diff --git a/.eslintignore b/.eslintignore
index 972c818d791bf4..93c69b4f9b2077 100644
--- a/.eslintignore
+++ b/.eslintignore
@@ -39,7 +39,7 @@ target
 /x-pack/legacy/plugins/maps/public/vendor/**
 
 # package overrides
-/packages/eslint-config-kibana
+/packages/elastic-eslint-config-kibana
 /packages/kbn-interpreter/src/common/lib/grammar.js
 /packages/kbn-plugin-generator/template
 /packages/kbn-pm/dist
diff --git a/.eslintrc.js b/.eslintrc.js
index ff4ac180c3774b..3161a25b708708 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -94,12 +94,6 @@ module.exports = {
         'jsx-a11y/no-onchange': 'off',
       },
     },
-    {
-      files: ['src/plugins/es_ui_shared/**/*.{js,mjs,ts,tsx}'],
-      rules: {
-        'react-hooks/exhaustive-deps': 'off',
-      },
-    },
     {
       files: ['src/plugins/kibana_react/**/*.{js,mjs,ts,tsx}'],
       rules: {
@@ -125,25 +119,12 @@ module.exports = {
         'jsx-a11y/click-events-have-key-events': 'off',
       },
     },
-    {
-      files: ['x-pack/legacy/plugins/index_management/**/*.{js,mjs,ts,tsx}'],
-      rules: {
-        'react-hooks/exhaustive-deps': 'off',
-        'react-hooks/rules-of-hooks': 'off',
-      },
-    },
     {
       files: ['x-pack/plugins/ml/**/*.{js,mjs,ts,tsx}'],
       rules: {
         'react-hooks/exhaustive-deps': 'off',
       },
     },
-    {
-      files: ['x-pack/legacy/plugins/snapshot_restore/**/*.{js,mjs,ts,tsx}'],
-      rules: {
-        'react-hooks/exhaustive-deps': 'off',
-      },
-    },
 
     /**
      * Files that require Apache 2.0 headers, settings
@@ -324,6 +305,8 @@ module.exports = {
                   '!src/core/server/mocks{,.ts}',
                   '!src/core/server/types{,.ts}',
                   '!src/core/server/test_utils{,.ts}',
+                  '!src/core/server/utils', // ts alias
+                  '!src/core/server/utils/**/*',
                   // for absolute imports until fixed in
                   // https://github.com/elastic/kibana/issues/36096
                   '!src/core/server/*.test.mocks{,.ts}',
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 1d0f6fc50ee9ba..bcb47744758497 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -63,6 +63,13 @@
 /src/plugins/apm_oss/  @elastic/apm-ui
 /src/apm.js @watson @vigneshshanmugam
 
+# Client Side Monitoring (lives in APM directories but owned by Uptime)
+/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum @elastic/uptime
+/x-pack/plugins/apm/public/application/csmApp.tsx @elastic/uptime
+/x-pack/plugins/apm/public/components/app/RumDashboard @elastic/uptime
+/x-pack/plugins/apm/server/lib/rum_client @elastic/uptime
+/x-pack/plugins/apm/server/routes/rum_client.ts @elastic/uptime
+
 # Beats
 /x-pack/legacy/plugins/beats_management/  @elastic/beats
 
@@ -209,8 +216,19 @@ x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json @elastic/kib
 /x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/ @elastic/kibana-alerting-services
 
 # Enterprise Search
-/x-pack/plugins/enterprise_search/ @elastic/app-search-frontend @elastic/workplace-search-frontend
-/x-pack/test/functional_enterprise_search/ @elastic/app-search-frontend @elastic/workplace-search-frontend
+# Shared
+/x-pack/plugins/enterprise_search/ @elastic/enterprise-search-frontend
+/x-pack/test/functional_enterprise_search/ @elastic/enterprise-search-frontend
+# App Search
+/x-pack/plugins/enterprise_search/public/applications/app_search @elastic/app-search-frontend
+/x-pack/plugins/enterprise_search/server/routes/app_search @elastic/app-search-frontend
+/x-pack/plugins/enterprise_search/server/collectors/app_search @elastic/app-search-frontend
+/x-pack/plugins/enterprise_search/server/saved_objects/app_search @elastic/app-search-frontend
+# Workplace Search
+/x-pack/plugins/enterprise_search/public/applications/workplace_search @elastic/workplace-search-frontend
+/x-pack/plugins/enterprise_search/server/routes/workplace_search @elastic/workplace-search-frontend
+/x-pack/plugins/enterprise_search/server/collectors/workplace_search @elastic/workplace-search-frontend
+/x-pack/plugins/enterprise_search/server/saved_objects/workplace_search @elastic/workplace-search-frontend
 
 # Elasticsearch UI
 /src/plugins/dev_tools/ @elastic/es-ui
diff --git a/.github/ISSUE_TEMPLATE/APM.md b/.github/ISSUE_TEMPLATE/APM.md
new file mode 100644
index 00000000000000..983806f70bc3fa
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/APM.md
@@ -0,0 +1,11 @@
+---
+name: APM Issue
+about: Issues related to the APM solution in Kibana
+labels: Team:apm
+title: [APM] 
+---
+
+**Versions**
+Kibana: (if relevant)
+APM Server: (if relevant)
+Elasticsearch: (if relevant)
diff --git a/.gitignore b/.gitignore
index 1d12ef2a9cff3a..1bbd38debbf0f8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -60,3 +60,6 @@ apm.tsconfig.json
 # release notes script output
 report.csv
 report.asciidoc
+
+# TS incremental build cache
+*.tsbuildinfo
diff --git a/NOTICE.txt b/NOTICE.txt
index e1552852d03493..d689abf4c4e05c 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -281,6 +281,13 @@ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
+---
+This product includes code in the function applyCubicBezierStyles that was
+inspired by a public Codepen, which was available under a "MIT" license.
+
+Copyright (c) 2020 by Guillaume (https://codepen.io/guillaumethomas/pen/xxbbBKO)
+MIT License http://www.opensource.org/licenses/mit-license
+
 ---
 This product includes code that is adapted from mapbox-gl-js, which is
 available under a "BSD-3-Clause" license.
diff --git a/docs/apm/apm-app-users.asciidoc b/docs/apm/apm-app-users.asciidoc
index d766c866f87e43..3f0a42251304c4 100644
--- a/docs/apm/apm-app-users.asciidoc
+++ b/docs/apm/apm-app-users.asciidoc
@@ -84,7 +84,7 @@ Here are two examples:
 | Allow the use of the the {beat_kib_app}
 
 | Spaces
-| `Read` or `All` on Dashboards, Visualize, and Discover
+| `Read` or `All` on Dashboards and Discover
 | Allow the user to view, edit, and create dashboards, as well as browse data.
 |====
 
diff --git a/docs/canvas/canvas-elements.asciidoc b/docs/canvas/canvas-elements.asciidoc
new file mode 100644
index 00000000000000..782bae061b8c11
--- /dev/null
+++ b/docs/canvas/canvas-elements.asciidoc
@@ -0,0 +1,167 @@
+[role="xpack"]
+[[add-canvas-elements]]
+=== Add elements
+
+Create a story about your data by adding elements to your workpad that include images, text, charts, and more. You can create your own elements and connect them to your data sources, add saved objects, and add your own images.
+
+[float]
+[[create-canvas-element]]
+==== Create an element
+
+Choose the type of element you want to use, then connect it to your own data.
+
+. Click *Add element*, then select the element you want to use.
++
+[role="screenshot"]
+image::images/canvas-element-select.gif[Canvas elements]
+
+. To familiarize yourself with the element, use the preconfigured data demo data.
++
+By default, most of the elements you create use demo data until you change the data source. The demo data includes a small data set that you can use to experiment with your element.
+
+. To connect the element to your data, select *Data*, then select one of the following data sources:
+
+* *{es} SQL* — Access your data in {es} using SQL syntax. For information about SQL syntax, refer to {ref}/sql-spec.html[SQL language].
+
+* *{es} documents* &mdash; Access your data in {es} without using aggregations. To use, select an index and fields, and optionally enter a query using the <<lucene-query,Lucene Query Syntax>>. Use the *{es} documents* data source when you have low volume datasets, to view raw documents, or to plot exact, non-aggregated values on a chart.
+
+* *Timelion* &mdash; Access your time series data using <<timelion,Timelion>> queries. To use Timelion queries, you can enter a query using the <<lucene-query,Lucene Query Syntax>>.
+
+Each element can display a different data source. Pages and workpads often contain multiple data sources.
+
+[float]
+[[canvas-add-object]]
+==== Add a saved object
+
+Add <<managing-saved-objects,saved objects>> to your workpad, such as maps and visualizations.
+
+. Click *Add element > Add from Visualize Library*.
+
+. Select the saved object you want to add.
++
+[role="screenshot"]
+image::images/canvas-map-embed.gif[]
+
+. To use the customization options, click the panel menu, then select one of the following options:
+
+* *Edit map* &mdash; Opens <<maps,Maps>> or <<create-panels,Dashboard>> so that you can edit the original saved object.
+
+* *Edit panel title* &mdash; Adds a title to the saved object.
+
+* *Customize time range* &mdash; Exposes a time filter dedicated to the saved object.
+
+* *Inspect* &mdash; Allows you to drill down into the element data.
+
+[float]
+[[canvas-add-image]]
+==== Add your own image
+
+To personalize your workpad, add your own logos and graphics.
+
+. Click *Add element > Manage assets*.
+
+. On the *Manage workpad assets* window, drag and drop your images.
+
+. To add the image to the workpad, click the *Create image element* icon.
++
+[role="screenshot"]
+image::images/canvas-add-image.gif[]
+
+[float]
+[[move-canvas-elements]]
+==== Organize elements
+
+Move and resize your elements to meet your design needs.
+
+* To move, click and hold the element, then drag to the new location.
+
+* To move by 1 pixel, select the element, press and hold Shift, then use your arrow keys.
+
+* To move by 10 pixels, select the element, then use your arrow keys.
+
+* To resize, click and drag the resize handles to the new dimensions.
+
+[float]
+[[format-canvas-elements]]
+==== Format elements
+
+For consistency and readability across your workpad pages, align, distribute, and reorder elements.
+
+To align two or more elements:
+
+. Press and hold Shift, then select the elements you want to align.
+
+. Click *Edit > Alignment*, then select the alignment option.
+
+To distribute three or more elements:
+
+. Press and hold Shift, then select the elements you want to distribute.
+
+. Click *Edit > Distribution*, then select the distribution option.
+
+To reorder elements:
+
+. Select the element you want to reorder.
+
+. Click *Edit > Order*, then select the order option.
+
+[float]
+[[data-display]]
+==== Change the element display options
+
+Each element has its own display options to fit your design needs.
+
+To choose the display options, click *Display*, then make your changes.
+
+To define the appearance of the container and border:
+
+. Next to *Element style*, click *+*, then select *Container style*.
+
+. Expand *Container style*.
+
+. Change the *Appearance* and *Border* options.
+
+To apply CSS overrides:
+
+. Next to *Element style*, click *+*, then select *CSS*.
+
+. Enter the *CSS*.
++
+For example, to center the Markdown element, enter:
++
+[source,text]
+--------------------------------------------------
+.canvasRenderEl h1 {
+text.align: center;
+}
+--------------------------------------------------
+
+. Click *Apply stylesheet*.
+
+[float]
+[[save-elements]]
+==== Save elements
+
+To use the elements across all workpads, save the elements.
+
+When you're ready to save your element, select the element, then click *Edit > Save as new element*.
+
+[role="screenshot"]
+image::images/canvas_save_element.png[]
+
+To save a group of elements, press and hold Shift, select the elements you want to save, then click *Edit > Save as new element*.
+
+To access your saved elements, click *Add element > My elements*.
+
+[float]
+[[delete-elements]]
+==== Delete elements
+
+When you no longer need an element, delete it from your workpad.
+
+. Select the element you want to delete.
+
+. Click *Edit > Delete*.
++
+[role="screenshot"]
+image::images/canvas_element_options.png[]
diff --git a/docs/canvas/canvas-tinymath-functions.asciidoc b/docs/canvas/canvas-tinymath-functions.asciidoc
index 73808fc6625d12..f92f7c642a2ee3 100644
--- a/docs/canvas/canvas-tinymath-functions.asciidoc
+++ b/docs/canvas/canvas-tinymath-functions.asciidoc
@@ -492,37 +492,6 @@ find the mean by index.
 |one or more numbers or arrays of numbers
 |===
 
-*Returns*: `number` | `Array.<number>`. The maximum value of all numbers if
-`args` contains only numbers. Returns an array with the the maximum values at each
-index, including all scalar numbers in `args` in the calculation at each index if
-`args` contains at least one array.
-
-*Throws*: `'Array length mismatch'` if `args` contains arrays of different lengths
-
-*Example*
-[source, js]
-------------
-max(1, 2, 3) // returns 3
-max([10, 20, 30, 40], 15) // returns [15, 20, 30, 40]
-max([1, 9], 4, [3, 5]) // returns [max([1, 4, 3]), max([9, 4, 5])] = [4, 9]
-------------
-
-[float]
-=== mean( ...args )
-
-Finds the mean value of one of more numbers/arrays of numbers passed into the function.
-If at least one array of numbers is passed into the function, the function will
-find the mean by index.
-
-[cols="3*^<"]
-|===
-|Param |Type |Description
-
-|...args
-|number \| Array.<number>
-|one or more numbers or arrays of numbers
-|===
-
 *Returns*: `number` | `Array.<number>`. The mean value of all numbers if `args`
 contains only numbers. Returns an array with the the mean values of each index,
 including all scalar numbers in `args` in the calculation at each index if `args`
diff --git a/docs/developer/contributing/development-accessibility-tests.asciidoc b/docs/developer/contributing/development-accessibility-tests.asciidoc
index facf7ff14a6c10..584d779bc7de6b 100644
--- a/docs/developer/contributing/development-accessibility-tests.asciidoc
+++ b/docs/developer/contributing/development-accessibility-tests.asciidoc
@@ -1,23 +1,104 @@
 [[development-accessibility-tests]]
 == Automated Accessibility Testing
 
+
+To write an accessibility test, use the provided accessibility service `getService('a11y')`. Accessibility tests are fairly straightforward to write as https://github.com/dequelabs/axe-core[axe] does most of the heavy lifting. Navigate to the UI that you need to test, then call `testAppSnapshot();` from the service imported earlier to make sure axe finds no failures. Navigate through every portion of the UI for the best coverage.
+
+An example test might look like this:
+[source,js]
+----
+export default function ({ getService, getPageObjects }) {
+  const { common, home } = getPageObjects(['common', 'home']);
+  const a11y = getService('a11y'); /* this is the wrapping service around axe */
+
+  describe('Kibana Home', () => {
+    before(async () => {
+      await common.navigateToApp('home'); /* navigates to the page we want to test */
+    });
+
+    it('Kibana Home view', async () => {
+      await retry.waitFor(
+        'home page visible',
+        async () => await testSubjects.exists('homeApp')
+      ); /* confirm you're on the correct page and that it's loaded */
+      await a11y.testAppSnapshot(); /* this expects that there are no failures found by axe */
+    });
+
+    /**
+     * If these tests were added by our QA team, tests that fail that require significant app code
+     * changes to be fixed will be skipped with a corresponding issue label with more info
+     */
+    // Skipped due to https://github.com/elastic/kibana/issues/99999
+    it.skip('all plugins view page meets a11y requirements', async () => {
+      await home.clickAllKibanaPlugins();
+      await a11y.testAppSnapshot();
+    });
+
+    /**
+     * Testing all the versions and different views of of a page is important to get good
+     * coverage. Things like empty states, different license levels, different permissions, and
+     * loaded data can all significantly change the UI which necessitates their own test.
+     */
+    it('Add Kibana sample data page', async () => {
+      await common.navigateToUrl('home', '/tutorial_directory/sampleData', {
+        useActualUrl: true,
+      });
+      await a11y.testAppSnapshot();
+    });
+  });
+}
+----
+
+=== Running tests
 To run the tests locally:
 
 [arabic]
-. In one terminal window run
-`node scripts/functional_tests_server --config test/accessibility/config.ts`
-. In another terminal window run
-`node scripts/functional_test_runner.js --config test/accessibility/config.ts`
+. In one terminal window run:
++
+[source,shell]
+-----------
+node scripts/functional_tests_server --config test/accessibility/config.ts
+-----------
+
+. When the server prints that it is ready, in another terminal window run:
++
+[source,shell]
+-----------
+node scripts/functional_test_runner.js --config test/accessibility/config.ts
+-----------
 
 To run the x-pack tests, swap the config file out for
 `x-pack/test/accessibility/config.ts`.
 
-After the server is up, you can go to this instance of {kib} at
-`localhost:5620`.
-
 The testing is done using https://github.com/dequelabs/axe-core[axe].
-The same thing that runs in CI, can be run locally using their browser
-plugins:
+You can run the same thing that runs CI using browser plugins:
 
 * https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US[Chrome]
-* https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/[Firefox]
\ No newline at end of file
+* https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/[Firefox]
+
+=== Anatomy of a failure
+
+Failures can seem confusing if you've never seen one before. Here is a breakdown of what a failure coming from CI might look like:
+[source,bash]
+----
+1)    Dashboard
+       create dashboard button:
+
+      Error: a11y report:
+
+ VIOLATION
+   [aria-hidden-focus]: Ensures aria-hidden elements do not contain focusable elements
+     Help: https://dequeuniversity.com/rules/axe/3.5/aria-hidden-focus?application=axeAPI
+     Elements:
+       - #example
+       at Accessibility.testAxeReport (test/accessibility/services/a11y/a11y.ts:90:15)
+       at Accessibility.testAppSnapshot (test/accessibility/services/a11y/a11y.ts:58:18)
+       at process._tickCallback (internal/process/next_tick.js:68:7)
+----
+
+
+* "Dashboard" and "create dashboard button" are the names of the test suite and specific test that failed.
+* Always in brackets, "[aria-hidden-focus]" is the name of the axe rule that failed, followed by a short description.
+* "Help: <url>" links to the axe documentation for that rule, including severity, remediation tips, and good and bad code examples.
+* "Elements:"  points to where in the DOM the failure originated (using CSS selector syntax). In this example, the problem came from an element with the ID `example`. If the selector is too complicated to find the source of the problem, use the browser plugins mentioned earlier to locate it. If you have a general idea where the issue is coming from, you can also try adding unique IDs to the page to narrow down the location.
+* The stack trace points to the internals of axe. The stack trace is there in case the test failure is a bug in axe and not in your code, although this is unlikely.
diff --git a/docs/developer/contributing/development-github.asciidoc b/docs/developer/contributing/development-github.asciidoc
index a6d4e29940487a..84f51843098a70 100644
--- a/docs/developer/contributing/development-github.asciidoc
+++ b/docs/developer/contributing/development-github.asciidoc
@@ -1,5 +1,5 @@
 [[development-github]]
-== How we use git and github
+== How we use Git and GitHub
 
 [discrete]
 === Forking
@@ -12,17 +12,21 @@ repo, which we'll refer to in later code snippets.
 [discrete]
 === Branching
 
-* All work on the next major release goes into master.
-* Past major release branches are named `{majorVersion}.x`. They contain
-work that will go into the next minor release. For example, if the next
-minor release is `5.2.0`, work for it should go into the `5.x` branch.
-* Past minor release branches are named `{majorVersion}.{minorVersion}`.
-They contain work that will go into the next patch release. For example,
-if the next patch release is `5.3.1`, work for it should go into the
-`5.3` branch.
-* All work is done on feature branches and merged into one of these
-branches.
-* Where appropriate, we'll backport changes into older release branches.
+At Elastic, all products in the stack, including Kibana, are released at the same time with the same version number. Most of these projects have the following branching strategy:
+
+* `master` is the next major version.
+* `<major>.x` is the next minor version.
+* `<major>.<minor>` is the next release of a minor version, including patch releases.
+
+As an example, let's assume that the `7.x` branch is currently a not-yet-released `7.6.0`. Once `7.6.0` has reached feature freeze, it will be branched to `7.6` and `7.x` will be updated to reflect `7.7.0`. The release of `7.6.0` and subsequent patch releases will be cut from the `7.6` branch. At any time, you can verify the current version of a branch by inspecting the `version` attribute in the `package.json` file within the Kibana source.
+
+Pull requests are made into the `master` branch and then backported when it is safe and appropriate.
+
+* Breaking changes do not get backported and only go into `master`.
+* All non-breaking changes can be backported to the `<major>.x` branch.
+* Features should not be backported to a `<major>.<minor>` branch.
+* Bugs can be backported to a `<major>.<minor>` branch if the changes are safe and appropriate. Safety is a judgment call you make based on factors like the bug's severity, test coverage, confidence in the changes, etc. Your reasoning should be included in the pull request description.
+* Documentation changes can be backported to any branch at any time.
 
 [discrete]
 === Commits and Merging
@@ -109,4 +113,4 @@ Assuming you've successfully rebased and you're happy with the code, you should
 [discrete]
 === Creating a pull request
 
-See <<development-pull-request>> for the next steps on getting your code changes merged into {kib}.
\ No newline at end of file
+See <<development-pull-request>> for the next steps on getting your code changes merged into {kib}.
diff --git a/docs/developer/getting-started/running-kibana-advanced.asciidoc b/docs/developer/getting-started/running-kibana-advanced.asciidoc
index 44897184f88f25..277e52a3dc8e91 100644
--- a/docs/developer/getting-started/running-kibana-advanced.asciidoc
+++ b/docs/developer/getting-started/running-kibana-advanced.asciidoc
@@ -48,7 +48,7 @@ If you’re installing dependencies and seeing an error that looks
 something like
 
 ....
-Unsupported URL Type: link:packages/eslint-config-kibana
+Unsupported URL Type: link:packages/elastic-eslint-config-kibana
 ....
 
 you’re likely running `npm`. To install dependencies in {kib} you
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.capabilities.md b/docs/development/core/public/kibana-plugin-core-public.app.capabilities.md
new file mode 100644
index 00000000000000..4a027a6ab132cc
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.capabilities.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [capabilities](./kibana-plugin-core-public.app.capabilities.md)
+
+## App.capabilities property
+
+Custom capabilities defined by the app.
+
+<b>Signature:</b>
+
+```typescript
+capabilities?: Partial<Capabilities>;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.category.md b/docs/development/core/public/kibana-plugin-core-public.app.category.md
new file mode 100644
index 00000000000000..a1e74f2bcf5e2f
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.category.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [category](./kibana-plugin-core-public.app.category.md)
+
+## App.category property
+
+The category definition of the product See [AppCategory](./kibana-plugin-core-public.appcategory.md) See DEFAULT\_APP\_CATEGORIES for more reference
+
+<b>Signature:</b>
+
+```typescript
+category?: AppCategory;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.defaultpath.md b/docs/development/core/public/kibana-plugin-core-public.app.defaultpath.md
new file mode 100644
index 00000000000000..3c952ec053e625
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.defaultpath.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [defaultPath](./kibana-plugin-core-public.app.defaultpath.md)
+
+## App.defaultPath property
+
+Allow to define the default path a user should be directed to when navigating to the app. When defined, this value will be used as a default for the `path` option when calling [navigateToApp](./kibana-plugin-core-public.applicationstart.navigatetoapp.md)<!-- -->\`<!-- -->, and will also be appended to the [application navLink](./kibana-plugin-core-public.chromenavlink.md) in the navigation bar.
+
+<b>Signature:</b>
+
+```typescript
+defaultPath?: string;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.euiicontype.md b/docs/development/core/public/kibana-plugin-core-public.app.euiicontype.md
new file mode 100644
index 00000000000000..ff79d832f92e2b
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.euiicontype.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [euiIconType](./kibana-plugin-core-public.app.euiicontype.md)
+
+## App.euiIconType property
+
+A EUI iconType that will be used for the app's icon. This icon takes precendence over the `icon` property.
+
+<b>Signature:</b>
+
+```typescript
+euiIconType?: string;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.icon.md b/docs/development/core/public/kibana-plugin-core-public.app.icon.md
new file mode 100644
index 00000000000000..98260da5d20219
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.icon.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [icon](./kibana-plugin-core-public.app.icon.md)
+
+## App.icon property
+
+A URL to an image file used as an icon. Used as a fallback if `euiIconType` is not provided.
+
+<b>Signature:</b>
+
+```typescript
+icon?: string;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.id.md b/docs/development/core/public/kibana-plugin-core-public.app.id.md
new file mode 100644
index 00000000000000..9899cfc0cf572e
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.id.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [id](./kibana-plugin-core-public.app.id.md)
+
+## App.id property
+
+The unique identifier of the application
+
+<b>Signature:</b>
+
+```typescript
+id: string;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.md b/docs/development/core/public/kibana-plugin-core-public.app.md
index 8dd60972549f9a..7bdee9dc4c53eb 100644
--- a/docs/development/core/public/kibana-plugin-core-public.app.md
+++ b/docs/development/core/public/kibana-plugin-core-public.app.md
@@ -4,12 +4,11 @@
 
 ## App interface
 
-Extension of [common app properties](./kibana-plugin-core-public.appbase.md) with the mount function.
 
 <b>Signature:</b>
 
 ```typescript
-export interface App<HistoryLocationState = unknown> extends AppBase 
+export interface App<HistoryLocationState = unknown> 
 ```
 
 ## Properties
@@ -17,7 +16,19 @@ export interface App<HistoryLocationState = unknown> extends AppBase
 |  Property | Type | Description |
 |  --- | --- | --- |
 |  [appRoute](./kibana-plugin-core-public.app.approute.md) | <code>string</code> | Override the application's routing path from <code>/app/${id}</code>. Must be unique across registered applications. Should not include the base path from HTTP. |
+|  [capabilities](./kibana-plugin-core-public.app.capabilities.md) | <code>Partial&lt;Capabilities&gt;</code> | Custom capabilities defined by the app. |
+|  [category](./kibana-plugin-core-public.app.category.md) | <code>AppCategory</code> | The category definition of the product See [AppCategory](./kibana-plugin-core-public.appcategory.md) See DEFAULT\_APP\_CATEGORIES for more reference |
 |  [chromeless](./kibana-plugin-core-public.app.chromeless.md) | <code>boolean</code> | Hide the UI chrome when the application is mounted. Defaults to <code>false</code>. Takes precedence over chrome service visibility settings. |
+|  [defaultPath](./kibana-plugin-core-public.app.defaultpath.md) | <code>string</code> | Allow to define the default path a user should be directed to when navigating to the app. When defined, this value will be used as a default for the <code>path</code> option when calling [navigateToApp](./kibana-plugin-core-public.applicationstart.navigatetoapp.md)<!-- -->\`<!-- -->, and will also be appended to the [application navLink](./kibana-plugin-core-public.chromenavlink.md) in the navigation bar. |
+|  [euiIconType](./kibana-plugin-core-public.app.euiicontype.md) | <code>string</code> | A EUI iconType that will be used for the app's icon. This icon takes precendence over the <code>icon</code> property. |
 |  [exactRoute](./kibana-plugin-core-public.app.exactroute.md) | <code>boolean</code> | If set to true, the application's route will only be checked against an exact match. Defaults to <code>false</code>. |
+|  [icon](./kibana-plugin-core-public.app.icon.md) | <code>string</code> | A URL to an image file used as an icon. Used as a fallback if <code>euiIconType</code> is not provided. |
+|  [id](./kibana-plugin-core-public.app.id.md) | <code>string</code> | The unique identifier of the application |
 |  [mount](./kibana-plugin-core-public.app.mount.md) | <code>AppMount&lt;HistoryLocationState&gt; &#124; AppMountDeprecated&lt;HistoryLocationState&gt;</code> | A mount function called when the user navigates to this app's route. May have signature of [AppMount](./kibana-plugin-core-public.appmount.md) or [AppMountDeprecated](./kibana-plugin-core-public.appmountdeprecated.md)<!-- -->. |
+|  [navLinkStatus](./kibana-plugin-core-public.app.navlinkstatus.md) | <code>AppNavLinkStatus</code> | The initial status of the application's navLink. Defaulting to <code>visible</code> if <code>status</code> is <code>accessible</code> and <code>hidden</code> if status is <code>inaccessible</code> See [AppNavLinkStatus](./kibana-plugin-core-public.appnavlinkstatus.md) |
+|  [order](./kibana-plugin-core-public.app.order.md) | <code>number</code> | An ordinal used to sort nav links relative to one another for display. |
+|  [status](./kibana-plugin-core-public.app.status.md) | <code>AppStatus</code> | The initial status of the application. Defaulting to <code>accessible</code> |
+|  [title](./kibana-plugin-core-public.app.title.md) | <code>string</code> | The title of the application. |
+|  [tooltip](./kibana-plugin-core-public.app.tooltip.md) | <code>string</code> | A tooltip shown when hovering over app link. |
+|  [updater$](./kibana-plugin-core-public.app.updater_.md) | <code>Observable&lt;AppUpdater&gt;</code> | An [AppUpdater](./kibana-plugin-core-public.appupdater.md) observable that can be used to update the application [AppUpdatableFields](./kibana-plugin-core-public.appupdatablefields.md) at runtime. |
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.navlinkstatus.md b/docs/development/core/public/kibana-plugin-core-public.app.navlinkstatus.md
new file mode 100644
index 00000000000000..c01a26e42e2373
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.navlinkstatus.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [navLinkStatus](./kibana-plugin-core-public.app.navlinkstatus.md)
+
+## App.navLinkStatus property
+
+The initial status of the application's navLink. Defaulting to `visible` if `status` is `accessible` and `hidden` if status is `inaccessible` See [AppNavLinkStatus](./kibana-plugin-core-public.appnavlinkstatus.md)
+
+<b>Signature:</b>
+
+```typescript
+navLinkStatus?: AppNavLinkStatus;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.order.md b/docs/development/core/public/kibana-plugin-core-public.app.order.md
new file mode 100644
index 00000000000000..bb6be116b6b587
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.order.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [order](./kibana-plugin-core-public.app.order.md)
+
+## App.order property
+
+An ordinal used to sort nav links relative to one another for display.
+
+<b>Signature:</b>
+
+```typescript
+order?: number;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.status.md b/docs/development/core/public/kibana-plugin-core-public.app.status.md
new file mode 100644
index 00000000000000..caa6ff1dcac9e7
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.status.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [status](./kibana-plugin-core-public.app.status.md)
+
+## App.status property
+
+The initial status of the application. Defaulting to `accessible`
+
+<b>Signature:</b>
+
+```typescript
+status?: AppStatus;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.title.md b/docs/development/core/public/kibana-plugin-core-public.app.title.md
new file mode 100644
index 00000000000000..c705e3ab8d2b13
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.title.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [title](./kibana-plugin-core-public.app.title.md)
+
+## App.title property
+
+The title of the application.
+
+<b>Signature:</b>
+
+```typescript
+title: string;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.tooltip.md b/docs/development/core/public/kibana-plugin-core-public.app.tooltip.md
new file mode 100644
index 00000000000000..e901de0fdccc98
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.tooltip.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [tooltip](./kibana-plugin-core-public.app.tooltip.md)
+
+## App.tooltip property
+
+A tooltip shown when hovering over app link.
+
+<b>Signature:</b>
+
+```typescript
+tooltip?: string;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.updater_.md b/docs/development/core/public/kibana-plugin-core-public.app.updater_.md
new file mode 100644
index 00000000000000..67acccbd02965d
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.app.updater_.md
@@ -0,0 +1,44 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [App](./kibana-plugin-core-public.app.md) &gt; [updater$](./kibana-plugin-core-public.app.updater_.md)
+
+## App.updater$ property
+
+An [AppUpdater](./kibana-plugin-core-public.appupdater.md) observable that can be used to update the application [AppUpdatableFields](./kibana-plugin-core-public.appupdatablefields.md) at runtime.
+
+<b>Signature:</b>
+
+```typescript
+updater$?: Observable<AppUpdater>;
+```
+
+## Example
+
+How to update an application navLink at runtime
+
+```ts
+// inside your plugin's setup function
+export class MyPlugin implements Plugin {
+  private appUpdater = new BehaviorSubject<AppUpdater>(() => ({}));
+
+  setup({ application }) {
+    application.register({
+      id: 'my-app',
+      title: 'My App',
+      updater$: this.appUpdater,
+      async mount(params) {
+        const { renderApp } = await import('./application');
+        return renderApp(params);
+      },
+    });
+  }
+
+  start() {
+     // later, when the navlink needs to be updated
+     appUpdater.next(() => {
+       navLinkStatus: AppNavLinkStatus.disabled,
+     })
+  }
+
+```
+
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.capabilities.md b/docs/development/core/public/kibana-plugin-core-public.appbase.capabilities.md
deleted file mode 100644
index 3dd440c4253b32..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.capabilities.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [capabilities](./kibana-plugin-core-public.appbase.capabilities.md)
-
-## AppBase.capabilities property
-
-Custom capabilities defined by the app.
-
-<b>Signature:</b>
-
-```typescript
-capabilities?: Partial<Capabilities>;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.category.md b/docs/development/core/public/kibana-plugin-core-public.appbase.category.md
deleted file mode 100644
index 29532a15747e16..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.category.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [category](./kibana-plugin-core-public.appbase.category.md)
-
-## AppBase.category property
-
-The category definition of the product See [AppCategory](./kibana-plugin-core-public.appcategory.md) See DEFAULT\_APP\_CATEGORIES for more reference
-
-<b>Signature:</b>
-
-```typescript
-category?: AppCategory;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.chromeless.md b/docs/development/core/public/kibana-plugin-core-public.appbase.chromeless.md
deleted file mode 100644
index 793eab4b5bdfa1..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.chromeless.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [chromeless](./kibana-plugin-core-public.appbase.chromeless.md)
-
-## AppBase.chromeless property
-
-Hide the UI chrome when the application is mounted. Defaults to `false`<!-- -->. Takes precedence over chrome service visibility settings.
-
-<b>Signature:</b>
-
-```typescript
-chromeless?: boolean;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.defaultpath.md b/docs/development/core/public/kibana-plugin-core-public.appbase.defaultpath.md
deleted file mode 100644
index 51492756ef2327..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.defaultpath.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [defaultPath](./kibana-plugin-core-public.appbase.defaultpath.md)
-
-## AppBase.defaultPath property
-
-Allow to define the default path a user should be directed to when navigating to the app. When defined, this value will be used as a default for the `path` option when calling [navigateToApp](./kibana-plugin-core-public.applicationstart.navigatetoapp.md)<!-- -->\`<!-- -->, and will also be appended to the [application navLink](./kibana-plugin-core-public.chromenavlink.md) in the navigation bar.
-
-<b>Signature:</b>
-
-```typescript
-defaultPath?: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.euiicontype.md b/docs/development/core/public/kibana-plugin-core-public.appbase.euiicontype.md
deleted file mode 100644
index e5bfa38097361f..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.euiicontype.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [euiIconType](./kibana-plugin-core-public.appbase.euiicontype.md)
-
-## AppBase.euiIconType property
-
-A EUI iconType that will be used for the app's icon. This icon takes precendence over the `icon` property.
-
-<b>Signature:</b>
-
-```typescript
-euiIconType?: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.icon.md b/docs/development/core/public/kibana-plugin-core-public.appbase.icon.md
deleted file mode 100644
index 0bd67922dc39c9..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.icon.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [icon](./kibana-plugin-core-public.appbase.icon.md)
-
-## AppBase.icon property
-
-A URL to an image file used as an icon. Used as a fallback if `euiIconType` is not provided.
-
-<b>Signature:</b>
-
-```typescript
-icon?: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.id.md b/docs/development/core/public/kibana-plugin-core-public.appbase.id.md
deleted file mode 100644
index 6c0ec462fa16ba..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.id.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [id](./kibana-plugin-core-public.appbase.id.md)
-
-## AppBase.id property
-
-The unique identifier of the application
-
-<b>Signature:</b>
-
-```typescript
-id: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.md b/docs/development/core/public/kibana-plugin-core-public.appbase.md
deleted file mode 100644
index 7b624f12ac1df0..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.md
+++ /dev/null
@@ -1,31 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md)
-
-## AppBase interface
-
-
-<b>Signature:</b>
-
-```typescript
-export interface AppBase 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [capabilities](./kibana-plugin-core-public.appbase.capabilities.md) | <code>Partial&lt;Capabilities&gt;</code> | Custom capabilities defined by the app. |
-|  [category](./kibana-plugin-core-public.appbase.category.md) | <code>AppCategory</code> | The category definition of the product See [AppCategory](./kibana-plugin-core-public.appcategory.md) See DEFAULT\_APP\_CATEGORIES for more reference |
-|  [chromeless](./kibana-plugin-core-public.appbase.chromeless.md) | <code>boolean</code> | Hide the UI chrome when the application is mounted. Defaults to <code>false</code>. Takes precedence over chrome service visibility settings. |
-|  [defaultPath](./kibana-plugin-core-public.appbase.defaultpath.md) | <code>string</code> | Allow to define the default path a user should be directed to when navigating to the app. When defined, this value will be used as a default for the <code>path</code> option when calling [navigateToApp](./kibana-plugin-core-public.applicationstart.navigatetoapp.md)<!-- -->\`<!-- -->, and will also be appended to the [application navLink](./kibana-plugin-core-public.chromenavlink.md) in the navigation bar. |
-|  [euiIconType](./kibana-plugin-core-public.appbase.euiicontype.md) | <code>string</code> | A EUI iconType that will be used for the app's icon. This icon takes precendence over the <code>icon</code> property. |
-|  [icon](./kibana-plugin-core-public.appbase.icon.md) | <code>string</code> | A URL to an image file used as an icon. Used as a fallback if <code>euiIconType</code> is not provided. |
-|  [id](./kibana-plugin-core-public.appbase.id.md) | <code>string</code> | The unique identifier of the application |
-|  [navLinkStatus](./kibana-plugin-core-public.appbase.navlinkstatus.md) | <code>AppNavLinkStatus</code> | The initial status of the application's navLink. Defaulting to <code>visible</code> if <code>status</code> is <code>accessible</code> and <code>hidden</code> if status is <code>inaccessible</code> See [AppNavLinkStatus](./kibana-plugin-core-public.appnavlinkstatus.md) |
-|  [order](./kibana-plugin-core-public.appbase.order.md) | <code>number</code> | An ordinal used to sort nav links relative to one another for display. |
-|  [status](./kibana-plugin-core-public.appbase.status.md) | <code>AppStatus</code> | The initial status of the application. Defaulting to <code>accessible</code> |
-|  [title](./kibana-plugin-core-public.appbase.title.md) | <code>string</code> | The title of the application. |
-|  [tooltip](./kibana-plugin-core-public.appbase.tooltip.md) | <code>string</code> | A tooltip shown when hovering over app link. |
-|  [updater$](./kibana-plugin-core-public.appbase.updater_.md) | <code>Observable&lt;AppUpdater&gt;</code> | An [AppUpdater](./kibana-plugin-core-public.appupdater.md) observable that can be used to update the application [AppUpdatableFields](./kibana-plugin-core-public.appupdatablefields.md) at runtime. |
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.navlinkstatus.md b/docs/development/core/public/kibana-plugin-core-public.appbase.navlinkstatus.md
deleted file mode 100644
index decfb235b28583..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.navlinkstatus.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [navLinkStatus](./kibana-plugin-core-public.appbase.navlinkstatus.md)
-
-## AppBase.navLinkStatus property
-
-The initial status of the application's navLink. Defaulting to `visible` if `status` is `accessible` and `hidden` if status is `inaccessible` See [AppNavLinkStatus](./kibana-plugin-core-public.appnavlinkstatus.md)
-
-<b>Signature:</b>
-
-```typescript
-navLinkStatus?: AppNavLinkStatus;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.order.md b/docs/development/core/public/kibana-plugin-core-public.appbase.order.md
deleted file mode 100644
index 606a40e72d592c..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.order.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [order](./kibana-plugin-core-public.appbase.order.md)
-
-## AppBase.order property
-
-An ordinal used to sort nav links relative to one another for display.
-
-<b>Signature:</b>
-
-```typescript
-order?: number;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.status.md b/docs/development/core/public/kibana-plugin-core-public.appbase.status.md
deleted file mode 100644
index 4d6ba6ebd955ef..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.status.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [status](./kibana-plugin-core-public.appbase.status.md)
-
-## AppBase.status property
-
-The initial status of the application. Defaulting to `accessible`
-
-<b>Signature:</b>
-
-```typescript
-status?: AppStatus;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.title.md b/docs/development/core/public/kibana-plugin-core-public.appbase.title.md
deleted file mode 100644
index d6058badee8e89..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.title.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [title](./kibana-plugin-core-public.appbase.title.md)
-
-## AppBase.title property
-
-The title of the application.
-
-<b>Signature:</b>
-
-```typescript
-title: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.tooltip.md b/docs/development/core/public/kibana-plugin-core-public.appbase.tooltip.md
deleted file mode 100644
index 0c0b0840eb9210..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.tooltip.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [tooltip](./kibana-plugin-core-public.appbase.tooltip.md)
-
-## AppBase.tooltip property
-
-A tooltip shown when hovering over app link.
-
-<b>Signature:</b>
-
-```typescript
-tooltip?: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appbase.updater_.md b/docs/development/core/public/kibana-plugin-core-public.appbase.updater_.md
deleted file mode 100644
index c2c572755f9b20..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.appbase.updater_.md
+++ /dev/null
@@ -1,44 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppBase](./kibana-plugin-core-public.appbase.md) &gt; [updater$](./kibana-plugin-core-public.appbase.updater_.md)
-
-## AppBase.updater$ property
-
-An [AppUpdater](./kibana-plugin-core-public.appupdater.md) observable that can be used to update the application [AppUpdatableFields](./kibana-plugin-core-public.appupdatablefields.md) at runtime.
-
-<b>Signature:</b>
-
-```typescript
-updater$?: Observable<AppUpdater>;
-```
-
-## Example
-
-How to update an application navLink at runtime
-
-```ts
-// inside your plugin's setup function
-export class MyPlugin implements Plugin {
-  private appUpdater = new BehaviorSubject<AppUpdater>(() => ({}));
-
-  setup({ application }) {
-    application.register({
-      id: 'my-app',
-      title: 'My App',
-      updater$: this.appUpdater,
-      async mount(params) {
-        const { renderApp } = await import('./application');
-        return renderApp(params);
-      },
-    });
-  }
-
-  start() {
-     // later, when the navlink needs to be updated
-     appUpdater.next(() => {
-       navLinkStatus: AppNavLinkStatus.disabled,
-     })
-  }
-
-```
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.applicationstart.applications_.md b/docs/development/core/public/kibana-plugin-core-public.applicationstart.applications_.md
index d428faa500faf0..bcc5435f35951a 100644
--- a/docs/development/core/public/kibana-plugin-core-public.applicationstart.applications_.md
+++ b/docs/development/core/public/kibana-plugin-core-public.applicationstart.applications_.md
@@ -9,7 +9,7 @@ Observable emitting the list of currently registered apps and their associated s
 <b>Signature:</b>
 
 ```typescript
-applications$: Observable<ReadonlyMap<string, PublicAppInfo | PublicLegacyAppInfo>>;
+applications$: Observable<ReadonlyMap<string, PublicAppInfo>>;
 ```
 
 ## Remarks
diff --git a/docs/development/core/public/kibana-plugin-core-public.applicationstart.md b/docs/development/core/public/kibana-plugin-core-public.applicationstart.md
index 896de2de32dd51..00318f32984e9b 100644
--- a/docs/development/core/public/kibana-plugin-core-public.applicationstart.md
+++ b/docs/development/core/public/kibana-plugin-core-public.applicationstart.md
@@ -15,7 +15,7 @@ export interface ApplicationStart
 
 |  Property | Type | Description |
 |  --- | --- | --- |
-|  [applications$](./kibana-plugin-core-public.applicationstart.applications_.md) | <code>Observable&lt;ReadonlyMap&lt;string, PublicAppInfo &#124; PublicLegacyAppInfo&gt;&gt;</code> | Observable emitting the list of currently registered apps and their associated status. |
+|  [applications$](./kibana-plugin-core-public.applicationstart.applications_.md) | <code>Observable&lt;ReadonlyMap&lt;string, PublicAppInfo&gt;&gt;</code> | Observable emitting the list of currently registered apps and their associated status. |
 |  [capabilities](./kibana-plugin-core-public.applicationstart.capabilities.md) | <code>RecursiveReadonly&lt;Capabilities&gt;</code> | Gets the read-only capabilities. |
 |  [currentAppId$](./kibana-plugin-core-public.applicationstart.currentappid_.md) | <code>Observable&lt;string &#124; undefined&gt;</code> | An observable that emits the current application id and each subsequent id update. |
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.appmountparameters.md b/docs/development/core/public/kibana-plugin-core-public.appmountparameters.md
index de79fc8281c45f..f6c57603beddec 100644
--- a/docs/development/core/public/kibana-plugin-core-public.appmountparameters.md
+++ b/docs/development/core/public/kibana-plugin-core-public.appmountparameters.md
@@ -19,4 +19,5 @@ export interface AppMountParameters<HistoryLocationState = unknown>
 |  [element](./kibana-plugin-core-public.appmountparameters.element.md) | <code>HTMLElement</code> | The container element to render the application into. |
 |  [history](./kibana-plugin-core-public.appmountparameters.history.md) | <code>ScopedHistory&lt;HistoryLocationState&gt;</code> | A scoped history instance for your application. Should be used to wire up your applications Router. |
 |  [onAppLeave](./kibana-plugin-core-public.appmountparameters.onappleave.md) | <code>(handler: AppLeaveHandler) =&gt; void</code> | A function that can be used to register a handler that will be called when the user is leaving the current application, allowing to prompt a confirmation message before actually changing the page.<!-- -->This will be called either when the user goes to another application, or when trying to close the tab or manually changing the url. |
+|  [setHeaderActionMenu](./kibana-plugin-core-public.appmountparameters.setheaderactionmenu.md) | <code>(menuMount: MountPoint &#124; undefined) =&gt; void</code> | A function that can be used to set the mount point used to populate the application action container in the chrome header.<!-- -->Calling the handler multiple time will erase the current content of the action menu with the mount from the latest call. Calling the handler with <code>undefined</code> will unmount the current mount point. Calling the handler after the application has been unmounted will have no effect. |
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.appmountparameters.setheaderactionmenu.md b/docs/development/core/public/kibana-plugin-core-public.appmountparameters.setheaderactionmenu.md
new file mode 100644
index 00000000000000..ca9cee64bb1f92
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.appmountparameters.setheaderactionmenu.md
@@ -0,0 +1,39 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [AppMountParameters](./kibana-plugin-core-public.appmountparameters.md) &gt; [setHeaderActionMenu](./kibana-plugin-core-public.appmountparameters.setheaderactionmenu.md)
+
+## AppMountParameters.setHeaderActionMenu property
+
+A function that can be used to set the mount point used to populate the application action container in the chrome header.
+
+Calling the handler multiple time will erase the current content of the action menu with the mount from the latest call. Calling the handler with `undefined` will unmount the current mount point. Calling the handler after the application has been unmounted will have no effect.
+
+<b>Signature:</b>
+
+```typescript
+setHeaderActionMenu: (menuMount: MountPoint | undefined) => void;
+```
+
+## Example
+
+
+```ts
+// application.tsx
+import React from 'react';
+import ReactDOM from 'react-dom';
+import { BrowserRouter, Route } from 'react-router-dom';
+
+import { CoreStart, AppMountParameters } from 'src/core/public';
+import { MyPluginDepsStart } from './plugin';
+
+export renderApp = ({ element, history, setHeaderActionMenu }: AppMountParameters) => {
+   const { renderApp } = await import('./application');
+   const { renderActionMenu } = await import('./action_menu');
+   setHeaderActionMenu((element) => {
+     return renderActionMenu(element);
+   })
+   return renderApp({ element, history });
+}
+
+```
+
diff --git a/docs/development/core/public/kibana-plugin-core-public.appupdatablefields.md b/docs/development/core/public/kibana-plugin-core-public.appupdatablefields.md
index 3d8b5d115c8a27..1232b7f9402552 100644
--- a/docs/development/core/public/kibana-plugin-core-public.appupdatablefields.md
+++ b/docs/development/core/public/kibana-plugin-core-public.appupdatablefields.md
@@ -9,5 +9,5 @@ Defines the list of fields that can be updated via an [AppUpdater](./kibana-plug
 <b>Signature:</b>
 
 ```typescript
-export declare type AppUpdatableFields = Pick<AppBase, 'status' | 'navLinkStatus' | 'tooltip' | 'defaultPath'>;
+export declare type AppUpdatableFields = Pick<App, 'status' | 'navLinkStatus' | 'tooltip' | 'defaultPath'>;
 ```
diff --git a/docs/development/core/public/kibana-plugin-core-public.appupdater.md b/docs/development/core/public/kibana-plugin-core-public.appupdater.md
index a1c1424132da63..744c52f221da77 100644
--- a/docs/development/core/public/kibana-plugin-core-public.appupdater.md
+++ b/docs/development/core/public/kibana-plugin-core-public.appupdater.md
@@ -9,5 +9,5 @@ Updater for applications. see [ApplicationSetup](./kibana-plugin-core-public.app
 <b>Signature:</b>
 
 ```typescript
-export declare type AppUpdater = (app: AppBase) => Partial<AppUpdatableFields> | undefined;
+export declare type AppUpdater = (app: App) => Partial<AppUpdatableFields> | undefined;
 ```
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.active.md b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.active.md
deleted file mode 100644
index fb8a6eb691b420..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.active.md
+++ /dev/null
@@ -1,17 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [ChromeNavLink](./kibana-plugin-core-public.chromenavlink.md) &gt; [active](./kibana-plugin-core-public.chromenavlink.active.md)
-
-## ChromeNavLink.active property
-
-> Warning: This API is now obsolete.
-> 
-> 
-
-Indicates whether or not this app is currently on the screen.
-
-<b>Signature:</b>
-
-```typescript
-readonly active?: boolean;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.disabled.md b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.disabled.md
index 9e1aefb79ad398..2b4d22be187f9d 100644
--- a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.disabled.md
+++ b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.disabled.md
@@ -4,10 +4,6 @@
 
 ## ChromeNavLink.disabled property
 
-> Warning: This API is now obsolete.
-> 
-> 
-
 Disables a link from being clickable.
 
 <b>Signature:</b>
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.disablesuburltracking.md b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.disablesuburltracking.md
deleted file mode 100644
index 843fd959d262ae..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.disablesuburltracking.md
+++ /dev/null
@@ -1,17 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [ChromeNavLink](./kibana-plugin-core-public.chromenavlink.md) &gt; [disableSubUrlTracking](./kibana-plugin-core-public.chromenavlink.disablesuburltracking.md)
-
-## ChromeNavLink.disableSubUrlTracking property
-
-> Warning: This API is now obsolete.
-> 
-> 
-
-A flag that tells legacy chrome to ignore the link when tracking sub-urls
-
-<b>Signature:</b>
-
-```typescript
-readonly disableSubUrlTracking?: boolean;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.href.md b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.href.md
index a8af0c997ca780..f51fa7e5b1355c 100644
--- a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.href.md
+++ b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.href.md
@@ -9,5 +9,5 @@ Settled state between `url`<!-- -->, `baseUrl`<!-- -->, and `active`
 <b>Signature:</b>
 
 ```typescript
-readonly href?: string;
+readonly href: string;
 ```
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.linktolastsuburl.md b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.linktolastsuburl.md
deleted file mode 100644
index 0b6d6ae1297440..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.linktolastsuburl.md
+++ /dev/null
@@ -1,17 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [ChromeNavLink](./kibana-plugin-core-public.chromenavlink.md) &gt; [linkToLastSubUrl](./kibana-plugin-core-public.chromenavlink.linktolastsuburl.md)
-
-## ChromeNavLink.linkToLastSubUrl property
-
-> Warning: This API is now obsolete.
-> 
-> 
-
-Whether or not the subUrl feature should be enabled.
-
-<b>Signature:</b>
-
-```typescript
-readonly linkToLastSubUrl?: boolean;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.md b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.md
index 0349e865bff97f..dfe8f119505aa8 100644
--- a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.md
+++ b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.md
@@ -15,20 +15,16 @@ export interface ChromeNavLink
 
 |  Property | Type | Description |
 |  --- | --- | --- |
-|  [active](./kibana-plugin-core-public.chromenavlink.active.md) | <code>boolean</code> | Indicates whether or not this app is currently on the screen. |
 |  [baseUrl](./kibana-plugin-core-public.chromenavlink.baseurl.md) | <code>string</code> | The base route used to open the root of an application. |
 |  [category](./kibana-plugin-core-public.chromenavlink.category.md) | <code>AppCategory</code> | The category the app lives in |
 |  [disabled](./kibana-plugin-core-public.chromenavlink.disabled.md) | <code>boolean</code> | Disables a link from being clickable. |
-|  [disableSubUrlTracking](./kibana-plugin-core-public.chromenavlink.disablesuburltracking.md) | <code>boolean</code> | A flag that tells legacy chrome to ignore the link when tracking sub-urls |
 |  [euiIconType](./kibana-plugin-core-public.chromenavlink.euiicontype.md) | <code>string</code> | A EUI iconType that will be used for the app's icon. This icon takes precedence over the <code>icon</code> property. |
 |  [hidden](./kibana-plugin-core-public.chromenavlink.hidden.md) | <code>boolean</code> | Hides a link from the navigation. |
 |  [href](./kibana-plugin-core-public.chromenavlink.href.md) | <code>string</code> | Settled state between <code>url</code>, <code>baseUrl</code>, and <code>active</code> |
 |  [icon](./kibana-plugin-core-public.chromenavlink.icon.md) | <code>string</code> | A URL to an image file used as an icon. Used as a fallback if <code>euiIconType</code> is not provided. |
 |  [id](./kibana-plugin-core-public.chromenavlink.id.md) | <code>string</code> | A unique identifier for looking up links. |
-|  [linkToLastSubUrl](./kibana-plugin-core-public.chromenavlink.linktolastsuburl.md) | <code>boolean</code> | Whether or not the subUrl feature should be enabled. |
 |  [order](./kibana-plugin-core-public.chromenavlink.order.md) | <code>number</code> | An ordinal used to sort nav links relative to one another for display. |
-|  [subUrlBase](./kibana-plugin-core-public.chromenavlink.suburlbase.md) | <code>string</code> | A url base that legacy apps can set to match deep URLs to an application. |
 |  [title](./kibana-plugin-core-public.chromenavlink.title.md) | <code>string</code> | The title of the application. |
 |  [tooltip](./kibana-plugin-core-public.chromenavlink.tooltip.md) | <code>string</code> | A tooltip shown when hovering over an app link. |
-|  [url](./kibana-plugin-core-public.chromenavlink.url.md) | <code>string</code> | The route used to open the [default path](./kibana-plugin-core-public.appbase.defaultpath.md) of an application. If unset, <code>baseUrl</code> will be used instead. |
+|  [url](./kibana-plugin-core-public.chromenavlink.url.md) | <code>string</code> | The route used to open the  of an application. If unset, <code>baseUrl</code> will be used instead. |
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.suburlbase.md b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.suburlbase.md
deleted file mode 100644
index 047a1d83b137f8..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.suburlbase.md
+++ /dev/null
@@ -1,17 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [ChromeNavLink](./kibana-plugin-core-public.chromenavlink.md) &gt; [subUrlBase](./kibana-plugin-core-public.chromenavlink.suburlbase.md)
-
-## ChromeNavLink.subUrlBase property
-
-> Warning: This API is now obsolete.
-> 
-> 
-
-A url base that legacy apps can set to match deep URLs to an application.
-
-<b>Signature:</b>
-
-```typescript
-readonly subUrlBase?: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.url.md b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.url.md
index 1e0b8900159930..833930c4947862 100644
--- a/docs/development/core/public/kibana-plugin-core-public.chromenavlink.url.md
+++ b/docs/development/core/public/kibana-plugin-core-public.chromenavlink.url.md
@@ -4,7 +4,7 @@
 
 ## ChromeNavLink.url property
 
-The route used to open the [default path](./kibana-plugin-core-public.appbase.defaultpath.md) of an application. If unset, `baseUrl` will be used instead.
+The route used to open the  of an application. If unset, `baseUrl` will be used instead.
 
 <b>Signature:</b>
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromenavlinks.update.md b/docs/development/core/public/kibana-plugin-core-public.chromenavlinks.update.md
index 5741a4c98f8956..7948f2f8543fd8 100644
--- a/docs/development/core/public/kibana-plugin-core-public.chromenavlinks.update.md
+++ b/docs/development/core/public/kibana-plugin-core-public.chromenavlinks.update.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Uses the [AppBase.updater$](./kibana-plugin-core-public.appbase.updater_.md) property when registering your application with [ApplicationSetup.register()](./kibana-plugin-core-public.applicationsetup.register.md) instead.
+> Uses the  property when registering your application with [ApplicationSetup.register()](./kibana-plugin-core-public.applicationsetup.register.md) instead.
 > 
 
 Update the navlink for the given id with the updated attributes. Returns the updated navlink or `undefined` if it does not exist.
diff --git a/docs/development/core/public/kibana-plugin-core-public.chromenavlinkupdateablefields.md b/docs/development/core/public/kibana-plugin-core-public.chromenavlinkupdateablefields.md
index bd5a1399cded79..0445bb28bb355f 100644
--- a/docs/development/core/public/kibana-plugin-core-public.chromenavlinkupdateablefields.md
+++ b/docs/development/core/public/kibana-plugin-core-public.chromenavlinkupdateablefields.md
@@ -8,5 +8,5 @@
 <b>Signature:</b>
 
 ```typescript
-export declare type ChromeNavLinkUpdateableFields = Partial<Pick<ChromeNavLink, 'active' | 'disabled' | 'hidden' | 'url' | 'subUrlBase' | 'href'>>;
+export declare type ChromeNavLinkUpdateableFields = Partial<Pick<ChromeNavLink, 'disabled' | 'hidden' | 'url' | 'href'>>;
 ```
diff --git a/docs/development/core/public/kibana-plugin-core-public.coresetup.injectedmetadata.md b/docs/development/core/public/kibana-plugin-core-public.coresetup.injectedmetadata.md
index b8f2699b677b0c..8c845c621e0d7e 100644
--- a/docs/development/core/public/kibana-plugin-core-public.coresetup.injectedmetadata.md
+++ b/docs/development/core/public/kibana-plugin-core-public.coresetup.injectedmetadata.md
@@ -8,7 +8,7 @@
 > 
 > 
 
-exposed temporarily until https://github.com/elastic/kibana/issues/41990 done use \*only\* to retrieve config values. There is no way to set injected values in the new platform. Use the legacy platform API instead.
+exposed temporarily until https://github.com/elastic/kibana/issues/41990 done use \*only\* to retrieve config values. There is no way to set injected values in the new platform.
 
 <b>Signature:</b>
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.coresetup.md b/docs/development/core/public/kibana-plugin-core-public.coresetup.md
index 870fa33dce9000..b9f97b83af88ff 100644
--- a/docs/development/core/public/kibana-plugin-core-public.coresetup.md
+++ b/docs/development/core/public/kibana-plugin-core-public.coresetup.md
@@ -21,7 +21,7 @@ export interface CoreSetup<TPluginsStart extends object = object, TStart = unkno
 |  [fatalErrors](./kibana-plugin-core-public.coresetup.fatalerrors.md) | <code>FatalErrorsSetup</code> | [FatalErrorsSetup](./kibana-plugin-core-public.fatalerrorssetup.md) |
 |  [getStartServices](./kibana-plugin-core-public.coresetup.getstartservices.md) | <code>StartServicesAccessor&lt;TPluginsStart, TStart&gt;</code> | [StartServicesAccessor](./kibana-plugin-core-public.startservicesaccessor.md) |
 |  [http](./kibana-plugin-core-public.coresetup.http.md) | <code>HttpSetup</code> | [HttpSetup](./kibana-plugin-core-public.httpsetup.md) |
-|  [injectedMetadata](./kibana-plugin-core-public.coresetup.injectedmetadata.md) | <code>{</code><br/><code>        getInjectedVar: (name: string, defaultValue?: any) =&gt; unknown;</code><br/><code>    }</code> | exposed temporarily until https://github.com/elastic/kibana/issues/41990 done use \*only\* to retrieve config values. There is no way to set injected values in the new platform. Use the legacy platform API instead. |
+|  [injectedMetadata](./kibana-plugin-core-public.coresetup.injectedmetadata.md) | <code>{</code><br/><code>        getInjectedVar: (name: string, defaultValue?: any) =&gt; unknown;</code><br/><code>    }</code> | exposed temporarily until https://github.com/elastic/kibana/issues/41990 done use \*only\* to retrieve config values. There is no way to set injected values in the new platform. |
 |  [notifications](./kibana-plugin-core-public.coresetup.notifications.md) | <code>NotificationsSetup</code> | [NotificationsSetup](./kibana-plugin-core-public.notificationssetup.md) |
 |  [uiSettings](./kibana-plugin-core-public.coresetup.uisettings.md) | <code>IUiSettingsClient</code> | [IUiSettingsClient](./kibana-plugin-core-public.iuisettingsclient.md) |
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.corestart.injectedmetadata.md b/docs/development/core/public/kibana-plugin-core-public.corestart.injectedmetadata.md
index 45f9349ae8c615..4e9bf7c4bc0d5a 100644
--- a/docs/development/core/public/kibana-plugin-core-public.corestart.injectedmetadata.md
+++ b/docs/development/core/public/kibana-plugin-core-public.corestart.injectedmetadata.md
@@ -8,7 +8,7 @@
 > 
 > 
 
-exposed temporarily until https://github.com/elastic/kibana/issues/41990 done use \*only\* to retrieve config values. There is no way to set injected values in the new platform. Use the legacy platform API instead.
+exposed temporarily until https://github.com/elastic/kibana/issues/41990 done use \*only\* to retrieve config values. There is no way to set injected values in the new platform.
 
 <b>Signature:</b>
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.corestart.md b/docs/development/core/public/kibana-plugin-core-public.corestart.md
index cb4a825a825b13..a7b45b318d2c9e 100644
--- a/docs/development/core/public/kibana-plugin-core-public.corestart.md
+++ b/docs/development/core/public/kibana-plugin-core-public.corestart.md
@@ -22,7 +22,7 @@ export interface CoreStart
 |  [fatalErrors](./kibana-plugin-core-public.corestart.fatalerrors.md) | <code>FatalErrorsStart</code> | [FatalErrorsStart](./kibana-plugin-core-public.fatalerrorsstart.md) |
 |  [http](./kibana-plugin-core-public.corestart.http.md) | <code>HttpStart</code> | [HttpStart](./kibana-plugin-core-public.httpstart.md) |
 |  [i18n](./kibana-plugin-core-public.corestart.i18n.md) | <code>I18nStart</code> | [I18nStart](./kibana-plugin-core-public.i18nstart.md) |
-|  [injectedMetadata](./kibana-plugin-core-public.corestart.injectedmetadata.md) | <code>{</code><br/><code>        getInjectedVar: (name: string, defaultValue?: any) =&gt; unknown;</code><br/><code>    }</code> | exposed temporarily until https://github.com/elastic/kibana/issues/41990 done use \*only\* to retrieve config values. There is no way to set injected values in the new platform. Use the legacy platform API instead. |
+|  [injectedMetadata](./kibana-plugin-core-public.corestart.injectedmetadata.md) | <code>{</code><br/><code>        getInjectedVar: (name: string, defaultValue?: any) =&gt; unknown;</code><br/><code>    }</code> | exposed temporarily until https://github.com/elastic/kibana/issues/41990 done use \*only\* to retrieve config values. There is no way to set injected values in the new platform. |
 |  [notifications](./kibana-plugin-core-public.corestart.notifications.md) | <code>NotificationsStart</code> | [NotificationsStart](./kibana-plugin-core-public.notificationsstart.md) |
 |  [overlays](./kibana-plugin-core-public.corestart.overlays.md) | <code>OverlayStart</code> | [OverlayStart](./kibana-plugin-core-public.overlaystart.md) |
 |  [savedObjects](./kibana-plugin-core-public.corestart.savedobjects.md) | <code>SavedObjectsStart</code> | [SavedObjectsStart](./kibana-plugin-core-public.savedobjectsstart.md) |
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacyapp.appurl.md b/docs/development/core/public/kibana-plugin-core-public.legacyapp.appurl.md
deleted file mode 100644
index 292bf299628397..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacyapp.appurl.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyApp](./kibana-plugin-core-public.legacyapp.md) &gt; [appUrl](./kibana-plugin-core-public.legacyapp.appurl.md)
-
-## LegacyApp.appUrl property
-
-<b>Signature:</b>
-
-```typescript
-appUrl: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacyapp.disablesuburltracking.md b/docs/development/core/public/kibana-plugin-core-public.legacyapp.disablesuburltracking.md
deleted file mode 100644
index af4d0eb7969d3d..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacyapp.disablesuburltracking.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyApp](./kibana-plugin-core-public.legacyapp.md) &gt; [disableSubUrlTracking](./kibana-plugin-core-public.legacyapp.disablesuburltracking.md)
-
-## LegacyApp.disableSubUrlTracking property
-
-<b>Signature:</b>
-
-```typescript
-disableSubUrlTracking?: boolean;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacyapp.linktolastsuburl.md b/docs/development/core/public/kibana-plugin-core-public.legacyapp.linktolastsuburl.md
deleted file mode 100644
index fa1314b74fd83f..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacyapp.linktolastsuburl.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyApp](./kibana-plugin-core-public.legacyapp.md) &gt; [linkToLastSubUrl](./kibana-plugin-core-public.legacyapp.linktolastsuburl.md)
-
-## LegacyApp.linkToLastSubUrl property
-
-<b>Signature:</b>
-
-```typescript
-linkToLastSubUrl?: boolean;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacyapp.md b/docs/development/core/public/kibana-plugin-core-public.legacyapp.md
deleted file mode 100644
index 06533aaa991708..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacyapp.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyApp](./kibana-plugin-core-public.legacyapp.md)
-
-## LegacyApp interface
-
-
-<b>Signature:</b>
-
-```typescript
-export interface LegacyApp extends AppBase 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [appUrl](./kibana-plugin-core-public.legacyapp.appurl.md) | <code>string</code> |  |
-|  [disableSubUrlTracking](./kibana-plugin-core-public.legacyapp.disablesuburltracking.md) | <code>boolean</code> |  |
-|  [linkToLastSubUrl](./kibana-plugin-core-public.legacyapp.linktolastsuburl.md) | <code>boolean</code> |  |
-|  [subUrlBase](./kibana-plugin-core-public.legacyapp.suburlbase.md) | <code>string</code> |  |
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacyapp.suburlbase.md b/docs/development/core/public/kibana-plugin-core-public.legacyapp.suburlbase.md
deleted file mode 100644
index 44a1e52ccd2447..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacyapp.suburlbase.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyApp](./kibana-plugin-core-public.legacyapp.md) &gt; [subUrlBase](./kibana-plugin-core-public.legacyapp.suburlbase.md)
-
-## LegacyApp.subUrlBase property
-
-<b>Signature:</b>
-
-```typescript
-subUrlBase?: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacycoresetup.injectedmetadata.md b/docs/development/core/public/kibana-plugin-core-public.legacycoresetup.injectedmetadata.md
deleted file mode 100644
index 4014d27907e983..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacycoresetup.injectedmetadata.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyCoreSetup](./kibana-plugin-core-public.legacycoresetup.md) &gt; [injectedMetadata](./kibana-plugin-core-public.legacycoresetup.injectedmetadata.md)
-
-## LegacyCoreSetup.injectedMetadata property
-
-> Warning: This API is now obsolete.
-> 
-> 
-
-<b>Signature:</b>
-
-```typescript
-injectedMetadata: InjectedMetadataSetup;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacycoresetup.md b/docs/development/core/public/kibana-plugin-core-public.legacycoresetup.md
deleted file mode 100644
index 26220accbfaf31..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacycoresetup.md
+++ /dev/null
@@ -1,28 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyCoreSetup](./kibana-plugin-core-public.legacycoresetup.md)
-
-## LegacyCoreSetup interface
-
-> Warning: This API is now obsolete.
-> 
-> 
-
-Setup interface exposed to the legacy platform via the `ui/new_platform` module.
-
-<b>Signature:</b>
-
-```typescript
-export interface LegacyCoreSetup extends CoreSetup<any, any> 
-```
-
-## Remarks
-
-Some methods are not supported in the legacy platform and while present to make this type compatibile with [CoreSetup](./kibana-plugin-core-public.coresetup.md)<!-- -->, unsupported methods will throw exceptions when called.
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [injectedMetadata](./kibana-plugin-core-public.legacycoresetup.injectedmetadata.md) | <code>InjectedMetadataSetup</code> |  |
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacycorestart.injectedmetadata.md b/docs/development/core/public/kibana-plugin-core-public.legacycorestart.injectedmetadata.md
deleted file mode 100644
index 288b288b1814d9..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacycorestart.injectedmetadata.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyCoreStart](./kibana-plugin-core-public.legacycorestart.md) &gt; [injectedMetadata](./kibana-plugin-core-public.legacycorestart.injectedmetadata.md)
-
-## LegacyCoreStart.injectedMetadata property
-
-> Warning: This API is now obsolete.
-> 
-> 
-
-<b>Signature:</b>
-
-```typescript
-injectedMetadata: InjectedMetadataStart;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacycorestart.md b/docs/development/core/public/kibana-plugin-core-public.legacycorestart.md
deleted file mode 100644
index 7714d0f325d2c9..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacycorestart.md
+++ /dev/null
@@ -1,28 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyCoreStart](./kibana-plugin-core-public.legacycorestart.md)
-
-## LegacyCoreStart interface
-
-> Warning: This API is now obsolete.
-> 
-> 
-
-Start interface exposed to the legacy platform via the `ui/new_platform` module.
-
-<b>Signature:</b>
-
-```typescript
-export interface LegacyCoreStart extends CoreStart 
-```
-
-## Remarks
-
-Some methods are not supported in the legacy platform and while present to make this type compatibile with [CoreStart](./kibana-plugin-core-public.corestart.md)<!-- -->, unsupported methods will throw exceptions when called.
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [injectedMetadata](./kibana-plugin-core-public.legacycorestart.injectedmetadata.md) | <code>InjectedMetadataStart</code> |  |
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.category.md b/docs/development/core/public/kibana-plugin-core-public.legacynavlink.category.md
deleted file mode 100644
index a70aac70067de7..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.category.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyNavLink](./kibana-plugin-core-public.legacynavlink.md) &gt; [category](./kibana-plugin-core-public.legacynavlink.category.md)
-
-## LegacyNavLink.category property
-
-<b>Signature:</b>
-
-```typescript
-category?: AppCategory;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.euiicontype.md b/docs/development/core/public/kibana-plugin-core-public.legacynavlink.euiicontype.md
deleted file mode 100644
index b360578f98cf14..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.euiicontype.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyNavLink](./kibana-plugin-core-public.legacynavlink.md) &gt; [euiIconType](./kibana-plugin-core-public.legacynavlink.euiicontype.md)
-
-## LegacyNavLink.euiIconType property
-
-<b>Signature:</b>
-
-```typescript
-euiIconType?: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.icon.md b/docs/development/core/public/kibana-plugin-core-public.legacynavlink.icon.md
deleted file mode 100644
index c2c6f89be0d784..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.icon.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyNavLink](./kibana-plugin-core-public.legacynavlink.md) &gt; [icon](./kibana-plugin-core-public.legacynavlink.icon.md)
-
-## LegacyNavLink.icon property
-
-<b>Signature:</b>
-
-```typescript
-icon?: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.id.md b/docs/development/core/public/kibana-plugin-core-public.legacynavlink.id.md
deleted file mode 100644
index fc79b6b4bd6dda..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.id.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyNavLink](./kibana-plugin-core-public.legacynavlink.md) &gt; [id](./kibana-plugin-core-public.legacynavlink.id.md)
-
-## LegacyNavLink.id property
-
-<b>Signature:</b>
-
-```typescript
-id: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.md b/docs/development/core/public/kibana-plugin-core-public.legacynavlink.md
deleted file mode 100644
index b6402f991f965f..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.md
+++ /dev/null
@@ -1,25 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyNavLink](./kibana-plugin-core-public.legacynavlink.md)
-
-## LegacyNavLink interface
-
-
-<b>Signature:</b>
-
-```typescript
-export interface LegacyNavLink 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [category](./kibana-plugin-core-public.legacynavlink.category.md) | <code>AppCategory</code> |  |
-|  [euiIconType](./kibana-plugin-core-public.legacynavlink.euiicontype.md) | <code>string</code> |  |
-|  [icon](./kibana-plugin-core-public.legacynavlink.icon.md) | <code>string</code> |  |
-|  [id](./kibana-plugin-core-public.legacynavlink.id.md) | <code>string</code> |  |
-|  [order](./kibana-plugin-core-public.legacynavlink.order.md) | <code>number</code> |  |
-|  [title](./kibana-plugin-core-public.legacynavlink.title.md) | <code>string</code> |  |
-|  [url](./kibana-plugin-core-public.legacynavlink.url.md) | <code>string</code> |  |
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.order.md b/docs/development/core/public/kibana-plugin-core-public.legacynavlink.order.md
deleted file mode 100644
index 6ad3081b81d4ba..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.order.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyNavLink](./kibana-plugin-core-public.legacynavlink.md) &gt; [order](./kibana-plugin-core-public.legacynavlink.order.md)
-
-## LegacyNavLink.order property
-
-<b>Signature:</b>
-
-```typescript
-order: number;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.title.md b/docs/development/core/public/kibana-plugin-core-public.legacynavlink.title.md
deleted file mode 100644
index 70b0e37729f26d..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.title.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyNavLink](./kibana-plugin-core-public.legacynavlink.md) &gt; [title](./kibana-plugin-core-public.legacynavlink.title.md)
-
-## LegacyNavLink.title property
-
-<b>Signature:</b>
-
-```typescript
-title: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.url.md b/docs/development/core/public/kibana-plugin-core-public.legacynavlink.url.md
deleted file mode 100644
index 7e543f4a90c1dd..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.legacynavlink.url.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [LegacyNavLink](./kibana-plugin-core-public.legacynavlink.md) &gt; [url](./kibana-plugin-core-public.legacynavlink.url.md)
-
-## LegacyNavLink.url property
-
-<b>Signature:</b>
-
-```typescript
-url: string;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.md b/docs/development/core/public/kibana-plugin-core-public.md
index c931ce544f5d51..08b12190ef6383 100644
--- a/docs/development/core/public/kibana-plugin-core-public.md
+++ b/docs/development/core/public/kibana-plugin-core-public.md
@@ -41,8 +41,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 
 |  Interface | Description |
 |  --- | --- |
-|  [App](./kibana-plugin-core-public.app.md) | Extension of [common app properties](./kibana-plugin-core-public.appbase.md) with the mount function. |
-|  [AppBase](./kibana-plugin-core-public.appbase.md) |  |
+|  [App](./kibana-plugin-core-public.app.md) |  |
 |  [AppCategory](./kibana-plugin-core-public.appcategory.md) | A category definition for nav links to know where to sort them in the left hand nav |
 |  [AppLeaveConfirmAction](./kibana-plugin-core-public.appleaveconfirmaction.md) | Action to return from a [AppLeaveHandler](./kibana-plugin-core-public.appleavehandler.md) to show a confirmation message when trying to leave an application.<!-- -->See  |
 |  [AppLeaveDefaultAction](./kibana-plugin-core-public.appleavedefaultaction.md) | Action to return from a [AppLeaveHandler](./kibana-plugin-core-public.appleavehandler.md) to execute the default behaviour when leaving the application.<!-- -->See  |
@@ -90,10 +89,6 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [IHttpResponseInterceptorOverrides](./kibana-plugin-core-public.ihttpresponseinterceptoroverrides.md) | Properties that can be returned by HttpInterceptor.request to override the response. |
 |  [ImageValidation](./kibana-plugin-core-public.imagevalidation.md) |  |
 |  [IUiSettingsClient](./kibana-plugin-core-public.iuisettingsclient.md) | Client-side client that provides access to the advanced settings stored in elasticsearch. The settings provide control over the behavior of the Kibana application. For example, a user can specify how to display numeric or date fields. Users can adjust the settings via Management UI. [IUiSettingsClient](./kibana-plugin-core-public.iuisettingsclient.md) |
-|  [LegacyApp](./kibana-plugin-core-public.legacyapp.md) |  |
-|  [LegacyCoreSetup](./kibana-plugin-core-public.legacycoresetup.md) | Setup interface exposed to the legacy platform via the <code>ui/new_platform</code> module. |
-|  [LegacyCoreStart](./kibana-plugin-core-public.legacycorestart.md) | Start interface exposed to the legacy platform via the <code>ui/new_platform</code> module. |
-|  [LegacyNavLink](./kibana-plugin-core-public.legacynavlink.md) |  |
 |  [NavigateToAppOptions](./kibana-plugin-core-public.navigatetoappoptions.md) | Options for the [navigateToApp API](./kibana-plugin-core-public.applicationstart.navigatetoapp.md) |
 |  [NotificationsSetup](./kibana-plugin-core-public.notificationssetup.md) |  |
 |  [NotificationsStart](./kibana-plugin-core-public.notificationsstart.md) |  |
@@ -173,7 +168,6 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [PluginInitializer](./kibana-plugin-core-public.plugininitializer.md) | The <code>plugin</code> export at the root of a plugin's <code>public</code> directory should conform to this interface. |
 |  [PluginOpaqueId](./kibana-plugin-core-public.pluginopaqueid.md) |  |
 |  [PublicAppInfo](./kibana-plugin-core-public.publicappinfo.md) | Public information about a registered [application](./kibana-plugin-core-public.app.md) |
-|  [PublicLegacyAppInfo](./kibana-plugin-core-public.publiclegacyappinfo.md) | Information about a registered [legacy application](./kibana-plugin-core-public.legacyapp.md) |
 |  [PublicUiSettingsParams](./kibana-plugin-core-public.publicuisettingsparams.md) | A sub-set of [UiSettingsParams](./kibana-plugin-core-public.uisettingsparams.md) exposed to the client-side. |
 |  [SavedObjectAttribute](./kibana-plugin-core-public.savedobjectattribute.md) | Type definition for a Saved Object attribute value |
 |  [SavedObjectAttributeSingle](./kibana-plugin-core-public.savedobjectattributesingle.md) | Don't use this type, it's simply a helper type for [SavedObjectAttribute](./kibana-plugin-core-public.savedobjectattribute.md) |
diff --git a/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.md b/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.md
index aa51e5706e3d76..b7c01fae4314fb 100644
--- a/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.md
+++ b/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.md
@@ -16,7 +16,7 @@ export interface NavigateToAppOptions
 
 |  Property | Type | Description |
 |  --- | --- | --- |
-|  [path](./kibana-plugin-core-public.navigatetoappoptions.path.md) | <code>string</code> | optional path inside application to deep link to. If undefined, will use [the app's default path](./kibana-plugin-core-public.appbase.defaultpath.md)<!-- -->\` as default. |
+|  [path](./kibana-plugin-core-public.navigatetoappoptions.path.md) | <code>string</code> | optional path inside application to deep link to. If undefined, will use [the app's default path](./kibana-plugin-core-public.app.defaultpath.md)<!-- -->\` as default. |
 |  [replace](./kibana-plugin-core-public.navigatetoappoptions.replace.md) | <code>boolean</code> | if true, will not create a new history entry when navigating (using <code>replace</code> instead of <code>push</code>) |
 |  [state](./kibana-plugin-core-public.navigatetoappoptions.state.md) | <code>unknown</code> | optional state to forward to the application |
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.path.md b/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.path.md
index 58ce7e02d8dd88..095553d05778c9 100644
--- a/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.path.md
+++ b/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.path.md
@@ -4,7 +4,7 @@
 
 ## NavigateToAppOptions.path property
 
-optional path inside application to deep link to. If undefined, will use [the app's default path](./kibana-plugin-core-public.appbase.defaultpath.md)<!-- -->\` as default.
+optional path inside application to deep link to. If undefined, will use [the app's default path](./kibana-plugin-core-public.app.defaultpath.md)<!-- -->\` as default.
 
 <b>Signature:</b>
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.replace.md b/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.replace.md
index 9530d034862995..8a7440025aedc7 100644
--- a/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.replace.md
+++ b/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.replace.md
@@ -11,8 +11,3 @@ if true, will not create a new history entry when navigating (using `replace` in
 ```typescript
 replace?: boolean;
 ```
-
-## Remarks
-
-This option not be used when navigating from and/or to legacy applications.
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.publicappinfo.md b/docs/development/core/public/kibana-plugin-core-public.publicappinfo.md
index 4b3b103c92731d..3717dc847db25b 100644
--- a/docs/development/core/public/kibana-plugin-core-public.publicappinfo.md
+++ b/docs/development/core/public/kibana-plugin-core-public.publicappinfo.md
@@ -10,7 +10,6 @@ Public information about a registered [application](./kibana-plugin-core-public.
 
 ```typescript
 export declare type PublicAppInfo = Omit<App, 'mount' | 'updater$'> & {
-    legacy: false;
     status: AppStatus;
     navLinkStatus: AppNavLinkStatus;
     appRoute: string;
diff --git a/docs/development/core/public/kibana-plugin-core-public.publiclegacyappinfo.md b/docs/development/core/public/kibana-plugin-core-public.publiclegacyappinfo.md
deleted file mode 100644
index 051638daabd12f..00000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.publiclegacyappinfo.md
+++ /dev/null
@@ -1,17 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [PublicLegacyAppInfo](./kibana-plugin-core-public.publiclegacyappinfo.md)
-
-## PublicLegacyAppInfo type
-
-Information about a registered [legacy application](./kibana-plugin-core-public.legacyapp.md)
-
-<b>Signature:</b>
-
-```typescript
-export declare type PublicLegacyAppInfo = Omit<LegacyApp, 'updater$'> & {
-    legacy: true;
-    status: AppStatus;
-    navLinkStatus: AppNavLinkStatus;
-};
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.savedobjectsfindoptions.filter.md b/docs/development/core/public/kibana-plugin-core-public.savedobjectsfindoptions.filter.md
index 900f8e333f3376..2c20fe2dab00f8 100644
--- a/docs/development/core/public/kibana-plugin-core-public.savedobjectsfindoptions.filter.md
+++ b/docs/development/core/public/kibana-plugin-core-public.savedobjectsfindoptions.filter.md
@@ -7,5 +7,5 @@
 <b>Signature:</b>
 
 ```typescript
-filter?: string;
+filter?: string | KueryNode;
 ```
diff --git a/docs/development/core/public/kibana-plugin-core-public.savedobjectsfindoptions.md b/docs/development/core/public/kibana-plugin-core-public.savedobjectsfindoptions.md
index ebd0a99531755b..903462ac3039d5 100644
--- a/docs/development/core/public/kibana-plugin-core-public.savedobjectsfindoptions.md
+++ b/docs/development/core/public/kibana-plugin-core-public.savedobjectsfindoptions.md
@@ -17,7 +17,7 @@ export interface SavedObjectsFindOptions
 |  --- | --- | --- |
 |  [defaultSearchOperator](./kibana-plugin-core-public.savedobjectsfindoptions.defaultsearchoperator.md) | <code>'AND' &#124; 'OR'</code> |  |
 |  [fields](./kibana-plugin-core-public.savedobjectsfindoptions.fields.md) | <code>string[]</code> | An array of fields to include in the results |
-|  [filter](./kibana-plugin-core-public.savedobjectsfindoptions.filter.md) | <code>string</code> |  |
+|  [filter](./kibana-plugin-core-public.savedobjectsfindoptions.filter.md) | <code>string &#124; KueryNode</code> |  |
 |  [hasReference](./kibana-plugin-core-public.savedobjectsfindoptions.hasreference.md) | <code>{</code><br/><code>        type: string;</code><br/><code>        id: string;</code><br/><code>    }</code> |  |
 |  [namespaces](./kibana-plugin-core-public.savedobjectsfindoptions.namespaces.md) | <code>string[]</code> |  |
 |  [page](./kibana-plugin-core-public.savedobjectsfindoptions.page.md) | <code>number</code> |  |
diff --git a/docs/development/core/server/kibana-plugin-core-server.appenderconfigtype.md b/docs/development/core/server/kibana-plugin-core-server.appenderconfigtype.md
index 9c70e658014b3a..0838572f26f490 100644
--- a/docs/development/core/server/kibana-plugin-core-server.appenderconfigtype.md
+++ b/docs/development/core/server/kibana-plugin-core-server.appenderconfigtype.md
@@ -8,5 +8,5 @@
 <b>Signature:</b>
 
 ```typescript
-export declare type AppenderConfigType = TypeOf<typeof appendersSchema>;
+export declare type AppenderConfigType = ConsoleAppenderConfig | FileAppenderConfig | LegacyAppenderConfig;
 ```
diff --git a/docs/development/core/server/kibana-plugin-core-server.savedobjectsfindoptions.filter.md b/docs/development/core/server/kibana-plugin-core-server.savedobjectsfindoptions.filter.md
index ae7b7a28bcd09a..c98a4fe5e8796f 100644
--- a/docs/development/core/server/kibana-plugin-core-server.savedobjectsfindoptions.filter.md
+++ b/docs/development/core/server/kibana-plugin-core-server.savedobjectsfindoptions.filter.md
@@ -7,5 +7,5 @@
 <b>Signature:</b>
 
 ```typescript
-filter?: string;
+filter?: string | KueryNode;
 ```
diff --git a/docs/development/core/server/kibana-plugin-core-server.savedobjectsfindoptions.md b/docs/development/core/server/kibana-plugin-core-server.savedobjectsfindoptions.md
index 15a9d99b3d062e..804c83f7c1b48f 100644
--- a/docs/development/core/server/kibana-plugin-core-server.savedobjectsfindoptions.md
+++ b/docs/development/core/server/kibana-plugin-core-server.savedobjectsfindoptions.md
@@ -17,7 +17,7 @@ export interface SavedObjectsFindOptions
 |  --- | --- | --- |
 |  [defaultSearchOperator](./kibana-plugin-core-server.savedobjectsfindoptions.defaultsearchoperator.md) | <code>'AND' &#124; 'OR'</code> |  |
 |  [fields](./kibana-plugin-core-server.savedobjectsfindoptions.fields.md) | <code>string[]</code> | An array of fields to include in the results |
-|  [filter](./kibana-plugin-core-server.savedobjectsfindoptions.filter.md) | <code>string</code> |  |
+|  [filter](./kibana-plugin-core-server.savedobjectsfindoptions.filter.md) | <code>string &#124; KueryNode</code> |  |
 |  [hasReference](./kibana-plugin-core-server.savedobjectsfindoptions.hasreference.md) | <code>{</code><br/><code>        type: string;</code><br/><code>        id: string;</code><br/><code>    }</code> |  |
 |  [namespaces](./kibana-plugin-core-server.savedobjectsfindoptions.namespaces.md) | <code>string[]</code> |  |
 |  [page](./kibana-plugin-core-server.savedobjectsfindoptions.page.md) | <code>number</code> |  |
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fetchoptions.abortsignal.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fetchoptions.abortsignal.md
deleted file mode 100644
index 791f1b63e65397..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fetchoptions.abortsignal.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FetchOptions](./kibana-plugin-plugins-data-public.fetchoptions.md) &gt; [abortSignal](./kibana-plugin-plugins-data-public.fetchoptions.abortsignal.md)
-
-## FetchOptions.abortSignal property
-
-<b>Signature:</b>
-
-```typescript
-abortSignal?: AbortSignal;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fetchoptions.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fetchoptions.md
deleted file mode 100644
index f07fdd4280533d..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fetchoptions.md
+++ /dev/null
@@ -1,19 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FetchOptions](./kibana-plugin-plugins-data-public.fetchoptions.md)
-
-## FetchOptions interface
-
-<b>Signature:</b>
-
-```typescript
-export interface FetchOptions 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [abortSignal](./kibana-plugin-plugins-data-public.fetchoptions.abortsignal.md) | <code>AbortSignal</code> |  |
-|  [searchStrategyId](./kibana-plugin-plugins-data-public.fetchoptions.searchstrategyid.md) | <code>string</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fetchoptions.searchstrategyid.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fetchoptions.searchstrategyid.md
deleted file mode 100644
index 8824529eb4eca3..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fetchoptions.searchstrategyid.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FetchOptions](./kibana-plugin-plugins-data-public.fetchoptions.md) &gt; [searchStrategyId](./kibana-plugin-plugins-data-public.fetchoptions.searchstrategyid.md)
-
-## FetchOptions.searchStrategyId property
-
-<b>Signature:</b>
-
-```typescript
-searchStrategyId?: string;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist._constructor_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist._constructor_.md
deleted file mode 100644
index 9f9613a5a68f7c..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist._constructor_.md
+++ /dev/null
@@ -1,23 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md) &gt; [(constructor)](./kibana-plugin-plugins-data-public.fieldlist._constructor_.md)
-
-## FieldList.(constructor)
-
-Constructs a new instance of the `FieldList` class
-
-<b>Signature:</b>
-
-```typescript
-constructor(indexPattern: IndexPattern, specs?: FieldSpec[], shortDotsEnable?: boolean, onNotification?: OnNotification);
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  indexPattern | <code>IndexPattern</code> |  |
-|  specs | <code>FieldSpec[]</code> |  |
-|  shortDotsEnable | <code>boolean</code> |  |
-|  onNotification | <code>OnNotification</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.add.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.add.md
deleted file mode 100644
index ae3d82f0cc3ea1..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.add.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md) &gt; [add](./kibana-plugin-plugins-data-public.fieldlist.add.md)
-
-## FieldList.add property
-
-<b>Signature:</b>
-
-```typescript
-readonly add: (field: FieldSpec) => void;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.getall.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.getall.md
deleted file mode 100644
index da29a4de9acc8f..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.getall.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md) &gt; [getAll](./kibana-plugin-plugins-data-public.fieldlist.getall.md)
-
-## FieldList.getAll property
-
-<b>Signature:</b>
-
-```typescript
-readonly getAll: () => IndexPatternField[];
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.getbyname.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.getbyname.md
deleted file mode 100644
index af368d003423a5..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.getbyname.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md) &gt; [getByName](./kibana-plugin-plugins-data-public.fieldlist.getbyname.md)
-
-## FieldList.getByName property
-
-<b>Signature:</b>
-
-```typescript
-readonly getByName: (name: IndexPatternField['name']) => IndexPatternField | undefined;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.getbytype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.getbytype.md
deleted file mode 100644
index 16bae3ee7c555c..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.getbytype.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md) &gt; [getByType](./kibana-plugin-plugins-data-public.fieldlist.getbytype.md)
-
-## FieldList.getByType property
-
-<b>Signature:</b>
-
-```typescript
-readonly getByType: (type: IndexPatternField['type']) => any[];
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.md
index 012b0694302903..79bcaf9700cf02 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.md
@@ -1,32 +1,11 @@
 <!-- Do not edit this file. It is automatically generated by API Documenter. -->
 
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md)
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [fieldList](./kibana-plugin-plugins-data-public.fieldlist.md)
 
-## FieldList class
+## fieldList variable
 
 <b>Signature:</b>
 
 ```typescript
-export declare class FieldList extends Array<IndexPatternField> implements IIndexPatternFieldList 
+fieldList: (specs?: FieldSpec[], shortDotsEnable?: boolean) => IIndexPatternFieldList
 ```
-
-## Constructors
-
-|  Constructor | Modifiers | Description |
-|  --- | --- | --- |
-|  [(constructor)(indexPattern, specs, shortDotsEnable, onNotification)](./kibana-plugin-plugins-data-public.fieldlist._constructor_.md) |  | Constructs a new instance of the <code>FieldList</code> class |
-
-## Properties
-
-|  Property | Modifiers | Type | Description |
-|  --- | --- | --- | --- |
-|  [add](./kibana-plugin-plugins-data-public.fieldlist.add.md) |  | <code>(field: FieldSpec) =&gt; void</code> |  |
-|  [getAll](./kibana-plugin-plugins-data-public.fieldlist.getall.md) |  | <code>() =&gt; IndexPatternField[]</code> |  |
-|  [getByName](./kibana-plugin-plugins-data-public.fieldlist.getbyname.md) |  | <code>(name: IndexPatternField['name']) =&gt; IndexPatternField &#124; undefined</code> |  |
-|  [getByType](./kibana-plugin-plugins-data-public.fieldlist.getbytype.md) |  | <code>(type: IndexPatternField['type']) =&gt; any[]</code> |  |
-|  [remove](./kibana-plugin-plugins-data-public.fieldlist.remove.md) |  | <code>(field: IFieldType) =&gt; void</code> |  |
-|  [removeAll](./kibana-plugin-plugins-data-public.fieldlist.removeall.md) |  | <code>() =&gt; void</code> |  |
-|  [replaceAll](./kibana-plugin-plugins-data-public.fieldlist.replaceall.md) |  | <code>(specs: FieldSpec[]) =&gt; void</code> |  |
-|  [toSpec](./kibana-plugin-plugins-data-public.fieldlist.tospec.md) |  | <code>() =&gt; {</code><br/><code>        count: number;</code><br/><code>        script: string &#124; undefined;</code><br/><code>        lang: string &#124; undefined;</code><br/><code>        conflictDescriptions: Record&lt;string, string[]&gt; &#124; undefined;</code><br/><code>        name: string;</code><br/><code>        type: string;</code><br/><code>        esTypes: string[] &#124; undefined;</code><br/><code>        scripted: boolean;</code><br/><code>        searchable: boolean;</code><br/><code>        aggregatable: boolean;</code><br/><code>        readFromDocValues: boolean;</code><br/><code>        subType: import(&quot;../types&quot;).IFieldSubType &#124; undefined;</code><br/><code>        format: any;</code><br/><code>    }[]</code> |  |
-|  [update](./kibana-plugin-plugins-data-public.fieldlist.update.md) |  | <code>(field: FieldSpec) =&gt; void</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.remove.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.remove.md
deleted file mode 100644
index 149410adb3550a..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.remove.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md) &gt; [remove](./kibana-plugin-plugins-data-public.fieldlist.remove.md)
-
-## FieldList.remove property
-
-<b>Signature:</b>
-
-```typescript
-readonly remove: (field: IFieldType) => void;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.removeall.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.removeall.md
deleted file mode 100644
index 92a45349ad0051..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.removeall.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md) &gt; [removeAll](./kibana-plugin-plugins-data-public.fieldlist.removeall.md)
-
-## FieldList.removeAll property
-
-<b>Signature:</b>
-
-```typescript
-readonly removeAll: () => void;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.replaceall.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.replaceall.md
deleted file mode 100644
index 5330440e6b96a1..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.replaceall.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md) &gt; [replaceAll](./kibana-plugin-plugins-data-public.fieldlist.replaceall.md)
-
-## FieldList.replaceAll property
-
-<b>Signature:</b>
-
-```typescript
-readonly replaceAll: (specs: FieldSpec[]) => void;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.tospec.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.tospec.md
deleted file mode 100644
index e646339feb4955..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.tospec.md
+++ /dev/null
@@ -1,25 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md) &gt; [toSpec](./kibana-plugin-plugins-data-public.fieldlist.tospec.md)
-
-## FieldList.toSpec property
-
-<b>Signature:</b>
-
-```typescript
-readonly toSpec: () => {
-        count: number;
-        script: string | undefined;
-        lang: string | undefined;
-        conflictDescriptions: Record<string, string[]> | undefined;
-        name: string;
-        type: string;
-        esTypes: string[] | undefined;
-        scripted: boolean;
-        searchable: boolean;
-        aggregatable: boolean;
-        readFromDocValues: boolean;
-        subType: import("../types").IFieldSubType | undefined;
-        format: any;
-    }[];
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.update.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.update.md
deleted file mode 100644
index c718e47b31b50a..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldlist.update.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md) &gt; [update](./kibana-plugin-plugins-data-public.fieldlist.update.md)
-
-## FieldList.update property
-
-<b>Signature:</b>
-
-```typescript
-readonly update: (field: FieldSpec) => void;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md
index 6f42fb32fdb7be..3ff2afafcc5145 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md
@@ -28,7 +28,7 @@ export interface IFieldType
 |  [searchable](./kibana-plugin-plugins-data-public.ifieldtype.searchable.md) | <code>boolean</code> |  |
 |  [sortable](./kibana-plugin-plugins-data-public.ifieldtype.sortable.md) | <code>boolean</code> |  |
 |  [subType](./kibana-plugin-plugins-data-public.ifieldtype.subtype.md) | <code>IFieldSubType</code> |  |
-|  [toSpec](./kibana-plugin-plugins-data-public.ifieldtype.tospec.md) | <code>() =&gt; FieldSpec</code> |  |
+|  [toSpec](./kibana-plugin-plugins-data-public.ifieldtype.tospec.md) | <code>(options?: {</code><br/><code>        getFormatterForField?: IndexPattern['getFormatterForField'];</code><br/><code>    }) =&gt; FieldSpec</code> |  |
 |  [type](./kibana-plugin-plugins-data-public.ifieldtype.type.md) | <code>string</code> |  |
 |  [visualizable](./kibana-plugin-plugins-data-public.ifieldtype.visualizable.md) | <code>boolean</code> |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.tospec.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.tospec.md
index 1fb4084c25d343..52238ea2a00ca4 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.tospec.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.tospec.md
@@ -7,5 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-toSpec?: () => FieldSpec;
+toSpec?: (options?: {
+        getFormatterForField?: IndexPattern['getFormatterForField'];
+    }) => FieldSpec;
 ```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.md
index b068c4804c0ddd..b1e13ffaabd077 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.md
@@ -21,5 +21,6 @@ export interface IIndexPatternFieldList extends Array<IndexPatternField>
 |  [remove(field)](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.remove.md) |  |
 |  [removeAll()](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.removeall.md) |  |
 |  [replaceAll(specs)](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.replaceall.md) |  |
+|  [toSpec(options)](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.tospec.md) |  |
 |  [update(field)](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.update.md) |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.tospec.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.tospec.md
new file mode 100644
index 00000000000000..fd20f2944c5be3
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.tospec.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md) &gt; [toSpec](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.tospec.md)
+
+## IIndexPatternFieldList.toSpec() method
+
+<b>Signature:</b>
+
+```typescript
+toSpec(options?: {
+        getFormatterForField?: IndexPattern['getFormatterForField'];
+    }): FieldSpec[];
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  options | <code>{</code><br/><code>        getFormatterForField?: IndexPattern['getFormatterForField'];</code><br/><code>    }</code> |  |
+
+<b>Returns:</b>
+
+`FieldSpec[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.md
index 37db063e284ec3..4c53af3f8970ed 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.md
@@ -61,7 +61,5 @@ export declare class IndexPattern implements IIndexPattern
 |  [refreshFields()](./kibana-plugin-plugins-data-public.indexpattern.refreshfields.md) |  |  |
 |  [removeScriptedField(fieldName)](./kibana-plugin-plugins-data-public.indexpattern.removescriptedfield.md) |  |  |
 |  [save(saveAttempts)](./kibana-plugin-plugins-data-public.indexpattern.save.md) |  |  |
-|  [toJSON()](./kibana-plugin-plugins-data-public.indexpattern.tojson.md) |  |  |
 |  [toSpec()](./kibana-plugin-plugins-data-public.indexpattern.tospec.md) |  |  |
-|  [toString()](./kibana-plugin-plugins-data-public.indexpattern.tostring.md) |  |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.tojson.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.tojson.md
deleted file mode 100644
index 0ae04bb424d44c..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.tojson.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPattern](./kibana-plugin-plugins-data-public.indexpattern.md) &gt; [toJSON](./kibana-plugin-plugins-data-public.indexpattern.tojson.md)
-
-## IndexPattern.toJSON() method
-
-<b>Signature:</b>
-
-```typescript
-toJSON(): string | undefined;
-```
-<b>Returns:</b>
-
-`string | undefined`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.tostring.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.tostring.md
deleted file mode 100644
index a10b549a7b9ebb..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.tostring.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPattern](./kibana-plugin-plugins-data-public.indexpattern.md) &gt; [toString](./kibana-plugin-plugins-data-public.indexpattern.tostring.md)
-
-## IndexPattern.toString() method
-
-<b>Signature:</b>
-
-```typescript
-toString(): string;
-```
-<b>Returns:</b>
-
-`string`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield._constructor_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield._constructor_.md
index 10b65bdccdf87e..5d467a7a9cbcee 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield._constructor_.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield._constructor_.md
@@ -9,15 +9,13 @@ Constructs a new instance of the `IndexPatternField` class
 <b>Signature:</b>
 
 ```typescript
-constructor(indexPattern: IndexPattern, spec: FieldSpec, displayName: string, onNotification: OnNotification);
+constructor(spec: FieldSpec, displayName: string);
 ```
 
 ## Parameters
 
 |  Parameter | Type | Description |
 |  --- | --- | --- |
-|  indexPattern | <code>IndexPattern</code> |  |
 |  spec | <code>FieldSpec</code> |  |
 |  displayName | <code>string</code> |  |
-|  onNotification | <code>OnNotification</code> |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.format.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.format.md
deleted file mode 100644
index f28d5b1bca7e56..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.format.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPatternField](./kibana-plugin-plugins-data-public.indexpatternfield.md) &gt; [format](./kibana-plugin-plugins-data-public.indexpatternfield.format.md)
-
-## IndexPatternField.format property
-
-<b>Signature:</b>
-
-```typescript
-get format(): FieldFormat;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.indexpattern.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.indexpattern.md
deleted file mode 100644
index 3d145cce9d07df..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.indexpattern.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPatternField](./kibana-plugin-plugins-data-public.indexpatternfield.md) &gt; [indexPattern](./kibana-plugin-plugins-data-public.indexpatternfield.indexpattern.md)
-
-## IndexPatternField.indexPattern property
-
-<b>Signature:</b>
-
-```typescript
-readonly indexPattern: IndexPattern;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.md
index 713b29ea3a3d30..215188ffa26073 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.md
@@ -14,7 +14,7 @@ export declare class IndexPatternField implements IFieldType
 
 |  Constructor | Modifiers | Description |
 |  --- | --- | --- |
-|  [(constructor)(indexPattern, spec, displayName, onNotification)](./kibana-plugin-plugins-data-public.indexpatternfield._constructor_.md) |  | Constructs a new instance of the <code>IndexPatternField</code> class |
+|  [(constructor)(spec, displayName)](./kibana-plugin-plugins-data-public.indexpatternfield._constructor_.md) |  | Constructs a new instance of the <code>IndexPatternField</code> class |
 
 ## Properties
 
@@ -26,8 +26,6 @@ export declare class IndexPatternField implements IFieldType
 |  [displayName](./kibana-plugin-plugins-data-public.indexpatternfield.displayname.md) |  | <code>string</code> |  |
 |  [esTypes](./kibana-plugin-plugins-data-public.indexpatternfield.estypes.md) |  | <code>string[] &#124; undefined</code> |  |
 |  [filterable](./kibana-plugin-plugins-data-public.indexpatternfield.filterable.md) |  | <code>boolean</code> |  |
-|  [format](./kibana-plugin-plugins-data-public.indexpatternfield.format.md) |  | <code>FieldFormat</code> |  |
-|  [indexPattern](./kibana-plugin-plugins-data-public.indexpatternfield.indexpattern.md) |  | <code>IndexPattern</code> |  |
 |  [lang](./kibana-plugin-plugins-data-public.indexpatternfield.lang.md) |  | <code>string &#124; undefined</code> |  |
 |  [name](./kibana-plugin-plugins-data-public.indexpatternfield.name.md) |  | <code>string</code> |  |
 |  [readFromDocValues](./kibana-plugin-plugins-data-public.indexpatternfield.readfromdocvalues.md) |  | <code>boolean</code> |  |
@@ -45,5 +43,5 @@ export declare class IndexPatternField implements IFieldType
 |  Method | Modifiers | Description |
 |  --- | --- | --- |
 |  [toJSON()](./kibana-plugin-plugins-data-public.indexpatternfield.tojson.md) |  |  |
-|  [toSpec()](./kibana-plugin-plugins-data-public.indexpatternfield.tospec.md) |  |  |
+|  [toSpec({ getFormatterForField, })](./kibana-plugin-plugins-data-public.indexpatternfield.tospec.md) |  |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.tospec.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.tospec.md
index 5037cb0049e829..1d80c90991f553 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.tospec.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternfield.tospec.md
@@ -7,7 +7,9 @@
 <b>Signature:</b>
 
 ```typescript
-toSpec(): {
+toSpec({ getFormatterForField, }?: {
+        getFormatterForField?: IndexPattern['getFormatterForField'];
+    }): {
         count: number;
         script: string | undefined;
         lang: string | undefined;
@@ -20,9 +22,19 @@ toSpec(): {
         aggregatable: boolean;
         readFromDocValues: boolean;
         subType: import("../types").IFieldSubType | undefined;
-        format: any;
+        format: {
+            id: any;
+            params: any;
+        } | undefined;
     };
 ```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  { getFormatterForField, } | <code>{</code><br/><code>        getFormatterForField?: IndexPattern['getFormatterForField'];</code><br/><code>    }</code> |  |
+
 <b>Returns:</b>
 
 `{
@@ -38,6 +50,9 @@ toSpec(): {
         aggregatable: boolean;
         readFromDocValues: boolean;
         subType: import("../types").IFieldSubType | undefined;
-        format: any;
+        format: {
+            id: any;
+            params: any;
+        } | undefined;
     }`
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.abortsignal.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.abortsignal.md
new file mode 100644
index 00000000000000..fd8d322d54b264
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.abortsignal.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchOptions](./kibana-plugin-plugins-data-public.isearchoptions.md) &gt; [abortSignal](./kibana-plugin-plugins-data-public.isearchoptions.abortsignal.md)
+
+## ISearchOptions.abortSignal property
+
+An `AbortSignal` that allows the caller of `search` to abort a search request.
+
+<b>Signature:</b>
+
+```typescript
+abortSignal?: AbortSignal;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.md
index 3eb38dc7d52e08..c9018b0048aa3c 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.md
@@ -14,6 +14,6 @@ export interface ISearchOptions
 
 |  Property | Type | Description |
 |  --- | --- | --- |
-|  [signal](./kibana-plugin-plugins-data-public.isearchoptions.signal.md) | <code>AbortSignal</code> |  |
-|  [strategy](./kibana-plugin-plugins-data-public.isearchoptions.strategy.md) | <code>string</code> |  |
+|  [abortSignal](./kibana-plugin-plugins-data-public.isearchoptions.abortsignal.md) | <code>AbortSignal</code> | An <code>AbortSignal</code> that allows the caller of <code>search</code> to abort a search request. |
+|  [strategy](./kibana-plugin-plugins-data-public.isearchoptions.strategy.md) | <code>string</code> | Use this option to force using a specific server side search strategy. Leave empty to use the default strategy. |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.signal.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.signal.md
deleted file mode 100644
index 10bd186d55baad..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.signal.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchOptions](./kibana-plugin-plugins-data-public.isearchoptions.md) &gt; [signal](./kibana-plugin-plugins-data-public.isearchoptions.signal.md)
-
-## ISearchOptions.signal property
-
-<b>Signature:</b>
-
-```typescript
-signal?: AbortSignal;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.strategy.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.strategy.md
index df7e050691a8f3..bd2580957f6c17 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.strategy.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.strategy.md
@@ -4,6 +4,8 @@
 
 ## ISearchOptions.strategy property
 
+Use this option to force using a specific server side search strategy. Leave empty to use the default strategy.
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
index 09702df4fdb545..b651480a858992 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
@@ -10,7 +10,6 @@
 |  --- | --- |
 |  [AggParamType](./kibana-plugin-plugins-data-public.aggparamtype.md) |  |
 |  [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) |  |
-|  [FieldList](./kibana-plugin-plugins-data-public.fieldlist.md) |  |
 |  [FilterManager](./kibana-plugin-plugins-data-public.filtermanager.md) |  |
 |  [IndexPattern](./kibana-plugin-plugins-data-public.indexpattern.md) |  |
 |  [IndexPatternField](./kibana-plugin-plugins-data-public.indexpatternfield.md) |  |
@@ -51,7 +50,6 @@
 |  [DataPublicPluginSetup](./kibana-plugin-plugins-data-public.datapublicpluginsetup.md) |  |
 |  [DataPublicPluginStart](./kibana-plugin-plugins-data-public.datapublicpluginstart.md) |  |
 |  [EsQueryConfig](./kibana-plugin-plugins-data-public.esqueryconfig.md) |  |
-|  [FetchOptions](./kibana-plugin-plugins-data-public.fetchoptions.md) |  |
 |  [FieldFormatConfig](./kibana-plugin-plugins-data-public.fieldformatconfig.md) |  |
 |  [FieldMappingSpec](./kibana-plugin-plugins-data-public.fieldmappingspec.md) |  |
 |  [Filter](./kibana-plugin-plugins-data-public.filter.md) |  |
@@ -103,6 +101,7 @@
 |  [expandShorthand](./kibana-plugin-plugins-data-public.expandshorthand.md) |  |
 |  [extractSearchSourceReferences](./kibana-plugin-plugins-data-public.extractsearchsourcereferences.md) |  |
 |  [fieldFormats](./kibana-plugin-plugins-data-public.fieldformats.md) |  |
+|  [fieldList](./kibana-plugin-plugins-data-public.fieldlist.md) |  |
 |  [FilterBar](./kibana-plugin-plugins-data-public.filterbar.md) |  |
 |  [getKbnTypeNames](./kibana-plugin-plugins-data-public.getkbntypenames.md) | Get the esTypes known by all kbnFieldTypes {<!-- -->Array<string>} |
 |  [indexPatterns](./kibana-plugin-plugins-data-public.indexpatterns.md) |  |
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md
index e139b326b75008..9f3ed8c1263ba0 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md
@@ -7,5 +7,5 @@
 <b>Signature:</b>
 
 ```typescript
-QueryStringInput: React.FC<Pick<Props, "query" | "prepend" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>
+QueryStringInput: React.FC<Pick<Props, "query" | "prepend" | "size" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>
 ```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.es_search_strategy.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.es_search_strategy.md
new file mode 100644
index 00000000000000..8fac5cf4d7a9ec
--- /dev/null
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.es_search_strategy.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ES\_SEARCH\_STRATEGY](./kibana-plugin-plugins-data-server.es_search_strategy.md)
+
+## ES\_SEARCH\_STRATEGY variable
+
+<b>Signature:</b>
+
+```typescript
+ES_SEARCH_STRATEGY = "es"
+```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md
index 77a2954428f8d4..d106f3a35a91c7 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md
@@ -28,7 +28,7 @@ export interface IFieldType
 |  [searchable](./kibana-plugin-plugins-data-server.ifieldtype.searchable.md) | <code>boolean</code> |  |
 |  [sortable](./kibana-plugin-plugins-data-server.ifieldtype.sortable.md) | <code>boolean</code> |  |
 |  [subType](./kibana-plugin-plugins-data-server.ifieldtype.subtype.md) | <code>IFieldSubType</code> |  |
-|  [toSpec](./kibana-plugin-plugins-data-server.ifieldtype.tospec.md) | <code>() =&gt; FieldSpec</code> |  |
+|  [toSpec](./kibana-plugin-plugins-data-server.ifieldtype.tospec.md) | <code>(options?: {</code><br/><code>        getFormatterForField?: IndexPattern['getFormatterForField'];</code><br/><code>    }) =&gt; FieldSpec</code> |  |
 |  [type](./kibana-plugin-plugins-data-server.ifieldtype.type.md) | <code>string</code> |  |
 |  [visualizable](./kibana-plugin-plugins-data-server.ifieldtype.visualizable.md) | <code>boolean</code> |  |
 
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.tospec.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.tospec.md
index d1863bebce4f00..6f8ee9d9eebf03 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.tospec.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.tospec.md
@@ -7,5 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-toSpec?: () => FieldSpec;
+toSpec?: (options?: {
+        getFormatterForField?: IndexPattern['getFormatterForField'];
+    }) => FieldSpec;
 ```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.abortsignal.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.abortsignal.md
new file mode 100644
index 00000000000000..693345f480a9a4
--- /dev/null
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.abortsignal.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchOptions](./kibana-plugin-plugins-data-server.isearchoptions.md) &gt; [abortSignal](./kibana-plugin-plugins-data-server.isearchoptions.abortsignal.md)
+
+## ISearchOptions.abortSignal property
+
+An `AbortSignal` that allows the caller of `search` to abort a search request.
+
+<b>Signature:</b>
+
+```typescript
+abortSignal?: AbortSignal;
+```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.md
index 002ce864a1aa41..21ddaef3a0b94c 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.md
@@ -14,6 +14,6 @@ export interface ISearchOptions
 
 |  Property | Type | Description |
 |  --- | --- | --- |
-|  [signal](./kibana-plugin-plugins-data-server.isearchoptions.signal.md) | <code>AbortSignal</code> | An <code>AbortSignal</code> that allows the caller of <code>search</code> to abort a search request. |
-|  [strategy](./kibana-plugin-plugins-data-server.isearchoptions.strategy.md) | <code>string</code> |  |
+|  [abortSignal](./kibana-plugin-plugins-data-server.isearchoptions.abortsignal.md) | <code>AbortSignal</code> | An <code>AbortSignal</code> that allows the caller of <code>search</code> to abort a search request. |
+|  [strategy](./kibana-plugin-plugins-data-server.isearchoptions.strategy.md) | <code>string</code> | Use this option to force using a specific server side search strategy. Leave empty to use the default strategy. |
 
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.signal.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.signal.md
deleted file mode 100644
index 948dfd66da7a03..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.signal.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchOptions](./kibana-plugin-plugins-data-server.isearchoptions.md) &gt; [signal](./kibana-plugin-plugins-data-server.isearchoptions.signal.md)
-
-## ISearchOptions.signal property
-
-An `AbortSignal` that allows the caller of `search` to abort a search request.
-
-<b>Signature:</b>
-
-```typescript
-signal?: AbortSignal;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.strategy.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.strategy.md
index 6df72d023e2c08..65da7fddd13f60 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.strategy.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.strategy.md
@@ -4,6 +4,8 @@
 
 ## ISearchOptions.strategy property
 
+Use this option to force using a specific server side search strategy. Leave empty to use the default strategy.
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.md
index 62d954cb80eb7f..577532d22b3d37 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.md
@@ -16,5 +16,5 @@ export interface ISearchStart<SearchStrategyRequest extends IEsSearchRequest = I
 |  --- | --- | --- |
 |  [aggs](./kibana-plugin-plugins-data-server.isearchstart.aggs.md) | <code>AggsStart</code> |  |
 |  [getSearchStrategy](./kibana-plugin-plugins-data-server.isearchstart.getsearchstrategy.md) | <code>(name: string) =&gt; ISearchStrategy&lt;SearchStrategyRequest, SearchStrategyResponse&gt;</code> | Get other registered search strategies. For example, if a new strategy needs to use the already-registered ES search strategy, it can use this function to accomplish that. |
-|  [search](./kibana-plugin-plugins-data-server.isearchstart.search.md) | <code>(context: RequestHandlerContext, request: IKibanaSearchRequest, options: ISearchOptions) =&gt; Promise&lt;IKibanaSearchResponse&gt;</code> |  |
+|  [search](./kibana-plugin-plugins-data-server.isearchstart.search.md) | <code>(context: RequestHandlerContext, request: IEsSearchRequest, options: ISearchOptions) =&gt; Promise&lt;IEsSearchResponse&gt;</code> |  |
 
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.search.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.search.md
index 1c2ae916995591..33ca818afc7699 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.search.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.search.md
@@ -7,5 +7,5 @@
 <b>Signature:</b>
 
 ```typescript
-search: (context: RequestHandlerContext, request: IKibanaSearchRequest, options: ISearchOptions) => Promise<IKibanaSearchResponse>;
+search: (context: RequestHandlerContext, request: IEsSearchRequest, options: ISearchOptions) => Promise<IEsSearchResponse>;
 ```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
index 0292e08063fbbd..70c32adeab9fdf 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
@@ -71,6 +71,7 @@
 |  [AggGroupNames](./kibana-plugin-plugins-data-server.agggroupnames.md) |  |
 |  [castEsToKbnFieldTypeName](./kibana-plugin-plugins-data-server.castestokbnfieldtypename.md) | Get the KbnFieldType name for an esType string |
 |  [config](./kibana-plugin-plugins-data-server.config.md) |  |
+|  [ES\_SEARCH\_STRATEGY](./kibana-plugin-plugins-data-server.es_search_strategy.md) |  |
 |  [esFilters](./kibana-plugin-plugins-data-server.esfilters.md) |  |
 |  [esKuery](./kibana-plugin-plugins-data-server.eskuery.md) |  |
 |  [esQuery](./kibana-plugin-plugins-data-server.esquery.md) |  |
diff --git a/docs/discover/search.asciidoc b/docs/discover/search.asciidoc
index eef2a12a964b8e..da58382deb89a5 100644
--- a/docs/discover/search.asciidoc
+++ b/docs/discover/search.asciidoc
@@ -1,7 +1,7 @@
 [[search]]
 == Search data
 Many Kibana apps embed a query bar for real-time search, including
-*Discover*, *Visualize*, and *Dashboard*.
+*Discover* and *Dashboard*.
 
 [float]
 === Search your data
@@ -84,7 +84,7 @@ query language you can also submit queries using the {ref}/query-dsl.html[Elasti
 
 [[save-open-search]]
 === Save a search
-A saved search persists your current view of Discover for later retrieval and reuse. You can reload a saved search into Discover, add it to a dashboard, and use it as the basis for a <<visualize, visualization>>.
+A saved search persists your current view of Discover for later retrieval and reuse. You can reload a saved search into Discover, add it to a dashboard, and use it as the basis for a visualization.
 
 A saved search includes the query text, filters, and optionally, the time filter. A saved search also includes the selected columns in the document table, the sort order, and the current index pattern.
 
@@ -120,7 +120,7 @@ used for the saved search will also be automatically selected.
 
 [[save-load-delete-query]]
 === Save a query
-A saved query is a portable collection of query text and filters that you can reuse in <<discover, Discover>>, <<visualize, Visualize>>, and <<dashboard, Dashboard>>. Save a query when you want to:
+A saved query is a portable collection of query text and filters that you can reuse in <<discover, Discover>> and <<dashboard, Dashboard>>. Save a query when you want to:
 
 * Retrieve results from the same query at a later time without having to reenter the query text, add the filters or set the time filter
 * View the results of the same query in multiple apps
@@ -148,7 +148,7 @@ image::discover/images/saved-query-save-form-default-filters.png["Example of the
 . Click *Save*.
 
 ==== Load a query
-To load a saved query into Discover, Dashboard, or Visualize:
+To load a saved query into Discover or Dashboard:
 
 . Click *#* in the search bar, next to the query text input.
 . Select the query you want to load. You might need to scroll down to find the query you are looking for.
diff --git a/docs/drilldowns/explore-underlying-data.asciidoc b/docs/drilldowns/explore-underlying-data.asciidoc
deleted file mode 100644
index c2bba599730d82..00000000000000
--- a/docs/drilldowns/explore-underlying-data.asciidoc
+++ /dev/null
@@ -1,41 +0,0 @@
-[[explore-underlying-data]]
-== Explore the underlying data for a visualization
-
-++++
-<titleabbrev>Explore the underlying data</titleabbrev>
-++++
-
-Dashboard panels have an *Explore underlying data* action that navigates you to *Discover*,
-where you can narrow your documents to the ones you'll most likely use in a  visualization.
-This action is available for visualizations backed by a single index pattern.
-
-You can access *Explore underlying data* in two ways: from the panel context
-menu or from the menu that appears when you interact with the chart.
-
-[float]
-[[explore-data-from-panel-context-menu]]
-=== Explore data from panel context menu
-
-The *Explore underlying data* action in the panel menu navigates you to Discover,
-carrying over the index pattern, filters, query, and time range for the visualization.
-
-[role="screenshot"]
-image::images/explore_data_context_menu.png[Explore underlying data from panel context menu]
-
-[float]
-[[explore-data-from-chart]]
-=== Explore data from chart action
-
-Initiating *Explore underlying data* from the chart also navigates to Discover,
-carrying over the current context for the visualization. In addition, this action
-applies the filters and time range created by the events that triggered the action.
-
-[role="screenshot"]
-image::images/explore_data_in_chart.png[Explore underlying data from chart]
-
-To enable this action add the following line to your `kibana.yml` config.
-
-["source","yml"]
------------
-xpack.discoverEnhanced.actions.exploreDataInChart.enabled: true
------------
diff --git a/docs/getting-started/add-sample-data.asciidoc b/docs/getting-started/add-sample-data.asciidoc
deleted file mode 100644
index ab43431601888e..00000000000000
--- a/docs/getting-started/add-sample-data.asciidoc
+++ /dev/null
@@ -1,28 +0,0 @@
-[[add-sample-data]]
-== Add sample data
-
-{kib} has several sample data sets that you can use to explore {kib} before loading your own data.
-These sample data sets showcase a variety of use cases:
-
-* *eCommerce orders* includes visualizations for product-related information,
-such as cost, revenue, and price.
-* *Flight data* enables you to view and interact with flight routes.
-* *Web logs* lets you analyze website traffic.
-
-To get started, go to the {kib} home page and click the link underneath *Add sample data*.
-
-Once you've loaded a data set, click *View data* to view prepackaged 
-visualizations, dashboards, Canvas workpads, Maps, and Machine Learning jobs.
-
-[role="screenshot"]
-image::images/add-sample-data.png[]
-
-NOTE: The timestamps in the sample data sets are relative to when they are installed.
-If you uninstall and reinstall a data set, the timestamps will change to reflect the most recent installation.
-
-[float]
-=== Next steps
-
-* Explore {kib} by following the <<tutorial-sample-data, sample data tutorial>>.
-
-* Learn how to load data, define index patterns, and build visualizations by <<tutorial-build-dashboard, building your own dashboard>>.
diff --git a/docs/getting-started/images/gs_maps_time_filter.png b/docs/getting-started/images/gs_maps_time_filter.png
new file mode 100644
index 00000000000000..83e20c279906ed
Binary files /dev/null and b/docs/getting-started/images/gs_maps_time_filter.png differ
diff --git a/docs/getting-started/images/tutorial-discover-2.png b/docs/getting-started/images/tutorial-discover-2.png
index 7190c90d8e5bac..681e4834de830e 100644
Binary files a/docs/getting-started/images/tutorial-discover-2.png and b/docs/getting-started/images/tutorial-discover-2.png differ
diff --git a/docs/getting-started/images/tutorial-pattern-1.png b/docs/getting-started/images/tutorial-pattern-1.png
index 8a289f93fc66ec..0026b18775518a 100644
Binary files a/docs/getting-started/images/tutorial-pattern-1.png and b/docs/getting-started/images/tutorial-pattern-1.png differ
diff --git a/docs/getting-started/images/tutorial-visualize-bar-1.5.png b/docs/getting-started/images/tutorial-visualize-bar-1.5.png
index c02b9ca59dff56..009152f9407e46 100644
Binary files a/docs/getting-started/images/tutorial-visualize-bar-1.5.png and b/docs/getting-started/images/tutorial-visualize-bar-1.5.png differ
diff --git a/docs/getting-started/images/tutorial-visualize-map-2.png b/docs/getting-started/images/tutorial-visualize-map-2.png
index f4d1d0e47fe6ad..ed2fd47cb27de9 100644
Binary files a/docs/getting-started/images/tutorial-visualize-map-2.png and b/docs/getting-started/images/tutorial-visualize-map-2.png differ
diff --git a/docs/getting-started/images/tutorial-visualize-md-2.png b/docs/getting-started/images/tutorial-visualize-md-2.png
index 9e9a670ba196f1..af56faa3b05161 100644
Binary files a/docs/getting-started/images/tutorial-visualize-md-2.png and b/docs/getting-started/images/tutorial-visualize-md-2.png differ
diff --git a/docs/getting-started/images/tutorial-visualize-pie-2.png b/docs/getting-started/images/tutorial-visualize-pie-2.png
index ef5d62b4ceee70..ca8f5e92146bc2 100644
Binary files a/docs/getting-started/images/tutorial-visualize-pie-2.png and b/docs/getting-started/images/tutorial-visualize-pie-2.png differ
diff --git a/docs/getting-started/images/tutorial-visualize-pie-3.png b/docs/getting-started/images/tutorial-visualize-pie-3.png
index 6974c8d34b0dd3..59fce360096c0f 100644
Binary files a/docs/getting-started/images/tutorial-visualize-pie-3.png and b/docs/getting-started/images/tutorial-visualize-pie-3.png differ
diff --git a/docs/getting-started/images/tutorial_index_patterns.png b/docs/getting-started/images/tutorial_index_patterns.png
new file mode 100644
index 00000000000000..430baf898b6126
Binary files /dev/null and b/docs/getting-started/images/tutorial_index_patterns.png differ
diff --git a/docs/getting-started/tutorial-dashboard.asciidoc b/docs/getting-started/tutorial-dashboard.asciidoc
deleted file mode 100644
index 2ee2d76024aed5..00000000000000
--- a/docs/getting-started/tutorial-dashboard.asciidoc
+++ /dev/null
@@ -1,53 +0,0 @@
-[[tutorial-dashboard]]
-=== Add the visualizations to a dashboard
-
-Build a dashboard that contains the visualizations and map that you saved during
-this tutorial.
-
-. Open the menu, go to *Dashboard*, then click *Create dashboard*.
-. Set the time filter to May 18, 2015 to May 20, 2015.
-. Click *Add*, then select the following:
- * *Bar Example*
- * *Map Example*
- * *Markdown Example*
- * *Pie Example*
-+
-Your sample dashboard looks like this:
-+
-[role="screenshot"]
-image::images/tutorial-dashboard.png[]
-
-. Try out the editing controls.
-+
-You can rearrange the visualizations by clicking a the header of a
-visualization and dragging. The gear icon in the top right of a visualization
-displays controls for editing and deleting the visualization.  A resize control
-is on the lower right.
-
-. *Save* your dashboard.
-
-==== Inspect the data
-
-Seeing visualizations of your data is great,
-but sometimes you need to look at the actual data to
-understand what's really going on. You can inspect the data behind any visualization
-and view the {es} query used to retrieve it.
-
-. Click the pie chart *Options* menu, then select *Inspect*.
-+
-[role="screenshot"]
-image::images/tutorial-full-inspect1.png[]
-
-. To look at the query used to fetch the data for the visualization, select *View > Requests*.
-
-[float]
-=== Next steps
-
-Now that you have the basics, you're ready to start exploring
-your own data with {kib}.
-
-* To learn about searching and filtering your data, refer to {kibana-ref}/discover.html[Discover].
-* To learn about the visualization types {kib} has to offer, refer to {kibana-ref}/visualize.html[Visualize].
-* To learn about configuring {kib} and managing your saved objects, refer to {kibana-ref}/management.html[Management].
-* To learn about the interactive console you can use to submit REST requests to {es}, refer to {kibana-ref}/console-kibana.html[Console].
-
diff --git a/docs/getting-started/tutorial-define-index.asciidoc b/docs/getting-started/tutorial-define-index.asciidoc
index 254befa55faeac..fbe7450683dbc1 100644
--- a/docs/getting-started/tutorial-define-index.asciidoc
+++ b/docs/getting-started/tutorial-define-index.asciidoc
@@ -1,7 +1,7 @@
 [[tutorial-define-index]]
 === Define your index patterns
 
-Index patterns tell Kibana which Elasticsearch indices you want to explore.
+Index patterns tell {kib} which {es} indices you want to explore.
 An index pattern can match the name of a single index, or include a wildcard
 (*) to match multiple indices. 
 
@@ -10,28 +10,29 @@ series of indices in the format `logstash-YYYY.MMM.DD`. To explore all
 of the log data from May 2018, you could specify the index pattern
 `logstash-2018.05*`.
 
-
 [float]
-==== Create your first index pattern
+==== Create the index patterns
 
 First you'll create index patterns for the Shakespeare data set, which has an
 index named `shakespeare,` and the accounts data set, which has an index named
 `bank`. These data sets don't contain time series data.
 
 . Open the menu, then go to *Stack Management > {kib} > Index Patterns*.
+
 . If this is your first index pattern, the *Create index pattern* page opens.
-Otherwise, click *Create index pattern*.
-. In the *Index pattern field*, enter `shakes*`.
+
+. In the *Index pattern name* field, enter `shakes*`.
 +
 [role="screenshot"]
-image::images/tutorial-pattern-1.png[]
+image::images/tutorial-pattern-1.png[shakes* index patterns]
 
 . Click *Next step*.
-. Select the *Time Filter field name*, then click *Create index pattern*.
+
+. On the *Configure settings* page, *Create index pattern*.
 +
 You’re presented a table of all fields and associated data types in the index.
 
-. Return to the *Index patterns* page and create a second index pattern named  `ba*`. 
+. Create a second index pattern named  `ba*`. 
 
 [float]
 ==== Create an index pattern for the time series data
@@ -39,15 +40,12 @@ You’re presented a table of all fields and associated data types in the index.
 Create an index pattern for the Logstash index, which
 contains the time series data.
 
-. Define an index pattern named `logstash*`.
-. Click *Next step*.
-. From the *Time Filter field name* dropdown, select *@timestamp*.
-. Click *Create index pattern*.
+. Create an index pattern named `logstash*`, then click *Next step*.
 
-NOTE: When you define an index pattern, the indices that match that pattern must
-exist in Elasticsearch and they must contain data. To check which indices are
-available, open the menu, then go to *Dev Tools > Console* and enter `GET _cat/indices`.  Alternately, use
-`curl -XGET "http://localhost:9200/_cat/indices"`.
+. From the *Time field* dropdown, select *@timestamp, then click *Create index pattern*.
++
+[role="screenshot"]
+image::images/tutorial_index_patterns.png[All tutorial index patterns]
 
 
 
diff --git a/docs/getting-started/tutorial-discovering.asciidoc b/docs/getting-started/tutorial-discovering.asciidoc
index 31d77be1275ee1..ec07a74b8ac0db 100644
--- a/docs/getting-started/tutorial-discovering.asciidoc
+++ b/docs/getting-started/tutorial-discovering.asciidoc
@@ -1,9 +1,8 @@
-[[tutorial-discovering]]
-=== Discover your data
+[[explore-your-data]]
+=== Explore your data
 
-Using *Discover*, enter
-an {ref}/query-dsl-query-string-query.html#query-string-syntax[Elasticsearch
-query] to search your data and filter the results.
+With *Discover*, you use {ref}/query-dsl-query-string-query.html#query-string-syntax[Elasticsearch
+queries] to explore your data and narrow the results with filters.
 
 . Open the menu, then go to *Discover*.
 +
@@ -13,7 +12,7 @@ The `shakes*` index pattern appears.
 +
 By default, all fields are shown for each matching document.
 
-. In the *Search* field, enter the following:
+. In the *Search* field, enter the following, then click *Update*:
 +
 [source,text]
 account_number<100 AND balance>47500
@@ -32,3 +31,5 @@ account numbers.
 +
 [role="screenshot"]
 image::images/tutorial-discover-3.png[]
+
+Now that you know what your documents contain, it's time to gain insight into your data with visualizations.
diff --git a/docs/getting-started/tutorial-full-experience.asciidoc b/docs/getting-started/tutorial-full-experience.asciidoc
index e6f2de87905bff..1e6fe39dbd013c 100644
--- a/docs/getting-started/tutorial-full-experience.asciidoc
+++ b/docs/getting-started/tutorial-full-experience.asciidoc
@@ -1,32 +1,23 @@
-[[tutorial-build-dashboard]]
-== Build your own dashboard
+[[create-your-own-dashboard]]
+== Create your own dashboard
 
-Want to load some data into Kibana and build a dashboard? This tutorial shows you how to:
+Ready to add data to {kib} and create your own dashboard? In this tutorial, you'll use three types of data sets that'll help you learn to:
 
-* <<tutorial-load-dataset, Load a data set into Elasticsearch>>
-* <<tutorial-define-index, Define an index pattern to connect to Elasticsearch>>
-* <<tutorial-discovering, Discover and explore the data>>
-* <<tutorial-visualizing, Visualize the data>>
-* <<tutorial-dashboard, Add visualizations to a dashboard>>
-
-When you complete this tutorial, you'll have a dashboard that looks like this.
-
-[role="screenshot"]
-image::images/tutorial-dashboard.png[]
+* <<load-the-data-sets, Load data into Elasticsearch>>
+* <<tutorial-define-index, Define an index pattern>>
+* <<explore-your-data, Discover and explore data>>
+* <<tutorial-visualizing, Visualize data>>
 
 [float]
-[[tutorial-load-dataset]]
-=== Load sample data
+[[download-the-data]]
+=== Download the data
 
-This tutorial requires you to download three data sets:
+To complete the tutorial, you'll download and use the following data sets:
 
 * The complete works of William Shakespeare, suitably parsed into fields
-* A set of fictitious accounts with randomly generated data
+* A set of fictitious bank accounts with randomly generated data
 * A set of randomly generated log files
 
-[float]
-==== Download the data sets
-
 Create a new working directory where you want to download the files. From that directory, run the following commands:
 
 [source,shell]
@@ -34,7 +25,7 @@ curl -O https://download.elastic.co/demos/kibana/gettingstarted/8.x/shakespeare.
 curl -O https://download.elastic.co/demos/kibana/gettingstarted/8.x/accounts.zip
 curl -O https://download.elastic.co/demos/kibana/gettingstarted/8.x/logs.jsonl.gz
 
-Two of the data sets are compressed. To extract the files, use these commands:
+Two of the data sets are compressed. To extract the files, use the following commands:
 
 [source,shell]
 unzip accounts.zip
@@ -43,7 +34,7 @@ gunzip logs.jsonl.gz
 [float]
 ==== Structure of the data sets
 
-The Shakespeare data set has this structure:
+The Shakespeare data set has the following structure:
 
 [source,json]
 {
@@ -55,7 +46,7 @@ The Shakespeare data set has this structure:
     "text_entry": "String",
 }
 
-The accounts data set is structured as follows:
+The accounts data set has the following structure:
 
 [source,json]
 {
@@ -72,7 +63,7 @@ The accounts data set is structured as follows:
     "state": "String"
 }
 
-The logs data set has dozens of different fields. Here are the notable fields for this tutorial:
+The logs data set has dozens of different fields. The notable fields include the following:
 
 [source,json]
 {
@@ -94,7 +85,7 @@ You must also have the `create`, `manage` `read`, `write,` and `delete`
 index privileges. See {ref}/security-privileges.html[Security privileges] 
 for more information.
 
-Open *Dev Tools*. On the *Console* page, set up a mapping for the Shakespeare data set:
+Open the menu, then go to *Dev Tools*. On the *Console* page, set up a mapping for the Shakespeare data set:
 
 [source,js]
 PUT /shakespeare
@@ -111,10 +102,11 @@ PUT /shakespeare
 
 //CONSOLE
 
-This mapping specifies field characteristics for the data set:
+The mapping specifies field characteristics for the data set:
 
 * The `speaker` and `play_name` fields are keyword fields. These fields are not analyzed.
 The strings are treated as a single unit even if they contain multiple words.
+
 * The `line_id` and `speech_number` fields are integers.
 
 The logs data set requires a mapping to label the latitude and longitude pairs
@@ -177,6 +169,7 @@ PUT /logstash-2015.05.20
 The accounts data set doesn't require any mappings.
 
 [float]
+[[load-the-data-sets]]
 ==== Load the data sets
 
 At this point, you're ready to use the Elasticsearch {ref}/docs-bulk.html[bulk]
@@ -195,14 +188,20 @@ Invoke-RestMethod "http://<host>:<port>/_bulk?pretty" -Method Post -ContentType
 
 These commands might take some time to execute, depending on the available computing resources.
 
-Verify successful loading:
+When you define an index pattern, the indices that match the pattern must
+exist in {es} and contain data. 
+
+To verify the availability of the indices, open the menu, go to *Dev Tools > Console*, then enter:
 
 [source,js]
 GET /_cat/indices?v
 
-//CONSOLE
+Alternately, use:
+
+[source,shell]
+`curl -XGET "http://localhost:9200/_cat/indices"`.
 
-Your output should look similar to this:
+The output should look similar to:
 
 [source,shell]
 health status index               pri rep docs.count docs.deleted store.size pri.store.size
diff --git a/docs/getting-started/tutorial-sample-data.asciidoc b/docs/getting-started/tutorial-sample-data.asciidoc
index 2460a55e132937..18ef862272f85c 100644
--- a/docs/getting-started/tutorial-sample-data.asciidoc
+++ b/docs/getting-started/tutorial-sample-data.asciidoc
@@ -1,207 +1,159 @@
-[[tutorial-sample-data]]
+[[explore-kibana-using-sample-data]]
 == Explore {kib} using sample data
 
-Ready to get some hands-on experience with Kibana?
-In this tutorial, you’ll work 
-with Kibana sample data and learn to:
+Ready to get some hands-on experience with {kib}?
+In this tutorial, you’ll work with {kib} sample data and learn to:
 
-* <<tutorial-sample-filter, Filter and query data in visualizations>>
-* <<tutorial-sample-discover, Discover and explore your documents>>
-* <<tutorial-sample-edit, Edit a visualization>>
-* <<tutorial-sample-inspect, Inspect the data behind a visualization>>
+* <<explore-the-data, Explore the sample data using *Discover*>>
 
+* <<view-and-analyze-the-data, View and analyze the data on a dashboard>>
 
-NOTE: If security is enabled, you must have `read`, `write`, and `manage` privileges
-on the `kibana_sample_data_*` indices. See
-{ref}/security-privileges.html[Security privileges] for more information.
+* <<filter-and-query-the-data, Filter and query the dashboard data>>
 
+NOTE: If security is enabled, you must have `read`, `write`, and `manage` privileges
+on the `kibana_sample_data_*` indices. For more information, refer to
+{ref}/security-privileges.html[Security privileges].
 
 [float]
-=== Add sample data
+[[add-the-sample-data]]
+=== Add the sample data
 
-Install the Flights sample data set, if you haven't already.
+Add the *Sample flight data*.
 
 . On the home page, click *Load a data set and a {kib} dashboard*. 
+
 . On the *Sample flight data* card, click *Add data*.
-. Once the data is added, click *View data > Dashboard*.
-+
-You’re taken to the *Global Flight* dashboard, a collection of charts, graphs, 
-maps, and other visualizations of the the data in the `kibana_sample_data_flights` index.
-+
-[role="screenshot"]
-image::getting-started/images/tutorial-sample-dashboard.png[]
 
 [float]
-[[tutorial-sample-filter]]
-=== Filter and query the data
+[[explore-the-data]]
+=== Explore the data
 
-You can use filters and queries to
-narrow the view of the data. 
-For more detailed information on these actions, see 
-{ref}/query-filter-context.html[Query and filter context].
+Explore the documents in the index that 
+match the selected index pattern. The index pattern tells {kib} which {es} index you want to
+explore. 
 
-[float]
-==== Filter the data
+. Open the menu, then go to *Discover*.
 
-. In the *Controls* visualization, select an *Origin City* and a *Destination City*.
-. Click *Apply changes*.
+. Make sure `kibana_sample_data_flights` is the current index pattern. 
+You might need to click *New* in the {kib} toolbar to refresh the data.
 +
-The `OriginCityName` and the `DestCityName` fields filter the data on the dasbhoard to match 
-the data you specified. 
+You'll see a histogram that shows the distribution of 
+documents over time. A table lists the fields for 
+each document that matches the index. By default, all fields are shown.
 +
-For example, the following dashboard shows the data for flights from London to Milan. 
+[role="screenshot"]
+image::getting-started/images/tutorial-sample-discover1.png[]
+
+. Hover over the list of *Available fields*, then click *Add* next 
+to each field you want explore in the table.
 +
 [role="screenshot"]
-image::getting-started/images/tutorial-sample-filter.png[]
+image::getting-started/images/tutorial-sample-discover2.png[]
 
-. To add a filter manually, click *Add filter*,
-then specify the data you want to view.
+[float]
+[[view-and-analyze-the-data]]
+=== View and analyze the data
 
-. When you are finished experimenting, remove all filters.
+A _dashboard_ is a collection of panels that provide you with an overview of your data that you can 
+use to analyze your data. Panels contain everything you need, including visualizations, 
+interactive controls, Markdown, and more.
+
+To open the *Global Flight* dashboard, open the menu, then go to *Dashboard*.
 
+[role="screenshot"]
+image::getting-started/images/tutorial-sample-dashboard.png[]
 
 [float]
-[[tutorial-sample-query]]
-==== Query the data
+[[change-the-panel-data]]
+==== Change the panel data
 
-. To find all flights out of Rome, enter this query in the query bar and click *Update*:
-+
-[source,text]
-OriginCityName:Rome   
+To gain insights into your data, change the appearance and behavior of the panels. 
+For example, edit the metric panel to find the airline that has the lowest average fares.
 
-. For a more complex query with AND and OR, try this:
-+
-[source,text]
-OriginCityName:Rome AND (Carrier:JetBeats OR "Kibana Airlines")
-+
-The dashboard updates to show data for the flights out of Rome on JetBeats and 
-{kib} Airlines.  
-+
-[role="screenshot"]
-image::getting-started/images/tutorial-sample-query.png[]
+. In the {kib} toolbar, click *Edit*.
 
-. When you are finished exploring the dashboard, remove the query by 
-clearing the contents in the query bar and clicking *Update*.
+. In the *Average Ticket Price* metric panel, open the panel menu, then select *Edit visualization*.
 
-[float]
-[[tutorial-sample-discover]]
-=== Discover the data
+. To change the data on the panel, use an {es} {ref}/search-aggregations.html[bucket aggregation],  
+which sorts the documents that match your search criteria into different categories or buckets.
 
-In Discover, you have access to every document in every index that 
-matches the selected index pattern. The index pattern tells {kib} which {es} index you are currently
-exploring. You can submit search queries, filter the 
-search results, and view document data.
+.. In the *Buckets* pane, select *Add > Split group*.
 
-. From the menu, click *Discover*.
+.. From the *Aggregation* dropdown, select *Terms*.
 
-. Ensure `kibana_sample_data_flights` is the current index pattern. 
-You might need to click *New* in the menu bar to refresh the data.
+.. From the *Field* dropdown, select *Carrier*.
+
+.. Set *Descending* to *4*, then click *Update*.
 +
-You'll see a histogram that shows the distribution of 
-documents over time. A table lists the fields for 
-each matching document. By default, all fields are shown.
+The average ticket price for all four airlines appear in the visualization builder.
 +
 [role="screenshot"]
-image::getting-started/images/tutorial-sample-discover1.png[]
+image::getting-started/images/tutorial-sample-edit1.png[]
 
-. To choose which fields to display, 
-hover the pointer over the list of *Available fields*, and then click *add* next 
-to each field you want include as a column in the table.
-+
-For example, if you add the `DestAirportID` and `DestWeather` fields, 
-the display includes columns for those two fields.
+. To save your changes, click *Save and return* in the {kib} toolbar. 
+
+. To save the dashboard, click *Save* in the {kib} toolbar.
 +
 [role="screenshot"]
-image::getting-started/images/tutorial-sample-discover2.png[]
+image::getting-started/images/tutorial-sample-edit2.png[]
 
 [float]
-[[tutorial-sample-edit]]
-=== Edit a visualization
-
-You have edit permissions for the *Global Flight* dashboard, so you can change 
-the appearance and behavior of the visualizations. For example, you might want 
-to see which airline has the lowest average fares.
-
-. In the side navigation, click *Recently viewed* and open the *Global Flight Dashboard*. 
-. In the menu bar, click *Edit*.
-. In the *Average Ticket Price* visualization, click the gear icon in 
-the upper right.
-. From the *Options* menu, select *Edit visualization*.
-+
-*Average Ticket Price* is a metric visualization.
-To specify which groups to display 
-in this visualization, you use an {es} {ref}/search-aggregations.html[bucket aggregation]. 
-This aggregation sorts the documents that match your search criteria into different 
-categories, or buckets.
+[[filter-and-query-the-data]]
+==== Filter and query the data
 
-[float]
-==== Create a bucket aggregation
+To focus in on the data you want to explore, use filters and queries. 
+For more information, refer to 
+{ref}/query-filter-context.html[Query and filter context].
+
+To filter the data:
 
-. In the *Buckets* pane, select *Add > Split group*.
-. In the *Aggregation* dropdown, select *Terms*.
-. In the *Field* dropdown, select *Carrier*.
-. Set *Descending* to *4*.
-. Click *Apply changes* image:images/apply-changes-button.png[].
+. In the *Controls* visualization, select an *Origin City* and *Destination City*, then click *Apply changes*.
 +
-You now see the average ticket price for all four airlines.
+The `OriginCityName` and the `DestCityName` fields filter the data in the panels. 
 +
-[role="screenshot"]
-image::getting-started/images/tutorial-sample-edit1.png[]
-
-[float]
-==== Save the visualization
-
-. In the menu bar, click *Save*.
-. Leave the visualization name as is and confirm the save.
-. Go to the *Global Flight* dashboard and scroll the *Average Ticket Price* visualization to see the four prices.
-. Optionally, edit the dashboard. Resize the panel 
-for the *Average Ticket Price* visualization by dragging the
-handle in the lower right. You can also rearrange the visualizations by clicking 
-the header and dragging. Be sure to save the dashboard.
+For example, the following dashboard shows the data for flights from London to Milan. 
 +
 [role="screenshot"]
-image::getting-started/images/tutorial-sample-edit2.png[]
+image::getting-started/images/tutorial-sample-filter.png[]
 
-[float]
-[[tutorial-sample-inspect]]
-=== Inspect the data
+. To manually add a filter, click *Add filter*,
+then specify the data you want to view.
 
-Seeing visualizations of your data is great, 
-but sometimes you need to look at the actual data to
-understand what's really going on. You can inspect the data behind any visualization
-and view the {es} query used to retrieve it.
+. When you are finished experimenting, remove all filters.
 
-. In the dashboard, hover the pointer over the pie chart, and then click the icon in the upper right. 
-. From the *Options* menu, select *Inspect*.
+[[query-the-data]]
+To query the data:
+
+. To view all flights out of Rome, enter the following in the *KQL* query bar, then click *Update*:
 +
-The initial view shows the document count. 
+[source,text]
+OriginCityName: Rome
+
+. For a more complex query with AND and OR, enter:
++
+[source,text]
+OriginCityName:Rome AND (Carrier:JetBeats OR Carrier:"Kibana Airlines")
++
+The dashboard panels update to display the flights out of Rome on JetBeats and 
+{kib} Airlines.  
 +
 [role="screenshot"]
-image::getting-started/images/tutorial-sample-inspect1.png[]
-
-. To look at the query used to fetch the data for the visualization, select *View > Requests*
-in the upper right of the Inspect pane.
-
-[float]
-[[tutorial-sample-remove]]
-=== Remove the sample data set
-When you’re done experimenting with the sample data set, you can remove it. 
+image::getting-started/images/tutorial-sample-query.png[]
 
-. Go to the *Sample data* page. 
-. On the *Sample flight data* card, click *Remove*.
+. When you are finished exploring, remove the query by 
+clearing the contents in the *KQL* query bar, then click *Update*.
 
 [float]
 === Next steps
 
-Now that you have a handle on the {kib} basics, you might be interested in the 
-tutorial <<tutorial-build-dashboard, Build your own dashboard>>, where you'll learn to:
+Now that you know the {kib} basics, try out the <<create-your-own-dashboard, Create your own dashboard>> tutorial, where you'll learn to:
+
+* Add a data set to {kib}
 
-* Load data
 * Define an index pattern
-* Discover and explore data
-* Create visualizations
-* Add visualizations to a dashboard
 
+* Discover and explore data
 
+* Create and add panels to a dashboard
 
 
diff --git a/docs/getting-started/tutorial-visualizing.asciidoc b/docs/getting-started/tutorial-visualizing.asciidoc
index 20b4e335830725..33a70351602477 100644
--- a/docs/getting-started/tutorial-visualizing.asciidoc
+++ b/docs/getting-started/tutorial-visualizing.asciidoc
@@ -1,47 +1,76 @@
 [[tutorial-visualizing]]
 === Visualize your data
 
-In *Visualize*, you can shape your data using a variety
-of charts, tables, and maps, and more. In this tutorial, you'll create four
-visualizations:
+Shape your data using a variety
+of {kib} supported visualizations, tables, and more. In this tutorial, you'll create four
+visualizations that you'll use to create a dashboard.
 
-* <<tutorial-visualize-pie, Pie chart>>
-* <<tutorial-visualize-bar, Bar chart>>
-* <<tutorial-visualize-map, Map>>
-* <<tutorial-visualize-markdown, Markdown widget>>
+To begin, open the menu, go to *Dashboard*, then click *Create new dashboard*.
 
 [float]
-[[tutorial-visualize-pie]]
-=== Pie chart
+[[compare-the-number-of-speaking-parts-in-the-play]]
+=== Compare the number of speaking parts in the plays
 
-Use the pie chart to
-gain insight into the account balances in the bank account data.
+To visualize the Shakespeare data and compare the number of speaking parts in the plays, create a bar chart using *Lens*.
 
-. Open then menu, then go to *Visualize*.
-. Click *Create visualization*.
+. Click *Create new*, then click *Lens* on the *New Visualization* window.
 +
 [role="screenshot"]
-image::images/tutorial-visualize-wizard-step-1.png[]
-. Click *Pie*.
+image::images/tutorial-visualize-wizard-step-1.png[Bar chart]
 
-. On the *Choose a source* window, select `ba*`.
+. Make sure the index pattern is *shakes*.
+
+. Display the play data along the x-axis.
+
+.. From the *Available fields* list, drag and drop *play_name* to the *X-axis* field.
+
+.. Click *Top values of play_name*.
+
+.. From the *Order direction* dropdown, select *Ascending*.
+
+.. In the *Label* field, enter `Play Name`. 
+
+. Display the number of speaking parts per play along the y-axis.
+
+.. From the *Available fields* list, drag and drop *speaker* to the *Y-axis* field.
+
+.. Click *Unique count of speaker*.
+
+.. In the *Label* field, enter `Speaking Parts`. 
++
+[role="screenshot"]
+image::images/tutorial-visualize-bar-1.5.png[Bar chart]
+
+. *Save* the chart with the name `Bar Example`.
 +
-Initially, the pie contains a single "slice."
-That's because the default search matches all documents.
+To show a tooltip with the number of speaking parts for that play, hover over a bar.
 +
-To specify which slices to display in the pie, you use an Elasticsearch
-{ref}/search-aggregations.html[bucket aggregation]. This aggregation
-sorts the documents that match your search criteria into different
-categories. You'll use a bucket aggregation to establish
-multiple ranges of account balances and find out how many accounts fall into
-each range.
+Notice how the individual play names show up as whole phrases, instead of
+broken up into individual words. This is the result of the mapping
+you did at the beginning of the tutorial, when you marked the `play_name` field
+as `not analyzed`.
 
-. In the *Buckets* pane, click *Add > Split slices.*
+[float]
+[[view-the-average-account-balance-by-age]]
+=== View the average account balance by age
+
+To gain insight into the account balances in the bank account data, create a pie chart. In this tutorial, you'll use the {es}
+{ref}/search-aggregations.html[bucket aggregation] to specify the pie slices to display. The bucket aggregation sorts the documents that match your search criteria into different
+categories and establishes multiple ranges of account balances so that you can find how many accounts fall into each range.
+
+. Click *Create new*, then click *Pie* on the *New Visualization* window.
+
+. On the *Choose a source* window, select `ba*`.
 +
+Since the default search matches all documents, the pie contains a single slice. 
+
+. In the *Buckets* pane, click *Add > Split slices.*
+
 .. From the *Aggregation* dropdown, select *Range*.
+
 .. From the *Field* dropdown, select *balance*.
-.. Click *Add range* four times to bring the total number of ranges to six.
-.. Define the following ranges:
+
+.. Click *Add range* until there are six rows of fields, then define the following ranges:
 +
 [source,text]
 0             999
@@ -53,80 +82,83 @@ each range.
 
 . Click *Update*.
 +
-Now you can see what proportion of the 1000 accounts fall into each balance
-range.
+The pie chart displays the proportion of the 1,000 accounts that fall into each of the ranges.
 +
 [role="screenshot"]
-image::images/tutorial-visualize-pie-2.png[]
+image::images/tutorial-visualize-pie-2.png[Pie chart]
 
-. Add another bucket aggregation that looks at the ages of the account
-holders.
+. Add another bucket aggregation that displays the ages of the account holders.
 
 .. In the *Buckets* pane, click *Add*, then click *Split slices*.
+
 .. From the *Sub aggregation* dropdown, select *Terms*.
-.. From the *Field* dropdown, select *age*.
 
-. Click  *Update*.
+.. From the *Field* dropdown, select *age*, then click *Update*.
 +
 The break down of the ages of the account holders are displayed
 in a ring around the balance ranges.
 +
 [role="screenshot"]
-image::images/tutorial-visualize-pie-3.png[]
+image::images/tutorial-visualize-pie-3.png[Final pie chart]
 
 . Click *Save*, then enter `Pie Example` in the *Title* field.
 
 [float]
-[[tutorial-visualize-bar]]
-=== Bar chart
+[role="xpack"]
+[[visualize-geographic-information]]
+=== Visualize geographic information
 
-Use a bar chart to look at the Shakespeare data set and compare
-the number of speaking parts in the plays.
+To visualize geographic information in the log file data, use <<maps,Maps>>.
 
-. Click *Create visualization > Vertical Bar*, then set the source to `shakes*`.
+. Click *Create new*, then click *Maps* on the *New Visualization* window.
+
+. To change the time, use the time filter.
+
+.. Set the *Start date* to `May 18, 2015 @ 12:00:00.000`.
+
+.. Set the *End date* to `May 20, 2015 @ 12:00:00.000`.
 +
-Initially, the chart is a single bar that shows the total count
-of documents that match the default wildcard query.
+[role="screenshot"]
+image::images/gs_maps_time_filter.png[Time filter for Maps tutorial]
 
-. Show the number of speaking parts per play along the y-axis.
+.. Click *Update*
+
+. Map the geo coordinates from the log files.
 
-.. In the *Metrics* pane, expand *Y-axis*.
-.. From the *Aggregation* dropdown, select *Unique Count*.
-.. From the *Field* dropdown, select *speaker*.
-.. In the *Custom label* field, enter `Speaking Parts`.
+.. Click *Add layer > Clusters and grids*.
 
-. Click *Update*.
+.. From the *Index pattern* dropdown, select *logstash*.
 
-. Show the plays along the x-axis.
+.. Click *Add layer*.
 
-.. In the *Buckets* pane, click *Add > X-axis*.
-.. From the *Aggregation* dropdown, select *Terms*.
-.. From the *Field* dropdown, select *play_name*.
-.. To list the plays alphabetically, select *Ascending* from the *Order* dropdown.
-.. In the *Custom label* field, enter `Play Name`.
+. Specify the *Layer Style*.
 
-. Click *Update*.
+.. From the *Fill color* dropdown, select the yellow to red color ramp.
+
+.. In the *Border width* field, enter `3`.
+
+.. From the *Border color* dropdown, select *#FFF*, then click *Save & close*.
 +
 [role="screenshot"]
-image::images/tutorial-visualize-bar-1.5.png[]
-. *Save* the chart with the name `Bar Example`.
-+
-Hovering over a bar shows a tooltip with the number of speaking parts for
-that play.
-+
-Notice how the individual play names show up as whole phrases, instead of
-broken into individual words. This is the result of the mapping
-you did at the beginning of the tutorial, when you marked the `play_name` field
-as `not analyzed`.
+image::images/tutorial-visualize-map-2.png[Map]
+
+. Click *Save*, then enter `Map Example` in the *Title* field.
+
+. Add the map to your dashboard.
+
+.. Open the menu, go to *Dashboard*, then click *Add*. 
+
+.. On the *Add panels* flyout, click *Map Example*.
 
 [float]
 [[tutorial-visualize-markdown]]
-=== Markdown
+=== Add context to your visualizations with Markdown
 
-Add formatted text to your dashboard with a markdown tool.
+Add context to your new visualizations with Markdown text.
 
-. Click *Create visualization > Markdown*.
-. In the text field, enter the following:
+. Click *Create new*, then click *Markdown* on the *New Visualization* window.
+
+. In the *Markdown* text field, enter:
 +
 [source,markdown]
 # This is a tutorial dashboard!
@@ -140,40 +172,22 @@ The Markdown renders in the preview pane.
 [role="screenshot"]
 image::images/tutorial-visualize-md-2.png[]
 
-. *Save* the tool with the name `Markdown Example`.
+. Click *Save*, then enter `Markdown Example` in the *Title* field.
 
-[float]
-[[tutorial-visualize-map]]
-=== Map
+[role="screenshot"]
+image::images/tutorial-dashboard.png[]
 
-Using <<maps>>, you can visualize geographic information in the log file sample data.
+[float]
+=== Next steps
 
-. Click *Create visualization > Maps*.
+Now that you have the basics, you're ready to start exploring your own system data with {kib}.
 
-. Set the time.
-.. In the time filter, click *Show dates*.
-.. Click the start date, then *Absolute*.
-.. Set the *Start date* to May 18, 2015.
-.. Click *now*, then *Absolute*.
-.. Set the *End date* to May 20, 2015.
-.. Click *Update*
+* To add your own data to {kib}, refer to <<connect-to-elasticsearch,Add data to {kib}>>.
 
-. Map the geo coordinates from the log files.
+* To search and filter your data, refer to {kibana-ref}/discover.html[Discover].
 
-.. Click *Add layer > Clusters and Grids*.
-.. From the *Index pattern* dropdown, select *logstash*.
-.. Click *Add layer*.
+* To create a dashboard with your own data, refer to <<dashboard, Dashboard>>.
 
-. Set the *Layer Style*.
-.. From the *Fill color* dropdown, select the yellow to red color ramp.
-.. From the *Border color* dropdown, select white.
-.. Click *Save & close*.
-+
-The map looks like this:
-+
-[role="screenshot"]
-image::images/tutorial-visualize-map-2.png[]
+* To create maps that you can add to your dashboards, refer to <<maps,Maps>>.
 
-. Navigate the map by clicking and dragging.  Use the controls
-to zoom the map and set filters.
-. *Save* the map with the name `Map Example`.
+* To create presentations of your live data, refer to <<canvas,Canvas>>.
diff --git a/docs/glossary.asciidoc b/docs/glossary.asciidoc
index 1edb33032418bf..be24402170bbee 100644
--- a/docs/glossary.asciidoc
+++ b/docs/glossary.asciidoc
@@ -151,7 +151,7 @@ that you are interested in.
 A navigation path that retains context (time range and filters)
 from the source to the destination, so you can view the data from a new perspective.
 A dashboard that shows the overall status of multiple data centers
-might have a drilldown to a dashboard for a single data center. See {kibana-ref}/drilldowns.html[Drilldowns].
+might have a drilldown to a dashboard for a single data center. See {kibana-ref}/dashboard.html[Drilldowns].
 // end::drilldown-def[]
 
 
@@ -238,7 +238,7 @@ support for scripted fields. See
 Enables you to build visualizations by dragging and dropping data fields.
 Lens makes makes smart visualization suggestions for your data,
 allowing you to switch between visualization types.
-See {kibana-ref}/lens.html[Lens].
+See {kibana-ref}/dashboard.html[Lens].
 // end::lens-def[]
 
 
@@ -350,7 +350,7 @@ A {kib} control that constrains the search results to a particular time period.
 [[glossary-timelion]] Timelion ::
 // tag::timelion-def[]
 A tool for building a time series visualization that analyzes data in time order.
-See {kibana-ref}/timelion.html[Timelion].
+See {kibana-ref}/dashboard.html[Timelion].
 // end::timelion-def[]
 
 
@@ -364,7 +364,7 @@ Timestamped data such as logs, metrics, and events that is indexed on an ongoing
 // tag::tsvb-def[]
 A time series data visualizer that allows you to combine an
 infinite number of aggregations to display complex data.
-See {kibana-ref}/TSVB.html[TSVB].
+See {kibana-ref}/dashboard.html[TSVB].
 // end::tsvb-def[]
 
 
@@ -388,7 +388,7 @@ indices and guides you through resolving issues, including reindexing. See
 [[glossary-vega]] Vega ::
 // tag::vega-def[]
 A declarative language used to create interactive visualizations.
-See {kibana-ref}/vega-graph.html[Vega].
+See {kibana-ref}/dashboard.html[Vega].
 // end::vega-def[]
 
 [[glossary-vector]] vector data::
diff --git a/docs/management/advanced-options.asciidoc b/docs/management/advanced-options.asciidoc
index 9f13c152b4cbec..a64a0330ae43f4 100644
--- a/docs/management/advanced-options.asciidoc
+++ b/docs/management/advanced-options.asciidoc
@@ -150,6 +150,12 @@ working on big documents.
 ==== Machine learning
 
 [horizontal]
+`ml:anomalyDetection:results:enableTimeDefaults`:: Use the default time filter
+in the *Single Metric Viewer* and *Anomaly Explorer*. If this setting is
+disabled, the results for the full time range are shown.
+`ml:anomalyDetection:results:timeDefaults`:: Sets the default time filter for
+viewing {anomaly-job} results. This setting must contain `from` and `to` values (see {ref}/common-options.html#date-math[accepted formats]). It is ignored
+unless `ml:anomalyDetection:results:enableTimeDefaults` is enabled.
 `ml:fileDataVisualizerMaxFileSize`:: Sets the file size limit when importing
 data in the {data-viz}. The default value is `100MB`. The highest supported
 value for this setting is `1GB`.
diff --git a/docs/management/index-patterns.asciidoc b/docs/management/index-patterns.asciidoc
index 05036311c094c6..7de2a042160e99 100644
--- a/docs/management/index-patterns.asciidoc
+++ b/docs/management/index-patterns.asciidoc
@@ -7,7 +7,7 @@ you want to work with.
 Once you create an index pattern, you're ready to:
 
 * Interactively explore your data in <<discover, Discover>>.
-* Analyze your data in charts, tables, gauges, tag clouds, and more in <<visualize, Visualize>>.
+* Analyze your data in charts, tables, gauges, tag clouds, and more in <<dashboard, Dashboard>>.
 * Show off your data in a <<canvas, Canvas>> workpad.
 * If your data includes geo data, visualize it with <<maps, Maps>>.
 
diff --git a/docs/management/managing-saved-objects.asciidoc b/docs/management/managing-saved-objects.asciidoc
index 51de5ad620b46f..8c885ddca52e55 100644
--- a/docs/management/managing-saved-objects.asciidoc
+++ b/docs/management/managing-saved-objects.asciidoc
@@ -92,5 +92,5 @@ index pattern. This is useful if the index you were working with has been rename
 
 WARNING: Validation is not performed for object properties. Submitting an invalid
 change will render the object unusable. A more failsafe approach is to use
-*Discover*, *Visualize*, or *Dashboard* to create new objects instead of
+*Discover* or *Dashboard* to create new objects instead of
 directly editing an existing one.
diff --git a/docs/management/numeral.asciidoc b/docs/management/numeral.asciidoc
index 5d4d48ca785e1e..a8834a3278a9e4 100644
--- a/docs/management/numeral.asciidoc
+++ b/docs/management/numeral.asciidoc
@@ -10,7 +10,7 @@ Numeral formatting patterns are used in multiple places in {kib}, including:
 
 * <<advanced-options, Advanced settings>>
 * <<field-formatters-numeric, Index pattern formatters>>
-* <<TSVB, TSVB>>
+* <<tsvb, TSVB>>
 * <<canvas, Canvas>>
 
 The simplest pattern format is `0`, and the default {kib} pattern is `0,0.[000]`.
diff --git a/docs/management/rollups/create_and_manage_rollups.asciidoc b/docs/management/rollups/create_and_manage_rollups.asciidoc
index 831b536f8c1cb6..8aa57f50fe94bf 100644
--- a/docs/management/rollups/create_and_manage_rollups.asciidoc
+++ b/docs/management/rollups/create_and_manage_rollups.asciidoc
@@ -60,7 +60,7 @@ You can read more at {ref}/rollup-job-config.html[rollup job configuration].
 === Try it: Create and visualize rolled up data
 
 This example creates a rollup job to capture log data from sample web logs.
-To follow along, add the <<get-data-in, sample web logs data set>>.
+To follow along, add the <<gs-get-data-into-kibana, sample web logs data set>>.
 
 In this example, you want data that is older than 7 days in the target index pattern `kibana_sample_data_logs`
 to roll up once a day into the index `rollup_logstash`. You’ll bucket the
@@ -145,7 +145,7 @@ is `rollup_logstash,kibana_sample_data_logs`. In this index pattern, `rollup_log
 matches the rolled up index pattern and `kibana_sample_data_logs` matches the index
 pattern for raw data.
 
-. Go to *Visualize* and create a vertical bar chart.
+. Go to *Dashboard* and create a vertical bar chart.
  
 . Choose `rollup_logstash,kibana_sample_data_logs`
 as your source to see both the raw and rolled up data.
diff --git a/docs/redirects.asciidoc b/docs/redirects.asciidoc
index 1a20c1df582e66..42d1d89145d79c 100644
--- a/docs/redirects.asciidoc
+++ b/docs/redirects.asciidoc
@@ -59,7 +59,7 @@ This page has moved. Please see <<reporting-getting-started>>.
 [role="exclude",id="add-sample-data"]
 == Add sample data
 
-This page has moved. Please see <<get-data-in>>.
+This page has moved. Please see <<gs-get-data-into-kibana>>.
 
 [role="exclude",id="tilemap"]
 == Coordinate map
@@ -95,3 +95,8 @@ More information on this new feature is available in <<apm-alerts>>.
 == Role-based access control
 
 This content has moved to the <<development-rbac, Security>> page.
+
+[role="exclude",id="TSVB"]
+== TSVB
+
+This page was deleted. See <<tsvb>>.
diff --git a/docs/settings/alert-action-settings.asciidoc b/docs/settings/alert-action-settings.asciidoc
index e02c7f212277ec..13c1d20552fa15 100644
--- a/docs/settings/alert-action-settings.asciidoc
+++ b/docs/settings/alert-action-settings.asciidoc
@@ -37,12 +37,12 @@ You can configure the following settings in the `kibana.yml` file.
 [cols="2*<"]
 |===
 
-| `xpack.actions.whitelistedHosts`
-  | A list of hostnames that {kib} is allowed to connect to when built-in actions are triggered. It defaults to `[*]`, allowing any host, but keep in mind the potential for SSRF attacks when hosts are not explicitly whitelisted. An empty list `[]` can be used to block built-in actions from making any external connections. +
+| `xpack.actions.allowedHosts` {ess-icon}
+  | A list of hostnames that {kib} is allowed to connect to when built-in actions are triggered. It defaults to `[*]`, allowing any host, but keep in mind the potential for SSRF attacks when hosts are not explicitly added to the allowed hosts. An empty list `[]` can be used to block built-in actions from making any external connections. +
   +
-  Note that hosts associated with built-in actions, such as Slack and PagerDuty, are not automatically whitelisted. If you are not using the default `[*]` setting, you must ensure that the corresponding endpoints are whitelisted as well.
+  Note that hosts associated with built-in actions, such as Slack and PagerDuty, are not automatically added to allowed hosts. If you are not using the default `[*]` setting, you must ensure that the corresponding endpoints are added to the allowed hosts as well.
 
-| `xpack.actions.enabledActionTypes`
+| `xpack.actions.enabledActionTypes` {ess-icon}
   | A list of action types that are enabled. It defaults to `[*]`, enabling all types. The names for built-in {kib} action types are prefixed with a `.` and include: `.server-log`, `.slack`, `.email`, `.index`, `.pagerduty`, and `.webhook`. An empty list `[]` will disable all action types. +
   +
   Disabled action types will not appear as an option when creating new connectors, but existing connectors and actions of that type will remain in {kib} and will not function.
diff --git a/docs/settings/dev-settings.asciidoc b/docs/settings/dev-settings.asciidoc
index e92e9c2928793e..62553293a7d03a 100644
--- a/docs/settings/dev-settings.asciidoc
+++ b/docs/settings/dev-settings.asciidoc
@@ -14,7 +14,7 @@ They are enabled by default.
 
 [cols="2*<"]
 |===
-| `xpack.grokdebugger.enabled`
+| `xpack.grokdebugger.enabled` {ess-icon}
   | Set to `true` to enable the <<xpack-grokdebugger,Grok Debugger>>. Defaults to `true`.
 
 |===
diff --git a/docs/settings/graph-settings.asciidoc b/docs/settings/graph-settings.asciidoc
index a66785242c19a8..876e3dc936ccfe 100644
--- a/docs/settings/graph-settings.asciidoc
+++ b/docs/settings/graph-settings.asciidoc
@@ -13,7 +13,7 @@ You do not need to configure any settings to use the {graph-features}.
 
 [cols="2*<"]
 |===
-| `xpack.graph.enabled`
+| `xpack.graph.enabled` {ess-icon}
   | Set to `false` to disable the {graph-features}.
 
 |===
diff --git a/docs/settings/monitoring-settings.asciidoc b/docs/settings/monitoring-settings.asciidoc
index d538519eefcc43..6c8632efa9cc07 100644
--- a/docs/settings/monitoring-settings.asciidoc
+++ b/docs/settings/monitoring-settings.asciidoc
@@ -37,6 +37,11 @@ For more information, see
   monitoring back-end does not run and {kib} stats are not sent to the monitoring
   cluster.
 
+a|`monitoring.cluster_alerts.`
+`email_notifications.email_address` {ess-icon}
+    | Specifies the email address where you want to receive cluster alerts.
+    See <<cluster-alert-email-notifications, email notifications>> for details.
+
 | `monitoring.ui.elasticsearch.hosts`
   | Specifies the location of the {es} cluster where your monitoring data is stored.
   By default, this is the same as `elasticsearch.hosts`. This setting enables
@@ -85,7 +90,7 @@ These settings control how data is collected from {kib}.
   | Set to `true` (default) to enable data collection from the {kib} NodeJS server
   for {kib} dashboards to be featured in *{stack-monitor-app}*.
 
-| `monitoring.kibana.collection.interval`
+| `monitoring.kibana.collection.interval` {ess-icon}
   | Specifies the number of milliseconds to wait in between data sampling on the
   {kib} NodeJS server for the metrics that are displayed in the {kib} dashboards.
   Defaults to `10000` (10 seconds).
@@ -111,7 +116,7 @@ about configuring {kib}, see
   | Set to `false` to hide *{stack-monitor-app}*. The monitoring back-end
     continues to run as an agent for sending {kib} stats to the monitoring
     cluster. Defaults to `true`.
-  
+
 | `monitoring.ui.logs.index`
   | Specifies the name of the indices that are shown on the
   <<logs-monitor-page,*Logs*>> page in *{stack-monitor-app}*. The default value
@@ -124,7 +129,7 @@ about configuring {kib}, see
   {ref}/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-size[Terms Aggregation].
   Defaults to `10000`.
 
-| `monitoring.ui.min_interval_seconds`
+| `monitoring.ui.min_interval_seconds` {ess-icon}
   | Specifies the minimum number of seconds that a time bucket in a chart can
   represent. Defaults to 10. If you modify the
   `monitoring.ui.collection.interval` in `elasticsearch.yml`, use the same
@@ -143,7 +148,7 @@ container, then Cgroup statistics are not useful.
 
 [cols="2*<"]
 |===
-| `monitoring.ui.container.elasticsearch.enabled`
+| `monitoring.ui.container.elasticsearch.enabled` {ess-icon}
   | For {es} clusters that are running in containers, this setting changes the
   *Node Listing* to display the CPU utilization based on the reported Cgroup
   statistics. It also adds the calculated Cgroup CPU utilization to the
diff --git a/docs/settings/reporting-settings.asciidoc b/docs/settings/reporting-settings.asciidoc
index 0b6f94e86a39f8..9c8d753a2d6681 100644
--- a/docs/settings/reporting-settings.asciidoc
+++ b/docs/settings/reporting-settings.asciidoc
@@ -17,10 +17,10 @@ You can configure `xpack.reporting` settings in your `kibana.yml` to:
 
 [cols="2*<"]
 |===
-| [[xpack-enable-reporting]]`xpack.reporting.enabled`
+| [[xpack-enable-reporting]]`xpack.reporting.enabled` {ess-icon}
   | Set to `false` to disable the {report-features}.
 
-| `xpack.reporting.encryptionKey`
+| `xpack.reporting.encryptionKey` {ess-icon}
   | Set to an alphanumeric, at least 32 characters long text string. By default, {kib} will generate a random key when it
   starts, which will cause pending reports to fail after restart. Configure this
   setting to preserve the same key across multiple restarts and multiple instances of {kib}.
@@ -86,7 +86,7 @@ reports, you might need to change the following settings.
   | How often the index that stores reporting jobs rolls over to a new index.
   Valid values are `year`, `month`, `week`, `day`, and `hour`. Defaults to `week`.
 
-| `xpack.reporting.queue.pollEnabled`
+| `xpack.reporting.queue.pollEnabled` {ess-icon}
   | Set to `true` (default) to enable the {kib} instance to to poll the index for
   pending jobs and claim them for execution. Setting this to `false` allows the
   {kib} instance to only add new jobs to the reporting queue, list jobs, and
@@ -107,7 +107,7 @@ security is enabled, `xpack.security.encryptionKey`.
   | Specifies the number of milliseconds that the reporting poller waits between polling the
   index for any pending Reporting jobs. Defaults to `3000` (3 seconds).
 
-| [[xpack-reporting-q-timeout]] `xpack.reporting.queue.timeout`
+| [[xpack-reporting-q-timeout]] `xpack.reporting.queue.timeout` {ess-icon}
   | How long each worker has to produce a report. If your machine is slow or under
   heavy load, you might need to increase this timeout. Specified in milliseconds.
   If a Reporting job execution time goes over this time limit, the job will be
@@ -125,19 +125,22 @@ control the capturing process.
 
 [cols="2*<"]
 |===
-| `xpack.reporting.capture.timeouts.openUrl`
+a| `xpack.reporting.capture.timeouts`
+`.openUrl` {ess-icon}
   | Specify how long to allow the Reporting browser to wait for the "Loading..." screen
   to dismiss and find the initial data for the Kibana page.  If the time is
   exceeded, a page screenshot is captured showing the current state, and the download link shows a warning message.
   Defaults to `60000` (1 minute).
 
-| `xpack.reporting.capture.timeouts.waitForElements`
+a| `xpack.reporting.capture.timeouts`
+`.waitForElements` {ess-icon}
   | Specify how long to allow the Reporting browser to wait for all visualization
   panels to load on the Kibana page. If the time is exceeded, a page screenshot
   is captured showing the current state, and the download link shows a warning message. Defaults to `30000` (30
   seconds).
 
-| `xpack.reporting.capture.timeouts.renderComplete`
+a| `xpack.reporting.capture.timeouts`
+`.renderComplete` {ess-icon}
   | Specify how long to allow the Reporting browser to wait for all visualizations to
   fetch and render the data. If the time is exceeded, a
   page screenshot is captured showing the current state, and the download link shows a warning message. Defaults to
@@ -155,7 +158,7 @@ available, but there will likely be errors in the visualizations in the report.
 
 [cols="2*<"]
 |===
-| `xpack.reporting.capture.maxAttempts`
+| `xpack.reporting.capture.maxAttempts` {ess-icon}
   | If capturing a report fails for any reason, {kib} will re-attempt other reporting
   job, as many times as this setting. Defaults to `3`.
 
@@ -166,7 +169,7 @@ available, but there will likely be errors in the visualizations in the report.
   visualizations, try increasing this value.
   Defaults to `3000` (3 seconds).
 
-| [[xpack-reporting-browser]] `xpack.reporting.capture.browser.type`
+| [[xpack-reporting-browser]] `xpack.reporting.capture.browser.type` {ess-icon}
   | Specifies the browser to use to capture screenshots. This setting exists for
   backward compatibility. The only valid option is `chromium`.
 
@@ -180,20 +183,24 @@ When `xpack.reporting.capture.browser.type` is set to `chromium` (default) you c
 
 [cols="2*<"]
 |===
-| `xpack.reporting.capture.browser.chromium.disableSandbox`
+a| `xpack.reporting.capture.browser`
+`.chromium.disableSandbox`
   | It is recommended that you research the feasibility of enabling unprivileged user namespaces.
   See Chromium Sandbox for additional information. Defaults to false for all operating systems except Debian,
   Red Hat Linux, and CentOS which use true.
 
-| `xpack.reporting.capture.browser.chromium.proxy.enabled`
+a| `xpack.reporting.capture.browser`
+`.chromium.proxy.enabled`
   | Enables the proxy for Chromium to use. When set to `true`, you must also specify the
   `xpack.reporting.capture.browser.chromium.proxy.server` setting.
   Defaults to `false`.
 
-| `xpack.reporting.capture.browser.chromium.proxy.server`
+a| `xpack.reporting.capture.browser`
+.chromium.proxy.server`
   | The uri for the proxy server. Providing the username and password for the proxy server via the uri is not supported.
 
-| `xpack.reporting.capture.browser.chromium.proxy.bypass`
+a| `xpack.reporting.capture.browser`
+.chromium.proxy.bypass`
   | An array of hosts that should not go through the proxy server and should use a direct connection instead.
   Examples of valid entries are "elastic.co", "*.elastic.co", ".elastic.co", ".elastic.co:5601".
 
@@ -205,27 +212,27 @@ When `xpack.reporting.capture.browser.type` is set to `chromium` (default) you c
 
 [cols="2*<"]
 |===
-| [[xpack-reporting-csv]] `xpack.reporting.csv.maxSizeBytes`
+| [[xpack-reporting-csv]] `xpack.reporting.csv.maxSizeBytes` {ess-icon}
   | The maximum size of a CSV file before being truncated. This setting exists to prevent
   large exports from causing performance and storage issues.
   Defaults to `10485760` (10mB).
 
 | `xpack.reporting.csv.scroll.size`
-  | Number of documents retrieved from {es} for each scroll iteration during a CSV 
+  | Number of documents retrieved from {es} for each scroll iteration during a CSV
   export.
   Defaults to `500`.
 
 | `xpack.reporting.csv.scroll.duration`
   | Amount of time allowed before {kib} cleans the scroll context during a CSV export.
   Defaults to `30s`.
-  
+
 | `xpack.reporting.csv.checkForFormulas`
   | Enables a check that warns you when there's a potential formula involved in the output (=, -, +, and @ chars).
   See OWASP: https://www.owasp.org/index.php/CSV_Injection
   Defaults to `true`.
-  
+
 | `xpack.reporting.csv.enablePanelActionDownload`
-  | Enables CSV export from a saved search on a dashboard. This action is available in the dashboard 
+  | Enables CSV export from a saved search on a dashboard. This action is available in the dashboard
   panel menu for the saved search.
   Defaults to `true`.
 
diff --git a/docs/settings/security-settings.asciidoc b/docs/settings/security-settings.asciidoc
index a0995cab984d40..b6eecc6ea9f043 100644
--- a/docs/settings/security-settings.asciidoc
+++ b/docs/settings/security-settings.asciidoc
@@ -73,27 +73,27 @@ The valid settings in the `xpack.security.authc.providers` namespace vary depend
 [cols="2*<"]
 |===
 | `xpack.security.authc.providers.`
-`<provider-type>.<provider-name>.enabled`
+`<provider-type>.<provider-name>.enabled` {ess-icon}
 | Determines if the authentication provider should be enabled. By default, {kib} enables the provider as soon as you configure any of its properties.
 
 | `xpack.security.authc.providers.`
-`<provider-type>.<provider-name>.order`
+`<provider-type>.<provider-name>.order` {ess-icon}
 | Order of the provider in the authentication chain and on the Login Selector UI.
 
 | `xpack.security.authc.providers.`
-`<provider-type>.<provider-name>.description`
+`<provider-type>.<provider-name>.description` {ess-icon}
 | Custom description of the provider entry displayed on the Login Selector UI.
 
 | `xpack.security.authc.providers.`
-`<provider-type>.<provider-name>.hint`
+`<provider-type>.<provider-name>.hint` {ess-icon}
 | Custom hint for the provider entry displayed on the Login Selector UI.
 
 | `xpack.security.authc.providers.`
-`<provider-type>.<provider-name>.icon`
+`<provider-type>.<provider-name>.icon` {ess-icon}
 | Custom icon for the provider entry displayed on the Login Selector UI.
 
 | `xpack.security.authc.providers.`
-`<provider-type>.<provider-name>.showInSelector`
+`<provider-type>.<provider-name>.showInSelector` {ess-icon}
 | Flag that indicates if the provider should have an entry on the Login Selector UI. Setting this to `false` doesn't remove the provider from the authentication chain.
 
 2+a|
@@ -104,7 +104,7 @@ You are unable to set this setting to `false` for `basic` and `token` authentica
 ============
 
 | `xpack.security.authc.providers.`
-`<provider-type>.<provider-name>.accessAgreement.message`
+`<provider-type>.<provider-name>.accessAgreement.message` {ess-icon}
 | Access agreement text in Markdown format. For more information, refer to <<xpack-security-access-agreement>>.
 
 |===
@@ -118,11 +118,11 @@ In addition to <<authentication-provider-settings,the settings that are valid fo
 [cols="2*<"]
 |===
 | `xpack.security.authc.providers.`
-`saml.<provider-name>.realm`
+`saml.<provider-name>.realm` {ess-icon}
 | SAML realm in {es} that provider should use.
 
 | `xpack.security.authc.providers.`
-`saml.<provider-name>.useRelayStateDeepLink`
+`saml.<provider-name>.useRelayStateDeepLink` {ess-icon}
 | Determines if the provider should treat the `RelayState` parameter as a deep link in {kib} during Identity Provider initiated log in. By default, this setting is set to `false`. The link specified in `RelayState` should be a relative, URL-encoded {kib} URL. For example, the `/app/dashboards#/list` link in `RelayState` parameter would look like this: `RelayState=%2Fapp%2Fdashboards%23%2Flist`.
 
 |===
@@ -136,7 +136,7 @@ In addition to <<authentication-provider-settings,the settings that are valid fo
 [cols="2*<"]
 |===
 | `xpack.security.authc.providers.`
-`oidc.<provider-name>.realm`
+`oidc.<provider-name>.realm` {ess-icon}
 | OpenID Connect realm in {es} that the provider should use.
 
 |===
@@ -168,13 +168,13 @@ You can configure the following settings in the `kibana.yml` file.
 
 [cols="2*<"]
 |===
-| `xpack.security.loginAssistanceMessage`
+| `xpack.security.loginAssistanceMessage` {ess-icon}
 | Adds a message to the login UI. Useful for displaying information about maintenance windows, links to corporate sign up pages, and so on.
 
-| `xpack.security.loginHelp`
+| `xpack.security.loginHelp` {ess-icon}
 | Adds a message accessible at the login UI with additional help information for the login process.
 
-| `xpack.security.authc.selector.enabled`
+| `xpack.security.authc.selector.enabled` {ess-icon}
 | Determines if the login selector UI should be enabled. By default, this setting is set to `true` if more than one authentication provider is configured.
 
 |===
@@ -203,12 +203,12 @@ You can configure the following settings in the `kibana.yml` file.
   this to `true` if SSL is configured outside of {kib} (for example, you are
   routing requests through a load balancer or proxy).
 
-| `xpack.security.sameSiteCookies`
+| `xpack.security.sameSiteCookies` {ess-icon}
   | Sets the `SameSite` attribute of the session cookie. This allows you to declare whether your cookie should be restricted to a first-party or same-site context.
   Valid values are `Strict`, `Lax`, `None`.
   This is *not set* by default, which modern browsers will treat as `Lax`. If you use Kibana embedded in an iframe in modern browsers, you might need to set it to `None`. Setting this value to `None` requires cookies to be sent over a secure connection by setting `xpack.security.secureCookies: true`.
 
-| `xpack.security.session.idleTimeout`
+| `xpack.security.session.idleTimeout` {ess-icon}
   | Ensures that user sessions will expire after a period of inactivity. This and `xpack.security.session.lifespan` are both
 highly recommended. By default, this setting is not set.
 
@@ -218,7 +218,7 @@ highly recommended. By default, this setting is not set.
 The format is a string of `<count>[ms\|s\|m\|h\|d\|w\|M\|Y]` (e.g. '20m', '24h', '7d', '1w').
 ============
 
-| `xpack.security.session.lifespan`
+| `xpack.security.session.lifespan` {ess-icon}
   | Ensures that user sessions will expire after the defined time period. This behavior also known as an "absolute timeout". If
 this is _not_ set, user sessions could stay active indefinitely. This and `xpack.security.session.idleTimeout` are both highly
 recommended. By default, this setting is not set.
diff --git a/docs/setup/connect-to-elasticsearch.asciidoc b/docs/setup/connect-to-elasticsearch.asciidoc
index f750784c47043b..ea02afb8a9fda6 100644
--- a/docs/setup/connect-to-elasticsearch.asciidoc
+++ b/docs/setup/connect-to-elasticsearch.asciidoc
@@ -11,7 +11,7 @@ To start working with your data in {kib}, you can:
 
 * Connect {kib} with existing {es} indices.
 
-If you're not ready to use your own data, you can add a <<get-data-in, sample data set>>
+If you're not ready to use your own data, you can add a <<gs-get-data-into-kibana, sample data set>>
 to see all that you can do in {kib}.
 
 [float]
diff --git a/docs/user/alerting/action-types.asciidoc b/docs/user/alerting/action-types.asciidoc
index 1743edb10f92b8..be31458ff39fae 100644
--- a/docs/user/alerting/action-types.asciidoc
+++ b/docs/user/alerting/action-types.asciidoc
@@ -25,7 +25,7 @@ a| <<server-log-action-type, ServerLog>>
 
 a| <<servicenow-action-type, ServiceNow>>
 
-| Push or update data to a new incident in ServiceNow.
+| Create an incident in ServiceNow.
 
 a| <<slack-action-type, Slack>>
 
diff --git a/docs/user/alerting/action-types/email.asciidoc b/docs/user/alerting/action-types/email.asciidoc
index f6a02b9038c02b..83e7edc5a016a6 100644
--- a/docs/user/alerting/action-types/email.asciidoc
+++ b/docs/user/alerting/action-types/email.asciidoc
@@ -12,7 +12,7 @@ Email connectors have the following configuration properties:
 
 Name::      The name of the connector. The name is used to identify a  connector in the management UI connector listing, or in the connector list when configuring an action.
 Sender::    The from address for all emails sent with this connector, specified in `user@host-name` format.
-Host::      Host name of the service provider. If you are using the <<action-settings, `xpack.actions.whitelistedHosts`>> setting, make sure this hostname is whitelisted.
+Host::      Host name of the service provider. If you are using the <<action-settings, `xpack.actions.allowedHosts`>> setting, make sure this hostname is added to the allowed hosts.
 Port::      The port to connect to on the service provider.
 Secure::    If true the connection will use TLS when connecting to the service provider. See https://nodemailer.com/smtp/#tls-options[nodemailer TLS documentation] for more information.
 Username::  username for 'login' type authentication.
diff --git a/docs/user/alerting/action-types/pagerduty.asciidoc b/docs/user/alerting/action-types/pagerduty.asciidoc
index 5fd85a10452655..2c9add5233c913 100644
--- a/docs/user/alerting/action-types/pagerduty.asciidoc
+++ b/docs/user/alerting/action-types/pagerduty.asciidoc
@@ -132,7 +132,7 @@ This is an irreversible action and impacts all alerts that use this connector.
 PagerDuty connectors have the following configuration properties:
 
 Name::      The name of the connector. The name is used to identify a  connector in the management UI connector listing, or in the connector list when configuring an action.
-API URL::   An optional PagerDuty event URL. Defaults to `https://events.pagerduty.com/v2/enqueue`. If you are using the <<action-settings, `xpack.actions.whitelistedHosts`>> setting, make sure the hostname is whitelisted.
+API URL::   An optional PagerDuty event URL. Defaults to `https://events.pagerduty.com/v2/enqueue`. If you are using the <<action-settings, `xpack.actions.allowedHosts`>> setting, make sure the hostname is added to the allowed hosts.
 Integration Key::   A 32 character PagerDuty Integration Key for an integration on a service, also referred to as the routing key.
 
 [float]
diff --git a/docs/user/alerting/action-types/slack.asciidoc b/docs/user/alerting/action-types/slack.asciidoc
index 99bf73c0f5597e..a1fe7a2521b22a 100644
--- a/docs/user/alerting/action-types/slack.asciidoc
+++ b/docs/user/alerting/action-types/slack.asciidoc
@@ -11,7 +11,7 @@ The Slack action type uses https://api.slack.com/incoming-webhooks[Slack Incomin
 Slack connectors have the following configuration properties:
 
 Name::      The name of the connector. The name is used to identify a  connector in the management UI connector listing, or in the connector list when configuring an action.
-Webhook URL::   The URL of the incoming webhook. See https://api.slack.com/messaging/webhooks#getting_started[Slack Incoming Webhooks] for instructions on generating this URL. If you are using the <<action-settings, `xpack.actions.whitelistedHosts`>> setting, make sure the hostname is whitelisted.
+Webhook URL::   The URL of the incoming webhook. See https://api.slack.com/messaging/webhooks#getting_started[Slack Incoming Webhooks] for instructions on generating this URL. If you are using the <<action-settings, `xpack.actions.allowedHosts`>> setting, make sure the hostname is added to the allowed hosts.
 
 [float]
 [[Preconfigured-slack-configuration]]
diff --git a/docs/user/alerting/action-types/webhook.asciidoc b/docs/user/alerting/action-types/webhook.asciidoc
index c91c24430e982c..659c3afad6bd1c 100644
--- a/docs/user/alerting/action-types/webhook.asciidoc
+++ b/docs/user/alerting/action-types/webhook.asciidoc
@@ -11,7 +11,7 @@ The Webhook action type uses https://github.com/axios/axios[axios] to send a POS
 Webhook connectors have the following configuration properties:
 
 Name::      The name of the connector. The name is used to identify a  connector in the management UI connector listing, or in the connector list when configuring an action.
-URL::       The request URL. If you are using the <<action-settings, `xpack.actions.whitelistedHosts`>> setting, make sure the hostname is whitelisted.
+URL::       The request URL. If you are using the <<action-settings, `xpack.actions.allowedHosts`>> setting, make sure the hostname is added to the allowed hosts.
 Method::    HTTP request method, either `post`(default) or `put`.
 Headers::   A set of key-value pairs sent as headers with the request
 User::      An optional username. If set, HTTP basic authentication is used. Currently only basic authentication is supported.
diff --git a/docs/user/canvas.asciidoc b/docs/user/canvas.asciidoc
index 317ec67dd7c0af..0b0eb7a3184959 100644
--- a/docs/user/canvas.asciidoc
+++ b/docs/user/canvas.asciidoc
@@ -137,7 +137,7 @@ image::images/canvas-map-embed.gif[]
 
 . To use the customization options, click the panel menu, then select one of the following options:
 
-* *Edit map* &mdash; Opens <<maps,Maps>> or <<visualize,Visualize>> so that you can edit the original saved object.
+* *Edit map* &mdash; Opens <<maps,Maps>> or a visualization builder so that you can edit the original saved object.
 
 * *Edit panel title* &mdash; Adds a title to the saved object.
 
diff --git a/docs/user/dashboard.asciidoc b/docs/user/dashboard.asciidoc
deleted file mode 100644
index b812af7e981bf3..00000000000000
--- a/docs/user/dashboard.asciidoc
+++ /dev/null
@@ -1,191 +0,0 @@
-[[dashboard]]
-= Dashboard
-
-[partintro]
---
-
-A _dashboard_ is a collection of visualizations, searches, and
-maps, typically in real-time. Dashboards provide
-at-a-glance insights into your data and enable you to drill down into details.
-
-With *Dashboard*, you can:
-
-* Add visualizations, saved searches, and maps for side-by-side analysis
-
-* Arrange dashboard elements to display exactly how you want
-
-* Customize time ranges to display only the data you want
-
-* Inspect and edit dashboard elements to find out exactly what kind of data is displayed
-
-[role="screenshot"]
-image:images/Dashboard_example.png[Example dashboard]
-
-[float]
-[[dashboard-read-only-access]]
-=== [xpack]#Read only access#
-If you see
-the read-only icon in the application header,
-then you don't have sufficient privileges to create and save dashboards. The buttons to create and edit
-dashboards are not visible. For more information, see <<xpack-security-authorization>>.
-
-[role="screenshot"]
-image::images/dashboard-read-only-badge.png[Example of Dashboard read only access indicator in Kibana header]
-
---
-
-[[dashboard-create-new-dashboard]]
-== Create a dashboard
-
-To create a dashboard, you must have data indexed into {es}, an index pattern
-to retrieve the data from {es}, and
-visualizations, saved searches, or maps. If these don't exist, you're prompted to
-add them as you create the dashboard, or you can add
-<<add-sample-data, sample data sets>>,
-which include pre-built dashboards.
-
-To begin, open the menu, go to *Dashboard*, then click *Create dashboard.*
-
-[float]
-[[dashboard-add-elements]]
-=== Add elements
-
-The visualizations, saved searches, and maps are stored as elements in panels
-that you can move and resize.
-
-You can add elements from multiple indices, and the same element can appear in
-multiple dashboards.
-
-To create an element:
-
-. Click *Create new*.
-. On the *New Visualization* window, click the visualization type.
-+
-[role="screenshot"]
-image:images/Dashboard_add_new_visualization.png[Example add new visualization to dashboard]
-+
-For information on how to create visualizations, see <<visualize,Visualize>>.
-+
-For information on how to create maps, see <<maps,Maps>>.
-
-To add an existing element:
-
-. Click *Add*.
-
-. On the *Add panels* flyout, select the panel.
-+
-When a dashboard element has a stored query,
-both queries are applied.
-+
-[role="screenshot"]
-image:images/Dashboard_add_visualization.png[Example add visualization to dashboard]
-
-[float]
-[[customizing-your-dashboard]]
-=== Arrange dashboard elements
-
-In *Edit* mode, you can move, resize, customize, and delete panels to suit your needs.
-
-[[moving-containers]]
-* To move a panel, click and hold the panel header and drag to the new location.
-
-[[resizing-containers]]
-* To resize a panel, click the resize control and drag
-to the new dimensions.
-
-* To toggle the use of margins and panel titles, use the *Options* menu.
-
-* To delete a panel, open the panel menu and select *Delete from dashboard.* Deleting a panel from a
-dashboard does *not* delete the saved visualization or search.
-
-[float]
-[[cloning-a-panel]]
-=== Clone dashboard elements
-
-In *Edit* mode, you can clone any panel on a dashboard.
-
-To clone an existing panel, open the panel menu of the element you wish to clone, then select *Clone panel*.
-
-* Cloned panels appear beside the original, and will move other panels down to make room if necessary.
-
-* Clones support all of the original panel's functionality, including renaming, editing, and cloning.
-
-* All cloned visualizations will appear in the visualization list.
-
-[role="screenshot"]
-image:images/clone_panel.gif[clone panel]
-
-
-[float]
-[[viewing-detailed-information]]
-=== Inspect and edit elements
-
-Many dashboard elements allow you to drill down into the data and requests
-behind the element.
-
-From the panel menu, select *Inspect*.
-The data that displays depends on the element that you inspect.
-
-[role="screenshot"]
-image:images/Dashboard_inspect.png[Inspect in dashboard]
-
-To open an element for editing, put the dashboard in *Edit* mode,
-and then select *Edit visualization* from the panel menu. The changes you make appear in
-every dashboard that uses the element.
-
-[float]
-[[dashboard-customize-filter]]
-=== Customize time ranges
-
-You can configure each visualization, saved search, and map on your dashboard
-for a specific time range. For example, you might want one visualization to show
-the monthly trend for CPU usage and another to show the current CPU usage.
-
-From the panel menu, select *Customize time range* to expose a time filter
-dedicated to that panel. Panels that are not restricted by a specific
-time range are controlled by the
-global time filter.
-
-[role="screenshot"]
-image:images/time_range_per_panel.gif[Time range per dashboard panel]
-
-[float]
-[[save-dashboards]]
-=== Save the dashboard
-
-When you're finished adding and arranging the panels, save the dashboard.
-
-. In the {kib} toolbar, click *Save*.
-
-. Enter the dashboard *Title* and optional *Description*, then *Save* the dashboard.
-
-include::{kib-repo-dir}/drilldowns/drilldowns.asciidoc[]
-include::{kib-repo-dir}/drilldowns/explore-underlying-data.asciidoc[]
-
-[[sharing-dashboards]]
-== Share the dashboard
-
-[[embedding-dashboards]]
-Share your dashboard outside of {kib}.
-
-From the *Share* menu, you can:
-
-* Embed the code in a web page. Users must have {kib} access
-to view an embedded dashboard.
-* Share a direct link to a {kib} dashboard
-* Generate a PDF report
-* Generate a PNG report
-
-TIP: To create a link to a dashboard by title, use: +
-`${domain}/${basepath?}/app/dashboards#/list?title=${yourdashboardtitle}`
-
-TIP: When sharing a link to a dashboard snapshot, use the *Short URL*. Snapshot
-URLs are long and can be problematic for Internet Explorer and other
-tools. To create a short URL, you must have write access to {kib}.
-
-[float]
-[[import-dashboards]]
-=== Export the dashboard
-
-To export the dashboard, open the menu, then click *Stack Management > Saved Objects*. For more information,
-refer to <<managing-saved-objects, Managing saved objects>>.
diff --git a/docs/user/dashboard/aggregation-reference.asciidoc b/docs/user/dashboard/aggregation-reference.asciidoc
new file mode 100644
index 00000000000000..1bcea3bb36aea6
--- /dev/null
+++ b/docs/user/dashboard/aggregation-reference.asciidoc
@@ -0,0 +1,242 @@
+[[aggregation-reference]]
+== Aggregation reference
+
+{kib} supports many types of {ref}/search-aggregations.html[{es} aggregations] that you can use to build complex summaries of your data. 
+
+By using a series of {es} aggregations to extract and process your data, you can create panels that tell a 
+story about the trends, patterns, and outliers in your data.
+
+[float]
+[[bucket-aggregations]]
+=== Bucket aggregations
+
+For information about Elasticsearch bucket aggregations, refer to {ref}/search-aggregations-bucket.html[Bucket aggregations].
+
+[options="header"]
+|===
+
+| Type | Visualizations | Data table | Markdown | Lens | TSVB 
+
+| Histogram
+^| X
+^| X
+^| X
+| 
+| 
+
+| Date histogram
+^| X
+^| X
+^| X
+^| X
+^| X
+
+| Date range
+^| X
+^| X
+^| X
+| 
+| 
+
+| Filter
+^| X
+^| X
+^| X
+| 
+^| X
+
+| Filters
+^| X
+^| X
+^| X
+| 
+^| X
+
+| GeoHash grid
+^| X
+^| X
+^| X
+| 
+| 
+
+| IP range
+^| X
+^| X
+^| X
+| 
+| 
+
+| Range
+^| X
+^| X
+^| X
+| 
+| 
+
+| Terms
+^| X
+^| X
+^| X
+^| X
+^| X
+
+| Significant terms
+^| X
+^| X
+^| X
+|
+^| X
+
+|===
+
+[float]
+[[metrics-aggregations]]
+=== Metrics aggregations
+
+For information about Elasticsearch metrics aggregations, refer to {ref}/search-aggregations-metrics.html[Metrics aggregations].
+
+[options="header"]
+|===
+
+| Type | Visualizations | Data table | Markdown | Lens | TSVB
+
+| Average
+^| X
+^| X
+^| X
+^| X
+^| X
+
+| Sum 
+^| X
+^| X
+^| X
+^| X
+^| X
+
+| Unique count (Cardinality)
+^| X
+^| X
+^| X
+^| X
+^| X
+
+| Max
+^| X
+^| X
+^| X
+^| X
+^| X
+
+| Min
+^| X
+^| X
+^| X
+^| X
+^| X
+
+| Percentiles
+^| X
+^| X
+^| X
+| 
+^| X
+
+| Percentiles Rank
+^| X
+^| X
+^| X
+| 
+^| X
+
+| Top hit 
+^| X
+^| X
+^| X
+| 
+^| X
+
+| Value count 
+| 
+| 
+| 
+| 
+^| X
+
+|===
+
+[float]
+[[pipeline-aggregations]]
+=== Pipeline aggregations
+
+For information about Elasticsearch pipeline aggregations, refer to {ref}/search-aggregations-pipeline.html[Pipeline aggregations].
+
+[options="header"]
+|===
+
+| Type | Visualizations | Data table | Markdown | Lens | TSVB
+
+| Avg bucket  
+^| X
+^| X
+^| X
+| 
+^| X
+
+| Derivative  
+^| X
+^| X
+^| X
+| 
+^| X
+
+| Max bucket   
+^| X
+^| X
+^| X
+| 
+^| X
+
+| Min bucket   
+^| X
+^| X
+^| X
+| 
+^| X
+
+| Sum bucket  
+^| X
+^| X
+^| X
+^| 
+^| X
+ 
+| Moving average  
+^| X
+^| X
+^| X
+^| 
+^| X
+
+| Cumulative sum 
+^| X
+^| X
+^| X
+^| 
+^| X
+
+| Bucket script 
+| 
+| 
+| 
+| 
+^| X
+
+| Serial differencing 
+^| X
+^| X
+^| X
+| 
+^| X
+
+|===
diff --git a/docs/user/dashboard/dashboard.asciidoc b/docs/user/dashboard/dashboard.asciidoc
new file mode 100644
index 00000000000000..0c0151cc3ace27
--- /dev/null
+++ b/docs/user/dashboard/dashboard.asciidoc
@@ -0,0 +1,472 @@
+[[dashboard]]
+= Dashboard
+
+[partintro]
+--
+
+A _dashboard_ is a collection of panels that you use to analyze your data. On a dashboard, you can add a variety of panels that 
+you can rearrange and tell a story about your data. Panels contain everything you need, including visualizations, 
+interactive controls, markdown, and more.  
+
+With *Dashboard*s, you can:
+
+* Add multiple panels to see many aspects and views of your data in one place.
+
+* Arrange panels for analysis and comparison.
+
+* Add text and images to provide context to the panels and make them easy to consume.
+
+* Create and apply filters to focus on the data you want to display.
+
+* Control who can use your data, and share the dashboard with a small or large audience. 
+
+* Generate reports based on your findings.
+
+To begin, open the menu, go to *Dashboard*, then click *Create dashboard*.
+
+[role="screenshot"]
+image:images/Dashboard_example.png[Example dashboard]
+
+[float]
+[[dashboard-read-only-access]]
+=== [xpack]#Read only access#
+If you see
+the read-only icon in the application header,
+then you don't have sufficient privileges to create and save dashboards. The buttons to create and edit
+dashboards are not visible. For more information, see <<xpack-security-authorization>>.
+
+[role="screenshot"]
+image::images/dashboard-read-only-badge.png[Example of Dashboard read only access indicator in Kibana header]
+
+[float]
+[[types-of-panels]]
+== Types of panels
+
+Panels contain everything you need to tell a story about you data, including visualizations, 
+interactive controls, Markdown, and more.
+
+[cols="50, 50"]
+|===
+
+a| *Area*
+
+Displays data points, connected by a line, where the area between the line and axes are shaded. 
+Use area charts to compare two or more categories over time, and display the magnitude of trends.
+
+| image:images/area.png[Area chart]
+
+a| *Stacked area*
+
+Displays the evolution of the value of several data groups. The values of each group are displayed 
+on top of each other. Use stacked area charts to visualize part-to-whole relationships, and to show 
+how each category contributes to the cumulative total.
+
+| image:images/stacked_area.png[Stacked area chart]
+
+a| *Bar*
+
+Displays bars side-by-side where each bar represents a category. Use bar charts to compare data across a 
+large number of categories, display data that includes categories with negative values, and easily identify 
+the categories that represent the highest and lowest values. Kibana also supports horizontal bar charts.
+
+| image:images/bar.png[Bar chart]
+
+a| *Stacked bar*
+
+Displays numeric values across two or more categories. Use stacked bar charts to compare numeric values between 
+levels of a categorical value. Kibana also supports stacked horizontal bar charts.
+
+| image:images/stacked_bar.png[Stacked area chart]
+
+
+a| *Line*
+
+Displays data points that are connected by a line. Use line charts to visualize a sequence of values, discover 
+trends over time, and forecast future values.
+
+| image:images/line.png[Line chart]
+
+a| *Pie*
+
+Displays slices that represent a data category, where the slice size is proportional to the quantity it represents.  
+Use pie charts to show comparisons between multiple categories, illustrate the dominance of one category over others, 
+and show percentage or proportional data.
+
+| image:images/pie.png[Pie chart]
+
+a| *Donut*
+
+Similar to the pie chart, but the central circle is removed. Use donut charts when you’d like to display multiple statistics at once.
+
+| image:images/donut.png[Donut chart]
+
+
+a| *Tree map*
+
+Relates different segments of your data to the whole. Each rectangle is subdivided into smaller rectangles, or sub branches, based on 
+its proportion to the whole. Use treemaps to make efficient use of space to show percent total for each category.
+
+| image:images/treemap.png[Tree map]
+
+
+a| *Heat map*
+
+Displays graphical representations of data where the individual values are represented by colors. Use heat maps when your data set includes 
+categorical data. For example, use a heat map to see the flights of origin countries compared to destination countries using the sample flight data.
+
+| image:images/heat_map.png[Heat map]
+
+a| *Goal*
+
+Displays how your metric progresses toward a fixed goal. Use the goal to display an easy to read visual of the status of your goal progression.
+
+| image:images/goal.png[Goal]
+
+
+a| *Gauge*
+
+Displays your data along a scale that changes color according to where your data falls on the expected scale. Use the gauge to show how metric 
+values relate to reference threshold values, or determine how a specified field is performing versus how it is expected to perform.
+
+| image:images/gauge.png[Gauge]
+
+
+a| *Metric*
+
+Displays a single numeric value for an aggregation. Use the metric visualization when you have a numeric value that is powerful enough to tell 
+a story about your data.
+
+| image:images/metric.png[Metric]
+
+
+a| *Data table*
+
+Displays your raw data or aggregation results in a tabular format. Use data tables to display server configuration details, track counts, min, 
+or max values for a specific field, and monitor the status of key services.
+
+| image:images/data_table.png[Data table]
+
+
+a| *Tag cloud*
+
+Graphical representations of how frequently a word appears in the source text. Use tag clouds to easily produce a summary of large documents and 
+create visual art for a specific topic.
+
+| image:images/tag_cloud.png[Tag cloud]
+
+
+a| *Maps*
+
+For all your mapping needs, use <<maps,Maps>>.
+
+| image:images/maps.png[Maps]
+
+
+|===
+
+[float]
+[[create-panels]]
+== Create panels
+
+To create a panel, make sure you have {ref}/getting-started-index.html[data indexed into {es}] and an <<index-patterns,index pattern>> 
+to retrieve the data from {es}. If you aren’t ready to use your own data, {kib} comes with several pre-built dashboards that you can test out. For more information, 
+refer to <<add-sample-data, Explore {kib} using sample data>>.
+
+To begin, click *Create new*, then choose one of the following options on the 
+*New Visualization* window:
+
+* Click on the type of panel you want to create, then configure the options. 
+
+* Select an editor to help you create the panel. 
+
+[role="screenshot"]
+image:images/Dashboard_add_new_visualization.png[Example add new visualization to dashboard]
+
+{kib} provides you with several editors that help you create panels.
+
+[float]
+[[lens]]
+=== Create panels with Lens
+
+*Lens* is the simplest and fastest way to create powerful visualizations of your data. To use *Lens*, you drag and drop as many data fields 
+as you want onto the visualization builder pane, and *Lens* uses heuristics to decide how to apply each field to the visualization.
+
+With *Lens*, you can:
+
+* Use the automatically generated suggestions to change the visualization type.
+* Create visualizations with multiple layers and indices. 
+* Change the aggregation and labels to customize the data.
+
+[role="screenshot"]
+image::images/lens_drag_drop.gif[Drag and drop]
+
+TIP: Drag-and-drop capabilities are available only when *Lens* knows how to use the data. If *Lens* is unable to automatically generate a 
+visualization, configure the customization options for your visualization.
+
+[float]
+[[fiter-the-data-fields]]
+==== Filter the data fields
+
+The data fields that are displayed are based on the selected <<index-patterns,index pattern>> and the <<set-time-filter,time filter>>.
+
+To view the data fields in a different index pattern, click the index pattern, then select a new one. The data fields automatically update.
+
+To filter the data fields:
+
+* Enter the name in the *Search field names*.
+* Click *Field by type*, then select the filter. To show all fields in the index pattern, deselect *Only show fields with data*.
+
+[float]
+[[view-data-summaries]]
+==== View data summaries
+
+To help you decide exactly the data you want to display, get a quick summary of each field. The summary shows the distribution of 
+values within the specified time range.
+
+To view the data field summary information, navigate to the field, then click *i*.
+
+[role="screenshot"]
+image::images/lens_data_info.png[Data summary window]
+
+[float]
+[[change-the-visualization-type]]
+==== Change the visualization type
+
+Use the automatically generated suggestions to change the visualization type, or manually select the type of visualization you want to view.
+
+*Suggestions* are shortcuts to alternative visualizations that *Lens* generates for you.
+
+[role="screenshot"]
+image::images/lens_suggestions.gif[Visualization suggestions]
+
+If you’d like to use a visualization type outside of the suggestions, click the visualization type, then select a new one.
+
+[role="screenshot"]
+image::images/lens_viz_types.png[]
+
+When there is an exclamation point (!) next to a visualization type, *Lens* is unable to transfer your data, but still allows you to make the change.
+
+[float]
+[[customize-the-data]]
+==== Customize the data
+
+For each visualization type, you can customize the aggregation and labels. The options available depend on the selected visualization type. 
+
+. Click a data field name in the editor, or click *Drop a field here*.
+. Change the options that appear. 
++
+[role="screenshot"]
+image::images/lens_aggregation_labels.png[Quick function options]
+
+[float]
+[[add-layers-and-indices]]
+==== Add layers and indices
+
+To compare and analyze data from different sources, you can visualize multiple data layers and indices. Multiple layers and indices are 
+supported in area, line, and bar charts.
+
+To add a layer, click *+*, then drag and drop the data fields for the new layer.
+
+[role="screenshot"]
+image::images/lens_layers.png[Add layers]
+
+To view a different index, click the index name in the editor, then select a new one.
+
+[role="screenshot"]
+image::images/lens_index_pattern.png[Add index pattern]
+
+Ready to try out *Lens*? Refer to the <<lens-tutorial,step-by-step tutorial>>.
+
+[float]
+[[tsvb]]
+=== Create panels with TSVB
+
+*TSVB* is a time series data visualizer that allows you to use the full power of the Elasticsearch aggregation framework. To use *TSVB*, 
+you can combine an infinite number of <<aggregation-reference,aggregations>> to display your data.
+
+With *TSVB*, you can:
+
+* Create visualizations, data tables, and markdown panels.
+* Create visualizations with multiple indices.
+* Change the aggregation and labels to customize the data.
++
+[role="screenshot"]
+image::images/tsvb.png[TSVB UI]
+
+[float]
+[[configure-the-data]]
+==== Configure the data 
+
+With *TSVB*, you can add and display multiple data sets to compare and analyze. {kib} uses many types of <<aggregation-reference,aggregations>> that you can use to build 
+complex summaries of that data.
+
+. Select *Data*. If you are using *Table*, select *Columns*.
+. From the *Aggregation* drop down, select the aggregation you want to visualize. 
++
+If you don’t see any data, change the <<set-time-filter,time filter>>. 
++
+To add multiple aggregations, click *+*.
+. From the *Group by* drop down, select how you want to group or split the data.
+. To add another data set, click *+*.
++
+When you have more than one aggregation, the last value is displayed, which is indicated by the eye icon.
+
+[float]
+[[change-the-data-display]]
+==== Change the data display
+
+To find the best way to display your data, *TSVB* supports several types of panels and charts. 
+
+To change the *Time Series* chart type:
+
+. Click *Data > Options*.
+. Select the *Chart type*.
+
+To change the panel type, click on the panel options: 
+
+[role="screenshot"]
+image::images/tsvb_change_display.gif[TSVB change the panel type]
+
+[float]
+[[custommize-the-data]]
+==== Customize the data
+
+View data in a different <<index-patterns,index pattern>>, and change the data label name and colors. The options available depend on the panel type. 
+
+To change the index pattern, click *Panel options*, then enter the new *Index Pattern*.
+
+To override the index pattern for a data set, click *Data > Options*. Select *Yes* to override, then enter the new *Index pattern*.
+
+To change the data labels and colors:
+
+. Click *Data*.
+. Enter the *Label* name, which *TSVB* uses on the legends and data labels.
+. Click the color picker, then select the color for the data.
++
+[role="screenshot"]
+image::images/tsvb_color_picker.png[TSVB color picker]
+
+[float]
+[[add-annotations]]
+==== Add annotations
+
+You can overlay annotation events on top of your *Time Series* charts. The options available depend on the data source.
+
+To begin, click *Annotations*, click *Add data source*, then configure the options.
+
+[role="screenshot"]
+image::images/tsvb_annotations.png[TSVB annotations]
+
+[float]
+[[filter-the-panel]]
+==== Filter the panel
+
+The data that displays on the panel is based on the <<index-patterns,index pattern>> and <<set-time-filter,time filter>>. 
+You can filter the data on the panels using the <<lucene-query,Lucene query syntax>>.
+
+Click *Panel options*, then enter the syntax in the *Panel Filter* field.
+
+If you want to ignore filters from all of {kib}, select *Yes* for *Ignore global filter*.
+
+[float]
+[[vega]]
+=== Create custom panels with Vega
+
+Build custom visualizations using *Vega* and *Vega-Lite*, backed by one or more data sources including {es}, Elastic Map Service, 
+URL, or static data. Use the {kib} extensions to embed *Vega* in your dashboard, and add interactive tools.
+
+Use *Vega* and *Vega-Lite* when you want to create a visualization for:
+
+* Aggregations that use `nested` or `parent/child` mapping
+* Aggregations without an index pattern
+* Queries that use custom time filters
+* Complex calculations
+* Extracting data from _source instead of aggregations
+* Scatter charts, sankey charts, and custom maps
+* Using an unsupported visual theme
+
+[role="screenshot"]
+image::images/vega.png[Vega UI]
+
+*Vega* and *Vega-Lite*  are declarative formats that:
+
+* Create complex visualizations
+* Use JSON and a different syntax for declaring visualizations
+* Are not fully interchangeable
+
+For more information about *Vega* and *Vega-Lite*, refer to:
+
+* <<vega-lite-tutorial-create-your-first-visualizations,Create your first visualization>>
+* <<vega-tutorial-update-kibana-filters-from-vega,Update Kibana filters>>
+* <<reference-for-kibana-extensions,Reference for Kibana extensions>>
+* <<resources-and-examples,Resources and examples>>
+
+[float]
+[[timelion]]
+=== Create panels with Timelion
+
+*Timelion* is a time series data visualizer that enables you to combine independent data sources within a single visualization. 
+
+*Timelion* is driven by a simple expression language that you use to:
+
+* Retrieve time series data
+* Perform calculation to tease out the answers to complex questions
+* Visualize the results
+
+[role="screenshot"]
+image::images/timelion.png[Timelion UI]
+
+Ready to try out Timelion? For step-by-step tutorials, refer to:
+
+* <<timelion-tutorial-create-time-series-visualizations,Create time series visualizations>>
+* <<timelion-tutorial-create-visualizations-with-mathematical-functions,Create visualizations with mathematical functions>>
+* <<timelion-tutorial-create-visualizations-withconditional-logic-and-tracking-trends,Create visualizations with conditional logic and tracking trends>>
+
+[float]
+[[save-panels]]
+=== Save panels
+
+When you’ve finished making changes, save the panels.
+
+. Click *Save*.
+. Add the *Title* and optional *Description*.
+. Click *Save and return*.
+
+[float]
+[[add-existing-panels]]
+== Add existing panels
+
+Add panels that you’ve already created to your dashboard. 
+
+On the dashboard, click *Add an existing*, then select the panel you want to add.
+
+When a panel contains a stored query, both queries are applied.
+
+[role="screenshot"]
+image:images/Dashboard_add_visualization.png[Example add visualization to dashboard]
+
+To make changes to the panel, put the dashboard in *Edit* mode, then select the edit option from the panel menu. 
+The changes you make appear in every dashboard that uses the panel, except if you edit the panel title. Changes to the panel title appear only on the dashboard where you made the change.
+
+[float]
+[[save-dashboards]]
+== Save dashboards
+
+When you’ve finished adding the panels, save the dashboard.
+
+. In the toolbar, click *Save*.
+
+. Enter the dashboard *Title* and optional *Description*, then *Save* the dashboard.
+
+--
+include::edit-dashboards.asciidoc[]
+
+include::explore-dashboard-data.asciidoc[]
+
+include::share-dashboards.asciidoc[]
+
+include::tutorials.asciidoc[]
+
+include::aggregation-reference.asciidoc[]
+
+include::vega-reference.asciidoc[]
diff --git a/docs/drilldowns/drilldowns.asciidoc b/docs/user/dashboard/drilldowns.asciidoc
similarity index 93%
rename from docs/drilldowns/drilldowns.asciidoc
rename to docs/user/dashboard/drilldowns.asciidoc
index e2dfaa5af39ce9..5fca974d581352 100644
--- a/docs/drilldowns/drilldowns.asciidoc
+++ b/docs/user/dashboard/drilldowns.asciidoc
@@ -1,5 +1,6 @@
+[float]
 [[drilldowns]]
-== Use drilldowns for dashboard actions
+=== Use drilldowns for dashboard actions
 
 Drilldowns, also known as custom actions, allow you to configure a
 workflow for analyzing and troubleshooting your data.
@@ -13,7 +14,7 @@ that shows a single data center or server.
 
 [float]
 [[how-drilldowns-work]]
-=== How drilldowns work
+==== How drilldowns work
 
 Drilldowns are user-configurable {kib} actions that are stored with the
 dashboard metadata. Drilldowns are specific to the dashboard panel
@@ -35,7 +36,7 @@ to learn how to code drilldowns.
 
 [float]
 [[create-manage-drilldowns]]
-=== Create and manage drilldowns
+==== Create and manage drilldowns
 
 Your dashboard must be in *Edit* mode to create a drilldown.
 Once a panel has at least one drilldown, the menu also includes a *Manage drilldowns* action
@@ -46,14 +47,13 @@ image::images/drilldown_menu.png[Panel menu with Create drilldown and Manage dri
 
 [float]
 [[drilldowns-example]]
-=== Try it: Create a drilldown
+==== Try it: Create a drilldown
 
 This example shows how to create the *Host Overview* drilldown shown earlier in this doc.
 
-[float]
-==== Set up the dashboards
+*Set up the dashboards*
 
-. Add the <<get-data-in, sample web logs>> data set.
+. Add the <<gs-get-data-into-kibana, sample web logs>> data set.
 
 . Create a new dashboard, called `Host Overview`, and include these visualizations
 from the sample data set:
@@ -74,9 +74,7 @@ TIP: If you don’t see data for a panel, try changing the time range.
 Search: `extension.keyword:( “gz” or “css” or “deb”)`
 Filter: `geo.src : CN`
 
-[float]
-==== Create the drilldown
-
+*Create the drilldown*
 
 . In the dashboard menu bar, click *Edit*.
 
diff --git a/docs/user/dashboard/edit-dashboards.asciidoc b/docs/user/dashboard/edit-dashboards.asciidoc
new file mode 100644
index 00000000000000..7534ea1e9e9fb4
--- /dev/null
+++ b/docs/user/dashboard/edit-dashboards.asciidoc
@@ -0,0 +1,115 @@
+[[edit-dashboards]]
+== Edit dashboards
+
+Now that you have added panels to your dashboard, you can add filter panels to interact with the data, and Markdown panels to add context to the dashboard. 
+To make your dashboard look the way you want, use the editing options.
+
+[float]
+[[add-controls]]
+=== Add controls
+
+To filter the data on your dashboard in real-time, add a *Controls* panel.
+
+You can add two types of *Controls*:
+
+* Options list — Filters content based on one or more specified options. The dropdown menu is dynamically populated with the results of a terms aggregation. 
+For example, use the options list on the sample flight dashboard when you want to filter the data by origin city and destination city.
+
+* Range slider — Filters data within a specified range of numbers. The minimum and maximum values are dynamically populated with the results of a 
+min and max aggregation. For example, use the range slider when you want to filter the sample flight dashboard by a specific average ticket price.
+
+[role="screenshot"]
+image::images/dashboard-controls.png[]
+
+To configure *Controls* for your dashboard:
+
+. Click *Options*, then configure the following:
+
+* *Update Kibana filters on each change* &mdash; When selected, all interactive inputs create filters that refresh the dashboard. When unselected,
+ {kib} filters are created only when you click *Apply changes*.
+
+* *Use time filter* &mdash; When selected, the aggregations that generate the options list and time range are connected to the <<set-time-filter,time filter>>.
+
+* *Pin filters to global state* &mdash; When selected, all filters created by interacting with the inputs are automatically pinned.
+
+. Click *Update*.
+
+[float]
+[[add-markdown]]
+=== Add Markdown
+
+*Markdown* is a text entry field that accepts GitHub-flavored Markdown text. When you enter the text, the tool populates the results on the dashboard. 
+
+Use Markdown when you want to add context to the other panels on your dashboard, such as important information, instructions and images.
+
+For information about GitHub-flavored Markdown text, click *Help*.
+
+For example, when you enter:
+
+[role="screenshot"]
+image::images/markdown_example_1.png[]
+
+The following instructions are displayed:
+
+[role="screenshot"]
+image::images/markdown_example_2.png[]
+
+Or when you enter:
+
+[role="screenshot"]
+image::images/markdown_example_3.png[]
+
+The following image is displayed:
+
+[role="screenshot"]
+image::images/markdown_example_4.png[]
+
+[float]
+[[arrange-panels]]
+[[moving-containers]]
+[[resizing-containers]]
+=== Arrange panels
+
+To make your dashboard panels look exactly how you want, you can move, resize, customize, and delete them.
+
+Put the dashboard in *Edit* mode, then use the following options:
+
+* To move, click and hold the panel header, then drag to the new location.
+
+* To resize, click the resize control, then drag to the new dimensions.
+
+* To delete, open the panel menu, then select Delete from dashboard. When you delete a panel from the dashboard, the 
+visualization or saved search from the panel is still available in Kibana.
+
+[float]
+[[clone-panels]]
+=== Clone panels
+
+To duplicate a panel and its configured functionality, clone the panel. Cloned panels support all of the original functionality, 
+including renaming, editing, and cloning. 
+
+. Put the dashboard in *Edit* mode. 
+
+. For the panel you want to clone, open the panel menu, then select *Clone panel*. 
+
+Cloned panels appear beside the original, and move other panels down to make room when necessary. 
+All cloned visualization panels appear in the visualization list.
+
+[role="screenshot"]
+image:images/clone_panel.gif[clone panel]
+
+[float]
+[[dashboard-customize-filter]]
+=== Customize time ranges
+
+You can configure each visualization, saved search, and map on your dashboard
+for a specific time range. For example, you might want one visualization to show
+the monthly trend for CPU usage and another to show the current CPU usage.
+
+From the panel menu, select *Customize time range* to expose a time filter
+dedicated to that panel. Panels that are not restricted by a specific
+time range are controlled by the
+<<set-time-filter,time filter>>.
+
+[role="screenshot"]
+image:images/time_range_per_panel.gif[Time range per dashboard panel]
diff --git a/docs/user/dashboard/explore-dashboard-data.asciidoc b/docs/user/dashboard/explore-dashboard-data.asciidoc
new file mode 100644
index 00000000000000..a0564f5bceb3dd
--- /dev/null
+++ b/docs/user/dashboard/explore-dashboard-data.asciidoc
@@ -0,0 +1,20 @@
+[[explore-dashboard-data]]
+== Explore dashboard data
+
+Get a closer look at your data by inspecting elements and using drilldown actions.
+
+[float]
+[[viewing-detailed-information]]
+=== Inspect elements
+
+To view the data and requests behind the visualizations and saved searches, you can drill down into the elements.
+
+From the panel menu, select *Inspect*.
+The data that displays depends on the element that you inspect.
+
+[role="screenshot"]
+image:images/Dashboard_inspect.png[Inspect in dashboard]
+
+include::explore-underlying-data.asciidoc[]
+
+include::drilldowns.asciidoc[]
diff --git a/docs/user/dashboard/explore-underlying-data.asciidoc b/docs/user/dashboard/explore-underlying-data.asciidoc
new file mode 100644
index 00000000000000..9b7be21dc45d24
--- /dev/null
+++ b/docs/user/dashboard/explore-underlying-data.asciidoc
@@ -0,0 +1,27 @@
+[float]
+[[explore-the-underlying-data]]
+=== Explore the underlying data for panels
+
+To explore the underlying data of the panels on your dashboard, {kib} opens *Discover*,
+where you can view and filter the data in the visualization panel. When {kib} opens *Discover*, the index pattern, filters, query, and time range for the visualization continue to apply.
+
+TIP: The *Explore underlying data* option is available only for visualization panels with a single index pattern.
+
+To use the *Explore underlying data* option: 
+
+* Click the from the panel menu, then click *Explore underlying data*.
++
+[role="screenshot"]
+image::images/explore_data_context_menu.png[Explore underlying data from panel context menu]
+
+* Interact with the chart, then click *Explore underlying data* on the menu that appears.
++
+[role="screenshot"]
+image::images/explore_data_in_chart.png[Explore underlying data from chart]
++
+To enable, open `kibana.yml`, then add the following:
+
+["source","yml"]
+-----------
+xpack.discoverEnhanced.actions.exploreDataInChart.enabled: true
+-----------
diff --git a/docs/user/dashboard/images/area.png b/docs/user/dashboard/images/area.png
new file mode 100644
index 00000000000000..85d21a9e178c5a
Binary files /dev/null and b/docs/user/dashboard/images/area.png differ
diff --git a/docs/user/dashboard/images/bar.png b/docs/user/dashboard/images/bar.png
new file mode 100644
index 00000000000000..f1db8476559477
Binary files /dev/null and b/docs/user/dashboard/images/bar.png differ
diff --git a/docs/user/dashboard/images/data_table.png b/docs/user/dashboard/images/data_table.png
new file mode 100644
index 00000000000000..3e08ec526ba57d
Binary files /dev/null and b/docs/user/dashboard/images/data_table.png differ
diff --git a/docs/user/dashboard/images/donut.png b/docs/user/dashboard/images/donut.png
new file mode 100644
index 00000000000000..a662f58ba553bb
Binary files /dev/null and b/docs/user/dashboard/images/donut.png differ
diff --git a/docs/drilldowns/images/drilldown_create.png b/docs/user/dashboard/images/drilldown_create.png
similarity index 100%
rename from docs/drilldowns/images/drilldown_create.png
rename to docs/user/dashboard/images/drilldown_create.png
diff --git a/docs/drilldowns/images/drilldown_menu.png b/docs/user/dashboard/images/drilldown_menu.png
similarity index 100%
rename from docs/drilldowns/images/drilldown_menu.png
rename to docs/user/dashboard/images/drilldown_menu.png
diff --git a/docs/drilldowns/images/drilldown_on_panel.png b/docs/user/dashboard/images/drilldown_on_panel.png
similarity index 100%
rename from docs/drilldowns/images/drilldown_on_panel.png
rename to docs/user/dashboard/images/drilldown_on_panel.png
diff --git a/docs/drilldowns/images/drilldown_on_piechart.gif b/docs/user/dashboard/images/drilldown_on_piechart.gif
similarity index 100%
rename from docs/drilldowns/images/drilldown_on_piechart.gif
rename to docs/user/dashboard/images/drilldown_on_piechart.gif
diff --git a/docs/drilldowns/images/explore_data_context_menu.png b/docs/user/dashboard/images/explore_data_context_menu.png
similarity index 100%
rename from docs/drilldowns/images/explore_data_context_menu.png
rename to docs/user/dashboard/images/explore_data_context_menu.png
diff --git a/docs/drilldowns/images/explore_data_in_chart.png b/docs/user/dashboard/images/explore_data_in_chart.png
similarity index 100%
rename from docs/drilldowns/images/explore_data_in_chart.png
rename to docs/user/dashboard/images/explore_data_in_chart.png
diff --git a/docs/user/dashboard/images/gauge.png b/docs/user/dashboard/images/gauge.png
new file mode 100644
index 00000000000000..c4aef7f5f68544
Binary files /dev/null and b/docs/user/dashboard/images/gauge.png differ
diff --git a/docs/user/dashboard/images/goal.png b/docs/user/dashboard/images/goal.png
new file mode 100644
index 00000000000000..967e64f722d745
Binary files /dev/null and b/docs/user/dashboard/images/goal.png differ
diff --git a/docs/user/dashboard/images/heat_map.png b/docs/user/dashboard/images/heat_map.png
new file mode 100644
index 00000000000000..d4a6502509f6f1
Binary files /dev/null and b/docs/user/dashboard/images/heat_map.png differ
diff --git a/docs/user/dashboard/images/lens_aggregation_labels.png b/docs/user/dashboard/images/lens_aggregation_labels.png
new file mode 100644
index 00000000000000..9dcf1d226a197a
Binary files /dev/null and b/docs/user/dashboard/images/lens_aggregation_labels.png differ
diff --git a/docs/user/dashboard/images/lens_data_info.png b/docs/user/dashboard/images/lens_data_info.png
new file mode 100644
index 00000000000000..5ea6fc64a217dc
Binary files /dev/null and b/docs/user/dashboard/images/lens_data_info.png differ
diff --git a/docs/user/dashboard/images/lens_drag_drop.gif b/docs/user/dashboard/images/lens_drag_drop.gif
new file mode 100644
index 00000000000000..ca62115e7ea3a8
Binary files /dev/null and b/docs/user/dashboard/images/lens_drag_drop.gif differ
diff --git a/docs/user/dashboard/images/lens_index_pattern.png b/docs/user/dashboard/images/lens_index_pattern.png
new file mode 100644
index 00000000000000..90a34b7a5d225a
Binary files /dev/null and b/docs/user/dashboard/images/lens_index_pattern.png differ
diff --git a/docs/user/dashboard/images/lens_layers.png b/docs/user/dashboard/images/lens_layers.png
new file mode 100644
index 00000000000000..7410425a6977e0
Binary files /dev/null and b/docs/user/dashboard/images/lens_layers.png differ
diff --git a/docs/user/dashboard/images/lens_suggestions.gif b/docs/user/dashboard/images/lens_suggestions.gif
new file mode 100644
index 00000000000000..3258e924cb205e
Binary files /dev/null and b/docs/user/dashboard/images/lens_suggestions.gif differ
diff --git a/docs/user/dashboard/images/lens_viz_types.png b/docs/user/dashboard/images/lens_viz_types.png
new file mode 100644
index 00000000000000..2ecfa6bd0e0e3d
Binary files /dev/null and b/docs/user/dashboard/images/lens_viz_types.png differ
diff --git a/docs/user/dashboard/images/line.png b/docs/user/dashboard/images/line.png
new file mode 100644
index 00000000000000..123fa74dc7e146
Binary files /dev/null and b/docs/user/dashboard/images/line.png differ
diff --git a/docs/user/dashboard/images/maps.png b/docs/user/dashboard/images/maps.png
new file mode 100644
index 00000000000000..65336451cc1c7c
Binary files /dev/null and b/docs/user/dashboard/images/maps.png differ
diff --git a/docs/user/dashboard/images/metric.png b/docs/user/dashboard/images/metric.png
new file mode 100644
index 00000000000000..f8182d538a6087
Binary files /dev/null and b/docs/user/dashboard/images/metric.png differ
diff --git a/docs/user/dashboard/images/pie.png b/docs/user/dashboard/images/pie.png
new file mode 100644
index 00000000000000..927fbb98adc073
Binary files /dev/null and b/docs/user/dashboard/images/pie.png differ
diff --git a/docs/user/dashboard/images/stacked_area.png b/docs/user/dashboard/images/stacked_area.png
new file mode 100644
index 00000000000000..ae66fc51176f9b
Binary files /dev/null and b/docs/user/dashboard/images/stacked_area.png differ
diff --git a/docs/user/dashboard/images/stacked_bar.png b/docs/user/dashboard/images/stacked_bar.png
new file mode 100644
index 00000000000000..aa90ce3685cff1
Binary files /dev/null and b/docs/user/dashboard/images/stacked_bar.png differ
diff --git a/docs/user/dashboard/images/tag_cloud.png b/docs/user/dashboard/images/tag_cloud.png
new file mode 100644
index 00000000000000..976c456e4a1f1e
Binary files /dev/null and b/docs/user/dashboard/images/tag_cloud.png differ
diff --git a/docs/user/dashboard/images/timelion.png b/docs/user/dashboard/images/timelion.png
new file mode 100644
index 00000000000000..a6637915750779
Binary files /dev/null and b/docs/user/dashboard/images/timelion.png differ
diff --git a/docs/user/dashboard/images/treemap.png b/docs/user/dashboard/images/treemap.png
new file mode 100644
index 00000000000000..5df3c9526bfeb4
Binary files /dev/null and b/docs/user/dashboard/images/treemap.png differ
diff --git a/docs/user/dashboard/images/tsvb.png b/docs/user/dashboard/images/tsvb.png
new file mode 100644
index 00000000000000..09a3c7e86eb560
Binary files /dev/null and b/docs/user/dashboard/images/tsvb.png differ
diff --git a/docs/user/dashboard/images/tsvb_annotations.png b/docs/user/dashboard/images/tsvb_annotations.png
new file mode 100644
index 00000000000000..510f3c2672118e
Binary files /dev/null and b/docs/user/dashboard/images/tsvb_annotations.png differ
diff --git a/docs/user/dashboard/images/tsvb_change_display.gif b/docs/user/dashboard/images/tsvb_change_display.gif
new file mode 100644
index 00000000000000..09d435b0a6b240
Binary files /dev/null and b/docs/user/dashboard/images/tsvb_change_display.gif differ
diff --git a/docs/user/dashboard/images/tsvb_color_picker.png b/docs/user/dashboard/images/tsvb_color_picker.png
new file mode 100644
index 00000000000000..4f033579d0005e
Binary files /dev/null and b/docs/user/dashboard/images/tsvb_color_picker.png differ
diff --git a/docs/user/dashboard/images/vega.png b/docs/user/dashboard/images/vega.png
new file mode 100644
index 00000000000000..6a0d8cb772adff
Binary files /dev/null and b/docs/user/dashboard/images/vega.png differ
diff --git a/docs/user/dashboard/share-dashboards.asciidoc b/docs/user/dashboard/share-dashboards.asciidoc
new file mode 100644
index 00000000000000..cfa146d60fdac0
--- /dev/null
+++ b/docs/user/dashboard/share-dashboards.asciidoc
@@ -0,0 +1,27 @@
+[[share-dashboards]]
+== Share dashboards
+
+[[embedding-dashboards]]
+Share your dashboard outside of {kib}.
+
+From the *Share* menu, you can:
+
+* Embed the code in a web page. Users must have {kib} access
+to view an embedded dashboard.
+* Share a direct link to a {kib} dashboard
+* Generate a PDF report
+* Generate a PNG report
+
+TIP: To create a link to a dashboard by title, use: +
+`${domain}/${basepath?}/app/dashboards#/list?title=${yourdashboardtitle}`
+
+TIP: When sharing a link to a dashboard snapshot, use the *Short URL*. Snapshot
+URLs are long and can be problematic for Internet Explorer and other
+tools. To create a short URL, you must have write access to {kib}.
+
+[float]
+[[import-dashboards]]
+=== Export the dashboard
+
+To export the dashboard, open the menu, then click *Stack Management > Saved Objects*. For more information,
+refer to <<managing-saved-objects, Managing saved objects>>.
\ No newline at end of file
diff --git a/docs/user/dashboard/tutorials.asciidoc b/docs/user/dashboard/tutorials.asciidoc
new file mode 100644
index 00000000000000..931720ccbe257c
--- /dev/null
+++ b/docs/user/dashboard/tutorials.asciidoc
@@ -0,0 +1,1756 @@
+[[tutorials]]
+== Tutorials
+
+Learn how to use *Lens*, *Vega*, and *Timelion* by going through one of the step-by-step tutorials.
+
+[[lens-tutorial]]
+=== Compare sales over time with Lens
+
+Ready to create your own visualization with Lens? Use the following tutorial to create a visualization that lets you compare sales over time.
+
+[float]
+[[lens-before-begin]]
+==== Before you begin
+
+To start, you'll need to add the <<add-sample-data, sample ecommerce data>>.
+
+[float]
+==== Build the visualization
+
+Drag and drop your data onto the visualization builder pane.
+
+. Select the *kibana_sample_data_ecommerce* index pattern.
+
+. Click image:images/time-filter-calendar.png[], then click *Last 7 days*. 
++
+The fields in the data panel update.
+
+. Drag and drop the *taxful_total_price* data field to the visualization builder pane.
++
+[role="screenshot"]
+image::images/lens_tutorial_1.png[Lens tutorial]
+
+To display the average order prices over time, *Lens* automatically added in *order_date* field.
+
+To break down your data, drag the *category.keyword* field to the visualization builder pane. Lens
+knows that you want to show the top categories and compare them across the dates,
+and creates a chart that compares the sales for each of the top three categories:
+
+[role="screenshot"]
+image::images/lens_tutorial_2.png[Lens tutorial]
+
+[float]
+[[customize-lens-visualization]]
+==== Customize your visualization
+
+Make your visualization look exactly how you want with the customization options.
+
+. Click *Average of taxful_total_price*, then change the *Label* to `Sales`.
++
+[role="screenshot"]
+image::images/lens_tutorial_3.1.png[Lens tutorial]
+
+. Click *Top values of category.keyword*, then change *Number of values* to `10`.
++
+[role="screenshot"]
+image::images/lens_tutorial_3.2.png[Lens tutorial]
++
+The visualization updates to show there are only six available categories.
++
+Look at the *Suggestions*. An area chart is not an option, but for the sales data, a stacked area chart might be the best option.
+
+. To switch the chart type, click *Stacked bar chart* in the column, then click *Stacked area* from the *Select a visualizations* window.
++
+[role="screenshot"]
+image::images/lens_tutorial_3.png[Lens tutorial]
+
+[float]
+[[lens-tutorial-next-steps]]
+==== Next steps
+
+Now that you've created your visualization, you can add it to a <<dashboard,dashboard>> or <<canvas,Canvas workpad>>.
+
+[[vega-lite-tutorial-create-your-first-visualizations]]
+=== Create your first visualization with Vega-Lite
+
+experimental[]
+
+In this tutorial, you will learn about how to edit Vega-Lite in {kib} to create
+a stacked area chart from an {es} search query. It will give you a starting point
+for a more comprehensive
+https://vega.github.io/vega-lite/tutorials/getting_started.html[introduction to Vega-Lite],
+while only covering the basics.
+
+In this tutorial, you will build a stacked area chart from one of the {kib} sample data
+sets.
+
+[role="screenshot"]
+image::visualize/images/vega_lite_tutorial_1.png[]
+
+Before beginning this tutorial, install the <<add-sample-data, eCommerce sample data>>
+set.
+
+When you first open the Vega editor in {kib}, you will see a pre-populated
+line chart which shows the total number of documents across all your indices
+within the time range.
+
+[role="screenshot"]
+image::visualize/images/vega_lite_default.png[]
+
+The text editor contains a Vega-Lite spec written in https://hjson.github.io/[HJSON],
+which is similar to JSON but optimized for human editing. HJSON supports:
+
+* Comments using // or /* syntax
+* Object keys without quotes
+* String values without quotes
+* Optional commas
+* Double or single quotes
+* Multiline strings
+
+[float]
+[[small-steps]]
+==== Small steps
+
+Always work on Vega in the smallest steps possible, and save your work frequently.
+Small changes will cause unexpected results. Click the "Save" button now.
+
+The first step is to change the index to one of the <<add-sample-data, sample data>>
+sets. Change
+
+```yaml
+index: _all
+```
+
+to:
+
+```yaml
+index: kibana_sample_data_ecommerce
+```
+
+Click "Update". The result is probably not what you expect. You should see a flat
+line with 0 results.
+
+You've only changed the index, so the difference must be the query is returning
+no results. You can try the <<vega-browser-debugging-console, Vega debugging process>>,
+but intuition may be faster for this particular problem.
+
+In this case, the problem is that you are querying the field `@timestamp`,
+which does not exist in the `kibana_sample_data_ecommerce` data. Find and replace
+`@timestamp` with `order_date`. This fixes the problem, leaving you with this spec:
+
+.Expand Vega-Lite spec
+[%collapsible%closed]
+====
+[source,yaml]
+----
+{
+  $schema: https://vega.github.io/schema/vega-lite/v4.json
+  title: Event counts from ecommerce
+  data: {
+    url: {
+      %context%: true
+      %timefield%: order_date
+      index: kibana_sample_data_ecommerce
+      body: {
+        aggs: {
+          time_buckets: {
+            date_histogram: {
+              field: order_date
+              interval: {%autointerval%: true}
+              extended_bounds: {
+                min: {%timefilter%: "min"}
+                max: {%timefilter%: "max"}
+              }
+              min_doc_count: 0
+            }
+          }
+        }
+        size: 0
+      }
+    }
+    format: {property: "aggregations.time_buckets.buckets" }
+  }
+
+  mark: line
+
+  encoding: {
+    x: {
+      field: key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+    }
+  }
+}
+----
+
+====
+
+Now, let's make the visualization more interesting by adding another aggregation
+to create a stacked area chart. To verify that you have constructed the right
+query, it is easiest to use the {kib} Dev Tools in a separate tab from the
+Vega editor. Open the Dev Tools from the Management section of the navigation.
+
+This query is roughly equivalent to the one that is used in the default
+Vega-Lite spec. Copy it into the Dev Tools:
+
+```js
+POST kibana_sample_data_ecommerce/_search
+{
+  "query": {
+    "range": {
+      "order_date": {
+        "gte": "now-7d"
+      }
+    }
+  },
+  "aggs": {
+    "time_buckets": {
+      "date_histogram": {
+        "field": "order_date",
+        "fixed_interval": "1d",
+        "extended_bounds": {
+          "min": "now-7d"
+        },
+        "min_doc_count": 0
+      }
+    }
+  },
+  "size": 0
+}
+```
+
+There's not enough data to create a stacked bar in the original query, so we
+will add a new
+{ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregation]:
+
+```js
+POST kibana_sample_data_ecommerce/_search
+{
+  "query": {
+    "range": {
+      "order_date": {
+        "gte": "now-7d"
+      }
+    }
+  },
+  "aggs": {
+    "categories": {
+      "terms": { "field": "category.keyword" },
+      "aggs": {
+        "time_buckets": {
+          "date_histogram": {
+            "field": "order_date",
+            "fixed_interval": "1d",
+            "extended_bounds": {
+              "min": "now-7d"
+            },
+            "min_doc_count": 0
+          }
+        }
+      }
+    }
+  },
+  "size": 0
+}
+```
+
+You'll see that the response format looks different from the previous query:
+
+```json
+{
+  "aggregations" : {
+    "categories" : {
+      "doc_count_error_upper_bound" : 0,
+      "sum_other_doc_count" : 0,
+      "buckets" : [{
+        "key" : "Men's Clothing",
+        "doc_count" : 1661,
+        "time_buckets" : {
+          "buckets" : [{
+            "key_as_string" : "2020-06-30T00:00:00.000Z",
+            "key" : 1593475200000,
+            "doc_count" : 19
+          }, {
+            "key_as_string" : "2020-07-01T00:00:00.000Z",
+            "key" : 1593561600000,
+            "doc_count" : 71
+          }]
+        }
+      }]
+    }
+  }
+}
+```
+
+Now that we have data that we're happy with, it's time to convert from an
+isolated {es} query into a query with {kib} integration. Looking at the
+<<vega-queries, reference for writing {es} queries in Vega>>, you will
+see the full list of special tokens that are used in this query, such
+as `%context: true`. This query has also replaced `"fixed_interval": "1d"`
+with `interval: {%autointerval%: true}`. Copy the final query into
+your spec:
+
+```yaml
+  data: {
+    url: {
+      %context%: true
+      %timefield%: order_date
+      index: kibana_sample_data_ecommerce
+      body: {
+        aggs: {
+          categories: {
+            terms: { field: "category.keyword" }
+            aggs: {
+              time_buckets: {
+                date_histogram: {
+                  field: order_date
+                  interval: {%autointerval%: true}
+                  extended_bounds: {
+                    min: {%timefilter%: "min"}
+                    max: {%timefilter%: "max"}
+                  }
+                  min_doc_count: 0
+                }
+              }
+            }
+          }
+        }
+        size: 0
+      }
+    }
+    format: {property: "aggregations.categories.buckets" }
+  }
+```
+
+If you copy and paste that into your Vega-Lite spec, and click "Update",
+you will see a warning saying `Infinite extent for field "key": [Infinity, -Infinity]`.
+Let's use our <<vega-browser-debugging-console, Vega debugging skills>> to understand why.
+
+Vega-Lite generates data using the names `source_0` and `data_0`. `source_0` contains
+the results from the {es} query, and `data_0` contains the visually encoded results
+which are shown in the chart. To debug this problem, you need to compare both.
+
+To look at the source, open the browser dev tools console and type
+`VEGA_DEBUG.view.data('source_0')`. You will see:
+
+```js
+[{
+  doc_count: 454
+  key: "Men's Clothing"
+  time_buckets: {buckets: Array(57)}
+  Symbol(vega_id): 12822
+}, ...]
+```
+
+To compare to the visually encoded data, open the browser dev tools console and type
+`VEGA_DEBUG.view.data('data_0')`. You will see:
+
+```js
+[{
+  doc_count: 454
+  key: NaN
+  time_buckets: {buckets: Array(57)}
+  Symbol(vega_id): 13879
+}]
+```
+
+The issue seems to be that the `key` property is not being converted the right way,
+which makes sense because the `key` is now `Men's Clothing` instead of a timestamp.
+
+To fix this, try updating the `encoding` of your Vega-Lite spec to:
+
+```yaml
+  encoding: {
+    x: {
+      field: time_buckets.buckets.key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: time_buckets.buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+    }
+  }
+```
+
+This will show more errors, and you can inspect `VEGA_DEBUG.view.data('data_0')` to
+understand why. This now shows:
+
+```js
+[{
+  doc_count: 454
+  key: "Men's Clothing"
+  time_buckets: {buckets: Array(57)}
+  time_buckets.buckets.doc_count: undefined
+  time_buckets.buckets.key: null
+  Symbol(vega_id): 14094
+}]
+```
+
+It looks like the problem is that the `time_buckets` inner array is not being
+extracted by Vega. The solution is to use a Vega-lite
+https://vega.github.io/vega-lite/docs/flatten.html[flatten transformation], available in {kib} 7.9 and later.
+If using an older version of Kibana, the flatten transformation is available in Vega
+but not Vega-Lite.
+
+Add this section in between the `data` and `encoding` section:
+
+```yaml
+  transform: [{
+    flatten: ["time_buckets.buckets"]
+  }]
+```
+
+This does not yet produce the results you expect. Inspect the transformed data
+by typing `VEGA_DEBUG.view.data('data_0')` into the console again:
+
+```js
+[{
+  doc_count: 453
+  key: "Men's Clothing"
+  time_bucket.buckets.doc_count: undefined
+  time_buckets: {buckets: Array(57)}
+  time_buckets.buckets: {
+    key_as_string: "2020-06-30T15:00:00.000Z",
+    key: 1593529200000,
+    doc_count: 2
+  }
+  time_buckets.buckets.key: null
+  Symbol(vega_id): 21564
+}]
+```
+
+The debug view shows `undefined` values where you would expect to see numbers, and
+the cause is that there are duplicate names which are confusing Vega-Lite. This can
+be fixed by making this change to the `transform` and `encoding` blocks:
+
+```yaml
+  transform: [{
+    flatten: ["time_buckets.buckets"],
+    as: ["buckets"]
+  }]
+
+  mark: area
+
+  encoding: {
+    x: {
+      field: buckets.key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+    }
+    color: {
+      field: key
+      type: nominal
+    }
+  }
+```
+
+At this point, you have a stacked area chart that shows the top categories,
+but the chart is still missing some common features that we expect from a {kib}
+visualization. Let's add hover states and tooltips next.
+
+Hover states are handled differently in Vega-Lite and Vega. In Vega-Lite this is
+done using a concept called `selection`, which has many permutations that are not
+covered in this tutorial. We will be adding a simple tooltip and hover state.
+
+Because {kib} has enabled the https://vega.github.io/vega-lite/docs/tooltip.html[Vega tooltip plugin],
+tooltips can be defined in several ways:
+
+* Automatic tooltip based on the data, via `{ content: "data" }`
+* Array of fields, like `[{ field: "key", type: "nominal" }]`
+* Defining a custom Javascript object using the `calculate` transform
+
+For the simple tooltip, add this to your encoding:
+
+```yaml
+  encoding: {
+    tooltip: [{
+      field: buckets.key
+      type: temporal
+      title: "Date"
+    }, {
+      field: key
+      type: nominal
+      title: "Category"
+    }, {
+      field: buckets.doc_count
+      type: quantitative
+      title: "Count"
+    }]
+  }
+```
+
+As you hover over the area series in your chart, a multi-line tooltip will
+appear, but it won't indicate the nearest point that it's pointing to. To
+indicate the nearest point, we need to add a second layer.
+
+The first step is to remove the `mark: area` from your visualization.
+Once you've removed the previous mark, add a composite mark at the end of
+the Vega-Lite spec:
+
+```yaml
+  layer: [{
+    mark: area
+  }, {
+    mark: point
+  }]
+```
+
+You'll see that the points are not appearing to line up with the area chart,
+and the reason is that the points are not being stacked. Change your Y encoding
+to this:
+
+```yaml
+    y: {
+      field: buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+      stack: true
+    }
+```
+
+Now, we will add a `selection` block inside the point mark:
+
+```yaml
+  layer: [{
+    mark: area
+  }, {
+    mark: point
+    
+    selection: {
+      pointhover: {
+        type: single
+        on: mouseover
+        clear: mouseout
+        empty: none
+        fields: ["buckets.key", "key"]
+        nearest: true
+      }
+    }
+
+    encoding: {
+      size: {
+        condition: {
+          selection: pointhover
+          value: 100
+        }
+        value: 5
+      }
+      fill: {
+        condition: {
+          selection: pointhover
+          value: white
+        }
+      }
+    }
+  }]
+```
+
+Now that you've enabled a selection, try moving the mouse around the visualization
+and seeing the points respond to the nearest position:
+
+[role="screenshot"]
+image::visualize/images/vega_lite_tutorial_2.png[]
+
+The final result of this tutorial is this spec:
+
+.Expand final Vega-Lite spec
+[%collapsible%closed]
+====
+[source,yaml]
+----
+{
+  $schema: https://vega.github.io/schema/vega-lite/v4.json
+  title: Event counts from ecommerce
+  data: {
+    url: {
+      %context%: true
+      %timefield%: order_date
+      index: kibana_sample_data_ecommerce
+      body: {
+        aggs: {
+          categories: {
+            terms: { field: "category.keyword" }
+            aggs: {
+              time_buckets: {
+                date_histogram: {
+                  field: order_date
+                  interval: {%autointerval%: true}
+                  extended_bounds: {
+                    min: {%timefilter%: "min"}
+                    max: {%timefilter%: "max"}
+                  }
+                  min_doc_count: 0
+                }
+              }
+            }
+          }
+        }
+        size: 0
+      }
+    }
+    format: {property: "aggregations.categories.buckets" }
+  }
+  
+  transform: [{
+    flatten: ["time_buckets.buckets"]
+    as: ["buckets"]
+  }]
+
+  encoding: {
+    x: {
+      field: buckets.key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+      stack: true
+    }
+    color: {
+      field: key
+      type: nominal
+      title: "Category"
+    }
+    tooltip: [{
+      field: buckets.key
+      type: temporal
+      title: "Date"
+    }, {
+      field: key
+      type: nominal
+      title: "Category"
+    }, {
+      field: buckets.doc_count
+      type: quantitative
+      title: "Count"
+    }]
+  }
+  
+  layer: [{
+    mark: area
+  }, {
+    mark: point
+    
+    selection: {
+      pointhover: {
+        type: single
+        on: mouseover
+        clear: mouseout
+        empty: none
+        fields: ["buckets.key", "key"]
+        nearest: true
+      }
+    }
+
+    encoding: {
+      size: {
+        condition: {
+          selection: pointhover
+          value: 100
+        }
+        value: 5
+      }
+      fill: {
+        condition: {
+          selection: pointhover
+          value: white
+        }
+      }
+    }
+  }]
+}
+----
+
+====
+
+[[vega-tutorial-update-kibana-filters-from-vega]]
+=== Update {kib} filters from Vega
+
+experimental[]
+
+In this tutorial you will build an area chart in Vega using an {es} search query,
+and add a click handler and drag handler to update {kib} filters.
+This tutorial is not a full https://vega.github.io/vega/tutorials/[Vega tutorial],
+but will cover the basics of creating Vega visualizations into {kib}.
+
+First, create an almost-blank Vega chart by pasting this into the editor:
+
+```yaml
+{
+  $schema: "https://vega.github.io/schema/vega/v5.json"
+  data: [{
+    name: source_0
+  }]
+  
+  scales: [{
+    name: x
+    type: time
+    range: width
+  }, {
+    name: y
+    type: linear
+    range: height
+  }]
+  
+  axes: [{
+    orient: bottom
+    scale: x
+  }, {
+    orient: left
+    scale: y
+  }]
+  
+  marks: [
+    {
+      type: area
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+        }
+      }
+    }
+  ]
+}
+```
+
+Despite being almost blank, this Vega spec still contains the minimum requirements:
+
+* Data
+* Scales
+* Marks
+* (optional) Axes
+
+Next, add a valid {es} search query in the `data` block:
+
+```yaml
+  data: [
+    {
+      name: source_0
+      url: {
+        %context%: true
+        %timefield%: order_date
+        index: kibana_sample_data_ecommerce
+        body: {
+          aggs: {
+            time_buckets: {
+              date_histogram: {
+                field: order_date
+                fixed_interval: "3h"
+                extended_bounds: {
+                  min: {%timefilter%: "min"}
+                  max: {%timefilter%: "max"}
+                }
+                min_doc_count: 0
+              }
+            }
+          }
+          size: 0
+        }
+      }
+      format: { property: "aggregations.time_buckets.buckets" }
+    }
+  ]
+```
+
+Click "Update", and nothing will change in the visualization. The first step
+is to change the X and Y scales based on the data:
+
+```yaml
+  scales: [{
+    name: x
+    type: time
+    range: width
+    domain: {
+      data: source_0
+      field: key
+    }
+  }, {
+    name: y
+    type: linear
+    range: height
+    domain: {
+      data: source_0
+      field: doc_count
+    }
+  }]
+```
+
+Click "Update", and you will see that the X and Y axes are now showing labels based
+on the real data.
+
+Next, encode the fields `key` and `doc_count` as the X and Y values:
+
+```yaml
+  marks: [
+    {
+      type: area
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+          x: {
+            scale: x
+            field: key
+          }
+          y: {
+            scale: y
+            value: 0
+          }
+          y2: {
+            scale: y
+            field: doc_count
+          }
+        }
+      }
+    }
+  ]
+```
+
+Click "Update" and you will get a basic area chart:
+
+[role="screenshot"]
+image::visualize/images/vega_tutorial_3.png[]
+
+Next, add a new block to the `marks` section. This will show clickable points to filter for a specific
+date:
+
+```yaml
+  {
+    name: point
+    type: symbol
+    style: ["point"]
+    from: {
+      data: source_0
+    }
+    encode: {
+      update: {
+        x: {
+          scale: x
+          field: key
+        }
+        y: {
+          scale: y
+          field: doc_count
+        }
+        size: {
+          value: 100
+        }
+        fill: {
+          value: black
+        }
+      }
+    }
+  }
+```
+
+Next, we will create a Vega signal to make the points clickable. You can access
+the clicked `datum` in the expression used to update. In this case, you want
+clicks on points to add a time filter with the 3-hour interval defined above.
+
+```yaml
+  signals: [
+    {
+      name: point_click
+      on: [{
+        events: {
+          source: scope
+          type: click
+          markname: point
+        }
+        update: '''kibanaSetTimeFilter(datum.key, datum.key + 3 * 60 * 60 * 1000)'''
+      }]
+    }
+  ]
+```
+
+This event is using the {kib} custom function `kibanaSetTimeFilter` to generate a filter that
+gets applied to the entire dashboard on click.
+
+The mouse cursor does not currently indicate that the chart is interactive. Find the `marks` section,
+and update the mark named `point` by adding `cursor: { value: "pointer" }` to
+the `encoding` section like this:
+
+```yaml
+  {
+    name: point
+    type: symbol
+    style: ["point"]
+    from: {
+      data: source_0
+    }
+    encode: {
+      update: {
+        ...
+        cursor: { value: "pointer" }
+      }
+    }
+  }
+```
+
+Next, we will add a drag interaction which will allow the user to narrow into
+a specific time range in the visualization. This will require adding more signals, and
+adding a rectangle overlay:
+
+[role="screenshot"]
+image::visualize/images/vega_tutorial_4.png[]
+
+The first step is to add a new `signal` to track the X position of the cursor:
+
+```yaml
+    {
+      name: currentX
+      value: -1
+      on: [{
+        events: {
+          type: mousemove
+          source: view
+        },
+        update: "clamp(x(), 0, width)"
+      }, {
+        events: {
+          type: mouseout
+          source: view
+        }
+        update: "-1"
+      }]
+    }
+```
+
+Now add a new `mark` to indicate the current cursor position:
+
+```yaml
+    {
+      type: rule
+      interactive: false
+      encode: {
+        update: {
+          y: {value: 0}
+          y2: {signal: "height"}
+          stroke: {value: "gray"}
+          strokeDash: {
+            value: [2, 1]
+          }
+          x: {signal: "max(currentX,0)"}
+          defined: {signal: "currentX > 0"}
+        }
+      }
+    }
+```
+
+Next, add a signal to track the current selected range, which will update
+until the user releases the mouse button or uses the escape key:
+
+
+```yaml
+    {
+      name: selected
+      value: [0, 0]
+      on: [{
+        events: {
+          type: mousedown
+          source: view
+        }
+        update: "[clamp(x(), 0, width), clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: mousemove
+          source: window
+          consume: true
+          between: [{
+            type: mousedown
+            source: view
+          }, {
+            merge: [{
+              type: mouseup
+              source: window
+            }, {
+              type: keydown
+              source: window
+              filter: "event.key === 'Escape'"
+            }]
+          }]
+        }
+        update: "[selected[0], clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: keydown
+          source: window
+          filter: "event.key === 'Escape'"
+        }
+        update: "[0, 0]"
+      }]
+    }
+```
+
+Now that there is a signal which tracks the time range from the user, we need to indicate
+the range visually by adding a new mark which only appears conditionally:
+
+```yaml
+    {
+      type: rect
+      name: selectedRect
+      encode: {
+        update: {
+          height: {signal: "height"}
+          fill: {value: "#333"}
+          fillOpacity: {value: 0.2}
+          x: {signal: "selected[0]"}
+          x2: {signal: "selected[1]"}
+          defined: {signal: "selected[0] !== selected[1]"}
+        }
+      }
+    }
+```
+
+Finally, add a new signal which will update the {kib} time filter when the mouse is released while
+dragging:
+
+```yaml
+    {
+      name: applyTimeFilter
+      value: null
+      on: [{
+        events: {
+          type: mouseup
+          source: view
+        }
+        update: '''selected[0] !== selected[1] ? kibanaSetTimeFilter(
+               invert('x',selected[0]),
+               invert('x',selected[1])) : null'''
+      }]
+    }
+```
+
+Putting this all together, your visualization now supports the main features of
+standard visualizations in {kib}, but with the potential to add even more control.
+The final Vega spec for this tutorial is here:
+
+.Expand final Vega spec
+[%collapsible%closed]
+====
+[source,yaml]
+----
+{
+  $schema: "https://vega.github.io/schema/vega/v5.json"
+  data: [
+    {
+      name: source_0
+      url: {
+        %context%: true
+        %timefield%: order_date
+        index: kibana_sample_data_ecommerce
+        body: {
+          aggs: {
+            time_buckets: {
+              date_histogram: {
+                field: order_date
+                fixed_interval: "3h"
+                extended_bounds: {
+                  min: {%timefilter%: "min"}
+                  max: {%timefilter%: "max"}
+                }
+                min_doc_count: 0
+              }
+            }
+          }
+          size: 0
+        }
+      }
+      format: { property: "aggregations.time_buckets.buckets" }
+    }
+  ]
+  
+  scales: [{
+    name: x
+    type: time
+    range: width
+    domain: {
+      data: source_0
+      field: key
+    }
+  }, {
+    name: y
+    type: linear
+    range: height
+    domain: {
+      data: source_0
+      field: doc_count
+    }
+  }]
+  
+  axes: [{
+    orient: bottom
+    scale: x
+  }, {
+    orient: left
+    scale: y
+  }]
+  
+  marks: [
+    {
+      type: area
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+          x: {
+            scale: x
+            field: key
+          }
+          y: {
+            scale: y
+            value: 0
+          }
+          y2: {
+            scale: y
+            field: doc_count
+          }
+        }
+      }
+    },
+    {
+      name: point
+      type: symbol
+      style: ["point"]
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+          x: {
+            scale: x
+            field: key
+          }
+          y: {
+            scale: y
+            field: doc_count
+          }
+          size: {
+            value: 100
+          }
+          fill: {
+            value: black
+          }
+          cursor: { value: "pointer" }
+        }
+      }
+    },
+    {
+      type: rule
+      interactive: false
+      encode: {
+        update: {
+          y: {value: 0}
+          y2: {signal: "height"}
+          stroke: {value: "gray"}
+          strokeDash: {
+            value: [2, 1]
+          }
+          x: {signal: "max(currentX,0)"}
+          defined: {signal: "currentX > 0"}
+        }
+      }
+    },
+    {
+      type: rect
+      name: selectedRect
+      encode: {
+        update: {
+          height: {signal: "height"}
+          fill: {value: "#333"}
+          fillOpacity: {value: 0.2}
+          x: {signal: "selected[0]"}
+          x2: {signal: "selected[1]"}
+          defined: {signal: "selected[0] !== selected[1]"}
+        }
+      }
+    }
+  ]
+  
+  signals: [
+    {
+      name: point_click
+      on: [{
+        events: {
+          source: scope
+          type: click
+          markname: point
+        }
+        update: '''kibanaSetTimeFilter(datum.key, datum.key + 3 * 60 * 60 * 1000)'''
+      }]
+    }
+    {
+      name: currentX
+      value: -1
+      on: [{
+        events: {
+          type: mousemove
+          source: view
+        },
+        update: "clamp(x(), 0, width)"
+      }, {
+        events: {
+          type: mouseout
+          source: view
+        }
+        update: "-1"
+      }]
+    }
+    {
+      name: selected
+      value: [0, 0]
+      on: [{
+        events: {
+          type: mousedown
+          source: view
+        }
+        update: "[clamp(x(), 0, width), clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: mousemove
+          source: window
+          consume: true
+          between: [{
+            type: mousedown
+            source: view
+          }, {
+            merge: [{
+              type: mouseup
+              source: window
+            }, {
+              type: keydown
+              source: window
+              filter: "event.key === 'Escape'"
+            }]
+          }]
+        }
+        update: "[selected[0], clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: keydown
+          source: window
+          filter: "event.key === 'Escape'"
+        }
+        update: "[0, 0]"
+      }]
+    }
+    {
+      name: applyTimeFilter
+      value: null
+      on: [{
+        events: {
+          type: mouseup
+          source: view
+        }
+        update: '''selected[0] !== selected[1] ? kibanaSetTimeFilter(
+               invert('x',selected[0]),
+               invert('x',selected[1])) : null'''
+      }]
+    }
+  ]
+}
+
+----
+====
+
+[[timelion-tutorial-create-time-series-visualizations]]
+=== Create time series visualizations with Timelion
+
+To compare the real-time percentage of CPU time spent in user space to the results offset by one hour, create a time series visualization.
+
+[float]
+[[define-the-functions]]
+==== Define the functions
+
+To start tracking the real-time percentage of CPU, enter the following in the *Timelion Expression* field:
+
+[source,text]
+----------------------------------
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct')
+----------------------------------
+
+[role="screenshot"]
+image::images/timelion-create01.png[]
+{nbsp}
+
+[float]
+[[compare-the-data]]
+==== Compare the data
+
+To compare the two data sets, add another series with data from the previous hour, separated by a comma:
+
+[source,text]
+----------------------------------
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct'),
+.es(offset=-1h,             <1>
+    index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct')
+----------------------------------
+
+<1> `offset` offsets the data retrieval by a date expression. In this example, `-1h` offsets the data back by one hour.
+
+[role="screenshot"]
+image::images/timelion-create02.png[]
+{nbsp}
+
+[float]
+[[add-label-names]]
+==== Add label names
+
+To easily distinguish between the two data sets, add the label names:
+
+[source,text]
+----------------------------------
+.es(offset=-1h,index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct').label('last hour'),
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct').label('current hour') <1>
+----------------------------------
+
+<1> `.label()` adds custom labels to the visualization.
+
+[role="screenshot"]
+image::images/timelion-create03.png[]
+{nbsp}
+
+[float]
+[[add-a-title]]
+==== Add a title
+
+Add a meaningful title:
+
+[source,text]
+----------------------------------
+.es(offset=-1h,
+    index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct')
+  .label('last hour'),
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct')
+  .label('current hour')
+  .title('CPU usage over time') <1>
+----------------------------------
+
+<1> `.title()` adds a title with a meaningful name. Titles make is easier for unfamiliar users to understand the purpose of the visualization.
+
+[role="screenshot"]
+image::images/timelion-customize01.png[]
+{nbsp}
+
+[float]
+[[change-the-chart-type]]
+==== Change the chart type
+
+To differentiate between the current hour data and the last hour data, change the chart type:
+
+[source,text]
+----------------------------------
+.es(offset=-1h,
+    index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct')
+  .label('last hour')
+  .lines(fill=1,width=0.5), <1>
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct')
+  .label('current hour')
+  .title('CPU usage over time')
+----------------------------------
+
+<1> `.lines()` changes the appearance of the chart lines. In this example, `.lines(fill=1,width=0.5)` sets the fill level to `1`, and the border width to `0.5`.
+
+[role="screenshot"]
+image::images/timelion-customize02.png[]
+{nbsp}
+
+[float]
+[[change-the-line-colors]]
+==== Change the line colors
+
+To make the current hour data stand out, change the line colors:
+
+[source,text]
+----------------------------------
+.es(offset=-1h,
+    index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct')
+  .label('last hour')
+  .lines(fill=1,width=0.5)
+  .color(gray), <1>
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct')
+  .label('current hour')
+  .title('CPU usage over time')
+  .color(#1E90FF)
+----------------------------------
+
+<1> `.color()` changes the color of the data. Supported color types include standard color names, hexadecimal values, or a color schema for grouped data. In this example, `.color(gray)` represents the last hour, and `.color(#1E90FF)` represents the current hour.
+
+[role="screenshot"]
+image::images/timelion-customize03.png[]
+{nbsp}
+
+[float]
+[[make-adjustments-to-the-legend]]
+==== Make adjustments to the legend
+
+Change the position and style of the legend:
+
+[source,text]
+----------------------------------
+.es(offset=-1h,
+    index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct')
+  .label('last hour')
+  .lines(fill=1,width=0.5)
+  .color(gray),
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='avg:system.cpu.user.pct')
+  .label('current hour')
+  .title('CPU usage over time')
+  .color(#1E90FF)
+  .legend(columns=2, position=nw) <1>
+----------------------------------
+
+<1> `.legend()` sets the position and style of the legend. In this example, `.legend(columns=2, position=nw)` places the legend in the north west position of the visualization with two columns.
+
+[role="screenshot"]
+image::images/timelion-customize04.png[]
+{nbsp}
+
+[[timelion-tutorial-create-visualizations-with-mathematical-functions]]
+=== Timelion tutorial: Create visualizations with mathematical functions
+
+To create a visualization for inbound and outbound network traffic, use mathematical functions.
+
+[float]
+[[mathematical-functions-define-functions]]
+==== Define the functions
+
+To start tracking the inbound and outbound network traffic, enter the following in the *Timelion Expression* field:
+
+[source,text]
+----------------------------------
+.es(index=metricbeat*,
+    timefield=@timestamp,
+    metric=max:system.network.in.bytes)
+----------------------------------
+
+[role="screenshot"]
+image::images/timelion-math01.png[]
+{nbsp}
+
+[float]
+[[mathematical-functions-plot-change]]
+==== Plot the rate of change
+
+Change how the data is displayed so that you can easily monitor the inbound traffic:
+
+[source,text]
+----------------------------------
+.es(index=metricbeat*,
+    timefield=@timestamp,
+    metric=max:system.network.in.bytes)
+  .derivative() <1>
+----------------------------------
+
+<1> `.derivative` plots the change in values over time.
+
+[role="screenshot"]
+image::images/timelion-math02.png[]
+{nbsp}
+
+Add a similar calculation for outbound traffic:
+
+[source,text]
+----------------------------------
+.es(index=metricbeat*,
+    timefield=@timestamp,
+    metric=max:system.network.in.bytes)
+  .derivative(),
+.es(index=metricbeat*,
+    timefield=@timestamp,
+    metric=max:system.network.out.bytes)
+  .derivative()
+  .multiply(-1) <1>
+----------------------------------
+
+<1> `.multiply()` multiplies the data series by a number, the result of a data series, or a list of data series. For this example, `.multiply(-1)` converts the outbound network traffic to a negative value since the outbound network traffic is leaving your machine.
+
+[role="screenshot"]
+image::images/timelion-math03.png[]
+{nbsp}
+
+[float]
+[[mathematical-functions-convert-data]]
+==== Change the data metric
+
+To make the visualization easier to analyze, change the data metric from bytes to megabytes:
+
+[source,text]
+----------------------------------
+.es(index=metricbeat*,
+    timefield=@timestamp,
+    metric=max:system.network.in.bytes)
+  .derivative()
+  .divide(1048576),
+.es(index=metricbeat*,
+    timefield=@timestamp,
+    metric=max:system.network.out.bytes)
+  .derivative()
+  .multiply(-1)
+  .divide(1048576) <1>
+----------------------------------
+
+<1> `.divide()` accepts the same input as `.multiply()`, then divides the data series by the defined divisor.
+
+[role="screenshot"]
+image::images/timelion-math04.png[]
+{nbsp}
+
+[float]
+[[mathematical-functions-add-labels]]
+==== Customize and format the visualization
+
+Customize and format the visualization using functions:
+
+[source,text]
+----------------------------------
+.es(index=metricbeat*,
+    timefield=@timestamp,
+    metric=max:system.network.in.bytes)
+  .derivative()
+  .divide(1048576)
+  .lines(fill=2, width=1)
+  .color(green)
+  .label("Inbound traffic")         <1>
+  .title("Network traffic (MB/s)"), <2>
+.es(index=metricbeat*,
+    timefield=@timestamp,
+    metric=max:system.network.out.bytes)
+  .derivative()
+  .multiply(-1)
+  .divide(1048576)
+  .lines(fill=2, width=1)           <3>
+  .color(blue)                      <4>
+  .label("Outbound traffic")
+  .legend(columns=2, position=nw) <5>
+----------------------------------
+
+<1> `.label()` adds custom labels to the visualization.
+<2> `.title()` adds a title with a meaningful name.
+<3> `.lines()` changes the appearance of the chart lines. In this example, `.lines(fill=2, width=1)` sets the fill level to `2`, and the border width to `1`.
+<4> `.color()` changes the color of the data. Supported color types include standard color names, hexadecimal values, or a color schema for grouped data. In this example, `.color(green)` represents the inbound network traffic, and `.color(blue)` represents the outbound network traffic.
+<5> `.legend()` sets the position and style of the legend. For this example, `legend(columns=2, position=nw)` places the legend in the north west position of the visualization with two columns.
+
+[role="screenshot"]
+image::images/timelion-math05.png[]
+{nbsp}
+
+[[timelion-tutorial-create-visualizations-withconditional-logic-and-tracking-trends]]
+=== Create visualizations with conditional logic and tracking trends using Timelion
+
+To easily detect outliers and discover patterns over time, modify time series data with conditional logic and create a trend with a moving average.
+
+With Timelion conditional logic, you can use the following operator values to compare your data:
+
+[horizontal]
+`eq`:: equal
+`ne`:: not equal
+`lt`:: less than
+`lte`:: less than or equal to
+`gt`:: greater than
+`gte`:: greater than or equal to
+
+[float]
+[[conditional-define-functions]]
+==== Define the functions
+
+To chart the maximum value of `system.memory.actual.used.bytes`, enter the following in the *Timelion Expression* field:
+
+[source,text]
+----------------------------------
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes')
+----------------------------------
+
+[role="screenshot"]
+image::images/timelion-conditional01.png[]
+{nbsp}
+
+[float]
+[[conditional-track-memory]]
+==== Track used memory
+
+To track the amount of memory used, create two thresholds:
+
+[source,text]
+----------------------------------
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes'),
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes')
+  .if(gt,                             <1>
+      11300000000,                    <2>
+      .es(index=metricbeat-*,
+          timefield='@timestamp',
+          metric='max:system.memory.actual.used.bytes'),
+      null)
+    .label('warning')
+    .color('#FFCC11'),
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes')
+  .if(gt,
+      11375000000,
+      .es(index=metricbeat-*,
+          timefield='@timestamp',
+          metric='max:system.memory.actual.used.bytes'),
+      null)
+  .label('severe')
+  .color('red')
+----------------------------------
+
+<1> Timelion conditional logic for the _greater than_ operator. In this example, the warning threshold is 11.3GB (`11300000000`), and the severe threshold is 11.375GB (`11375000000`). If the threshold values are too high or low for your machine, adjust the values accordingly.
+<2> `if()` compares each point to a number. If the condition evaluates to `true`, adjust the styling. If the condition evaluates to `false`, use the default styling.
+
+[role="screenshot"]
+image::images/timelion-conditional02.png[]
+{nbsp}
+
+[float]
+[[conditional-determine-trend]]
+==== Determine the trend
+
+To determine the trend, create a new data series:
+
+[source,text]
+----------------------------------
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes'),
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes')
+  .if(gt,11300000000,
+      .es(index=metricbeat-*,
+          timefield='@timestamp',
+          metric='max:system.memory.actual.used.bytes'),
+      null)
+      .label('warning')
+      .color('#FFCC11'),
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes')
+  .if(gt,11375000000,
+      .es(index=metricbeat-*,
+          timefield='@timestamp',
+          metric='max:system.memory.actual.used.bytes'),
+      null).
+      label('severe')
+      .color('red'),
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes')
+  .mvavg(10) <1>
+----------------------------------
+
+<1> `mvavg()` calculates the moving average over a specified period of time. In this example, `.mvavg(10)` creates a moving average with a window of 10 data points.
+
+[role="screenshot"]
+image::images/timelion-conditional03.png[]
+{nbsp}
+
+[float]
+[[conditional-format-visualization]]
+==== Customize and format the visualization
+
+Customize and format the visualization using functions:
+
+[source,text]
+----------------------------------
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes')
+  .label('max memory')                    <1>
+  .title('Memory consumption over time'), <2>
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes')
+  .if(gt,
+      11300000000,
+      .es(index=metricbeat-*,
+          timefield='@timestamp',
+          metric='max:system.memory.actual.used.bytes'),
+      null)
+    .label('warning')
+    .color('#FFCC11')                 <3>
+    .lines(width=5),                  <4>
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes')
+  .if(gt,
+      11375000000,
+      .es(index=metricbeat-*,
+          timefield='@timestamp',
+          metric='max:system.memory.actual.used.bytes'),
+      null)
+    .label('severe')
+    .color('red')
+    .lines(width=5),
+.es(index=metricbeat-*,
+    timefield='@timestamp',
+    metric='max:system.memory.actual.used.bytes')
+  .mvavg(10)
+  .label('mvavg')
+  .lines(width=2)
+  .color(#5E5E5E)
+  .legend(columns=4, position=nw)    <5>
+----------------------------------
+
+<1> `.label()` adds custom labels to the visualization.
+<2> `.title()` adds a title with a meaningful name.
+<3> `.color()` changes the color of the data. Supported color types include standard color names, hexadecimal values, or a color schema for grouped data.
+<4> `.lines()` changes the appearance of the chart lines. In this example, .lines(width=5) sets border width to `5`.
+<5> `.legend()` sets the position and style of the legend. For this example, `(columns=4, position=nw)` places the legend in the north west position of the visualization with four columns.
+
+[role="screenshot"]
+image::images/timelion-conditional04.png[]
+{nbsp}
+
+For additional information on Timelion conditional capabilities, go to https://www.elastic.co/blog/timeseries-if-then-else-with-timelion[I have but one .condition()].
\ No newline at end of file
diff --git a/docs/user/dashboard/vega-reference.asciidoc b/docs/user/dashboard/vega-reference.asciidoc
new file mode 100644
index 00000000000000..eed8d9a35b8748
--- /dev/null
+++ b/docs/user/dashboard/vega-reference.asciidoc
@@ -0,0 +1,437 @@
+[[vega-reference]]
+== Vega reference
+
+experimental[]
+
+For additional *Vega* and *Vega-Lite* information, refer to the reference sections.
+
+[float]
+[[reference-for-kibana-extensions]]
+=== Reference for {kib} extensions
+
+{kib} has extended Vega and Vega-Lite with extensions that support:
+
+* Default height and width
+* Default theme to match {kib}
+* Writing {es} queries using the time range and filters from dashboards
+* Using the Elastic Map Service in Vega maps
+* Additional tooltip styling
+* Advanced setting to enable URL loading from any domain
+* Limited debugging support using the browser dev tools
+* (Vega only) Expression functions which can update the time range and dashboard filters
+
+[float]
+[[vega-sizing-and-positioning]]
+==== Default height and width
+
+By default, Vega visualizations use the `autosize = { type: 'fit', contains: 'padding' }` layout.
+`fit` uses all available space, ignores `width` and `height` values,
+and respects the padding values. To override this behavior, change the
+`autosize` value.
+
+[float]
+[[vega-theme]]
+==== Default theme to match {kib}
+
+{kib} registers a default https://vega.github.io/vega/docs/schemes/[Vega color scheme]
+with the id `elastic`, and sets a default color for each `mark` type.
+Override it by providing a different `stroke`, `fill`, or `color` (Vega-Lite) value.
+
+[float]
+[[vega-queries]]
+==== Writing {es} queries in Vega
+
+experimental[] {kib} extends the Vega https://vega.github.io/vega/docs/data/[data] elements
+with support for direct {es} queries specified as a `url`.
+
+Because of this, {kib} is **unable to support dynamically loaded data**,
+which would otherwise work in Vega. All data is fetched before it's passed to
+the Vega renderer.
+
+To define an {es} query in Vega, set the `url` to an object. {kib} will parse
+the object looking for special tokens that allow your query to integrate with {kib}.
+These tokens are:
+
+* `%context%: true`: Set at the top level, and replaces the `query` section with filters from dashboard
+* `%timefield%: <name>`: Set at the top level, integrates the query with the dashboard time filter
+* `{%timefilter%: true}`: Replaced by an {es} range query with upper and lower bounds
+* `{%timefilter%: "min" | "max"}`: Replaced only by the upper or lower bounds
+* `{%timefilter: true, shift: -1, unit: 'hour'}`: Generates a time range query one hour in the past
+* `{%autointerval%: true}`: Replaced by the string which contains the automatic {kib} time interval, such as `1h`
+* `{%autointerval%: 10}`: Replaced by a string which is approximately dividing the time into 10 ranges, allowing
+  you to influence the automatic interval
+* `"%dashboard_context-must_clause%"`: String replaced by object containing filters
+* `"%dashboard_context-filter_clause%"`: String replaced by an object containing filters
+* `"%dashboard_context-must_not_clause%"`: String replaced by an object containing filters
+
+Putting this together, an example query that counts the number of documents in 
+a specific index:
+
+[source,yaml]
+----
+// An object instead of a string for the URL value
+// is treated as a context-aware Elasticsearch query.
+url: {
+  // Specify the time filter.
+  %timefield%: @timestamp
+  // Apply dashboard context filters when set
+  %context%: true
+
+  // Which indexes to search
+  index: kibana_sample_data_logs
+  // The body element may contain "aggs" and "query" keys
+  body: {
+    aggs: {
+      time_buckets: {
+        date_histogram: {
+          // Use date histogram aggregation on @timestamp field
+          field: @timestamp <1>
+          // interval value will depend on the time filter
+          // Use an integer to set approximate bucket count
+          interval: { %autointerval%: true }
+          // Make sure we get an entire range, even if it has no data
+          extended_bounds: {
+            min: { %timefilter%: "min" }
+            max: { %timefilter%: "max" }
+          }
+          // Use this for linear (e.g. line, area) graphs
+          // Without it, empty buckets will not show up
+          min_doc_count: 0
+        }
+      }
+    }
+    // Speed up the response by only including aggregation results
+    size: 0
+  }
+}
+----
+
+<1> `@timestamp` &mdash; Filters the time range and breaks it into histogram
+buckets.
+
+The full result includes the following structure:
+
+[source,yaml]
+----
+{
+  "aggregations": {
+    "time_buckets": {
+      "buckets": [{
+          "key_as_string": "2015-11-30T22:00:00.000Z",
+          "key": 1448920800000,<1>
+          "doc_count": 28
+        }, {
+          "key_as_string": "2015-11-30T23:00:00.000Z",
+          "key": 1448924400000, <1>
+          "doc_count": 330
+        }, ...
+----
+
+<1> `"key"` &mdash; The unix timestamp you can use without conversions by the
+Vega date expressions.
+
+For most visualizations, you only need the list of bucket values. To focus on
+only the data you need, use `format: {property: "aggregations.time_buckets.buckets"}`.
+
+Specify a query with individual range and dashboard context. The query is
+equivalent to `"%context%": true, "%timefield%": "@timestamp"`,
+except that the time range is shifted back by 10 minutes:
+
+[source,yaml]
+----
+{
+  body: {
+    query: {
+      bool: {
+        must: [
+          // This string will be replaced
+          // with the auto-generated "MUST" clause
+          "%dashboard_context-must_clause%"
+          {
+            range: {
+              // apply timefilter (upper right corner)
+              // to the @timestamp variable
+              @timestamp: {
+                // "%timefilter%" will be replaced with
+                // the current values of the time filter
+                // (from the upper right corner)
+                "%timefilter%": true
+                // Only work with %timefilter%
+                // Shift current timefilter by 10 units back
+                shift: 10
+                // week, day (default), hour, minute, second
+                unit: minute
+              }
+            }
+          }
+        ]
+        must_not: [
+          // This string will be replaced with
+          // the auto-generated "MUST-NOT" clause
+          "%dashboard_context-must_not_clause%"
+        ]
+        filter: [
+          // This string will be replaced
+          // with the auto-generated "FILTER" clause
+          "%dashboard_context-filter_clause%"
+        ]
+      }
+    }
+  }
+}
+----
+
+NOTE: When using `"%context%": true` or defining a value for `"%timefield%"` the body cannot contain a query. To customize the query within the VEGA specification (e.g. add an additional filter, or shift the timefilter), define your query and use the placeholders as in the example above. The placeholders will be replaced by the actual context of the dashboard or visualization once parsed.
+
+The `"%timefilter%"` can also be used to specify a single min or max
+value. The date_histogram's `extended_bounds` can be set
+with two values - min and max. Instead of hardcoding a value, you may
+use `"min": {"%timefilter%": "min"}`, which will be replaced with the
+beginning of the current time range. The `shift` and `unit` values are
+also supported. The `"interval"` can also be set dynamically, depending
+on the currently picked range: `"interval": {"%autointerval%": 10}` will
+try to get about 10-15 data points (buckets).
+
+[float]
+[[vega-esmfiles]]
+=== Access Elastic Map Service files
+
+experimental[] Access the Elastic Map Service files via the same mechanism:
+
+[source,yaml]
+----
+url: {
+  // "type" defaults to "elasticsearch" otherwise
+  type: emsfile
+  // Name of the file, exactly as in the Region map visualization
+  name: World Countries
+}
+// The result is a geojson file, get its features to use
+// this data source with the "shape" marks
+// https://vega.github.io/vega/docs/marks/shape/
+format: {property: "features"}
+----
+
+To enable Maps, the graph must specify `type=map` in the host
+configuration:
+
+[source,yaml]
+----
+{
+  "config": {
+    "kibana": {
+      "type": "map",
+
+      // Initial map position
+      "latitude": 40.7,   // default 0
+      "longitude": -74,   // default 0
+      "zoom": 7,          // default 2
+
+      // defaults to "default". Use false to disable base layer.
+      "mapStyle": false,
+
+      // default 0
+      "minZoom": 5,
+
+      // defaults to the maximum for the given style,
+      // or 25 when base is disabled
+      "maxZoom": 13,
+
+      // defaults to true, shows +/- buttons to zoom in/out
+      "zoomControl": false,
+
+      // Defaults to 'false', disables mouse wheel zoom. If set to
+      // 'true', map may zoom unexpectedly while scrolling dashboard
+      "scrollWheelZoom": false,
+
+      // When false, repaints on each move frame.
+      // Makes the graph slower when moving the map
+      "delayRepaint": true, // default true
+    }
+  },
+  /* the rest of Vega JSON */
+}
+----
+
+The visualization automatically injects a `"projection"`, which you can use to
+calculate the position of all geo-aware marks.
+Additionally, you can use `latitude`, `longitude`, and `zoom` signals.
+These signals can be used in the graph, or can be updated to modify the
+position of the map.
+
+[float]
+[[vega-tooltip]]
+==== Additional tooltip styling
+
+{kib} has installed the https://vega.github.io/vega-lite/docs/tooltip.html[Vega tooltip plugin],
+so tooltips can be defined in the ways documented there. Beyond that, {kib} also supports
+a configuration option for changing the tooltip position and padding:
+
+```js
+{
+  config: {
+    kibana: {
+      tooltips: {
+        position: 'top',
+        padding: 15
+      }
+    }
+  }
+}
+```
+
+[float]
+[[vega-url-loading]]
+==== Advanced setting to enable URL loading from any domain
+
+Vega can load data from any URL, but this is disabled by default in {kib}. 
+To change this, set `vis_type_vega.enableExternalUrls: true` in `kibana.yml`,
+then restart {kib}.
+
+[float]
+[[vega-inspector]]
+==== Vega Inspector
+Use the contextual *Inspect* tool to gain insights into different elements. 
+For Vega visualizations, there are two different views: *Request* and *Vega debug*.
+
+[float]
+[[inspect-elasticsearch-requests]]
+===== Inspect {es} requests
+
+Vega uses the {ref}/search-search.html[{es} search API] to get documents and aggregation 
+results from {es}. To troubleshoot these requests, click *Inspect*, which shows the most recent requests. 
+In case your specification has more than one request, you can switch between the views using the *View* dropdown.
+
+[role="screenshot"]
+image::visualize/images/vega_tutorial_inspect_requests.png[]
+
+[float]
+[[vega-debugging]]
+===== Vega debugging
+
+With the *Vega debug* view, you can inspect the *Data sets* and *Signal Values* runtime data. 
+ 
+The runtime data is read from the 
+https://vega.github.io/vega/docs/api/debugging/#scope[runtime scope]. 
+
+[role="screenshot"]
+image::visualize/images/vega_tutorial_inspect_data_sets.png[]
+
+To debug more complex specs, access to the `view` variable.  For more information, refer to
+the <<vega-browser-debugging-console, Vega browser debugging process>>.
+
+[float]
+[[asking-for-help-with-a-vega-spec]]
+===== Asking for help with a Vega spec
+
+Because of the dynamic nature of the data in {es}, it is hard to help you with 
+Vega specs unless you can share a dataset. To do this, click *Inspect*, select the *Vega debug* view,
+then select the *Spec* tab:
+
+[role="screenshot"]
+image::visualize/images/vega_tutorial_getting_help.png[]
+
+To copy the response, click *Copy to clipboard*. Paste the copied data to 
+https://gist.github.com/[gist.github.com], possibly with a .json extension. Use the [raw] button, 
+and share that when asking for help.
+
+[float]
+[[vega-browser-debugging-console]]
+==== Browser debugging console
+
+experimental[] Use browser debugging tools (for example, F12 or Ctrl+Shift+J in Chrome) to
+inspect the `VEGA_DEBUG` variable:
+
+* `view` &mdash; Access to the Vega View object. See https://vega.github.io/vega/docs/api/debugging/[Vega Debugging Guide]
+on how to inspect data and signals at runtime. For Vega-Lite,
+`VEGA_DEBUG.view.data('source_0')` gets the pre-transformed data, and `VEGA_DEBUG.view.data('data_0')`
+gets the encoded data. For Vega, it uses the data name as defined in your Vega spec.
+
+* `vega_spec` &mdash; Vega JSON graph specification after some modifications by {kib}. In case
+of Vega-Lite, this is the output of the Vega-Lite compiler.
+
+* `vegalite_spec` &mdash; If this is a Vega-Lite graph, JSON specification of the graph before
+Vega-Lite compilation.
+
+[float]
+[[vega-expression-functions]]
+==== (Vega only) Expression functions which can update the time range and dashboard filters
+
+{kib} has extended the Vega expression language with these functions:
+
+```js
+/**
+  * @param {object} query Elastic Query DSL snippet, as used in the query DSL editor
+  * @param {string} [index] as defined in Kibana, or default if missing
+  */
+kibanaAddFilter(query, index)
+
+/**
+  * @param {object} query Elastic Query DSL snippet, as used in the query DSL editor
+  * @param {string} [index] as defined in Kibana, or default if missing
+  */
+kibanaRemoveFilter(query, index)
+
+kibanaRemoveAllFilters()
+
+/**
+  * Update dashboard time filter to the new values
+  * @param {number|string|Date} start
+  * @param {number|string|Date} end
+  */
+kibanaSetTimeFilter(start, end)
+```
+
+[float]
+[[vega-additional-configuration-options]]
+==== Additional configuration options
+
+[source,yaml]
+----
+{
+  config: {
+    kibana: {
+      // Placement of the Vega-defined signal bindings.
+      // Can be `left`, `right`, `top`, or `bottom` (default).
+      controlsLocation: top
+      // Can be `vertical` or `horizontal` (default).
+      controlsDirection: vertical
+      // If true, hides most of Vega and Vega-Lite warnings
+      hideWarnings: true
+      // Vega renderer to use: `svg` or `canvas` (default)
+      renderer: canvas
+    }
+  }
+}
+----
+
+[[vega-notes]]
+[[resources-and-examples]]
+=== Resources and examples
+
+experimental[] To learn more about Vega and Vega-Lite, refer to the resources and examples.
+
+[float]
+[[vega-editor]]
+==== Vega editor
+The https://vega.github.io/editor/[Vega Editor] includes examples for Vega & Vega-Lite, but does not support any
+{kib}-specific features like {es} requests and interactive base maps.
+
+[float]
+[[vega-lite-resources]]
+==== Vega-Lite resources
+* https://vega.github.io/vega-lite/tutorials/getting_started.html[Tutorials]
+* https://vega.github.io/vega-lite/docs/[Docs]
+* https://vega.github.io/vega-lite/examples/[Examples]
+
+[float]
+[[vega-resources]]
+==== Vega resources
+* https://vega.github.io/vega/tutorials/[Tutorials]
+* https://vega.github.io/vega/docs/[Docs]
+* https://vega.github.io/vega/examples/[Examples]
+
+TIP: When you use the examples in {kib}, you may
+need to modify the "data" section to use absolute URL. For example,
+replace `"url": "data/world-110m.json"` with
+`"url": "https://vega.github.io/editor/data/world-110m.json"`.
diff --git a/docs/user/getting-started.asciidoc b/docs/user/getting-started.asciidoc
index 2ff3a09152df4d..a877f6a66a79ad 100644
--- a/docs/user/getting-started.asciidoc
+++ b/docs/user/getting-started.asciidoc
@@ -1,19 +1,19 @@
-[[getting-started]]
+[[get-started]]
 = Get started
 
 [partintro]
 --
 
-Ready to try out {kib} and see what it can do? To quickest way to get started with {kib} is to set up on Cloud, then add a sample data set that helps you get a handle on the full range of {kib} features.
+Ready to try out {kib} and see what it can do? The quickest way to get started with {kib} is to set up on Cloud, then add a sample data set to explore the full range of {kib} features.
 
 [float]
-[[cloud-set-up]]
+[[set-up-on-cloud]]
 == Set up on cloud
 
 include::{docs-root}/shared/cloud/ess-getting-started.asciidoc[]
 
 [float]
-[[get-data-in]]
+[[gs-get-data-into-kibana]]
 == Get data into {kib}
 
 The easiest way to get data into {kib} is to add a sample data set.
@@ -42,12 +42,11 @@ NOTE: The timestamps in the sample data sets are relative to when they are insta
 If you uninstall and reinstall a data set, the timestamps change to reflect the most recent installation.
 
 [float]
-[[getting-started-next-steps]]
 == Next steps
 
-* To get a hands-on experience creating visualizations, follow the <<tutorial-sample-data, add sample data>> tutorial.
+* To get a hands-on experience creating visualizations, follow the <<explore-kibana-using-sample-data, add sample data>> tutorial.
 
-* If you're ready to load an actual data set and build a dashboard, follow the <<tutorial-build-dashboard, build your own dashboard>> tutorial.
+* If you're ready to load an actual data set and build a dashboard, follow the <<create-your-own-dashboard, Create your own dashboard>> tutorial.
 
 --
 
@@ -60,5 +59,3 @@ include::{kib-repo-dir}/getting-started/tutorial-define-index.asciidoc[]
 include::{kib-repo-dir}/getting-started/tutorial-discovering.asciidoc[]
 
 include::{kib-repo-dir}/getting-started/tutorial-visualizing.asciidoc[]
-
-include::{kib-repo-dir}/getting-started/tutorial-dashboard.asciidoc[]
diff --git a/docs/user/index.asciidoc b/docs/user/index.asciidoc
index abbdbeb68d9cbc..e909626c5779cd 100644
--- a/docs/user/index.asciidoc
+++ b/docs/user/index.asciidoc
@@ -2,8 +2,6 @@ include::introduction.asciidoc[]
 
 include::whats-new.asciidoc[]
 
-include::getting-started.asciidoc[]
-
 include::setup.asciidoc[]
 
 include::monitoring/configuring-monitoring.asciidoc[leveloffset=+1]
@@ -13,9 +11,11 @@ include::monitoring/monitoring-kibana.asciidoc[leveloffset=+2]
 
 include::security/securing-kibana.asciidoc[]
 
+include::getting-started.asciidoc[]
+
 include::discover.asciidoc[]
 
-include::dashboard.asciidoc[]
+include::dashboard/dashboard.asciidoc[]
 
 include::canvas.asciidoc[]
 
@@ -25,8 +25,6 @@ include::ml/index.asciidoc[]
 
 include::graph/index.asciidoc[]
 
-include::visualize.asciidoc[]
-
 include::{kib-repo-dir}/observability/index.asciidoc[]
 
 include::{kib-repo-dir}/logs/index.asciidoc[]
diff --git a/docs/user/introduction.asciidoc b/docs/user/introduction.asciidoc
index ff936fb4d55696..079d183dd959dd 100644
--- a/docs/user/introduction.asciidoc
+++ b/docs/user/introduction.asciidoc
@@ -83,12 +83,6 @@ image::images/intro-dashboard.png[]
 
 {kib} also offers these visualization features:
 
-* <<visualize, Visualize>> allows you to display your data in
-charts, graphs, and tables
-(just to name a few). It's also home to Lens.
-Visualize supports the ability to add interactive
-controls to your dashboard, filter dashboard content in real time, and add your own images and logos for your brand.
-
 * <<canvas, Canvas>> gives you the ability to present your data in a
 visually compelling, pixel-perfect report. Give your data the “wow” factor
 needed to impress your CEO or to captivate coworkers with a big-screen display.
@@ -98,7 +92,7 @@ questions of your location-based data. Maps supports multiple
 layers and data sources, mapping of individual geo points and shapes,
 and dynamic client-side styling.
 
-* <<TSVB, TSVB>> allows you to combine
+* <<tsvb, TSVB>> allows you to combine
 an infinite number of aggregations to display complex data.
 With TSVB, you can analyze multiple index patterns and customize
 every aspect of your visualization. Choose your own date format and color
@@ -161,6 +155,6 @@ and start exploring data in minutes.
 You can also <<install, install {kib} on your own>> &mdash; no code, no additional
 infrastructure required.
 
-Our <<tutorial-build-dashboard, Getting Started>> and in-product guidance can
+Our <<create-your-own-dashboard, Getting Started>> and in-product guidance can
 help you get up and running, faster. Click the help icon image:images/intro-help-icon.png[]
 in the top navigation bar for help with questions or to provide feedback.
diff --git a/docs/user/reporting/automating-report-generation.asciidoc b/docs/user/reporting/automating-report-generation.asciidoc
index 3e227229ddcc52..371855deb2f3c7 100644
--- a/docs/user/reporting/automating-report-generation.asciidoc
+++ b/docs/user/reporting/automating-report-generation.asciidoc
@@ -13,7 +13,7 @@ URL that triggers a report to generate.
 
 To create the POST URL for PDF reports:
 
-. Go to *Visualize* or *Dashboard*, then open the visualization or dashboard.
+. Go to *Dashboard*, then open the visualization or dashboard.
 +
 To specify a relative or absolute time period, use the time filter.
 
diff --git a/docs/user/reporting/index.asciidoc b/docs/user/reporting/index.asciidoc
index 4f4d59315fafa3..50ae92382fb243 100644
--- a/docs/user/reporting/index.asciidoc
+++ b/docs/user/reporting/index.asciidoc
@@ -11,7 +11,7 @@ saved search, or Canvas workpad. Depending on the object type, you can export th
 a PDF, PNG, or CSV document, which you can keep for yourself, or share with others.
 
 Reporting is available from the *Share* menu
-in *Discover*, *Visualize*, *Dashboard*, and *Canvas*.
+in *Discover*, *Dashboard*, and *Canvas*.
 
 [role="screenshot"]
 image::user/reporting/images/share-button.png["Share"]
diff --git a/docs/user/security/rbac_tutorial.asciidoc b/docs/user/security/rbac_tutorial.asciidoc
index 3a4b2202201e25..cc4af9041bcd9c 100644
--- a/docs/user/security/rbac_tutorial.asciidoc
+++ b/docs/user/security/rbac_tutorial.asciidoc
@@ -28,7 +28,7 @@ To complete this tutorial, you'll need the following:
 *  **A space**: In this tutorial, use `Dev Mortgage` as the space
 name. See <<spaces-managing, spaces management>> for
 details on creating a space.
-*  **Data**:  You can use <<tutorial-sample-data, sample data>> or
+*  **Data**:  You can use <<gs-get-data-into-kibana, sample data>> or
 live data.  In the following steps, Filebeat and Metricbeat data are used.
 
 [float]
diff --git a/docs/user/security/reporting.asciidoc b/docs/user/security/reporting.asciidoc
index 4e02759ce99cbd..daf9720a0f1d8c 100644
--- a/docs/user/security/reporting.asciidoc
+++ b/docs/user/security/reporting.asciidoc
@@ -47,7 +47,7 @@ image::user/security/images/reporting-privileges-example.png["Reporting privileg
 Reporting users typically save searches, create
 visualizations, and build dashboards. They require a space
 that provides read and write privileges in
-*Discover*, *Visualize*, and *Dashboard*.
+*Discover* and *Dashboard*.
 
 . Save your new role.
 
diff --git a/docs/user/visualize.asciidoc b/docs/user/visualize.asciidoc
deleted file mode 100644
index dc116962f9e961..00000000000000
--- a/docs/user/visualize.asciidoc
+++ /dev/null
@@ -1,142 +0,0 @@
-[[visualize]]
-= Visualize
-
-[partintro]
---
-_Visualize_ enables you to create visualizations of the data from your {es} indices, which you can then add to dashboards for analysis.
-
-{kib} visualizations are based on {es} queries. By using a series of {es} {ref}/search-aggregations.html[aggregations] to extract and process your data, you can create charts that show you the trends, spikes, and dips you need to know about.
-
-To begin, open the menu, go to *Visualize*, then click *Create visualization*.
-
-[float]
-[[visualization-types]]
-== Types of visualizations
-
-{kib} supports several types of visualizations.
-
-<<lens,Lens>>::
-Quickly build several types of basic visualizations by simply dragging and dropping the data fields you want to display.
-
-<<most-frequent,Most frequently used visualizations>>::
-
-* *Line, area, and bar charts* &mdash; Compares different series in X/Y charts.
-
-* *Pie chart* &mdash; Displays each source contribution to a total.
-
-* *Data table* &mdash; Flattens aggregations into table format.
-
-* *Metric* &mdash; Displays a single number.
-
-* *Goal and gauge* &mdash; Displays a number with progress indicators.
-
-* *Tag cloud* &mdash; Displays words in a cloud, where the size of the word corresponds to its importance.
-
-<<TSVB,TSVB>>:: Visualizes time series data using pipeline aggregations.
-
-<<timelion,Timelion>>:: Computes and combine data from multiple time series
-data sets.
-
-<<visualize-maps, Maps>>::
-* *<<maps,Maps>>* &mdash; Displays geospatial data in {kib}.
-
-* <<heat-map,Heat map>>:: Display shaded cells within a matrix.
-
-<<for-dashboard,Dashboard tools>>::
-
-* *Markdown widget* &mdash; Displays free-form information or instructions.
-
-* *Controls* &mdash; Adds interactive inputs to a dashboard.
-
-<<vega-graph,Vega>>:: Completes control over query and display.
-
-[float]
-[[choose-your-data]]
-== Choose your data
-
-Specify a search query to retrieve the data for your visualization, or used rolled up data.
-
-* To enter new search criteria, select the <<index-patterns, index pattern>> for the indices that
-contain the data you want to visualize. The visualization builder opens
-with a wildcard query that matches all of the documents in the selected
-indices.
-
-* To build a visualization from a saved search, click the name of the saved
-search you want to use. The visualization builder opens and loads the
-selected query.
-+
-NOTE: When you build a visualization from a saved search, any subsequent
-modifications to the saved search are reflected in the
-visualization. To disable automatic updates, delete the visualization
-on the *Saved Object* page.
-
-* To build a visualization using <<rollup-index-pattern,rolled up data>>, select
-the index pattern that includes the data. Rolled up data is summarized into
-time buckets that can be split into sub buckets for numeric field values or
-terms. To lower granularity, use a time aggregation that uses and combines
-several time buckets. For an example, refer to <<rollup-data-tutorial,Create and visualize rolled up data>>.
-
-[float]
-[[vis-inspector]]
-== Inspect visualizations
-
-Many visualizations allow you to inspect the query and data behind the visualization.
-
-. In the {kib} toolbar, click *Inspect*.
-. To download the data, click *Download CSV*, then choose one of the following options:
-* *Formatted CSV* - Downloads the data in table format.
-* *Raw CSV* - Downloads the data as provided.
-. To view the requests for collecting data, select *Requests* from the *View*
-dropdown.
-
-[float]
-[[save-visualize]]
-== Save visualizations
-To use your visualizations in <<dashboard, dashboards>>, you must save them.
-
-. In the {kib} toolbar, click *Save*.
-. Enter the visualization *Title* and optional *Description*, then *Save* the visualization.
-
-To access the saved visualization, go to *Management > {kib} > Saved Objects*.
-
-[float]
-[[save-visualization-read-only-access]]
-==== Read only access
-When you have insufficient privileges to save visualizations, the following indicator is
-displayed and the *Save* button is not visible.
-
-For more information, refer to <<xpack-security-authorization>>.
-
-[role="screenshot"]
-image::visualize/images/read-only-badge.png[Example of Visualize's read only access indicator in Kibana's header]
-
-[float]
-[[visualize-share-options]]
-== Share visualizations
-
-When you've finished your visualization, you can share it outside of {kib}.
-
-From the *Share* menu, you can:
-
-* Embed the code in a web page. Users must have {kib} access
-to view an embedded visualization.
-* Share a direct link to a {kib} visualization.
-* Generate a PDF report.
-* Generate a PNG report.
-
---
-include::{kib-repo-dir}/visualize/aggregations.asciidoc[]
-
-include::{kib-repo-dir}/visualize/lens.asciidoc[]
-
-include::{kib-repo-dir}/visualize/most-frequent.asciidoc[]
-
-include::{kib-repo-dir}/visualize/tsvb.asciidoc[]
-
-include::{kib-repo-dir}/visualize/timelion.asciidoc[]
-
-include::{kib-repo-dir}/visualize/tilemap.asciidoc[]
-
-include::{kib-repo-dir}/visualize/for-dashboard.asciidoc[]
-
-include::{kib-repo-dir}/visualize/vega.asciidoc[]
diff --git a/docs/visualize/aggregations.asciidoc b/docs/visualize/aggregations.asciidoc
deleted file mode 100644
index ef38f716f23033..00000000000000
--- a/docs/visualize/aggregations.asciidoc
+++ /dev/null
@@ -1,110 +0,0 @@
-[[supported-aggregations]]
-== Supported aggregations
-
-Use the supported aggregations to build your visualizations.
-
-[float]
-[[visualize-metric-aggregations]]
-=== Metric aggregations
-
-Metric aggregations extract field from documents to generate data values.
-
-{ref}/search-aggregations-metrics-avg-aggregation.html[Average]:: The mean value.
-
-{ref}/search-aggregations-metrics-valuecount-aggregation.html[Count]:: The total number of documents that match the query, which allows you to visualize the number of documents in a bucket. Count is the default value.
-
-{ref}/search-aggregations-metrics-max-aggregation.html[Max]:: The highest value.
-
-{ref}/search-aggregations-metrics-percentile-aggregation.html[Median]:: The value that is in the 50% percentile.
-
-{ref}/search-aggregations-metrics-min-aggregation.html[Min]:: The lowest value.
-
-{ref}/search-aggregations-metrics-percentile-rank-aggregation.html[Percentile ranks]:: Returns the percentile rankings for the values in the specified numeric field. Select a numeric field from the drop-down, then specify one or more percentile rank values in the *Values* fields.
-
-{ref}/search-aggregations-metrics-percentile-aggregation.html[Percentiles]:: Divides the
-values in a numeric field into specified percentile bands. Select a field from the drop-down, then specify one or more ranges in the *Percentiles* fields.
-
-Standard Deviation:: Requires a numeric field. Uses the {ref}/search-aggregations-metrics-extendedstats-aggregation.html[_extended stats_] aggregation.
-
-{ref}/search-aggregations-metrics-sum-aggregation.html[Sum]:: The total value.
-
-{ref}/search-aggregations-metrics-top-hits-aggregation.html[Top hit]:: Returns a sample of individual documents. When the Top Hit aggregation is matched to more than one document, you must choose a technique for combining the values. Techniques include average, minimum, maximum, and sum.
-
-Unique Count:: The {ref}/search-aggregations-metrics-cardinality-aggregation.html[Cardinality] of the field within the bucket.
-
-Alternatively, you can override the field values with a script using JSON input. For example:
-
-[source,shell]
-{ "script" : "doc['grade'].value * 1.2" }
-
-The example implements a {es} {ref}/search-aggregations.html[Script Value Source], which replaces
-the value in the metric. The options available depend on the aggregation you choose.
-
-[float]
-[[visualize-parent-pipeline-aggregations]]
-=== Parent pipeline aggregations
-
-Parent pipeline aggregations assume the bucket aggregations are ordered and are especially useful for time series data. For each parent pipeline aggregation, you must define a bucket aggregation and metric aggregation.
-
-You can also nest these aggregations. For example, if you want to produce a third derivative.
-
-{ref}/search-aggregations-pipeline-bucket-script-aggregation.html[Bucket script]:: Executes a script that performs computations for each bucket that specifies metrics in the parent multi-bucket aggregation.
-
-{ref}/search-aggregations-pipeline-cumulative-sum-aggregation.html[Cumulative sum]:: Calculates the cumulative sum of a specified metric in a parent histogram.
-
-{ref}/search-aggregations-pipeline-derivative-aggregation.html[Derivative]:: Calculates the derivative of specific metrics.
-
-{ref}/search-aggregations-pipeline-movavg-aggregation.html[Moving avg]:: Slides a window across the data and emits the average value of the window.
-
-{ref}/search-aggregations-pipeline-serialdiff-aggregation.html[Serial diff]:: Values in a time series are subtracted from itself at different time lags or periods.
-
-[float]
-[[visualize-sibling-pipeline-aggregations]]
-=== Sibling pipeline aggregations
-
-Sibling pipeline aggregations condense many buckets into one. For each sibling pipeline aggregation, you must define a bucket aggregations and metric aggregation.
-
-{ref}/search-aggregations-pipeline-avg-bucket-aggregation.html[Average bucket]:: Calculates the mean, or average, value of a specified metric in a sibling aggregation.
-
-{ref}/search-aggregations-pipeline-avg-bucket-aggregation.html[Max Bucket]:: Calculates the maximum value of a specified metric in a sibling aggregation.
-
-{ref}/search-aggregations-pipeline-avg-bucket-aggregation.html[Min Bucket]:: Calculates the minimum value of a specified metric in a sibling aggregation.
-
-{ref}/search-aggregations-pipeline-avg-bucket-aggregation.html[Sum Bucket]:: Calculates the sum of the values of a specified metric in a sibling aggregation.
-
-[float]
-[[visualize-bucket-aggregations]]
-=== Bucket aggregations
-
-Bucket aggregations sort documents into buckets, depending on the contents of the document.
-
-{ref}/search-aggregations-bucket-datehistogram-aggregation.html[Date histogram]:: Splits a date field into buckets by interval. If the date field is the primary time field for the index pattern, it chooses an automatic interval for you. Intervals are labeled at the start of the interval, using the date-key returned by {es}. For example, the tooltip for a monthly interval displays the first day of the month.
-
-{ref}/search-aggregations-bucket-daterange-aggregation.html[Date range]:: Reports values that are within a range of dates that you specify. You can specify the ranges for the dates using {ref}/common-options.html#date-math[_date math_] expressions.
-
-{ref}/search-aggregations-bucket-filter-aggregation.html[Filter]:: Each filter creates a bucket of documents. You can specify a filter as a
-<<kuery-query, KQL>> or <<lucene-query, Lucene>> query string.
-
-{ref}/search-aggregations-bucket-geohashgrid-aggregation.html[Geohash]:: Displays points based on a geohash. Supported by data table visualizations and <<maps>>.
-
-{ref}/search-aggregations-bucket-geotilegrid-aggregation.html[Geotile]:: Groups points based on web map tiling. Supported by data table visualizations and <<maps>>.
-
-{ref}/search-aggregations-bucket-histogram-aggregation.html[Histogram]:: Builds from a numeric field.
-
-{ref}/search-aggregations-bucket-iprange-aggregation.html[IPv4 range]:: Specify ranges of IPv4 addresses.
-
-{ref}/search-aggregations-bucket-range-aggregation.html[Range]:: Specify ranges of values for a numeric field.
-
-{ref}/search-aggregations-bucket-significantterms-aggregation.html[Significant terms]:: Returns interesting or unusual occurrences of terms in a set. Supports {es} {ref}/search-aggregations-bucket-terms-aggregation.html#_filtering_values_4[exclude and include patterns].
-
-{ref}/search-aggregations-bucket-terms-aggregation.html[Terms]:: Specify the top or bottom _n_ elements of a given field to display, ordered by count or a custom metric. Supports {es} {ref}/search-aggregations-bucket-terms-aggregation.html#_filtering_values_4[exclude and include patterns].
-
-{kib} filters string fields with only regular expression patterns, and does not filter numeric fields or match with arrays.
-
-For example:
-
-* You want to exclude the metricbeat process from your visualization of top processes: `metricbeat.*`
-* You only want to show processes collecting beats: `.*beat`
-* You want to exclude two specific values, the string `"empty"` and `"none"`: `empty|none`
-
-Patterns are case sensitive.
diff --git a/docs/visualize/for-dashboard.asciidoc b/docs/visualize/for-dashboard.asciidoc
deleted file mode 100644
index 400179e9ceae73..00000000000000
--- a/docs/visualize/for-dashboard.asciidoc
+++ /dev/null
@@ -1,67 +0,0 @@
-[[for-dashboard]]
-== Dashboard tools
-
-Visualize comes with controls and Markdown tools that you can add to dashboards for an interactive experience.
-
-[float]
-[[controls]]
-=== Controls
-experimental[]
-
-The controls tool enables you to add interactive inputs
-on a dashboard.
-
-You can add two types of interactive inputs:
-
-* *Options list* &mdash; Filters content based on one or more specified options. The dropdown menu is dynamically populated with the results of a terms aggregation. For example, use the options list on the sample flight dashboard when you want to filter the data by origin city and destination city.
-
-* *Range slider* &mdash; Filters data within a specified range of numbers. The minimum and maximum values are dynamically populated with the results of a min and max aggregation. For example, use the range slider when you want to filter the sample flight dashboard by a specific average ticket price.
-
-[role="screenshot"]
-image::images/dashboard-controls.png[]
-
-[float]
-[[controls-options]]
-==== Controls options
-
-Configure the settings that apply to the interactive inputs on a dashboard.
-
-. Click *Options*, then configure the following:
-
-* *Update {kib} filters on each change* &mdash; When selected, all interactive inputs create filters that refresh the dashboard. When unselected, {kib} filters are created only when you click *Apply changes*.
-
-* *Use time filter* &mdash; When selected, the aggregations that generate the options list and time range are connected to the <<set-time-filter,time filter>>.
-
-* *Pin filters to global state* &mdash; When selected, all filters created by interacting with the inputs are automatically pinned.
-
-. Click *Update*.
-
-[float]
-[[markdown-widget]]
-=== Markdown
-
-The Markdown tool is a text entry field that accepts GitHub-flavored Markdown text. When you enter the text, the tool populates the results on the dashboard.
-
-Markdown is helpful when you want to include important information, instructions, and images on your dashboard.
-
-For information about GitHub-flavored Markdown text, click *Help*.
-
-For example, when you enter:
-
-[role="screenshot"]
-image::images/markdown_example_1.png[]
-
-The following instructions are displayed:
-
-[role="screenshot"]
-image::images/markdown_example_2.png[]
-
-Or when you enter:
-
-[role="screenshot"]
-image::images/markdown_example_3.png[]
-
-The following image is displayed:
-
-[role="screenshot"]
-image::images/markdown_example_4.png[]
diff --git a/docs/visualize/images/lens_drag_drop.gif b/docs/visualize/images/lens_drag_drop.gif
index ca62115e7ea3a8..1f8580d462702c 100644
Binary files a/docs/visualize/images/lens_drag_drop.gif and b/docs/visualize/images/lens_drag_drop.gif differ
diff --git a/docs/visualize/lens.asciidoc b/docs/visualize/lens.asciidoc
deleted file mode 100644
index 6e51433bca3f6a..00000000000000
--- a/docs/visualize/lens.asciidoc
+++ /dev/null
@@ -1,173 +0,0 @@
-[role="xpack"]
-[[lens]]
-== Lens
-
-beta[]
-
-*Lens* is a simple and fast way to create visualizations of your {es} data. To create visualizations, 
-you drag and drop your data fields onto the visualization builder pane, and *Lens* automatically generates 
-a visualization that best displays your data.
-
-With Lens, you can:
-
-* Use the automatically generated visualization suggestions to change the visualization type.
-
-* Create visualizations with multiple layers and indices.
-
-* Add your visualizations to dashboards and Canvas workpads.
-
-To get started with *Lens*, select a field in the data panel, then drag and drop the field on a highlighted area.
-
-[role="screenshot"]
-image::images/lens_drag_drop.gif[Drag and drop]
-
-You can incorporate many fields into your visualization, and Lens uses heuristics to decide how to apply each one to the visualization.
-
-TIP: Drag-and-drop capabilities are available only when Lens knows how to use the data. If *Lens* is unable to automatically generate a visualization,
-you can still configure the customization options for your visualization.
-
-[float]
-[[apply-lens-filters]]
-==== Change the data panel fields
-
-The fields in the data panel are based on the selected <<index-patterns, index pattern>> and <<set-time-filter,time filter>>. 
-
-To change the index pattern, click it, then select a new one. The fields in the data panel automatically update.
-
-To filter the fields in the data panel:
-
-* Enter the name in *Search field names*.
-
-* Click *Filter by type*, then select the filter. To show all of the fields in the index pattern, deselect *Only show fields with data*.
-
-[float]
-[[view-data-summaries]]
-==== Data summaries
-
-To help you decide exactly the data you want to display, get a quick summary of each field. The summary shows the distribution of values within the selected time range.
-
-To view the field summary information, navigate to the field, then click *i*.
-
-[role="screenshot"]
-image::images/lens_data_info.png[Data summary window]
-
-[float]
-[[change-the-visualization-type]]
-==== Change the visualization type
-
-*Lens* enables you to switch between any supported visualization type at any time.
-
-*Suggestions* are shortcuts to alternate visualizations that *Lens* generates for you.
-
-[role="screenshot"]
-image::images/lens_suggestions.gif[Visualization suggestions]
-
-If you'd like to use a visualization type that is not suggested, click the visualization type,
-then select a new one. 
-
-[role="screenshot"]
-image::images/lens_viz_types.png[]
-
-When there is an exclamation point (!)
-next to a visualization type, Lens is unable to transfer your data, but
-still allows you to make the change.
-
-[float]
-[[customize-operation]]
-==== Change the aggregation and labels
-
-For each visualization, Lens allows some customizations of the data.
-
-. Click *Drop a field here* or the field name in the column.
-
-. Change the options that appear. Options vary depending on the type of field.
-+
-[role="screenshot"]
-image::images/lens_aggregation_labels.png[Quick function options]
-
-[float]
-[[layers]]
-==== Add layers and indices
-
-Area, line, and bar charts allow you to visualize multiple data layers and indices so that you can compare and analyze data from multiple sources.
-
-To add a layer, click *+*, then drag and drop the fields for the new layer. 
-
-[role="screenshot"]
-image::images/lens_layers.png[Add layers]
-
-To view a different index, click it, then select a new one.
-
-[role="screenshot"]
-image::images/lens_index_pattern.png[Add index pattern]
-
-[float]
-[[lens-tutorial]]
-=== Lens tutorial
-
-Ready to create your own visualization with Lens? Use the following tutorial to create a visualization that
-lets you compare sales over time.
-
-[float]
-[[lens-before-begin]]
-==== Before you begin
-
-To start, you'll need to add the <<add-sample-data, sample ecommerce data>>.
-
-[float]
-==== Build the visualization
-
-Drag and drop your data onto the visualization builder pane.
-
-. Select the *kibana_sample_data_ecommerce* index pattern.
-
-. Click image:images/time-filter-calendar.png[], then click *Last 7 days*. 
-+
-The fields in the data panel update.
-
-. Drag and drop the *taxful_total_price* data field to the visualization builder pane.
-+
-[role="screenshot"]
-image::images/lens_tutorial_1.png[Lens tutorial]
-
-To display the average order prices over time, *Lens* automatically added in *order_date* field.
-
-To break down your data, drag the *category.keyword* field to the visualization builder pane. Lens
-knows that you want to show the top categories and compare them across the dates,
-and creates a chart that compares the sales for each of the top three categories:
-
-[role="screenshot"]
-image::images/lens_tutorial_2.png[Lens tutorial]
-
-[float]
-[[customize-lens-visualization]]
-==== Customize your visualization
-
-Make your visualization look exactly how you want with the customization options.
-
-. Click *Average of taxful_total_price*, then change the *Label* to `Sales`.
-+
-[role="screenshot"]
-image::images/lens_tutorial_3.1.png[Lens tutorial]
-
-. Click *Top values of category.keyword*, then change *Number of values* to `10`.
-+
-[role="screenshot"]
-image::images/lens_tutorial_3.2.png[Lens tutorial]
-+
-The visualization updates to show there are only six available categories.
-+
-Look at the *Suggestions*. An area chart is not an option, but for the sales data, a stacked area chart might be the best option.
-
-. To switch the chart type, click *Stacked bar chart* in the column, then click *Stacked area* from the *Select a visualizations* window.
-+
-[role="screenshot"]
-image::images/lens_tutorial_3.png[Lens tutorial]
-
-[float]
-[[lens-tutorial-next-steps]]
-==== Next steps
-
-Now that you've created your visualization, you can add it to a dashboard or Canvas workpad.
-
-For more information, refer to <<dashboard,Dashboard>> or <<canvas,Canvas>>.
diff --git a/docs/visualize/most-frequent.asciidoc b/docs/visualize/most-frequent.asciidoc
deleted file mode 100644
index f716930e7e65c1..00000000000000
--- a/docs/visualize/most-frequent.asciidoc
+++ /dev/null
@@ -1,59 +0,0 @@
-[[most-frequent]]
-== Most frequently used visualizations
-
-The most frequently used visualizations allow you to plot aggregated data from a <<save-open-search, saved search>> or <<index-patterns, index pattern>>.
-
-The most frequently used visualizations include:
-
-* Line, area, and bar charts
-* Pie chart
-* Data table
-* Metric, goal, and gauge
-* Tag cloud
-
-[[metric-chart]]
-
-[float]
-=== Configure your visualization
-
-You configure visualizations using the default editor. Each visualization supports different configurations of the metrics and buckets.
-
-For example, a bar chart allows you to add an x-axis:
-
-[role="screenshot"]
-image::images/add-bucket.png["",height=478]
-
-A common configuration for the x-axis is to use a {es} {ref}/search-aggregations-bucket-datehistogram-aggregation.html[date histogram] aggregation:
-
-[role="screenshot"]
-image::images/visualize-date-histogram.png[]
-
-To see your changes, click *Apply changes* image:images/apply-changes-button.png[]
-
-If it's supported by the visualization, you can add more buckets. In this example we have
-added a
-{es} {ref}/search-aggregations-bucket-terms-aggregation.html[terms] aggregation on the field
-`geo.src` to show the top 5 sources of log traffic.
-
-[role="screenshot"]
-image::images/visualize-date-histogram-split-1.png[]
-
-The new aggregation is added after the first one, so the result shows
-the top 5 sources of traffic per 3 hours. If you want to change the aggregation order, you can do
-so by dragging:
-
-[role="screenshot"]
-image::images/visualize-drag-reorder.png["",width=366]
-
-The visualization
-now shows the top 5 sources of traffic overall, and compares them in 3 hour increments:
-
-[role="screenshot"]
-image::images/visualize-date-histogram-split-2.png[]
-
-For more information about how aggregations are used in visualizations, see <<supported-aggregations, supported aggregations>>.
-
-Each visualization also has its own customization options. Most visualizations allow you to customize the color of a specific series:
-
-[role="screenshot"]
-image::images/color-picker.png[An array of color dots that users can select,height=267]
diff --git a/docs/visualize/tilemap.asciidoc b/docs/visualize/tilemap.asciidoc
deleted file mode 100644
index c889bd0bb6ca07..00000000000000
--- a/docs/visualize/tilemap.asciidoc
+++ /dev/null
@@ -1,27 +0,0 @@
-[[heat-map]]
-== Heat map
-
-Display graphical representations of data where the individual values are represented by colors. Use heat maps when your data set includes categorical data. For example, use a heat map to see the flights of origin countries compared to destination countries using the sample flight data.
-
-[role="screenshot"]
-image::images/visualize_heat_map_example.png[]
-
-[float]
-[[navigate-heatmap]]
-=== Change the color ranges
-
-When only one color displays on the heat map, you might need to change the color ranges.
-
-To specify the number of color ranges:
-
-. Click *Options*.
-
-. Enter the *Number of colors* to display.
-
-To specify custom ranges:
-
-. Click *Options*.
-
-. Select *Use custom ranges*.
-
-. Enter the ranges to display.
diff --git a/docs/visualize/timelion.asciidoc b/docs/visualize/timelion.asciidoc
deleted file mode 100644
index 4869664fab0a4b..00000000000000
--- a/docs/visualize/timelion.asciidoc
+++ /dev/null
@@ -1,547 +0,0 @@
-[[timelion]]
-== Timelion
-
-Timelion is a time series data visualizer that enables you to combine totally
-independent data sources within a single visualization. It's driven by a simple
-expression language you use to retrieve time series data, perform calculations
-to tease out the answers to complex questions, and visualize the results.
-
-For example, Timelion enables you to easily get the answers to questions like:
-
-* <<time-series-intro, What is the real-time percentage of CPU time spent in user space to the results offset by one hour?>>
-* <<mathematical-functions-intro, What does my inbound and outbound network traffic look like?>>
-* <<timelion-conditional-intro, How much memory is my system actually using?>>
-
-[float]
-[[time-series-before-you-begin]]
-=== Before you begin
-
-In this tutorial, you'll use the time series data from https://www.elastic.co/guide/en/beats/metricbeat/current/index.html[Metricbeat]. To ingest the data locally, link:https://www.elastic.co/downloads/beats/metricbeat[download Metricbeat].
-
-[float]
-[[time-series-intro]]
-=== Create time series visualizations
-
-To compare the real-time percentage of CPU time spent in user space to the results offset by one hour, create a time series visualization.
-
-[float]
-[[time-series-define-functions]]
-==== Define the functions
-
-To start tracking the real-time percentage of CPU, enter the following in the *Timelion Expression* field:
-
-[source,text]
-----------------------------------
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct')
-----------------------------------
-
-[role="screenshot"]
-image::images/timelion-create01.png[]
-{nbsp}
-
-[float]
-[[time-series-compare-data]]
-==== Compare the data
-
-To compare the two data sets, add another series with data from the previous hour, separated by a comma:
-
-[source,text]
-----------------------------------
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct'),
-.es(offset=-1h,             <1>
-    index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct')
-----------------------------------
-
-<1> `offset` offsets the data retrieval by a date expression. In this example, `-1h` offsets the data back by one hour.
-
-[role="screenshot"]
-image::images/timelion-create02.png[]
-{nbsp}
-
-[float]
-[[time-series-add-labels]]
-==== Add label names
-
-To easily distinguish between the two data sets, add the label names:
-
-[source,text]
-----------------------------------
-.es(offset=-1h,index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct').label('last hour'),
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct').label('current hour') <1>
-----------------------------------
-
-<1> `.label()` adds custom labels to the visualization.
-
-[role="screenshot"]
-image::images/timelion-create03.png[]
-{nbsp}
-
-[float]
-[[time-series-title]]
-==== Add a title
-
-Add a meaningful title:
-
-[source,text]
-----------------------------------
-.es(offset=-1h,
-    index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct')
-  .label('last hour'),
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct')
-  .label('current hour')
-  .title('CPU usage over time') <1>
-----------------------------------
-
-<1> `.title()` adds a title with a meaningful name. Titles make is easier for unfamiliar users to understand the purpose of the visualization.
-
-[role="screenshot"]
-image::images/timelion-customize01.png[]
-{nbsp}
-
-[float]
-[[time-series-change-chart-type]]
-==== Change the chart type
-
-To differentiate between the current hour data and the last hour data, change the chart type:
-
-[source,text]
-----------------------------------
-.es(offset=-1h,
-    index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct')
-  .label('last hour')
-  .lines(fill=1,width=0.5), <1>
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct')
-  .label('current hour')
-  .title('CPU usage over time')
-----------------------------------
-
-<1> `.lines()` changes the appearance of the chart lines. In this example, `.lines(fill=1,width=0.5)` sets the fill level to `1`, and the border width to `0.5`.
-
-[role="screenshot"]
-image::images/timelion-customize02.png[]
-{nbsp}
-
-[float]
-[[time-series-change-color]]
-==== Change the line colors
-
-To make the current hour data stand out, change the line colors:
-
-[source,text]
-----------------------------------
-.es(offset=-1h,
-    index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct')
-  .label('last hour')
-  .lines(fill=1,width=0.5)
-  .color(gray), <1>
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct')
-  .label('current hour')
-  .title('CPU usage over time')
-  .color(#1E90FF)
-----------------------------------
-
-<1> `.color()` changes the color of the data. Supported color types include standard color names, hexadecimal values, or a color schema for grouped data. In this example, `.color(gray)` represents the last hour, and `.color(#1E90FF)` represents the current hour.
-
-[role="screenshot"]
-image::images/timelion-customize03.png[]
-{nbsp}
-
-[float]
-[[time-series-adjust-legend]]
-==== Make adjustments to the legend
-
-Change the position and style of the legend:
-
-[source,text]
-----------------------------------
-.es(offset=-1h,
-    index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct')
-  .label('last hour')
-  .lines(fill=1,width=0.5)
-  .color(gray),
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='avg:system.cpu.user.pct')
-  .label('current hour')
-  .title('CPU usage over time')
-  .color(#1E90FF)
-  .legend(columns=2, position=nw) <1>
-----------------------------------
-
-<1> `.legend()` sets the position and style of the legend. In this example, `.legend(columns=2, position=nw)` places the legend in the north west position of the visualization with two columns.
-
-[role="screenshot"]
-image::images/timelion-customize04.png[]
-{nbsp}
-
-[float]
-[[mathematical-functions-intro]]
-=== Create visualizations with mathematical functions
-
-To create a visualization for inbound and outbound network traffic, use mathematical functions.
-
-[float]
-[[mathematical-functions-define-functions]]
-==== Define the functions
-
-To start tracking the inbound and outbound network traffic, enter the following in the *Timelion Expression* field:
-
-[source,text]
-----------------------------------
-.es(index=metricbeat*,
-    timefield=@timestamp,
-    metric=max:system.network.in.bytes)
-----------------------------------
-
-[role="screenshot"]
-image::images/timelion-math01.png[]
-{nbsp}
-
-[float]
-[[mathematical-functions-plot-change]]
-==== Plot the rate of change
-
-Change how the data is displayed so that you can easily monitor the inbound traffic:
-
-[source,text]
-----------------------------------
-.es(index=metricbeat*,
-    timefield=@timestamp,
-    metric=max:system.network.in.bytes)
-  .derivative() <1>
-----------------------------------
-
-<1> `.derivative` plots the change in values over time.
-
-[role="screenshot"]
-image::images/timelion-math02.png[]
-{nbsp}
-
-Add a similar calculation for outbound traffic:
-
-[source,text]
-----------------------------------
-.es(index=metricbeat*,
-    timefield=@timestamp,
-    metric=max:system.network.in.bytes)
-  .derivative(),
-.es(index=metricbeat*,
-    timefield=@timestamp,
-    metric=max:system.network.out.bytes)
-  .derivative()
-  .multiply(-1) <1>
-----------------------------------
-
-<1> `.multiply()` multiplies the data series by a number, the result of a data series, or a list of data series. For this example, `.multiply(-1)` converts the outbound network traffic to a negative value since the outbound network traffic is leaving your machine.
-
-[role="screenshot"]
-image::images/timelion-math03.png[]
-{nbsp}
-
-[float]
-[[mathematical-functions-convert-data]]
-==== Change the data metric
-
-To make the visualization easier to analyze, change the data metric from bytes to megabytes:
-
-[source,text]
-----------------------------------
-.es(index=metricbeat*,
-    timefield=@timestamp,
-    metric=max:system.network.in.bytes)
-  .derivative()
-  .divide(1048576),
-.es(index=metricbeat*,
-    timefield=@timestamp,
-    metric=max:system.network.out.bytes)
-  .derivative()
-  .multiply(-1)
-  .divide(1048576) <1>
-----------------------------------
-
-<1> `.divide()` accepts the same input as `.multiply()`, then divides the data series by the defined divisor.
-
-[role="screenshot"]
-image::images/timelion-math04.png[]
-{nbsp}
-
-[float]
-[[mathematical-functions-add-labels]]
-==== Customize and format the visualization
-
-Customize and format the visualization using functions:
-
-[source,text]
-----------------------------------
-.es(index=metricbeat*,
-    timefield=@timestamp,
-    metric=max:system.network.in.bytes)
-  .derivative()
-  .divide(1048576)
-  .lines(fill=2, width=1)
-  .color(green)
-  .label("Inbound traffic")         <1>
-  .title("Network traffic (MB/s)"), <2>
-.es(index=metricbeat*,
-    timefield=@timestamp,
-    metric=max:system.network.out.bytes)
-  .derivative()
-  .multiply(-1)
-  .divide(1048576)
-  .lines(fill=2, width=1)           <3>
-  .color(blue)                      <4>
-  .label("Outbound traffic")
-  .legend(columns=2, position=nw) <5>
-----------------------------------
-
-<1> `.label()` adds custom labels to the visualization.
-<2> `.title()` adds a title with a meaningful name.
-<3> `.lines()` changes the appearance of the chart lines. In this example, `.lines(fill=2, width=1)` sets the fill level to `2`, and the border width to `1`.
-<4> `.color()` changes the color of the data. Supported color types include standard color names, hexadecimal values, or a color schema for grouped data. In this example, `.color(green)` represents the inbound network traffic, and `.color(blue)` represents the outbound network traffic.
-<5> `.legend()` sets the position and style of the legend. For this example, `legend(columns=2, position=nw)` places the legend in the north west position of the visualization with two columns.
-
-[role="screenshot"]
-image::images/timelion-math05.png[]
-{nbsp}
-
-[float]
-[[timelion-conditional-intro]]
-=== Create visualizations with conditional logic and tracking trends
-
-To easily detect outliers and discover patterns over time, modify time series data with conditional logic and create a trend with a moving average.
-
-With Timelion conditional logic, you can use the following operator values to compare your data:
-
-[horizontal]
-`eq`:: equal
-`ne`:: not equal
-`lt`:: less than
-`lte`:: less than or equal to
-`gt`:: greater than
-`gte`:: greater than or equal to
-
-[float]
-[[conditional-define-functions]]
-==== Define the functions
-
-To chart the maximum value of `system.memory.actual.used.bytes`, enter the following in the *Timelion Expression* field:
-
-[source,text]
-----------------------------------
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes')
-----------------------------------
-
-[role="screenshot"]
-image::images/timelion-conditional01.png[]
-{nbsp}
-
-[float]
-[[conditional-track-memory]]
-==== Track used memory
-
-To track the amount of memory used, create two thresholds:
-
-[source,text]
-----------------------------------
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes'),
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes')
-  .if(gt,                             <1>
-      11300000000,                    <2>
-      .es(index=metricbeat-*,
-          timefield='@timestamp',
-          metric='max:system.memory.actual.used.bytes'),
-      null)
-    .label('warning')
-    .color('#FFCC11'),
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes')
-  .if(gt,
-      11375000000,
-      .es(index=metricbeat-*,
-          timefield='@timestamp',
-          metric='max:system.memory.actual.used.bytes'),
-      null)
-  .label('severe')
-  .color('red')
-----------------------------------
-
-<1> Timelion conditional logic for the _greater than_ operator. In this example, the warning threshold is 11.3GB (`11300000000`), and the severe threshold is 11.375GB (`11375000000`). If the threshold values are too high or low for your machine, adjust the values accordingly.
-<2> `if()` compares each point to a number. If the condition evaluates to `true`, adjust the styling. If the condition evaluates to `false`, use the default styling.
-
-[role="screenshot"]
-image::images/timelion-conditional02.png[]
-{nbsp}
-
-[float]
-[[conditional-determine-trend]]
-==== Determine the trend
-
-To determine the trend, create a new data series:
-
-[source,text]
-----------------------------------
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes'),
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes')
-  .if(gt,11300000000,
-      .es(index=metricbeat-*,
-          timefield='@timestamp',
-          metric='max:system.memory.actual.used.bytes'),
-      null)
-      .label('warning')
-      .color('#FFCC11'),
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes')
-  .if(gt,11375000000,
-      .es(index=metricbeat-*,
-          timefield='@timestamp',
-          metric='max:system.memory.actual.used.bytes'),
-      null).
-      label('severe')
-      .color('red'),
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes')
-  .mvavg(10) <1>
-----------------------------------
-
-<1> `mvavg()` calculates the moving average over a specified period of time. In this example, `.mvavg(10)` creates a moving average with a window of 10 data points.
-
-[role="screenshot"]
-image::images/timelion-conditional03.png[]
-{nbsp}
-
-[float]
-[[conditional-format-visualization]]
-==== Customize and format the visualization
-
-Customize and format the visualization using functions:
-
-[source,text]
-----------------------------------
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes')
-  .label('max memory')                    <1>
-  .title('Memory consumption over time'), <2>
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes')
-  .if(gt,
-      11300000000,
-      .es(index=metricbeat-*,
-          timefield='@timestamp',
-          metric='max:system.memory.actual.used.bytes'),
-      null)
-    .label('warning')
-    .color('#FFCC11')                 <3>
-    .lines(width=5),                  <4>
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes')
-  .if(gt,
-      11375000000,
-      .es(index=metricbeat-*,
-          timefield='@timestamp',
-          metric='max:system.memory.actual.used.bytes'),
-      null)
-    .label('severe')
-    .color('red')
-    .lines(width=5),
-.es(index=metricbeat-*,
-    timefield='@timestamp',
-    metric='max:system.memory.actual.used.bytes')
-  .mvavg(10)
-  .label('mvavg')
-  .lines(width=2)
-  .color(#5E5E5E)
-  .legend(columns=4, position=nw)    <5>
-----------------------------------
-
-<1> `.label()` adds custom labels to the visualization.
-<2> `.title()` adds a title with a meaningful name.
-<3> `.color()` changes the color of the data. Supported color types include standard color names, hexadecimal values, or a color schema for grouped data.
-<4> `.lines()` changes the appearance of the chart lines. In this example, .lines(width=5) sets border width to `5`.
-<5> `.legend()` sets the position and style of the legend. For this example, `(columns=4, position=nw)` places the legend in the north west position of the visualization with four columns.
-
-[role="screenshot"]
-image::images/timelion-conditional04.png[]
-{nbsp}
-
-For additional information on Timelion conditional capabilities, go to https://www.elastic.co/blog/timeseries-if-then-else-with-timelion[I have but one .condition()].
-
-[float]
-[[timelion-deprecation]]
-=== Timelion App deprecation
-
-Deprecated since 7.0, the Timelion app will be removed in 8.0. If you have any Timelion worksheets, you must migrate them to a dashboard.
-
-NOTE: Only the Timelion app is deprecated. {kib} continues to support Timelion visualizations on dashboards, in Visualize, and in Canvas. 
-
-[float]
-[[timelion-app-to-vis]]
-==== Create a dashboard from a Timelion worksheet
-
-To replace a Timelion worksheet with a dashboard, follow the same process for adding a visualization. 
-In addition, you must migrate the Timelion graphs to Visualize.
-
-. Open the menu, click **Dashboard**, then click **Create dashboard**.
-
-. On the dashboard, click **Create New**, then select the Timelion visualization.
-+
-[role="screenshot"]
-image::images/timelion-create-new-dashboard.png[]
-+
-The only thing you need is the Timelion expression for each graph.
-
-. Open the Timelion app on a new tab, select the chart you want to copy, and copy its expression.
-+
-[role="screenshot"]
-image::images/timelion-copy-expression.png[]
-
-. Return to the other tab and paste the copied expression to the *Timelion Expression* field and click **Update**.
-+
-[role="screenshot"]
-image::images/timelion-vis-paste-expression.png[]
-
-. Save the new visualization, give it a name, and click **Save and Return**.
-+
-Your Timelion visualization will appear on the dashboard. Repeat this for all your charts on each worksheet.
-+
-[role="screenshot"]
-image::images/timelion-dashboard.png[]
diff --git a/docs/visualize/tsvb.asciidoc b/docs/visualize/tsvb.asciidoc
deleted file mode 100644
index 9a1e81670b6541..00000000000000
--- a/docs/visualize/tsvb.asciidoc
+++ /dev/null
@@ -1,138 +0,0 @@
-[[TSVB]]
-== TSVB
-
-TSVB is a time series data visualizer that allows you to use the full power of the
-Elasticsearch aggregation framework. With TSVB, you can combine an infinite
-number of aggregations to display complex data.
-
-NOTE: In Elasticsearch version 7.3.0 and later, the time series data visualizer is now referred to as TSVB instead of Time Series Visual Builder.
-
-[float]
-[[tsvb-visualization-types]]
-=== Types of TSVB visualizations
-
-TSVB comes with these types of visualizations:
-
-Time Series:: A histogram visualization that supports area, line, bar, and steps along with multiple y-axis.
-
-[role="screenshot"]
-image:images/tsvb-screenshot.png["Time series visualization"]
-
-Metric:: A metric that displays the latest number in a data series.
-
-[role="screenshot"]
-image:images/tsvb-metric.png["Metric visualization"]
-
-Top N:: A horizontal bar chart where the y-axis is based on a series of metrics, and the x-axis is the latest value in the series.
-
-[role="screenshot"]
-image:images/tsvb-top-n.png["Top N visualization"]
-
-Gauge:: A single value gauge visualization based on the latest value in a series.
-
-[role="screenshot"]
-image:images/tsvb-gauge.png["Gauge visualization"]
-
-Markdown:: Edit the data using using Markdown text and Mustache template syntax.
-
-[role="screenshot"]
-image:images/tsvb-markdown.png["Markdown visualization"]
-
-Table:: Display data from multiple time series by defining the field group to show in the rows, and the columns of data to display.
-
-[role="screenshot"]
-image:images/tsvb-table.png["Table visualization"]
-
-[float]
-[[create-tsvb-visualization]]
-=== Create TSVB visualizations
-
-To create a TSVB visualization, choose the data series you want to display, then choose how you want to display the data. The options available are dependent on the visualization.
-
-[float]
-[[tsvb-data-series-options]]
-==== Configure the data series
-
-To create a single metric, add multiple data series with multiple aggregations.
-
-. Select the visualization type.
-
-. Specify the data series labels and colors.
-
-.. Select *Data*.
-+
-If you are using the *Table* visualization, select *Columns*.
-
-.. In the *Label* field, enter a name for the data series, which is used on legends and titles.
-+
-For series that are grouped by a term, you can specify a mustache variable of `{{key}}` to substitute the term.
-
-.. If supported by the visualization, click the swatch and choose a color for the data series.
-
-.. To add another data series, click *+*, then repeat the steps to specify the labels and colors.
-
-. Specify the data series metrics.
-
-.. Select *Metrics*.
-
-.. From the dropdown lists, choose your options.
-
-.. To add another metric, click *+*.
-+
-When you add more than one metric, the last metric value is displayed, which is indicated by the eye icon.
-
-. To specify the format and display options, select *Options*.
-
-. To specify how to group or split the data, choose an option from the *Group by* drop down list.
-+
-By default, the data series are grouped by everything.
-
-[float]
-[[tsvb-panel-options]]
-==== Configure the panel
-
-Change the data that you want to display and choose the style options for the panel.
-
-. Select *Panel options*.
-
-. Under *Data*, specify how much of the data that you want to display in the visualization.
-
-. Under *Style*, specify how you want the visualization to look.
-
-[float]
-[[tsvb-add-annotations]]
-==== Add annotations
-
-If you are using the Time Series visualization, add annotation data sources.
-
-. Select *Annotations*.
-
-. Click *Add data source*, then specify the options.
-
-[float]
-[[tsvb-enter-markdown]]
-==== Enter Markdown text
-
-Edit the source for the Markdown visualization.
-
-. Select *Markdown*.
-
-. In the editor, enter enter your Markdown text, then press Enter.
-
-. To insert the mustache template variable into the editor, click the variable name.
-+
-The http://mustache.github.io/mustache.5.html[mustache syntax] uses the Handlebar.js processor, which is an extended version of the Mustache template language.
-
-[float]
-[[tsvb-style-markdown]]
-==== Style Markdown text
-
-Style your Markdown visualization using http://lesscss.org/features/[less syntax].
-
-. Select *Markdown*.
-
-. Select *Panel options*.
-
-. Enter styling rules in *Custom CSS* section
-+
-Less in TSVB does not support custom plugins or inline JavaScript.
diff --git a/docs/visualize/vega.asciidoc b/docs/visualize/vega.asciidoc
deleted file mode 100644
index b231159e86bdec..00000000000000
--- a/docs/visualize/vega.asciidoc
+++ /dev/null
@@ -1,1639 +0,0 @@
-[[vega-graph]]
-== Vega
-
-Build custom visualizations using Vega and Vega-Lite, backed by one or more
-data sources including {es}, Elastic Map Service, URL,
-or static data. Use the {kib} extensions to Vega to embed Vega into
-your dashboard, and to add interactivity to the visualizations.
-
-Vega and Vega-Lite are both declarative formats to create visualizations
-using JSON. Both use a different syntax for declaring visualizations,
-and are not fully interchangeable.
-
-[float]
-[[when-to-vega]]
-=== When to use Vega
-
-Vega and Vega-Lite are capable of building most of the visualizations
-that {kib} provides, but with higher complexity. The most common reason
-to use Vega in {kib} is that {kib} is missing support for the query or
-visualization, for example:
-
-* Aggregations using the `nested` or `parent/child` mapping
-* Aggregations without a {kib} index pattern
-* Queries using custom time filters
-* Complex calculations
-* Extracting data from _source instead of aggregation
-* Scatter charts
-* Sankey charts
-* Custom maps
-* Using a visual theme that {kib} does not provide
-
-[[vega-lite-tutorial]]
-=== Tutorial: First visualization in Vega-Lite
-
-In this tutorial, you will learn about how to edit Vega-Lite in {kib} to create
-a stacked area chart from an {es} search query. It will give you a starting point
-for a more comprehensive
-https://vega.github.io/vega-lite/tutorials/getting_started.html[introduction to Vega-Lite],
-while only covering the basics.
-
-In this tutorial, you will build a stacked area chart from one of the {kib} sample data
-sets.
-
-[role="screenshot"]
-image::visualize/images/vega_lite_tutorial_1.png[]
-
-Before beginning this tutorial, install the <<add-sample-data, eCommerce sample data>>
-set.
-
-When you first open the Vega editor in {kib}, you will see a pre-populated
-line chart which shows the total number of documents across all your indices
-within the time range.
-
-[role="screenshot"]
-image::visualize/images/vega_lite_default.png[]
-
-The text editor contains a Vega-Lite spec written in https://hjson.github.io/[HJSON],
-which is similar to JSON but optimized for human editing. HJSON supports:
-
-* Comments using // or /* syntax
-* Object keys without quotes
-* String values without quotes
-* Optional commas
-* Double or single quotes
-* Multiline strings
-
-[float]
-==== Small steps
-
-Always work on Vega in the smallest steps possible, and save your work frequently.
-Small changes will cause unexpected results. Click the "Save" button now.
-
-The first step is to change the index to one of the <<add-sample-data, sample data>>
-sets. Change
-
-```yaml
-index: _all
-```
-
-to:
-
-```yaml
-index: kibana_sample_data_ecommerce
-```
-
-Click "Update". The result is probably not what you expect. You should see a flat
-line with 0 results.
-
-You've only changed the index, so the difference must be the query is returning
-no results. You can try the <<vega-browser-debugging-console, Vega debugging process>>,
-but intuition may be faster for this particular problem.
-
-In this case, the problem is that you are querying the field `@timestamp`,
-which does not exist in the `kibana_sample_data_ecommerce` data. Find and replace
-`@timestamp` with `order_date`. This fixes the problem, leaving you with this spec:
-
-.Expand Vega-Lite spec
-[%collapsible%closed]
-====
-[source,yaml]
-----
-{
-  $schema: https://vega.github.io/schema/vega-lite/v4.json
-  title: Event counts from ecommerce
-  data: {
-    url: {
-      %context%: true
-      %timefield%: order_date
-      index: kibana_sample_data_ecommerce
-      body: {
-        aggs: {
-          time_buckets: {
-            date_histogram: {
-              field: order_date
-              interval: {%autointerval%: true}
-              extended_bounds: {
-                min: {%timefilter%: "min"}
-                max: {%timefilter%: "max"}
-              }
-              min_doc_count: 0
-            }
-          }
-        }
-        size: 0
-      }
-    }
-    format: {property: "aggregations.time_buckets.buckets" }
-  }
-
-  mark: line
-
-  encoding: {
-    x: {
-      field: key
-      type: temporal
-      axis: { title: null }
-    }
-    y: {
-      field: doc_count
-      type: quantitative
-      axis: { title: "Document count" }
-    }
-  }
-}
-----
-
-====
-
-Now, let's make the visualization more interesting by adding another aggregation
-to create a stacked area chart. To verify that you have constructed the right
-query, it is easiest to use the {kib} Dev Tools in a separate tab from the
-Vega editor. Open the Dev Tools from the Management section of the navigation.
-
-This query is roughly equivalent to the one that is used in the default
-Vega-Lite spec. Copy it into the Dev Tools:
-
-```js
-POST kibana_sample_data_ecommerce/_search
-{
-  "query": {
-    "range": {
-      "order_date": {
-        "gte": "now-7d"
-      }
-    }
-  },
-  "aggs": {
-    "time_buckets": {
-      "date_histogram": {
-        "field": "order_date",
-        "fixed_interval": "1d",
-        "extended_bounds": {
-          "min": "now-7d"
-        },
-        "min_doc_count": 0
-      }
-    }
-  },
-  "size": 0
-}
-```
-
-There's not enough data to create a stacked bar in the original query, so we
-will add a new
-{ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregation]:
-
-```js
-POST kibana_sample_data_ecommerce/_search
-{
-  "query": {
-    "range": {
-      "order_date": {
-        "gte": "now-7d"
-      }
-    }
-  },
-  "aggs": {
-    "categories": {
-      "terms": { "field": "category.keyword" },
-      "aggs": {
-        "time_buckets": {
-          "date_histogram": {
-            "field": "order_date",
-            "fixed_interval": "1d",
-            "extended_bounds": {
-              "min": "now-7d"
-            },
-            "min_doc_count": 0
-          }
-        }
-      }
-    }
-  },
-  "size": 0
-}
-```
-
-You'll see that the response format looks different from the previous query:
-
-```json
-{
-  "aggregations" : {
-    "categories" : {
-      "doc_count_error_upper_bound" : 0,
-      "sum_other_doc_count" : 0,
-      "buckets" : [{
-        "key" : "Men's Clothing",
-        "doc_count" : 1661,
-        "time_buckets" : {
-          "buckets" : [{
-            "key_as_string" : "2020-06-30T00:00:00.000Z",
-            "key" : 1593475200000,
-            "doc_count" : 19
-          }, {
-            "key_as_string" : "2020-07-01T00:00:00.000Z",
-            "key" : 1593561600000,
-            "doc_count" : 71
-          }]
-        }
-      }]
-    }
-  }
-}
-```
-
-Now that we have data that we're happy with, it's time to convert from an
-isolated {es} query into a query with {kib} integration. Looking at the
-<<vega-queries, reference for writing {es} queries in Vega>>, you will
-see the full list of special tokens that are used in this query, such
-as `%context: true`. This query has also replaced `"fixed_interval": "1d"`
-with `interval: {%autointerval%: true}`. Copy the final query into
-your spec:
-
-```yaml
-  data: {
-    url: {
-      %context%: true
-      %timefield%: order_date
-      index: kibana_sample_data_ecommerce
-      body: {
-        aggs: {
-          categories: {
-            terms: { field: "category.keyword" }
-            aggs: {
-              time_buckets: {
-                date_histogram: {
-                  field: order_date
-                  interval: {%autointerval%: true}
-                  extended_bounds: {
-                    min: {%timefilter%: "min"}
-                    max: {%timefilter%: "max"}
-                  }
-                  min_doc_count: 0
-                }
-              }
-            }
-          }
-        }
-        size: 0
-      }
-    }
-    format: {property: "aggregations.categories.buckets" }
-  }
-```
-
-If you copy and paste that into your Vega-Lite spec, and click "Update",
-you will see a warning saying `Infinite extent for field "key": [Infinity, -Infinity]`.
-Let's use our <<vega-browser-debugging-console, Vega debugging skills>> to understand why.
-
-Vega-Lite generates data using the names `source_0` and `data_0`. `source_0` contains
-the results from the {es} query, and `data_0` contains the visually encoded results
-which are shown in the chart. To debug this problem, you need to compare both.
-
-To look at the source, open the browser dev tools console and type
-`VEGA_DEBUG.view.data('source_0')`. You will see:
-
-```js
-[{
-  doc_count: 454
-  key: "Men's Clothing"
-  time_buckets: {buckets: Array(57)}
-  Symbol(vega_id): 12822
-}, ...]
-```
-
-To compare to the visually encoded data, open the browser dev tools console and type
-`VEGA_DEBUG.view.data('data_0')`. You will see:
-
-```js
-[{
-  doc_count: 454
-  key: NaN
-  time_buckets: {buckets: Array(57)}
-  Symbol(vega_id): 13879
-}]
-```
-
-The issue seems to be that the `key` property is not being converted the right way,
-which makes sense because the `key` is now `Men's Clothing` instead of a timestamp.
-
-To fix this, try updating the `encoding` of your Vega-Lite spec to:
-
-```yaml
-  encoding: {
-    x: {
-      field: time_buckets.buckets.key
-      type: temporal
-      axis: { title: null }
-    }
-    y: {
-      field: time_buckets.buckets.doc_count
-      type: quantitative
-      axis: { title: "Document count" }
-    }
-  }
-```
-
-This will show more errors, and you can inspect `VEGA_DEBUG.view.data('data_0')` to
-understand why. This now shows:
-
-```js
-[{
-  doc_count: 454
-  key: "Men's Clothing"
-  time_buckets: {buckets: Array(57)}
-  time_buckets.buckets.doc_count: undefined
-  time_buckets.buckets.key: null
-  Symbol(vega_id): 14094
-}]
-```
-
-It looks like the problem is that the `time_buckets` inner array is not being
-extracted by Vega. The solution is to use a Vega-lite
-https://vega.github.io/vega-lite/docs/flatten.html[flatten transformation], available in {kib} 7.9 and later.
-If using an older version of Kibana, the flatten transformation is available in Vega
-but not Vega-Lite.
-
-Add this section in between the `data` and `encoding` section:
-
-```yaml
-  transform: [{
-    flatten: ["time_buckets.buckets"]
-  }]
-```
-
-This does not yet produce the results you expect. Inspect the transformed data
-by typing `VEGA_DEBUG.view.data('data_0')` into the console again:
-
-```js
-[{
-  doc_count: 453
-  key: "Men's Clothing"
-  time_bucket.buckets.doc_count: undefined
-  time_buckets: {buckets: Array(57)}
-  time_buckets.buckets: {
-    key_as_string: "2020-06-30T15:00:00.000Z",
-    key: 1593529200000,
-    doc_count: 2
-  }
-  time_buckets.buckets.key: null
-  Symbol(vega_id): 21564
-}]
-```
-
-The debug view shows `undefined` values where you would expect to see numbers, and
-the cause is that there are duplicate names which are confusing Vega-Lite. This can
-be fixed by making this change to the `transform` and `encoding` blocks:
-
-```yaml
-  transform: [{
-    flatten: ["time_buckets.buckets"],
-    as: ["buckets"]
-  }]
-
-  mark: area
-
-  encoding: {
-    x: {
-      field: buckets.key
-      type: temporal
-      axis: { title: null }
-    }
-    y: {
-      field: buckets.doc_count
-      type: quantitative
-      axis: { title: "Document count" }
-    }
-    color: {
-      field: key
-      type: nominal
-    }
-  }
-```
-
-At this point, you have a stacked area chart that shows the top categories,
-but the chart is still missing some common features that we expect from a {kib}
-visualization. Let's add hover states and tooltips next.
-
-Hover states are handled differently in Vega-Lite and Vega. In Vega-Lite this is
-done using a concept called `selection`, which has many permutations that are not
-covered in this tutorial. We will be adding a simple tooltip and hover state.
-
-Because {kib} has enabled the https://vega.github.io/vega-lite/docs/tooltip.html[Vega tooltip plugin],
-tooltips can be defined in several ways:
-
-* Automatic tooltip based on the data, via `{ content: "data" }`
-* Array of fields, like `[{ field: "key", type: "nominal" }]`
-* Defining a custom Javascript object using the `calculate` transform
-
-For the simple tooltip, add this to your encoding:
-
-```yaml
-  encoding: {
-    tooltip: [{
-      field: buckets.key
-      type: temporal
-      title: "Date"
-    }, {
-      field: key
-      type: nominal
-      title: "Category"
-    }, {
-      field: buckets.doc_count
-      type: quantitative
-      title: "Count"
-    }]
-  }
-```
-
-As you hover over the area series in your chart, a multi-line tooltip will
-appear, but it won't indicate the nearest point that it's pointing to. To
-indicate the nearest point, we need to add a second layer.
-
-The first step is to remove the `mark: area` from your visualization.
-Once you've removed the previous mark, add a composite mark at the end of
-the Vega-Lite spec:
-
-```yaml
-  layer: [{
-    mark: area
-  }, {
-    mark: point
-  }]
-```
-
-You'll see that the points are not appearing to line up with the area chart,
-and the reason is that the points are not being stacked. Change your Y encoding
-to this:
-
-```yaml
-    y: {
-      field: buckets.doc_count
-      type: quantitative
-      axis: { title: "Document count" }
-      stack: true
-    }
-```
-
-Now, we will add a `selection` block inside the point mark:
-
-```yaml
-  layer: [{
-    mark: area
-  }, {
-    mark: point
-    
-    selection: {
-      pointhover: {
-        type: single
-        on: mouseover
-        clear: mouseout
-        empty: none
-        fields: ["buckets.key", "key"]
-        nearest: true
-      }
-    }
-
-    encoding: {
-      size: {
-        condition: {
-          selection: pointhover
-          value: 100
-        }
-        value: 5
-      }
-      fill: {
-        condition: {
-          selection: pointhover
-          value: white
-        }
-      }
-    }
-  }]
-```
-
-Now that you've enabled a selection, try moving the mouse around the visualization
-and seeing the points respond to the nearest position:
-
-[role="screenshot"]
-image::visualize/images/vega_lite_tutorial_2.png[]
-
-The final result of this tutorial is this spec:
-
-.Expand final Vega-Lite spec
-[%collapsible%closed]
-====
-[source,yaml]
-----
-{
-  $schema: https://vega.github.io/schema/vega-lite/v4.json
-  title: Event counts from ecommerce
-  data: {
-    url: {
-      %context%: true
-      %timefield%: order_date
-      index: kibana_sample_data_ecommerce
-      body: {
-        aggs: {
-          categories: {
-            terms: { field: "category.keyword" }
-            aggs: {
-              time_buckets: {
-                date_histogram: {
-                  field: order_date
-                  interval: {%autointerval%: true}
-                  extended_bounds: {
-                    min: {%timefilter%: "min"}
-                    max: {%timefilter%: "max"}
-                  }
-                  min_doc_count: 0
-                }
-              }
-            }
-          }
-        }
-        size: 0
-      }
-    }
-    format: {property: "aggregations.categories.buckets" }
-  }
-  
-  transform: [{
-    flatten: ["time_buckets.buckets"]
-    as: ["buckets"]
-  }]
-
-  encoding: {
-    x: {
-      field: buckets.key
-      type: temporal
-      axis: { title: null }
-    }
-    y: {
-      field: buckets.doc_count
-      type: quantitative
-      axis: { title: "Document count" }
-      stack: true
-    }
-    color: {
-      field: key
-      type: nominal
-      title: "Category"
-    }
-    tooltip: [{
-      field: buckets.key
-      type: temporal
-      title: "Date"
-    }, {
-      field: key
-      type: nominal
-      title: "Category"
-    }, {
-      field: buckets.doc_count
-      type: quantitative
-      title: "Count"
-    }]
-  }
-  
-  layer: [{
-    mark: area
-  }, {
-    mark: point
-    
-    selection: {
-      pointhover: {
-        type: single
-        on: mouseover
-        clear: mouseout
-        empty: none
-        fields: ["buckets.key", "key"]
-        nearest: true
-      }
-    }
-
-    encoding: {
-      size: {
-        condition: {
-          selection: pointhover
-          value: 100
-        }
-        value: 5
-      }
-      fill: {
-        condition: {
-          selection: pointhover
-          value: white
-        }
-      }
-    }
-  }]
-}
-----
-
-====
-
-[[vega-tutorial]]
-=== Tutorial: Updating {kib} filters from Vega
-
-In this tutorial you will build an area chart in Vega using an {es} search query,
-and add a click handler and drag handler to update {kib} filters.
-This tutorial is not a full https://vega.github.io/vega/tutorials/[Vega tutorial],
-but will cover the basics of creating Vega visualizations into {kib}.
-
-First, create an almost-blank Vega chart by pasting this into the editor:
-
-```yaml
-{
-  $schema: "https://vega.github.io/schema/vega/v5.json"
-  data: [{
-    name: source_0
-  }]
-  
-  scales: [{
-    name: x
-    type: time
-    range: width
-  }, {
-    name: y
-    type: linear
-    range: height
-  }]
-  
-  axes: [{
-    orient: bottom
-    scale: x
-  }, {
-    orient: left
-    scale: y
-  }]
-  
-  marks: [
-    {
-      type: area
-      from: {
-        data: source_0
-      }
-      encode: {
-        update: {
-        }
-      }
-    }
-  ]
-}
-```
-
-Despite being almost blank, this Vega spec still contains the minimum requirements:
-
-* Data
-* Scales
-* Marks
-* (optional) Axes
-
-Next, add a valid {es} search query in the `data` block:
-
-```yaml
-  data: [
-    {
-      name: source_0
-      url: {
-        %context%: true
-        %timefield%: order_date
-        index: kibana_sample_data_ecommerce
-        body: {
-          aggs: {
-            time_buckets: {
-              date_histogram: {
-                field: order_date
-                fixed_interval: "3h"
-                extended_bounds: {
-                  min: {%timefilter%: "min"}
-                  max: {%timefilter%: "max"}
-                }
-                min_doc_count: 0
-              }
-            }
-          }
-          size: 0
-        }
-      }
-      format: { property: "aggregations.time_buckets.buckets" }
-    }
-  ]
-```
-
-Click "Update", and nothing will change in the visualization. The first step
-is to change the X and Y scales based on the data:
-
-```yaml
-  scales: [{
-    name: x
-    type: time
-    range: width
-    domain: {
-      data: source_0
-      field: key
-    }
-  }, {
-    name: y
-    type: linear
-    range: height
-    domain: {
-      data: source_0
-      field: doc_count
-    }
-  }]
-```
-
-Click "Update", and you will see that the X and Y axes are now showing labels based
-on the real data.
-
-Next, encode the fields `key` and `doc_count` as the X and Y values:
-
-```yaml
-  marks: [
-    {
-      type: area
-      from: {
-        data: source_0
-      }
-      encode: {
-        update: {
-          x: {
-            scale: x
-            field: key
-          }
-          y: {
-            scale: y
-            value: 0
-          }
-          y2: {
-            scale: y
-            field: doc_count
-          }
-        }
-      }
-    }
-  ]
-```
-
-Click "Update" and you will get a basic area chart:
-
-[role="screenshot"]
-image::visualize/images/vega_tutorial_3.png[]
-
-Next, add a new block to the `marks` section. This will show clickable points to filter for a specific
-date:
-
-```yaml
-  {
-    name: point
-    type: symbol
-    style: ["point"]
-    from: {
-      data: source_0
-    }
-    encode: {
-      update: {
-        x: {
-          scale: x
-          field: key
-        }
-        y: {
-          scale: y
-          field: doc_count
-        }
-        size: {
-          value: 100
-        }
-        fill: {
-          value: black
-        }
-      }
-    }
-  }
-```
-
-Next, we will create a Vega signal to make the points clickable. You can access
-the clicked `datum` in the expression used to update. In this case, you want
-clicks on points to add a time filter with the 3-hour interval defined above.
-
-```yaml
-  signals: [
-    {
-      name: point_click
-      on: [{
-        events: {
-          source: scope
-          type: click
-          markname: point
-        }
-        update: '''kibanaSetTimeFilter(datum.key, datum.key + 3 * 60 * 60 * 1000)'''
-      }]
-    }
-  ]
-```
-
-This event is using the {kib} custom function `kibanaSetTimeFilter` to generate a filter that
-gets applied to the entire dashboard on click.
-
-The mouse cursor does not currently indicate that the chart is interactive. Find the `marks` section,
-and update the mark named `point` by adding `cursor: { value: "pointer" }` to
-the `encoding` section like this:
-
-```yaml
-  {
-    name: point
-    type: symbol
-    style: ["point"]
-    from: {
-      data: source_0
-    }
-    encode: {
-      update: {
-        ...
-        cursor: { value: "pointer" }
-      }
-    }
-  }
-```
-
-Next, we will add a drag interaction which will allow the user to narrow into
-a specific time range in the visualization. This will require adding more signals, and
-adding a rectangle overlay:
-
-[role="screenshot"]
-image::visualize/images/vega_tutorial_4.png[]
-
-The first step is to add a new `signal` to track the X position of the cursor:
-
-```yaml
-    {
-      name: currentX
-      value: -1
-      on: [{
-        events: {
-          type: mousemove
-          source: view
-        },
-        update: "clamp(x(), 0, width)"
-      }, {
-        events: {
-          type: mouseout
-          source: view
-        }
-        update: "-1"
-      }]
-    }
-```
-
-Now add a new `mark` to indicate the current cursor position:
-
-```yaml
-    {
-      type: rule
-      interactive: false
-      encode: {
-        update: {
-          y: {value: 0}
-          y2: {signal: "height"}
-          stroke: {value: "gray"}
-          strokeDash: {
-            value: [2, 1]
-          }
-          x: {signal: "max(currentX,0)"}
-          defined: {signal: "currentX > 0"}
-        }
-      }
-    }
-```
-
-Next, add a signal to track the current selected range, which will update
-until the user releases the mouse button or uses the escape key:
-
-
-```yaml
-    {
-      name: selected
-      value: [0, 0]
-      on: [{
-        events: {
-          type: mousedown
-          source: view
-        }
-        update: "[clamp(x(), 0, width), clamp(x(), 0, width)]"
-      }, {
-        events: {
-          type: mousemove
-          source: window
-          consume: true
-          between: [{
-            type: mousedown
-            source: view
-          }, {
-            merge: [{
-              type: mouseup
-              source: window
-            }, {
-              type: keydown
-              source: window
-              filter: "event.key === 'Escape'"
-            }]
-          }]
-        }
-        update: "[selected[0], clamp(x(), 0, width)]"
-      }, {
-        events: {
-          type: keydown
-          source: window
-          filter: "event.key === 'Escape'"
-        }
-        update: "[0, 0]"
-      }]
-    }
-```
-
-Now that there is a signal which tracks the time range from the user, we need to indicate
-the range visually by adding a new mark which only appears conditionally:
-
-```yaml
-    {
-      type: rect
-      name: selectedRect
-      encode: {
-        update: {
-          height: {signal: "height"}
-          fill: {value: "#333"}
-          fillOpacity: {value: 0.2}
-          x: {signal: "selected[0]"}
-          x2: {signal: "selected[1]"}
-          defined: {signal: "selected[0] !== selected[1]"}
-        }
-      }
-    }
-```
-
-Finally, add a new signal which will update the {kib} time filter when the mouse is released while
-dragging:
-
-```yaml
-    {
-      name: applyTimeFilter
-      value: null
-      on: [{
-        events: {
-          type: mouseup
-          source: view
-        }
-        update: '''selected[0] !== selected[1] ? kibanaSetTimeFilter(
-               invert('x',selected[0]),
-               invert('x',selected[1])) : null'''
-      }]
-    }
-```
-
-Putting this all together, your visualization now supports the main features of
-standard visualizations in {kib}, but with the potential to add even more control.
-The final Vega spec for this tutorial is here:
-
-.Expand final Vega spec
-[%collapsible%closed]
-====
-[source,yaml]
-----
-{
-  $schema: "https://vega.github.io/schema/vega/v5.json"
-  data: [
-    {
-      name: source_0
-      url: {
-        %context%: true
-        %timefield%: order_date
-        index: kibana_sample_data_ecommerce
-        body: {
-          aggs: {
-            time_buckets: {
-              date_histogram: {
-                field: order_date
-                fixed_interval: "3h"
-                extended_bounds: {
-                  min: {%timefilter%: "min"}
-                  max: {%timefilter%: "max"}
-                }
-                min_doc_count: 0
-              }
-            }
-          }
-          size: 0
-        }
-      }
-      format: { property: "aggregations.time_buckets.buckets" }
-    }
-  ]
-  
-  scales: [{
-    name: x
-    type: time
-    range: width
-    domain: {
-      data: source_0
-      field: key
-    }
-  }, {
-    name: y
-    type: linear
-    range: height
-    domain: {
-      data: source_0
-      field: doc_count
-    }
-  }]
-  
-  axes: [{
-    orient: bottom
-    scale: x
-  }, {
-    orient: left
-    scale: y
-  }]
-  
-  marks: [
-    {
-      type: area
-      from: {
-        data: source_0
-      }
-      encode: {
-        update: {
-          x: {
-            scale: x
-            field: key
-          }
-          y: {
-            scale: y
-            value: 0
-          }
-          y2: {
-            scale: y
-            field: doc_count
-          }
-        }
-      }
-    },
-    {
-      name: point
-      type: symbol
-      style: ["point"]
-      from: {
-        data: source_0
-      }
-      encode: {
-        update: {
-          x: {
-            scale: x
-            field: key
-          }
-          y: {
-            scale: y
-            field: doc_count
-          }
-          size: {
-            value: 100
-          }
-          fill: {
-            value: black
-          }
-          cursor: { value: "pointer" }
-        }
-      }
-    },
-    {
-      type: rule
-      interactive: false
-      encode: {
-        update: {
-          y: {value: 0}
-          y2: {signal: "height"}
-          stroke: {value: "gray"}
-          strokeDash: {
-            value: [2, 1]
-          }
-          x: {signal: "max(currentX,0)"}
-          defined: {signal: "currentX > 0"}
-        }
-      }
-    },
-    {
-      type: rect
-      name: selectedRect
-      encode: {
-        update: {
-          height: {signal: "height"}
-          fill: {value: "#333"}
-          fillOpacity: {value: 0.2}
-          x: {signal: "selected[0]"}
-          x2: {signal: "selected[1]"}
-          defined: {signal: "selected[0] !== selected[1]"}
-        }
-      }
-    }
-  ]
-  
-  signals: [
-    {
-      name: point_click
-      on: [{
-        events: {
-          source: scope
-          type: click
-          markname: point
-        }
-        update: '''kibanaSetTimeFilter(datum.key, datum.key + 3 * 60 * 60 * 1000)'''
-      }]
-    }
-    {
-      name: currentX
-      value: -1
-      on: [{
-        events: {
-          type: mousemove
-          source: view
-        },
-        update: "clamp(x(), 0, width)"
-      }, {
-        events: {
-          type: mouseout
-          source: view
-        }
-        update: "-1"
-      }]
-    }
-    {
-      name: selected
-      value: [0, 0]
-      on: [{
-        events: {
-          type: mousedown
-          source: view
-        }
-        update: "[clamp(x(), 0, width), clamp(x(), 0, width)]"
-      }, {
-        events: {
-          type: mousemove
-          source: window
-          consume: true
-          between: [{
-            type: mousedown
-            source: view
-          }, {
-            merge: [{
-              type: mouseup
-              source: window
-            }, {
-              type: keydown
-              source: window
-              filter: "event.key === 'Escape'"
-            }]
-          }]
-        }
-        update: "[selected[0], clamp(x(), 0, width)]"
-      }, {
-        events: {
-          type: keydown
-          source: window
-          filter: "event.key === 'Escape'"
-        }
-        update: "[0, 0]"
-      }]
-    }
-    {
-      name: applyTimeFilter
-      value: null
-      on: [{
-        events: {
-          type: mouseup
-          source: view
-        }
-        update: '''selected[0] !== selected[1] ? kibanaSetTimeFilter(
-               invert('x',selected[0]),
-               invert('x',selected[1])) : null'''
-      }]
-    }
-  ]
-}
-
-----
-====
-
-[[vega-reference]]
-=== Reference for {kib} extensions
-
-{kib} has extended Vega and Vega-Lite with extensions that support:
-
-* Default height and width
-* Default theme to match {kib}
-* Writing {es} queries using the time range and filters from dashboards
-* Using the Elastic Map Service in Vega maps
-* Additional tooltip styling
-* Advanced setting to enable URL loading from any domain
-* Limited debugging support using the browser dev tools
-* (Vega only) Expression functions which can update the time range and dashboard filters
-
-[[vega-sizing-and-positioning]]
-==== Default height and width
-
-By default, Vega visualizations use the `autosize = { type: 'fit', contains: 'padding' }` layout.
-`fit` uses all available space, ignores `width` and `height` values,
-and respects the padding values. To override this behavior, change the
-`autosize` value.
-
-[[vega-theme]]
-==== Default theme to match {kib}
-
-{kib} registers a default https://vega.github.io/vega/docs/schemes/[Vega color scheme]
-with the id `elastic`, and sets a default color for each `mark` type.
-Override it by providing a different `stroke`, `fill`, or `color` (Vega-Lite) value.
-
-[[vega-queries]]
-==== Writing {es} queries in Vega
-
-{kib} extends the Vega https://vega.github.io/vega/docs/data/[data] elements
-with support for direct {es} queries specified as a `url`.
-
-Because of this, {kib} is **unable to support dynamically loaded data**,
-which would otherwise work in Vega. All data is fetched before it's passed to
-the Vega renderer.
-
-To define an {es} query in Vega, set the `url` to an object. {kib} will parse
-the object looking for special tokens that allow your query to integrate with {kib}.
-These tokens are:
-
-* `%context%: true`: Set at the top level, and replaces the `query` section with filters from dashboard
-* `%timefield%: <name>`: Set at the top level, integrates the query with the dashboard time filter
-* `{%timefilter%: true}`: Replaced by an {es} range query with upper and lower bounds
-* `{%timefilter%: "min" | "max"}`: Replaced only by the upper or lower bounds
-* `{%timefilter: true, shift: -1, unit: 'hour'}`: Generates a time range query one hour in the past
-* `{%autointerval%: true}`: Replaced by the string which contains the automatic {kib} time interval, such as `1h`
-* `{%autointerval%: 10}`: Replaced by a string which is approximately dividing the time into 10 ranges, allowing
-  you to influence the automatic interval
-* `"%dashboard_context-must_clause%"`: String replaced by object containing filters
-* `"%dashboard_context-filter_clause%"`: String replaced by an object containing filters
-* `"%dashboard_context-must_not_clause%"`: String replaced by an object containing filters
-
-Putting this together, an example query that counts the number of documents in 
-a specific index:
-
-[source,yaml]
-----
-// An object instead of a string for the URL value
-// is treated as a context-aware Elasticsearch query.
-url: {
-  // Specify the time filter.
-  %timefield%: @timestamp
-  // Apply dashboard context filters when set
-  %context%: true
-
-  // Which indexes to search
-  index: kibana_sample_data_logs
-  // The body element may contain "aggs" and "query" keys
-  body: {
-    aggs: {
-      time_buckets: {
-        date_histogram: {
-          // Use date histogram aggregation on @timestamp field
-          field: @timestamp <1>
-          // interval value will depend on the time filter
-          // Use an integer to set approximate bucket count
-          interval: { %autointerval%: true }
-          // Make sure we get an entire range, even if it has no data
-          extended_bounds: {
-            min: { %timefilter%: "min" }
-            max: { %timefilter%: "max" }
-          }
-          // Use this for linear (e.g. line, area) graphs
-          // Without it, empty buckets will not show up
-          min_doc_count: 0
-        }
-      }
-    }
-    // Speed up the response by only including aggregation results
-    size: 0
-  }
-}
-----
-
-<1> `@timestamp` &mdash; Filters the time range and breaks it into histogram
-buckets.
-
-The full result includes the following structure:
-
-[source,yaml]
-----
-{
-  "aggregations": {
-    "time_buckets": {
-      "buckets": [{
-          "key_as_string": "2015-11-30T22:00:00.000Z",
-          "key": 1448920800000,<1>
-          "doc_count": 28
-        }, {
-          "key_as_string": "2015-11-30T23:00:00.000Z",
-          "key": 1448924400000, <1>
-          "doc_count": 330
-        }, ...
-----
-
-<1> `"key"` &mdash; The unix timestamp you can use without conversions by the
-Vega date expressions.
-
-For most visualizations, you only need the list of bucket values. To focus on
-only the data you need, use `format: {property: "aggregations.time_buckets.buckets"}`.
-
-Specify a query with individual range and dashboard context. The query is
-equivalent to `"%context%": true, "%timefield%": "@timestamp"`,
-except that the time range is shifted back by 10 minutes:
-
-[source,yaml]
-----
-{
-  body: {
-    query: {
-      bool: {
-        must: [
-          // This string will be replaced
-          // with the auto-generated "MUST" clause
-          "%dashboard_context-must_clause%"
-          {
-            range: {
-              // apply timefilter (upper right corner)
-              // to the @timestamp variable
-              @timestamp: {
-                // "%timefilter%" will be replaced with
-                // the current values of the time filter
-                // (from the upper right corner)
-                "%timefilter%": true
-                // Only work with %timefilter%
-                // Shift current timefilter by 10 units back
-                shift: 10
-                // week, day (default), hour, minute, second
-                unit: minute
-              }
-            }
-          }
-        ]
-        must_not: [
-          // This string will be replaced with
-          // the auto-generated "MUST-NOT" clause
-          "%dashboard_context-must_not_clause%"
-        ]
-        filter: [
-          // This string will be replaced
-          // with the auto-generated "FILTER" clause
-          "%dashboard_context-filter_clause%"
-        ]
-      }
-    }
-  }
-}
-----
-
-NOTE: When using `"%context%": true` or defining a value for `"%timefield%"` the body cannot contain a query. To customize the query within the VEGA specification (e.g. add an additional filter, or shift the timefilter), define your query and use the placeholders as in the example above. The placeholders will be replaced by the actual context of the dashboard or visualization once parsed.
-
-The `"%timefilter%"` can also be used to specify a single min or max
-value. The date_histogram's `extended_bounds` can be set
-with two values - min and max. Instead of hardcoding a value, you may
-use `"min": {"%timefilter%": "min"}`, which will be replaced with the
-beginning of the current time range. The `shift` and `unit` values are
-also supported. The `"interval"` can also be set dynamically, depending
-on the currently picked range: `"interval": {"%autointerval%": 10}` will
-try to get about 10-15 data points (buckets).
-
-[float]
-[[vega-esmfiles]]
-=== Access Elastic Map Service files
-
-Access the Elastic Map Service files via the same mechanism:
-
-[source,yaml]
-----
-url: {
-  // "type" defaults to "elasticsearch" otherwise
-  type: emsfile
-  // Name of the file, exactly as in the Region map visualization
-  name: World Countries
-}
-// The result is a geojson file, get its features to use
-// this data source with the "shape" marks
-// https://vega.github.io/vega/docs/marks/shape/
-format: {property: "features"}
-----
-
-To enable Maps, the graph must specify `type=map` in the host
-configuration:
-
-[source,yaml]
-----
-{
-  "config": {
-    "kibana": {
-      "type": "map",
-
-      // Initial map position
-      "latitude": 40.7,   // default 0
-      "longitude": -74,   // default 0
-      "zoom": 7,          // default 2
-
-      // defaults to "default". Use false to disable base layer.
-      "mapStyle": false,
-
-      // default 0
-      "minZoom": 5,
-
-      // defaults to the maximum for the given style,
-      // or 25 when base is disabled
-      "maxZoom": 13,
-
-      // defaults to true, shows +/- buttons to zoom in/out
-      "zoomControl": false,
-
-      // Defaults to 'false', disables mouse wheel zoom. If set to
-      // 'true', map may zoom unexpectedly while scrolling dashboard
-      "scrollWheelZoom": false,
-
-      // When false, repaints on each move frame.
-      // Makes the graph slower when moving the map
-      "delayRepaint": true, // default true
-    }
-  },
-  /* the rest of Vega JSON */
-}
-----
-
-The visualization automatically injects a `"projection"`, which you can use to
-calculate the position of all geo-aware marks.
-Additionally, you can use `latitude`, `longitude`, and `zoom` signals.
-These signals can be used in the graph, or can be updated to modify the
-position of the map.
-
-[float]
-[[vega-tooltip]]
-==== Additional tooltip styling
-
-{kib} has installed the https://vega.github.io/vega-lite/docs/tooltip.html[Vega tooltip plugin],
-so tooltips can be defined in the ways documented there. Beyond that, {kib} also supports
-a configuration option for changing the tooltip position and padding:
-
-```js
-{
-  config: {
-    kibana: {
-      tooltips: {
-        position: 'top',
-        padding: 15
-      }
-    }
-  }
-}
-```
-
-[[vega-url-loading]]
-==== Advanced setting to enable URL loading from any domain
-
-Vega can load data from any URL, but this is disabled by default in {kib}. 
-To change this, set `vis_type_vega.enableExternalUrls: true` in `kibana.yml`,
-then restart {kib}.
-
-[[vega-inspector]]
-==== Vega Inspector
-Use the contextual *Inspect* tool to gain insights into different elements. 
-For Vega visualizations, there are two different views: *Request* and *Vega debug*.
-
-===== Inspect Elasticsearch requests
-
-Vega uses the {ref}/search-search.html[{es} search API] to get documents and aggregation 
-results from {es}. To troubleshoot these requests, click *Inspect*, which shows the most recent requests. 
-In case your specification has more than one request, you can switch between the views using the *View* dropdown.
-
-[role="screenshot"]
-image::visualize/images/vega_tutorial_inspect_requests.png[]
-
-===== Vega debugging
-
-With the *Vega debug* view, you can inspect the *Data sets* and *Signal Values* runtime data. 
- 
-The runtime data is read from the 
-https://vega.github.io/vega/docs/api/debugging/#scope[runtime scope]. 
-
-[role="screenshot"]
-image::visualize/images/vega_tutorial_inspect_data_sets.png[]
-
-To debug more complex specs, access to the `view` variable.  For more information, refer to
-the <<vega-browser-debugging-console, Vega browser debugging process>>.
-
-===== Asking for help with a Vega spec
-
-Because of the dynamic nature of the data in {es}, it is hard to help you with 
-Vega specs unless you can share a dataset. To do this, click *Inspect*, select the *Vega debug* view,
-then select the *Spec* tab:
-
-[role="screenshot"]
-image::visualize/images/vega_tutorial_getting_help.png[]
-
-To copy the response, click *Copy to clipboard*. Paste the copied data to 
-https://gist.github.com/[gist.github.com], possibly with a .json extension. Use the [raw] button, 
-and share that when asking for help.
-
-[[vega-browser-debugging-console]]
-==== Browser debugging console
-
-experimental[] Use browser debugging tools (for example, F12 or Ctrl+Shift+J in Chrome) to
-inspect the `VEGA_DEBUG` variable:
-
-* `view` &mdash; Access to the Vega View object. See https://vega.github.io/vega/docs/api/debugging/[Vega Debugging Guide]
-on how to inspect data and signals at runtime. For Vega-Lite,
-`VEGA_DEBUG.view.data('source_0')` gets the pre-transformed data, and `VEGA_DEBUG.view.data('data_0')`
-gets the encoded data. For Vega, it uses the data name as defined in your Vega spec.
-
-* `vega_spec` &mdash; Vega JSON graph specification after some modifications by {kib}. In case
-of Vega-Lite, this is the output of the Vega-Lite compiler.
-
-* `vegalite_spec` &mdash; If this is a Vega-Lite graph, JSON specification of the graph before
-Vega-Lite compilation.
-
-[float]
-[[vega-expression-functions]]
-==== (Vega only) Expression functions which can update the time range and dashboard filters
-
-{kib} has extended the Vega expression language with these functions:
-
-```js
-/**
-  * @param {object} query Elastic Query DSL snippet, as used in the query DSL editor
-  * @param {string} [index] as defined in Kibana, or default if missing
-  */
-kibanaAddFilter(query, index)
-
-/**
-  * @param {object} query Elastic Query DSL snippet, as used in the query DSL editor
-  * @param {string} [index] as defined in Kibana, or default if missing
-  */
-kibanaRemoveFilter(query, index)
-
-kibanaRemoveAllFilters()
-
-/**
-  * Update dashboard time filter to the new values
-  * @param {number|string|Date} start
-  * @param {number|string|Date} end
-  */
-kibanaSetTimeFilter(start, end)
-```
-
-[float]
-[[vega-additional-configuration-options]]
-==== Additional configuration options
-
-[source,yaml]
-----
-{
-  config: {
-    kibana: {
-      // Placement of the Vega-defined signal bindings.
-      // Can be `left`, `right`, `top`, or `bottom` (default).
-      controlsLocation: top
-      // Can be `vertical` or `horizontal` (default).
-      controlsDirection: vertical
-      // If true, hides most of Vega and Vega-Lite warnings
-      hideWarnings: true
-      // Vega renderer to use: `svg` or `canvas` (default)
-      renderer: canvas
-    }
-  }
-}
-----
-
-
-[[vega-notes]]
-[[vega-useful-links]]
-=== Resources and examples
-
-To learn more about Vega and Vega-Lite, refer to the resources and examples.
-
-==== Vega editor
-The https://vega.github.io/editor/[Vega Editor] includes examples for Vega & Vega-Lite, but does not support any
-{kib}-specific features like {es} requests and interactive base maps.
-
-==== Vega-Lite resources
-* https://vega.github.io/vega-lite/tutorials/getting_started.html[Tutorials]
-* https://vega.github.io/vega-lite/docs/[Docs]
-* https://vega.github.io/vega-lite/examples/[Examples]
-
-==== Vega resources
-* https://vega.github.io/vega/tutorials/[Tutorials]
-* https://vega.github.io/vega/docs/[Docs]
-* https://vega.github.io/vega/examples/[Examples]
-
-TIP: When you use the examples in {kib}, you may
-need to modify the "data" section to use absolute URL. For example,
-replace `"url": "data/world-110m.json"` with
-`"url": "https://vega.github.io/editor/data/world-110m.json"`.
diff --git a/examples/alerting_example/tsconfig.json b/examples/alerting_example/tsconfig.json
index fbcec9de439bdb..09c130aca46429 100644
--- a/examples/alerting_example/tsconfig.json
+++ b/examples/alerting_example/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target"
   },
diff --git a/examples/bfetch_explorer/tsconfig.json b/examples/bfetch_explorer/tsconfig.json
index d508076b331990..798a9c222c5ab7 100644
--- a/examples/bfetch_explorer/tsconfig.json
+++ b/examples/bfetch_explorer/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/examples/dashboard_embeddable_examples/tsconfig.json b/examples/dashboard_embeddable_examples/tsconfig.json
index d508076b331990..798a9c222c5ab7 100644
--- a/examples/dashboard_embeddable_examples/tsconfig.json
+++ b/examples/dashboard_embeddable_examples/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/examples/developer_examples/tsconfig.json b/examples/developer_examples/tsconfig.json
index d508076b331990..798a9c222c5ab7 100644
--- a/examples/developer_examples/tsconfig.json
+++ b/examples/developer_examples/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/examples/embeddable_examples/public/book/book_embeddable.tsx b/examples/embeddable_examples/public/book/book_embeddable.tsx
index b033fe86cd1c70..48b81c27e8b8dc 100644
--- a/examples/embeddable_examples/public/book/book_embeddable.tsx
+++ b/examples/embeddable_examples/public/book/book_embeddable.tsx
@@ -71,11 +71,7 @@ export class BookEmbeddable
 
   constructor(
     initialInput: BookEmbeddableInput,
-    private attributeService: AttributeService<
-      BookSavedObjectAttributes,
-      BookByValueInput,
-      BookByReferenceInput
-    >,
+    private attributeService: AttributeService<BookSavedObjectAttributes>,
     {
       parent,
     }: {
@@ -99,18 +95,21 @@ export class BookEmbeddable
     });
   }
 
-  inputIsRefType = (input: BookEmbeddableInput): input is BookByReferenceInput => {
+  readonly inputIsRefType = (input: BookEmbeddableInput): input is BookByReferenceInput => {
     return this.attributeService.inputIsRefType(input);
   };
 
-  getInputAsValueType = async (): Promise<BookByValueInput> => {
+  readonly getInputAsValueType = async (): Promise<BookByValueInput> => {
     const input = this.attributeService.getExplicitInputFromEmbeddable(this);
     return this.attributeService.getInputAsValueType(input);
   };
 
-  getInputAsRefType = async (): Promise<BookByReferenceInput> => {
+  readonly getInputAsRefType = async (): Promise<BookByReferenceInput> => {
     const input = this.attributeService.getExplicitInputFromEmbeddable(this);
-    return this.attributeService.getInputAsRefType(input, { showSaveModal: true });
+    return this.attributeService.getInputAsRefType(input, {
+      showSaveModal: true,
+      saveModalTitle: this.getTitle(),
+    });
   };
 
   public render(node: HTMLElement) {
diff --git a/examples/embeddable_examples/public/book/book_embeddable_factory.tsx b/examples/embeddable_examples/public/book/book_embeddable_factory.tsx
index 4c144c3843c470..292261ee16c59e 100644
--- a/examples/embeddable_examples/public/book/book_embeddable_factory.tsx
+++ b/examples/embeddable_examples/public/book/book_embeddable_factory.tsx
@@ -31,8 +31,6 @@ import {
   BOOK_EMBEDDABLE,
   BookEmbeddableInput,
   BookEmbeddableOutput,
-  BookByValueInput,
-  BookByReferenceInput,
 } from './book_embeddable';
 import { CreateEditBookComponent } from './create_edit_book_component';
 import { OverlayStart } from '../../../../src/core/public';
@@ -66,11 +64,7 @@ export class BookEmbeddableFactoryDefinition
     getIconForSavedObject: () => 'pencil',
   };
 
-  private attributeService?: AttributeService<
-    BookSavedObjectAttributes,
-    BookByValueInput,
-    BookByReferenceInput
-  >;
+  private attributeService?: AttributeService<BookSavedObjectAttributes>;
 
   constructor(private getStartServices: () => Promise<StartServices>) {}
 
@@ -126,9 +120,7 @@ export class BookEmbeddableFactoryDefinition
   private async getAttributeService() {
     if (!this.attributeService) {
       this.attributeService = await (await this.getStartServices()).getAttributeService<
-        BookSavedObjectAttributes,
-        BookByValueInput,
-        BookByReferenceInput
+        BookSavedObjectAttributes
       >(this.type);
     }
     return this.attributeService!;
diff --git a/examples/embeddable_examples/public/book/edit_book_action.tsx b/examples/embeddable_examples/public/book/edit_book_action.tsx
index 5b14dc85b1fc71..3541ace1e5e7e6 100644
--- a/examples/embeddable_examples/public/book/edit_book_action.tsx
+++ b/examples/embeddable_examples/public/book/edit_book_action.tsx
@@ -57,13 +57,13 @@ export const createEditBookAction = (getStartServices: () => Promise<StartServic
     },
     execute: async ({ embeddable }: ActionContext) => {
       const { openModal, getAttributeService } = await getStartServices();
-      const attributeService = getAttributeService<
-        BookSavedObjectAttributes,
-        BookByValueInput,
-        BookByReferenceInput
-      >(BOOK_SAVED_OBJECT);
+      const attributeService = getAttributeService<BookSavedObjectAttributes>(BOOK_SAVED_OBJECT);
       const onSave = async (attributes: BookSavedObjectAttributes, useRefType: boolean) => {
-        const newInput = await attributeService.wrapAttributes(attributes, useRefType, embeddable);
+        const newInput = await attributeService.wrapAttributes(
+          attributes,
+          useRefType,
+          attributeService.getExplicitInputFromEmbeddable(embeddable)
+        );
         if (!useRefType && (embeddable.getInput() as SavedObjectEmbeddableInput).savedObjectId) {
           // Set the saved object ID to null so that update input will remove the existing savedObjectId...
           (newInput as BookByValueInput & { savedObjectId: unknown }).savedObjectId = null;
diff --git a/examples/embeddable_examples/tsconfig.json b/examples/embeddable_examples/tsconfig.json
index 7fa03739119b43..caeed2c1a434fa 100644
--- a/examples/embeddable_examples/tsconfig.json
+++ b/examples/embeddable_examples/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/examples/embeddable_explorer/tsconfig.json b/examples/embeddable_explorer/tsconfig.json
index d508076b331990..798a9c222c5ab7 100644
--- a/examples/embeddable_explorer/tsconfig.json
+++ b/examples/embeddable_explorer/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/examples/routing_example/tsconfig.json b/examples/routing_example/tsconfig.json
index 9bbd9021b2e0a2..761a5c4da65ba9 100644
--- a/examples/routing_example/tsconfig.json
+++ b/examples/routing_example/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/examples/search_examples/tsconfig.json b/examples/search_examples/tsconfig.json
index 8a3ced743d0fa3..8bec69ca40ccc0 100644
--- a/examples/search_examples/tsconfig.json
+++ b/examples/search_examples/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/examples/state_containers_examples/tsconfig.json b/examples/state_containers_examples/tsconfig.json
index 3f43072c2aade0..007322e2d95257 100644
--- a/examples/state_containers_examples/tsconfig.json
+++ b/examples/state_containers_examples/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/examples/ui_action_examples/tsconfig.json b/examples/ui_action_examples/tsconfig.json
index d508076b331990..798a9c222c5ab7 100644
--- a/examples/ui_action_examples/tsconfig.json
+++ b/examples/ui_action_examples/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/examples/ui_actions_explorer/tsconfig.json b/examples/ui_actions_explorer/tsconfig.json
index 199fbe1fcfa269..119209114a7bb8 100644
--- a/examples/ui_actions_explorer/tsconfig.json
+++ b/examples/ui_actions_explorer/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/examples/url_generators_examples/tsconfig.json b/examples/url_generators_examples/tsconfig.json
index 091130487791bd..327b4642a8e7f8 100644
--- a/examples/url_generators_examples/tsconfig.json
+++ b/examples/url_generators_examples/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/examples/url_generators_explorer/tsconfig.json b/examples/url_generators_explorer/tsconfig.json
index 091130487791bd..327b4642a8e7f8 100644
--- a/examples/url_generators_explorer/tsconfig.json
+++ b/examples/url_generators_explorer/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/package.json b/package.json
index b8cf2e1e27774e..ff487510f7a328 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,6 @@
     "test:ftr:server": "node scripts/functional_tests_server",
     "test:ftr:runner": "node scripts/functional_test_runner",
     "test:coverage": "grunt test:coverage",
-    "typespec": "typings-tester --config x-pack/plugins/canvas/public/lib/aeroelastic/tsconfig.json x-pack/plugins/canvas/public/lib/aeroelastic/__fixtures__/typescript/typespec_tests.ts",
     "checkLicenses": "node scripts/check_licenses --dev",
     "build": "node scripts/build --all-platforms",
     "start": "node scripts/kibana --dev",
@@ -66,7 +65,7 @@
     "kbn:watch": "node scripts/kibana --dev --logging.json=false",
     "build:types": "tsc --p tsconfig.types.json",
     "docs:acceptApiChanges": "node --max-old-space-size=6144 scripts/check_published_api_changes.js --accept",
-    "kbn:bootstrap": "node scripts/register_git_hook",
+    "kbn:bootstrap": "node scripts/build_ts_refs && node scripts/register_git_hook",
     "spec_to_console": "node scripts/spec_to_console",
     "backport-skip-ci": "backport --prDescription \"[skip-ci]\"",
     "storybook": "node scripts/storybook",
@@ -93,6 +92,7 @@
     "**/istanbul-instrumenter-loader/schema-utils": "1.0.0",
     "**/image-diff/gm/debug": "^2.6.9",
     "**/load-grunt-config/lodash": "^4.17.20",
+    "**/node-jose/node-forge": "^0.10.0",
     "**/react-dom": "^16.12.0",
     "**/react": "^16.12.0",
     "**/react-test-renderer": "^16.12.0",
@@ -117,7 +117,10 @@
       "**/@types/*/**",
       "**/grunt-*",
       "**/grunt-*/**",
-      "x-pack/typescript"
+      "x-pack/typescript",
+      "@elastic/eui/rehype-react",
+      "@elastic/eui/remark-rehype",
+      "@elastic/eui/remark-rehype/**"
     ]
   },
   "dependencies": {
@@ -125,7 +128,7 @@
     "@babel/register": "^7.10.5",
     "@elastic/datemath": "5.0.3",
     "@elastic/elasticsearch": "7.9.0-rc.2",
-    "@elastic/eui": "27.4.1",
+    "@elastic/eui": "28.2.0",
     "@elastic/good": "8.1.1-kibana2",
     "@elastic/numeral": "^2.5.0",
     "@elastic/request-crypto": "1.1.4",
@@ -142,6 +145,7 @@
     "@kbn/test-subj-selector": "0.2.1",
     "@kbn/ui-framework": "1.0.0",
     "@kbn/ui-shared-deps": "1.0.0",
+    "@types/yauzl": "^2.9.1",
     "JSONStream": "1.3.5",
     "abortcontroller-polyfill": "^1.4.0",
     "accept": "3.0.2",
@@ -188,7 +192,7 @@
     "moment-timezone": "^0.5.27",
     "mustache": "2.3.2",
     "node-fetch": "1.7.3",
-    "node-forge": "^0.9.1",
+    "node-forge": "^0.10.0",
     "opn": "^5.5.0",
     "oppsy": "^2.0.0",
     "p-map": "^4.0.0",
@@ -227,7 +231,7 @@
     "@babel/parser": "^7.11.2",
     "@babel/types": "^7.11.0",
     "@elastic/apm-rum": "^5.5.0",
-    "@elastic/charts": "19.8.1",
+    "@elastic/charts": "21.0.1",
     "@elastic/ems-client": "7.9.3",
     "@elastic/eslint-config-kibana": "0.15.0",
     "@elastic/eslint-plugin-eui": "0.0.2",
@@ -302,7 +306,7 @@
     "@types/moment-timezone": "^0.5.12",
     "@types/mustache": "^0.8.31",
     "@types/node": ">=10.17.17 <10.20.0",
-    "@types/node-forge": "^0.9.0",
+    "@types/node-forge": "^0.9.5",
     "@types/normalize-path": "^3.0.0",
     "@types/opn": "^5.1.0",
     "@types/pegjs": "^0.10.1",
@@ -363,7 +367,6 @@
     "dedent": "^0.7.0",
     "deepmerge": "^4.2.2",
     "delete-empty": "^2.0.0",
-    "elasticsearch-browser": "^16.7.0",
     "enzyme": "^3.11.0",
     "enzyme-adapter-react-16": "^1.15.2",
     "enzyme-adapter-utils": "^1.13.0",
@@ -470,7 +473,6 @@
     "topojson-client": "3.0.0",
     "tree-kill": "^1.2.2",
     "typescript": "4.0.2",
-    "typings-tester": "^0.3.2",
     "ui-select": "0.19.8",
     "vega": "^5.13.0",
     "vega-lite": "^4.13.1",
diff --git a/packages/elastic-datemath/tsconfig.json b/packages/elastic-datemath/tsconfig.json
index 3604f1004cf6c4..cbfe1e80474336 100644
--- a/packages/elastic-datemath/tsconfig.json
+++ b/packages/elastic-datemath/tsconfig.json
@@ -1,6 +1,9 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/packages/elastic-datemath"
+  },
   "include": [
     "index.d.ts"
-  ],
+  ]
 }
diff --git a/packages/eslint-config-kibana/.eslintrc.js b/packages/elastic-eslint-config-kibana/.eslintrc.js
similarity index 100%
rename from packages/eslint-config-kibana/.eslintrc.js
rename to packages/elastic-eslint-config-kibana/.eslintrc.js
diff --git a/packages/eslint-config-kibana/.gitignore b/packages/elastic-eslint-config-kibana/.gitignore
similarity index 100%
rename from packages/eslint-config-kibana/.gitignore
rename to packages/elastic-eslint-config-kibana/.gitignore
diff --git a/packages/eslint-config-kibana/.npmignore b/packages/elastic-eslint-config-kibana/.npmignore
similarity index 100%
rename from packages/eslint-config-kibana/.npmignore
rename to packages/elastic-eslint-config-kibana/.npmignore
diff --git a/packages/elastic-eslint-config-kibana/README.md b/packages/elastic-eslint-config-kibana/README.md
new file mode 100644
index 00000000000000..2049440cd8ff77
--- /dev/null
+++ b/packages/elastic-eslint-config-kibana/README.md
@@ -0,0 +1,31 @@
+# elastic-eslint-config-kibana
+
+The eslint config used by the kibana team
+
+## Usage
+
+To use this eslint config, just install the peer dependencies and reference it 
+in your `.eslintrc`:
+
+```javascript
+{
+  extends: [
+    '@elastic/eslint-config-kibana'
+  ]
+}
+```
+
+## Optional jest config
+
+If the project uses the [jest test runner](https://facebook.github.io/jest/), 
+the `@elastic/eslint-config-kibana/jest` config can be extended as well to use 
+`eslint-plugin-jest` and add settings specific to it:
+
+```javascript
+{
+  extends: [
+    '@elastic/eslint-config-kibana',
+    '@elastic/eslint-config-kibana/jest'
+  ]
+}
+```
diff --git a/packages/eslint-config-kibana/javascript.js b/packages/elastic-eslint-config-kibana/javascript.js
similarity index 100%
rename from packages/eslint-config-kibana/javascript.js
rename to packages/elastic-eslint-config-kibana/javascript.js
diff --git a/packages/eslint-config-kibana/jest.js b/packages/elastic-eslint-config-kibana/jest.js
similarity index 100%
rename from packages/eslint-config-kibana/jest.js
rename to packages/elastic-eslint-config-kibana/jest.js
diff --git a/packages/elastic-eslint-config-kibana/package.json b/packages/elastic-eslint-config-kibana/package.json
new file mode 100644
index 00000000000000..a4bb8d5449ee8f
--- /dev/null
+++ b/packages/elastic-eslint-config-kibana/package.json
@@ -0,0 +1,34 @@
+{
+  "name": "@elastic/eslint-config-kibana",
+  "version": "0.15.0",
+  "description": "The eslint config used by the kibana team",
+  "main": ".eslintrc.js",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/elastic/kibana.git"
+  },
+  "keywords": [],
+  "author": "Spencer Alger <email@spalger.com>",
+  "license": "Apache-2.0",
+  "bugs": {
+    "url": "https://github.com/elastic/kibana/tree/master/packages/elastic-eslint-config-kibana"
+  },
+  "homepage": "https://github.com/elastic/kibana/tree/master/packages/elastic-eslint-config-kibana",
+  "peerDependencies": {
+    "@typescript-eslint/eslint-plugin": "^3.10.0",
+    "@typescript-eslint/parser": "^3.10.0",
+    "babel-eslint": "^10.0.3",
+    "eslint": "^6.8.0",
+    "eslint-plugin-babel": "^5.3.0",
+    "eslint-plugin-ban": "^1.4.0",
+    "eslint-plugin-jsx-a11y": "^6.2.3",
+    "eslint-plugin-eslint-comments": "^3.2.0",
+    "eslint-plugin-import": "^2.19.1",
+    "eslint-plugin-jest": "^23.10.0",
+    "eslint-plugin-mocha": "^6.2.2",
+    "eslint-plugin-no-unsanitized": "^3.0.2",
+    "eslint-plugin-prefer-object-spread": "^1.2.1",
+    "eslint-plugin-react": "^7.17.0",
+    "eslint-plugin-react-hooks": "^4.0.4"
+  }
+}
diff --git a/packages/eslint-config-kibana/react.js b/packages/elastic-eslint-config-kibana/react.js
similarity index 100%
rename from packages/eslint-config-kibana/react.js
rename to packages/elastic-eslint-config-kibana/react.js
diff --git a/packages/eslint-config-kibana/restricted_globals.js b/packages/elastic-eslint-config-kibana/restricted_globals.js
similarity index 100%
rename from packages/eslint-config-kibana/restricted_globals.js
rename to packages/elastic-eslint-config-kibana/restricted_globals.js
diff --git a/packages/eslint-config-kibana/typescript.js b/packages/elastic-eslint-config-kibana/typescript.js
similarity index 98%
rename from packages/eslint-config-kibana/typescript.js
rename to packages/elastic-eslint-config-kibana/typescript.js
index 18b11eb62beef6..d3e80b7448151f 100644
--- a/packages/eslint-config-kibana/typescript.js
+++ b/packages/elastic-eslint-config-kibana/typescript.js
@@ -223,7 +223,8 @@ module.exports = {
           'no-undef-init': 'error',
           'no-unsafe-finally': 'error',
           'no-unsanitized/property': 'error',
-          'no-unused-expressions': 'error',
+          'no-unused-expressions': 'off',
+          '@typescript-eslint/no-unused-expressions': 'error',
           'no-unused-labels': 'error',
           'no-var': 'error',
           'object-shorthand': 'error',
diff --git a/packages/elastic-safer-lodash-set/package.json b/packages/elastic-safer-lodash-set/package.json
index f0f425661f605a..7602f2fa5924fd 100644
--- a/packages/elastic-safer-lodash-set/package.json
+++ b/packages/elastic-safer-lodash-set/package.json
@@ -16,7 +16,7 @@
   "scripts": {
     "lint": "dependency-check --no-dev package.json set.js setWith.js fp/*.js",
     "test": "npm run lint && tape test/*.js && npm run test:types",
-    "test:types": "./scripts/tsd.sh",
+    "test:types": "tsc --noEmit",
     "update": "./scripts/update.sh",
     "save_state": "./scripts/save_state.sh"
   },
@@ -42,8 +42,5 @@
     "ignore": [
       "/lodash/"
     ]
-  },
-  "tsd": {
-    "directory": "test"
   }
 }
diff --git a/packages/elastic-safer-lodash-set/scripts/tsd.sh b/packages/elastic-safer-lodash-set/scripts/tsd.sh
deleted file mode 100755
index 4572367df415df..00000000000000
--- a/packages/elastic-safer-lodash-set/scripts/tsd.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-# Elasticsearch B.V licenses this file to you under the MIT License.
-# See `packages/elastic-safer-lodash-set/LICENSE` for more information.
-
-# tsd will get confused if it finds a tsconfig.json file in the project
-# directory and start to scan the entirety of Kibana. We don't want that.
-mv tsconfig.json tsconfig.tmp
-
-clean_up () {
-  exit_code=$?
-  mv tsconfig.tmp tsconfig.json
-  exit $exit_code
-}
-trap clean_up EXIT
-
-./node_modules/.bin/tsd
diff --git a/packages/elastic-safer-lodash-set/test/fp.test-d.ts b/packages/elastic-safer-lodash-set/test/fp.ts
similarity index 100%
rename from packages/elastic-safer-lodash-set/test/fp.test-d.ts
rename to packages/elastic-safer-lodash-set/test/fp.ts
diff --git a/packages/elastic-safer-lodash-set/test/fp_assoc.test-d.ts b/packages/elastic-safer-lodash-set/test/fp_assoc.ts
similarity index 100%
rename from packages/elastic-safer-lodash-set/test/fp_assoc.test-d.ts
rename to packages/elastic-safer-lodash-set/test/fp_assoc.ts
diff --git a/packages/elastic-safer-lodash-set/test/fp_assocPath.test-d.ts b/packages/elastic-safer-lodash-set/test/fp_assocPath.ts
similarity index 100%
rename from packages/elastic-safer-lodash-set/test/fp_assocPath.test-d.ts
rename to packages/elastic-safer-lodash-set/test/fp_assocPath.ts
diff --git a/packages/elastic-safer-lodash-set/test/fp_set.test-d.ts b/packages/elastic-safer-lodash-set/test/fp_set.ts
similarity index 100%
rename from packages/elastic-safer-lodash-set/test/fp_set.test-d.ts
rename to packages/elastic-safer-lodash-set/test/fp_set.ts
diff --git a/packages/elastic-safer-lodash-set/test/fp_setWith.test-d.ts b/packages/elastic-safer-lodash-set/test/fp_setWith.ts
similarity index 100%
rename from packages/elastic-safer-lodash-set/test/fp_setWith.test-d.ts
rename to packages/elastic-safer-lodash-set/test/fp_setWith.ts
diff --git a/packages/elastic-safer-lodash-set/test/index.test-d.ts b/packages/elastic-safer-lodash-set/test/index.test-d.ts
deleted file mode 100644
index ab29d7de5a03fb..00000000000000
--- a/packages/elastic-safer-lodash-set/test/index.test-d.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Elasticsearch B.V licenses this file to you under the MIT License.
- * See `packages/elastic-safer-lodash-set/LICENSE` for more information.
- */
-
-import { expectType } from 'tsd';
-import { set, setWith } from '../';
-
-const someObj: object = {};
-const anyValue: any = 'any value';
-
-expectType<object>(set(someObj, 'a.b.c', anyValue));
-expectType<object>(
-  setWith(someObj, 'a.b.c', anyValue, (value, key, obj) => {
-    expectType<any>(value);
-    expectType<string>(key);
-    expectType<object>(obj);
-  })
-);
-
-expectType<object>(set(someObj, ['a.b.c'], anyValue));
-expectType<object>(
-  setWith(someObj, ['a.b.c'], anyValue, (value, key, obj) => {
-    expectType<any>(value);
-    expectType<string>(key);
-    expectType<object>(obj);
-  })
-);
-
-expectType<object>(set(someObj, ['a.b.c', 2, Symbol('hep')], anyValue));
-expectType<object>(
-  setWith(someObj, ['a.b.c', 2, Symbol('hep')], anyValue, (value, key, obj) => {
-    expectType<any>(value);
-    expectType<string>(key);
-    expectType<object>(obj);
-  })
-);
diff --git a/packages/elastic-safer-lodash-set/test/index.ts b/packages/elastic-safer-lodash-set/test/index.ts
new file mode 100644
index 00000000000000..2090c1adcfce14
--- /dev/null
+++ b/packages/elastic-safer-lodash-set/test/index.ts
@@ -0,0 +1,37 @@
+/*
+ * Elasticsearch B.V licenses this file to you under the MIT License.
+ * See `packages/elastic-safer-lodash-set/LICENSE` for more information.
+ */
+
+import { expectType } from 'tsd';
+import { set, setWith } from '..';
+
+const someObj: object = {};
+const anyValue: any = 'any value';
+
+expectType<object>(set(someObj, 'a.b.c', anyValue));
+expectType<object>(
+  setWith(someObj, 'a.b.c', anyValue, (value, key, obj) => {
+    expectType<any>(value);
+    expectType<string>(key);
+    expectType<object>(obj);
+  })
+);
+
+expectType<object>(set(someObj, ['a.b.c'], anyValue));
+expectType<object>(
+  setWith(someObj, ['a.b.c'], anyValue, (value, key, obj) => {
+    expectType<any>(value);
+    expectType<string>(key);
+    expectType<object>(obj);
+  })
+);
+
+expectType<object>(set(someObj, ['a.b.c', 2, Symbol('hep')], anyValue));
+expectType<object>(
+  setWith(someObj, ['a.b.c', 2, Symbol('hep')], anyValue, (value, key, obj) => {
+    expectType<any>(value);
+    expectType<string>(key);
+    expectType<object>(obj);
+  })
+);
diff --git a/packages/elastic-safer-lodash-set/test/set.test-d.ts b/packages/elastic-safer-lodash-set/test/set.ts
similarity index 100%
rename from packages/elastic-safer-lodash-set/test/set.test-d.ts
rename to packages/elastic-safer-lodash-set/test/set.ts
diff --git a/packages/elastic-safer-lodash-set/test/setWith.test-d.ts b/packages/elastic-safer-lodash-set/test/setWith.ts
similarity index 100%
rename from packages/elastic-safer-lodash-set/test/setWith.test-d.ts
rename to packages/elastic-safer-lodash-set/test/setWith.ts
diff --git a/packages/elastic-safer-lodash-set/tsconfig.json b/packages/elastic-safer-lodash-set/tsconfig.json
index bc1d1a3a7e413d..6517e5c60ee01a 100644
--- a/packages/elastic-safer-lodash-set/tsconfig.json
+++ b/packages/elastic-safer-lodash-set/tsconfig.json
@@ -1,9 +1,9 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/packages/elastic-safer-lodash-set"
+  },
   "include": [
-    "**/*"
+    "**/*",
   ],
-  "exclude": [
-    "**/*.test-d.ts"
-  ]
 }
diff --git a/packages/eslint-config-kibana/README.md b/packages/eslint-config-kibana/README.md
deleted file mode 100644
index 68c1639b834a5e..00000000000000
--- a/packages/eslint-config-kibana/README.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# eslint-config-kibana
-
-The eslint config used by the kibana team
-
-## Usage
-
-To use this eslint config, just install the peer dependencies and reference it 
-in your `.eslintrc`:
-
-```javascript
-{
-  extends: [
-    '@elastic/eslint-config-kibana'
-  ]
-}
-```
-
-## Optional jest config
-
-If the project uses the [jest test runner](https://facebook.github.io/jest/), 
-the `@elastic/eslint-config-kibana/jest` config can be extended as well to use 
-`eslint-plugin-jest` and add settings specific to it:
-
-```javascript
-{
-  extends: [
-    '@elastic/eslint-config-kibana',
-    '@elastic/eslint-config-kibana/jest'
-  ]
-}
-```
diff --git a/packages/eslint-config-kibana/package.json b/packages/eslint-config-kibana/package.json
deleted file mode 100644
index 4ec3bcdfd7c052..00000000000000
--- a/packages/eslint-config-kibana/package.json
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  "name": "@elastic/eslint-config-kibana",
-  "version": "0.15.0",
-  "description": "The eslint config used by the kibana team",
-  "main": ".eslintrc.js",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/elastic/eslint-config-kibana.git"
-  },
-  "keywords": [],
-  "author": "Spencer Alger <email@spalger.com>",
-  "license": "Apache-2.0",
-  "bugs": {
-    "url": "https://github.com/elastic/kibana/tree/master/packages/eslint-config-kibana"
-  },
-  "homepage": "https://github.com/elastic/kibana/tree/master/packages/eslint-config-kibana",
-  "peerDependencies": {
-    "@typescript-eslint/eslint-plugin": "^3.10.0",
-    "@typescript-eslint/parser": "^3.10.0",
-    "babel-eslint": "^10.0.3",
-    "eslint": "^6.8.0",
-    "eslint-plugin-babel": "^5.3.0",
-    "eslint-plugin-ban": "^1.4.0",
-    "eslint-plugin-jsx-a11y": "^6.2.3",
-    "eslint-plugin-eslint-comments": "^3.2.0",
-    "eslint-plugin-import": "^2.19.1",
-    "eslint-plugin-jest": "^23.10.0",
-    "eslint-plugin-mocha": "^6.2.2",
-    "eslint-plugin-no-unsanitized": "^3.0.2",
-    "eslint-plugin-prefer-object-spread": "^1.2.1",
-    "eslint-plugin-react": "^7.17.0",
-    "eslint-plugin-react-hooks": "^4.0.4"
-  }
-}
diff --git a/packages/kbn-analytics/scripts/build.js b/packages/kbn-analytics/scripts/build.js
index 448d1ca9332f24..0e00a144d0b92c 100644
--- a/packages/kbn-analytics/scripts/build.js
+++ b/packages/kbn-analytics/scripts/build.js
@@ -71,7 +71,6 @@ run(
         proc.run(padRight(10, 'tsc'), {
           cmd: 'tsc',
           args: [
-            '--emitDeclarationOnly',
             ...(flags.watch ? ['--watch', '--preserveWatchOutput', 'true'] : []),
             ...(flags['source-maps'] ? ['--declarationMap', 'true'] : []),
           ],
diff --git a/packages/kbn-analytics/tsconfig.json b/packages/kbn-analytics/tsconfig.json
index fdd9e8281fba88..861e0204a31a28 100644
--- a/packages/kbn-analytics/tsconfig.json
+++ b/packages/kbn-analytics/tsconfig.json
@@ -1,8 +1,9 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "declaration": true,
-    "declarationDir": "./target/types",
+    "emitDeclarationOnly": true,
+    "outDir": "./target/types",
     "stripInternal": true,
     "declarationMap": true,
     "types": [
@@ -11,7 +12,7 @@
     ]
   },
   "include": [
-    "./src/**/*.ts"
+    "src/**/*"
   ],
   "exclude": [
     "target"
diff --git a/packages/kbn-config-schema/tsconfig.json b/packages/kbn-config-schema/tsconfig.json
index f6c61268da17c9..6a268f2e7c0165 100644
--- a/packages/kbn-config-schema/tsconfig.json
+++ b/packages/kbn-config-schema/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "declaration": true,
     "declarationDir": "./target/types",
diff --git a/packages/kbn-dev-utils/tsconfig.json b/packages/kbn-dev-utils/tsconfig.json
index 0ec058eeb8a280..1c6c671d0b7683 100644
--- a/packages/kbn-dev-utils/tsconfig.json
+++ b/packages/kbn-dev-utils/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "target",
     "target": "ES2019",
diff --git a/packages/kbn-es-archiver/src/actions/save.ts b/packages/kbn-es-archiver/src/actions/save.ts
index 2f87cabadee6c5..84a0ce09936d09 100644
--- a/packages/kbn-es-archiver/src/actions/save.ts
+++ b/packages/kbn-es-archiver/src/actions/save.ts
@@ -39,6 +39,7 @@ export async function saveAction({
   dataDir,
   log,
   raw,
+  query,
 }: {
   name: string;
   indices: string | string[];
@@ -46,6 +47,7 @@ export async function saveAction({
   dataDir: string;
   log: ToolingLog;
   raw: boolean;
+  query?: Record<string, any>;
 }) {
   const outputDir = resolve(dataDir, name);
   const stats = createStats(name, log);
@@ -69,7 +71,7 @@ export async function saveAction({
     // export all documents from matching indexes into data.json.gz
     createPromiseFromStreams([
       createListStream(indices),
-      createGenerateDocRecordsStream(client, stats, progress),
+      createGenerateDocRecordsStream({ client, stats, progress, query }),
       ...createFormatArchiveStreams({ gzip: !raw }),
       createWriteStream(resolve(outputDir, `data.json${raw ? '' : '.gz'}`)),
     ] as [Readable, ...Writable[]]),
diff --git a/packages/kbn-es-archiver/src/cli.ts b/packages/kbn-es-archiver/src/cli.ts
index 1745bd862b4344..41abe83c148cdc 100644
--- a/packages/kbn-es-archiver/src/cli.ts
+++ b/packages/kbn-es-archiver/src/cli.ts
@@ -122,8 +122,10 @@ export function runCli() {
       `,
       flags: {
         boolean: ['raw'],
+        string: ['query'],
         help: `
           --raw              don't gzip the archives
+          --query            query object to limit the documents being archived, needs to be properly escaped JSON
         `,
       },
       async run({ flags, esArchiver }) {
@@ -140,7 +142,17 @@ export function runCli() {
           throw createFlagError('--raw does not take a value');
         }
 
-        await esArchiver.save(name, indices, { raw });
+        const query = flags.query;
+        let parsedQuery;
+        if (typeof query === 'string') {
+          try {
+            parsedQuery = JSON.parse(query);
+          } catch (err) {
+            throw createFlagError('--query should be valid JSON');
+          }
+        }
+
+        await esArchiver.save(name, indices, { raw, query: parsedQuery });
       },
     })
     .command({
diff --git a/packages/kbn-es-archiver/src/es_archiver.ts b/packages/kbn-es-archiver/src/es_archiver.ts
index e335652195b863..d61e7d2a422e82 100644
--- a/packages/kbn-es-archiver/src/es_archiver.ts
+++ b/packages/kbn-es-archiver/src/es_archiver.ts
@@ -62,7 +62,11 @@ export class EsArchiver {
    *  @property {Boolean} options.raw - should the archive be raw (unzipped) or not
    *  @return Promise<Stats>
    */
-  async save(name: string, indices: string | string[], { raw = false }: { raw?: boolean } = {}) {
+  async save(
+    name: string,
+    indices: string | string[],
+    { raw = false, query }: { raw?: boolean; query?: Record<string, any> } = {}
+  ) {
     return await saveAction({
       name,
       indices,
@@ -70,6 +74,7 @@ export class EsArchiver {
       client: this.client,
       dataDir: this.dataDir,
       log: this.log,
+      query,
     });
   }
 
diff --git a/packages/kbn-es-archiver/src/lib/docs/__tests__/generate_doc_records_stream.ts b/packages/kbn-es-archiver/src/lib/docs/__tests__/generate_doc_records_stream.ts
index 2214f7ae9f2eae..3c5fc742a6e104 100644
--- a/packages/kbn-es-archiver/src/lib/docs/__tests__/generate_doc_records_stream.ts
+++ b/packages/kbn-es-archiver/src/lib/docs/__tests__/generate_doc_records_stream.ts
@@ -47,7 +47,7 @@ describe('esArchiver: createGenerateDocRecordsStream()', () => {
     const progress = new Progress();
     await createPromiseFromStreams([
       createListStream(['logstash-*']),
-      createGenerateDocRecordsStream(client, stats, progress),
+      createGenerateDocRecordsStream({ client, stats, progress }),
     ]);
 
     expect(progress.getTotal()).to.be(0);
@@ -74,7 +74,7 @@ describe('esArchiver: createGenerateDocRecordsStream()', () => {
     const progress = new Progress();
     await createPromiseFromStreams([
       createListStream(['logstash-*']),
-      createGenerateDocRecordsStream(client, stats, progress),
+      createGenerateDocRecordsStream({ client, stats, progress }),
     ]);
 
     expect(progress.getTotal()).to.be(0);
@@ -115,7 +115,7 @@ describe('esArchiver: createGenerateDocRecordsStream()', () => {
     const progress = new Progress();
     const docRecords = await createPromiseFromStreams([
       createListStream(['index1', 'index2']),
-      createGenerateDocRecordsStream(client, stats, progress),
+      createGenerateDocRecordsStream({ client, stats, progress }),
       createConcatStream([]),
     ]);
 
diff --git a/packages/kbn-es-archiver/src/lib/docs/generate_doc_records_stream.ts b/packages/kbn-es-archiver/src/lib/docs/generate_doc_records_stream.ts
index e255a0abc36c5f..87c166fe275ccc 100644
--- a/packages/kbn-es-archiver/src/lib/docs/generate_doc_records_stream.ts
+++ b/packages/kbn-es-archiver/src/lib/docs/generate_doc_records_stream.ts
@@ -25,7 +25,17 @@ import { Progress } from '../progress';
 const SCROLL_SIZE = 1000;
 const SCROLL_TIMEOUT = '1m';
 
-export function createGenerateDocRecordsStream(client: Client, stats: Stats, progress: Progress) {
+export function createGenerateDocRecordsStream({
+  client,
+  stats,
+  progress,
+  query,
+}: {
+  client: Client;
+  stats: Stats;
+  progress: Progress;
+  query?: Record<string, any>;
+}) {
   return new Transform({
     writableObjectMode: true,
     readableObjectMode: true,
@@ -41,6 +51,9 @@ export function createGenerateDocRecordsStream(client: Client, stats: Stats, pro
               scroll: SCROLL_TIMEOUT,
               size: SCROLL_SIZE,
               _source: true,
+              body: {
+                query,
+              },
               rest_total_hits_as_int: true, // not declared on SearchParams type
             } as SearchParams);
             remainingHits = resp.hits.total;
diff --git a/packages/kbn-es-archiver/src/lib/indices/generate_index_records_stream.ts b/packages/kbn-es-archiver/src/lib/indices/generate_index_records_stream.ts
index b4b98f8ae262c7..07ee1420741c9c 100644
--- a/packages/kbn-es-archiver/src/lib/indices/generate_index_records_stream.ts
+++ b/packages/kbn-es-archiver/src/lib/indices/generate_index_records_stream.ts
@@ -37,6 +37,10 @@ export function createGenerateIndexRecordsStream(client: Client, stats: Stats) {
             '-*.settings.index.uuid',
             '-*.settings.index.version',
             '-*.settings.index.provided_name',
+            '-*.settings.index.frozen',
+            '-*.settings.index.search.throttled',
+            '-*.settings.index.query',
+            '-*.settings.index.routing',
           ],
         })) as Record<string, any>;
 
diff --git a/packages/kbn-es-archiver/src/lib/streams.ts b/packages/kbn-es-archiver/src/lib/streams.ts
deleted file mode 100644
index a90afbe0c4d254..00000000000000
--- a/packages/kbn-es-archiver/src/lib/streams.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export * from '../../../../src/legacy/utils/streams';
diff --git a/src/legacy/utils/streams/concat_stream.test.js b/packages/kbn-es-archiver/src/lib/streams/concat_stream.test.js
similarity index 100%
rename from src/legacy/utils/streams/concat_stream.test.js
rename to packages/kbn-es-archiver/src/lib/streams/concat_stream.test.js
diff --git a/packages/kbn-es-archiver/src/lib/streams/concat_stream.ts b/packages/kbn-es-archiver/src/lib/streams/concat_stream.ts
new file mode 100644
index 00000000000000..03dd894067afc5
--- /dev/null
+++ b/packages/kbn-es-archiver/src/lib/streams/concat_stream.ts
@@ -0,0 +1,41 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createReduceStream } from './reduce_stream';
+
+/**
+ *  Creates a Transform stream that consumes all provided
+ *  values and concatenates them using each values `concat`
+ *  method.
+ *
+ *  Concatenate strings:
+ *    createListStream(['f', 'o', 'o'])
+ *      .pipe(createConcatStream())
+ *      .on('data', console.log)
+ *      // logs "foo"
+ *
+ *  Concatenate values into an array:
+ *    createListStream([1,2,3])
+ *      .pipe(createConcatStream([]))
+ *      .on('data', console.log)
+ *      // logs "[1,2,3]"
+ */
+export function createConcatStream(initial: any) {
+  return createReduceStream((acc, chunk) => acc.concat(chunk), initial);
+}
diff --git a/src/legacy/utils/streams/concat_stream_providers.test.js b/packages/kbn-es-archiver/src/lib/streams/concat_stream_providers.test.js
similarity index 100%
rename from src/legacy/utils/streams/concat_stream_providers.test.js
rename to packages/kbn-es-archiver/src/lib/streams/concat_stream_providers.test.js
diff --git a/packages/kbn-es-archiver/src/lib/streams/concat_stream_providers.ts b/packages/kbn-es-archiver/src/lib/streams/concat_stream_providers.ts
new file mode 100644
index 00000000000000..4794d76cc7f846
--- /dev/null
+++ b/packages/kbn-es-archiver/src/lib/streams/concat_stream_providers.ts
@@ -0,0 +1,60 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { PassThrough, TransformOptions } from 'stream';
+
+/**
+ *  Write the data and errors from a list of stream providers
+ *  to a single stream in order. Stream providers are only
+ *  called right before they will be consumed, and only one
+ *  provider will be active at a time.
+ */
+export function concatStreamProviders(
+  sourceProviders: Array<() => NodeJS.ReadableStream>,
+  options: TransformOptions = {}
+) {
+  const destination = new PassThrough(options);
+  const queue = sourceProviders.slice();
+
+  (function pipeNext() {
+    const provider = queue.shift();
+
+    if (!provider) {
+      return;
+    }
+
+    const source = provider();
+    const isLast = !queue.length;
+
+    // if there are more sources to pipe, hook
+    // into the source completion
+    if (!isLast) {
+      source.once('end', pipeNext);
+    }
+
+    source
+      // proxy errors from the source to the destination
+      .once('error', (error) => destination.emit('error', error))
+      // pipe the source to the destination but only proxy the
+      // end event if this is the last source
+      .pipe(destination, { end: isLast });
+  })();
+
+  return destination;
+}
diff --git a/src/legacy/utils/streams/filter_stream.test.ts b/packages/kbn-es-archiver/src/lib/streams/filter_stream.test.ts
similarity index 100%
rename from src/legacy/utils/streams/filter_stream.test.ts
rename to packages/kbn-es-archiver/src/lib/streams/filter_stream.test.ts
diff --git a/packages/kbn-es-archiver/src/lib/streams/filter_stream.ts b/packages/kbn-es-archiver/src/lib/streams/filter_stream.ts
new file mode 100644
index 00000000000000..738b9d5793d064
--- /dev/null
+++ b/packages/kbn-es-archiver/src/lib/streams/filter_stream.ts
@@ -0,0 +1,33 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Transform } from 'stream';
+
+export function createFilterStream<T>(fn: (obj: T) => boolean) {
+  return new Transform({
+    objectMode: true,
+    async transform(obj, _, done) {
+      const canPushDownStream = fn(obj);
+      if (canPushDownStream) {
+        this.push(obj);
+      }
+      done();
+    },
+  });
+}
diff --git a/src/legacy/utils/streams/index.js b/packages/kbn-es-archiver/src/lib/streams/index.ts
similarity index 100%
rename from src/legacy/utils/streams/index.js
rename to packages/kbn-es-archiver/src/lib/streams/index.ts
diff --git a/src/legacy/utils/streams/intersperse_stream.test.js b/packages/kbn-es-archiver/src/lib/streams/intersperse_stream.test.js
similarity index 100%
rename from src/legacy/utils/streams/intersperse_stream.test.js
rename to packages/kbn-es-archiver/src/lib/streams/intersperse_stream.test.js
diff --git a/packages/kbn-es-archiver/src/lib/streams/intersperse_stream.ts b/packages/kbn-es-archiver/src/lib/streams/intersperse_stream.ts
new file mode 100644
index 00000000000000..eb2e3d3087d4ad
--- /dev/null
+++ b/packages/kbn-es-archiver/src/lib/streams/intersperse_stream.ts
@@ -0,0 +1,61 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Transform } from 'stream';
+
+/**
+ *  Create a Transform stream that receives values in object mode,
+ *  and intersperses a chunk between each object received.
+ *
+ *  This is useful for writing lists:
+ *
+ *    createListStream(['foo', 'bar'])
+ *      .pipe(createIntersperseStream('\n'))
+ *      .pipe(process.stdout) // outputs "foo\nbar"
+ *
+ *  Combine with a concat stream to get "join" like functionality:
+ *
+ *    await createPromiseFromStreams([
+ *      createListStream(['foo', 'bar']),
+ *      createIntersperseStream(' '),
+ *      createConcatStream()
+ *    ]) // produces a single value "foo bar"
+ */
+export function createIntersperseStream(intersperseChunk: any) {
+  let first = true;
+
+  return new Transform({
+    writableObjectMode: true,
+    readableObjectMode: true,
+    transform(chunk, _, callback) {
+      try {
+        if (first) {
+          first = false;
+        } else {
+          this.push(intersperseChunk);
+        }
+
+        this.push(chunk);
+        callback(undefined);
+      } catch (err) {
+        callback(err);
+      }
+    },
+  });
+}
diff --git a/src/legacy/utils/streams/list_stream.test.js b/packages/kbn-es-archiver/src/lib/streams/list_stream.test.js
similarity index 100%
rename from src/legacy/utils/streams/list_stream.test.js
rename to packages/kbn-es-archiver/src/lib/streams/list_stream.test.js
diff --git a/packages/kbn-es-archiver/src/lib/streams/list_stream.ts b/packages/kbn-es-archiver/src/lib/streams/list_stream.ts
new file mode 100644
index 00000000000000..c061b969b3c099
--- /dev/null
+++ b/packages/kbn-es-archiver/src/lib/streams/list_stream.ts
@@ -0,0 +1,41 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Readable } from 'stream';
+
+/**
+ *  Create a Readable stream that provides the items
+ *  from a list as objects to subscribers
+ */
+export function createListStream(items: any | any[] = []) {
+  const queue: any[] = [].concat(items);
+
+  return new Readable({
+    objectMode: true,
+    read(size) {
+      queue.splice(0, size).forEach((item) => {
+        this.push(item);
+      });
+
+      if (!queue.length) {
+        this.push(null);
+      }
+    },
+  });
+}
diff --git a/src/legacy/utils/streams/map_stream.test.js b/packages/kbn-es-archiver/src/lib/streams/map_stream.test.js
similarity index 100%
rename from src/legacy/utils/streams/map_stream.test.js
rename to packages/kbn-es-archiver/src/lib/streams/map_stream.test.js
diff --git a/packages/kbn-es-archiver/src/lib/streams/map_stream.ts b/packages/kbn-es-archiver/src/lib/streams/map_stream.ts
new file mode 100644
index 00000000000000..e88c512a386535
--- /dev/null
+++ b/packages/kbn-es-archiver/src/lib/streams/map_stream.ts
@@ -0,0 +1,36 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Transform } from 'stream';
+
+export function createMapStream<T = any>(fn: (chunk: any, i: number) => T | Promise<T>) {
+  let i = 0;
+
+  return new Transform({
+    objectMode: true,
+    async transform(value, _, done) {
+      try {
+        this.push(await fn(value, i++));
+        done();
+      } catch (err) {
+        done(err);
+      }
+    },
+  });
+}
diff --git a/src/legacy/utils/streams/promise_from_streams.test.js b/packages/kbn-es-archiver/src/lib/streams/promise_from_streams.test.js
similarity index 100%
rename from src/legacy/utils/streams/promise_from_streams.test.js
rename to packages/kbn-es-archiver/src/lib/streams/promise_from_streams.test.js
diff --git a/packages/kbn-es-archiver/src/lib/streams/promise_from_streams.ts b/packages/kbn-es-archiver/src/lib/streams/promise_from_streams.ts
new file mode 100644
index 00000000000000..fefb18be147805
--- /dev/null
+++ b/packages/kbn-es-archiver/src/lib/streams/promise_from_streams.ts
@@ -0,0 +1,64 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ *  Take an array of streams, pipe the output
+ *  from each one into the next, listening for
+ *  errors from any of the streams, and then resolve
+ *  the promise once the final stream has finished
+ *  writing/reading.
+ *
+ *  If the last stream is readable, it's final value
+ *  will be provided as the promise value.
+ *
+ *  Errors emitted from any stream will cause
+ *  the promise to be rejected with that error.
+ */
+
+import { pipeline, Writable } from 'stream';
+import { promisify } from 'util';
+
+const asyncPipeline = promisify(pipeline);
+
+export async function createPromiseFromStreams<T = any>(streams: any): Promise<T> {
+  let finalChunk: any;
+  const last = streams[streams.length - 1];
+  if (typeof last.read !== 'function' && streams.length === 1) {
+    // For a nicer error than what stream.pipeline throws
+    throw new Error('A minimum of 2 streams is required when a non-readable stream is given');
+  }
+  if (typeof last.read === 'function') {
+    // We are pushing a writable stream to capture the last chunk
+    streams.push(
+      new Writable({
+        // Use object mode even when "last" stream isn't. This allows to
+        // capture the last chunk as-is.
+        objectMode: true,
+        write(chunk, _, done) {
+          finalChunk = chunk;
+          done();
+        },
+      })
+    );
+  }
+
+  await asyncPipeline(...(streams as [any]));
+
+  return finalChunk;
+}
diff --git a/src/legacy/utils/streams/reduce_stream.test.js b/packages/kbn-es-archiver/src/lib/streams/reduce_stream.test.js
similarity index 100%
rename from src/legacy/utils/streams/reduce_stream.test.js
rename to packages/kbn-es-archiver/src/lib/streams/reduce_stream.test.js
diff --git a/packages/kbn-es-archiver/src/lib/streams/reduce_stream.ts b/packages/kbn-es-archiver/src/lib/streams/reduce_stream.ts
new file mode 100644
index 00000000000000..d9458e9a11c33a
--- /dev/null
+++ b/packages/kbn-es-archiver/src/lib/streams/reduce_stream.ts
@@ -0,0 +1,77 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Transform } from 'stream';
+
+/**
+ *  Create a transform stream that consumes each chunk it receives
+ *  and passes it to the reducer, which will return the new value
+ *  for the stream. Once all chunks have been received the reduce
+ *  stream provides the result of final call to the reducer to
+ *  subscribers.
+ */
+export function createReduceStream(
+  reducer: (acc: any, chunk: any, env: string) => any,
+  initial: any
+) {
+  let i = -1;
+  let value = initial;
+
+  // if the reducer throws an error then the value is
+  // considered invalid and the stream will never provide
+  // it to subscribers. We will also stop calling the
+  // reducer for any new data that is provided to us
+  let failed = false;
+
+  if (typeof reducer !== 'function') {
+    throw new TypeError('reducer must be a function');
+  }
+
+  return new Transform({
+    readableObjectMode: true,
+    writableObjectMode: true,
+    async transform(chunk, enc, callback) {
+      try {
+        if (failed) {
+          return callback();
+        }
+
+        i += 1;
+        if (i === 0 && initial === undefined) {
+          value = chunk;
+        } else {
+          value = await reducer(value, chunk, enc);
+        }
+
+        callback();
+      } catch (err) {
+        failed = true;
+        callback(err);
+      }
+    },
+
+    flush(callback) {
+      if (!failed) {
+        this.push(value);
+      }
+
+      callback();
+    },
+  });
+}
diff --git a/src/legacy/utils/streams/replace_stream.test.js b/packages/kbn-es-archiver/src/lib/streams/replace_stream.test.js
similarity index 100%
rename from src/legacy/utils/streams/replace_stream.test.js
rename to packages/kbn-es-archiver/src/lib/streams/replace_stream.test.js
diff --git a/packages/kbn-es-archiver/src/lib/streams/replace_stream.ts b/packages/kbn-es-archiver/src/lib/streams/replace_stream.ts
new file mode 100644
index 00000000000000..fe2ba1fcdf31c9
--- /dev/null
+++ b/packages/kbn-es-archiver/src/lib/streams/replace_stream.ts
@@ -0,0 +1,84 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Transform } from 'stream';
+
+export function createReplaceStream(toReplace: string, replacement: string) {
+  if (typeof toReplace !== 'string') {
+    throw new TypeError('toReplace must be a string');
+  }
+
+  let buffer = Buffer.alloc(0);
+  return new Transform({
+    objectMode: false,
+    async transform(value, _, done) {
+      try {
+        buffer = Buffer.concat([buffer, value], buffer.length + value.length);
+
+        while (true) {
+          // try to find the next instance of `toReplace` in buffer
+          const index = buffer.indexOf(toReplace);
+
+          // if there is no next instance, break
+          if (index === -1) {
+            break;
+          }
+
+          // flush everything to the left of the next instance
+          // of `toReplace`
+          this.push(buffer.slice(0, index));
+
+          // then flush an instance of `replacement`
+          this.push(replacement);
+
+          // and finally update the buffer to include everything
+          // to the right of `toReplace`, dropping to replace from the buffer
+          buffer = buffer.slice(index + toReplace.length);
+        }
+
+        // until now we have only flushed data that is to the left
+        // of a discovered instance of `toReplace`. If `toReplace` is
+        // never found this would lead to us buffering the entire stream.
+        //
+        // Instead, we only keep enough buffer to complete a potentially
+        // partial instance of `toReplace`
+        if (buffer.length > toReplace.length) {
+          // the entire buffer except the last `toReplace.length` bytes
+          // so that if all but one byte from `toReplace` is in the buffer,
+          // and the next chunk delivers the necessary byte, the buffer will then
+          // contain a complete `toReplace` token.
+          this.push(buffer.slice(0, buffer.length - toReplace.length));
+          buffer = buffer.slice(-toReplace.length);
+        }
+
+        done();
+      } catch (err) {
+        done(err);
+      }
+    },
+
+    flush(callback) {
+      if (buffer.length) {
+        this.push(buffer);
+      }
+
+      callback();
+    },
+  });
+}
diff --git a/src/legacy/utils/streams/split_stream.test.js b/packages/kbn-es-archiver/src/lib/streams/split_stream.test.js
similarity index 100%
rename from src/legacy/utils/streams/split_stream.test.js
rename to packages/kbn-es-archiver/src/lib/streams/split_stream.test.js
diff --git a/packages/kbn-es-archiver/src/lib/streams/split_stream.ts b/packages/kbn-es-archiver/src/lib/streams/split_stream.ts
new file mode 100644
index 00000000000000..1c9b59449bd927
--- /dev/null
+++ b/packages/kbn-es-archiver/src/lib/streams/split_stream.ts
@@ -0,0 +1,71 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Transform } from 'stream';
+
+/**
+ *  Creates a Transform stream that consumes a stream of Buffers
+ *  and produces a stream of strings (in object mode) by splitting
+ *  the received bytes using the splitChunk.
+ *
+ *  Ways this is behaves like String#split:
+ *    - instances of splitChunk are removed from the input
+ *    - splitChunk can be on any size
+ *    - if there are no bytes found after the last splitChunk
+ *      a final empty chunk is emitted
+ *
+ *  Ways this deviates from String#split:
+ *    - splitChunk cannot be a regexp
+ *    - an empty string or Buffer will not produce a stream of individual
+ *      bytes like `string.split('')` would
+ */
+export function createSplitStream(splitChunk: string) {
+  let unsplitBuffer = Buffer.alloc(0);
+
+  return new Transform({
+    writableObjectMode: false,
+    readableObjectMode: true,
+    transform(chunk, _, callback) {
+      try {
+        let i;
+        let toSplit = Buffer.concat([unsplitBuffer, chunk]);
+        while ((i = toSplit.indexOf(splitChunk)) !== -1) {
+          const slice = toSplit.slice(0, i);
+          toSplit = toSplit.slice(i + splitChunk.length);
+          this.push(slice.toString('utf8'));
+        }
+
+        unsplitBuffer = toSplit;
+        callback(undefined);
+      } catch (err) {
+        callback(err);
+      }
+    },
+
+    flush(callback) {
+      try {
+        this.push(unsplitBuffer.toString('utf8'));
+
+        callback(undefined);
+      } catch (err) {
+        callback(err);
+      }
+    },
+  });
+}
diff --git a/packages/kbn-es-archiver/tsconfig.json b/packages/kbn-es-archiver/tsconfig.json
index 6ffa64d91fba0f..02209a29e58171 100644
--- a/packages/kbn-es-archiver/tsconfig.json
+++ b/packages/kbn-es-archiver/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "declaration": true,
diff --git a/packages/kbn-es/tsconfig.json b/packages/kbn-es/tsconfig.json
index 6bb61453c99e75..9487a282326845 100644
--- a/packages/kbn-es/tsconfig.json
+++ b/packages/kbn-es/tsconfig.json
@@ -1,6 +1,9 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/packages/kbn-es"
+  },
   "include": [
-    "src/**/*.ts"
+    "src/**/*"
   ]
 }
diff --git a/packages/kbn-eslint-import-resolver-kibana/lib/get_webpack_config.js b/packages/kbn-eslint-import-resolver-kibana/lib/get_webpack_config.js
index d4e234e3a6a2ee..60a03ae8a104e5 100755
--- a/packages/kbn-eslint-import-resolver-kibana/lib/get_webpack_config.js
+++ b/packages/kbn-eslint-import-resolver-kibana/lib/get_webpack_config.js
@@ -27,11 +27,7 @@ exports.getWebpackConfig = function (kibanaPath) {
       mainFields: ['browser', 'main'],
       modules: ['node_modules', resolve(kibanaPath, 'node_modules')],
       alias: {
-        // Kibana defaults https://github.com/elastic/kibana/blob/6998f074542e8c7b32955db159d15661aca253d7/src/legacy/ui/ui_bundler_env.js#L30-L36
-        ui: resolve(kibanaPath, 'src/legacy/ui/public'),
-
         // Dev defaults for test bundle https://github.com/elastic/kibana/blob/6998f074542e8c7b32955db159d15661aca253d7/src/core_plugins/tests_bundle/index.js#L73-L78
-        ng_mock$: resolve(kibanaPath, 'src/test_utils/public/ng_mock'),
         fixtures: resolve(kibanaPath, 'src/fixtures'),
         test_utils: resolve(kibanaPath, 'src/test_utils/public'),
       },
diff --git a/packages/kbn-expect/tsconfig.json b/packages/kbn-expect/tsconfig.json
index a09ae2d7ae6415..ae7e9ff090cc28 100644
--- a/packages/kbn-expect/tsconfig.json
+++ b/packages/kbn-expect/tsconfig.json
@@ -1,5 +1,8 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/packages/kbn-expect"
+  },
   "include": [
     "expect.js.d.ts"
   ]
diff --git a/packages/kbn-i18n/scripts/build.js b/packages/kbn-i18n/scripts/build.js
index 62e1a35f003994..1d2b5031e37d74 100644
--- a/packages/kbn-i18n/scripts/build.js
+++ b/packages/kbn-i18n/scripts/build.js
@@ -71,7 +71,6 @@ run(
         proc.run(padRight(10, 'tsc'), {
           cmd: 'tsc',
           args: [
-            '--emitDeclarationOnly',
             ...(flags.watch ? ['--watch', '--preserveWatchOutput', 'true'] : []),
             ...(flags['source-maps'] ? ['--declarationMap', 'true'] : []),
           ],
diff --git a/packages/kbn-i18n/tsconfig.json b/packages/kbn-i18n/tsconfig.json
index d3dae3078c1d7d..c6380f1cde9697 100644
--- a/packages/kbn-i18n/tsconfig.json
+++ b/packages/kbn-i18n/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "include": [
     "src/**/*.ts",
     "src/**/*.tsx",
@@ -11,7 +11,8 @@
   ],
   "compilerOptions": {
     "declaration": true,
-    "declarationDir": "./target/types",
+    "emitDeclarationOnly": true,
+    "outDir": "./target/types",
     "types": [
       "jest",
       "node"
diff --git a/packages/kbn-interpreter/tsconfig.json b/packages/kbn-interpreter/tsconfig.json
index 63376a7ca1ae8b..3b81bbb118a55e 100644
--- a/packages/kbn-interpreter/tsconfig.json
+++ b/packages/kbn-interpreter/tsconfig.json
@@ -1,4 +1,7 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/packages/kbn-interpreter"
+  },
   "include": ["index.d.ts", "src/**/*.d.ts"]
 }
diff --git a/packages/kbn-monaco/tsconfig.json b/packages/kbn-monaco/tsconfig.json
index 95acfd32b24dd3..6d3f433c6a6d10 100644
--- a/packages/kbn-monaco/tsconfig.json
+++ b/packages/kbn-monaco/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "declaration": true,
diff --git a/packages/kbn-optimizer/src/worker/webpack.config.ts b/packages/kbn-optimizer/src/worker/webpack.config.ts
index 6b07384910abbb..9f2c5654a8bd40 100644
--- a/packages/kbn-optimizer/src/worker/webpack.config.ts
+++ b/packages/kbn-optimizer/src/worker/webpack.config.ts
@@ -79,7 +79,6 @@ export function getWebpackConfig(bundle: Bundle, bundleRefs: BundleRefs, worker:
       // or which have require() statements that should be ignored because the file is
       // already bundled with all its necessary depedencies
       noParse: [
-        /[\/\\]node_modules[\/\\]elasticsearch-browser[\/\\]/,
         /[\/\\]node_modules[\/\\]lodash[\/\\]index\.js$/,
         /[\/\\]node_modules[\/\\]vega[\/\\]build[\/\\]vega\.js$/,
       ],
diff --git a/packages/kbn-optimizer/tsconfig.json b/packages/kbn-optimizer/tsconfig.json
index e2994f4d024149..20b06b5658cbcb 100644
--- a/packages/kbn-optimizer/tsconfig.json
+++ b/packages/kbn-optimizer/tsconfig.json
@@ -1,5 +1,8 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/packages/kbn-optimizer"
+  },
   "include": [
     "index.d.ts",
     "src/**/*"
diff --git a/packages/kbn-plugin-generator/tsconfig.json b/packages/kbn-plugin-generator/tsconfig.json
index fc88223dae4b20..c54ff041d7065b 100644
--- a/packages/kbn-plugin-generator/tsconfig.json
+++ b/packages/kbn-plugin-generator/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "target",
     "target": "ES2019",
diff --git a/packages/kbn-plugin-helpers/tsconfig.json b/packages/kbn-plugin-helpers/tsconfig.json
index e794b11b14afad..651bc79d6e7071 100644
--- a/packages/kbn-plugin-helpers/tsconfig.json
+++ b/packages/kbn-plugin-helpers/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "target",
     "declaration": true,
diff --git a/packages/kbn-pm/README.md b/packages/kbn-pm/README.md
index 05405e7b98374f..c169b5c75e178b 100644
--- a/packages/kbn-pm/README.md
+++ b/packages/kbn-pm/README.md
@@ -19,7 +19,7 @@ From a plugin perspective there are two different types of Kibana dependencies:
 runtime and static dependencies. Runtime dependencies are things that are
 instantiated at runtime and that are injected into the plugin, for example
 config and elasticsearch clients. Static dependencies are those dependencies
-that we want to `import`. `eslint-config-kibana` is one example of this, and
+that we want to `import`. `elastic-eslint-config-kibana` is one example of this, and
 it's actually needed because eslint requires it to be a separate package. But we
 also have dependencies like `datemath`, `flot`, `eui` and others that we
 control, but where we want to `import` them in plugins instead of injecting them
diff --git a/packages/kbn-pm/dist/index.js b/packages/kbn-pm/dist/index.js
index eb2d0d2581a347..9a3bb1c687032d 100644
--- a/packages/kbn-pm/dist/index.js
+++ b/packages/kbn-pm/dist/index.js
@@ -27651,6 +27651,7 @@ var eos = function(stream, opts, callback) {
 	var rs = stream._readableState;
 	var readable = opts.readable || (opts.readable !== false && stream.readable);
 	var writable = opts.writable || (opts.writable !== false && stream.writable);
+	var cancelled = false;
 
 	var onlegacyfinish = function() {
 		if (!stream.writable) onfinish();
@@ -27675,8 +27676,13 @@ var eos = function(stream, opts, callback) {
 	};
 
 	var onclose = function() {
-		if (readable && !(rs && rs.ended)) return callback.call(stream, new Error('premature close'));
-		if (writable && !(ws && ws.ended)) return callback.call(stream, new Error('premature close'));
+		process.nextTick(onclosenexttick);
+	};
+
+	var onclosenexttick = function() {
+		if (cancelled) return;
+		if (readable && !(rs && (rs.ended && !rs.destroyed))) return callback.call(stream, new Error('premature close'));
+		if (writable && !(ws && (ws.ended && !ws.destroyed))) return callback.call(stream, new Error('premature close'));
 	};
 
 	var onrequest = function() {
@@ -27701,6 +27707,7 @@ var eos = function(stream, opts, callback) {
 	stream.on('close', onclose);
 
 	return function() {
+		cancelled = true;
 		stream.removeListener('complete', onfinish);
 		stream.removeListener('abort', onclose);
 		stream.removeListener('request', onrequest);
diff --git a/packages/kbn-pm/tsconfig.json b/packages/kbn-pm/tsconfig.json
index c13a9243c50aa9..175c4701f2e5ba 100644
--- a/packages/kbn-pm/tsconfig.json
+++ b/packages/kbn-pm/tsconfig.json
@@ -1,12 +1,13 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "include": [
     "./index.d.ts",
     "./src/**/*.ts",
-    "./dist/*.d.ts",
+    "./dist/*.d.ts"
   ],
   "exclude": [],
   "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/packages/kbn-pm",
     "types": [
       "jest",
       "node"
diff --git a/packages/kbn-release-notes/src/cli.ts b/packages/kbn-release-notes/src/cli.ts
index 44b4a7a0282d20..7dcfa380783919 100644
--- a/packages/kbn-release-notes/src/cli.ts
+++ b/packages/kbn-release-notes/src/cli.ts
@@ -25,8 +25,7 @@ import { run, createFlagError, createFailError, REPO_ROOT } from '@kbn/dev-utils
 
 import { FORMATS, SomeFormat } from './formats';
 import {
-  iterRelevantPullRequests,
-  getPr,
+  PrApi,
   Version,
   ClassifiedPr,
   streamFromIterable,
@@ -48,6 +47,7 @@ export function runReleaseNotesCli() {
       if (!token || typeof token !== 'string') {
         throw createFlagError('--token must be defined');
       }
+      const prApi = new PrApi(log, token);
 
       const version = Version.fromFlag(flags.version);
       if (!version) {
@@ -80,7 +80,7 @@ export function runReleaseNotesCli() {
         }
 
         const summary = new IrrelevantPrSummary(log);
-        const pr = await getPr(token, number);
+        const pr = await prApi.getPr(number);
         log.success(
           inspect(
             {
@@ -101,7 +101,7 @@ export function runReleaseNotesCli() {
 
       const summary = new IrrelevantPrSummary(log);
       const prsToReport: ClassifiedPr[] = [];
-      const prIterable = iterRelevantPullRequests(token, version, log);
+      const prIterable = prApi.iterRelevantPullRequests(version);
       for await (const pr of prIterable) {
         if (!isPrRelevant(pr, version, includeVersions, summary)) {
           continue;
diff --git a/packages/kbn-release-notes/src/lib/classify_pr.ts b/packages/kbn-release-notes/src/lib/classify_pr.ts
index c567935ab7e480..2dfe6916235eef 100644
--- a/packages/kbn-release-notes/src/lib/classify_pr.ts
+++ b/packages/kbn-release-notes/src/lib/classify_pr.ts
@@ -27,7 +27,7 @@ import {
   ASCIIDOC_SECTIONS,
   UNKNOWN_ASCIIDOC_SECTION,
 } from '../release_notes_config';
-import { PullRequest } from './pull_request';
+import { PullRequest } from './pr_api';
 
 export interface ClassifiedPr extends PullRequest {
   area: Area;
diff --git a/packages/kbn-release-notes/src/lib/index.ts b/packages/kbn-release-notes/src/lib/index.ts
index 00d8f49cf763fa..8d27a26d96d0a4 100644
--- a/packages/kbn-release-notes/src/lib/index.ts
+++ b/packages/kbn-release-notes/src/lib/index.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-export * from './pull_request';
+export * from './pr_api';
 export * from './version';
 export * from './is_pr_relevant';
 export * from './streams';
diff --git a/packages/kbn-release-notes/src/lib/irrelevant_pr_summary.ts b/packages/kbn-release-notes/src/lib/irrelevant_pr_summary.ts
index 1a458a04c7740d..ba82ab8780465b 100644
--- a/packages/kbn-release-notes/src/lib/irrelevant_pr_summary.ts
+++ b/packages/kbn-release-notes/src/lib/irrelevant_pr_summary.ts
@@ -19,7 +19,7 @@
 
 import { ToolingLog } from '@kbn/dev-utils';
 
-import { PullRequest } from './pull_request';
+import { PullRequest } from './pr_api';
 import { Version } from './version';
 
 export class IrrelevantPrSummary {
diff --git a/packages/kbn-release-notes/src/lib/is_pr_relevant.ts b/packages/kbn-release-notes/src/lib/is_pr_relevant.ts
index af2ef9440dedeb..452a14e919ed44 100644
--- a/packages/kbn-release-notes/src/lib/is_pr_relevant.ts
+++ b/packages/kbn-release-notes/src/lib/is_pr_relevant.ts
@@ -18,7 +18,7 @@
  */
 
 import { Version } from './version';
-import { PullRequest } from './pull_request';
+import { PullRequest } from './pr_api';
 import { IGNORE_LABELS } from '../release_notes_config';
 import { IrrelevantPrSummary } from './irrelevant_pr_summary';
 
diff --git a/packages/kbn-release-notes/src/lib/pr_api.ts b/packages/kbn-release-notes/src/lib/pr_api.ts
new file mode 100644
index 00000000000000..1f26aa7ad86c36
--- /dev/null
+++ b/packages/kbn-release-notes/src/lib/pr_api.ts
@@ -0,0 +1,231 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { inspect } from 'util';
+
+import Axios from 'axios';
+import gql from 'graphql-tag';
+import * as GraphqlPrinter from 'graphql/language/printer';
+import { DocumentNode } from 'graphql/language/ast';
+import makeTerminalLink from 'terminal-link';
+import { ToolingLog, isAxiosResponseError } from '@kbn/dev-utils';
+
+import { Version } from './version';
+import { getFixReferences } from './get_fix_references';
+import { getNoteFromDescription } from './get_note_from_description';
+
+const PrNodeFragment = gql`
+  fragment PrNode on PullRequest {
+    number
+    url
+    title
+    bodyText
+    bodyHTML
+    mergedAt
+    baseRefName
+    state
+    author {
+      login
+      ... on User {
+        name
+      }
+    }
+    labels(first: 100) {
+      nodes {
+        name
+      }
+    }
+  }
+`;
+
+export interface PullRequest {
+  number: number;
+  url: string;
+  title: string;
+  targetBranch: string;
+  mergedAt: string;
+  state: string;
+  labels: string[];
+  fixes: string[];
+  user: {
+    name: string;
+    login: string;
+  };
+  versions: Version[];
+  terminalLink: string;
+  note?: string;
+}
+
+export class PrApi {
+  constructor(private readonly log: ToolingLog, private readonly token: string) {}
+
+  async getPr(number: number) {
+    const resp = await this.gqlRequest(
+      gql`
+        query($number: Int!) {
+          repository(owner: "elastic", name: "kibana") {
+            pullRequest(number: $number) {
+              ...PrNode
+            }
+          }
+        }
+        ${PrNodeFragment}
+      `,
+      {
+        number,
+      }
+    );
+
+    const node = resp.data?.repository?.pullRequest;
+    if (!node) {
+      throw new Error(`unexpected github response, unable to fetch PR: ${inspect(resp)}`);
+    }
+
+    return this.parsePullRequestNode(node);
+  }
+
+  /**
+   * Iterate all of the PRs which have the `version` label
+   */
+  async *iterRelevantPullRequests(version: Version) {
+    let nextCursor: string | undefined;
+    let hasNextPage = true;
+
+    while (hasNextPage) {
+      const resp = await this.gqlRequest(
+        gql`
+          query($cursor: String, $labels: [String!]) {
+            repository(owner: "elastic", name: "kibana") {
+              pullRequests(first: 100, after: $cursor, labels: $labels, states: MERGED) {
+                pageInfo {
+                  hasNextPage
+                  endCursor
+                }
+                nodes {
+                  ...PrNode
+                }
+              }
+            }
+          }
+          ${PrNodeFragment}
+        `,
+        {
+          cursor: nextCursor,
+          labels: [version.label],
+        }
+      );
+
+      const pullRequests = resp.data?.repository?.pullRequests;
+      if (!pullRequests) {
+        throw new Error(`unexpected github response, unable to fetch PRs: ${inspect(resp)}`);
+      }
+
+      hasNextPage = pullRequests.pageInfo?.hasNextPage;
+      nextCursor = pullRequests.pageInfo?.endCursor;
+
+      if (hasNextPage === undefined || (hasNextPage && !nextCursor)) {
+        throw new Error(
+          `github response does not include valid pagination information: ${inspect(resp)}`
+        );
+      }
+
+      for (const node of pullRequests.nodes) {
+        yield this.parsePullRequestNode(node);
+      }
+    }
+  }
+
+  /**
+   * Convert the Github API response into the structure used by this tool
+   *
+   * @param node A GraphQL response from Github using the PrNode fragment
+   */
+  private parsePullRequestNode(node: any): PullRequest {
+    const terminalLink = makeTerminalLink(`#${node.number}`, node.url);
+
+    const labels: string[] = node.labels.nodes.map((l: { name: string }) => l.name);
+
+    return {
+      number: node.number,
+      url: node.url,
+      terminalLink,
+      title: node.title,
+      targetBranch: node.baseRefName,
+      state: node.state,
+      mergedAt: node.mergedAt,
+      labels,
+      fixes: getFixReferences(node.bodyText),
+      user: {
+        login: node.author?.login || 'deleted user',
+        name: node.author?.name,
+      },
+      versions: labels
+        .map((l) => Version.fromLabel(l))
+        .filter((v): v is Version => v instanceof Version),
+      note: getNoteFromDescription(node.bodyHTML),
+    };
+  }
+
+  /**
+   * Send a single request to the Github v4 GraphQL API
+   */
+  private async gqlRequest(query: DocumentNode, variables: Record<string, unknown> = {}) {
+    let attempt = 0;
+
+    while (true) {
+      attempt += 1;
+
+      try {
+        const resp = await Axios.request({
+          url: 'https://api.github.com/graphql',
+          method: 'POST',
+          headers: {
+            'user-agent': '@kbn/release-notes',
+            authorization: `bearer ${this.token}`,
+          },
+          data: {
+            query: GraphqlPrinter.print(query),
+            variables,
+          },
+        });
+
+        return resp.data;
+      } catch (error) {
+        if (!isAxiosResponseError(error) || error.response.status < 500) {
+          // rethrow error unless it is a 500+ response from github
+          throw error;
+        }
+
+        const { status, data } = error.response;
+        const resp = inspect(data);
+
+        if (attempt === 5) {
+          throw new Error(
+            `${status} response from Github, attempted request ${attempt} times: [${resp}]`
+          );
+        }
+
+        const delay = attempt * 2000;
+        this.log.debug(`Github responded with ${status}, retrying in ${delay} ms: [${resp}]`);
+        await new Promise((resolve) => setTimeout(resolve, delay));
+        continue;
+      }
+    }
+  }
+}
diff --git a/packages/kbn-release-notes/src/lib/pull_request.ts b/packages/kbn-release-notes/src/lib/pull_request.ts
deleted file mode 100644
index e61e496642062a..00000000000000
--- a/packages/kbn-release-notes/src/lib/pull_request.ts
+++ /dev/null
@@ -1,206 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { inspect } from 'util';
-
-import Axios from 'axios';
-import gql from 'graphql-tag';
-import * as GraphqlPrinter from 'graphql/language/printer';
-import { DocumentNode } from 'graphql/language/ast';
-import makeTerminalLink from 'terminal-link';
-import { ToolingLog } from '@kbn/dev-utils';
-
-import { Version } from './version';
-import { getFixReferences } from './get_fix_references';
-import { getNoteFromDescription } from './get_note_from_description';
-
-const PrNodeFragment = gql`
-  fragment PrNode on PullRequest {
-    number
-    url
-    title
-    bodyText
-    bodyHTML
-    mergedAt
-    baseRefName
-    state
-    author {
-      login
-      ... on User {
-        name
-      }
-    }
-    labels(first: 100) {
-      nodes {
-        name
-      }
-    }
-  }
-`;
-
-export interface PullRequest {
-  number: number;
-  url: string;
-  title: string;
-  targetBranch: string;
-  mergedAt: string;
-  state: string;
-  labels: string[];
-  fixes: string[];
-  user: {
-    name: string;
-    login: string;
-  };
-  versions: Version[];
-  terminalLink: string;
-  note?: string;
-}
-
-/**
- * Send a single request to the Github v4 GraphQL API
- */
-async function gqlRequest(
-  token: string,
-  query: DocumentNode,
-  variables: Record<string, unknown> = {}
-) {
-  const resp = await Axios.request({
-    url: 'https://api.github.com/graphql',
-    method: 'POST',
-    headers: {
-      'user-agent': '@kbn/release-notes',
-      authorization: `bearer ${token}`,
-    },
-    data: {
-      query: GraphqlPrinter.print(query),
-      variables,
-    },
-  });
-
-  return resp.data;
-}
-
-/**
- * Convert the Github API response into the structure used by this tool
- *
- * @param node A GraphQL response from Github using the PrNode fragment
- */
-function parsePullRequestNode(node: any): PullRequest {
-  const terminalLink = makeTerminalLink(`#${node.number}`, node.url);
-
-  const labels: string[] = node.labels.nodes.map((l: { name: string }) => l.name);
-
-  return {
-    number: node.number,
-    url: node.url,
-    terminalLink,
-    title: node.title,
-    targetBranch: node.baseRefName,
-    state: node.state,
-    mergedAt: node.mergedAt,
-    labels,
-    fixes: getFixReferences(node.bodyText),
-    user: {
-      login: node.author?.login || 'deleted user',
-      name: node.author?.name,
-    },
-    versions: labels
-      .map((l) => Version.fromLabel(l))
-      .filter((v): v is Version => v instanceof Version),
-    note: getNoteFromDescription(node.bodyHTML),
-  };
-}
-
-/**
- * Iterate all of the PRs which have the `version` label
- */
-export async function* iterRelevantPullRequests(token: string, version: Version, log: ToolingLog) {
-  let nextCursor: string | undefined;
-  let hasNextPage = true;
-
-  while (hasNextPage) {
-    const resp = await gqlRequest(
-      token,
-      gql`
-        query($cursor: String, $labels: [String!]) {
-          repository(owner: "elastic", name: "kibana") {
-            pullRequests(first: 100, after: $cursor, labels: $labels, states: MERGED) {
-              pageInfo {
-                hasNextPage
-                endCursor
-              }
-              nodes {
-                ...PrNode
-              }
-            }
-          }
-        }
-        ${PrNodeFragment}
-      `,
-      {
-        cursor: nextCursor,
-        labels: [version.label],
-      }
-    );
-
-    const pullRequests = resp.data?.repository?.pullRequests;
-    if (!pullRequests) {
-      throw new Error(`unexpected github response, unable to fetch PRs: ${inspect(resp)}`);
-    }
-
-    hasNextPage = pullRequests.pageInfo?.hasNextPage;
-    nextCursor = pullRequests.pageInfo?.endCursor;
-
-    if (hasNextPage === undefined || (hasNextPage && !nextCursor)) {
-      throw new Error(
-        `github response does not include valid pagination information: ${inspect(resp)}`
-      );
-    }
-
-    for (const node of pullRequests.nodes) {
-      yield parsePullRequestNode(node);
-    }
-  }
-}
-
-export async function getPr(token: string, number: number) {
-  const resp = await gqlRequest(
-    token,
-    gql`
-      query($number: Int!) {
-        repository(owner: "elastic", name: "kibana") {
-          pullRequest(number: $number) {
-            ...PrNode
-          }
-        }
-      }
-      ${PrNodeFragment}
-    `,
-    {
-      number,
-    }
-  );
-
-  const node = resp.data?.repository?.pullRequest;
-  if (!node) {
-    throw new Error(`unexpected github response, unable to fetch PR: ${inspect(resp)}`);
-  }
-
-  return parsePullRequestNode(node);
-}
diff --git a/packages/kbn-release-notes/tsconfig.json b/packages/kbn-release-notes/tsconfig.json
index 6ffa64d91fba0f..02209a29e58171 100644
--- a/packages/kbn-release-notes/tsconfig.json
+++ b/packages/kbn-release-notes/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "declaration": true,
diff --git a/packages/kbn-telemetry-tools/tsconfig.json b/packages/kbn-telemetry-tools/tsconfig.json
index 13ce8ef2bad60b..98512053a5c92b 100644
--- a/packages/kbn-telemetry-tools/tsconfig.json
+++ b/packages/kbn-telemetry-tools/tsconfig.json
@@ -1,5 +1,8 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/packages/kbn-telemetry-tools"
+  },
   "include": [
     "src/**/*",
   ]
diff --git a/packages/kbn-test-subj-selector/tsconfig.json b/packages/kbn-test-subj-selector/tsconfig.json
index 3604f1004cf6c4..a1e1c1af372c69 100644
--- a/packages/kbn-test-subj-selector/tsconfig.json
+++ b/packages/kbn-test-subj-selector/tsconfig.json
@@ -1,6 +1,9 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/packages/kbn-test-subj-selector"
+  },
   "include": [
     "index.d.ts"
-  ],
+  ]
 }
diff --git a/packages/kbn-test/src/functional_test_runner/lib/config/read_config_file.ts b/packages/kbn-test/src/functional_test_runner/lib/config/read_config_file.ts
index 96fd525efa3ec8..2e40aeec4f43d3 100644
--- a/packages/kbn-test/src/functional_test_runner/lib/config/read_config_file.ts
+++ b/packages/kbn-test/src/functional_test_runner/lib/config/read_config_file.ts
@@ -21,7 +21,6 @@ import { ToolingLog } from '@kbn/dev-utils';
 import { defaultsDeep } from 'lodash';
 
 import { Config } from './config';
-import { transformDeprecations } from './transform_deprecations';
 
 const cache = new WeakMap();
 
@@ -52,8 +51,7 @@ async function getSettingsFromFile(log: ToolingLog, path: string, settingOverrid
     await cache.get(configProvider)!
   );
 
-  const logDeprecation = (error: string | Error) => log.error(error);
-  return transformDeprecations(settingsWithDefaults, logDeprecation);
+  return settingsWithDefaults;
 }
 
 export async function readConfigFile(log: ToolingLog, path: string, settingOverrides: any = {}) {
diff --git a/packages/kbn-test/src/functional_test_runner/lib/config/transform_deprecations.ts b/packages/kbn-test/src/functional_test_runner/lib/config/transform_deprecations.ts
deleted file mode 100644
index 08dfc4a4f61f46..00000000000000
--- a/packages/kbn-test/src/functional_test_runner/lib/config/transform_deprecations.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-// @ts-ignore
-import { createTransform, Deprecations } from '../../../../../../src/legacy/deprecation';
-
-type DeprecationTransformer = (
-  settings: object,
-  log: (msg: string) => void
-) => {
-  [key: string]: any;
-};
-
-export const transformDeprecations: DeprecationTransformer = createTransform([
-  Deprecations.unused('servers.webdriver'),
-]);
diff --git a/packages/kbn-test/tsconfig.json b/packages/kbn-test/tsconfig.json
index fdb53de52687bb..fec35e45b2a159 100644
--- a/packages/kbn-test/tsconfig.json
+++ b/packages/kbn-test/tsconfig.json
@@ -1,5 +1,8 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/packages/kbn-test"
+  },
   "include": [
     "types/**/*",
     "src/**/*",
diff --git a/packages/kbn-ui-shared-deps/entry.js b/packages/kbn-ui-shared-deps/entry.js
index 0f981f3d07610f..365b84b83bd5fe 100644
--- a/packages/kbn-ui-shared-deps/entry.js
+++ b/packages/kbn-ui-shared-deps/entry.js
@@ -54,6 +54,3 @@ export const ElasticEuiChartsTheme = require('@elastic/eui/dist/eui_charts_theme
 
 import * as Theme from './theme.ts';
 export { Theme };
-
-// massive deps that we should really get rid of or reduce in size substantially
-export const ElasticsearchBrowser = require('elasticsearch-browser/elasticsearch.js');
diff --git a/packages/kbn-ui-shared-deps/index.js b/packages/kbn-ui-shared-deps/index.js
index 40e89f199b6a13..84ca3435e02bc4 100644
--- a/packages/kbn-ui-shared-deps/index.js
+++ b/packages/kbn-ui-shared-deps/index.js
@@ -62,12 +62,5 @@ exports.externals = {
   '@elastic/eui/dist/eui_charts_theme': '__kbnSharedDeps__.ElasticEuiChartsTheme',
   '@elastic/eui/dist/eui_theme_light.json': '__kbnSharedDeps__.Theme.euiLightVars',
   '@elastic/eui/dist/eui_theme_dark.json': '__kbnSharedDeps__.Theme.euiDarkVars',
-
-  /**
-   * massive deps that we should really get rid of or reduce in size substantially
-   */
-  elasticsearch: '__kbnSharedDeps__.ElasticsearchBrowser',
-  'elasticsearch-browser': '__kbnSharedDeps__.ElasticsearchBrowser',
-  'elasticsearch-browser/elasticsearch': '__kbnSharedDeps__.ElasticsearchBrowser',
 };
 exports.publicPathLoader = require.resolve('./public_path_loader');
diff --git a/packages/kbn-ui-shared-deps/package.json b/packages/kbn-ui-shared-deps/package.json
index 531513481b1d4c..4b2e88d1552455 100644
--- a/packages/kbn-ui-shared-deps/package.json
+++ b/packages/kbn-ui-shared-deps/package.json
@@ -9,8 +9,8 @@
     "kbn:watch": "node scripts/build --dev --watch"
   },
   "dependencies": {
-    "@elastic/charts": "19.8.1",
-    "@elastic/eui": "27.4.1",
+    "@elastic/charts": "21.0.1",
+    "@elastic/eui": "28.2.0",
     "@elastic/numeral": "^2.5.0",
     "@kbn/i18n": "1.0.0",
     "@kbn/monaco": "1.0.0",
@@ -19,7 +19,6 @@
     "compression-webpack-plugin": "^4.0.0",
     "core-js": "^3.6.4",
     "custom-event-polyfill": "^0.3.0",
-    "elasticsearch-browser": "^16.7.0",
     "jquery": "^3.5.0",
     "mini-css-extract-plugin": "0.8.0",
     "moment": "^2.24.0",
diff --git a/packages/kbn-ui-shared-deps/tsconfig.json b/packages/kbn-ui-shared-deps/tsconfig.json
index cef9a442d17bc0..88699027f85de8 100644
--- a/packages/kbn-ui-shared-deps/tsconfig.json
+++ b/packages/kbn-ui-shared-deps/tsconfig.json
@@ -1,5 +1,8 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/packages/kbn-ui-shared-deps"
+  },
   "include": [
     "index.d.ts",
     "theme.ts"
diff --git a/packages/kbn-utility-types/tsconfig.json b/packages/kbn-utility-types/tsconfig.json
index 202df37faf5615..03cace5b9cb2c3 100644
--- a/packages/kbn-utility-types/tsconfig.json
+++ b/packages/kbn-utility-types/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "declaration": true,
     "declarationDir": "./target",
diff --git a/scripts/build_ts_refs.js b/scripts/build_ts_refs.js
new file mode 100644
index 00000000000000..29fd66bab4ca99
--- /dev/null
+++ b/scripts/build_ts_refs.js
@@ -0,0 +1,20 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+require('../src/setup_node_env');
+require('../src/dev/typescript/build_refs').runBuildRefs();
diff --git a/src/cli_keystore/add.js b/src/cli_keystore/add.js
index 44737e387c2d29..462259ec942dd5 100644
--- a/src/cli_keystore/add.js
+++ b/src/cli_keystore/add.js
@@ -19,7 +19,7 @@
 
 import { Logger } from '../cli_plugin/lib/logger';
 import { confirm, question } from '../legacy/server/utils';
-import { createPromiseFromStreams, createConcatStream } from '../legacy/utils';
+import { createPromiseFromStreams, createConcatStream } from '../core/server/utils';
 
 /**
  * @param {Keystore} keystore
diff --git a/src/core/TESTING.md b/src/core/TESTING.md
index a62922d9b5d64b..a0fd0a6ffc2552 100644
--- a/src/core/TESTING.md
+++ b/src/core/TESTING.md
@@ -330,7 +330,7 @@ Cons:
 To have access to Kibana TestUtils, you should create `integration_tests` folder and import `test_utils` within a test file:
 ```typescript
 // src/plugins/my_plugin/server/integration_tests/formatter.test.ts
-import * as kbnTestServer from 'src/test_utils/kbn_server';
+import * as kbnTestServer from 'src/core/test_helpers/kbn_server';
 
 describe('myPlugin', () => {
   describe('GET /myPlugin/formatter', () => {
diff --git a/src/core/public/application/__snapshots__/application_service.test.ts.snap b/src/core/public/application/__snapshots__/application_service.test.ts.snap
index c63a22170c4f61..a6c9eb27e338a5 100644
--- a/src/core/public/application/__snapshots__/application_service.test.ts.snap
+++ b/src/core/public/application/__snapshots__/application_service.test.ts.snap
@@ -80,6 +80,7 @@ exports[`#start() getComponent returns renderable JSX tree 1`] = `
     }
   }
   mounters={Map {}}
+  setAppActionMenu={[Function]}
   setAppLeaveHandler={[Function]}
   setIsMounting={[Function]}
 />
diff --git a/src/core/public/application/application_service.mock.ts b/src/core/public/application/application_service.mock.ts
index 47a8a01d917eb0..5609e7eb5d17db 100644
--- a/src/core/public/application/application_service.mock.ts
+++ b/src/core/public/application/application_service.mock.ts
@@ -20,6 +20,7 @@
 import { History } from 'history';
 import { BehaviorSubject, Subject } from 'rxjs';
 
+import type { MountPoint } from '../types';
 import { capabilitiesServiceMock } from './capabilities/capabilities_service.mock';
 import {
   ApplicationSetup,
@@ -27,7 +28,6 @@ import {
   ApplicationStart,
   InternalApplicationSetup,
   PublicAppInfo,
-  PublicLegacyAppInfo,
 } from './types';
 import { ApplicationServiceContract } from './test_types';
 
@@ -39,7 +39,6 @@ const createSetupContractMock = (): jest.Mocked<ApplicationSetup> => ({
 
 const createInternalSetupContractMock = (): jest.Mocked<InternalApplicationSetup> => ({
   register: jest.fn(),
-  registerLegacyApp: jest.fn(),
   registerAppUpdater: jest.fn(),
   registerMountContext: jest.fn(),
 });
@@ -48,7 +47,7 @@ const createStartContractMock = (): jest.Mocked<ApplicationStart> => {
   const currentAppId$ = new Subject<string | undefined>();
 
   return {
-    applications$: new BehaviorSubject<Map<string, PublicAppInfo | PublicLegacyAppInfo>>(new Map()),
+    applications$: new BehaviorSubject<Map<string, PublicAppInfo>>(new Map()),
     currentAppId$: currentAppId$.asObservable(),
     capabilities: capabilitiesServiceMock.createStartContract().capabilities,
     navigateToApp: jest.fn(),
@@ -84,9 +83,10 @@ const createInternalStartContractMock = (): jest.Mocked<InternalApplicationStart
   const currentAppId$ = new Subject<string | undefined>();
 
   return {
-    applications$: new BehaviorSubject<Map<string, PublicAppInfo | PublicLegacyAppInfo>>(new Map()),
+    applications$: new BehaviorSubject<Map<string, PublicAppInfo>>(new Map()),
     capabilities: capabilitiesServiceMock.createStartContract().capabilities,
     currentAppId$: currentAppId$.asObservable(),
+    currentActionMenu$: new BehaviorSubject<MountPoint | undefined>(undefined),
     getComponent: jest.fn(),
     getUrlForApp: jest.fn(),
     navigateToApp: jest.fn().mockImplementation((appId) => currentAppId$.next(appId)),
diff --git a/src/core/public/application/application_service.test.ts b/src/core/public/application/application_service.test.ts
index d0c2ac111eb1f4..afcebc06506c26 100644
--- a/src/core/public/application/application_service.test.ts
+++ b/src/core/public/application/application_service.test.ts
@@ -28,21 +28,12 @@ import { BehaviorSubject, Subject } from 'rxjs';
 import { bufferCount, take, takeUntil } from 'rxjs/operators';
 import { shallow, mount } from 'enzyme';
 
-import { injectedMetadataServiceMock } from '../injected_metadata/injected_metadata_service.mock';
 import { contextServiceMock } from '../context/context_service.mock';
 import { httpServiceMock } from '../http/http_service.mock';
 import { overlayServiceMock } from '../overlays/overlay_service.mock';
 import { MockLifecycle } from './test_types';
 import { ApplicationService } from './application_service';
-import {
-  App,
-  PublicAppInfo,
-  AppNavLinkStatus,
-  AppStatus,
-  AppUpdater,
-  LegacyApp,
-  PublicLegacyAppInfo,
-} from './types';
+import { App, PublicAppInfo, AppNavLinkStatus, AppStatus, AppUpdater } from './types';
 import { act } from 'react-dom/test-utils';
 
 const createApp = (props: Partial<App>): App => {
@@ -54,15 +45,6 @@ const createApp = (props: Partial<App>): App => {
   };
 };
 
-const createLegacyApp = (props: Partial<LegacyApp>): LegacyApp => {
-  return {
-    id: 'some-id',
-    title: 'some-title',
-    appUrl: '/my-url',
-    ...props,
-  };
-};
-
 let setupDeps: MockLifecycle<'setup'>;
 let startDeps: MockLifecycle<'start'>;
 let service: ApplicationService;
@@ -73,10 +55,8 @@ describe('#setup()', () => {
     setupDeps = {
       http,
       context: contextServiceMock.createSetupContract(),
-      injectedMetadata: injectedMetadataServiceMock.createSetupContract(),
       redirectTo: jest.fn(),
     };
-    setupDeps.injectedMetadata.getLegacyMode.mockReturnValue(false);
     startDeps = { http, overlays: overlayServiceMock.createStartContract() };
     service = new ApplicationService();
   });
@@ -116,7 +96,6 @@ describe('#setup()', () => {
       expect(applications.get('app1')).toEqual(
         expect.objectContaining({
           id: 'app1',
-          legacy: false,
           navLinkStatus: AppNavLinkStatus.visible,
           status: AppStatus.accessible,
         })
@@ -124,7 +103,6 @@ describe('#setup()', () => {
       expect(applications.get('app2')).toEqual(
         expect.objectContaining({
           id: 'app2',
-          legacy: false,
           navLinkStatus: AppNavLinkStatus.visible,
           status: AppStatus.accessible,
         })
@@ -141,7 +119,6 @@ describe('#setup()', () => {
       expect(applications.get('app1')).toEqual(
         expect.objectContaining({
           id: 'app1',
-          legacy: false,
           navLinkStatus: AppNavLinkStatus.hidden,
           status: AppStatus.inaccessible,
           defaultPath: 'foo/bar',
@@ -151,7 +128,6 @@ describe('#setup()', () => {
       expect(applications.get('app2')).toEqual(
         expect.objectContaining({
           id: 'app2',
-          legacy: false,
           navLinkStatus: AppNavLinkStatus.visible,
           status: AppStatus.accessible,
         })
@@ -159,7 +135,7 @@ describe('#setup()', () => {
     });
 
     it('throws an error if an App with the same appRoute is registered', () => {
-      const { register, registerLegacyApp } = service.setup(setupDeps);
+      const { register } = service.setup(setupDeps);
 
       register(Symbol(), createApp({ id: 'app1' }));
 
@@ -168,7 +144,6 @@ describe('#setup()', () => {
       ).toThrowErrorMatchingInlineSnapshot(
         `"An application is already registered with the appRoute \\"/app/app1\\""`
       );
-      expect(() => registerLegacyApp(createLegacyApp({ id: 'app1' }))).toThrow();
 
       register(Symbol(), createApp({ id: 'app-next', appRoute: '/app/app3' }));
 
@@ -177,7 +152,6 @@ describe('#setup()', () => {
       ).toThrowErrorMatchingInlineSnapshot(
         `"An application is already registered with the appRoute \\"/app/app3\\""`
       );
-      expect(() => registerLegacyApp(createLegacyApp({ id: 'app3' }))).not.toThrow();
     });
 
     it('throws an error if an App starts with the HTTP base path', () => {
@@ -195,41 +169,6 @@ describe('#setup()', () => {
     });
   });
 
-  describe('registerLegacyApp', () => {
-    it('throws an error if two apps with the same id are registered', () => {
-      const { registerLegacyApp } = service.setup(setupDeps);
-
-      registerLegacyApp(createLegacyApp({ id: 'app2' }));
-      expect(() =>
-        registerLegacyApp(createLegacyApp({ id: 'app2' }))
-      ).toThrowErrorMatchingInlineSnapshot(
-        `"An application is already registered with the id \\"app2\\""`
-      );
-    });
-
-    it('throws error if additional apps are registered after setup', async () => {
-      const { registerLegacyApp } = service.setup(setupDeps);
-
-      await service.start(startDeps);
-      expect(() =>
-        registerLegacyApp(createLegacyApp({ id: 'app2' }))
-      ).toThrowErrorMatchingInlineSnapshot(`"Applications cannot be registered after \\"setup\\""`);
-    });
-
-    it('throws an error if a LegacyApp with the same appRoute is registered', () => {
-      const { register, registerLegacyApp } = service.setup(setupDeps);
-
-      registerLegacyApp(createLegacyApp({ id: 'app1' }));
-
-      expect(() =>
-        register(Symbol(), createApp({ id: 'app2', appRoute: '/app/app1' }))
-      ).toThrowErrorMatchingInlineSnapshot(
-        `"An application is already registered with the appRoute \\"/app/app1\\""`
-      );
-      expect(() => registerLegacyApp(createLegacyApp({ id: 'app1:other' }))).not.toThrow();
-    });
-  });
-
   describe('registerAppUpdater', () => {
     it('updates status fields', async () => {
       const setup = service.setup(setupDeps);
@@ -258,7 +197,6 @@ describe('#setup()', () => {
       expect(applications.get('app1')).toEqual(
         expect.objectContaining({
           id: 'app1',
-          legacy: false,
           navLinkStatus: AppNavLinkStatus.disabled,
           status: AppStatus.inaccessible,
           tooltip: 'App inaccessible due to reason',
@@ -267,7 +205,6 @@ describe('#setup()', () => {
       expect(applications.get('app2')).toEqual(
         expect.objectContaining({
           id: 'app2',
-          legacy: false,
           navLinkStatus: AppNavLinkStatus.visible,
           status: AppStatus.accessible,
           tooltip: 'App accessible',
@@ -307,7 +244,6 @@ describe('#setup()', () => {
       expect(applications.get('app1')).toEqual(
         expect.objectContaining({
           id: 'app1',
-          legacy: false,
           navLinkStatus: AppNavLinkStatus.disabled,
           status: AppStatus.inaccessible,
           tooltip: 'App inaccessible due to reason',
@@ -316,7 +252,6 @@ describe('#setup()', () => {
       expect(applications.get('app2')).toEqual(
         expect.objectContaining({
           id: 'app2',
-          legacy: false,
           status: AppStatus.inaccessible,
           navLinkStatus: AppNavLinkStatus.hidden,
         })
@@ -352,7 +287,6 @@ describe('#setup()', () => {
       expect(applications.get('app1')).toEqual(
         expect.objectContaining({
           id: 'app1',
-          legacy: false,
           navLinkStatus: AppNavLinkStatus.disabled,
           status: AppStatus.inaccessible,
         })
@@ -374,10 +308,7 @@ describe('#setup()', () => {
       setup.registerAppUpdater(statusUpdater);
 
       const start = await service.start(startDeps);
-      let latestValue: ReadonlyMap<string, PublicAppInfo | PublicLegacyAppInfo> = new Map<
-        string,
-        PublicAppInfo | PublicLegacyAppInfo
-      >();
+      let latestValue: ReadonlyMap<string, PublicAppInfo> = new Map<string, PublicAppInfo>();
       start.applications$.subscribe((apps) => {
         latestValue = apps;
       });
@@ -385,7 +316,6 @@ describe('#setup()', () => {
       expect(latestValue.get('app1')).toEqual(
         expect.objectContaining({
           id: 'app1',
-          legacy: false,
           status: AppStatus.inaccessible,
           navLinkStatus: AppNavLinkStatus.disabled,
         })
@@ -401,43 +331,12 @@ describe('#setup()', () => {
       expect(latestValue.get('app1')).toEqual(
         expect.objectContaining({
           id: 'app1',
-          legacy: false,
           status: AppStatus.accessible,
           navLinkStatus: AppNavLinkStatus.hidden,
         })
       );
     });
 
-    it('also updates legacy apps', async () => {
-      const setup = service.setup(setupDeps);
-
-      setup.registerLegacyApp(createLegacyApp({ id: 'app1' }));
-
-      setup.registerAppUpdater(
-        new BehaviorSubject<AppUpdater>((app) => {
-          return {
-            status: AppStatus.inaccessible,
-            navLinkStatus: AppNavLinkStatus.hidden,
-            tooltip: 'App inaccessible due to reason',
-          };
-        })
-      );
-
-      const start = await service.start(startDeps);
-      const applications = await start.applications$.pipe(take(1)).toPromise();
-
-      expect(applications.size).toEqual(1);
-      expect(applications.get('app1')).toEqual(
-        expect.objectContaining({
-          id: 'app1',
-          legacy: true,
-          status: AppStatus.inaccessible,
-          navLinkStatus: AppNavLinkStatus.hidden,
-          tooltip: 'App inaccessible due to reason',
-        })
-      );
-    });
-
     it('allows to update the basePath', async () => {
       const setup = service.setup(setupDeps);
 
@@ -486,10 +385,8 @@ describe('#start()', () => {
     setupDeps = {
       http,
       context: contextServiceMock.createSetupContract(),
-      injectedMetadata: injectedMetadataServiceMock.createSetupContract(),
       redirectTo: jest.fn(),
     };
-    setupDeps.injectedMetadata.getLegacyMode.mockReturnValue(false);
     startDeps = { http, overlays: overlayServiceMock.createStartContract() };
     service = new ApplicationService();
   });
@@ -507,11 +404,10 @@ describe('#start()', () => {
   });
 
   it('exposes available apps', async () => {
-    setupDeps.injectedMetadata.getLegacyMode.mockReturnValue(true);
-    const { register, registerLegacyApp } = service.setup(setupDeps);
+    const { register } = service.setup(setupDeps);
 
     register(Symbol(), createApp({ id: 'app1' }));
-    registerLegacyApp(createLegacyApp({ id: 'app2' }));
+    register(Symbol(), createApp({ id: 'app2' }));
 
     const { applications$ } = await service.start(startDeps);
     const availableApps = await applications$.pipe(take(1)).toPromise();
@@ -522,16 +418,14 @@ describe('#start()', () => {
       expect.objectContaining({
         appRoute: '/app/app1',
         id: 'app1',
-        legacy: false,
         navLinkStatus: AppNavLinkStatus.visible,
         status: AppStatus.accessible,
       })
     );
     expect(availableApps.get('app2')).toEqual(
       expect.objectContaining({
-        appUrl: '/my-url',
+        appRoute: '/app/app2',
         id: 'app2',
-        legacy: true,
         navLinkStatus: AppNavLinkStatus.visible,
         status: AppStatus.accessible,
       })
@@ -558,39 +452,19 @@ describe('#start()', () => {
         navLinks: {
           app1: true,
           app2: false,
-          legacyApp1: true,
-          legacyApp2: false,
         },
       },
     } as any);
 
-    const { register, registerLegacyApp } = service.setup(setupDeps);
+    const { register } = service.setup(setupDeps);
 
     register(Symbol(), createApp({ id: 'app1' }));
-    registerLegacyApp(createLegacyApp({ id: 'legacyApp1' }));
     register(Symbol(), createApp({ id: 'app2' }));
-    registerLegacyApp(createLegacyApp({ id: 'legacyApp2' }));
 
     const { applications$ } = await service.start(startDeps);
     const availableApps = await applications$.pipe(take(1)).toPromise();
 
-    expect([...availableApps.keys()]).toEqual(['app1', 'legacyApp1']);
-  });
-
-  describe('currentAppId$', () => {
-    it('emits the legacy app id when in legacy mode', async () => {
-      setupDeps.injectedMetadata.getLegacyMode.mockReturnValue(true);
-      setupDeps.injectedMetadata.getLegacyMetadata.mockReturnValue({
-        app: {
-          id: 'legacy',
-          title: 'Legacy App',
-        },
-      } as any);
-      await service.setup(setupDeps);
-      const { currentAppId$ } = await service.start(startDeps);
-
-      expect(await currentAppId$.pipe(take(1)).toPromise()).toEqual('legacy');
-    });
+    expect([...availableApps.keys()]).toEqual(['app1']);
   });
 
   describe('getComponent', () => {
@@ -602,16 +476,6 @@ describe('#start()', () => {
       expect(() => shallow(createElement(getComponent))).not.toThrow();
       expect(getComponent()).toMatchSnapshot();
     });
-
-    it('renders null when in legacy mode', async () => {
-      setupDeps.injectedMetadata.getLegacyMode.mockReturnValue(true);
-      service.setup(setupDeps);
-
-      const { getComponent } = await service.start(startDeps);
-
-      expect(() => shallow(createElement(getComponent))).not.toThrow();
-      expect(getComponent()).toBe(null);
-    });
   });
 
   describe('getUrlForApp', () => {
@@ -624,16 +488,14 @@ describe('#start()', () => {
     });
 
     it('creates URL for registered appId', async () => {
-      const { register, registerLegacyApp } = service.setup(setupDeps);
+      const { register } = service.setup(setupDeps);
 
       register(Symbol(), createApp({ id: 'app1' }));
-      registerLegacyApp(createLegacyApp({ id: 'legacyApp1' }));
       register(Symbol(), createApp({ id: 'app2', appRoute: '/custom/path' }));
 
       const { getUrlForApp } = await service.start(startDeps);
 
       expect(getUrlForApp('app1')).toBe('/base-path/app/app1');
-      expect(getUrlForApp('legacyApp1')).toBe('/base-path/app/legacyApp1');
       expect(getUrlForApp('app2')).toBe('/base-path/custom/path');
     });
 
@@ -800,16 +662,6 @@ describe('#start()', () => {
       expect(MockHistory.push).toHaveBeenCalledWith('/custom/path', 'my-state');
     });
 
-    it('redirects when in legacyMode', async () => {
-      setupDeps.injectedMetadata.getLegacyMode.mockReturnValue(true);
-      service.setup(setupDeps);
-
-      const { navigateToApp } = await service.start(startDeps);
-
-      await navigateToApp('myTestApp');
-      expect(setupDeps.redirectTo).toHaveBeenCalledWith('/base-path/app/myTestApp');
-    });
-
     it('updates currentApp$ after mounting', async () => {
       service.setup(setupDeps);
 
@@ -903,31 +755,6 @@ describe('#start()', () => {
       `);
     });
 
-    it('sets window.location.href when navigating to legacy apps', async () => {
-      setupDeps.http = httpServiceMock.createSetupContract({ basePath: '/test' });
-      setupDeps.injectedMetadata.getLegacyMode.mockReturnValue(true);
-      service.setup(setupDeps);
-
-      const { navigateToApp } = await service.start(startDeps);
-
-      await navigateToApp('alpha');
-      expect(setupDeps.redirectTo).toHaveBeenCalledWith('/test/app/alpha');
-    });
-
-    it('handles legacy apps with subapps', async () => {
-      setupDeps.http = httpServiceMock.createSetupContract({ basePath: '/test' });
-      setupDeps.injectedMetadata.getLegacyMode.mockReturnValue(true);
-
-      const { registerLegacyApp } = service.setup(setupDeps);
-
-      registerLegacyApp(createLegacyApp({ id: 'baseApp:legacyApp1' }));
-
-      const { navigateToApp } = await service.start(startDeps);
-
-      await navigateToApp('baseApp:legacyApp1');
-      expect(setupDeps.redirectTo).toHaveBeenCalledWith('/test/app/baseApp');
-    });
-
     describe('when `replace` option is true', () => {
       it('use `history.replace` instead of `history.push`', async () => {
         service.setup(setupDeps);
@@ -973,16 +800,6 @@ describe('#start()', () => {
           undefined
         );
       });
-      it('do not change the behavior when in legacy mode', async () => {
-        setupDeps.http = httpServiceMock.createSetupContract({ basePath: '/test' });
-        setupDeps.injectedMetadata.getLegacyMode.mockReturnValue(true);
-        service.setup(setupDeps);
-
-        const { navigateToApp } = await service.start(startDeps);
-
-        await navigateToApp('alpha', { replace: true });
-        expect(setupDeps.redirectTo).toHaveBeenCalledWith('/test/app/alpha');
-      });
     });
 
     describe('when `replace` option is false', () => {
@@ -1040,9 +857,7 @@ describe('#stop()', () => {
     setupDeps = {
       http,
       context: contextServiceMock.createSetupContract(),
-      injectedMetadata: injectedMetadataServiceMock.createSetupContract(),
     };
-    setupDeps.injectedMetadata.getLegacyMode.mockReturnValue(false);
     startDeps = { http, overlays: overlayServiceMock.createStartContract() };
     service = new ApplicationService();
   });
diff --git a/src/core/public/application/application_service.tsx b/src/core/public/application/application_service.tsx
index d7f15decb255dd..0d08f6f3007b02 100644
--- a/src/core/public/application/application_service.tsx
+++ b/src/core/public/application/application_service.tsx
@@ -22,7 +22,7 @@ import { BehaviorSubject, Observable, Subject, Subscription } from 'rxjs';
 import { map, shareReplay, takeUntil, distinctUntilChanged, filter } from 'rxjs/operators';
 import { createBrowserHistory, History } from 'history';
 
-import { InjectedMetadataSetup } from '../injected_metadata';
+import { MountPoint } from '../types';
 import { HttpSetup, HttpStart } from '../http';
 import { OverlayStart } from '../overlays';
 import { ContextSetup, IContextContainer } from '../context';
@@ -31,7 +31,6 @@ import { AppRouter } from './ui';
 import { Capabilities, CapabilitiesService } from './capabilities';
 import {
   App,
-  AppBase,
   AppLeaveHandler,
   AppMount,
   AppMountDeprecated,
@@ -41,8 +40,6 @@ import {
   AppUpdater,
   InternalApplicationSetup,
   InternalApplicationStart,
-  LegacyApp,
-  LegacyAppMounter,
   Mounter,
   NavigateToAppOptions,
 } from './types';
@@ -52,9 +49,8 @@ import { appendAppPath, parseAppUrl, relativeToAbsolute, getAppInfo } from './ut
 interface SetupDeps {
   context: ContextSetup;
   http: HttpSetup;
-  injectedMetadata: InjectedMetadataSetup;
   history?: History<any>;
-  /** Used to redirect to external urls (and legacy apps) */
+  /** Used to redirect to external urls */
   redirectTo?: (path: string) => void;
 }
 
@@ -90,16 +86,22 @@ interface AppUpdaterWrapper {
   updater: AppUpdater;
 }
 
+interface AppInternalState {
+  leaveHandler?: AppLeaveHandler;
+  actionMenu?: MountPoint;
+}
+
 /**
  * Service that is responsible for registering new applications.
  * @internal
  */
 export class ApplicationService {
-  private readonly apps = new Map<string, App<any> | LegacyApp>();
+  private readonly apps = new Map<string, App<any>>();
   private readonly mounters = new Map<string, Mounter>();
   private readonly capabilities = new CapabilitiesService();
-  private readonly appLeaveHandlers = new Map<string, AppLeaveHandler>();
+  private readonly appInternalStates = new Map<string, AppInternalState>();
   private currentAppId$ = new BehaviorSubject<string | undefined>(undefined);
+  private currentActionMenu$ = new BehaviorSubject<MountPoint | undefined>(undefined);
   private readonly statusUpdaters$ = new BehaviorSubject<Map<symbol, AppUpdaterWrapper>>(new Map());
   private readonly subscriptions: Subscription[] = [];
   private stop$ = new Subject();
@@ -112,28 +114,17 @@ export class ApplicationService {
   public setup({
     context,
     http: { basePath },
-    injectedMetadata,
     redirectTo = (path: string) => {
       window.location.assign(path);
     },
     history,
   }: SetupDeps): InternalApplicationSetup {
     const basename = basePath.get();
-    if (injectedMetadata.getLegacyMode()) {
-      this.currentAppId$.next(injectedMetadata.getLegacyMetadata().app.id);
-    } else {
-      // Only setup history if we're not in legacy mode
-      this.history = history || createBrowserHistory({ basename });
-    }
+    this.history = history || createBrowserHistory({ basename });
 
     this.navigate = (url, state, replace) => {
-      if (this.history) {
-        // basePath not needed here because `history` is configured with basename
-        return replace ? this.history.replace(url, state) : this.history.push(url, state);
-      } else {
-        // If we do not have history available (legacy mode), use redirectTo to do a full page refresh.
-        return redirectTo(basePath.prepend(url));
-      }
+      // basePath not needed here because `history` is configured with basename
+      return replace ? this.history!.replace(url, state) : this.history!.push(url, state);
     };
 
     this.redirectTo = redirectTo;
@@ -193,7 +184,6 @@ export class ApplicationService {
           ...appProps,
           status: app.status ?? AppStatus.accessible,
           navLinkStatus: app.navLinkStatus ?? AppNavLinkStatus.default,
-          legacy: false,
         });
         if (updater$) {
           registerStatusUpdater(app.id, updater$);
@@ -204,43 +194,6 @@ export class ApplicationService {
           exactRoute: app.exactRoute ?? false,
           mount: wrapMount(plugin, app),
           unmountBeforeMounting: false,
-          legacy: false,
-        });
-      },
-      registerLegacyApp: (app) => {
-        const appRoute = `/app/${app.id.split(':')[0]}`;
-
-        if (this.registrationClosed) {
-          throw new Error('Applications cannot be registered after "setup"');
-        } else if (this.apps.has(app.id)) {
-          throw new Error(`An application is already registered with the id "${app.id}"`);
-        } else if (basename && appRoute!.startsWith(`${basename}/`)) {
-          throw new Error('Cannot register an application route that includes HTTP base path');
-        }
-
-        const appBasePath = basePath.prepend(appRoute);
-        const mount: LegacyAppMounter = ({ history: appHistory }) => {
-          redirectTo(appHistory.createHref(appHistory.location));
-          window.location.reload();
-        };
-
-        const { updater$, ...appProps } = app;
-        this.apps.set(app.id, {
-          ...appProps,
-          status: app.status ?? AppStatus.accessible,
-          navLinkStatus: app.navLinkStatus ?? AppNavLinkStatus.default,
-          legacy: true,
-        });
-        if (updater$) {
-          registerStatusUpdater(app.id, updater$);
-        }
-        this.mounters.set(app.id, {
-          appRoute,
-          appBasePath,
-          exactRoute: false,
-          mount,
-          unmountBeforeMounting: true,
-          legacy: true,
         });
       },
       registerAppUpdater: (appUpdater$: Observable<AppUpdater>) =>
@@ -293,12 +246,14 @@ export class ApplicationService {
         if (path === undefined) {
           path = applications$.value.get(appId)?.defaultPath;
         }
-        this.appLeaveHandlers.delete(this.currentAppId$.value!);
+        this.appInternalStates.delete(this.currentAppId$.value!);
         this.navigate!(getAppUrl(availableMounters, appId, path), state, replace);
         this.currentAppId$.next(appId);
       }
     };
 
+    this.currentAppId$.subscribe(() => this.refreshCurrentActionMenu());
+
     return {
       applications$: applications$.pipe(
         map((apps) => new Map([...apps.entries()].map(([id, app]) => [id, getAppInfo(app)]))),
@@ -310,7 +265,11 @@ export class ApplicationService {
         distinctUntilChanged(),
         takeUntil(this.stop$)
       ),
-      history: this.history,
+      currentActionMenu$: this.currentActionMenu$.pipe(
+        distinctUntilChanged(),
+        takeUntil(this.stop$)
+      ),
+      history: this.history!,
       registerMountContext: this.mountContext.registerContext,
       getUrlForApp: (
         appId,
@@ -338,6 +297,7 @@ export class ApplicationService {
             mounters={availableMounters}
             appStatuses$={applicationStatuses$}
             setAppLeaveHandler={this.setAppLeaveHandler}
+            setAppActionMenu={this.setAppActionMenu}
             setIsMounting={(isMounting) => httpLoadingCount$.next(isMounting ? 1 : 0)}
           />
         );
@@ -346,7 +306,24 @@ export class ApplicationService {
   }
 
   private setAppLeaveHandler = (appId: string, handler: AppLeaveHandler) => {
-    this.appLeaveHandlers.set(appId, handler);
+    this.appInternalStates.set(appId, {
+      ...(this.appInternalStates.get(appId) ?? {}),
+      leaveHandler: handler,
+    });
+  };
+
+  private setAppActionMenu = (appId: string, mount: MountPoint | undefined) => {
+    this.appInternalStates.set(appId, {
+      ...(this.appInternalStates.get(appId) ?? {}),
+      actionMenu: mount,
+    });
+    this.refreshCurrentActionMenu();
+  };
+
+  private refreshCurrentActionMenu = () => {
+    const appId = this.currentAppId$.getValue();
+    const currentActionMenu = appId ? this.appInternalStates.get(appId)?.actionMenu : undefined;
+    this.currentActionMenu$.next(currentActionMenu);
   };
 
   private async shouldNavigate(overlays: OverlayStart): Promise<boolean> {
@@ -354,7 +331,7 @@ export class ApplicationService {
     if (currentAppId === undefined) {
       return true;
     }
-    const action = getLeaveAction(this.appLeaveHandlers.get(currentAppId));
+    const action = getLeaveAction(this.appInternalStates.get(currentAppId)?.leaveHandler);
     if (isConfirmAction(action)) {
       const confirmed = await overlays.openConfirm(action.text, {
         title: action.title,
@@ -372,7 +349,7 @@ export class ApplicationService {
     if (currentAppId === undefined) {
       return;
     }
-    const action = getLeaveAction(this.appLeaveHandlers.get(currentAppId));
+    const action = getLeaveAction(this.appInternalStates.get(currentAppId)?.leaveHandler);
     if (isConfirmAction(action)) {
       event.preventDefault();
       // some browsers accept a string return value being the message displayed
@@ -383,13 +360,14 @@ export class ApplicationService {
   public stop() {
     this.stop$.next();
     this.currentAppId$.complete();
+    this.currentActionMenu$.complete();
     this.statusUpdaters$.complete();
     this.subscriptions.forEach((sub) => sub.unsubscribe());
     window.removeEventListener('beforeunload', this.onBeforeUnload);
   }
 }
 
-const updateStatus = <T extends AppBase>(app: T, statusUpdaters: AppUpdaterWrapper[]): T => {
+const updateStatus = (app: App, statusUpdaters: AppUpdaterWrapper[]): App => {
   let changes: Partial<AppUpdatableFields> = {};
   statusUpdaters.forEach((wrapper) => {
     if (wrapper.application !== allApplicationsFilter && wrapper.application !== app.id) {
diff --git a/src/core/public/application/index.ts b/src/core/public/application/index.ts
index 121f0c7ac07d67..4f3b113a29c9b1 100644
--- a/src/core/public/application/index.ts
+++ b/src/core/public/application/index.ts
@@ -22,7 +22,6 @@ export { Capabilities } from './capabilities';
 export { ScopedHistory } from './scoped_history';
 export {
   App,
-  AppBase,
   AppMount,
   AppMountDeprecated,
   AppUnmount,
@@ -39,10 +38,8 @@ export {
   AppLeaveAction,
   AppLeaveDefaultAction,
   AppLeaveConfirmAction,
-  LegacyApp,
   NavigateToAppOptions,
   PublicAppInfo,
-  PublicLegacyAppInfo,
   // Internal types
   InternalApplicationSetup,
   InternalApplicationStart,
diff --git a/src/core/public/application/integration_tests/application_service.test.tsx b/src/core/public/application/integration_tests/application_service.test.tsx
index b0419d276dfa18..d28486928b7e24 100644
--- a/src/core/public/application/integration_tests/application_service.test.tsx
+++ b/src/core/public/application/integration_tests/application_service.test.tsx
@@ -25,11 +25,11 @@ import { createRenderer } from './utils';
 import { ApplicationService } from '../application_service';
 import { httpServiceMock } from '../../http/http_service.mock';
 import { contextServiceMock } from '../../context/context_service.mock';
-import { injectedMetadataServiceMock } from '../../injected_metadata/injected_metadata_service.mock';
 import { MockLifecycle } from '../test_types';
 import { overlayServiceMock } from '../../overlays/overlay_service.mock';
 import { AppMountParameters } from '../types';
-import { ScopedHistory } from '../scoped_history';
+import { Observable } from 'rxjs';
+import { MountPoint } from 'kibana/public';
 
 const flushPromises = () => new Promise((resolve) => setImmediate(resolve));
 
@@ -54,10 +54,8 @@ describe('ApplicationService', () => {
     setupDeps = {
       http,
       context: contextServiceMock.createSetupContract(),
-      injectedMetadata: injectedMetadataServiceMock.createSetupContract(),
       history: history as any,
     };
-    setupDeps.injectedMetadata.getLegacyMode.mockReturnValue(false);
     startDeps = { http, overlays: overlayServiceMock.createStartContract() };
     service = new ApplicationService();
   });
@@ -147,54 +145,6 @@ describe('ApplicationService', () => {
     });
   });
 
-  describe('redirects', () => {
-    beforeAll(() => {
-      Object.defineProperty(window, 'location', {
-        value: {
-          reload: jest.fn(),
-        },
-      });
-    });
-
-    it('to full path when navigating to legacy app', async () => {
-      const redirectTo = jest.fn();
-
-      // In the real application, we use a BrowserHistory instance configured with `basename`. However, in tests we must
-      // use MemoryHistory which does not support `basename`. In order to emulate this behavior, we will wrap this
-      // instance with a ScopedHistory configured with a basepath.
-      history.push(setupDeps.http.basePath.get()); // ScopedHistory constructor will fail if underlying history is not currently at basePath.
-      const { register, registerLegacyApp } = service.setup({
-        ...setupDeps,
-        redirectTo,
-        history: new ScopedHistory(history, setupDeps.http.basePath.get()),
-      });
-
-      register(Symbol(), {
-        id: 'app1',
-        title: 'App1',
-        mount: ({ onAppLeave }: AppMountParameters) => {
-          onAppLeave((actions) => actions.default());
-          return () => undefined;
-        },
-      });
-      registerLegacyApp({
-        id: 'myLegacyTestApp',
-        appUrl: '/app/myLegacyTestApp',
-        title: 'My Legacy Test App',
-      });
-
-      const { navigateToApp, getComponent } = await service.start(startDeps);
-
-      update = createRenderer(getComponent());
-
-      await navigate('/test/app/app1');
-      await act(() => navigateToApp('myLegacyTestApp', { path: '#/some-path' }));
-
-      expect(redirectTo).toHaveBeenCalledWith('/test/app/myLegacyTestApp#/some-path');
-      expect(window.location.reload).toHaveBeenCalled();
-    });
-  });
-
   describe('leaving an application that registered an app leave handler', () => {
     it('navigates to the new app if action is default', async () => {
       startDeps.overlays.openConfirm.mockResolvedValue(true);
@@ -309,4 +259,189 @@ describe('ApplicationService', () => {
       expect(history.entries[1].pathname).toEqual('/app/app1');
     });
   });
+
+  describe('registering action menus', () => {
+    const getValue = (obs: Observable<MountPoint | undefined>): Promise<MountPoint | undefined> => {
+      return obs.pipe(take(1)).toPromise();
+    };
+
+    const mounter1: MountPoint = () => () => undefined;
+    const mounter2: MountPoint = () => () => undefined;
+
+    it('updates the observable value when an application is mounted', async () => {
+      const { register } = service.setup(setupDeps);
+
+      register(Symbol(), {
+        id: 'app1',
+        title: 'App1',
+        mount: async ({ setHeaderActionMenu }: AppMountParameters) => {
+          setHeaderActionMenu(mounter1);
+          return () => undefined;
+        },
+      });
+
+      const { navigateToApp, getComponent, currentActionMenu$ } = await service.start(startDeps);
+      update = createRenderer(getComponent());
+
+      expect(await getValue(currentActionMenu$)).toBeUndefined();
+
+      await act(async () => {
+        await navigateToApp('app1');
+        await flushPromises();
+      });
+
+      expect(await getValue(currentActionMenu$)).toBe(mounter1);
+    });
+
+    it('updates the observable value when switching application', async () => {
+      const { register } = service.setup(setupDeps);
+
+      register(Symbol(), {
+        id: 'app1',
+        title: 'App1',
+        mount: async ({ setHeaderActionMenu }: AppMountParameters) => {
+          setHeaderActionMenu(mounter1);
+          return () => undefined;
+        },
+      });
+      register(Symbol(), {
+        id: 'app2',
+        title: 'App2',
+        mount: async ({ setHeaderActionMenu }: AppMountParameters) => {
+          setHeaderActionMenu(mounter2);
+          return () => undefined;
+        },
+      });
+
+      const { navigateToApp, getComponent, currentActionMenu$ } = await service.start(startDeps);
+      update = createRenderer(getComponent());
+
+      await act(async () => {
+        await navigateToApp('app1');
+        await flushPromises();
+      });
+
+      expect(await getValue(currentActionMenu$)).toBe(mounter1);
+
+      await act(async () => {
+        await navigateToApp('app2');
+        await flushPromises();
+      });
+
+      expect(await getValue(currentActionMenu$)).toBe(mounter2);
+    });
+
+    it('updates the observable value to undefined when switching to an application without action menu', async () => {
+      const { register } = service.setup(setupDeps);
+
+      register(Symbol(), {
+        id: 'app1',
+        title: 'App1',
+        mount: async ({ setHeaderActionMenu }: AppMountParameters) => {
+          setHeaderActionMenu(mounter1);
+          return () => undefined;
+        },
+      });
+      register(Symbol(), {
+        id: 'app2',
+        title: 'App2',
+        mount: async ({}: AppMountParameters) => {
+          return () => undefined;
+        },
+      });
+
+      const { navigateToApp, getComponent, currentActionMenu$ } = await service.start(startDeps);
+      update = createRenderer(getComponent());
+
+      await act(async () => {
+        await navigateToApp('app1');
+        await flushPromises();
+      });
+
+      expect(await getValue(currentActionMenu$)).toBe(mounter1);
+
+      await act(async () => {
+        await navigateToApp('app2');
+        await flushPromises();
+      });
+
+      expect(await getValue(currentActionMenu$)).toBeUndefined();
+    });
+
+    it('allow applications to call `setHeaderActionMenu` multiple times', async () => {
+      const { register } = service.setup(setupDeps);
+
+      let resolveMount: () => void;
+      const promise = new Promise((resolve) => {
+        resolveMount = resolve;
+      });
+
+      register(Symbol(), {
+        id: 'app1',
+        title: 'App1',
+        mount: async ({ setHeaderActionMenu }: AppMountParameters) => {
+          setHeaderActionMenu(mounter1);
+          promise.then(() => {
+            setHeaderActionMenu(mounter2);
+          });
+          return () => undefined;
+        },
+      });
+
+      const { navigateToApp, getComponent, currentActionMenu$ } = await service.start(startDeps);
+      update = createRenderer(getComponent());
+
+      await act(async () => {
+        await navigateToApp('app1');
+        await flushPromises();
+      });
+
+      expect(await getValue(currentActionMenu$)).toBe(mounter1);
+
+      await act(async () => {
+        resolveMount();
+        await flushPromises();
+      });
+
+      expect(await getValue(currentActionMenu$)).toBe(mounter2);
+    });
+
+    it('allow applications to unset the current menu', async () => {
+      const { register } = service.setup(setupDeps);
+
+      let resolveMount: () => void;
+      const promise = new Promise((resolve) => {
+        resolveMount = resolve;
+      });
+
+      register(Symbol(), {
+        id: 'app1',
+        title: 'App1',
+        mount: async ({ setHeaderActionMenu }: AppMountParameters) => {
+          setHeaderActionMenu(mounter1);
+          promise.then(() => {
+            setHeaderActionMenu(undefined);
+          });
+          return () => undefined;
+        },
+      });
+
+      const { navigateToApp, getComponent, currentActionMenu$ } = await service.start(startDeps);
+      update = createRenderer(getComponent());
+
+      await act(async () => {
+        await navigateToApp('app1');
+        await flushPromises();
+      });
+
+      expect(await getValue(currentActionMenu$)).toBe(mounter1);
+
+      await act(async () => {
+        resolveMount();
+        await flushPromises();
+      });
+
+      expect(await getValue(currentActionMenu$)).toBeUndefined();
+    });
+  });
 });
diff --git a/src/core/public/application/integration_tests/router.test.tsx b/src/core/public/application/integration_tests/router.test.tsx
index f992e121437a96..e3f992990f9f95 100644
--- a/src/core/public/application/integration_tests/router.test.tsx
+++ b/src/core/public/application/integration_tests/router.test.tsx
@@ -22,13 +22,12 @@ import { BehaviorSubject } from 'rxjs';
 import { createMemoryHistory, History, createHashHistory } from 'history';
 
 import { AppRouter, AppNotFound } from '../ui';
-import { EitherApp, MockedMounterMap, MockedMounterTuple } from '../test_types';
-import { createRenderer, createAppMounter, createLegacyAppMounter, getUnmounter } from './utils';
+import { MockedMounterMap, MockedMounterTuple } from '../test_types';
+import { createRenderer, createAppMounter, getUnmounter } from './utils';
 import { AppStatus } from '../types';
-import { ScopedHistory } from '../scoped_history';
 
 describe('AppRouter', () => {
-  let mounters: MockedMounterMap<EitherApp>;
+  let mounters: MockedMounterMap;
   let globalHistory: History;
   let update: ReturnType<typeof createRenderer>;
   let scopedAppHistory: History;
@@ -59,6 +58,7 @@ describe('AppRouter', () => {
         mounters={mockMountersToMounters()}
         appStatuses$={mountersToAppStatus$()}
         setAppLeaveHandler={noop}
+        setAppActionMenu={noop}
         setIsMounting={noop}
       />
     );
@@ -66,9 +66,7 @@ describe('AppRouter', () => {
   beforeEach(() => {
     mounters = new Map([
       createAppMounter({ appId: 'app1', html: '<span>App 1</span>' }),
-      createLegacyAppMounter('legacyApp1', jest.fn()),
       createAppMounter({ appId: 'app2', html: '<div>App 2</div>' }),
-      createLegacyAppMounter('baseApp:legacyApp2', jest.fn()),
       createAppMounter({
         appId: 'app3',
         html: '<div>Chromeless A</div>',
@@ -80,7 +78,6 @@ describe('AppRouter', () => {
         appRoute: '/chromeless-b/path',
       }),
       createAppMounter({ appId: 'disabledApp', html: '<div>Disabled app</div>' }),
-      createLegacyAppMounter('disabledLegacyApp', jest.fn()),
       createAppMounter({
         appId: 'scopedApp',
         extraMountHook: ({ history }) => {
@@ -98,7 +95,7 @@ describe('AppRouter', () => {
         html: '<div>App 6</div>',
         appRoute: '/app/my-app/app6',
       }),
-    ] as Array<MockedMounterTuple<EitherApp>>);
+    ] as MockedMounterTuple[]);
     globalHistory = createMemoryHistory();
     update = createMountersRenderer();
   });
@@ -383,26 +380,6 @@ describe('AppRouter', () => {
     expect(globalHistory.location.pathname).toEqual('/app/scopedApp/subpath');
   });
 
-  it('calls legacy mount handler', async () => {
-    await navigate('/app/legacyApp1');
-    expect(mounters.get('legacyApp1')!.mounter.mount.mock.calls[0][0]).toMatchObject({
-      appBasePath: '/app/legacyApp1',
-      element: expect.any(HTMLDivElement),
-      onAppLeave: expect.any(Function),
-      history: expect.any(ScopedHistory),
-    });
-  });
-
-  it('handles legacy apps with subapps', async () => {
-    await navigate('/app/baseApp');
-    expect(mounters.get('baseApp:legacyApp2')!.mounter.mount.mock.calls[0][0]).toMatchObject({
-      appBasePath: '/app/baseApp',
-      element: expect.any(HTMLDivElement),
-      onAppLeave: expect.any(Function),
-      history: expect.any(ScopedHistory),
-    });
-  });
-
   it('displays error page if no app is found', async () => {
     const dom = await navigate('/app/unknown');
 
@@ -414,10 +391,4 @@ describe('AppRouter', () => {
 
     expect(dom?.exists(AppNotFound)).toBe(true);
   });
-
-  it('displays error page if legacy app is inaccessible', async () => {
-    const dom = await navigate('/app/disabledLegacyApp');
-
-    expect(dom?.exists(AppNotFound)).toBe(true);
-  });
 });
diff --git a/src/core/public/application/integration_tests/utils.tsx b/src/core/public/application/integration_tests/utils.tsx
index 80a7fc2c2cad60..2ed9e0c495fb90 100644
--- a/src/core/public/application/integration_tests/utils.tsx
+++ b/src/core/public/application/integration_tests/utils.tsx
@@ -20,11 +20,10 @@
 import React, { ReactElement } from 'react';
 import { act } from 'react-dom/test-utils';
 import { mount } from 'enzyme';
-
 import { I18nProvider } from '@kbn/i18n/react';
 
-import { App, LegacyApp, AppMountParameters } from '../types';
-import { EitherApp, MockedMounter, MockedMounterTuple, Mountable } from '../test_types';
+import { AppMountParameters } from '../types';
+import { MockedMounterTuple, Mountable } from '../test_types';
 
 type Dom = ReturnType<typeof mount> | null;
 type Renderer = () => Dom | Promise<Dom>;
@@ -55,7 +54,7 @@ export const createAppMounter = ({
   appRoute?: string;
   exactRoute?: boolean;
   extraMountHook?: (params: AppMountParameters) => void;
-}): MockedMounterTuple<App> => {
+}): MockedMounterTuple => {
   const unmount = jest.fn();
   return [
     appId,
@@ -63,7 +62,6 @@ export const createAppMounter = ({
       mounter: {
         appRoute,
         appBasePath: appRoute,
-        legacy: false,
         exactRoute,
         mount: jest.fn(async (params: AppMountParameters) => {
           const { appBasePath: basename, element } = params;
@@ -82,24 +80,6 @@ export const createAppMounter = ({
   ];
 };
 
-export const createLegacyAppMounter = (
-  appId: string,
-  legacyMount: MockedMounter<LegacyApp>['mount']
-): MockedMounterTuple<LegacyApp> => [
-  appId,
-  {
-    mounter: {
-      appRoute: `/app/${appId.split(':')[0]}`,
-      appBasePath: `/app/${appId.split(':')[0]}`,
-      unmountBeforeMounting: true,
-      legacy: true,
-      exactRoute: false,
-      mount: legacyMount,
-    },
-    unmount: jest.fn(),
-  },
-];
-
-export function getUnmounter(app: Mountable<EitherApp>) {
+export function getUnmounter(app: Mountable) {
   return app.mounter.mount.mock.results[0].value;
 }
diff --git a/src/core/public/application/test_types.ts b/src/core/public/application/test_types.ts
index b822597e510cb9..64012f0c0b6c15 100644
--- a/src/core/public/application/test_types.ts
+++ b/src/core/public/application/test_types.ts
@@ -17,28 +17,26 @@
  * under the License.
  */
 
-import { App, LegacyApp, Mounter, AppUnmount } from './types';
+import { AppUnmount, Mounter } from './types';
 import { ApplicationService } from './application_service';
 
 /** @internal */
 export type ApplicationServiceContract = PublicMethodsOf<ApplicationService>;
 /** @internal */
-export type EitherApp = App | LegacyApp;
-/** @internal */
 export type MockedUnmount = jest.Mocked<AppUnmount>;
 
 /** @internal */
-export interface Mountable<T extends EitherApp> {
-  mounter: MockedMounter<T>;
+export interface Mountable {
+  mounter: MockedMounter;
   unmount: MockedUnmount;
 }
 
 /** @internal */
-export type MockedMounter<T extends EitherApp> = jest.Mocked<Mounter<jest.Mocked<T>>>;
+export type MockedMounter = jest.Mocked<Mounter>;
 /** @internal */
-export type MockedMounterTuple<T extends EitherApp> = [string, Mountable<T>];
+export type MockedMounterTuple = [string, Mountable];
 /** @internal */
-export type MockedMounterMap<T extends EitherApp> = Map<string, Mountable<T>>;
+export type MockedMounterMap = Map<string, Mountable>;
 /** @internal */
 export type MockLifecycle<
   T extends keyof ApplicationService,
diff --git a/src/core/public/application/types.ts b/src/core/public/application/types.ts
index 0fe97431b15690..df83b6e932aad9 100644
--- a/src/core/public/application/types.ts
+++ b/src/core/public/application/types.ts
@@ -21,6 +21,7 @@ import { Observable } from 'rxjs';
 import { History } from 'history';
 import { RecursiveReadonly } from '@kbn/utility-types';
 
+import { MountPoint } from '../types';
 import { Capabilities } from './capabilities';
 import { ChromeStart } from '../chrome';
 import { IContextProvider } from '../context';
@@ -35,8 +36,64 @@ import { SavedObjectsStart } from '../saved_objects';
 import { AppCategory } from '../../types';
 import { ScopedHistory } from './scoped_history';
 
-/** @public */
-export interface AppBase {
+/**
+ * Accessibility status of an application.
+ *
+ * @public
+ */
+export enum AppStatus {
+  /**
+   * Application is accessible.
+   */
+  accessible = 0,
+  /**
+   * Application is not accessible.
+   */
+  inaccessible = 1,
+}
+
+/**
+ * Status of the application's navLink.
+ *
+ * @public
+ */
+export enum AppNavLinkStatus {
+  /**
+   * The application navLink will be `visible` if the application's {@link AppStatus} is set to `accessible`
+   * and `hidden` if the application status is set to `inaccessible`.
+   */
+  default = 0,
+  /**
+   * The application navLink is visible and clickable in the navigation bar.
+   */
+  visible = 1,
+  /**
+   * The application navLink is visible but inactive and not clickable in the navigation bar.
+   */
+  disabled = 2,
+  /**
+   * The application navLink does not appear in the navigation bar.
+   */
+  hidden = 3,
+}
+
+/**
+ * Defines the list of fields that can be updated via an {@link AppUpdater}.
+ * @public
+ */
+export type AppUpdatableFields = Pick<App, 'status' | 'navLinkStatus' | 'tooltip' | 'defaultPath'>;
+
+/**
+ * Updater for applications.
+ * see {@link ApplicationSetup}
+ * @public
+ */
+export type AppUpdater = (app: App) => Partial<AppUpdatableFields> | undefined;
+
+/**
+ * @public
+ */
+export interface App<HistoryLocationState = unknown> {
   /**
    * The unique identifier of the application
    */
@@ -135,83 +192,12 @@ export interface AppBase {
    */
   capabilities?: Partial<Capabilities>;
 
-  /**
-   * Flag to keep track of legacy applications.
-   * For internal use only. any value will be overridden when registering an App.
-   *
-   * @internal
-   */
-  legacy?: boolean;
-
   /**
    * Hide the UI chrome when the application is mounted. Defaults to `false`.
    * Takes precedence over chrome service visibility settings.
    */
   chromeless?: boolean;
-}
 
-/**
- * Accessibility status of an application.
- *
- * @public
- */
-export enum AppStatus {
-  /**
-   * Application is accessible.
-   */
-  accessible = 0,
-  /**
-   * Application is not accessible.
-   */
-  inaccessible = 1,
-}
-
-/**
- * Status of the application's navLink.
- *
- * @public
- */
-export enum AppNavLinkStatus {
-  /**
-   * The application navLink will be `visible` if the application's {@link AppStatus} is set to `accessible`
-   * and `hidden` if the application status is set to `inaccessible`.
-   */
-  default = 0,
-  /**
-   * The application navLink is visible and clickable in the navigation bar.
-   */
-  visible = 1,
-  /**
-   * The application navLink is visible but inactive and not clickable in the navigation bar.
-   */
-  disabled = 2,
-  /**
-   * The application navLink does not appear in the navigation bar.
-   */
-  hidden = 3,
-}
-
-/**
- * Defines the list of fields that can be updated via an {@link AppUpdater}.
- * @public
- */
-export type AppUpdatableFields = Pick<
-  AppBase,
-  'status' | 'navLinkStatus' | 'tooltip' | 'defaultPath'
->;
-
-/**
- * Updater for applications.
- * see {@link ApplicationSetup}
- * @public
- */
-export type AppUpdater = (app: AppBase) => Partial<AppUpdatableFields> | undefined;
-
-/**
- * Extension of {@link AppBase | common app properties} with the mount function.
- * @public
- */
-export interface App<HistoryLocationState = unknown> extends AppBase {
   /**
    * A mount function called when the user navigates to this app's route. May have signature of {@link AppMount} or
    * {@link AppMountDeprecated}.
@@ -222,12 +208,6 @@ export interface App<HistoryLocationState = unknown> extends AppBase {
    */
   mount: AppMount<HistoryLocationState> | AppMountDeprecated<HistoryLocationState>;
 
-  /**
-   * Hide the UI chrome when the application is mounted. Defaults to `false`.
-   * Takes precedence over chrome service visibility settings.
-   */
-  chromeless?: boolean;
-
   /**
    * Override the application's routing path from `/app/${id}`.
    * Must be unique across registered applications. Should not include the
@@ -254,39 +234,18 @@ export interface App<HistoryLocationState = unknown> extends AppBase {
   exactRoute?: boolean;
 }
 
-/** @public */
-export interface LegacyApp extends AppBase {
-  appUrl: string;
-  subUrlBase?: string;
-  linkToLastSubUrl?: boolean;
-  disableSubUrlTracking?: boolean;
-}
-
 /**
  * Public information about a registered {@link App | application}
  *
  * @public
  */
 export type PublicAppInfo = Omit<App, 'mount' | 'updater$'> & {
-  legacy: false;
   // remove optional on fields populated with default values
   status: AppStatus;
   navLinkStatus: AppNavLinkStatus;
   appRoute: string;
 };
 
-/**
- * Information about a registered {@link LegacyApp | legacy application}
- *
- * @public
- */
-export type PublicLegacyAppInfo = Omit<LegacyApp, 'updater$'> & {
-  legacy: true;
-  // remove optional on fields populated with default values
-  status: AppStatus;
-  navLinkStatus: AppNavLinkStatus;
-};
-
 /**
  * A mount function called when the user navigates to this app's route.
  *
@@ -299,6 +258,12 @@ export type AppMount<HistoryLocationState = unknown> = (
   params: AppMountParameters<HistoryLocationState>
 ) => AppUnmount | Promise<AppUnmount>;
 
+/**
+ * A function called when an application should be unmounted from the page. This function should be synchronous.
+ * @public
+ */
+export type AppUnmount = () => void;
+
 /**
  * A mount function called when the user navigates to this app's route.
  *
@@ -495,6 +460,37 @@ export interface AppMountParameters<HistoryLocationState = unknown> {
    * ```
    */
   onAppLeave: (handler: AppLeaveHandler) => void;
+
+  /**
+   * A function that can be used to set the mount point used to populate the application action container
+   * in the chrome header.
+   *
+   * Calling the handler multiple time will erase the current content of the action menu with the mount from the latest call.
+   * Calling the handler with `undefined` will unmount the current mount point.
+   * Calling the handler after the application has been unmounted will have no effect.
+   *
+   * @example
+   *
+   * ```ts
+   * // application.tsx
+   * import React from 'react';
+   * import ReactDOM from 'react-dom';
+   * import { BrowserRouter, Route } from 'react-router-dom';
+   *
+   * import { CoreStart, AppMountParameters } from 'src/core/public';
+   * import { MyPluginDepsStart } from './plugin';
+   *
+   * export renderApp = ({ element, history, setHeaderActionMenu }: AppMountParameters) => {
+   *    const { renderApp } = await import('./application');
+   *    const { renderActionMenu } = await import('./action_menu');
+   *    setHeaderActionMenu((element) => {
+   *      return renderActionMenu(element);
+   *    })
+   *    return renderApp({ element, history });
+   * }
+   * ```
+   */
+  setHeaderActionMenu: (menuMount: MountPoint | undefined) => void;
 }
 
 /**
@@ -575,30 +571,14 @@ export interface AppLeaveActionFactory {
   default(): AppLeaveDefaultAction;
 }
 
-/**
- * A function called when an application should be unmounted from the page. This function should be synchronous.
- * @public
- */
-export type AppUnmount = () => void;
-
-/** @internal */
-export type AppMounter = (params: AppMountParameters) => Promise<AppUnmount>;
-
-/** @internal */
-export type LegacyAppMounter = (params: AppMountParameters) => void;
-
 /** @internal */
-export type Mounter<T = App | LegacyApp> = SelectivePartial<
-  {
-    appRoute: string;
-    appBasePath: string;
-    mount: T extends LegacyApp ? LegacyAppMounter : AppMounter;
-    legacy: boolean;
-    exactRoute: boolean;
-    unmountBeforeMounting: T extends LegacyApp ? true : boolean;
-  },
-  T extends LegacyApp ? never : 'unmountBeforeMounting'
->;
+export interface Mounter {
+  appRoute: string;
+  appBasePath: string;
+  mount: AppMount;
+  exactRoute: boolean;
+  unmountBeforeMounting?: boolean;
+}
 
 /** @internal */
 export interface ParsedAppUrl {
@@ -670,13 +650,6 @@ export interface InternalApplicationSetup extends Pick<ApplicationSetup, 'regist
     app: App<HistoryLocationState>
   ): void;
 
-  /**
-   * Register metadata about legacy applications. Legacy apps will not be mounted when navigated to.
-   * @param app
-   * @internal
-   */
-  registerLegacyApp(app: LegacyApp): void;
-
   /**
    * Register a context provider for application mounting. Will only be available to applications that depend on the
    * plugin that registered this context. Deprecated, use {@link CoreSetup.getStartServices}.
@@ -699,7 +672,7 @@ export interface InternalApplicationSetup extends Pick<ApplicationSetup, 'regist
 export interface NavigateToAppOptions {
   /**
    * optional path inside application to deep link to.
-   * If undefined, will use {@link AppBase.defaultPath | the app's default path}` as default.
+   * If undefined, will use {@link App.defaultPath | the app's default path}` as default.
    */
   path?: string;
   /**
@@ -708,9 +681,6 @@ export interface NavigateToAppOptions {
   state?: unknown;
   /**
    * if true, will not create a new history entry when navigating (using `replace` instead of `push`)
-   *
-   * @remarks
-   * This option not be used when navigating from and/or to legacy applications.
    */
   replace?: boolean;
 }
@@ -729,7 +699,7 @@ export interface ApplicationStart {
    * Applications disabled by {@link Capabilities} will not be present in the map. Applications manually disabled from
    * the client-side using an {@link AppUpdater | application updater} are present, with their status properly set as `inaccessible`.
    */
-  applications$: Observable<ReadonlyMap<string, PublicAppInfo | PublicLegacyAppInfo>>;
+  applications$: Observable<ReadonlyMap<string, PublicAppInfo>>;
 
   /**
    * Navigate to a given app
@@ -821,14 +791,16 @@ export interface InternalApplicationStart extends Omit<ApplicationStart, 'regist
   getComponent(): JSX.Element | null;
 
   /**
-   * The global history instance, exposed only to Core. Undefined when rendering a legacy application.
+   * The potential action menu set by the currently mounted app.
+   * Consumed by the chrome header.
+   *
    * @internal
    */
-  history: History<unknown> | undefined;
-}
+  currentActionMenu$: Observable<MountPoint | undefined>;
 
-/** @internal */
-type SelectivePartial<T, K extends keyof T> = Partial<Pick<T, K>> &
-  Required<Pick<T, Exclude<keyof T, K>>> extends infer U
-  ? { [P in keyof U]: U[P] }
-  : never;
+  /**
+   * The global history instance, exposed only to Core.
+   * @internal
+   */
+  history: History<unknown>;
+}
diff --git a/src/core/public/application/ui/app_container.test.tsx b/src/core/public/application/ui/app_container.test.tsx
index a94313dd53abbc..f6cde54e6f5025 100644
--- a/src/core/public/application/ui/app_container.test.tsx
+++ b/src/core/public/application/ui/app_container.test.tsx
@@ -29,6 +29,7 @@ import { ScopedHistory } from '../scoped_history';
 describe('AppContainer', () => {
   const appId = 'someApp';
   const setAppLeaveHandler = jest.fn();
+  const setAppActionMenu = jest.fn();
   const setIsMounting = jest.fn();
 
   beforeEach(() => {
@@ -54,7 +55,6 @@ describe('AppContainer', () => {
     appBasePath: '/base-path',
     appRoute: '/some-route',
     unmountBeforeMounting: false,
-    legacy: false,
     exactRoute: false,
     mount: async ({ element }: AppMountParameters) => {
       await promise;
@@ -76,6 +76,7 @@ describe('AppContainer', () => {
         appStatus={AppStatus.inaccessible}
         mounter={mounter}
         setAppLeaveHandler={setAppLeaveHandler}
+        setAppActionMenu={setAppActionMenu}
         setIsMounting={setIsMounting}
         createScopedHistory={(appPath: string) =>
           // Create a history using the appPath as the current location
@@ -116,6 +117,7 @@ describe('AppContainer', () => {
         appStatus={AppStatus.accessible}
         mounter={mounter}
         setAppLeaveHandler={setAppLeaveHandler}
+        setAppActionMenu={setAppActionMenu}
         setIsMounting={setIsMounting}
         createScopedHistory={(appPath: string) =>
           // Create a history using the appPath as the current location
@@ -143,7 +145,6 @@ describe('AppContainer', () => {
       appBasePath: '/base-path/some-route',
       appRoute: '/some-route',
       unmountBeforeMounting: false,
-      legacy: false,
       exactRoute: false,
       mount: async ({ element }: AppMountParameters) => {
         await waitPromise;
@@ -158,6 +159,7 @@ describe('AppContainer', () => {
         appStatus={AppStatus.accessible}
         mounter={mounter}
         setAppLeaveHandler={setAppLeaveHandler}
+        setAppActionMenu={setAppActionMenu}
         setIsMounting={setIsMounting}
         createScopedHistory={(appPath: string) =>
           // Create a history using the appPath as the current location
diff --git a/src/core/public/application/ui/app_container.tsx b/src/core/public/application/ui/app_container.tsx
index 332c31c64b6ba1..f668cf851da55f 100644
--- a/src/core/public/application/ui/app_container.tsx
+++ b/src/core/public/application/ui/app_container.tsx
@@ -25,8 +25,9 @@ import React, {
   useState,
   MutableRefObject,
 } from 'react';
-
 import { EuiLoadingSpinner } from '@elastic/eui';
+
+import type { MountPoint } from '../../types';
 import { AppLeaveHandler, AppStatus, AppUnmount, Mounter } from '../types';
 import { AppNotFound } from './app_not_found_screen';
 import { ScopedHistory } from '../scoped_history';
@@ -39,6 +40,7 @@ interface Props {
   mounter?: Mounter;
   appStatus: AppStatus;
   setAppLeaveHandler: (appId: string, handler: AppLeaveHandler) => void;
+  setAppActionMenu: (appId: string, mount: MountPoint | undefined) => void;
   createScopedHistory: (appUrl: string) => ScopedHistory;
   setIsMounting: (isMounting: boolean) => void;
 }
@@ -48,6 +50,7 @@ export const AppContainer: FunctionComponent<Props> = ({
   appId,
   appPath,
   setAppLeaveHandler,
+  setAppActionMenu,
   createScopedHistory,
   appStatus,
   setIsMounting,
@@ -84,6 +87,7 @@ export const AppContainer: FunctionComponent<Props> = ({
             history: createScopedHistory(appPath),
             element: elementRef.current!,
             onAppLeave: (handler) => setAppLeaveHandler(appId, handler),
+            setHeaderActionMenu: (menuMount) => setAppActionMenu(appId, menuMount),
           })) || null;
       } catch (e) {
         // TODO: add error UI
@@ -98,7 +102,16 @@ export const AppContainer: FunctionComponent<Props> = ({
     mount();
 
     return unmount;
-  }, [appId, appStatus, mounter, createScopedHistory, setAppLeaveHandler, appPath, setIsMounting]);
+  }, [
+    appId,
+    appStatus,
+    mounter,
+    createScopedHistory,
+    setAppLeaveHandler,
+    setAppActionMenu,
+    appPath,
+    setIsMounting,
+  ]);
 
   return (
     <Fragment>
diff --git a/src/core/public/application/ui/app_router.tsx b/src/core/public/application/ui/app_router.tsx
index f1f22237c32db0..42bc9a53aee2dd 100644
--- a/src/core/public/application/ui/app_router.tsx
+++ b/src/core/public/application/ui/app_router.tsx
@@ -23,6 +23,7 @@ import { History } from 'history';
 import { Observable } from 'rxjs';
 import useObservable from 'react-use/lib/useObservable';
 
+import type { MountPoint } from '../../types';
 import { AppLeaveHandler, AppStatus, Mounter } from '../types';
 import { AppContainer } from './app_container';
 import { ScopedHistory } from '../scoped_history';
@@ -32,6 +33,7 @@ interface Props {
   history: History;
   appStatuses$: Observable<Map<string, AppStatus>>;
   setAppLeaveHandler: (appId: string, handler: AppLeaveHandler) => void;
+  setAppActionMenu: (appId: string, mount: MountPoint | undefined) => void;
   setIsMounting: (isMounting: boolean) => void;
 }
 
@@ -43,6 +45,7 @@ export const AppRouter: FunctionComponent<Props> = ({
   history,
   mounters,
   setAppLeaveHandler,
+  setAppActionMenu,
   appStatuses$,
   setIsMounting,
 }) => {
@@ -55,25 +58,21 @@ export const AppRouter: FunctionComponent<Props> = ({
   return (
     <Router history={history}>
       <Switch>
-        {[...mounters]
-          // legacy apps can have multiple sub-apps registered with the same route
-          // which needs additional logic that is handled in the catch-all route below
-          .filter(([_, mounter]) => !mounter.legacy)
-          .map(([appId, mounter]) => (
-            <Route
-              key={mounter.appRoute}
-              path={mounter.appRoute}
-              exact={mounter.exactRoute}
-              render={({ match: { path } }) => (
-                <AppContainer
-                  appPath={path}
-                  appStatus={appStatuses.get(appId) ?? AppStatus.inaccessible}
-                  createScopedHistory={createScopedHistory}
-                  {...{ appId, mounter, setAppLeaveHandler, setIsMounting }}
-                />
-              )}
-            />
-          ))}
+        {[...mounters].map(([appId, mounter]) => (
+          <Route
+            key={mounter.appRoute}
+            path={mounter.appRoute}
+            exact={mounter.exactRoute}
+            render={({ match: { path } }) => (
+              <AppContainer
+                appPath={path}
+                appStatus={appStatuses.get(appId) ?? AppStatus.inaccessible}
+                createScopedHistory={createScopedHistory}
+                {...{ appId, mounter, setAppLeaveHandler, setAppActionMenu, setIsMounting }}
+              />
+            )}
+          />
+        ))}
         {/* handler for legacy apps and used as a catch-all to display 404 page on not existing /app/appId apps*/}
         <Route
           path="/app/:appId"
@@ -83,18 +82,15 @@ export const AppRouter: FunctionComponent<Props> = ({
               url,
             },
           }: RouteComponentProps<Params>) => {
-            // Find the mounter including legacy mounters with subapps:
-            const [id, mounter] = mounters.has(appId)
-              ? [appId, mounters.get(appId)]
-              : [...mounters].filter(([key]) => key.split(':')[0] === appId)[0] ?? [];
-
+            // the id/mounter retrieval can be removed once #76348 is addressed
+            const [id, mounter] = mounters.has(appId) ? [appId, mounters.get(appId)] : [];
             return (
               <AppContainer
                 appPath={url}
-                appId={id}
-                appStatus={appStatuses.get(id) ?? AppStatus.inaccessible}
+                appId={id ?? appId}
+                appStatus={appStatuses.get(appId) ?? AppStatus.inaccessible}
                 createScopedHistory={createScopedHistory}
-                {...{ mounter, setAppLeaveHandler, setIsMounting }}
+                {...{ mounter, setAppLeaveHandler, setAppActionMenu, setIsMounting }}
               />
             );
           }}
diff --git a/src/core/public/application/utils.test.ts b/src/core/public/application/utils.test.ts
index 4663ca2db21e70..ee1d82a7a872e1 100644
--- a/src/core/public/application/utils.test.ts
+++ b/src/core/public/application/utils.test.ts
@@ -18,16 +18,9 @@
  */
 
 import { of } from 'rxjs';
-import { App, AppNavLinkStatus, AppStatus, LegacyApp } from './types';
+import { App, AppNavLinkStatus, AppStatus } from './types';
 import { BasePath } from '../http/base_path';
-import {
-  appendAppPath,
-  getAppInfo,
-  isLegacyApp,
-  parseAppUrl,
-  relativeToAbsolute,
-  removeSlashes,
-} from './utils';
+import { appendAppPath, getAppInfo, parseAppUrl, relativeToAbsolute, removeSlashes } from './utils';
 
 describe('removeSlashes', () => {
   it('only removes duplicates by default', () => {
@@ -70,9 +63,11 @@ describe('appendAppPath', () => {
     expect(appendAppPath('/app/my-app', '')).toEqual('/app/my-app');
   });
 
-  it('preserves the trailing slash only if included in the hash', () => {
+  it('preserves the trailing slash only if included in the hash or appPath', () => {
     expect(appendAppPath('/app/my-app', '/some-path/')).toEqual('/app/my-app/some-path');
     expect(appendAppPath('/app/my-app', '/some-path#/')).toEqual('/app/my-app/some-path#/');
+    expect(appendAppPath('/app/my-app#/', '')).toEqual('/app/my-app#/');
+    expect(appendAppPath('/app/my-app#', '/')).toEqual('/app/my-app#/');
     expect(appendAppPath('/app/my-app', '/some-path#/hash/')).toEqual(
       '/app/my-app/some-path#/hash/'
     );
@@ -80,29 +75,6 @@ describe('appendAppPath', () => {
   });
 });
 
-describe('isLegacyApp', () => {
-  it('returns true for legacy apps', () => {
-    expect(
-      isLegacyApp({
-        id: 'legacy',
-        title: 'Legacy App',
-        appUrl: '/some-url',
-        legacy: true,
-      })
-    ).toEqual(true);
-  });
-  it('returns false for non-legacy apps', () => {
-    expect(
-      isLegacyApp({
-        id: 'legacy',
-        title: 'Legacy App',
-        mount: () => () => undefined,
-        legacy: false,
-      })
-    ).toEqual(false);
-  });
-});
-
 describe('relativeToAbsolute', () => {
   it('converts a relative path to an absolute url', () => {
     const origin = window.location.origin;
@@ -113,7 +85,7 @@ describe('relativeToAbsolute', () => {
 });
 
 describe('parseAppUrl', () => {
-  let apps: Map<string, App<any> | LegacyApp>;
+  let apps: Map<string, App<any>>;
   let basePath: BasePath;
 
   const getOrigin = () => 'https://kibana.local:8080';
@@ -124,19 +96,6 @@ describe('parseAppUrl', () => {
       title: 'some-title',
       mount: () => () => undefined,
       ...props,
-      legacy: false,
-    };
-    apps.set(app.id, app);
-    return app;
-  };
-
-  const createLegacyApp = (props: Partial<LegacyApp>): LegacyApp => {
-    const app: LegacyApp = {
-      id: 'some-id',
-      title: 'some-title',
-      appUrl: '/my-url',
-      ...props,
-      legacy: true,
     };
     apps.set(app.id, app);
     return app;
@@ -153,10 +112,6 @@ describe('parseAppUrl', () => {
       id: 'bar',
       appRoute: '/custom-bar',
     });
-    createLegacyApp({
-      id: 'legacy',
-      appUrl: '/app/legacy',
-    });
   });
 
   describe('with relative paths', () => {
@@ -236,18 +191,6 @@ describe('parseAppUrl', () => {
         path: '/path#hash/bang?hello=dolly',
       });
     });
-    it('works with legacy apps', () => {
-      expect(parseAppUrl('/base-path/app/legacy', basePath, apps, getOrigin)).toEqual({
-        app: 'legacy',
-        path: undefined,
-      });
-      expect(
-        parseAppUrl('/base-path/app/legacy/path#hash?query=bar', basePath, apps, getOrigin)
-      ).toEqual({
-        app: 'legacy',
-        path: '/path#hash?query=bar',
-      });
-    });
     it('returns undefined when the app is not known', () => {
       expect(parseAppUrl('/base-path/app/non-registered', basePath, apps, getOrigin)).toEqual(
         undefined
@@ -409,25 +352,6 @@ describe('parseAppUrl', () => {
         path: '/path#hash/bang?hello=dolly',
       });
     });
-    it('works with legacy apps', () => {
-      expect(
-        parseAppUrl('https://kibana.local:8080/base-path/app/legacy', basePath, apps, getOrigin)
-      ).toEqual({
-        app: 'legacy',
-        path: undefined,
-      });
-      expect(
-        parseAppUrl(
-          'https://kibana.local:8080/base-path/app/legacy/path#hash?query=bar',
-          basePath,
-          apps,
-          getOrigin
-        )
-      ).toEqual({
-        app: 'legacy',
-        path: '/path#hash?query=bar',
-      });
-    });
     it('returns undefined when the app is not known', () => {
       expect(
         parseAppUrl(
@@ -471,18 +395,6 @@ describe('getAppInfo', () => {
     status: AppStatus.accessible,
     navLinkStatus: AppNavLinkStatus.default,
     appRoute: `/app/some-id`,
-    legacy: false,
-    ...props,
-  });
-
-  const createLegacyApp = (props: Partial<LegacyApp> = {}): LegacyApp => ({
-    appUrl: '/my-app-url',
-    updater$: of(() => undefined),
-    id: 'some-id',
-    title: 'some-title',
-    status: AppStatus.accessible,
-    navLinkStatus: AppNavLinkStatus.default,
-    legacy: true,
     ...props,
   });
 
@@ -496,21 +408,6 @@ describe('getAppInfo', () => {
       status: AppStatus.accessible,
       navLinkStatus: AppNavLinkStatus.visible,
       appRoute: `/app/some-id`,
-      legacy: false,
-    });
-  });
-
-  it('converts a legacy application and remove sensitive properties', () => {
-    const app = createLegacyApp();
-    const info = getAppInfo(app);
-
-    expect(info).toEqual({
-      appUrl: '/my-app-url',
-      id: 'some-id',
-      title: 'some-title',
-      status: AppStatus.accessible,
-      navLinkStatus: AppNavLinkStatus.visible,
-      legacy: true,
     });
   });
 
diff --git a/src/core/public/application/utils.ts b/src/core/public/application/utils.ts
index c5ed7b659f3aeb..85760526bf5442 100644
--- a/src/core/public/application/utils.ts
+++ b/src/core/public/application/utils.ts
@@ -18,15 +18,7 @@
  */
 
 import { IBasePath } from '../http';
-import {
-  App,
-  AppNavLinkStatus,
-  AppStatus,
-  LegacyApp,
-  ParsedAppUrl,
-  PublicAppInfo,
-  PublicLegacyAppInfo,
-} from './types';
+import { App, AppNavLinkStatus, AppStatus, ParsedAppUrl, PublicAppInfo } from './types';
 
 /**
  * Utility to remove trailing, leading or duplicate slashes.
@@ -55,8 +47,8 @@ export const removeSlashes = (
 export const appendAppPath = (appBasePath: string, path: string = '') => {
   // Only prepend slash if not a hash or query path
   path = path === '' || path.startsWith('#') || path.startsWith('?') ? path : `/${path}`;
-  // Do not remove trailing slash when in hashbang
-  const removeTrailing = path.indexOf('#') === -1;
+  // Do not remove trailing slash when in hashbang or basePath
+  const removeTrailing = path.indexOf('#') === -1 && appBasePath.indexOf('#') === -1;
   return removeSlashes(`${appBasePath}${path}`, {
     trailing: removeTrailing,
     duplicates: true,
@@ -64,10 +56,6 @@ export const appendAppPath = (appBasePath: string, path: string = '') => {
   });
 };
 
-export function isLegacyApp(app: App | LegacyApp): app is LegacyApp {
-  return app.legacy === true;
-}
-
 /**
  * Converts a relative path to an absolute url.
  * Implementation is based on a specified behavior of the browser to automatically convert
@@ -95,7 +83,7 @@ export const relativeToAbsolute = (url: string): string => {
 export const parseAppUrl = (
   url: string,
   basePath: IBasePath,
-  apps: Map<string, App<unknown> | LegacyApp>,
+  apps: Map<string, App<unknown>>,
   getOrigin: () => string = () => window.location.origin
 ): ParsedAppUrl | undefined => {
   url = removeBasePath(url, basePath, getOrigin());
@@ -104,7 +92,7 @@ export const parseAppUrl = (
   }
 
   for (const app of apps.values()) {
-    const appPath = isLegacyApp(app) ? app.appUrl : app.appRoute || `/app/${app.id}`;
+    const appPath = app.appRoute || `/app/${app.id}`;
 
     if (url.startsWith(appPath)) {
       const path = url.substr(appPath.length);
@@ -123,29 +111,18 @@ const removeBasePath = (url: string, basePath: IBasePath, origin: string): strin
   return basePath.remove(url);
 };
 
-export function getAppInfo(app: App<unknown> | LegacyApp): PublicAppInfo | PublicLegacyAppInfo {
+export function getAppInfo(app: App<unknown>): PublicAppInfo {
   const navLinkStatus =
     app.navLinkStatus === AppNavLinkStatus.default
       ? app.status === AppStatus.inaccessible
         ? AppNavLinkStatus.hidden
         : AppNavLinkStatus.visible
       : app.navLinkStatus!;
-  if (isLegacyApp(app)) {
-    const { updater$, ...infos } = app;
-    return {
-      ...infos,
-      status: app.status!,
-      navLinkStatus,
-      legacy: true,
-    };
-  } else {
-    const { updater$, mount, ...infos } = app;
-    return {
-      ...infos,
-      status: app.status!,
-      navLinkStatus,
-      appRoute: app.appRoute!,
-      legacy: false,
-    };
-  }
+  const { updater$, mount, ...infos } = app;
+  return {
+    ...infos,
+    status: app.status!,
+    navLinkStatus,
+    appRoute: app.appRoute!,
+  };
 }
diff --git a/src/core/public/chrome/chrome_service.mock.ts b/src/core/public/chrome/chrome_service.mock.ts
index c9a05ff4e08fe1..5862ee7175f717 100644
--- a/src/core/public/chrome/chrome_service.mock.ts
+++ b/src/core/public/chrome/chrome_service.mock.ts
@@ -47,9 +47,6 @@ const createStartContractMock = () => {
     docTitle: {
       change: jest.fn(),
       reset: jest.fn(),
-      __legacy: {
-        setBaseTitle: jest.fn(),
-      },
     },
     navControls: {
       registerLeft: jest.fn(),
diff --git a/src/core/public/chrome/chrome_service.tsx b/src/core/public/chrome/chrome_service.tsx
index ef9a682d609ec6..b96c34cd9fbe84 100644
--- a/src/core/public/chrome/chrome_service.tsx
+++ b/src/core/public/chrome/chrome_service.tsx
@@ -238,7 +238,6 @@ export class ChromeService {
           homeHref={http.basePath.prepend('/app/home')}
           isVisible$={this.isVisible$}
           kibanaVersion={injectedMetadata.getKibanaVersion()}
-          legacyMode={injectedMetadata.getLegacyMode()}
           navLinks$={navLinks.getNavLinks$()}
           recentlyAccessed$={recentlyAccessed.get$()}
           navControlsLeft$={navControls.getLeft$()}
diff --git a/src/core/public/chrome/doc_title/doc_title_service.test.ts b/src/core/public/chrome/doc_title/doc_title_service.test.ts
index 763e8c9ebd74a5..953baf7e7d1d5a 100644
--- a/src/core/public/chrome/doc_title/doc_title_service.test.ts
+++ b/src/core/public/chrome/doc_title/doc_title_service.test.ts
@@ -64,17 +64,4 @@ describe('DocTitleService', () => {
       expect(document.title).toEqual('InitialTitle');
     });
   });
-
-  describe('#__legacy.setBaseTitle()', () => {
-    it('allows to change the baseTitle after startup', async () => {
-      const start = getStart('InitialTitle');
-      start.change('WithInitial');
-      expect(document.title).toEqual('WithInitial - InitialTitle');
-      start.__legacy.setBaseTitle('NewBaseTitle');
-      start.change('WithNew');
-      expect(document.title).toEqual('WithNew - NewBaseTitle');
-      start.reset();
-      expect(document.title).toEqual('NewBaseTitle');
-    });
-  });
 });
diff --git a/src/core/public/chrome/doc_title/doc_title_service.ts b/src/core/public/chrome/doc_title/doc_title_service.ts
index c6e9ec7a40b77d..817a460acaf3fb 100644
--- a/src/core/public/chrome/doc_title/doc_title_service.ts
+++ b/src/core/public/chrome/doc_title/doc_title_service.ts
@@ -59,11 +59,6 @@ export interface ChromeDocTitle {
    * (meaning the one present in the title meta at application load.)
    */
   reset(): void;
-
-  /** @internal */
-  __legacy: {
-    setBaseTitle(baseTitle: string): void;
-  };
 }
 
 const defaultTitle: string[] = [];
@@ -85,11 +80,6 @@ export class DocTitleService {
       reset: () => {
         this.applyTitle(defaultTitle);
       },
-      __legacy: {
-        setBaseTitle: (baseTitle) => {
-          this.baseTitle = baseTitle;
-        },
-      },
     };
   }
 
diff --git a/src/core/public/chrome/nav_links/nav_link.ts b/src/core/public/chrome/nav_links/nav_link.ts
index 55b5c80526babd..4b82e0ced45057 100644
--- a/src/core/public/chrome/nav_links/nav_link.ts
+++ b/src/core/public/chrome/nav_links/nav_link.ts
@@ -74,54 +74,8 @@ export interface ChromeNavLink {
 
   /**
    * Settled state between `url`, `baseUrl`, and `active`
-   *
-   * @internalRemarks
-   * This should be required once legacy apps are gone.
-   */
-  readonly href?: string;
-
-  /** LEGACY FIELDS */
-
-  /**
-   * A url base that legacy apps can set to match deep URLs to an application.
-   *
-   * @internalRemarks
-   * This should be removed once legacy apps are gone.
-   *
-   * @deprecated
    */
-  readonly subUrlBase?: string;
-
-  /**
-   * A flag that tells legacy chrome to ignore the link when
-   * tracking sub-urls
-   *
-   * @internalRemarks
-   * This should be removed once legacy apps are gone.
-   *
-   * @deprecated
-   */
-  readonly disableSubUrlTracking?: boolean;
-
-  /**
-   * Whether or not the subUrl feature should be enabled.
-   *
-   * @internalRemarks
-   * Only read by legacy platform.
-   *
-   * @deprecated
-   */
-  readonly linkToLastSubUrl?: boolean;
-
-  /**
-   * Indicates whether or not this app is currently on the screen.
-   *
-   * @internalRemarks
-   * Remove this when ApplicationService is implemented and managing apps.
-   *
-   * @deprecated
-   */
-  readonly active?: boolean;
+  readonly href: string;
 
   /**
    * Disables a link from being clickable.
@@ -129,30 +83,18 @@ export interface ChromeNavLink {
    * @internalRemarks
    * This is only used by the ML and Graph plugins currently. They use this field
    * to disable the nav link when the license is expired.
-   *
-   * @deprecated
    */
   readonly disabled?: boolean;
 
   /**
    * Hides a link from the navigation.
-   *
-   * @internalRemarks
-   * Remove this when ApplicationService is implemented. Instead, plugins should only
-   * register an Application if needed.
    */
   readonly hidden?: boolean;
-
-  /**
-   * Used to separate links to legacy applications from NP applications
-   * @internal
-   */
-  readonly legacy: boolean;
 }
 
 /** @public */
 export type ChromeNavLinkUpdateableFields = Partial<
-  Pick<ChromeNavLink, 'active' | 'disabled' | 'hidden' | 'url' | 'subUrlBase' | 'href'>
+  Pick<ChromeNavLink, 'disabled' | 'hidden' | 'url' | 'href'>
 >;
 
 export class NavLinkWrapper {
@@ -170,7 +112,7 @@ export class NavLinkWrapper {
 
   public update(newProps: ChromeNavLinkUpdateableFields) {
     // Enforce limited properties at runtime for JS code
-    newProps = pick(newProps, ['active', 'disabled', 'hidden', 'url', 'subUrlBase', 'href']);
+    newProps = pick(newProps, ['disabled', 'hidden', 'url', 'href']);
     return new NavLinkWrapper({ ...this.properties, ...newProps });
   }
 }
diff --git a/src/core/public/chrome/nav_links/nav_links_service.test.ts b/src/core/public/chrome/nav_links/nav_links_service.test.ts
index 8f610e238b0fd8..a8413ed5b546ad 100644
--- a/src/core/public/chrome/nav_links/nav_links_service.test.ts
+++ b/src/core/public/chrome/nav_links/nav_links_service.test.ts
@@ -19,7 +19,7 @@
 
 import { NavLinksService } from './nav_links_service';
 import { take, map, takeLast } from 'rxjs/operators';
-import { App, LegacyApp } from '../../application';
+import { App } from '../../application';
 import { BehaviorSubject } from 'rxjs';
 
 const availableApps = new Map([
@@ -34,32 +34,6 @@ const availableApps = new Map([
     },
   ],
   ['chromelessApp', { id: 'chromelessApp', order: 20, title: 'Chromless App', chromeless: true }],
-  [
-    'legacyApp1',
-    {
-      id: 'legacyApp1',
-      order: 5,
-      title: 'Legacy App 1',
-      icon: 'legacyApp1',
-      appUrl: '/app1',
-      legacy: true,
-    },
-  ],
-  [
-    'legacyApp2',
-    {
-      id: 'legacyApp2',
-      order: -10,
-      title: 'Legacy App 2',
-      euiIconType: 'canvasApp',
-      appUrl: '/app2',
-      legacy: true,
-    },
-  ],
-  [
-    'legacyApp3',
-    { id: 'legacyApp3', order: 20, title: 'Legacy App 3', appUrl: '/app3', legacy: true },
-  ],
 ]);
 
 const mockHttp = {
@@ -76,9 +50,7 @@ describe('NavLinksService', () => {
   beforeEach(() => {
     service = new NavLinksService();
     mockAppService = {
-      applications$: new BehaviorSubject<ReadonlyMap<string, App | LegacyApp>>(
-        availableApps as any
-      ),
+      applications$: new BehaviorSubject<ReadonlyMap<string, App>>(availableApps as any),
     };
     start = service.start({ application: mockAppService, http: mockHttp });
   });
@@ -105,19 +77,19 @@ describe('NavLinksService', () => {
             map((links) => links.map((l) => l.id))
           )
           .toPromise()
-      ).toEqual(['app2', 'legacyApp2', 'app1', 'legacyApp1', 'legacyApp3']);
+      ).toEqual(['app2', 'app1']);
     });
 
     it('emits multiple values', async () => {
       const navLinkIds$ = start.getNavLinks$().pipe(map((links) => links.map((l) => l.id)));
       const emittedLinks: string[][] = [];
       navLinkIds$.subscribe((r) => emittedLinks.push(r));
-      start.update('legacyApp1', { active: true });
+      start.update('app1', { href: '/foo' });
 
       service.stop();
       expect(emittedLinks).toEqual([
-        ['app2', 'legacyApp2', 'app1', 'legacyApp1', 'legacyApp3'],
-        ['app2', 'legacyApp2', 'app1', 'legacyApp1', 'legacyApp3'],
+        ['app2', 'app1'],
+        ['app2', 'app1'],
       ]);
     });
 
@@ -130,7 +102,7 @@ describe('NavLinksService', () => {
 
   describe('#get()', () => {
     it('returns link if exists', () => {
-      expect(start.get('legacyApp1')!.title).toEqual('Legacy App 1');
+      expect(start.get('app2')!.title).toEqual('App 2');
     });
 
     it('returns undefined if it does not exist', () => {
@@ -140,19 +112,13 @@ describe('NavLinksService', () => {
 
   describe('#getAll()', () => {
     it('returns a sorted array of navlinks', () => {
-      expect(start.getAll().map((l) => l.id)).toEqual([
-        'app2',
-        'legacyApp2',
-        'app1',
-        'legacyApp1',
-        'legacyApp3',
-      ]);
+      expect(start.getAll().map((l) => l.id)).toEqual(['app2', 'app1']);
     });
   });
 
   describe('#has()', () => {
     it('returns true if exists', () => {
-      expect(start.has('legacyApp1')).toBe(true);
+      expect(start.has('app2')).toBe(true);
     });
 
     it('returns false if it does not exist', () => {
@@ -171,7 +137,7 @@ describe('NavLinksService', () => {
             map((links) => links.map((l) => l.id))
           )
           .toPromise()
-      ).toEqual(['app2', 'legacyApp2', 'app1', 'legacyApp1', 'legacyApp3']);
+      ).toEqual(['app2', 'app1']);
     });
 
     it('does nothing on chromeless applications', async () => {
@@ -184,11 +150,11 @@ describe('NavLinksService', () => {
             map((links) => links.map((l) => l.id))
           )
           .toPromise()
-      ).toEqual(['app2', 'legacyApp2', 'app1', 'legacyApp1', 'legacyApp3']);
+      ).toEqual(['app2', 'app1']);
     });
 
     it('removes all other links', async () => {
-      start.showOnly('legacyApp1');
+      start.showOnly('app2');
       expect(
         await start
           .getNavLinks$()
@@ -197,11 +163,11 @@ describe('NavLinksService', () => {
             map((links) => links.map((l) => l.id))
           )
           .toPromise()
-      ).toEqual(['legacyApp1']);
+      ).toEqual(['app2']);
     });
 
     it('still removes all other links when availableApps are re-emitted', async () => {
-      start.showOnly('legacyApp2');
+      start.showOnly('app2');
       mockAppService.applications$.next(mockAppService.applications$.value);
       expect(
         await start
@@ -211,22 +177,19 @@ describe('NavLinksService', () => {
             map((links) => links.map((l) => l.id))
           )
           .toPromise()
-      ).toEqual(['legacyApp2']);
+      ).toEqual(['app2']);
     });
   });
 
   describe('#update()', () => {
     it('updates the navlinks and returns the updated link', async () => {
-      expect(start.update('legacyApp1', { hidden: true })).toEqual(
+      expect(start.update('app2', { hidden: true })).toEqual(
         expect.objectContaining({
-          appUrl: '/app1',
-          disabled: false,
           hidden: true,
-          icon: 'legacyApp1',
-          id: 'legacyApp1',
-          legacy: true,
-          order: 5,
-          title: 'Legacy App 1',
+          id: 'app2',
+          order: -10,
+          title: 'App 2',
+          euiIconType: 'canvasApp',
         })
       );
       const hiddenLinkIds = await start
@@ -236,7 +199,7 @@ describe('NavLinksService', () => {
           map((links) => links.filter((l) => l.hidden).map((l) => l.id))
         )
         .toPromise();
-      expect(hiddenLinkIds).toEqual(['legacyApp1']);
+      expect(hiddenLinkIds).toEqual(['app2']);
     });
 
     it('returns undefined if link does not exist', () => {
@@ -244,7 +207,7 @@ describe('NavLinksService', () => {
     });
 
     it('keeps the updated link when availableApps are re-emitted', async () => {
-      start.update('legacyApp1', { hidden: true });
+      start.update('app2', { hidden: true });
       mockAppService.applications$.next(mockAppService.applications$.value);
       const hiddenLinkIds = await start
         .getNavLinks$()
@@ -253,7 +216,7 @@ describe('NavLinksService', () => {
           map((links) => links.filter((l) => l.hidden).map((l) => l.id))
         )
         .toPromise();
-      expect(hiddenLinkIds).toEqual(['legacyApp1']);
+      expect(hiddenLinkIds).toEqual(['app2']);
     });
   });
 
diff --git a/src/core/public/chrome/nav_links/to_nav_link.test.ts b/src/core/public/chrome/nav_links/to_nav_link.test.ts
index ba04dbed49cd44..7e2c1fc1f89f8e 100644
--- a/src/core/public/chrome/nav_links/to_nav_link.test.ts
+++ b/src/core/public/chrome/nav_links/to_nav_link.test.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { PublicAppInfo, AppNavLinkStatus, AppStatus, PublicLegacyAppInfo } from '../../application';
+import { PublicAppInfo, AppNavLinkStatus, AppStatus } from '../../application';
 import { toNavLink } from './to_nav_link';
 
 import { httpServiceMock } from '../../mocks';
@@ -28,17 +28,6 @@ const app = (props: Partial<PublicAppInfo> = {}): PublicAppInfo => ({
   status: AppStatus.accessible,
   navLinkStatus: AppNavLinkStatus.default,
   appRoute: `/app/some-id`,
-  legacy: false,
-  ...props,
-});
-
-const legacyApp = (props: Partial<PublicLegacyAppInfo> = {}): PublicLegacyAppInfo => ({
-  appUrl: '/my-app-url',
-  id: 'some-id',
-  title: 'some-title',
-  status: AppStatus.accessible,
-  navLinkStatus: AppNavLinkStatus.default,
-  legacy: true,
   ...props,
 });
 
@@ -67,11 +56,6 @@ describe('toNavLink', () => {
     );
   });
 
-  it('flags legacy apps when converting to navLink', () => {
-    expect(toNavLink(app({}), basePath).properties.legacy).toEqual(false);
-    expect(toNavLink(legacyApp({}), basePath).properties.legacy).toEqual(true);
-  });
-
   it('handles applications with custom app route', () => {
     const link = toNavLink(
       app({
@@ -103,32 +87,6 @@ describe('toNavLink', () => {
     );
   });
 
-  it('does not generate `url` for legacy app', () => {
-    const link = toNavLink(
-      legacyApp({
-        appUrl: '/my-legacy-app/#foo',
-        defaultPath: '/some/default/path',
-      }),
-      basePath
-    );
-    expect(link.properties.url).toBeUndefined();
-  });
-
-  it('uses appUrl when converting legacy applications', () => {
-    expect(
-      toNavLink(
-        legacyApp({
-          appUrl: '/my-legacy-app/#foo',
-        }),
-        basePath
-      ).properties
-    ).toEqual(
-      expect.objectContaining({
-        baseUrl: 'http://localhost/base-path/my-legacy-app/#foo',
-      })
-    );
-  });
-
   it('uses the application status when the navLinkStatus is set to default', () => {
     expect(
       toNavLink(
diff --git a/src/core/public/chrome/nav_links/to_nav_link.ts b/src/core/public/chrome/nav_links/to_nav_link.ts
index 2dedbfd5f36ace..703c1798b6fb8f 100644
--- a/src/core/public/chrome/nav_links/to_nav_link.ts
+++ b/src/core/public/chrome/nav_links/to_nav_link.ts
@@ -17,19 +17,14 @@
  * under the License.
  */
 
-import { PublicAppInfo, AppNavLinkStatus, AppStatus, PublicLegacyAppInfo } from '../../application';
+import { PublicAppInfo, AppNavLinkStatus, AppStatus } from '../../application';
 import { IBasePath } from '../../http';
 import { NavLinkWrapper } from './nav_link';
 import { appendAppPath } from '../../application/utils';
 
-export function toNavLink(
-  app: PublicAppInfo | PublicLegacyAppInfo,
-  basePath: IBasePath
-): NavLinkWrapper {
+export function toNavLink(app: PublicAppInfo, basePath: IBasePath): NavLinkWrapper {
   const useAppStatus = app.navLinkStatus === AppNavLinkStatus.default;
-  const relativeBaseUrl = isLegacyApp(app)
-    ? basePath.prepend(app.appUrl)
-    : basePath.prepend(app.appRoute!);
+  const relativeBaseUrl = basePath.prepend(app.appRoute!);
   const url = relativeToAbsolute(appendAppPath(relativeBaseUrl, app.defaultPath));
   const baseUrl = relativeToAbsolute(relativeBaseUrl);
 
@@ -39,14 +34,9 @@ export function toNavLink(
       ? app.status === AppStatus.inaccessible
       : app.navLinkStatus === AppNavLinkStatus.hidden,
     disabled: useAppStatus ? false : app.navLinkStatus === AppNavLinkStatus.disabled,
-    legacy: isLegacyApp(app),
     baseUrl,
-    ...(isLegacyApp(app)
-      ? {}
-      : {
-          href: url,
-          url,
-        }),
+    href: url,
+    url,
   });
 }
 
@@ -63,7 +53,3 @@ export function relativeToAbsolute(url: string) {
   a.setAttribute('href', url);
   return a.href;
 }
-
-function isLegacyApp(app: PublicAppInfo | PublicLegacyAppInfo): app is PublicLegacyAppInfo {
-  return app.legacy === true;
-}
diff --git a/src/core/public/chrome/recently_accessed/persisted_log.test.ts b/src/core/public/chrome/recently_accessed/persisted_log.test.ts
index 4229efdf7ca9dc..345ad8f3a1f5a8 100644
--- a/src/core/public/chrome/recently_accessed/persisted_log.test.ts
+++ b/src/core/public/chrome/recently_accessed/persisted_log.test.ts
@@ -28,12 +28,6 @@ const createMockStorage = () => ({
   length: 0,
 });
 
-jest.mock('ui/chrome', () => {
-  return {
-    getBasePath: () => `/some/base/path`,
-  };
-});
-
 const historyName = 'testHistory';
 const historyLimit = 10;
 const payload = [
diff --git a/src/core/public/chrome/ui/header/__snapshots__/collapsible_nav.test.tsx.snap b/src/core/public/chrome/ui/header/__snapshots__/collapsible_nav.test.tsx.snap
index fe959e570ab986..a770ece8496e4c 100644
--- a/src/core/public/chrome/ui/header/__snapshots__/collapsible_nav.test.tsx.snap
+++ b/src/core/public/chrome/ui/header/__snapshots__/collapsible_nav.test.tsx.snap
@@ -71,7 +71,6 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
         "href": "Custom link",
         "id": "Custom link",
         "isActive": true,
-        "legacy": false,
         "title": "Custom link",
       },
       "closed": false,
@@ -123,7 +122,6 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
   id="collapsibe-nav"
   isLocked={false}
   isOpen={true}
-  legacyMode={false}
   navLinks$={
     BehaviorSubject {
       "_isScalar": false,
@@ -140,7 +138,6 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
           "href": "discover",
           "id": "discover",
           "isActive": true,
-          "legacy": false,
           "title": "discover",
         },
         Object {
@@ -155,7 +152,6 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
           "href": "siem",
           "id": "siem",
           "isActive": true,
-          "legacy": false,
           "title": "siem",
         },
         Object {
@@ -170,7 +166,6 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
           "href": "metrics",
           "id": "metrics",
           "isActive": true,
-          "legacy": false,
           "title": "metrics",
         },
         Object {
@@ -184,7 +179,6 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
           "href": "monitoring",
           "id": "monitoring",
           "isActive": true,
-          "legacy": false,
           "title": "monitoring",
         },
         Object {
@@ -199,7 +193,6 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
           "href": "visualize",
           "id": "visualize",
           "isActive": true,
-          "legacy": false,
           "title": "visualize",
         },
         Object {
@@ -214,7 +207,6 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
           "href": "dashboard",
           "id": "dashboard",
           "isActive": true,
-          "legacy": false,
           "title": "dashboard",
         },
         Object {
@@ -224,7 +216,6 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
           "href": "canvas",
           "id": "canvas",
           "isActive": true,
-          "legacy": false,
           "title": "canvas",
         },
         Object {
@@ -239,7 +230,6 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
           "href": "logs",
           "id": "logs",
           "isActive": true,
-          "legacy": false,
           "title": "logs",
         },
       ],
@@ -650,6 +640,8 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
               data-test-subj="collapsibleNavGroup-recentlyViewed"
               id="mockId"
               initialIsOpen={true}
+              isLoading={false}
+              isLoadingMessage={false}
               onToggle={[Function]}
               paddingSize="none"
             >
@@ -901,6 +893,8 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
                   data-test-subj="collapsibleNavGroup-kibana"
                   id="mockId"
                   initialIsOpen={true}
+                  isLoading={false}
+                  isLoadingMessage={false}
                   onToggle={[Function]}
                   paddingSize="none"
                 >
@@ -1188,6 +1182,8 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
                   data-test-subj="collapsibleNavGroup-observability"
                   id="mockId"
                   initialIsOpen={true}
+                  isLoading={false}
+                  isLoadingMessage={false}
                   onToggle={[Function]}
                   paddingSize="none"
                 >
@@ -1436,6 +1432,8 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
                   data-test-subj="collapsibleNavGroup-securitySolution"
                   id="mockId"
                   initialIsOpen={true}
+                  isLoading={false}
+                  isLoadingMessage={false}
                   onToggle={[Function]}
                   paddingSize="none"
                 >
@@ -1636,6 +1634,8 @@ exports[`CollapsibleNav renders links grouped by category 1`] = `
                   data-test-subj="collapsibleNavGroup-management"
                   id="mockId"
                   initialIsOpen={true}
+                  isLoading={false}
+                  isLoadingMessage={false}
                   onToggle={[Function]}
                   paddingSize="none"
                 >
@@ -2106,7 +2106,6 @@ exports[`CollapsibleNav renders the default nav 1`] = `
   id="collapsibe-nav"
   isLocked={false}
   isOpen={false}
-  legacyMode={false}
   navLinks$={
     BehaviorSubject {
       "_isScalar": false,
@@ -2341,7 +2340,6 @@ exports[`CollapsibleNav renders the default nav 2`] = `
   id="collapsibe-nav"
   isLocked={false}
   isOpen={true}
-  legacyMode={false}
   navLinks$={
     BehaviorSubject {
       "_isScalar": false,
@@ -2624,6 +2622,8 @@ exports[`CollapsibleNav renders the default nav 2`] = `
               data-test-subj="collapsibleNavGroup-recentlyViewed"
               id="mockId"
               initialIsOpen={true}
+              isLoading={false}
+              isLoadingMessage={false}
               onToggle={[Function]}
               paddingSize="none"
             >
@@ -3026,7 +3026,6 @@ exports[`CollapsibleNav renders the default nav 3`] = `
   id="collapsibe-nav"
   isLocked={true}
   isOpen={true}
-  legacyMode={false}
   navLinks$={
     BehaviorSubject {
       "_isScalar": false,
@@ -3305,6 +3304,8 @@ exports[`CollapsibleNav renders the default nav 3`] = `
               data-test-subj="collapsibleNavGroup-recentlyViewed"
               id="mockId"
               initialIsOpen={true}
+              isLoading={false}
+              isLoadingMessage={false}
               onToggle={[Function]}
               paddingSize="none"
             >
diff --git a/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap b/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
index f101c30a1241b9..128a0c5369e082 100644
--- a/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
+++ b/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
@@ -29,6 +29,15 @@ exports[`Header renders 1`] = `
         "management": Object {},
         "navLinks": Object {},
       },
+      "currentActionMenu$": BehaviorSubject {
+        "_isScalar": false,
+        "_value": undefined,
+        "closed": false,
+        "hasError": false,
+        "isStopped": false,
+        "observers": Array [],
+        "thrownError": null,
+      },
       "currentAppId$": Observable {
         "_isScalar": false,
         "source": Subject {
@@ -106,8 +115,8 @@ exports[`Header renders 1`] = `
       "_isScalar": false,
       "_value": Object {
         "baseUrl": "",
+        "href": "",
         "id": "cloud-deployment-link",
-        "legacy": false,
         "title": "Manage cloud deployment",
       },
       "closed": false,
@@ -353,7 +362,6 @@ exports[`Header renders 1`] = `
   }
   kibanaDocLink="/docs"
   kibanaVersion="1.0.0"
-  legacyMode={false}
   loadingCount$={
     BehaviorSubject {
       "_isScalar": false,
@@ -431,8 +439,8 @@ exports[`Header renders 1`] = `
       "_value": Array [
         Object {
           "baseUrl": "",
+          "href": "",
           "id": "kibana",
-          "legacy": false,
           "title": "kibana",
         },
       ],
@@ -641,6 +649,15 @@ exports[`Header renders 2`] = `
         "management": Object {},
         "navLinks": Object {},
       },
+      "currentActionMenu$": BehaviorSubject {
+        "_isScalar": false,
+        "_value": undefined,
+        "closed": false,
+        "hasError": false,
+        "isStopped": false,
+        "observers": Array [],
+        "thrownError": null,
+      },
       "currentAppId$": Observable {
         "_isScalar": false,
         "source": Subject {
@@ -832,8 +849,8 @@ exports[`Header renders 2`] = `
       "_isScalar": false,
       "_value": Object {
         "baseUrl": "",
+        "href": "",
         "id": "cloud-deployment-link",
-        "legacy": false,
         "title": "Manage cloud deployment",
       },
       "closed": false,
@@ -1871,7 +1888,6 @@ exports[`Header renders 2`] = `
   }
   kibanaDocLink="/docs"
   kibanaVersion="1.0.0"
-  legacyMode={false}
   loadingCount$={
     BehaviorSubject {
       "_isScalar": false,
@@ -2025,8 +2041,8 @@ exports[`Header renders 2`] = `
       "_value": Array [
         Object {
           "baseUrl": "",
+          "href": "",
           "id": "kibana",
-          "legacy": false,
           "title": "kibana",
         },
       ],
@@ -2397,8 +2413,8 @@ exports[`Header renders 2`] = `
                       "_value": Array [
                         Object {
                           "baseUrl": "",
+                          "href": "",
                           "id": "kibana",
-                          "legacy": false,
                           "title": "kibana",
                         },
                       ],
@@ -4569,8 +4585,8 @@ exports[`Header renders 2`] = `
           "_isScalar": false,
           "_value": Object {
             "baseUrl": "",
+            "href": "",
             "id": "cloud-deployment-link",
-            "legacy": false,
             "title": "Manage cloud deployment",
           },
           "closed": false,
@@ -4622,15 +4638,14 @@ exports[`Header renders 2`] = `
       id="mockId"
       isLocked={false}
       isOpen={false}
-      legacyMode={false}
       navLinks$={
         BehaviorSubject {
           "_isScalar": false,
           "_value": Array [
             Object {
               "baseUrl": "",
+              "href": "",
               "id": "kibana",
-              "legacy": false,
               "title": "kibana",
             },
           ],
@@ -4854,6 +4869,15 @@ exports[`Header renders 3`] = `
         "management": Object {},
         "navLinks": Object {},
       },
+      "currentActionMenu$": BehaviorSubject {
+        "_isScalar": false,
+        "_value": undefined,
+        "closed": false,
+        "hasError": false,
+        "isStopped": false,
+        "observers": Array [],
+        "thrownError": null,
+      },
       "currentAppId$": Observable {
         "_isScalar": false,
         "source": Subject {
@@ -5045,8 +5069,8 @@ exports[`Header renders 3`] = `
       "_isScalar": false,
       "_value": Object {
         "baseUrl": "",
+        "href": "",
         "id": "cloud-deployment-link",
-        "legacy": false,
         "title": "Manage cloud deployment",
       },
       "closed": false,
@@ -6084,7 +6108,6 @@ exports[`Header renders 3`] = `
   }
   kibanaDocLink="/docs"
   kibanaVersion="1.0.0"
-  legacyMode={false}
   loadingCount$={
     BehaviorSubject {
       "_isScalar": false,
@@ -6238,8 +6261,8 @@ exports[`Header renders 3`] = `
       "_value": Array [
         Object {
           "baseUrl": "",
+          "href": "",
           "id": "kibana",
-          "legacy": false,
           "title": "kibana",
         },
       ],
@@ -6610,8 +6633,8 @@ exports[`Header renders 3`] = `
                       "_value": Array [
                         Object {
                           "baseUrl": "",
+                          "href": "",
                           "id": "kibana",
-                          "legacy": false,
                           "title": "kibana",
                         },
                       ],
@@ -8782,8 +8805,8 @@ exports[`Header renders 3`] = `
           "_isScalar": false,
           "_value": Object {
             "baseUrl": "",
+            "href": "",
             "id": "cloud-deployment-link",
-            "legacy": false,
             "title": "Manage cloud deployment",
           },
           "closed": false,
@@ -8835,15 +8858,14 @@ exports[`Header renders 3`] = `
       id="mockId"
       isLocked={true}
       isOpen={false}
-      legacyMode={false}
       navLinks$={
         BehaviorSubject {
           "_isScalar": false,
           "_value": Array [
             Object {
               "baseUrl": "",
+              "href": "",
               "id": "kibana",
-              "legacy": false,
               "title": "kibana",
             },
           ],
@@ -9056,7 +9078,7 @@ exports[`Header renders 3`] = `
                             Array [
                               Object {
                                 "data-test-subj": "collapsibleNavCustomNavLink",
-                                "href": undefined,
+                                "href": "",
                                 "icon": undefined,
                                 "iconType": undefined,
                                 "isActive": false,
@@ -9080,6 +9102,7 @@ exports[`Header renders 3`] = `
                             <EuiListGroupItem
                               color="text"
                               data-test-subj="collapsibleNavCustomNavLink"
+                              href=""
                               isActive={false}
                               key="title-0"
                               label="Manage cloud deployment"
@@ -9265,6 +9288,8 @@ exports[`Header renders 3`] = `
                   data-test-subj="collapsibleNavGroup-recentlyViewed"
                   id="mockId"
                   initialIsOpen={true}
+                  isLoading={false}
+                  isLoadingMessage={false}
                   onToggle={[Function]}
                   paddingSize="none"
                 >
@@ -9451,6 +9476,7 @@ exports[`Header renders 3`] = `
                             <EuiListGroupItem
                               color="text"
                               data-test-subj="collapsibleNavAppLink"
+                              href=""
                               isActive={false}
                               label="kibana"
                               onClick={[Function]}
@@ -9706,6 +9732,15 @@ exports[`Header renders 4`] = `
         "management": Object {},
         "navLinks": Object {},
       },
+      "currentActionMenu$": BehaviorSubject {
+        "_isScalar": false,
+        "_value": undefined,
+        "closed": false,
+        "hasError": false,
+        "isStopped": false,
+        "observers": Array [],
+        "thrownError": null,
+      },
       "currentAppId$": Observable {
         "_isScalar": false,
         "source": Subject {
@@ -9897,8 +9932,8 @@ exports[`Header renders 4`] = `
       "_isScalar": false,
       "_value": Object {
         "baseUrl": "",
+        "href": "",
         "id": "cloud-deployment-link",
-        "legacy": false,
         "title": "Manage cloud deployment",
       },
       "closed": false,
@@ -10898,7 +10933,6 @@ exports[`Header renders 4`] = `
   }
   kibanaDocLink="/docs"
   kibanaVersion="1.0.0"
-  legacyMode={false}
   loadingCount$={
     BehaviorSubject {
       "_isScalar": false,
@@ -11052,8 +11086,8 @@ exports[`Header renders 4`] = `
       "_value": Array [
         Object {
           "baseUrl": "",
+          "href": "",
           "id": "kibana",
-          "legacy": false,
           "title": "kibana",
         },
       ],
@@ -11426,8 +11460,8 @@ exports[`Header renders 4`] = `
                       "_value": Array [
                         Object {
                           "baseUrl": "",
+                          "href": "",
                           "id": "kibana",
-                          "legacy": false,
                           "title": "kibana",
                         },
                       ],
@@ -13593,15 +13627,14 @@ exports[`Header renders 4`] = `
         }
       }
       isLocked={true}
-      legacyMode={false}
       navLinks$={
         BehaviorSubject {
           "_isScalar": false,
           "_value": Array [
             Object {
               "baseUrl": "",
+              "href": "",
               "id": "kibana",
-              "legacy": false,
               "title": "kibana",
             },
           ],
@@ -14048,7 +14081,7 @@ exports[`Header renders 4`] = `
                           Array [
                             Object {
                               "data-test-subj": "navDrawerAppsMenuLink",
-                              "href": undefined,
+                              "href": "",
                               "icon": undefined,
                               "iconType": undefined,
                               "isActive": false,
@@ -14071,7 +14104,7 @@ exports[`Header renders 4`] = `
                                 "className": "euiNavDrawerGroup__item",
                                 "data-name": "kibana",
                                 "data-test-subj": "navDrawerAppsMenuLink",
-                                "href": undefined,
+                                "href": "",
                                 "icon": <span
                                   className="euiNavDrawerGroup__itemDefaultIcon"
                                 >
@@ -14098,6 +14131,7 @@ exports[`Header renders 4`] = `
                               className="euiNavDrawerGroup__item"
                               data-name="kibana"
                               data-test-subj="navDrawerAppsMenuLink"
+                              href=""
                               icon={
                                 <span
                                   className="euiNavDrawerGroup__itemDefaultIcon"
diff --git a/src/core/public/chrome/ui/header/collapsible_nav.test.tsx b/src/core/public/chrome/ui/header/collapsible_nav.test.tsx
index 97dd229cb1ead3..d4325e0caf88c4 100644
--- a/src/core/public/chrome/ui/header/collapsible_nav.test.tsx
+++ b/src/core/public/chrome/ui/header/collapsible_nav.test.tsx
@@ -40,7 +40,6 @@ function mockLink({ title = 'discover', category }: Partial<ChromeNavLink>) {
     id: title,
     href: title,
     baseUrl: '/',
-    legacy: false,
     isActive: true,
     'data-test-subj': title,
   };
@@ -62,7 +61,6 @@ function mockProps() {
     isLocked: false,
     isOpen: false,
     homeHref: '/',
-    legacyMode: false,
     navLinks$: new BehaviorSubject([]),
     recentlyAccessed$: new BehaviorSubject([]),
     storage: new StubBrowserStorage(),
diff --git a/src/core/public/chrome/ui/header/collapsible_nav.tsx b/src/core/public/chrome/ui/header/collapsible_nav.tsx
index 5abd14312f4a66..a5f42c09495626 100644
--- a/src/core/public/chrome/ui/header/collapsible_nav.tsx
+++ b/src/core/public/chrome/ui/header/collapsible_nav.tsx
@@ -81,7 +81,6 @@ interface Props {
   isLocked: boolean;
   isOpen: boolean;
   homeHref: string;
-  legacyMode: boolean;
   navLinks$: Rx.Observable<ChromeNavLink[]>;
   recentlyAccessed$: Rx.Observable<ChromeRecentlyAccessedHistoryItem[]>;
   storage?: Storage;
@@ -97,7 +96,6 @@ export function CollapsibleNav({
   isLocked,
   isOpen,
   homeHref,
-  legacyMode,
   storage = window.localStorage,
   onIsLockedUpdate,
   closeNav,
@@ -116,7 +114,6 @@ export function CollapsibleNav({
   const readyForEUI = (link: ChromeNavLink, needsIcon: boolean = false) => {
     return createEuiListItem({
       link,
-      legacyMode,
       appId,
       dataTestSubj: 'collapsibleNavAppLink',
       navigateToApp,
@@ -148,7 +145,6 @@ export function CollapsibleNav({
                 listItems={[
                   createEuiListItem({
                     link: customNavLink,
-                    legacyMode,
                     basePath,
                     navigateToApp,
                     dataTestSubj: 'collapsibleNavCustomNavLink',
diff --git a/src/core/public/chrome/ui/header/header.test.tsx b/src/core/public/chrome/ui/header/header.test.tsx
index a9fa15d43182be..04eb256f30f37c 100644
--- a/src/core/public/chrome/ui/header/header.test.tsx
+++ b/src/core/public/chrome/ui/header/header.test.tsx
@@ -50,7 +50,6 @@ function mockProps() {
     forceAppSwitcherNavigation$: new BehaviorSubject(false),
     helpExtension$: new BehaviorSubject(undefined),
     helpSupportUrl$: new BehaviorSubject(''),
-    legacyMode: false,
     navControlsLeft$: new BehaviorSubject([]),
     navControlsRight$: new BehaviorSubject([]),
     basePath: http.basePath,
@@ -74,13 +73,13 @@ describe('Header', () => {
     const isLocked$ = new BehaviorSubject(false);
     const navType$ = new BehaviorSubject('modern' as NavType);
     const navLinks$ = new BehaviorSubject([
-      { id: 'kibana', title: 'kibana', baseUrl: '', legacy: false },
+      { id: 'kibana', title: 'kibana', baseUrl: '', href: '' },
     ]);
     const customNavLink$ = new BehaviorSubject({
       id: 'cloud-deployment-link',
       title: 'Manage cloud deployment',
       baseUrl: '',
-      legacy: false,
+      href: '',
     });
     const recentlyAccessed$ = new BehaviorSubject([
       { link: '', label: 'dashboard', id: 'dashboard' },
diff --git a/src/core/public/chrome/ui/header/header.tsx b/src/core/public/chrome/ui/header/header.tsx
index 0624d66a9598bb..c0b3fc72930dc4 100644
--- a/src/core/public/chrome/ui/header/header.tsx
+++ b/src/core/public/chrome/ui/header/header.tsx
@@ -67,7 +67,6 @@ export interface HeaderProps {
   forceAppSwitcherNavigation$: Observable<boolean>;
   helpExtension$: Observable<ChromeHelpExtension | undefined>;
   helpSupportUrl$: Observable<string>;
-  legacyMode: boolean;
   navControlsLeft$: Observable<readonly ChromeNavControl[]>;
   navControlsRight$: Observable<readonly ChromeNavControl[]>;
   basePath: HttpStart['basePath'];
@@ -93,7 +92,6 @@ function renderMenuTrigger(toggleOpen: () => void) {
 export function Header({
   kibanaVersion,
   kibanaDocLink,
-  legacyMode,
   application,
   basePath,
   onIsLockedUpdate,
@@ -195,7 +193,6 @@ export function Header({
             isOpen={isOpen}
             homeHref={homeHref}
             basePath={basePath}
-            legacyMode={legacyMode}
             navigateToApp={application.navigateToApp}
             onIsLockedUpdate={onIsLockedUpdate}
             closeNav={() => {
@@ -218,7 +215,6 @@ export function Header({
             appId$={application.currentAppId$}
             navigateToApp={application.navigateToApp}
             ref={navDrawerRef}
-            legacyMode={legacyMode}
           />
         )}
       </header>
diff --git a/src/core/public/chrome/ui/header/nav_drawer.tsx b/src/core/public/chrome/ui/header/nav_drawer.tsx
index ee4bff6cc0ac44..fc080fbafc3030 100644
--- a/src/core/public/chrome/ui/header/nav_drawer.tsx
+++ b/src/core/public/chrome/ui/header/nav_drawer.tsx
@@ -33,7 +33,6 @@ export interface Props {
   appId$: InternalApplicationStart['currentAppId$'];
   basePath: HttpStart['basePath'];
   isLocked?: boolean;
-  legacyMode: boolean;
   navLinks$: Observable<ChromeNavLink[]>;
   recentlyAccessed$: Observable<ChromeRecentlyAccessedHistoryItem[]>;
   navigateToApp: CoreStart['application']['navigateToApp'];
@@ -41,7 +40,7 @@ export interface Props {
 }
 
 function NavDrawerRenderer(
-  { isLocked, onIsLockedUpdate, basePath, legacyMode, navigateToApp, ...observables }: Props,
+  { isLocked, onIsLockedUpdate, basePath, navigateToApp, ...observables }: Props,
   ref: React.Ref<EuiNavDrawer>
 ) {
   const appId = useObservable(observables.appId$, '');
@@ -67,7 +66,6 @@ function NavDrawerRenderer(
         listItems={navLinks.map((link) =>
           createEuiListItem({
             link,
-            legacyMode,
             appId,
             basePath,
             navigateToApp,
diff --git a/src/core/public/chrome/ui/header/nav_link.tsx b/src/core/public/chrome/ui/header/nav_link.tsx
index c70a40f49643e0..04d9c5bf7a10a6 100644
--- a/src/core/public/chrome/ui/header/nav_link.tsx
+++ b/src/core/public/chrome/ui/header/nav_link.tsx
@@ -29,7 +29,6 @@ export const isModifiedOrPrevented = (event: React.MouseEvent<HTMLButtonElement,
 
 interface Props {
   link: ChromeNavLink;
-  legacyMode: boolean;
   appId?: string;
   basePath?: HttpStart['basePath'];
   dataTestSubj: string;
@@ -44,7 +43,6 @@ interface Props {
 // But FlyoutMenuItem isn't exported from EUI
 export function createEuiListItem({
   link,
-  legacyMode,
   appId,
   basePath,
   onClick = () => {},
@@ -52,12 +50,7 @@ export function createEuiListItem({
   dataTestSubj,
   externalLink = false,
 }: Props) {
-  const { legacy, active, id, title, disabled, euiIconType, icon, tooltip } = link;
-  let { href } = link;
-
-  if (legacy) {
-    href = link.url && !active ? link.url : link.baseUrl;
-  }
+  const { href, id, title, disabled, euiIconType, icon, tooltip } = link;
 
   return {
     label: tooltip ?? title,
@@ -70,8 +63,6 @@ export function createEuiListItem({
 
       if (
         !externalLink && // ignore external links
-        !legacyMode && // ignore when in legacy mode
-        !legacy && // ignore links to legacy apps
         event.button === 0 && // ignore everything but left clicks
         !isModifiedOrPrevented(event)
       ) {
@@ -79,8 +70,7 @@ export function createEuiListItem({
         navigateToApp(id);
       }
     },
-    // Legacy apps use `active` property, NP apps should match the current app
-    isActive: active || appId === id,
+    isActive: appId === id,
     isDisabled: disabled,
     'data-test-subj': dataTestSubj,
     ...(basePath && {
@@ -116,7 +106,7 @@ export function createRecentNavLink(
 ) {
   const { link, label } = recentLink;
   const href = relativeToAbsolute(basePath.prepend(link));
-  const navLink = navLinks.find((nl) => href.startsWith(nl.baseUrl ?? nl.subUrlBase));
+  const navLink = navLinks.find((nl) => href.startsWith(nl.baseUrl));
   let titleAndAriaLabel = label;
 
   if (navLink) {
diff --git a/src/core/public/core_system.test.mocks.ts b/src/core/public/core_system.test.mocks.ts
index b5b99418b44b4f..d0e457386ffca3 100644
--- a/src/core/public/core_system.test.mocks.ts
+++ b/src/core/public/core_system.test.mocks.ts
@@ -23,7 +23,6 @@ import { fatalErrorsServiceMock } from './fatal_errors/fatal_errors_service.mock
 import { httpServiceMock } from './http/http_service.mock';
 import { i18nServiceMock } from './i18n/i18n_service.mock';
 import { injectedMetadataServiceMock } from './injected_metadata/injected_metadata_service.mock';
-import { legacyPlatformServiceMock } from './legacy/legacy_service.mock';
 import { notificationServiceMock } from './notifications/notifications_service.mock';
 import { overlayServiceMock } from './overlays/overlay_service.mock';
 import { pluginsServiceMock } from './plugins/plugins_service.mock';
@@ -34,14 +33,6 @@ import { contextServiceMock } from './context/context_service.mock';
 import { integrationsServiceMock } from './integrations/integrations_service.mock';
 import { coreAppMock } from './core_app/core_app.mock';
 
-export const MockLegacyPlatformService = legacyPlatformServiceMock.create();
-export const LegacyPlatformServiceConstructor = jest
-  .fn()
-  .mockImplementation(() => MockLegacyPlatformService);
-jest.doMock('./legacy', () => ({
-  LegacyPlatformService: LegacyPlatformServiceConstructor,
-}));
-
 export const MockInjectedMetadataService = injectedMetadataServiceMock.create();
 export const InjectedMetadataServiceConstructor = jest
   .fn()
diff --git a/src/core/public/core_system.test.ts b/src/core/public/core_system.test.ts
index 4c1993c90a2e10..213237309c30bd 100644
--- a/src/core/public/core_system.test.ts
+++ b/src/core/public/core_system.test.ts
@@ -23,13 +23,11 @@ import {
   HttpServiceConstructor,
   I18nServiceConstructor,
   InjectedMetadataServiceConstructor,
-  LegacyPlatformServiceConstructor,
   MockChromeService,
   MockFatalErrorsService,
   MockHttpService,
   MockI18nService,
   MockInjectedMetadataService,
-  MockLegacyPlatformService,
   MockNotificationsService,
   MockOverlayService,
   MockPluginsService,
@@ -80,7 +78,6 @@ describe('constructor', () => {
     createCoreSystem();
 
     expect(InjectedMetadataServiceConstructor).toHaveBeenCalledTimes(1);
-    expect(LegacyPlatformServiceConstructor).toHaveBeenCalledTimes(1);
     expect(I18nServiceConstructor).toHaveBeenCalledTimes(1);
     expect(FatalErrorsServiceConstructor).toHaveBeenCalledTimes(1);
     expect(NotificationServiceConstructor).toHaveBeenCalledTimes(1);
@@ -106,25 +103,6 @@ describe('constructor', () => {
     });
   });
 
-  it('passes required params to LegacyPlatformService', () => {
-    const requireLegacyFiles = { requireLegacyFiles: true };
-    const requireLegacyBootstrapModule = { requireLegacyBootstrapModule: true };
-    const requireNewPlatformShimModule = { requireNewPlatformShimModule: true };
-
-    createCoreSystem({
-      requireLegacyFiles,
-      requireLegacyBootstrapModule,
-      requireNewPlatformShimModule,
-    });
-
-    expect(LegacyPlatformServiceConstructor).toHaveBeenCalledTimes(1);
-    expect(LegacyPlatformServiceConstructor).toHaveBeenCalledWith({
-      requireLegacyFiles,
-      requireLegacyBootstrapModule,
-      requireNewPlatformShimModule,
-    });
-  });
-
   it('passes browserSupportsCsp to ChromeService', () => {
     createCoreSystem();
 
@@ -190,7 +168,6 @@ describe('#setup()', () => {
       pluginDependencies: new Map([
         [pluginA, []],
         [pluginB, [pluginA]],
-        [MockLegacyPlatformService.legacyId, [pluginA, pluginB]],
       ]),
     });
   });
@@ -301,11 +278,6 @@ describe('#start()', () => {
     expect(MockPluginsService.start).toHaveBeenCalledTimes(1);
   });
 
-  it('calls legacyPlatform#start()', async () => {
-    await startCore();
-    expect(MockLegacyPlatformService.start).toHaveBeenCalledTimes(1);
-  });
-
   it('calls overlays#start()', async () => {
     await startCore();
     expect(MockOverlayService.start).toHaveBeenCalledTimes(1);
@@ -317,7 +289,6 @@ describe('#start()', () => {
     expect(MockRenderingService.start).toHaveBeenCalledWith({
       application: expect.any(Object),
       chrome: expect.any(Object),
-      injectedMetadata: expect.any(Object),
       overlays: expect.any(Object),
       targetDomElement: expect.any(HTMLElement),
     });
@@ -335,14 +306,6 @@ describe('#start()', () => {
 });
 
 describe('#stop()', () => {
-  it('calls legacyPlatform.stop()', () => {
-    const coreSystem = createCoreSystem();
-
-    expect(MockLegacyPlatformService.stop).not.toHaveBeenCalled();
-    coreSystem.stop();
-    expect(MockLegacyPlatformService.stop).toHaveBeenCalled();
-  });
-
   it('calls notifications.stop()', () => {
     const coreSystem = createCoreSystem();
 
@@ -422,7 +385,6 @@ describe('RenderingService targetDomElement', () => {
     let targetDomElementParentInStart: HTMLElement | null;
     MockRenderingService.start.mockImplementation(({ targetDomElement }) => {
       targetDomElementParentInStart = targetDomElement.parentElement;
-      return { legacyTargetDomElement: document.createElement('div') };
     });
 
     // Starting the core system should pass the targetDomElement as a child of the rootDomElement
@@ -432,24 +394,6 @@ describe('RenderingService targetDomElement', () => {
   });
 });
 
-describe('LegacyPlatformService targetDomElement', () => {
-  it('only mounts the element when start, after setting up the legacyPlatformService', async () => {
-    const core = createCoreSystem();
-
-    let targetDomElementInStart: HTMLElement | undefined;
-    MockLegacyPlatformService.start.mockImplementation(({ targetDomElement }) => {
-      targetDomElementInStart = targetDomElement;
-    });
-
-    await core.setup();
-    await core.start();
-    // Starting the core system should pass the legacyTargetDomElement to the LegacyPlatformService
-    const renderingLegacyTargetDomElement =
-      MockRenderingService.start.mock.results[0].value.legacyTargetDomElement;
-    expect(targetDomElementInStart!).toBe(renderingLegacyTargetDomElement);
-  });
-});
-
 describe('Notifications targetDomElement', () => {
   it('only mounts the element when started, after setting up the notificationsService', async () => {
     const rootDomElement = document.createElement('div');
diff --git a/src/core/public/core_system.ts b/src/core/public/core_system.ts
index e08841b0271d9d..006d0036f7a129 100644
--- a/src/core/public/core_system.ts
+++ b/src/core/public/core_system.ts
@@ -30,13 +30,12 @@ import {
   InjectedMetadataSetup,
   InjectedMetadataStart,
 } from './injected_metadata';
-import { LegacyPlatformParams, LegacyPlatformService } from './legacy';
 import { NotificationsService } from './notifications';
 import { OverlayService } from './overlays';
 import { PluginsService } from './plugins';
 import { UiSettingsService } from './ui_settings';
 import { ApplicationService } from './application';
-import { mapToObject, pick } from '../utils/';
+import { pick } from '../utils/';
 import { DocLinksService } from './doc_links';
 import { RenderingService } from './rendering';
 import { SavedObjectsService } from './saved_objects';
@@ -49,9 +48,6 @@ interface Params {
   rootDomElement: HTMLElement;
   browserSupportsCsp: boolean;
   injectedMetadata: InjectedMetadataParams['injectedMetadata'];
-  requireLegacyFiles?: LegacyPlatformParams['requireLegacyFiles'];
-  requireLegacyBootstrapModule?: LegacyPlatformParams['requireLegacyBootstrapModule'];
-  requireNewPlatformShimModule?: LegacyPlatformParams['requireNewPlatformShimModule'];
 }
 
 /** @internal */
@@ -86,7 +82,6 @@ export interface InternalCoreStart extends Omit<CoreStart, 'application'> {
 export class CoreSystem {
   private readonly fatalErrors: FatalErrorsService;
   private readonly injectedMetadata: InjectedMetadataService;
-  private readonly legacy: LegacyPlatformService;
   private readonly notifications: NotificationsService;
   private readonly http: HttpService;
   private readonly savedObjects: SavedObjectsService;
@@ -107,14 +102,7 @@ export class CoreSystem {
   private fatalErrorsSetup: FatalErrorsSetup | null = null;
 
   constructor(params: Params) {
-    const {
-      rootDomElement,
-      browserSupportsCsp,
-      injectedMetadata,
-      requireLegacyFiles,
-      requireLegacyBootstrapModule,
-      requireNewPlatformShimModule,
-    } = params;
+    const { rootDomElement, browserSupportsCsp, injectedMetadata } = params;
 
     this.rootDomElement = rootDomElement;
 
@@ -145,12 +133,6 @@ export class CoreSystem {
     this.context = new ContextService(this.coreContext);
     this.plugins = new PluginsService(this.coreContext, injectedMetadata.uiPlugins);
     this.coreApp = new CoreApp(this.coreContext);
-
-    this.legacy = new LegacyPlatformService({
-      requireLegacyFiles,
-      requireLegacyBootstrapModule,
-      requireNewPlatformShimModule,
-    });
   }
 
   public async setup() {
@@ -170,16 +152,9 @@ export class CoreSystem {
 
       const pluginDependencies = this.plugins.getOpaqueIds();
       const context = this.context.setup({
-        // We inject a fake "legacy plugin" with dependencies on every plugin so that legacy plugins:
-        // 1) Can access context from any NP plugin
-        // 2) Can register context providers that will only be available to other legacy plugins and will not leak into
-        //    New Platform plugins.
-        pluginDependencies: new Map([
-          ...pluginDependencies,
-          [this.legacy.legacyId, [...pluginDependencies.keys()]],
-        ]),
+        pluginDependencies: new Map([...pluginDependencies]),
       });
-      const application = this.application.setup({ context, http, injectedMetadata });
+      const application = this.application.setup({ context, http });
       this.coreApp.setup({ application, http, injectedMetadata, notifications });
 
       const core: InternalCoreSetup = {
@@ -193,12 +168,7 @@ export class CoreSystem {
       };
 
       // Services that do not expose contracts at setup
-      const plugins = await this.plugins.setup(core);
-
-      await this.legacy.setup({
-        core,
-        plugins: mapToObject(plugins.contracts),
-      });
+      await this.plugins.setup(core);
 
       return { fatalErrors: this.fatalErrorsSetup };
     } catch (error) {
@@ -277,7 +247,7 @@ export class CoreSystem {
         fatalErrors,
       };
 
-      const plugins = await this.plugins.start(core);
+      await this.plugins.start(core);
 
       // ensure the rootDomElement is empty
       this.rootDomElement.textContent = '';
@@ -286,20 +256,13 @@ export class CoreSystem {
       this.rootDomElement.appendChild(notificationsTargetDomElement);
       this.rootDomElement.appendChild(overlayTargetDomElement);
 
-      const rendering = this.rendering.start({
+      this.rendering.start({
         application,
         chrome,
-        injectedMetadata,
         overlays,
         targetDomElement: coreUiTargetDomElement,
       });
 
-      await this.legacy.start({
-        core,
-        plugins: mapToObject(plugins.contracts),
-        targetDomElement: rendering.legacyTargetDomElement,
-      });
-
       return {
         application,
       };
@@ -315,7 +278,6 @@ export class CoreSystem {
   }
 
   public stop() {
-    this.legacy.stop();
     this.plugins.stop();
     this.coreApp.stop();
     this.notifications.stop();
diff --git a/src/core/public/index.ts b/src/core/public/index.ts
index 9176a277b3f434..a9774dafd2340a 100644
--- a/src/core/public/index.ts
+++ b/src/core/public/index.ts
@@ -61,7 +61,6 @@ import {
 import { FatalErrorsSetup, FatalErrorsStart, FatalErrorInfo } from './fatal_errors';
 import { HttpSetup, HttpStart } from './http';
 import { I18nStart } from './i18n';
-import { InjectedMetadataSetup, InjectedMetadataStart, LegacyNavLink } from './injected_metadata';
 import { NotificationsSetup, NotificationsStart } from './notifications';
 import { OverlayStart } from './overlays';
 import { Plugin, PluginInitializer, PluginInitializerContext, PluginOpaqueId } from './plugins';
@@ -106,7 +105,6 @@ export {
   ApplicationStart,
   App,
   PublicAppInfo,
-  AppBase,
   AppMount,
   AppMountDeprecated,
   AppUnmount,
@@ -122,8 +120,6 @@ export {
   AppUpdatableFields,
   AppUpdater,
   ScopedHistory,
-  LegacyApp,
-  PublicLegacyAppInfo,
   NavigateToAppOptions,
 } from './application';
 
@@ -230,7 +226,7 @@ export interface CoreSetup<TPluginsStart extends object = object, TStart = unkno
   /**
    * exposed temporarily until https://github.com/elastic/kibana/issues/41990 done
    * use *only* to retrieve config values. There is no way to set injected values
-   * in the new platform. Use the legacy platform API instead.
+   * in the new platform.
    * @deprecated
    * */
   injectedMetadata: {
@@ -285,7 +281,7 @@ export interface CoreStart {
   /**
    * exposed temporarily until https://github.com/elastic/kibana/issues/41990 done
    * use *only* to retrieve config values. There is no way to set injected values
-   * in the new platform. Use the legacy platform API instead.
+   * in the new platform.
    * @deprecated
    * */
   injectedMetadata: {
@@ -293,36 +289,6 @@ export interface CoreStart {
   };
 }
 
-/**
- * Setup interface exposed to the legacy platform via the `ui/new_platform` module.
- *
- * @remarks
- * Some methods are not supported in the legacy platform and while present to make this type compatibile with
- * {@link CoreSetup}, unsupported methods will throw exceptions when called.
- *
- * @public
- * @deprecated
- */
-export interface LegacyCoreSetup extends CoreSetup<any, any> {
-  /** @deprecated */
-  injectedMetadata: InjectedMetadataSetup;
-}
-
-/**
- * Start interface exposed to the legacy platform via the `ui/new_platform` module.
- *
- * @remarks
- * Some methods are not supported in the legacy platform and while present to make this type compatibile with
- * {@link CoreStart}, unsupported methods will throw exceptions when called.
- *
- * @public
- * @deprecated
- */
-export interface LegacyCoreStart extends CoreStart {
-  /** @deprecated */
-  injectedMetadata: InjectedMetadataStart;
-}
-
 export {
   Capabilities,
   ChromeBadge,
@@ -356,7 +322,6 @@ export {
   HttpSetup,
   HttpStart,
   I18nStart,
-  LegacyNavLink,
   NotificationsSetup,
   NotificationsStart,
   Plugin,
diff --git a/src/core/public/injected_metadata/index.ts b/src/core/public/injected_metadata/index.ts
index cebd0f017de698..925eeab1875357 100644
--- a/src/core/public/injected_metadata/index.ts
+++ b/src/core/public/injected_metadata/index.ts
@@ -23,5 +23,4 @@ export {
   InjectedMetadataSetup,
   InjectedMetadataStart,
   InjectedPluginMetadata,
-  LegacyNavLink,
 } from './injected_metadata_service';
diff --git a/src/core/public/injected_metadata/injected_metadata_service.mock.ts b/src/core/public/injected_metadata/injected_metadata_service.mock.ts
index e6b1c440519bd2..3bb4358406246b 100644
--- a/src/core/public/injected_metadata/injected_metadata_service.mock.ts
+++ b/src/core/public/injected_metadata/injected_metadata_service.mock.ts
@@ -25,7 +25,6 @@ const createSetupContractMock = () => {
     getKibanaVersion: jest.fn(),
     getKibanaBranch: jest.fn(),
     getCspConfig: jest.fn(),
-    getLegacyMode: jest.fn(),
     getAnonymousStatusPage: jest.fn(),
     getLegacyMetadata: jest.fn(),
     getPlugins: jest.fn(),
@@ -35,7 +34,6 @@ const createSetupContractMock = () => {
   };
   setupContract.getCspConfig.mockReturnValue({ warnLegacyBrowsers: true });
   setupContract.getKibanaVersion.mockReturnValue('kibanaVersion');
-  setupContract.getLegacyMode.mockReturnValue(true);
   setupContract.getAnonymousStatusPage.mockReturnValue(false);
   setupContract.getLegacyMetadata.mockReturnValue({
     app: {
diff --git a/src/core/public/injected_metadata/injected_metadata_service.ts b/src/core/public/injected_metadata/injected_metadata_service.ts
index db4bfdf415bcc8..23630a5bcf228b 100644
--- a/src/core/public/injected_metadata/injected_metadata_service.ts
+++ b/src/core/public/injected_metadata/injected_metadata_service.ts
@@ -28,17 +28,6 @@ import {
 import { deepFreeze } from '../../utils/';
 import { AppCategory } from '../';
 
-/** @public */
-export interface LegacyNavLink {
-  id: string;
-  category?: AppCategory;
-  title: string;
-  order: number;
-  url: string;
-  icon?: string;
-  euiIconType?: string;
-}
-
 export interface InjectedPluginMetadata {
   id: PluginName;
   plugin: DiscoveredPlugin;
@@ -67,7 +56,6 @@ export interface InjectedMetadataParams {
       packageInfo: Readonly<PackageInfo>;
     };
     uiPlugins: InjectedPluginMetadata[];
-    legacyMode: boolean;
     anonymousStatusPage: boolean;
     legacyMetadata: {
       app: {
@@ -75,7 +63,6 @@ export interface InjectedMetadataParams {
         title: string;
       };
       bundleId: string;
-      nav: LegacyNavLink[];
       version: string;
       branch: string;
       buildNum: number;
@@ -137,10 +124,6 @@ export class InjectedMetadataService {
         return this.state.uiPlugins;
       },
 
-      getLegacyMode: () => {
-        return this.state.legacyMode;
-      },
-
       getLegacyMetadata: () => {
         return this.state.legacyMetadata;
       },
@@ -182,8 +165,6 @@ export interface InjectedMetadataSetup {
    * An array of frontend plugins in topological order.
    */
   getPlugins: () => InjectedPluginMetadata[];
-  /** Indicates whether or not we are rendering a known legacy app. */
-  getLegacyMode: () => boolean;
   getAnonymousStatusPage: () => boolean;
   getLegacyMetadata: () => {
     app: {
@@ -191,7 +172,6 @@ export interface InjectedMetadataSetup {
       title: string;
     };
     bundleId: string;
-    nav: LegacyNavLink[];
     version: string;
     branch: string;
     buildNum: number;
diff --git a/src/core/public/legacy/index.ts b/src/core/public/legacy/index.ts
deleted file mode 100644
index 1ea43d8deebbc4..00000000000000
--- a/src/core/public/legacy/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { LegacyPlatformService, LegacyPlatformParams } from './legacy_service';
diff --git a/src/core/public/legacy/legacy_service.mock.ts b/src/core/public/legacy/legacy_service.mock.ts
deleted file mode 100644
index 0c8d9682185d5c..00000000000000
--- a/src/core/public/legacy/legacy_service.mock.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { LegacyPlatformService } from './legacy_service';
-
-// Use Required to get only public properties
-type LegacyPlatformServiceContract = Required<LegacyPlatformService>;
-const createMock = () => {
-  const mocked: jest.Mocked<LegacyPlatformServiceContract> = {
-    legacyId: Symbol(),
-    setup: jest.fn(),
-    start: jest.fn(),
-    stop: jest.fn(),
-  };
-  return mocked;
-};
-
-export const legacyPlatformServiceMock = {
-  create: createMock,
-};
diff --git a/src/core/public/legacy/legacy_service.test.ts b/src/core/public/legacy/legacy_service.test.ts
deleted file mode 100644
index cb29abc9b0ccc5..00000000000000
--- a/src/core/public/legacy/legacy_service.test.ts
+++ /dev/null
@@ -1,297 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import angular from 'angular';
-
-import { chromeServiceMock } from '../chrome/chrome_service.mock';
-import { fatalErrorsServiceMock } from '../fatal_errors/fatal_errors_service.mock';
-import { httpServiceMock } from '../http/http_service.mock';
-import { i18nServiceMock } from '../i18n/i18n_service.mock';
-import { injectedMetadataServiceMock } from '../injected_metadata/injected_metadata_service.mock';
-import { notificationServiceMock } from '../notifications/notifications_service.mock';
-import { overlayServiceMock } from '../overlays/overlay_service.mock';
-import { uiSettingsServiceMock } from '../ui_settings/ui_settings_service.mock';
-import { LegacyPlatformService } from './legacy_service';
-import { applicationServiceMock } from '../application/application_service.mock';
-import { docLinksServiceMock } from '../doc_links/doc_links_service.mock';
-import { savedObjectsServiceMock } from '../saved_objects/saved_objects_service.mock';
-import { contextServiceMock } from '../context/context_service.mock';
-
-const applicationSetup = applicationServiceMock.createInternalSetupContract();
-const contextSetup = contextServiceMock.createSetupContract();
-const docLinksSetup = docLinksServiceMock.createSetupContract();
-const fatalErrorsSetup = fatalErrorsServiceMock.createSetupContract();
-const httpSetup = httpServiceMock.createSetupContract();
-const injectedMetadataSetup = injectedMetadataServiceMock.createSetupContract();
-const notificationsSetup = notificationServiceMock.createSetupContract();
-const uiSettingsSetup = uiSettingsServiceMock.createSetupContract();
-
-const mockLoadOrder: string[] = [];
-const mockUiNewPlatformSetup = jest.fn();
-const mockUiNewPlatformStart = jest.fn();
-const mockUiChromeBootstrap = jest.fn();
-const defaultParams = {
-  requireLegacyFiles: jest.fn(() => {
-    mockLoadOrder.push('legacy files');
-  }),
-  requireLegacyBootstrapModule: jest.fn(() => {
-    mockLoadOrder.push('ui/chrome');
-    return {
-      bootstrap: mockUiChromeBootstrap,
-    };
-  }),
-  requireNewPlatformShimModule: jest.fn(() => ({
-    __setup__: mockUiNewPlatformSetup,
-    __start__: mockUiNewPlatformStart,
-  })),
-};
-
-const defaultSetupDeps = {
-  core: {
-    application: applicationSetup,
-    context: contextSetup,
-    docLinks: docLinksSetup,
-    fatalErrors: fatalErrorsSetup,
-    injectedMetadata: injectedMetadataSetup,
-    notifications: notificationsSetup,
-    http: httpSetup,
-    uiSettings: uiSettingsSetup,
-  },
-  plugins: {},
-};
-
-const applicationStart = applicationServiceMock.createInternalStartContract();
-const docLinksStart = docLinksServiceMock.createStartContract();
-const httpStart = httpServiceMock.createStartContract();
-const chromeStart = chromeServiceMock.createStartContract();
-const i18nStart = i18nServiceMock.createStartContract();
-const injectedMetadataStart = injectedMetadataServiceMock.createStartContract();
-const notificationsStart = notificationServiceMock.createStartContract();
-const overlayStart = overlayServiceMock.createStartContract();
-const uiSettingsStart = uiSettingsServiceMock.createStartContract();
-const savedObjectsStart = savedObjectsServiceMock.createStartContract();
-const fatalErrorsStart = fatalErrorsServiceMock.createStartContract();
-const mockStorage = { getItem: jest.fn() } as any;
-
-const defaultStartDeps = {
-  core: {
-    application: applicationStart,
-    docLinks: docLinksStart,
-    http: httpStart,
-    chrome: chromeStart,
-    i18n: i18nStart,
-    injectedMetadata: injectedMetadataStart,
-    notifications: notificationsStart,
-    overlays: overlayStart,
-    uiSettings: uiSettingsStart,
-    savedObjects: savedObjectsStart,
-    fatalErrors: fatalErrorsStart,
-  },
-  lastSubUrlStorage: mockStorage,
-  targetDomElement: document.createElement('div'),
-  plugins: {},
-};
-
-afterEach(() => {
-  jest.clearAllMocks();
-  jest.resetModules();
-  mockLoadOrder.length = 0;
-});
-
-describe('#setup()', () => {
-  describe('default', () => {
-    it('initializes new platform shim module with core APIs', () => {
-      const legacyPlatform = new LegacyPlatformService({
-        ...defaultParams,
-      });
-
-      legacyPlatform.setup(defaultSetupDeps);
-
-      expect(mockUiNewPlatformSetup).toHaveBeenCalledTimes(1);
-      expect(mockUiNewPlatformSetup).toHaveBeenCalledWith(expect.any(Object), {});
-    });
-
-    it('throws error if requireNewPlatformShimModule is undefined', () => {
-      const legacyPlatform = new LegacyPlatformService({
-        ...defaultParams,
-        requireNewPlatformShimModule: undefined,
-      });
-
-      expect(() => {
-        legacyPlatform.setup(defaultSetupDeps);
-      }).toThrowErrorMatchingInlineSnapshot(
-        `"requireNewPlatformShimModule must be specified when rendering a legacy application"`
-      );
-
-      expect(mockUiNewPlatformSetup).not.toHaveBeenCalled();
-    });
-  });
-});
-
-describe('#start()', () => {
-  it('fetches and sets legacy lastSubUrls', () => {
-    chromeStart.navLinks.getAll.mockReturnValue([
-      { id: 'link1', baseUrl: 'http://wowza.com/app1', legacy: true } as any,
-    ]);
-    mockStorage.getItem.mockReturnValue('http://wowza.com/app1/subUrl');
-    const legacyPlatform = new LegacyPlatformService({
-      ...defaultParams,
-    });
-
-    legacyPlatform.setup(defaultSetupDeps);
-    legacyPlatform.start({ ...defaultStartDeps, lastSubUrlStorage: mockStorage });
-
-    expect(chromeStart.navLinks.update).toHaveBeenCalledWith('link1', {
-      url: 'http://wowza.com/app1/subUrl',
-    });
-  });
-
-  it('initializes ui/new_platform with core APIs', () => {
-    const legacyPlatform = new LegacyPlatformService({
-      ...defaultParams,
-    });
-
-    legacyPlatform.setup(defaultSetupDeps);
-    legacyPlatform.start(defaultStartDeps);
-
-    expect(mockUiNewPlatformStart).toHaveBeenCalledTimes(1);
-    expect(mockUiNewPlatformStart).toHaveBeenCalledWith(expect.any(Object), {});
-  });
-
-  it('throws error if requireNewPlatformShimeModule is undefined', () => {
-    const legacyPlatform = new LegacyPlatformService({
-      ...defaultParams,
-      requireNewPlatformShimModule: undefined,
-    });
-
-    expect(() => {
-      legacyPlatform.start(defaultStartDeps);
-    }).toThrowErrorMatchingInlineSnapshot(
-      `"requireNewPlatformShimModule must be specified when rendering a legacy application"`
-    );
-
-    expect(mockUiNewPlatformStart).not.toHaveBeenCalled();
-  });
-
-  it('resolves getStartServices with core and plugin APIs', async () => {
-    const legacyPlatform = new LegacyPlatformService({
-      ...defaultParams,
-    });
-
-    legacyPlatform.setup(defaultSetupDeps);
-    legacyPlatform.start(defaultStartDeps);
-
-    const { getStartServices } = mockUiNewPlatformSetup.mock.calls[0][0];
-    const [coreStart, pluginsStart] = await getStartServices();
-    expect(coreStart).toEqual(expect.any(Object));
-    expect(pluginsStart).toBe(defaultStartDeps.plugins);
-  });
-
-  it('passes the targetDomElement to legacy bootstrap module', () => {
-    const legacyPlatform = new LegacyPlatformService({
-      ...defaultParams,
-    });
-
-    legacyPlatform.setup(defaultSetupDeps);
-    legacyPlatform.start(defaultStartDeps);
-
-    expect(mockUiChromeBootstrap).toHaveBeenCalledTimes(1);
-    expect(mockUiChromeBootstrap).toHaveBeenCalledWith(defaultStartDeps.targetDomElement);
-  });
-
-  describe('load order', () => {
-    it('loads ui/modules before ui/chrome, and both before legacy files', () => {
-      const legacyPlatform = new LegacyPlatformService({
-        ...defaultParams,
-      });
-
-      expect(mockLoadOrder).toEqual([]);
-
-      legacyPlatform.setup(defaultSetupDeps);
-      legacyPlatform.start(defaultStartDeps);
-
-      expect(mockLoadOrder).toMatchInlineSnapshot(`
-        Array [
-          "ui/chrome",
-          "legacy files",
-        ]
-      `);
-    });
-  });
-});
-
-describe('#stop()', () => {
-  it('does nothing if angular was not bootstrapped to targetDomElement', () => {
-    const targetDomElement = document.createElement('div');
-    targetDomElement.innerHTML = `
-      <h1>this should not be removed</h1>
-    `;
-
-    const legacyPlatform = new LegacyPlatformService({
-      ...defaultParams,
-    });
-
-    legacyPlatform.stop();
-    expect(targetDomElement).toMatchInlineSnapshot(`
-      <div>
-        
-            
-        <h1>
-          this should not be removed
-        </h1>
-        
-          
-      </div>
-    `);
-  });
-
-  it('destroys the angular scope and empties the targetDomElement if angular is bootstrapped to targetDomElement', async () => {
-    const targetDomElement = document.createElement('div');
-    const scopeDestroySpy = jest.fn();
-
-    const legacyPlatform = new LegacyPlatformService({
-      ...defaultParams,
-    });
-
-    // simulate bootstrapping with a module "foo"
-    angular.module('foo', []).directive('bar', () => ({
-      restrict: 'E',
-      link($scope) {
-        $scope.$on('$destroy', scopeDestroySpy);
-      },
-    }));
-
-    targetDomElement.innerHTML = `
-      <bar></bar>
-    `;
-
-    angular.bootstrap(targetDomElement, ['foo']);
-
-    await legacyPlatform.setup(defaultSetupDeps);
-    legacyPlatform.start({ ...defaultStartDeps, targetDomElement });
-    legacyPlatform.stop();
-
-    expect(targetDomElement).toMatchInlineSnapshot(`
-      <div
-        class="ng-scope"
-      />
-    `);
-    expect(scopeDestroySpy).toHaveBeenCalledTimes(1);
-  });
-});
diff --git a/src/core/public/legacy/legacy_service.ts b/src/core/public/legacy/legacy_service.ts
deleted file mode 100644
index 78a9219f3d6940..00000000000000
--- a/src/core/public/legacy/legacy_service.ts
+++ /dev/null
@@ -1,204 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import angular from 'angular';
-import { first } from 'rxjs/operators';
-import { Subject } from 'rxjs';
-import { InternalCoreSetup, InternalCoreStart } from '../core_system';
-import { LegacyCoreSetup, LegacyCoreStart, MountPoint } from '../';
-
-/** @internal */
-export interface LegacyPlatformParams {
-  requireLegacyFiles?: () => void;
-  requireLegacyBootstrapModule?: () => BootstrapModule;
-  requireNewPlatformShimModule?: () => {
-    __setup__: (legacyCore: LegacyCoreSetup, plugins: Record<string, unknown>) => void;
-    __start__: (legacyCore: LegacyCoreStart, plugins: Record<string, unknown>) => void;
-  };
-}
-
-interface SetupDeps {
-  core: InternalCoreSetup;
-  plugins: Record<string, unknown>;
-}
-
-interface StartDeps {
-  core: InternalCoreStart;
-  plugins: Record<string, unknown>;
-  lastSubUrlStorage?: Storage;
-  targetDomElement?: HTMLElement;
-}
-
-interface BootstrapModule {
-  bootstrap: MountPoint;
-}
-
-/**
- * The LegacyPlatformService is responsible for initializing
- * the legacy platform by injecting parts of the new platform
- * services into the legacy platform modules, like ui/modules,
- * and then bootstrapping the ui/chrome or ~~ui/test_harness~~ to
- * setup either the app or browser tests.
- */
-export class LegacyPlatformService {
-  /** Symbol to represent the legacy platform as a fake "plugin". Used by the ContextService */
-  public readonly legacyId = Symbol();
-  private bootstrapModule?: BootstrapModule;
-  private targetDomElement?: HTMLElement;
-  private readonly startDependencies$ = new Subject<[LegacyCoreStart, object, {}]>();
-  private readonly startDependencies = this.startDependencies$.pipe(first()).toPromise();
-
-  constructor(private readonly params: LegacyPlatformParams) {}
-
-  public setup({ core, plugins }: SetupDeps) {
-    // Always register legacy apps, even if not in legacy mode.
-    core.injectedMetadata.getLegacyMetadata().nav.forEach((navLink: any) =>
-      core.application.registerLegacyApp({
-        id: navLink.id,
-        order: navLink.order,
-        title: navLink.title,
-        euiIconType: navLink.euiIconType,
-        icon: navLink.icon,
-        appUrl: navLink.url,
-        subUrlBase: navLink.subUrlBase,
-        linkToLastSubUrl: navLink.linkToLastSubUrl,
-        category: navLink.category,
-        disableSubUrlTracking: navLink.disableSubUrlTracking,
-      })
-    );
-
-    const legacyCore: LegacyCoreSetup = {
-      ...core,
-      getStartServices: () => this.startDependencies,
-      application: {
-        ...core.application,
-        register: notSupported(`core.application.register()`),
-        registerMountContext: notSupported(`core.application.registerMountContext()`),
-      },
-    };
-
-    // Inject parts of the new platform into parts of the legacy platform
-    // so that legacy APIs/modules can mimic their new platform counterparts
-    if (core.injectedMetadata.getLegacyMode()) {
-      if (!this.params.requireNewPlatformShimModule) {
-        throw new Error(
-          `requireNewPlatformShimModule must be specified when rendering a legacy application`
-        );
-      }
-
-      this.params.requireNewPlatformShimModule().__setup__(legacyCore, plugins);
-    }
-  }
-
-  public start({
-    core,
-    targetDomElement,
-    plugins,
-    lastSubUrlStorage = window.sessionStorage,
-  }: StartDeps) {
-    // Initialize legacy sub urls
-    core.chrome.navLinks
-      .getAll()
-      .filter((link) => link.legacy)
-      .forEach((navLink) => {
-        const lastSubUrl = lastSubUrlStorage.getItem(`lastSubUrl:${navLink.baseUrl}`);
-        core.chrome.navLinks.update(navLink.id, {
-          url: lastSubUrl || navLink.url || navLink.baseUrl,
-        });
-      });
-
-    // Only import and bootstrap legacy platform if we're in legacy mode.
-    if (!core.injectedMetadata.getLegacyMode()) {
-      return;
-    }
-
-    const legacyCore: LegacyCoreStart = {
-      ...core,
-      application: {
-        applications$: core.application.applications$,
-        currentAppId$: core.application.currentAppId$,
-        capabilities: core.application.capabilities,
-        getUrlForApp: core.application.getUrlForApp,
-        navigateToApp: core.application.navigateToApp,
-        navigateToUrl: core.application.navigateToUrl,
-        registerMountContext: notSupported(`core.application.registerMountContext()`),
-      },
-    };
-
-    this.startDependencies$.next([legacyCore, plugins, {}]);
-
-    if (!this.params.requireNewPlatformShimModule) {
-      throw new Error(
-        `requireNewPlatformShimModule must be specified when rendering a legacy application`
-      );
-    }
-    if (!this.params.requireLegacyBootstrapModule) {
-      throw new Error(
-        `requireLegacyBootstrapModule must be specified when rendering a legacy application`
-      );
-    }
-
-    // Inject parts of the new platform into parts of the legacy platform
-    // so that legacy APIs/modules can mimic their new platform counterparts
-    this.params.requireNewPlatformShimModule().__start__(legacyCore, plugins);
-
-    // Load the bootstrap module before loading the legacy platform files so that
-    // the bootstrap module can modify the environment a bit first
-    this.bootstrapModule = this.params.requireLegacyBootstrapModule();
-
-    // require the files that will tie into the legacy platform
-    if (this.params.requireLegacyFiles) {
-      this.params.requireLegacyFiles();
-    }
-
-    if (!this.bootstrapModule) {
-      throw new Error('Bootstrap module must be loaded before `start`');
-    }
-
-    this.targetDomElement = targetDomElement;
-
-    // `targetDomElement` is always defined when in legacy mode
-    this.bootstrapModule.bootstrap(this.targetDomElement!);
-  }
-
-  public stop() {
-    if (!this.targetDomElement) {
-      return;
-    }
-
-    const angularRoot = angular.element(this.targetDomElement);
-    const injector$ = angularRoot.injector();
-
-    // if we haven't gotten to the point of bootstrapping
-    // angular, injector$ won't be defined
-    if (!injector$) {
-      return;
-    }
-
-    // destroy the root angular scope
-    injector$.get('$rootScope').$destroy();
-
-    // clear the inner html of the root angular element
-    this.targetDomElement.textContent = '';
-  }
-}
-
-const notSupported = (methodName: string) => (...args: any[]) => {
-  throw new Error(`${methodName} is not supported in the legacy platform.`);
-};
diff --git a/src/core/public/mocks.ts b/src/core/public/mocks.ts
index 2f7f6fae944369..8ed415c09806c7 100644
--- a/src/core/public/mocks.ts
+++ b/src/core/public/mocks.ts
@@ -42,7 +42,6 @@ export { fatalErrorsServiceMock } from './fatal_errors/fatal_errors_service.mock
 export { httpServiceMock } from './http/http_service.mock';
 export { i18nServiceMock } from './i18n/i18n_service.mock';
 export { injectedMetadataServiceMock } from './injected_metadata/injected_metadata_service.mock';
-export { legacyPlatformServiceMock } from './legacy/legacy_service.mock';
 export { notificationServiceMock } from './notifications/notifications_service.mock';
 export { overlayServiceMock } from './overlays/overlay_service.mock';
 export { uiSettingsServiceMock } from './ui_settings/ui_settings_service.mock';
@@ -166,6 +165,7 @@ function createAppMountParametersMock(appBasePath = '') {
     element: document.createElement('div'),
     history,
     onAppLeave: jest.fn(),
+    setHeaderActionMenu: jest.fn(),
   };
 
   return params;
diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
index 6f25f46c76fb91..c473ea67d9bcdc 100644
--- a/src/core/public/public.api.md
+++ b/src/core/public/public.api.md
@@ -7,6 +7,7 @@
 import { Action } from 'history';
 import { ApiResponse } from '@elastic/elasticsearch/lib/Transport';
 import Boom from 'boom';
+import { ErrorToastOptions as ErrorToastOptions_2 } from 'src/core/public/notifications';
 import { EuiBreadcrumb } from '@elastic/eui';
 import { EuiButtonEmptyProps } from '@elastic/eui';
 import { EuiConfirmModalProps } from '@elastic/eui';
@@ -27,7 +28,9 @@ import { PublicUiSettingsParams as PublicUiSettingsParams_2 } from 'src/core/ser
 import React from 'react';
 import { RecursiveReadonly } from '@kbn/utility-types';
 import * as Rx from 'rxjs';
+import { SavedObject as SavedObject_2 } from 'src/core/server';
 import { ShallowPromise } from '@kbn/utility-types';
+import { ToastInputFields as ToastInputFields_2 } from 'src/core/public/notifications';
 import { TransportRequestOptions } from '@elastic/elasticsearch/lib/Transport';
 import { TransportRequestParams } from '@elastic/elasticsearch/lib/Transport';
 import { TransportRequestPromise } from '@elastic/elasticsearch/lib/Transport';
@@ -39,25 +42,18 @@ import { UserProvidedValues as UserProvidedValues_2 } from 'src/core/server/type
 // @internal (undocumented)
 export function __kbnBootstrap__(): void;
 
-// @public
-export interface App<HistoryLocationState = unknown> extends AppBase {
-    appRoute?: string;
-    chromeless?: boolean;
-    exactRoute?: boolean;
-    mount: AppMount<HistoryLocationState> | AppMountDeprecated<HistoryLocationState>;
-}
-
 // @public (undocumented)
-export interface AppBase {
+export interface App<HistoryLocationState = unknown> {
+    appRoute?: string;
     capabilities?: Partial<Capabilities>;
     category?: AppCategory;
     chromeless?: boolean;
     defaultPath?: string;
     euiIconType?: string;
+    exactRoute?: boolean;
     icon?: string;
     id: string;
-    // @internal
-    legacy?: boolean;
+    mount: AppMount<HistoryLocationState> | AppMountDeprecated<HistoryLocationState>;
     navLinkStatus?: AppNavLinkStatus;
     order?: number;
     status?: AppStatus;
@@ -121,7 +117,7 @@ export interface ApplicationSetup {
 
 // @public (undocumented)
 export interface ApplicationStart {
-    applications$: Observable<ReadonlyMap<string, PublicAppInfo | PublicLegacyAppInfo>>;
+    applications$: Observable<ReadonlyMap<string, PublicAppInfo>>;
     capabilities: RecursiveReadonly<Capabilities>;
     currentAppId$: Observable<string | undefined>;
     getUrlForApp(appId: string, options?: {
@@ -165,6 +161,7 @@ export interface AppMountParameters<HistoryLocationState = unknown> {
     element: HTMLElement;
     history: ScopedHistory<HistoryLocationState>;
     onAppLeave: (handler: AppLeaveHandler) => void;
+    setHeaderActionMenu: (menuMount: MountPoint | undefined) => void;
 }
 
 // @public
@@ -185,10 +182,10 @@ export enum AppStatus {
 export type AppUnmount = () => void;
 
 // @public
-export type AppUpdatableFields = Pick<AppBase, 'status' | 'navLinkStatus' | 'tooltip' | 'defaultPath'>;
+export type AppUpdatableFields = Pick<App, 'status' | 'navLinkStatus' | 'tooltip' | 'defaultPath'>;
 
 // @public
-export type AppUpdater = (app: AppBase) => Partial<AppUpdatableFields> | undefined;
+export type AppUpdater = (app: App) => Partial<AppUpdatableFields> | undefined;
 
 // @public
 export function assertNever(x: never): never;
@@ -226,10 +223,6 @@ export type ChromeBreadcrumb = EuiBreadcrumb;
 
 // @public
 export interface ChromeDocTitle {
-    // @internal (undocumented)
-    __legacy: {
-        setBaseTitle(baseTitle: string): void;
-    };
     change(newTitle: string | string[]): void;
     reset(): void;
 }
@@ -289,28 +282,18 @@ export interface ChromeNavControls {
 
 // @public (undocumented)
 export interface ChromeNavLink {
-    // @deprecated
-    readonly active?: boolean;
     readonly baseUrl: string;
     readonly category?: AppCategory;
-    // @deprecated
     readonly disabled?: boolean;
-    // @deprecated
-    readonly disableSubUrlTracking?: boolean;
     readonly euiIconType?: string;
     readonly hidden?: boolean;
-    readonly href?: string;
+    readonly href: string;
     readonly icon?: string;
     readonly id: string;
-    // @internal
-    readonly legacy: boolean;
-    // @deprecated
-    readonly linkToLastSubUrl?: boolean;
     readonly order?: number;
-    // @deprecated
-    readonly subUrlBase?: string;
     readonly title: string;
     readonly tooltip?: string;
+    // Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "AppBase"
     readonly url?: string;
 }
 
@@ -323,12 +306,14 @@ export interface ChromeNavLinks {
     getNavLinks$(): Observable<Array<Readonly<ChromeNavLink>>>;
     has(id: string): boolean;
     showOnly(id: string): void;
+    // Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "AppBase"
+    //
     // @deprecated
     update(id: string, values: ChromeNavLinkUpdateableFields): ChromeNavLink | undefined;
 }
 
 // @public (undocumented)
-export type ChromeNavLinkUpdateableFields = Partial<Pick<ChromeNavLink, 'active' | 'disabled' | 'hidden' | 'url' | 'subUrlBase' | 'href'>>;
+export type ChromeNavLinkUpdateableFields = Partial<Pick<ChromeNavLink, 'disabled' | 'hidden' | 'url' | 'href'>>;
 
 // @public
 export interface ChromeRecentlyAccessed {
@@ -880,52 +865,6 @@ export interface IUiSettingsClient {
     set: (key: string, value: any) => Promise<boolean>;
 }
 
-// @public (undocumented)
-export interface LegacyApp extends AppBase {
-    // (undocumented)
-    appUrl: string;
-    // (undocumented)
-    disableSubUrlTracking?: boolean;
-    // (undocumented)
-    linkToLastSubUrl?: boolean;
-    // (undocumented)
-    subUrlBase?: string;
-}
-
-// @public @deprecated
-export interface LegacyCoreSetup extends CoreSetup<any, any> {
-    // Warning: (ae-forgotten-export) The symbol "InjectedMetadataSetup" needs to be exported by the entry point index.d.ts
-    //
-    // @deprecated (undocumented)
-    injectedMetadata: InjectedMetadataSetup;
-}
-
-// @public @deprecated
-export interface LegacyCoreStart extends CoreStart {
-    // Warning: (ae-forgotten-export) The symbol "InjectedMetadataStart" needs to be exported by the entry point index.d.ts
-    //
-    // @deprecated (undocumented)
-    injectedMetadata: InjectedMetadataStart;
-}
-
-// @public (undocumented)
-export interface LegacyNavLink {
-    // (undocumented)
-    category?: AppCategory;
-    // (undocumented)
-    euiIconType?: string;
-    // (undocumented)
-    icon?: string;
-    // (undocumented)
-    id: string;
-    // (undocumented)
-    order: number;
-    // (undocumented)
-    title: string;
-    // (undocumented)
-    url: string;
-}
-
 // @public
 export function modifyUrl(url: string, urlModifier: (urlParts: URLMeaningfulParts) => Partial<URLMeaningfulParts> | void): string;
 
@@ -1039,19 +978,11 @@ export type PluginOpaqueId = symbol;
 
 // @public
 export type PublicAppInfo = Omit<App, 'mount' | 'updater$'> & {
-    legacy: false;
     status: AppStatus;
     navLinkStatus: AppNavLinkStatus;
     appRoute: string;
 };
 
-// @public
-export type PublicLegacyAppInfo = Omit<LegacyApp, 'updater$'> & {
-    legacy: true;
-    status: AppStatus;
-    navLinkStatus: AppNavLinkStatus;
-};
-
 // @public
 export type PublicUiSettingsParams = Omit<UiSettingsParams, 'schema'>;
 
@@ -1188,8 +1119,10 @@ export interface SavedObjectsFindOptions {
     // (undocumented)
     defaultSearchOperator?: 'AND' | 'OR';
     fields?: string[];
+    // Warning: (ae-forgotten-export) The symbol "KueryNode" needs to be exported by the entry point index.d.ts
+    //
     // (undocumented)
-    filter?: string;
+    filter?: string | KueryNode;
     // (undocumented)
     hasReference?: {
         type: string;
@@ -1542,6 +1475,6 @@ export interface UserProvidedValues<T = any> {
 
 // Warnings were encountered during analysis:
 //
-// src/core/public/core_system.ts:215:21 - (ae-forgotten-export) The symbol "InternalApplicationStart" needs to be exported by the entry point index.d.ts
+// src/core/public/core_system.ts:185:21 - (ae-forgotten-export) The symbol "InternalApplicationStart" needs to be exported by the entry point index.d.ts
 
 ```
diff --git a/src/core/public/rendering/index.ts b/src/core/public/rendering/index.ts
index 7c1ea7031b763c..1de82a50a36b5b 100644
--- a/src/core/public/rendering/index.ts
+++ b/src/core/public/rendering/index.ts
@@ -17,4 +17,4 @@
  * under the License.
  */
 
-export { RenderingService, RenderingStart } from './rendering_service';
+export { RenderingService } from './rendering_service';
diff --git a/src/core/public/rendering/rendering_service.mock.ts b/src/core/public/rendering/rendering_service.mock.ts
index bb4e7cb49f1509..bb4723e69ab5e8 100644
--- a/src/core/public/rendering/rendering_service.mock.ts
+++ b/src/core/public/rendering/rendering_service.mock.ts
@@ -17,25 +17,16 @@
  * under the License.
  */
 
-import { RenderingStart, RenderingService } from './rendering_service';
-
-const createStartContractMock = () => {
-  const setupContract: jest.Mocked<RenderingStart> = {
-    legacyTargetDomElement: document.createElement('div'),
-  };
-  return setupContract;
-};
+import { RenderingService } from './rendering_service';
 
 type RenderingServiceContract = PublicMethodsOf<RenderingService>;
 const createMock = () => {
   const mocked: jest.Mocked<RenderingServiceContract> = {
     start: jest.fn(),
   };
-  mocked.start.mockReturnValue(createStartContractMock());
   return mocked;
 };
 
 export const renderingServiceMock = {
   create: createMock,
-  createStartContract: createStartContractMock,
 };
diff --git a/src/core/public/rendering/rendering_service.test.tsx b/src/core/public/rendering/rendering_service.test.tsx
index 437a602a3d4473..37658cb51c46f4 100644
--- a/src/core/public/rendering/rendering_service.test.tsx
+++ b/src/core/public/rendering/rendering_service.test.tsx
@@ -23,7 +23,6 @@ import { act } from 'react-dom/test-utils';
 import { RenderingService } from './rendering_service';
 import { applicationServiceMock } from '../application/application_service.mock';
 import { chromeServiceMock } from '../chrome/chrome_service.mock';
-import { injectedMetadataServiceMock } from '../injected_metadata/injected_metadata_service.mock';
 import { overlayServiceMock } from '../overlays/overlay_service.mock';
 import { BehaviorSubject } from 'rxjs';
 
@@ -31,7 +30,6 @@ describe('RenderingService#start', () => {
   let application: ReturnType<typeof applicationServiceMock.createInternalStartContract>;
   let chrome: ReturnType<typeof chromeServiceMock.createStartContract>;
   let overlays: ReturnType<typeof overlayServiceMock.createStartContract>;
-  let injectedMetadata: ReturnType<typeof injectedMetadataServiceMock.createStartContract>;
   let targetDomElement: HTMLDivElement;
   let rendering: RenderingService;
 
@@ -45,8 +43,6 @@ describe('RenderingService#start', () => {
     overlays = overlayServiceMock.createStartContract();
     overlays.banners.getComponent.mockReturnValue(<div>I&apos;m a banner!</div>);
 
-    injectedMetadata = injectedMetadataServiceMock.createStartContract();
-
     targetDomElement = document.createElement('div');
 
     rendering = new RenderingService();
@@ -56,20 +52,14 @@ describe('RenderingService#start', () => {
     return rendering.start({
       application,
       chrome,
-      injectedMetadata,
       overlays,
       targetDomElement,
     });
   };
 
-  describe('standard mode', () => {
-    beforeEach(() => {
-      injectedMetadata.getLegacyMode.mockReturnValue(false);
-    });
-
-    it('renders application service into provided DOM element', () => {
-      startService();
-      expect(targetDomElement.querySelector('div.application')).toMatchInlineSnapshot(`
+  it('renders application service into provided DOM element', () => {
+    startService();
+    expect(targetDomElement.querySelector('div.application')).toMatchInlineSnapshot(`
               <div
                 class="application class-name"
               >
@@ -78,50 +68,50 @@ describe('RenderingService#start', () => {
                 </div>
               </div>
           `);
-    });
+  });
 
-    it('adds the `chrome-hidden` class to the AppWrapper when chrome is hidden', () => {
-      const isVisible$ = new BehaviorSubject(true);
-      chrome.getIsVisible$.mockReturnValue(isVisible$);
-      startService();
+  it('adds the `chrome-hidden` class to the AppWrapper when chrome is hidden', () => {
+    const isVisible$ = new BehaviorSubject(true);
+    chrome.getIsVisible$.mockReturnValue(isVisible$);
+    startService();
 
-      const appWrapper = targetDomElement.querySelector('div.app-wrapper')!;
-      expect(appWrapper.className).toEqual('app-wrapper');
+    const appWrapper = targetDomElement.querySelector('div.app-wrapper')!;
+    expect(appWrapper.className).toEqual('app-wrapper');
 
-      act(() => isVisible$.next(false));
-      expect(appWrapper.className).toEqual('app-wrapper hidden-chrome');
+    act(() => isVisible$.next(false));
+    expect(appWrapper.className).toEqual('app-wrapper hidden-chrome');
 
-      act(() => isVisible$.next(true));
-      expect(appWrapper.className).toEqual('app-wrapper');
-    });
+    act(() => isVisible$.next(true));
+    expect(appWrapper.className).toEqual('app-wrapper');
+  });
 
-    it('adds the application classes to the AppContainer', () => {
-      const applicationClasses$ = new BehaviorSubject<string[]>([]);
-      chrome.getApplicationClasses$.mockReturnValue(applicationClasses$);
-      startService();
+  it('adds the application classes to the AppContainer', () => {
+    const applicationClasses$ = new BehaviorSubject<string[]>([]);
+    chrome.getApplicationClasses$.mockReturnValue(applicationClasses$);
+    startService();
 
-      const appContainer = targetDomElement.querySelector('div.application')!;
-      expect(appContainer.className).toEqual('application');
+    const appContainer = targetDomElement.querySelector('div.application')!;
+    expect(appContainer.className).toEqual('application');
 
-      act(() => applicationClasses$.next(['classA', 'classB']));
-      expect(appContainer.className).toEqual('application classA classB');
+    act(() => applicationClasses$.next(['classA', 'classB']));
+    expect(appContainer.className).toEqual('application classA classB');
 
-      act(() => applicationClasses$.next(['classC']));
-      expect(appContainer.className).toEqual('application classC');
+    act(() => applicationClasses$.next(['classC']));
+    expect(appContainer.className).toEqual('application classC');
 
-      act(() => applicationClasses$.next([]));
-      expect(appContainer.className).toEqual('application');
-    });
+    act(() => applicationClasses$.next([]));
+    expect(appContainer.className).toEqual('application');
+  });
 
-    it('contains wrapper divs', () => {
-      startService();
-      expect(targetDomElement.querySelector('div.app-wrapper')).toBeDefined();
-      expect(targetDomElement.querySelector('div.app-wrapper-pannel')).toBeDefined();
-    });
+  it('contains wrapper divs', () => {
+    startService();
+    expect(targetDomElement.querySelector('div.app-wrapper')).toBeDefined();
+    expect(targetDomElement.querySelector('div.app-wrapper-pannel')).toBeDefined();
+  });
 
-    it('renders the banner UI', () => {
-      startService();
-      expect(targetDomElement.querySelector('#globalBannerList')).toMatchInlineSnapshot(`
+  it('renders the banner UI', () => {
+    startService();
+    expect(targetDomElement.querySelector('#globalBannerList')).toMatchInlineSnapshot(`
               <div
                 id="globalBannerList"
               >
@@ -130,36 +120,5 @@ describe('RenderingService#start', () => {
                 </div>
               </div>
           `);
-    });
-  });
-
-  describe('legacy mode', () => {
-    beforeEach(() => {
-      injectedMetadata.getLegacyMode.mockReturnValue(true);
-    });
-
-    it('renders into provided DOM element', () => {
-      startService();
-
-      expect(targetDomElement).toMatchInlineSnapshot(`
-          <div>
-            <div
-              class="content"
-              data-test-subj="kibanaChrome"
-            >
-              <div>
-                Hello chrome!
-              </div>
-              <div />
-            </div>
-          </div>
-      `);
-    });
-
-    it('returns a div for the legacy service to render into', () => {
-      const { legacyTargetDomElement } = startService();
-
-      expect(targetDomElement.contains(legacyTargetDomElement!)).toBe(true);
-    });
   });
 });
diff --git a/src/core/public/rendering/rendering_service.tsx b/src/core/public/rendering/rendering_service.tsx
index 58b8c1921e333b..a20e14dbf61c5b 100644
--- a/src/core/public/rendering/rendering_service.tsx
+++ b/src/core/public/rendering/rendering_service.tsx
@@ -23,14 +23,12 @@ import { I18nProvider } from '@kbn/i18n/react';
 
 import { InternalChromeStart } from '../chrome';
 import { InternalApplicationStart } from '../application';
-import { InjectedMetadataStart } from '../injected_metadata';
 import { OverlayStart } from '../overlays';
 import { AppWrapper, AppContainer } from './app_containers';
 
 interface StartDeps {
   application: InternalApplicationStart;
   chrome: InternalChromeStart;
-  injectedMetadata: InjectedMetadataStart;
   overlays: OverlayStart;
   targetDomElement: HTMLDivElement;
 }
@@ -41,53 +39,28 @@ interface StartDeps {
  * @internalRemarks Currently this only renders Chrome UI. Notifications and
  * Overlays UI should be moved here as well.
  *
- * @returns a DOM element for the legacy platform to render into.
- *
  * @internal
  */
 export class RenderingService {
-  start({
-    application,
-    chrome,
-    injectedMetadata,
-    overlays,
-    targetDomElement,
-  }: StartDeps): RenderingStart {
+  start({ application, chrome, overlays, targetDomElement }: StartDeps) {
     const chromeUi = chrome.getHeaderComponent();
     const appUi = application.getComponent();
     const bannerUi = overlays.banners.getComponent();
 
-    const legacyMode = injectedMetadata.getLegacyMode();
-    const legacyRef = legacyMode ? React.createRef<HTMLDivElement>() : null;
-
     ReactDOM.render(
       <I18nProvider>
         <div className="content" data-test-subj="kibanaChrome">
           {chromeUi}
 
-          {!legacyMode && (
-            <AppWrapper chromeVisible$={chrome.getIsVisible$()}>
-              <div className="app-wrapper-panel">
-                <div id="globalBannerList">{bannerUi}</div>
-                <AppContainer classes$={chrome.getApplicationClasses$()}>{appUi}</AppContainer>
-              </div>
-            </AppWrapper>
-          )}
-
-          {legacyMode && <div ref={legacyRef} />}
+          <AppWrapper chromeVisible$={chrome.getIsVisible$()}>
+            <div className="app-wrapper-panel">
+              <div id="globalBannerList">{bannerUi}</div>
+              <AppContainer classes$={chrome.getApplicationClasses$()}>{appUi}</AppContainer>
+            </div>
+          </AppWrapper>
         </div>
       </I18nProvider>,
       targetDomElement
     );
-
-    return {
-      // When in legacy mode, return legacy div, otherwise undefined.
-      legacyTargetDomElement: legacyRef ? legacyRef.current! : undefined,
-    };
   }
 }
-
-/** @internal */
-export interface RenderingStart {
-  legacyTargetDomElement?: HTMLDivElement;
-}
diff --git a/src/core/public/ui_settings/ui_settings_api.test.ts b/src/core/public/ui_settings/ui_settings_api.test.ts
index 14791407d25508..b15754e5f13839 100644
--- a/src/core/public/ui_settings/ui_settings_api.test.ts
+++ b/src/core/public/ui_settings/ui_settings_api.test.ts
@@ -22,7 +22,7 @@ import fetchMock from 'fetch-mock/es5/client';
 import * as Rx from 'rxjs';
 import { takeUntil, toArray } from 'rxjs/operators';
 
-import { setup as httpSetup } from '../../../test_utils/public/http_test_setup';
+import { setup as httpSetup } from '../../test_helpers/http_test_setup';
 import { UiSettingsApi } from './ui_settings_api';
 
 function setup() {
diff --git a/src/core/server/config/integration_tests/config_deprecation.test.ts b/src/core/server/config/integration_tests/config_deprecation.test.ts
index 65f5bbdac52489..3ebf6d507a2fdf 100644
--- a/src/core/server/config/integration_tests/config_deprecation.test.ts
+++ b/src/core/server/config/integration_tests/config_deprecation.test.ts
@@ -19,7 +19,7 @@
 
 import { mockLoggingSystem } from './config_deprecation.test.mocks';
 import { loggingSystemMock } from '../../logging/logging_system.mock';
-import * as kbnTestServer from '../../../../test_utils/kbn_server';
+import * as kbnTestServer from '../../../test_helpers/kbn_server';
 
 describe('configuration deprecations', () => {
   let root: ReturnType<typeof kbnTestServer.createRoot>;
diff --git a/src/core/server/core_app/integration_tests/default_route_provider_config.test.ts b/src/core/server/core_app/integration_tests/default_route_provider_config.test.ts
index 3284be5ba4750e..340f45a0a2c189 100644
--- a/src/core/server/core_app/integration_tests/default_route_provider_config.test.ts
+++ b/src/core/server/core_app/integration_tests/default_route_provider_config.test.ts
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import * as kbnTestServer from '../../../../test_utils/kbn_server';
+import * as kbnTestServer from '../../../test_helpers/kbn_server';
 import { Root } from '../../root';
 
 const { startES } = kbnTestServer.createTestServers({
diff --git a/src/core/server/core_app/integration_tests/static_assets.test.ts b/src/core/server/core_app/integration_tests/static_assets.test.ts
index 160ef064a14d96..ca03c4228221ff 100644
--- a/src/core/server/core_app/integration_tests/static_assets.test.ts
+++ b/src/core/server/core_app/integration_tests/static_assets.test.ts
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import * as kbnTestServer from '../../../../test_utils/kbn_server';
+import * as kbnTestServer from '../../../test_helpers/kbn_server';
 import { Root } from '../../root';
 
 describe('Platform assets', function () {
diff --git a/src/core/server/http/integration_tests/core_services.test.ts b/src/core/server/http/integration_tests/core_services.test.ts
index 2b9193a280aeca..f30ff66ed803a8 100644
--- a/src/core/server/http/integration_tests/core_services.test.ts
+++ b/src/core/server/http/integration_tests/core_services.test.ts
@@ -30,7 +30,7 @@ import { LegacyElasticsearchErrorHelpers } from '../../elasticsearch/legacy';
 
 import { elasticsearchClientMock } from '../../elasticsearch/client/mocks';
 import { ResponseError } from '@elastic/elasticsearch/lib/errors';
-import * as kbnTestServer from '../../../../test_utils/kbn_server';
+import * as kbnTestServer from '../../../test_helpers/kbn_server';
 import { InternalElasticsearchServiceStart } from '../../elasticsearch';
 
 interface User {
diff --git a/src/core/server/http_resources/integration_tests/http_resources_service.test.ts b/src/core/server/http_resources/integration_tests/http_resources_service.test.ts
index eee7dc27860761..624cdbb7f9655a 100644
--- a/src/core/server/http_resources/integration_tests/http_resources_service.test.ts
+++ b/src/core/server/http_resources/integration_tests/http_resources_service.test.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 import { schema } from '@kbn/config-schema';
-import * as kbnTestServer from '../../../../test_utils/kbn_server';
+import * as kbnTestServer from '../../../test_helpers/kbn_server';
 
 describe('http resources service', () => {
   describe('register', () => {
diff --git a/src/core/server/index.ts b/src/core/server/index.ts
index 5422cbc2180ef7..c17d3d75467798 100644
--- a/src/core/server/index.ts
+++ b/src/core/server/index.ts
@@ -39,6 +39,7 @@
  * @packageDocumentation
  */
 
+import { Type } from '@kbn/config-schema';
 import {
   ElasticsearchServiceSetup,
   ILegacyScopedClusterClient,
@@ -46,7 +47,6 @@ import {
   ElasticsearchServiceStart,
   IScopedClusterClient,
 } from './elasticsearch';
-
 import { HttpServiceSetup, HttpServiceStart } from './http';
 import { HttpResources } from './http_resources';
 
@@ -63,12 +63,7 @@ import { CapabilitiesSetup, CapabilitiesStart } from './capabilities';
 import { MetricsServiceStart } from './metrics';
 import { StatusServiceSetup } from './status';
 import { Auditor, AuditTrailSetup, AuditTrailStart } from './audit_trail';
-import {
-  LoggingServiceSetup,
-  appendersSchema,
-  loggerContextConfigSchema,
-  loggerSchema,
-} from './logging';
+import { AppenderConfigType, appendersSchema, LoggingServiceSetup } from './logging';
 
 export { AuditableEvent, Auditor, AuditorFactory, AuditTrailSetup } from './audit_trail';
 export { bootstrap } from './bootstrap';
@@ -497,8 +492,6 @@ export const config = {
     schema: elasticsearchConfigSchema,
   },
   logging: {
-    appenders: appendersSchema,
-    loggers: loggerSchema,
-    loggerContext: loggerContextConfigSchema,
+    appenders: appendersSchema as Type<AppenderConfigType>,
   },
 };
diff --git a/src/core/server/legacy/config/get_unused_config_keys.test.ts b/src/core/server/legacy/config/get_unused_config_keys.test.ts
index 2106a0748d814f..f8506b57440304 100644
--- a/src/core/server/legacy/config/get_unused_config_keys.test.ts
+++ b/src/core/server/legacy/config/get_unused_config_keys.test.ts
@@ -217,34 +217,4 @@ describe('getUnusedConfigKeys', () => {
       })
     ).toEqual([]);
   });
-
-  describe('using deprecation', () => {
-    it('should use the plugin deprecations provider', async () => {
-      expect(
-        await getUnusedConfigKeys({
-          coreHandledConfigPaths: [],
-          pluginSpecs: [
-            ({
-              getDeprecationsProvider() {
-                return async ({ rename }: any) => [rename('foo1', 'foo2')];
-              },
-              getConfigPrefix: () => 'foo',
-            } as unknown) as LegacyPluginSpec,
-          ],
-          disabledPluginSpecs: [],
-          settings: {
-            foo: {
-              foo: 'dolly',
-              foo1: 'bar',
-            },
-          },
-          legacyConfig: getConfig({
-            foo: {
-              foo2: 'bar',
-            },
-          }),
-        })
-      ).toEqual(['foo.foo']);
-    });
-  });
 });
diff --git a/src/core/server/legacy/config/get_unused_config_keys.ts b/src/core/server/legacy/config/get_unused_config_keys.ts
index 354bf9af042cf7..d10c574f049743 100644
--- a/src/core/server/legacy/config/get_unused_config_keys.ts
+++ b/src/core/server/legacy/config/get_unused_config_keys.ts
@@ -17,10 +17,7 @@
  * under the License.
  */
 
-import { set } from '@elastic/safer-lodash-set';
-import { difference, get } from 'lodash';
-// @ts-expect-error
-import { getTransform } from '../../../../legacy/deprecation/index';
+import { difference } from 'lodash';
 import { unset } from '../../../../legacy/utils';
 import { getFlattenedObject } from '../../../utils';
 import { hasConfigPathIntersection } from '../../config';
@@ -41,21 +38,6 @@ export async function getUnusedConfigKeys({
   settings: LegacyVars;
   legacyConfig: LegacyConfig;
 }) {
-  // transform deprecated plugin settings
-  for (let i = 0; i < pluginSpecs.length; i++) {
-    const spec = pluginSpecs[i];
-    const transform = await getTransform(spec);
-    const prefix = spec.getConfigPrefix();
-
-    // nested plugin prefixes (a.b) translate to nested objects
-    const pluginSettings = get(settings, prefix);
-    if (pluginSettings) {
-      // flattened settings are expected to be converted to nested objects
-      // a.b = true => { a: { b: true }}
-      set(settings, prefix, transform(pluginSettings));
-    }
-  }
-
   // remove config values from disabled plugins
   for (const spec of disabledPluginSpecs) {
     unset(settings, spec.getConfigPrefix());
diff --git a/src/core/server/legacy/config/index.ts b/src/core/server/legacy/config/index.ts
index f10e3f22d53c5e..b56b83ca324cbc 100644
--- a/src/core/server/legacy/config/index.ts
+++ b/src/core/server/legacy/config/index.ts
@@ -19,4 +19,3 @@
 
 export { ensureValidConfiguration } from './ensure_valid_configuration';
 export { LegacyObjectToConfigAdapter } from './legacy_object_to_config_adapter';
-export { convertLegacyDeprecationProvider } from './legacy_deprecation_adapters';
diff --git a/src/core/server/legacy/config/legacy_deprecation_adapters.test.ts b/src/core/server/legacy/config/legacy_deprecation_adapters.test.ts
deleted file mode 100644
index b09f9d00b3bedb..00000000000000
--- a/src/core/server/legacy/config/legacy_deprecation_adapters.test.ts
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { ConfigDeprecation } from '../../config';
-import { configDeprecationFactory } from '../../config/deprecation/deprecation_factory';
-import { applyDeprecations } from '../../config/deprecation/apply_deprecations';
-import { LegacyConfigDeprecationProvider } from '../types';
-import { convertLegacyDeprecationProvider } from './legacy_deprecation_adapters';
-
-jest.spyOn(configDeprecationFactory, 'unusedFromRoot');
-jest.spyOn(configDeprecationFactory, 'renameFromRoot');
-
-const executeHandlers = (handlers: ConfigDeprecation[]) => {
-  handlers.forEach((handler) => {
-    handler({}, '', () => null);
-  });
-};
-
-describe('convertLegacyDeprecationProvider', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  it('returns the same number of handlers', async () => {
-    const legacyProvider: LegacyConfigDeprecationProvider = ({ rename, unused }) => [
-      rename('a', 'b'),
-      unused('c'),
-      unused('d'),
-    ];
-
-    const migrated = await convertLegacyDeprecationProvider(legacyProvider);
-    const handlers = migrated(configDeprecationFactory);
-    expect(handlers).toHaveLength(3);
-  });
-
-  it('invokes the factory "unusedFromRoot" when using legacy "unused"', async () => {
-    const legacyProvider: LegacyConfigDeprecationProvider = ({ rename, unused }) => [
-      rename('a', 'b'),
-      unused('c'),
-      unused('d'),
-    ];
-
-    const migrated = await convertLegacyDeprecationProvider(legacyProvider);
-    const handlers = migrated(configDeprecationFactory);
-    executeHandlers(handlers);
-
-    expect(configDeprecationFactory.unusedFromRoot).toHaveBeenCalledTimes(2);
-    expect(configDeprecationFactory.unusedFromRoot).toHaveBeenCalledWith('c');
-    expect(configDeprecationFactory.unusedFromRoot).toHaveBeenCalledWith('d');
-  });
-
-  it('invokes the factory "renameFromRoot" when using legacy "rename"', async () => {
-    const legacyProvider: LegacyConfigDeprecationProvider = ({ rename, unused }) => [
-      rename('a', 'b'),
-      unused('c'),
-      rename('d', 'e'),
-    ];
-
-    const migrated = await convertLegacyDeprecationProvider(legacyProvider);
-    const handlers = migrated(configDeprecationFactory);
-    executeHandlers(handlers);
-
-    expect(configDeprecationFactory.renameFromRoot).toHaveBeenCalledTimes(2);
-    expect(configDeprecationFactory.renameFromRoot).toHaveBeenCalledWith('a', 'b');
-    expect(configDeprecationFactory.renameFromRoot).toHaveBeenCalledWith('d', 'e');
-  });
-
-  it('properly works in a real use case', async () => {
-    const legacyProvider: LegacyConfigDeprecationProvider = ({ rename, unused }) => [
-      rename('old', 'new'),
-      unused('unused'),
-      unused('notpresent'),
-    ];
-
-    const convertedProvider = await convertLegacyDeprecationProvider(legacyProvider);
-    const handlers = convertedProvider(configDeprecationFactory);
-
-    const rawConfig = {
-      old: 'oldvalue',
-      unused: 'unused',
-      goodValue: 'good',
-    };
-
-    const migrated = applyDeprecations(
-      rawConfig,
-      handlers.map((handler) => ({ deprecation: handler, path: '' }))
-    );
-    expect(migrated).toEqual({ new: 'oldvalue', goodValue: 'good' });
-  });
-});
diff --git a/src/core/server/legacy/config/legacy_deprecation_adapters.ts b/src/core/server/legacy/config/legacy_deprecation_adapters.ts
deleted file mode 100644
index 1e0733969e6628..00000000000000
--- a/src/core/server/legacy/config/legacy_deprecation_adapters.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { ConfigDeprecation, ConfigDeprecationProvider } from '../../config/deprecation';
-import { configDeprecationFactory } from '../../config/deprecation/deprecation_factory';
-import { LegacyConfigDeprecation, LegacyConfigDeprecationProvider } from '../types';
-
-const convertLegacyDeprecation = (
-  legacyDeprecation: LegacyConfigDeprecation
-): ConfigDeprecation => (config, fromPath, logger) => {
-  legacyDeprecation(config, logger);
-  return config;
-};
-
-const legacyUnused = (unusedKey: string): LegacyConfigDeprecation => (settings, log) => {
-  const deprecation = configDeprecationFactory.unusedFromRoot(unusedKey);
-  deprecation(settings, '', log);
-};
-
-const legacyRename = (oldKey: string, newKey: string): LegacyConfigDeprecation => (
-  settings,
-  log
-) => {
-  const deprecation = configDeprecationFactory.renameFromRoot(oldKey, newKey);
-  deprecation(settings, '', log);
-};
-
-/**
- * Async deprecation provider converter for legacy deprecation implementation
- *
- * @internal
- */
-export const convertLegacyDeprecationProvider = async (
-  legacyProvider: LegacyConfigDeprecationProvider
-): Promise<ConfigDeprecationProvider> => {
-  const legacyDeprecations = await legacyProvider({
-    rename: legacyRename,
-    unused: legacyUnused,
-  });
-  return () => legacyDeprecations.map(convertLegacyDeprecation);
-};
diff --git a/src/core/server/legacy/integration_tests/legacy_service.test.ts b/src/core/server/legacy/integration_tests/legacy_service.test.ts
index 1dc8d53e7c3d64..ca3573e730d3f4 100644
--- a/src/core/server/legacy/integration_tests/legacy_service.test.ts
+++ b/src/core/server/legacy/integration_tests/legacy_service.test.ts
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import * as kbnTestServer from '../../../../test_utils/kbn_server';
+import * as kbnTestServer from '../../../test_helpers/kbn_server';
 
 describe('legacy service', () => {
   describe('http server', () => {
diff --git a/src/core/server/legacy/integration_tests/logging.test.ts b/src/core/server/legacy/integration_tests/logging.test.ts
index 2581c85debf267..2ebe17ea92978c 100644
--- a/src/core/server/legacy/integration_tests/logging.test.ts
+++ b/src/core/server/legacy/integration_tests/logging.test.ts
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import * as kbnTestServer from '../../../../test_utils/kbn_server';
+import * as kbnTestServer from '../../../test_helpers/kbn_server';
 
 import {
   getPlatformLogsFromMock,
diff --git a/src/core/server/legacy/legacy_service.test.ts b/src/core/server/legacy/legacy_service.test.ts
index 45869fd12d2b4b..d0492ea88c5e8a 100644
--- a/src/core/server/legacy/legacy_service.test.ts
+++ b/src/core/server/legacy/legacy_service.test.ts
@@ -19,9 +19,7 @@
 
 jest.mock('../../../legacy/server/kbn_server');
 jest.mock('../../../cli/cluster/cluster_manager');
-jest.mock('./config/legacy_deprecation_adapters', () => ({
-  convertLegacyDeprecationProvider: (provider: any) => Promise.resolve(provider),
-}));
+
 import {
   findLegacyPluginSpecsMock,
   logLegacyThirdPartyPluginDeprecationWarningMock,
@@ -446,46 +444,8 @@ describe('#discoverPlugins()', () => {
     expect(findLegacyPluginSpecs).toHaveBeenCalledWith(expect.any(Object), logger, env.packageInfo);
   });
 
-  it(`register legacy plugin's deprecation providers`, async () => {
-    findLegacyPluginSpecsMock.mockImplementation(
-      (settings) =>
-        Promise.resolve({
-          pluginSpecs: [
-            {
-              getDeprecationsProvider: () => undefined,
-            },
-            {
-              getDeprecationsProvider: () => 'providerA',
-            },
-            {
-              getDeprecationsProvider: () => 'providerB',
-            },
-          ],
-          pluginExtendedConfig: settings,
-          disabledPluginSpecs: [],
-          uiExports: {},
-          navLinks: [],
-        }) as any
-    );
-
-    const legacyService = new LegacyService({
-      coreId,
-      env,
-      logger,
-      configService: configService as any,
-    });
-
-    await legacyService.discoverPlugins();
-    expect(configService.addDeprecationProvider).toHaveBeenCalledTimes(2);
-    expect(configService.addDeprecationProvider).toHaveBeenCalledWith('', 'providerA');
-    expect(configService.addDeprecationProvider).toHaveBeenCalledWith('', 'providerB');
-  });
-
   it(`logs deprecations for legacy third party plugins`, async () => {
-    const pluginSpecs = [
-      { getId: () => 'pluginA', getDeprecationsProvider: () => undefined },
-      { getId: () => 'pluginB', getDeprecationsProvider: () => undefined },
-    ];
+    const pluginSpecs = [{ getId: () => 'pluginA' }, { getId: () => 'pluginB' }];
     findLegacyPluginSpecsMock.mockImplementation(
       (settings) =>
         Promise.resolve({
diff --git a/src/core/server/legacy/legacy_service.ts b/src/core/server/legacy/legacy_service.ts
index adfdecdd7c9761..880011d2e19238 100644
--- a/src/core/server/legacy/legacy_service.ts
+++ b/src/core/server/legacy/legacy_service.ts
@@ -21,7 +21,7 @@ import { combineLatest, ConnectableObservable, EMPTY, Observable, Subscription }
 import { first, map, publishReplay, tap } from 'rxjs/operators';
 
 import { CoreService } from '../../types';
-import { Config, ConfigDeprecationProvider } from '../config';
+import { Config } from '../config';
 import { CoreContext } from '../core_context';
 import { CspConfigType, config as cspConfig } from '../csp';
 import { DevConfig, DevConfigType, config as devConfig } from '../dev';
@@ -29,7 +29,6 @@ import { BasePathProxyServer, HttpConfig, HttpConfigType, config as httpConfig }
 import { Logger } from '../logging';
 import { PathConfigType } from '../path';
 import { findLegacyPluginSpecs, logLegacyThirdPartyPluginDeprecationWarning } from './plugins';
-import { convertLegacyDeprecationProvider } from './config';
 import {
   ILegacyInternals,
   LegacyServiceSetupDeps,
@@ -145,18 +144,6 @@ export class LegacyService implements CoreService {
       navLinks,
     };
 
-    const deprecationProviders = await pluginSpecs
-      .map((spec) => spec.getDeprecationsProvider())
-      .reduce(async (providers, current) => {
-        if (current) {
-          return [...(await providers), await convertLegacyDeprecationProvider(current)];
-        }
-        return providers;
-      }, Promise.resolve([] as ConfigDeprecationProvider[]));
-    deprecationProviders.forEach((provider) =>
-      this.coreContext.configService.addDeprecationProvider('', provider)
-    );
-
     this.legacyRawConfig = pluginExtendedConfig;
 
     // check for unknown uiExport types
diff --git a/src/core/server/legacy/logging/appenders/legacy_appender.ts b/src/core/server/legacy/logging/appenders/legacy_appender.ts
index 0c2f4ce93c3b84..a5d36423ba4c69 100644
--- a/src/core/server/legacy/logging/appenders/legacy_appender.ts
+++ b/src/core/server/legacy/logging/appenders/legacy_appender.ts
@@ -23,6 +23,11 @@ import { LogRecord } from '../../../logging/log_record';
 import { LegacyLoggingServer } from '../legacy_logging_server';
 import { LegacyVars } from '../../types';
 
+export interface LegacyAppenderConfig {
+  kind: 'legacy-appender';
+  legacyLoggingConfig?: any;
+}
+
 /**
  * Simple appender that just forwards `LogRecord` to the legacy KbnServer log.
  * @internal
diff --git a/src/core/server/legacy/plugins/__snapshots__/get_nav_links.test.ts.snap b/src/core/server/legacy/plugins/__snapshots__/get_nav_links.test.ts.snap
deleted file mode 100644
index c1b7164908ed68..00000000000000
--- a/src/core/server/legacy/plugins/__snapshots__/get_nav_links.test.ts.snap
+++ /dev/null
@@ -1,56 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[` 1`] = `
-Array [
-  Object {
-    "category": undefined,
-    "disableSubUrlTracking": undefined,
-    "disabled": false,
-    "euiIconType": undefined,
-    "hidden": false,
-    "icon": undefined,
-    "id": "link-a",
-    "linkToLastSubUrl": true,
-    "order": 0,
-    "subUrlBase": "/some-custom-url",
-    "title": "AppA",
-    "tooltip": "",
-    "url": "/some-custom-url",
-  },
-  Object {
-    "category": undefined,
-    "disableSubUrlTracking": true,
-    "disabled": false,
-    "euiIconType": undefined,
-    "hidden": false,
-    "icon": undefined,
-    "id": "link-b",
-    "linkToLastSubUrl": true,
-    "order": 0,
-    "subUrlBase": "/url-b",
-    "title": "AppB",
-    "tooltip": "",
-    "url": "/url-b",
-  },
-  Object {
-    "category": undefined,
-    "euiIconType": undefined,
-    "icon": undefined,
-    "id": "app-a",
-    "linkToLastSubUrl": true,
-    "order": 0,
-    "title": "AppA",
-    "url": "/app/app-a",
-  },
-  Object {
-    "category": undefined,
-    "euiIconType": undefined,
-    "icon": undefined,
-    "id": "app-b",
-    "linkToLastSubUrl": true,
-    "order": 0,
-    "title": "AppB",
-    "url": "/app/app-b",
-  },
-]
-`;
diff --git a/src/core/server/legacy/plugins/find_legacy_plugin_specs.ts b/src/core/server/legacy/plugins/find_legacy_plugin_specs.ts
index f3ec2ed8335c5a..82e04496ffc3e6 100644
--- a/src/core/server/legacy/plugins/find_legacy_plugin_specs.ts
+++ b/src/core/server/legacy/plugins/find_legacy_plugin_specs.ts
@@ -31,7 +31,6 @@ import { collectUiExports as collectLegacyUiExports } from '../../../../legacy/u
 import { LoggerFactory } from '../../logging';
 import { PackageInfo } from '../../config';
 import { LegacyPluginSpec, LegacyPluginPack, LegacyConfig } from '../types';
-import { getNavLinks } from './get_nav_links';
 
 export async function findLegacyPluginSpecs(
   settings: unknown,
@@ -125,13 +124,12 @@ export async function findLegacyPluginSpecs(
     log$.pipe(toArray())
   ).toPromise();
   const uiExports = collectLegacyUiExports(pluginSpecs);
-  const navLinks = getNavLinks(uiExports, pluginSpecs);
 
   return {
     disabledPluginSpecs,
     pluginSpecs,
     pluginExtendedConfig: configToMutate,
     uiExports,
-    navLinks,
+    navLinks: [],
   };
 }
diff --git a/src/core/server/legacy/plugins/get_nav_links.test.ts b/src/core/server/legacy/plugins/get_nav_links.test.ts
deleted file mode 100644
index af10706d0ea088..00000000000000
--- a/src/core/server/legacy/plugins/get_nav_links.test.ts
+++ /dev/null
@@ -1,288 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { LegacyUiExports, LegacyPluginSpec, LegacyAppSpec, LegacyNavLinkSpec } from '../types';
-import { getNavLinks } from './get_nav_links';
-
-const createLegacyExports = ({
-  uiAppSpecs = [],
-  navLinkSpecs = [],
-}: {
-  uiAppSpecs?: LegacyAppSpec[];
-  navLinkSpecs?: LegacyNavLinkSpec[];
-}): LegacyUiExports => ({
-  uiAppSpecs,
-  navLinkSpecs,
-  injectedVarsReplacers: [],
-  defaultInjectedVarProviders: [],
-  savedObjectMappings: [],
-  savedObjectSchemas: {},
-  savedObjectMigrations: {},
-  savedObjectValidations: {},
-  savedObjectsManagement: {},
-});
-
-const createPluginSpecs = (...ids: string[]): LegacyPluginSpec[] =>
-  ids.map(
-    (id) =>
-      ({
-        getId: () => id,
-      } as LegacyPluginSpec)
-  );
-
-describe('getNavLinks', () => {
-  describe('generating from uiAppSpecs', () => {
-    it('generates navlinks from legacy app specs', () => {
-      const navlinks = getNavLinks(
-        createLegacyExports({
-          uiAppSpecs: [
-            {
-              id: 'app-a',
-              title: 'AppA',
-              pluginId: 'pluginA',
-            },
-            {
-              id: 'app-b',
-              title: 'AppB',
-              pluginId: 'pluginA',
-            },
-          ],
-        }),
-        createPluginSpecs('pluginA')
-      );
-
-      expect(navlinks.length).toEqual(2);
-      expect(navlinks[0]).toEqual(
-        expect.objectContaining({
-          id: 'app-a',
-          title: 'AppA',
-          url: '/app/app-a',
-        })
-      );
-      expect(navlinks[1]).toEqual(
-        expect.objectContaining({
-          id: 'app-b',
-          title: 'AppB',
-          url: '/app/app-b',
-        })
-      );
-    });
-
-    it('uses the app id to generates the navlink id even if pluginId is specified', () => {
-      const navlinks = getNavLinks(
-        createLegacyExports({
-          uiAppSpecs: [
-            {
-              id: 'app-a',
-              title: 'AppA',
-              pluginId: 'pluginA',
-            },
-            {
-              id: 'app-b',
-              title: 'AppB',
-              pluginId: 'pluginA',
-            },
-          ],
-        }),
-        createPluginSpecs('pluginA')
-      );
-
-      expect(navlinks.length).toEqual(2);
-      expect(navlinks[0].id).toEqual('app-a');
-      expect(navlinks[1].id).toEqual('app-b');
-    });
-
-    it('throws if an app reference a missing plugin', () => {
-      expect(() => {
-        getNavLinks(
-          createLegacyExports({
-            uiAppSpecs: [
-              {
-                id: 'app-a',
-                title: 'AppA',
-                pluginId: 'notExistingPlugin',
-              },
-            ],
-          }),
-          createPluginSpecs('pluginA')
-        );
-      }).toThrowErrorMatchingInlineSnapshot(`"Unknown plugin id \\"notExistingPlugin\\""`);
-    });
-
-    it('uses all known properties of the navlink', () => {
-      const navlinks = getNavLinks(
-        createLegacyExports({
-          uiAppSpecs: [
-            {
-              id: 'app-a',
-              title: 'AppA',
-              category: {
-                id: 'foo',
-                label: 'My Category',
-              },
-              order: 42,
-              url: '/some-custom-url',
-              icon: 'fa-snowflake',
-              euiIconType: 'euiIcon',
-              linkToLastSubUrl: true,
-              hidden: false,
-            },
-          ],
-        }),
-        []
-      );
-      expect(navlinks.length).toBe(1);
-      expect(navlinks[0]).toEqual({
-        id: 'app-a',
-        title: 'AppA',
-        category: {
-          id: 'foo',
-          label: 'My Category',
-        },
-        order: 42,
-        url: '/some-custom-url',
-        icon: 'fa-snowflake',
-        euiIconType: 'euiIcon',
-        linkToLastSubUrl: true,
-      });
-    });
-  });
-
-  describe('generating from navLinkSpecs', () => {
-    it('generates navlinks from legacy navLink specs', () => {
-      const navlinks = getNavLinks(
-        createLegacyExports({
-          navLinkSpecs: [
-            {
-              id: 'link-a',
-              title: 'AppA',
-              url: '/some-custom-url',
-            },
-            {
-              id: 'link-b',
-              title: 'AppB',
-              url: '/some-other-url',
-              disableSubUrlTracking: true,
-            },
-          ],
-        }),
-        createPluginSpecs('pluginA')
-      );
-
-      expect(navlinks.length).toEqual(2);
-      expect(navlinks[0]).toEqual(
-        expect.objectContaining({
-          id: 'link-a',
-          title: 'AppA',
-          url: '/some-custom-url',
-          hidden: false,
-          disabled: false,
-        })
-      );
-      expect(navlinks[1]).toEqual(
-        expect.objectContaining({
-          id: 'link-b',
-          title: 'AppB',
-          url: '/some-other-url',
-          disableSubUrlTracking: true,
-        })
-      );
-    });
-
-    it('only uses known properties to create the navlink', () => {
-      const navlinks = getNavLinks(
-        createLegacyExports({
-          navLinkSpecs: [
-            {
-              id: 'link-a',
-              title: 'AppA',
-              category: {
-                id: 'foo',
-                label: 'My Second Cat',
-              },
-              order: 72,
-              url: '/some-other-custom',
-              subUrlBase: '/some-other-custom/sub',
-              disableSubUrlTracking: true,
-              icon: 'fa-corn',
-              euiIconType: 'euiIconBis',
-              linkToLastSubUrl: false,
-              hidden: false,
-              tooltip: 'My other tooltip',
-            },
-          ],
-        }),
-        []
-      );
-      expect(navlinks.length).toBe(1);
-      expect(navlinks[0]).toEqual({
-        id: 'link-a',
-        title: 'AppA',
-        category: {
-          id: 'foo',
-          label: 'My Second Cat',
-        },
-        order: 72,
-        url: '/some-other-custom',
-        subUrlBase: '/some-other-custom/sub',
-        disableSubUrlTracking: true,
-        icon: 'fa-corn',
-        euiIconType: 'euiIconBis',
-        linkToLastSubUrl: false,
-        hidden: false,
-        disabled: false,
-        tooltip: 'My other tooltip',
-      });
-    });
-  });
-
-  describe('generating from both apps and navlinks', () => {
-    const navlinks = getNavLinks(
-      createLegacyExports({
-        uiAppSpecs: [
-          {
-            id: 'app-a',
-            title: 'AppA',
-          },
-          {
-            id: 'app-b',
-            title: 'AppB',
-          },
-        ],
-        navLinkSpecs: [
-          {
-            id: 'link-a',
-            title: 'AppA',
-            url: '/some-custom-url',
-          },
-          {
-            id: 'link-b',
-            title: 'AppB',
-            url: '/url-b',
-            disableSubUrlTracking: true,
-          },
-        ],
-      }),
-      []
-    );
-
-    expect(navlinks.length).toBe(4);
-    expect(navlinks).toMatchSnapshot();
-  });
-});
diff --git a/src/core/server/legacy/plugins/get_nav_links.ts b/src/core/server/legacy/plugins/get_nav_links.ts
deleted file mode 100644
index b1d22df41e3454..00000000000000
--- a/src/core/server/legacy/plugins/get_nav_links.ts
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import {
-  LegacyUiExports,
-  LegacyNavLink,
-  LegacyPluginSpec,
-  LegacyNavLinkSpec,
-  LegacyAppSpec,
-} from '../types';
-
-function legacyAppToNavLink(spec: LegacyAppSpec): LegacyNavLink {
-  if (!spec.id) {
-    throw new Error('Every app must specify an id');
-  }
-  return {
-    id: spec.id,
-    category: spec.category,
-    title: spec.title ?? spec.id,
-    order: typeof spec.order === 'number' ? spec.order : 0,
-    icon: spec.icon,
-    euiIconType: spec.euiIconType,
-    url: spec.url || `/app/${spec.id}`,
-    linkToLastSubUrl: spec.linkToLastSubUrl ?? true,
-  };
-}
-
-function legacyLinkToNavLink(spec: LegacyNavLinkSpec): LegacyNavLink {
-  return {
-    id: spec.id,
-    category: spec.category,
-    title: spec.title,
-    order: typeof spec.order === 'number' ? spec.order : 0,
-    url: spec.url,
-    subUrlBase: spec.subUrlBase || spec.url,
-    disableSubUrlTracking: spec.disableSubUrlTracking,
-    icon: spec.icon,
-    euiIconType: spec.euiIconType,
-    linkToLastSubUrl: spec.linkToLastSubUrl ?? true,
-    hidden: spec.hidden ?? false,
-    disabled: spec.disabled ?? false,
-    tooltip: spec.tooltip ?? '',
-  };
-}
-
-function isHidden(app: LegacyAppSpec) {
-  return app.listed === false || app.hidden === true;
-}
-
-export function getNavLinks(uiExports: LegacyUiExports, pluginSpecs: LegacyPluginSpec[]) {
-  const navLinkSpecs = uiExports.navLinkSpecs || [];
-  const appSpecs = (uiExports.uiAppSpecs || []).filter(
-    (app) => app !== undefined && !isHidden(app)
-  ) as LegacyAppSpec[];
-
-  const pluginIds = (pluginSpecs || []).map((spec) => spec.getId());
-  appSpecs.forEach((spec) => {
-    if (spec.pluginId && !pluginIds.includes(spec.pluginId)) {
-      throw new Error(`Unknown plugin id "${spec.pluginId}"`);
-    }
-  });
-
-  return [...navLinkSpecs.map(legacyLinkToNavLink), ...appSpecs.map(legacyAppToNavLink)].sort(
-    (a, b) => a.order - b.order
-  );
-}
diff --git a/src/core/server/legacy/plugins/log_legacy_plugins_warning.test.ts b/src/core/server/legacy/plugins/log_legacy_plugins_warning.test.ts
index dfa2396d5904bc..2317f1036ce42b 100644
--- a/src/core/server/legacy/plugins/log_legacy_plugins_warning.test.ts
+++ b/src/core/server/legacy/plugins/log_legacy_plugins_warning.test.ts
@@ -26,7 +26,6 @@ const createPluginSpec = ({ id, path }: { id: string; path: string }): LegacyPlu
     getId: () => id,
     getExpectedKibanaVersion: () => 'kibana',
     getConfigPrefix: () => 'plugin.config',
-    getDeprecationsProvider: () => undefined,
     getPack: () => ({
       getPath: () => path,
     }),
diff --git a/src/core/server/legacy/types.ts b/src/core/server/legacy/types.ts
index 98f8d874c7088b..cf08689a6d0d42 100644
--- a/src/core/server/legacy/types.ts
+++ b/src/core/server/legacy/types.ts
@@ -51,36 +51,6 @@ export interface LegacyConfig {
   set(config: LegacyVars): void;
 }
 
-/**
- * Representation of a legacy configuration deprecation factory used for
- * legacy plugin deprecations.
- *
- * @internal
- * @deprecated
- */
-export interface LegacyConfigDeprecationFactory {
-  rename(oldKey: string, newKey: string): LegacyConfigDeprecation;
-  unused(unusedKey: string): LegacyConfigDeprecation;
-}
-
-/**
- * Representation of a legacy configuration deprecation.
- *
- * @internal
- * @deprecated
- */
-export type LegacyConfigDeprecation = (settings: LegacyVars, log: (msg: string) => void) => void;
-
-/**
- * Representation of a legacy configuration deprecation provider.
- *
- * @internal
- * @deprecated
- */
-export type LegacyConfigDeprecationProvider = (
-  factory: LegacyConfigDeprecationFactory
-) => LegacyConfigDeprecation[] | Promise<LegacyConfigDeprecation[]>;
-
 /**
  * @internal
  * @deprecated
@@ -97,7 +67,6 @@ export interface LegacyPluginSpec {
   getId: () => unknown;
   getExpectedKibanaVersion: () => string;
   getConfigPrefix: () => string;
-  getDeprecationsProvider: () => LegacyConfigDeprecationProvider | undefined;
   getPack: () => LegacyPluginPack;
 }
 
diff --git a/src/core/server/logging/appenders/appenders.ts b/src/core/server/logging/appenders/appenders.ts
index 3b90a10a1a76c3..edfce4988275ac 100644
--- a/src/core/server/logging/appenders/appenders.ts
+++ b/src/core/server/logging/appenders/appenders.ts
@@ -17,14 +17,17 @@
  * under the License.
  */
 
-import { schema, TypeOf } from '@kbn/config-schema';
+import { schema } from '@kbn/config-schema';
 
 import { assertNever } from '../../../utils';
-import { LegacyAppender } from '../../legacy/logging/appenders/legacy_appender';
+import {
+  LegacyAppender,
+  LegacyAppenderConfig,
+} from '../../legacy/logging/appenders/legacy_appender';
 import { Layouts } from '../layouts/layouts';
 import { LogRecord } from '../log_record';
-import { ConsoleAppender } from './console/console_appender';
-import { FileAppender } from './file/file_appender';
+import { ConsoleAppender, ConsoleAppenderConfig } from './console/console_appender';
+import { FileAppender, FileAppenderConfig } from './file/file_appender';
 
 /**
  * Config schema for validting the shape of the `appenders` key in in {@link LoggerContextConfigType} or
@@ -39,7 +42,7 @@ export const appendersSchema = schema.oneOf([
 ]);
 
 /** @public */
-export type AppenderConfigType = TypeOf<typeof appendersSchema>;
+export type AppenderConfigType = ConsoleAppenderConfig | FileAppenderConfig | LegacyAppenderConfig;
 
 /**
  * Entity that can append `LogRecord` instances to file, stdout, memory or whatever
diff --git a/src/core/server/logging/appenders/console/console_appender.ts b/src/core/server/logging/appenders/console/console_appender.ts
index b4420c12a23cab..a54674b1d347ce 100644
--- a/src/core/server/logging/appenders/console/console_appender.ts
+++ b/src/core/server/logging/appenders/console/console_appender.ts
@@ -19,13 +19,19 @@
 
 import { schema } from '@kbn/config-schema';
 
-import { Layout, Layouts } from '../../layouts/layouts';
+import { Layout, Layouts, LayoutConfigType } from '../../layouts/layouts';
 import { LogRecord } from '../../log_record';
 import { DisposableAppender } from '../appenders';
 
 const { literal, object } = schema;
 
+export interface ConsoleAppenderConfig {
+  kind: 'console';
+  layout: LayoutConfigType;
+}
+
 /**
+ *
  * Appender that formats all the `LogRecord` instances it receives and logs them via built-in `console`.
  * @internal
  */
diff --git a/src/core/server/logging/appenders/file/file_appender.ts b/src/core/server/logging/appenders/file/file_appender.ts
index 728e82ebcec9a1..a0e484cd87c8f5 100644
--- a/src/core/server/logging/appenders/file/file_appender.ts
+++ b/src/core/server/logging/appenders/file/file_appender.ts
@@ -20,10 +20,16 @@
 import { schema } from '@kbn/config-schema';
 import { createWriteStream, WriteStream } from 'fs';
 
-import { Layout, Layouts } from '../../layouts/layouts';
+import { Layout, Layouts, LayoutConfigType } from '../../layouts/layouts';
 import { LogRecord } from '../../log_record';
 import { DisposableAppender } from '../appenders';
 
+export interface FileAppenderConfig {
+  kind: 'file';
+  layout: LayoutConfigType;
+  path: string;
+}
+
 /**
  * Appender that formats all the `LogRecord` instances it receives and writes them to the specified file.
  * @internal
diff --git a/src/core/server/logging/integration_tests/logging.test.ts b/src/core/server/logging/integration_tests/logging.test.ts
index 841c1ce15af472..7f6059567c46ef 100644
--- a/src/core/server/logging/integration_tests/logging.test.ts
+++ b/src/core/server/logging/integration_tests/logging.test.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import * as kbnTestServer from '../../../../test_utils/kbn_server';
+import * as kbnTestServer from '../../../test_helpers/kbn_server';
 import { InternalCoreSetup } from '../../internal_types';
 import { LoggerContextConfigInput } from '../logging_config';
 import { Subject } from 'rxjs';
diff --git a/src/core/server/logging/layouts/json_layout.ts b/src/core/server/logging/layouts/json_layout.ts
index 04416184a59576..37eb6b8c4806e8 100644
--- a/src/core/server/logging/layouts/json_layout.ts
+++ b/src/core/server/logging/layouts/json_layout.ts
@@ -19,7 +19,7 @@
 
 import moment from 'moment-timezone';
 import { merge } from 'lodash';
-import { schema, TypeOf } from '@kbn/config-schema';
+import { schema } from '@kbn/config-schema';
 
 import { LogRecord } from '../log_record';
 import { Layout } from './layouts';
@@ -31,7 +31,9 @@ const jsonLayoutSchema = object({
 });
 
 /** @internal */
-export type JsonLayoutConfigType = TypeOf<typeof jsonLayoutSchema>;
+export interface JsonLayoutConfigType {
+  kind: 'json';
+}
 
 /**
  * Layout that just converts `LogRecord` into JSON string.
diff --git a/src/core/server/logging/layouts/layouts.ts b/src/core/server/logging/layouts/layouts.ts
index 0e6a6360cab2e3..124c007bae1040 100644
--- a/src/core/server/logging/layouts/layouts.ts
+++ b/src/core/server/logging/layouts/layouts.ts
@@ -26,7 +26,7 @@ import { PatternLayout, PatternLayoutConfigType } from './pattern_layout';
 
 const { oneOf } = schema;
 
-type LayoutConfigType = PatternLayoutConfigType | JsonLayoutConfigType;
+export type LayoutConfigType = PatternLayoutConfigType | JsonLayoutConfigType;
 
 /**
  * Entity that can format `LogRecord` instance into a string.
diff --git a/src/core/server/logging/layouts/pattern_layout.ts b/src/core/server/logging/layouts/pattern_layout.ts
index 7839345a3703ba..5dfc8aca77f181 100644
--- a/src/core/server/logging/layouts/pattern_layout.ts
+++ b/src/core/server/logging/layouts/pattern_layout.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { schema, TypeOf } from '@kbn/config-schema';
+import { schema } from '@kbn/config-schema';
 
 import { LogRecord } from '../log_record';
 import { Layout } from './layouts';
@@ -58,7 +58,11 @@ const conversions: Conversion[] = [
 ];
 
 /** @internal */
-export type PatternLayoutConfigType = TypeOf<typeof patternLayoutSchema>;
+export interface PatternLayoutConfigType {
+  kind: 'pattern';
+  highlight?: boolean;
+  pattern?: string;
+}
 
 /**
  * Layout that formats `LogRecord` using the `pattern` string with optional
diff --git a/src/core/server/logging/logging_config.ts b/src/core/server/logging/logging_config.ts
index a6aafabeb970cf..a6ab15dc29fdfe 100644
--- a/src/core/server/logging/logging_config.ts
+++ b/src/core/server/logging/logging_config.ts
@@ -96,7 +96,9 @@ export const config = {
   }),
 };
 
-export type LoggingConfigType = TypeOf<typeof config.schema>;
+export type LoggingConfigType = Omit<TypeOf<typeof config.schema>, 'appenders'> & {
+  appenders: Map<string, AppenderConfigType>;
+};
 
 /**
  * Config schema for validating the inputs to the {@link LoggingServiceStart.configure} API.
diff --git a/src/core/server/rendering/__snapshots__/rendering_service.test.ts.snap b/src/core/server/rendering/__snapshots__/rendering_service.test.ts.snap
index 5ff5d69f96f707..ab828a1780425a 100644
--- a/src/core/server/rendering/__snapshots__/rendering_service.test.ts.snap
+++ b/src/core/server/rendering/__snapshots__/rendering_service.test.ts.snap
@@ -46,7 +46,6 @@ Object {
     },
     "version": Any<String>,
   },
-  "legacyMode": false,
   "serverBasePath": "/mock-server-basepath",
   "uiPlugins": Array [],
   "vars": Object {},
@@ -100,7 +99,6 @@ Object {
     },
     "version": Any<String>,
   },
-  "legacyMode": false,
   "serverBasePath": "/mock-server-basepath",
   "uiPlugins": Array [],
   "vars": Object {},
@@ -158,7 +156,6 @@ Object {
     },
     "version": Any<String>,
   },
-  "legacyMode": false,
   "serverBasePath": "/mock-server-basepath",
   "uiPlugins": Array [],
   "vars": Object {},
@@ -212,7 +209,6 @@ Object {
     },
     "version": Any<String>,
   },
-  "legacyMode": false,
   "serverBasePath": "/mock-server-basepath",
   "uiPlugins": Array [],
   "vars": Object {},
@@ -266,7 +262,6 @@ Object {
     },
     "version": Any<String>,
   },
-  "legacyMode": false,
   "serverBasePath": "/mock-server-basepath",
   "uiPlugins": Array [],
   "vars": Object {},
diff --git a/src/core/server/rendering/rendering_service.tsx b/src/core/server/rendering/rendering_service.tsx
index e7ee0b16fce081..7761c89044f6fa 100644
--- a/src/core/server/rendering/rendering_service.tsx
+++ b/src/core/server/rendering/rendering_service.tsx
@@ -82,7 +82,6 @@ export class RenderingService implements CoreService<InternalRenderingServiceSet
             basePath,
             serverBasePath,
             env,
-            legacyMode: false,
             anonymousStatusPage: status.isStatusPageAnonymous(),
             i18n: {
               translationsUrl: `${basePath}/translations/${i18n.getLocale()}.json`,
diff --git a/src/core/server/rendering/types.ts b/src/core/server/rendering/types.ts
index d41c308ac66a4f..fb68921ca86364 100644
--- a/src/core/server/rendering/types.ts
+++ b/src/core/server/rendering/types.ts
@@ -45,7 +45,6 @@ export interface RenderingMetadata {
       mode: EnvironmentMode;
       packageInfo: PackageInfo;
     };
-    legacyMode: boolean;
     anonymousStatusPage: boolean;
     i18n: {
       translationsUrl: string;
diff --git a/src/core/server/saved_objects/export/get_sorted_objects_for_export.test.ts b/src/core/server/saved_objects/export/get_sorted_objects_for_export.test.ts
index 85b3a281aef7f6..c084125f43127a 100644
--- a/src/core/server/saved_objects/export/get_sorted_objects_for_export.test.ts
+++ b/src/core/server/saved_objects/export/get_sorted_objects_for_export.test.ts
@@ -20,7 +20,7 @@
 import { exportSavedObjectsToStream } from './get_sorted_objects_for_export';
 import { savedObjectsClientMock } from '../service/saved_objects_client.mock';
 import { Readable } from 'stream';
-import { createPromiseFromStreams, createConcatStream } from '../../../../legacy/utils/streams';
+import { createPromiseFromStreams, createConcatStream } from '../../utils/streams';
 
 async function readStreamToCompletion(stream: Readable) {
   return createPromiseFromStreams([stream, createConcatStream([])]);
diff --git a/src/core/server/saved_objects/export/get_sorted_objects_for_export.ts b/src/core/server/saved_objects/export/get_sorted_objects_for_export.ts
index 94f727e238ecf3..214b51db7dd6bb 100644
--- a/src/core/server/saved_objects/export/get_sorted_objects_for_export.ts
+++ b/src/core/server/saved_objects/export/get_sorted_objects_for_export.ts
@@ -18,7 +18,7 @@
  */
 
 import Boom from 'boom';
-import { createListStream } from '../../../../legacy/utils/streams';
+import { createListStream } from '../../utils/streams';
 import { SavedObjectsClientContract, SavedObject } from '../types';
 import { fetchNestedDependencies } from './inject_nested_depdendencies';
 import { sortObjects } from './sort_objects';
diff --git a/src/core/server/saved_objects/import/collect_saved_objects.ts b/src/core/server/saved_objects/import/collect_saved_objects.ts
index f55e6bf0d2af4c..8e84f864cf4490 100644
--- a/src/core/server/saved_objects/import/collect_saved_objects.ts
+++ b/src/core/server/saved_objects/import/collect_saved_objects.ts
@@ -23,7 +23,7 @@ import {
   createFilterStream,
   createMapStream,
   createPromiseFromStreams,
-} from '../../../../legacy/utils/streams';
+} from '../../utils/streams';
 import { SavedObject } from '../types';
 import { createLimitStream } from './create_limit_stream';
 import { SavedObjectsImportError } from './types';
diff --git a/src/core/server/saved_objects/import/create_limit_stream.test.ts b/src/core/server/saved_objects/import/create_limit_stream.test.ts
index 736cfadcb62228..a7e689710a564f 100644
--- a/src/core/server/saved_objects/import/create_limit_stream.test.ts
+++ b/src/core/server/saved_objects/import/create_limit_stream.test.ts
@@ -21,7 +21,7 @@ import {
   createConcatStream,
   createListStream,
   createPromiseFromStreams,
-} from '../../../../legacy/utils/streams';
+} from '../../utils/streams';
 import { createLimitStream } from './create_limit_stream';
 
 describe('createLimitStream()', () => {
diff --git a/src/core/server/saved_objects/routes/export.ts b/src/core/server/saved_objects/routes/export.ts
index 9445c144ecda45..35a65d8d9651fe 100644
--- a/src/core/server/saved_objects/routes/export.ts
+++ b/src/core/server/saved_objects/routes/export.ts
@@ -19,11 +19,7 @@
 
 import { schema } from '@kbn/config-schema';
 import stringify from 'json-stable-stringify';
-import {
-  createPromiseFromStreams,
-  createMapStream,
-  createConcatStream,
-} from '../../../../legacy/utils/streams';
+import { createPromiseFromStreams, createMapStream, createConcatStream } from '../../utils/streams';
 import { IRouter } from '../../http';
 import { SavedObjectConfig } from '../saved_objects_config';
 import { exportSavedObjectsToStream } from '../export';
diff --git a/src/core/server/saved_objects/routes/integration_tests/export.test.ts b/src/core/server/saved_objects/routes/integration_tests/export.test.ts
index d47f7c6050d8f7..a3891712fd22b7 100644
--- a/src/core/server/saved_objects/routes/integration_tests/export.test.ts
+++ b/src/core/server/saved_objects/routes/integration_tests/export.test.ts
@@ -22,7 +22,7 @@ jest.mock('../../export', () => ({
 }));
 
 import * as exportMock from '../../export';
-import { createListStream } from '../../../../../legacy/utils/streams';
+import { createListStream } from '../../../utils/streams';
 import supertest from 'supertest';
 import { UnwrapPromise } from '@kbn/utility-types';
 import { SavedObjectConfig } from '../../saved_objects_config';
diff --git a/src/core/server/saved_objects/routes/integration_tests/migrate.test.ts b/src/core/server/saved_objects/routes/integration_tests/migrate.test.ts
index 7a0e39b71afb81..e003d564c1ea25 100644
--- a/src/core/server/saved_objects/routes/integration_tests/migrate.test.ts
+++ b/src/core/server/saved_objects/routes/integration_tests/migrate.test.ts
@@ -18,7 +18,7 @@
  */
 
 import { migratorInstanceMock } from './migrate.test.mocks';
-import * as kbnTestServer from '../../../../../test_utils/kbn_server';
+import * as kbnTestServer from '../../../../test_helpers/kbn_server';
 
 describe('SavedObjects /_migrate endpoint', () => {
   let root: ReturnType<typeof kbnTestServer.createRoot>;
diff --git a/src/core/server/saved_objects/routes/utils.test.ts b/src/core/server/saved_objects/routes/utils.test.ts
index 24719724785af1..fd3bdad8606ed5 100644
--- a/src/core/server/saved_objects/routes/utils.test.ts
+++ b/src/core/server/saved_objects/routes/utils.test.ts
@@ -19,7 +19,7 @@
 
 import { createSavedObjectsStreamFromNdJson, validateTypes, validateObjects } from './utils';
 import { Readable } from 'stream';
-import { createPromiseFromStreams, createConcatStream } from '../../../../legacy/utils/streams';
+import { createPromiseFromStreams, createConcatStream } from '../../utils/streams';
 
 async function readStreamToCompletion(stream: Readable) {
   return createPromiseFromStreams([stream, createConcatStream([])]);
diff --git a/src/core/server/saved_objects/routes/utils.ts b/src/core/server/saved_objects/routes/utils.ts
index 3963833a9c718b..f16a6e471257d0 100644
--- a/src/core/server/saved_objects/routes/utils.ts
+++ b/src/core/server/saved_objects/routes/utils.ts
@@ -19,11 +19,7 @@
 
 import { Readable } from 'stream';
 import { SavedObject, SavedObjectsExportResultDetails } from 'src/core/server';
-import {
-  createSplitStream,
-  createMapStream,
-  createFilterStream,
-} from '../../../../legacy/utils/streams';
+import { createSplitStream, createMapStream, createFilterStream } from '../../utils/streams';
 
 export function createSavedObjectsStreamFromNdJson(ndJsonStream: Readable) {
   return ndJsonStream
diff --git a/src/core/server/saved_objects/service/lib/filter_utils.test.ts b/src/core/server/saved_objects/service/lib/filter_utils.test.ts
index 4d9bcdda3c8ae9..60e8aa0afdda4c 100644
--- a/src/core/server/saved_objects/service/lib/filter_utils.test.ts
+++ b/src/core/server/saved_objects/service/lib/filter_utils.test.ts
@@ -83,7 +83,19 @@ const mockMappings = {
 
 describe('Filter Utils', () => {
   describe('#validateConvertFilterToKueryNode', () => {
-    test('Validate a simple filter', () => {
+    test('Empty string filters are ignored', () => {
+      expect(validateConvertFilterToKueryNode(['foo'], '', mockMappings)).toBeUndefined();
+    });
+    test('Validate a simple KQL KueryNode filter', () => {
+      expect(
+        validateConvertFilterToKueryNode(
+          ['foo'],
+          esKuery.nodeTypes.function.buildNode('is', `foo.attributes.title`, 'best', true),
+          mockMappings
+        )
+      ).toEqual(esKuery.fromKueryExpression('foo.title: "best"'));
+    });
+    test('Validate a simple KQL expression filter', () => {
       expect(
         validateConvertFilterToKueryNode(['foo'], 'foo.attributes.title: "best"', mockMappings)
       ).toEqual(esKuery.fromKueryExpression('foo.title: "best"'));
diff --git a/src/core/server/saved_objects/service/lib/filter_utils.ts b/src/core/server/saved_objects/service/lib/filter_utils.ts
index 5fbe62a074b29b..d19f06d74e4193 100644
--- a/src/core/server/saved_objects/service/lib/filter_utils.ts
+++ b/src/core/server/saved_objects/service/lib/filter_utils.ts
@@ -28,11 +28,12 @@ const astFunctionType = ['is', 'range', 'nested'];
 
 export const validateConvertFilterToKueryNode = (
   allowedTypes: string[],
-  filter: string,
+  filter: string | KueryNode,
   indexMapping: IndexMapping
 ): KueryNode | undefined => {
-  if (filter && filter.length > 0 && indexMapping) {
-    const filterKueryNode = esKuery.fromKueryExpression(filter);
+  if (filter && indexMapping) {
+    const filterKueryNode =
+      typeof filter === 'string' ? esKuery.fromKueryExpression(filter) : filter;
 
     const validationFilterKuery = validateFilterKueryNode({
       astFilter: filterKueryNode,
diff --git a/src/core/server/saved_objects/service/lib/repository.test.js b/src/core/server/saved_objects/service/lib/repository.test.js
index 39433981dfd596..b1d6028465713f 100644
--- a/src/core/server/saved_objects/service/lib/repository.test.js
+++ b/src/core/server/saved_objects/service/lib/repository.test.js
@@ -25,6 +25,8 @@ import { encodeHitVersion } from '../../version';
 import { SavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 import { DocumentMigrator } from '../../migrations/core/document_migrator';
 import { elasticsearchClientMock } from '../../../elasticsearch/client/mocks';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { nodeTypes } from '../../../../../plugins/data/common/es_query';
 
 jest.mock('./search_dsl/search_dsl', () => ({ getSearchDsl: jest.fn() }));
 
@@ -2529,7 +2531,7 @@ describe('SavedObjectsRepository', () => {
         expect(getSearchDslNS.getSearchDsl).toHaveBeenCalledWith(mappings, registry, relevantOpts);
       });
 
-      it(`accepts KQL filter and passes kueryNode to getSearchDsl`, async () => {
+      it(`accepts KQL expression filter and passes KueryNode to getSearchDsl`, async () => {
         const findOpts = {
           namespace,
           search: 'foo*',
@@ -2570,6 +2572,47 @@ describe('SavedObjectsRepository', () => {
         `);
       });
 
+      it(`accepts KQL KueryNode filter and passes KueryNode to getSearchDsl`, async () => {
+        const findOpts = {
+          namespace,
+          search: 'foo*',
+          searchFields: ['foo'],
+          type: ['dashboard'],
+          sortField: 'name',
+          sortOrder: 'desc',
+          defaultSearchOperator: 'AND',
+          hasReference: {
+            type: 'foo',
+            id: '1',
+          },
+          indexPattern: undefined,
+          filter: nodeTypes.function.buildNode('is', `dashboard.attributes.otherField`, '*'),
+        };
+
+        await findSuccess(findOpts, namespace);
+        const { kueryNode } = getSearchDslNS.getSearchDsl.mock.calls[0][2];
+        expect(kueryNode).toMatchInlineSnapshot(`
+          Object {
+            "arguments": Array [
+              Object {
+                "type": "literal",
+                "value": "dashboard.otherField",
+              },
+              Object {
+                "type": "wildcard",
+                "value": "@kuery-wildcard@",
+              },
+              Object {
+                "type": "literal",
+                "value": false,
+              },
+            ],
+            "function": "is",
+            "type": "function",
+          }
+        `);
+      });
+
       it(`supports multiple types`, async () => {
         const types = ['config', 'index-pattern'];
         await findSuccess({ type: types });
diff --git a/src/core/server/saved_objects/types.ts b/src/core/server/saved_objects/types.ts
index edbdbe4d167848..000153cd542fa9 100644
--- a/src/core/server/saved_objects/types.ts
+++ b/src/core/server/saved_objects/types.ts
@@ -39,6 +39,9 @@ import { SavedObjectUnsanitizedDoc } from './serialization';
 import { SavedObjectsMigrationLogger } from './migrations/core/migration_logger';
 import { SavedObject } from '../../types';
 
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { KueryNode } from '../../../plugins/data/common';
+
 export {
   SavedObjectAttributes,
   SavedObjectAttribute,
@@ -89,7 +92,7 @@ export interface SavedObjectsFindOptions {
   rootSearchFields?: string[];
   hasReference?: { type: string; id: string };
   defaultSearchOperator?: 'AND' | 'OR';
-  filter?: string;
+  filter?: string | KueryNode;
   namespaces?: string[];
   /** An optional ES preference value to be used for the query **/
   preference?: string;
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index 49c97d837579d3..081554cd17f259 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -40,6 +40,7 @@ import { DeleteScriptParams } from 'elasticsearch';
 import { DeleteTemplateParams } from 'elasticsearch';
 import { DetailedPeerCertificate } from 'tls';
 import { Duration } from 'moment';
+import { ErrorToastOptions } from 'src/core/public/notifications';
 import { ExistsParams } from 'elasticsearch';
 import { ExplainParams } from 'elasticsearch';
 import { FieldStatsParams } from 'elasticsearch';
@@ -118,6 +119,7 @@ import { RenderSearchTemplateParams } from 'elasticsearch';
 import { Request } from 'hapi';
 import { ResponseObject } from 'hapi';
 import { ResponseToolkit } from 'hapi';
+import { SavedObject as SavedObject_2 } from 'src/core/server';
 import { SchemaTypeError } from '@kbn/config-schema';
 import { ScrollParams } from 'elasticsearch';
 import { SearchParams } from 'elasticsearch';
@@ -141,6 +143,7 @@ import { TasksCancelParams } from 'elasticsearch';
 import { TasksGetParams } from 'elasticsearch';
 import { TasksListParams } from 'elasticsearch';
 import { TermvectorsParams } from 'elasticsearch';
+import { ToastInputFields } from 'src/core/public/notifications';
 import { TransportRequestOptions } from '@elastic/elasticsearch/lib/Transport';
 import { TransportRequestParams } from '@elastic/elasticsearch/lib/Transport';
 import { TransportRequestPromise } from '@elastic/elasticsearch/lib/Transport';
@@ -150,10 +153,12 @@ import { UpdateDocumentByQueryParams } from 'elasticsearch';
 import { UpdateDocumentParams } from 'elasticsearch';
 import { Url } from 'url';
 
-// Warning: (ae-forgotten-export) The symbol "appendersSchema" needs to be exported by the entry point index.d.ts
+// Warning: (ae-forgotten-export) The symbol "ConsoleAppenderConfig" needs to be exported by the entry point index.d.ts
+// Warning: (ae-forgotten-export) The symbol "FileAppenderConfig" needs to be exported by the entry point index.d.ts
+// Warning: (ae-forgotten-export) The symbol "LegacyAppenderConfig" needs to be exported by the entry point index.d.ts
 //
 // @public (undocumented)
-export type AppenderConfigType = TypeOf<typeof appendersSchema>;
+export type AppenderConfigType = ConsoleAppenderConfig | FileAppenderConfig | LegacyAppenderConfig;
 
 // @public
 export function assertNever(x: never): never;
@@ -322,108 +327,45 @@ export type CapabilitiesSwitcher = (request: KibanaRequest, uiCapabilities: Capa
 export const config: {
     elasticsearch: {
         schema: import("@kbn/config-schema").ObjectType<{
-            sniffOnStart: import("@kbn/config-schema").Type<boolean>;
-            sniffInterval: import("@kbn/config-schema").Type<false | import("moment").Duration>;
-            sniffOnConnectionFault: import("@kbn/config-schema").Type<boolean>;
-            hosts: import("@kbn/config-schema").Type<string | string[]>;
-            preserveHost: import("@kbn/config-schema").Type<boolean>;
-            username: import("@kbn/config-schema").Type<string | undefined>;
-            password: import("@kbn/config-schema").Type<string | undefined>;
-            requestHeadersWhitelist: import("@kbn/config-schema").Type<string | string[]>;
-            customHeaders: import("@kbn/config-schema").Type<Record<string, string>>;
-            shardTimeout: import("@kbn/config-schema").Type<import("moment").Duration>;
-            requestTimeout: import("@kbn/config-schema").Type<import("moment").Duration>;
-            pingTimeout: import("@kbn/config-schema").Type<import("moment").Duration>;
-            startupTimeout: import("@kbn/config-schema").Type<import("moment").Duration>;
-            logQueries: import("@kbn/config-schema").Type<boolean>;
+            sniffOnStart: Type<boolean>;
+            sniffInterval: Type<false | import("moment").Duration>;
+            sniffOnConnectionFault: Type<boolean>;
+            hosts: Type<string | string[]>;
+            preserveHost: Type<boolean>;
+            username: Type<string | undefined>;
+            password: Type<string | undefined>;
+            requestHeadersWhitelist: Type<string | string[]>;
+            customHeaders: Type<Record<string, string>>;
+            shardTimeout: Type<import("moment").Duration>;
+            requestTimeout: Type<import("moment").Duration>;
+            pingTimeout: Type<import("moment").Duration>;
+            startupTimeout: Type<import("moment").Duration>;
+            logQueries: Type<boolean>;
             ssl: import("@kbn/config-schema").ObjectType<{
-                verificationMode: import("@kbn/config-schema").Type<"none" | "certificate" | "full">;
-                certificateAuthorities: import("@kbn/config-schema").Type<string | string[] | undefined>;
-                certificate: import("@kbn/config-schema").Type<string | undefined>;
-                key: import("@kbn/config-schema").Type<string | undefined>;
-                keyPassphrase: import("@kbn/config-schema").Type<string | undefined>;
+                verificationMode: Type<"none" | "certificate" | "full">;
+                certificateAuthorities: Type<string | string[] | undefined>;
+                certificate: Type<string | undefined>;
+                key: Type<string | undefined>;
+                keyPassphrase: Type<string | undefined>;
                 keystore: import("@kbn/config-schema").ObjectType<{
-                    path: import("@kbn/config-schema").Type<string | undefined>;
-                    password: import("@kbn/config-schema").Type<string | undefined>;
+                    path: Type<string | undefined>;
+                    password: Type<string | undefined>;
                 }>;
                 truststore: import("@kbn/config-schema").ObjectType<{
-                    path: import("@kbn/config-schema").Type<string | undefined>;
-                    password: import("@kbn/config-schema").Type<string | undefined>;
+                    path: Type<string | undefined>;
+                    password: Type<string | undefined>;
                 }>;
-                alwaysPresentCertificate: import("@kbn/config-schema").Type<boolean>;
+                alwaysPresentCertificate: Type<boolean>;
             }>;
-            apiVersion: import("@kbn/config-schema").Type<string>;
+            apiVersion: Type<string>;
             healthCheck: import("@kbn/config-schema").ObjectType<{
-                delay: import("@kbn/config-schema").Type<import("moment").Duration>;
+                delay: Type<import("moment").Duration>;
             }>;
             ignoreVersionMismatch: import("@kbn/config-schema/target/types/types").ConditionalType<false, boolean, boolean>;
         }>;
     };
     logging: {
-        appenders: import("@kbn/config-schema").Type<Readonly<{} & {
-            layout: Readonly<{} & {
-                kind: "json";
-            }> | Readonly<{
-                pattern?: string | undefined;
-                highlight?: boolean | undefined;
-            } & {
-                kind: "pattern";
-            }>;
-            kind: "console";
-        }> | Readonly<{} & {
-            path: string;
-            layout: Readonly<{} & {
-                kind: "json";
-            }> | Readonly<{
-                pattern?: string | undefined;
-                highlight?: boolean | undefined;
-            } & {
-                kind: "pattern";
-            }>;
-            kind: "file";
-        }> | Readonly<{
-            legacyLoggingConfig?: any;
-        } & {
-            kind: "legacy-appender";
-        }>>;
-        loggers: import("@kbn/config-schema").ObjectType<{
-            appenders: import("@kbn/config-schema").Type<string[]>;
-            context: import("@kbn/config-schema").Type<string>;
-            level: import("@kbn/config-schema").Type<import("./logging/log_level").LogLevelId>;
-        }>;
-        loggerContext: import("@kbn/config-schema").ObjectType<{
-            appenders: import("@kbn/config-schema").Type<Map<string, Readonly<{} & {
-                layout: Readonly<{} & {
-                    kind: "json";
-                }> | Readonly<{
-                    pattern?: string | undefined;
-                    highlight?: boolean | undefined;
-                } & {
-                    kind: "pattern";
-                }>;
-                kind: "console";
-            }> | Readonly<{} & {
-                path: string;
-                layout: Readonly<{} & {
-                    kind: "json";
-                }> | Readonly<{
-                    pattern?: string | undefined;
-                    highlight?: boolean | undefined;
-                } & {
-                    kind: "pattern";
-                }>;
-                kind: "file";
-            }> | Readonly<{
-                legacyLoggingConfig?: any;
-            } & {
-                kind: "legacy-appender";
-            }>>>;
-            loggers: import("@kbn/config-schema").Type<Readonly<{} & {
-                context: string;
-                appenders: string[];
-                level: import("./logging/log_level").LogLevelId;
-            }>[]>;
-        }>;
+        appenders: Type<AppenderConfigType>;
     };
 };
 
@@ -2320,8 +2262,10 @@ export interface SavedObjectsFindOptions {
     // (undocumented)
     defaultSearchOperator?: 'AND' | 'OR';
     fields?: string[];
+    // Warning: (ae-forgotten-export) The symbol "KueryNode" needs to be exported by the entry point index.d.ts
+    //
     // (undocumented)
-    filter?: string;
+    filter?: string | KueryNode;
     // (undocumented)
     hasReference?: {
         type: string;
@@ -2944,11 +2888,11 @@ export const validBodyOutput: readonly ["data", "stream"];
 // Warnings were encountered during analysis:
 //
 // src/core/server/http/router/response.ts:316:3 - (ae-forgotten-export) The symbol "KibanaResponse" needs to be exported by the entry point index.d.ts
-// src/core/server/legacy/types.ts:163:3 - (ae-forgotten-export) The symbol "VarsProvider" needs to be exported by the entry point index.d.ts
-// src/core/server/legacy/types.ts:164:3 - (ae-forgotten-export) The symbol "VarsReplacer" needs to be exported by the entry point index.d.ts
-// src/core/server/legacy/types.ts:165:3 - (ae-forgotten-export) The symbol "LegacyNavLinkSpec" needs to be exported by the entry point index.d.ts
-// src/core/server/legacy/types.ts:166:3 - (ae-forgotten-export) The symbol "LegacyAppSpec" needs to be exported by the entry point index.d.ts
-// src/core/server/legacy/types.ts:167:16 - (ae-forgotten-export) The symbol "LegacyPluginSpec" needs to be exported by the entry point index.d.ts
+// src/core/server/legacy/types.ts:132:3 - (ae-forgotten-export) The symbol "VarsProvider" needs to be exported by the entry point index.d.ts
+// src/core/server/legacy/types.ts:133:3 - (ae-forgotten-export) The symbol "VarsReplacer" needs to be exported by the entry point index.d.ts
+// src/core/server/legacy/types.ts:134:3 - (ae-forgotten-export) The symbol "LegacyNavLinkSpec" needs to be exported by the entry point index.d.ts
+// src/core/server/legacy/types.ts:135:3 - (ae-forgotten-export) The symbol "LegacyAppSpec" needs to be exported by the entry point index.d.ts
+// src/core/server/legacy/types.ts:136:16 - (ae-forgotten-export) The symbol "LegacyPluginSpec" needs to be exported by the entry point index.d.ts
 // src/core/server/plugins/types.ts:266:3 - (ae-forgotten-export) The symbol "KibanaConfigType" needs to be exported by the entry point index.d.ts
 // src/core/server/plugins/types.ts:266:3 - (ae-forgotten-export) The symbol "SharedGlobalConfigKeys" needs to be exported by the entry point index.d.ts
 // src/core/server/plugins/types.ts:268:3 - (ae-forgotten-export) The symbol "PathConfigType" needs to be exported by the entry point index.d.ts
diff --git a/src/core/server/ui_settings/create_or_upgrade_saved_config/integration_tests/create_or_upgrade.test.ts b/src/core/server/ui_settings/create_or_upgrade_saved_config/integration_tests/create_or_upgrade.test.ts
index d2e31dad58e55e..61b71f8c5de07d 100644
--- a/src/core/server/ui_settings/create_or_upgrade_saved_config/integration_tests/create_or_upgrade.test.ts
+++ b/src/core/server/ui_settings/create_or_upgrade_saved_config/integration_tests/create_or_upgrade.test.ts
@@ -24,7 +24,7 @@ import {
   TestElasticsearchUtils,
   TestKibanaUtils,
   TestUtils,
-} from '../../../../../test_utils/kbn_server';
+} from '../../../../test_helpers/kbn_server';
 import { createOrUpgradeSavedConfig } from '../create_or_upgrade_saved_config';
 import { loggingSystemMock } from '../../../logging/logging_system.mock';
 import { httpServerMock } from '../../../http/http_server.mocks';
diff --git a/src/core/server/ui_settings/integration_tests/lib/servers.ts b/src/core/server/ui_settings/integration_tests/lib/servers.ts
index 04979b69b32b9a..297deb0233c57e 100644
--- a/src/core/server/ui_settings/integration_tests/lib/servers.ts
+++ b/src/core/server/ui_settings/integration_tests/lib/servers.ts
@@ -24,7 +24,7 @@ import {
   TestElasticsearchUtils,
   TestKibanaUtils,
   TestUtils,
-} from '../../../../../test_utils/kbn_server';
+} from '../../../../test_helpers/kbn_server';
 import { LegacyAPICaller } from '../../../elasticsearch/';
 import { httpServerMock } from '../../../http/http_server.mocks';
 
diff --git a/src/core/server/ui_settings/integration_tests/routes.test.ts b/src/core/server/ui_settings/integration_tests/routes.test.ts
index b18cc370fac3cd..063d68e3866b71 100644
--- a/src/core/server/ui_settings/integration_tests/routes.test.ts
+++ b/src/core/server/ui_settings/integration_tests/routes.test.ts
@@ -18,7 +18,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import * as kbnTestServer from '../../../../test_utils/kbn_server';
+import * as kbnTestServer from '../../../test_helpers/kbn_server';
 
 describe('ui settings service', () => {
   describe('routes', () => {
diff --git a/src/core/server/utils/index.ts b/src/core/server/utils/index.ts
index b01a4c4e048998..d9c4217c4117f7 100644
--- a/src/core/server/utils/index.ts
+++ b/src/core/server/utils/index.ts
@@ -20,3 +20,4 @@
 export * from './crypto';
 export * from './from_root';
 export * from './package_json';
+export * from './streams';
diff --git a/src/core/server/utils/streams/concat_stream.test.ts b/src/core/server/utils/streams/concat_stream.test.ts
new file mode 100644
index 00000000000000..e964ab2a7a97ed
--- /dev/null
+++ b/src/core/server/utils/streams/concat_stream.test.ts
@@ -0,0 +1,74 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createListStream, createPromiseFromStreams, createConcatStream } from './index';
+
+describe('concatStream', () => {
+  test('accepts an initial value', async () => {
+    const output = await createPromiseFromStreams([
+      createListStream([1, 2, 3]),
+      createConcatStream([0]),
+    ]);
+
+    expect(output).toEqual([0, 1, 2, 3]);
+  });
+
+  describe(`combines using the previous value's concat method`, () => {
+    test('works with strings', async () => {
+      const output = await createPromiseFromStreams([
+        createListStream(['a', 'b', 'c']),
+        createConcatStream(),
+      ]);
+      expect(output).toEqual('abc');
+    });
+
+    test('works with arrays', async () => {
+      const output = await createPromiseFromStreams([
+        createListStream([[1], [2, 3, 4], [10]]),
+        createConcatStream(),
+      ]);
+      expect(output).toEqual([1, 2, 3, 4, 10]);
+    });
+
+    test('works with a mixture, starting with array', async () => {
+      const output = await createPromiseFromStreams([
+        createListStream([[], 1, 2, 3, 4, [5, 6, 7]]),
+        createConcatStream(),
+      ]);
+      expect(output).toEqual([1, 2, 3, 4, 5, 6, 7]);
+    });
+
+    test('fails when the value does not have a concat method', async () => {
+      let promise;
+      try {
+        promise = createPromiseFromStreams([createListStream([1, '1']), createConcatStream()]);
+      } catch (err) {
+        throw new Error('createPromiseFromStreams() should not fail synchronously');
+      }
+
+      try {
+        await promise;
+        throw new Error('Promise should have rejected');
+      } catch (err) {
+        expect(err).toBeInstanceOf(Error);
+        expect(err.message).toContain('concat');
+      }
+    });
+  });
+});
diff --git a/src/core/server/utils/streams/concat_stream.ts b/src/core/server/utils/streams/concat_stream.ts
new file mode 100644
index 00000000000000..03450cb51b8322
--- /dev/null
+++ b/src/core/server/utils/streams/concat_stream.ts
@@ -0,0 +1,46 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createReduceStream } from './reduce_stream';
+
+/**
+ *  Creates a Transform stream that consumes all provided
+ *  values and concatenates them using each values `concat`
+ *  method.
+ *
+ *  Concatenate strings:
+ *    createListStream(['f', 'o', 'o'])
+ *      .pipe(createConcatStream())
+ *      .on('data', console.log)
+ *      // logs "foo"
+ *
+ *  Concatenate values into an array:
+ *    createListStream([1,2,3])
+ *      .pipe(createConcatStream([]))
+ *      .on('data', console.log)
+ *      // logs "[1,2,3]"
+ *
+ *
+ *  @param {any} initial The initial value that subsequent
+ *                       items will concat with
+ *  @return {Transform}
+ */
+export function createConcatStream<T>(initial?: T) {
+  return createReduceStream((acc, chunk) => acc.concat(chunk), initial);
+}
diff --git a/src/core/server/utils/streams/concat_stream_providers.test.ts b/src/core/server/utils/streams/concat_stream_providers.test.ts
new file mode 100644
index 00000000000000..b742a770b70c81
--- /dev/null
+++ b/src/core/server/utils/streams/concat_stream_providers.test.ts
@@ -0,0 +1,66 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Readable } from 'stream';
+
+import { concatStreamProviders } from './concat_stream_providers';
+import { createListStream } from './list_stream';
+import { createConcatStream } from './concat_stream';
+import { createPromiseFromStreams } from './promise_from_streams';
+
+describe('concatStreamProviders() helper', () => {
+  test('writes the data from an array of stream providers into a destination stream in order', async () => {
+    const results = await createPromiseFromStreams([
+      concatStreamProviders([
+        () => createListStream(['foo', 'bar']),
+        () => createListStream(['baz']),
+        () => createListStream(['bug']),
+      ]),
+      createConcatStream(''),
+    ]);
+
+    expect(results).toBe('foobarbazbug');
+  });
+
+  test('emits the errors from a sub-stream to the destination', async () => {
+    const dest = concatStreamProviders([
+      () => createListStream(['foo', 'bar']),
+      () =>
+        new Readable({
+          read() {
+            this.emit('error', new Error('foo'));
+          },
+        }),
+    ]);
+
+    const errorListener = jest.fn();
+    dest.on('error', errorListener);
+
+    await expect(createPromiseFromStreams([dest])).rejects.toThrowErrorMatchingInlineSnapshot(
+      `"foo"`
+    );
+    expect(errorListener.mock.calls).toMatchInlineSnapshot(`
+Array [
+  Array [
+    [Error: foo],
+  ],
+]
+`);
+  });
+});
diff --git a/src/core/server/utils/streams/concat_stream_providers.ts b/src/core/server/utils/streams/concat_stream_providers.ts
new file mode 100644
index 00000000000000..bb836e3d737872
--- /dev/null
+++ b/src/core/server/utils/streams/concat_stream_providers.ts
@@ -0,0 +1,64 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Readable, PassThrough, TransformOptions } from 'stream';
+
+/**
+ *  Write the data and errors from a list of stream providers
+ *  to a single stream in order. Stream providers are only
+ *  called right before they will be consumed, and only one
+ *  provider will be active at a time.
+ *
+ *  @param {Array<() => ReadableStream>} sourceProviders
+ *  @param {PassThroughOptions} options options passed to the PassThrough constructor
+ *  @return {WritableStream} combined stream
+ */
+export function concatStreamProviders(
+  sourceProviders: Array<() => Readable>,
+  options?: TransformOptions
+) {
+  const destination = new PassThrough(options);
+  const queue = sourceProviders.slice();
+
+  (function pipeNext() {
+    const provider = queue.shift();
+
+    if (!provider) {
+      return;
+    }
+
+    const source = provider();
+    const isLast = !queue.length;
+
+    // if there are more sources to pipe, hook
+    // into the source completion
+    if (!isLast) {
+      source.once('end', pipeNext);
+    }
+
+    source
+      // proxy errors from the source to the destination
+      .once('error', (error) => destination.emit('error', error))
+      // pipe the source to the destination but only proxy the
+      // end event if this is the last source
+      .pipe(destination, { end: isLast });
+  })();
+
+  return destination;
+}
diff --git a/src/core/server/utils/streams/filter_stream.test.ts b/src/core/server/utils/streams/filter_stream.test.ts
new file mode 100644
index 00000000000000..41073e54b0a842
--- /dev/null
+++ b/src/core/server/utils/streams/filter_stream.test.ts
@@ -0,0 +1,77 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import {
+  createConcatStream,
+  createFilterStream,
+  createListStream,
+  createPromiseFromStreams,
+} from './index';
+
+describe('createFilterStream()', () => {
+  test('calls the function with each item in the source stream', async () => {
+    const filter = jest.fn().mockReturnValue(true);
+
+    await createPromiseFromStreams([createListStream(['a', 'b', 'c']), createFilterStream(filter)]);
+
+    expect(filter).toMatchInlineSnapshot(`
+      [MockFunction] {
+        "calls": Array [
+          Array [
+            "a",
+          ],
+          Array [
+            "b",
+          ],
+          Array [
+            "c",
+          ],
+        ],
+        "results": Array [
+          Object {
+            "type": "return",
+            "value": true,
+          },
+          Object {
+            "type": "return",
+            "value": true,
+          },
+          Object {
+            "type": "return",
+            "value": true,
+          },
+        ],
+      }
+    `);
+  });
+
+  test('send the filtered values on the output stream', async () => {
+    const result = await createPromiseFromStreams([
+      createListStream([1, 2, 3]),
+      createFilterStream<number>((n) => n % 2 === 0),
+      createConcatStream([]),
+    ]);
+
+    expect(result).toMatchInlineSnapshot(`
+      Array [
+        2,
+      ]
+    `);
+  });
+});
diff --git a/src/legacy/utils/streams/filter_stream.ts b/src/core/server/utils/streams/filter_stream.ts
similarity index 100%
rename from src/legacy/utils/streams/filter_stream.ts
rename to src/core/server/utils/streams/filter_stream.ts
diff --git a/src/core/server/utils/streams/index.ts b/src/core/server/utils/streams/index.ts
new file mode 100644
index 00000000000000..447d1ed5b1c535
--- /dev/null
+++ b/src/core/server/utils/streams/index.ts
@@ -0,0 +1,29 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { concatStreamProviders } from './concat_stream_providers';
+export { createIntersperseStream } from './intersperse_stream';
+export { createSplitStream } from './split_stream';
+export { createListStream } from './list_stream';
+export { createReduceStream } from './reduce_stream';
+export { createPromiseFromStreams } from './promise_from_streams';
+export { createConcatStream } from './concat_stream';
+export { createMapStream } from './map_stream';
+export { createReplaceStream } from './replace_stream';
+export { createFilterStream } from './filter_stream';
diff --git a/src/core/server/utils/streams/intersperse_stream.test.ts b/src/core/server/utils/streams/intersperse_stream.test.ts
new file mode 100644
index 00000000000000..9aa15035d2a1cc
--- /dev/null
+++ b/src/core/server/utils/streams/intersperse_stream.test.ts
@@ -0,0 +1,54 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import {
+  createPromiseFromStreams,
+  createListStream,
+  createIntersperseStream,
+  createConcatStream,
+} from './index';
+
+describe('intersperseStream', () => {
+  test('places the intersperse value between each provided value', async () => {
+    expect(
+      await createPromiseFromStreams([
+        createListStream(['to', 'be', 'or', 'not', 'to', 'be']),
+        createIntersperseStream(' '),
+        createConcatStream(),
+      ])
+    ).toBe('to be or not to be');
+  });
+
+  test('emits values as soon as possible, does not needlessly buffer', async () => {
+    const str = createIntersperseStream('y');
+    const onData = jest.fn();
+    str.on('data', onData);
+
+    str.write('a');
+    expect(onData).toHaveBeenCalledTimes(1);
+    expect(onData.mock.calls[0]).toEqual(['a']);
+    onData.mockClear();
+
+    str.write('b');
+    expect(onData).toHaveBeenCalledTimes(2);
+    expect(onData.mock.calls[0]).toEqual(['y']);
+    expect(onData).toHaveBeenCalledTimes(2);
+    expect(onData.mock.calls[1]).toEqual(['b']);
+  });
+});
diff --git a/src/core/server/utils/streams/intersperse_stream.ts b/src/core/server/utils/streams/intersperse_stream.ts
new file mode 100644
index 00000000000000..272507221caff3
--- /dev/null
+++ b/src/core/server/utils/streams/intersperse_stream.ts
@@ -0,0 +1,64 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Transform } from 'stream';
+
+/**
+ *  Create a Transform stream that receives values in object mode,
+ *  and intersperses a chunk between each object received.
+ *
+ *  This is useful for writing lists:
+ *
+ *    createListStream(['foo', 'bar'])
+ *      .pipe(createIntersperseStream('\n'))
+ *      .pipe(process.stdout) // outputs "foo\nbar"
+ *
+ *  Combine with a concat stream to get "join" like functionality:
+ *
+ *    await createPromiseFromStreams([
+ *      createListStream(['foo', 'bar']),
+ *      createIntersperseStream(' '),
+ *      createConcatStream()
+ *    ]) // produces a single value "foo bar"
+ *
+ *  @param  {String|Buffer} intersperseChunk
+ *  @return {Transform}
+ */
+export function createIntersperseStream(intersperseChunk: string | Buffer) {
+  let first = true;
+
+  return new Transform({
+    writableObjectMode: true,
+    readableObjectMode: true,
+    transform(chunk, enc, callback) {
+      try {
+        if (first) {
+          first = false;
+        } else {
+          this.push(intersperseChunk);
+        }
+
+        this.push(chunk);
+        callback();
+      } catch (err) {
+        callback(err);
+      }
+    },
+  });
+}
diff --git a/src/core/server/utils/streams/list_stream.test.ts b/src/core/server/utils/streams/list_stream.test.ts
new file mode 100644
index 00000000000000..2a20c929db6b97
--- /dev/null
+++ b/src/core/server/utils/streams/list_stream.test.ts
@@ -0,0 +1,44 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createListStream } from './index';
+
+describe('listStream', () => {
+  test('provides the values in the initial list', async () => {
+    const str = createListStream([1, 2, 3, 4]);
+    const onData = jest.fn();
+    str.on('data', onData);
+
+    await new Promise((resolve) => str.on('end', resolve));
+
+    expect(onData).toHaveBeenCalledTimes(4);
+    expect(onData.mock.calls[0]).toEqual([1]);
+    expect(onData.mock.calls[1]).toEqual([2]);
+    expect(onData.mock.calls[2]).toEqual([3]);
+    expect(onData.mock.calls[3]).toEqual([4]);
+  });
+
+  test('does not modify the list passed', async () => {
+    const list = [1, 2, 3, 4];
+    const str = createListStream(list);
+    str.resume();
+    await new Promise((resolve) => str.on('end', resolve));
+    expect(list).toEqual([1, 2, 3, 4]);
+  });
+});
diff --git a/src/core/server/utils/streams/list_stream.ts b/src/core/server/utils/streams/list_stream.ts
new file mode 100644
index 00000000000000..e62f6d3fa930bb
--- /dev/null
+++ b/src/core/server/utils/streams/list_stream.ts
@@ -0,0 +1,44 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Readable } from 'stream';
+
+/**
+ *  Create a Readable stream that provides the items
+ *  from a list as objects to subscribers
+ *
+ *  @param  {Array<any>} items - the list of items to provide
+ *  @return {Readable}
+ */
+export function createListStream<T = any>(items: T | T[] = []) {
+  const queue = Array.isArray(items) ? [...items] : [items];
+
+  return new Readable({
+    objectMode: true,
+    read(size) {
+      queue.splice(0, size).forEach((item) => {
+        this.push(item);
+      });
+
+      if (!queue.length) {
+        this.push(null);
+      }
+    },
+  });
+}
diff --git a/src/core/server/utils/streams/map_stream.test.ts b/src/core/server/utils/streams/map_stream.test.ts
new file mode 100644
index 00000000000000..bf0cab39c21f40
--- /dev/null
+++ b/src/core/server/utils/streams/map_stream.test.ts
@@ -0,0 +1,61 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { delay } from 'bluebird';
+
+import { createPromiseFromStreams } from './promise_from_streams';
+import { createListStream } from './list_stream';
+import { createMapStream } from './map_stream';
+import { createConcatStream } from './concat_stream';
+
+describe('createMapStream()', () => {
+  test('calls the function with each item in the source stream', async () => {
+    const mapper = jest.fn();
+
+    await createPromiseFromStreams([createListStream(['a', 'b', 'c']), createMapStream(mapper)]);
+
+    expect(mapper).toHaveBeenCalledTimes(3);
+    expect(mapper).toHaveBeenCalledWith('a', 0);
+    expect(mapper).toHaveBeenCalledWith('b', 1);
+    expect(mapper).toHaveBeenCalledWith('c', 2);
+  });
+
+  test('send the return value from the mapper on the output stream', async () => {
+    const result = await createPromiseFromStreams([
+      createListStream([1, 2, 3]),
+      createMapStream((n: number) => n * 100),
+      createConcatStream([]),
+    ]);
+
+    expect(result).toEqual([100, 200, 300]);
+  });
+
+  test('supports async mappers', async () => {
+    const result = await createPromiseFromStreams([
+      createListStream([1, 2, 3]),
+      createMapStream(async (n: number, i: number) => {
+        await delay(n);
+        return n * i;
+      }),
+      createConcatStream([]),
+    ]);
+
+    expect(result).toEqual([0, 2, 6]);
+  });
+});
diff --git a/src/core/server/utils/streams/map_stream.ts b/src/core/server/utils/streams/map_stream.ts
new file mode 100644
index 00000000000000..aad53cc5266260
--- /dev/null
+++ b/src/core/server/utils/streams/map_stream.ts
@@ -0,0 +1,36 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Transform } from 'stream';
+
+export function createMapStream<T>(fn: (value: T, i: number) => void) {
+  let i = 0;
+
+  return new Transform({
+    objectMode: true,
+    async transform(value, enc, done) {
+      try {
+        this.push(await fn(value, i++));
+        done();
+      } catch (err) {
+        done(err);
+      }
+    },
+  });
+}
diff --git a/src/core/server/utils/streams/promise_from_streams.test.ts b/src/core/server/utils/streams/promise_from_streams.test.ts
new file mode 100644
index 00000000000000..1f2596c16a6fa3
--- /dev/null
+++ b/src/core/server/utils/streams/promise_from_streams.test.ts
@@ -0,0 +1,135 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Readable, Writable, Duplex, Transform } from 'stream';
+
+import { createListStream, createPromiseFromStreams, createReduceStream } from './index';
+
+describe('promiseFromStreams', () => {
+  test('pipes together an array of streams', async () => {
+    const str1 = createListStream([1, 2, 3]);
+    const str2 = createReduceStream((acc, n) => acc + n, 0);
+    const sumPromise = new Promise((resolve) => str2.once('data', resolve));
+    createPromiseFromStreams([str1, str2]);
+    await new Promise((resolve) => str2.once('end', resolve));
+    expect(await sumPromise).toBe(6);
+  });
+
+  describe('last stream is writable', () => {
+    test('waits for the last stream to finish writing', async () => {
+      let written = '';
+
+      await createPromiseFromStreams([
+        createListStream(['a']),
+        new Writable({
+          write(chunk, enc, cb) {
+            setTimeout(() => {
+              written += chunk;
+              cb();
+            }, 100);
+          },
+        }),
+      ]);
+
+      expect(written).toBe('a');
+    });
+
+    test('resolves to undefined', async () => {
+      const result = await createPromiseFromStreams([
+        createListStream(['a']),
+        new Writable({
+          write(chunk, enc, cb) {
+            cb();
+          },
+        }),
+      ]);
+
+      expect(result).toBe(undefined);
+    });
+  });
+
+  describe('last stream is readable', () => {
+    test(`resolves to it's final value`, async () => {
+      const result = await createPromiseFromStreams([createListStream(['a', 'b', 'c'])]);
+
+      expect(result).toBe('c');
+    });
+  });
+
+  describe('last stream is duplex', () => {
+    test('waits for writing and resolves to final value', async () => {
+      let written = '';
+
+      const duplexReadQueue: Array<Promise<unknown>> = [];
+      const duplexItemsToPush = ['foo', 'bar', null];
+      const result = await createPromiseFromStreams([
+        createListStream(['a', 'b', 'c']),
+        new Duplex({
+          async read() {
+            this.push(await duplexReadQueue.shift());
+          },
+
+          write(chunk, enc, cb) {
+            duplexReadQueue.push(
+              new Promise((resolve) => {
+                setTimeout(() => {
+                  written += chunk;
+                  cb();
+                  resolve(duplexItemsToPush.shift());
+                }, 50);
+              })
+            );
+          },
+        }).setEncoding('utf8'),
+      ]);
+
+      expect(written).toEqual('abc');
+      expect(result).toBe('bar');
+    });
+  });
+
+  describe('error handling', () => {
+    test('read stream gets destroyed when transform stream fails', async () => {
+      let destroyCalled = false;
+      const readStream = new Readable({
+        read() {
+          this.push('a');
+          this.push('b');
+          this.push('c');
+          this.push(null);
+        },
+        destroy() {
+          destroyCalled = true;
+        },
+      });
+      const transformStream = new Transform({
+        transform(chunk, enc, done) {
+          done(new Error('Test error'));
+        },
+      });
+      try {
+        await createPromiseFromStreams([readStream, transformStream]);
+        throw new Error('Should fail');
+      } catch (e) {
+        expect(e.message).toBe('Test error');
+        expect(destroyCalled).toBe(true);
+      }
+    });
+  });
+});
diff --git a/src/core/server/utils/streams/promise_from_streams.ts b/src/core/server/utils/streams/promise_from_streams.ts
new file mode 100644
index 00000000000000..f5fc4af62bc838
--- /dev/null
+++ b/src/core/server/utils/streams/promise_from_streams.ts
@@ -0,0 +1,72 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ *  Take an array of streams, pipe the output
+ *  from each one into the next, listening for
+ *  errors from any of the streams, and then resolve
+ *  the promise once the final stream has finished
+ *  writing/reading.
+ *
+ *  If the last stream is readable, it's final value
+ *  will be provided as the promise value.
+ *
+ *  Errors emitted from any stream will cause
+ *  the promise to be rejected with that error.
+ *
+ *  @param  {Array<Stream>} streams
+ *  @return {Promise<any>}
+ */
+
+import { pipeline, Writable, Readable } from 'stream';
+
+function isReadable(stream: Readable | Writable): stream is Readable {
+  return 'read' in stream && typeof stream.read === 'function';
+}
+
+export async function createPromiseFromStreams<T>(streams: [Readable, ...Writable[]]): Promise<T> {
+  let finalChunk: any;
+  const last = streams[streams.length - 1];
+  if (!isReadable(last) && streams.length === 1) {
+    // For a nicer error than what stream.pipeline throws
+    throw new Error('A minimum of 2 streams is required when a non-readable stream is given');
+  }
+  if (isReadable(last)) {
+    // We are pushing a writable stream to capture the last chunk
+    streams.push(
+      new Writable({
+        // Use object mode even when "last" stream isn't. This allows to
+        // capture the last chunk as-is.
+        objectMode: true,
+        write(chunk, enc, done) {
+          finalChunk = chunk;
+          done();
+        },
+      })
+    );
+  }
+
+  return new Promise((resolve, reject) => {
+    // @ts-expect-error 'pipeline' doesn't support variable length of arguments
+    pipeline(...streams, (err) => {
+      if (err) return reject(err);
+      resolve(finalChunk);
+    });
+  });
+}
diff --git a/src/core/server/utils/streams/reduce_stream.test.ts b/src/core/server/utils/streams/reduce_stream.test.ts
new file mode 100644
index 00000000000000..e4a7dc1cef4912
--- /dev/null
+++ b/src/core/server/utils/streams/reduce_stream.test.ts
@@ -0,0 +1,87 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { Transform } from 'stream';
+import { createReduceStream, createPromiseFromStreams, createListStream } from './index';
+
+const promiseFromEvent = (name: string, emitter: Transform) =>
+  new Promise((resolve) => emitter.on(name, () => resolve(name)));
+
+describe('reduceStream', () => {
+  test('calls the reducer for each item provided', async () => {
+    const stub = jest.fn();
+    await createPromiseFromStreams([
+      createListStream([1, 2, 3]),
+      createReduceStream((val, chunk, enc) => {
+        stub(val, chunk, enc);
+        return chunk;
+      }, 0),
+    ]);
+    expect(stub).toHaveBeenCalledTimes(3);
+    expect(stub.mock.calls[0]).toEqual([0, 1, 'utf8']);
+    expect(stub.mock.calls[1]).toEqual([1, 2, 'utf8']);
+    expect(stub.mock.calls[2]).toEqual([2, 3, 'utf8']);
+  });
+
+  test('provides the return value of the last iteration of the reducer', async () => {
+    const result = await createPromiseFromStreams([
+      createListStream('abcdefg'.split('')),
+      createReduceStream((acc) => acc + 1, 0),
+    ]);
+    expect(result).toBe(7);
+  });
+
+  test('emits an error if an iteration fails', async () => {
+    const reduce = createReduceStream((acc, i) => {
+      expect(i).toBe(1);
+      return acc;
+    }, 0);
+    const errorEvent = promiseFromEvent('error', reduce);
+
+    reduce.write(1);
+    reduce.write(2);
+    reduce.resume();
+    await errorEvent;
+  });
+
+  test('stops calling the reducer if an iteration fails, emits no data', async () => {
+    const reducer = jest.fn((acc, i) => {
+      if (i < 100) return acc + i;
+      else throw new Error(i);
+    });
+    const reduce$ = createReduceStream(reducer, 0);
+
+    const dataStub = jest.fn();
+    const errorStub = jest.fn();
+    reduce$.on('data', dataStub);
+    reduce$.on('error', errorStub);
+    const endEvent = promiseFromEvent('end', reduce$);
+
+    reduce$.write(1);
+    reduce$.write(2);
+    reduce$.write(300);
+    reduce$.write(400);
+    reduce$.write(1000);
+    reduce$.end();
+
+    await endEvent;
+    expect(reducer).toHaveBeenCalledTimes(3);
+    expect(dataStub).toHaveBeenCalledTimes(0);
+    expect(errorStub).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/src/core/server/utils/streams/reduce_stream.ts b/src/core/server/utils/streams/reduce_stream.ts
new file mode 100644
index 00000000000000..9129df096ad13d
--- /dev/null
+++ b/src/core/server/utils/streams/reduce_stream.ts
@@ -0,0 +1,83 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Transform } from 'stream';
+
+/**
+ *  Create a transform stream that consumes each chunk it receives
+ *  and passes it to the reducer, which will return the new value
+ *  for the stream. Once all chunks have been received the reduce
+ *  stream provides the result of final call to the reducer to
+ *  subscribers.
+ *
+ *  @param  {Function}
+ *  @param  {any} initial Initial value for the stream, if undefined
+ *                        then the first chunk provided is used as the
+ *                        initial value.
+ *  @return {Transform}
+ */
+export function createReduceStream<T>(
+  reducer: (value: any, chunk: T, enc: string) => T,
+  initial?: T
+) {
+  let i = -1;
+  let value = initial;
+
+  // if the reducer throws an error then the value is
+  // considered invalid and the stream will never provide
+  // it to subscribers. We will also stop calling the
+  // reducer for any new data that is provided to us
+  let failed = false;
+
+  if (typeof reducer !== 'function') {
+    throw new TypeError('reducer must be a function');
+  }
+
+  return new Transform({
+    readableObjectMode: true,
+    writableObjectMode: true,
+    async transform(chunk, enc, callback) {
+      try {
+        if (failed) {
+          return callback();
+        }
+
+        i += 1;
+        if (i === 0 && initial === undefined) {
+          value = chunk;
+        } else {
+          value = await reducer(value, chunk, enc);
+        }
+
+        callback();
+      } catch (err) {
+        failed = true;
+        callback(err);
+      }
+    },
+
+    flush(callback) {
+      if (!failed) {
+        this.push(value);
+      }
+
+      callback();
+    },
+  });
+}
diff --git a/src/core/server/utils/streams/replace_stream.test.ts b/src/core/server/utils/streams/replace_stream.test.ts
new file mode 100644
index 00000000000000..c9da42395fb85c
--- /dev/null
+++ b/src/core/server/utils/streams/replace_stream.test.ts
@@ -0,0 +1,132 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { Writable, Readable } from 'stream';
+
+import {
+  createReplaceStream,
+  createConcatStream,
+  createPromiseFromStreams,
+  createListStream,
+  createMapStream,
+} from './index';
+
+async function concatToString(streams: [Readable, ...Writable[]]) {
+  return await createPromiseFromStreams([
+    ...streams,
+    createMapStream((buff: Buffer) => buff.toString('utf8')),
+    createConcatStream(''),
+  ]);
+}
+
+describe('replaceStream', () => {
+  test('produces buffers when it receives buffers', async () => {
+    const chunks = await createPromiseFromStreams<Buffer[]>([
+      createListStream([Buffer.from('foo'), Buffer.from('bar')]),
+      createReplaceStream('o', '0'),
+      createConcatStream([]),
+    ]);
+
+    chunks.forEach((chunk) => {
+      expect(chunk).toBeInstanceOf(Buffer);
+    });
+  });
+
+  test('produces buffers when it receives strings', async () => {
+    const chunks = await createPromiseFromStreams<string[]>([
+      createListStream(['foo', 'bar']),
+      createReplaceStream('o', '0'),
+      createConcatStream([]),
+    ]);
+
+    chunks.forEach((chunk) => {
+      expect(chunk).toBeInstanceOf(Buffer);
+    });
+  });
+
+  test('expects toReplace to be a string', () => {
+    // @ts-expect-error
+    expect(() => createReplaceStream(Buffer.from('foo'))).toThrowError(/be a string/);
+  });
+
+  test('replaces multiple single-char instances in a single chunk', async () => {
+    expect(
+      await concatToString([
+        createListStream([Buffer.from('f00 bar')]),
+        createReplaceStream('0', 'o'),
+      ])
+    ).toBe('foo bar');
+  });
+
+  test('replaces multiple single-char instances in multiple chunks', async () => {
+    expect(
+      await concatToString([
+        createListStream([Buffer.from('f0'), Buffer.from('0 bar')]),
+        createReplaceStream('0', 'o'),
+      ])
+    ).toBe('foo bar');
+  });
+
+  test('replaces single multi-char instances in single chunks', async () => {
+    expect(
+      await concatToString([
+        createListStream([Buffer.from('f0'), Buffer.from('0 bar')]),
+        createReplaceStream('0', 'o'),
+      ])
+    ).toBe('foo bar');
+  });
+
+  test('replaces multiple multi-char instances in single chunks', async () => {
+    expect(
+      await concatToString([
+        createListStream([Buffer.from('foo ba'), Buffer.from('r b'), Buffer.from('az bar')]),
+        createReplaceStream('bar', '*'),
+      ])
+    ).toBe('foo * baz *');
+  });
+
+  test('replaces multi-char instance that stretches multiple chunks', async () => {
+    expect(
+      await concatToString([
+        createListStream([
+          Buffer.from('foo supe'),
+          Buffer.from('rcalifra'),
+          Buffer.from('gilistic'),
+          Buffer.from('expialid'),
+          Buffer.from('ocious bar'),
+        ]),
+        createReplaceStream('supercalifragilisticexpialidocious', '*'),
+      ])
+    ).toBe('foo * bar');
+  });
+
+  test('ignores missing multi-char instance', async () => {
+    expect(
+      await concatToString([
+        createListStream([
+          Buffer.from('foo supe'),
+          Buffer.from('rcalifra'),
+          Buffer.from('gili stic'),
+          Buffer.from('expialid'),
+          Buffer.from('ocious bar'),
+        ]),
+        createReplaceStream('supercalifragilisticexpialidocious', '*'),
+      ])
+    ).toBe('foo supercalifragili sticexpialidocious bar');
+  });
+});
diff --git a/src/core/server/utils/streams/replace_stream.ts b/src/core/server/utils/streams/replace_stream.ts
new file mode 100644
index 00000000000000..05391bb3341c24
--- /dev/null
+++ b/src/core/server/utils/streams/replace_stream.ts
@@ -0,0 +1,86 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Transform } from 'stream';
+
+export function createReplaceStream(toReplace: string, replacement: string | Buffer) {
+  if (typeof toReplace !== 'string') {
+    throw new TypeError('toReplace must be a string');
+  }
+
+  let buffer = Buffer.alloc(0);
+  return new Transform({
+    objectMode: false,
+    async transform(value, enc, done) {
+      try {
+        buffer = Buffer.concat([buffer, value], buffer.length + value.length);
+
+        while (true) {
+          // try to find the next instance of `toReplace` in buffer
+          const index = buffer.indexOf(toReplace);
+
+          // if there is no next instance, break
+          if (index === -1) {
+            break;
+          }
+
+          // flush everything to the left of the next instance
+          // of `toReplace`
+          this.push(buffer.slice(0, index));
+
+          // then flush an instance of `replacement`
+          this.push(replacement);
+
+          // and finally update the buffer to include everything
+          // to the right of `toReplace`, dropping to replace from the buffer
+          buffer = buffer.slice(index + toReplace.length);
+        }
+
+        // until now we have only flushed data that is to the left
+        // of a discovered instance of `toReplace`. If `toReplace` is
+        // never found this would lead to us buffering the entire stream.
+        //
+        // Instead, we only keep enough buffer to complete a potentially
+        // partial instance of `toReplace`
+        if (buffer.length > toReplace.length) {
+          // the entire buffer except the last `toReplace.length` bytes
+          // so that if all but one byte from `toReplace` is in the buffer,
+          // and the next chunk delivers the necessary byte, the buffer will then
+          // contain a complete `toReplace` token.
+          this.push(buffer.slice(0, buffer.length - toReplace.length));
+          buffer = buffer.slice(-toReplace.length);
+        }
+
+        done();
+      } catch (err) {
+        done(err);
+      }
+    },
+
+    flush(callback) {
+      if (buffer.length) {
+        this.push(buffer);
+      }
+
+      // @ts-expect-error
+      buffer = null;
+      callback();
+    },
+  });
+}
diff --git a/src/core/server/utils/streams/split_stream.test.ts b/src/core/server/utils/streams/split_stream.test.ts
new file mode 100644
index 00000000000000..f131bd0661e54f
--- /dev/null
+++ b/src/core/server/utils/streams/split_stream.test.ts
@@ -0,0 +1,71 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { Transform } from 'stream';
+import { createSplitStream, createConcatStream, createPromiseFromStreams } from './index';
+
+async function split(stream: Transform, input: Array<Buffer | string>) {
+  const concat = createConcatStream();
+  concat.write([]);
+  stream.pipe(concat);
+  const output = createPromiseFromStreams([concat]);
+
+  input.forEach((i: any) => {
+    stream.write(i);
+  });
+  stream.end();
+
+  return await output;
+}
+
+describe('splitStream', () => {
+  test('splits buffers, produces strings', async () => {
+    const output = await split(createSplitStream('&'), [Buffer.from('foo&bar')]);
+    expect(output).toEqual(['foo', 'bar']);
+  });
+
+  test('supports mixed input', async () => {
+    const output = await split(createSplitStream('&'), [Buffer.from('foo&b'), 'ar']);
+    expect(output).toEqual(['foo', 'bar']);
+  });
+
+  test('supports buffer split chunks', async () => {
+    const output = await split(createSplitStream(Buffer.from('&')), ['foo&b', 'ar']);
+    expect(output).toEqual(['foo', 'bar']);
+  });
+
+  test('splits provided values by a delimiter', async () => {
+    const output = await split(createSplitStream('&'), ['foo&b', 'ar']);
+    expect(output).toEqual(['foo', 'bar']);
+  });
+
+  test('handles multi-character delimiters', async () => {
+    const output = await split(createSplitStream('oo'), ['foo&b', 'ar']);
+    expect(output).toEqual(['f', '&bar']);
+  });
+
+  test('handles delimiters that span multiple chunks', async () => {
+    const output = await split(createSplitStream('ba'), ['foo&b', 'ar']);
+    expect(output).toEqual(['foo&', 'r']);
+  });
+
+  test('produces an empty chunk if the split char is at the end of the input', async () => {
+    const output = await split(createSplitStream('&bar'), ['foo&b', 'ar']);
+    expect(output).toEqual(['foo', '']);
+  });
+});
diff --git a/src/core/server/utils/streams/split_stream.ts b/src/core/server/utils/streams/split_stream.ts
new file mode 100644
index 00000000000000..ae820f60abbf67
--- /dev/null
+++ b/src/core/server/utils/streams/split_stream.ts
@@ -0,0 +1,74 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Transform } from 'stream';
+
+/**
+ *  Creates a Transform stream that consumes a stream of Buffers
+ *  and produces a stream of strings (in object mode) by splitting
+ *  the received bytes using the splitChunk.
+ *
+ *  Ways this is behaves like String#split:
+ *    - instances of splitChunk are removed from the input
+ *    - splitChunk can be on any size
+ *    - if there are no bytes found after the last splitChunk
+ *      a final empty chunk is emitted
+ *
+ *  Ways this deviates from String#split:
+ *    - splitChunk cannot be a regexp
+ *    - an empty string or Buffer will not produce a stream of individual
+ *      bytes like `string.split('')` would
+ *
+ *  @param  {String} splitChunk
+ *  @return {Transform}
+ */
+export function createSplitStream(splitChunk: string | Uint8Array) {
+  let unsplitBuffer = Buffer.alloc(0);
+
+  return new Transform({
+    writableObjectMode: false,
+    readableObjectMode: true,
+    transform(chunk, enc, callback) {
+      try {
+        let i;
+        let toSplit = Buffer.concat([unsplitBuffer, chunk]);
+        while ((i = toSplit.indexOf(splitChunk)) !== -1) {
+          const slice = toSplit.slice(0, i);
+          toSplit = toSplit.slice(i + splitChunk.length);
+          this.push(slice.toString('utf8'));
+        }
+
+        unsplitBuffer = toSplit;
+        callback();
+      } catch (err) {
+        callback(err);
+      }
+    },
+
+    flush(callback) {
+      try {
+        this.push(unsplitBuffer.toString('utf8'));
+
+        callback();
+      } catch (err) {
+        callback(err);
+      }
+    },
+  });
+}
diff --git a/src/test_utils/public/http_test_setup.ts b/src/core/test_helpers/http_test_setup.ts
similarity index 85%
rename from src/test_utils/public/http_test_setup.ts
rename to src/core/test_helpers/http_test_setup.ts
index 7c70f64887af11..50ea43fb22b5e4 100644
--- a/src/test_utils/public/http_test_setup.ts
+++ b/src/core/test_helpers/http_test_setup.ts
@@ -17,9 +17,9 @@
  * under the License.
  */
 
-import { HttpService } from '../../core/public/http';
-import { fatalErrorsServiceMock } from '../../core/public/fatal_errors/fatal_errors_service.mock';
-import { injectedMetadataServiceMock } from '../../core/public/injected_metadata/injected_metadata_service.mock';
+import { HttpService } from '../public/http';
+import { fatalErrorsServiceMock } from '../public/fatal_errors/fatal_errors_service.mock';
+import { injectedMetadataServiceMock } from '../public/injected_metadata/injected_metadata_service.mock';
 
 export type SetupTap = (
   injectedMetadata: ReturnType<typeof injectedMetadataServiceMock.createSetupContract>,
diff --git a/src/test_utils/kbn_server.ts b/src/core/test_helpers/kbn_server.ts
similarity index 96%
rename from src/test_utils/kbn_server.ts
rename to src/core/test_helpers/kbn_server.ts
index e44ce0de403d94..a494c6aa31d6fe 100644
--- a/src/test_utils/kbn_server.ts
+++ b/src/core/test_helpers/kbn_server.ts
@@ -26,16 +26,16 @@ import {
   kibanaServerTestUser,
   kibanaTestUser,
   setupUsers,
-  // @ts-ignore: implicit any for JS file
 } from '@kbn/test';
 import { defaultsDeep, get } from 'lodash';
 import { resolve } from 'path';
 import { BehaviorSubject } from 'rxjs';
 import supertest from 'supertest';
-import { LegacyAPICaller } from '../core/server';
-import { CliArgs, Env } from '../core/server/config';
-import { Root } from '../core/server/root';
-import KbnServer from '../legacy/server/kbn_server';
+
+import { LegacyAPICaller } from '../server/elasticsearch';
+import { CliArgs, Env } from '../server/config';
+import { Root } from '../server/root';
+import KbnServer from '../../legacy/server/kbn_server';
 
 export type HttpMethod = 'delete' | 'get' | 'head' | 'post' | 'put';
 
@@ -53,7 +53,7 @@ const DEFAULTS_SETTINGS = {
 };
 
 const DEFAULT_SETTINGS_WITH_CORE_PLUGINS = {
-  plugins: { scanDirs: [resolve(__dirname, '../legacy/core_plugins')] },
+  plugins: { scanDirs: [resolve(__dirname, '../../legacy/core_plugins')] },
   elasticsearch: {
     hosts: [esTestConfig.getUrl()],
     username: kibanaServerTestUser.username,
diff --git a/src/dev/build/lib/watch_stdio_for_line.ts b/src/dev/build/lib/watch_stdio_for_line.ts
index 2322d017abc61b..3d7929ccfc33ac 100644
--- a/src/dev/build/lib/watch_stdio_for_line.ts
+++ b/src/dev/build/lib/watch_stdio_for_line.ts
@@ -24,7 +24,7 @@ import {
   createPromiseFromStreams,
   createSplitStream,
   createMapStream,
-} from '../../../legacy/utils/streams';
+} from '../../../core/server/utils';
 
 // creates a stream that skips empty lines unless they are followed by
 // another line, preventing the empty lines produced by splitStream
diff --git a/src/dev/build/tasks/create_archives_task.ts b/src/dev/build/tasks/create_archives_task.ts
index 0083881e9f7487..a05e383394ecf2 100644
--- a/src/dev/build/tasks/create_archives_task.ts
+++ b/src/dev/build/tasks/create_archives_task.ts
@@ -92,8 +92,8 @@ export const CreateArchives: Task = {
       });
 
       metrics.push({
-        group: `${build.isOss() ? 'oss ' : ''}distributable file count`,
-        id: 'total',
+        group: 'distributable file count',
+        id: build.isOss() ? 'oss' : 'default',
         value: fileCount,
       });
     }
diff --git a/src/dev/jest/config.js b/src/dev/jest/config.js
index 74e1ec5e2b4edb..486c8563c54562 100644
--- a/src/dev/jest/config.js
+++ b/src/dev/jest/config.js
@@ -59,7 +59,6 @@ export default {
     '@elastic/eui/lib/(.*)?': '<rootDir>/node_modules/@elastic/eui/test-env/$1',
     '^src/plugins/(.*)': '<rootDir>/src/plugins/$1',
     '^plugins/([^/.]*)(.*)': '<rootDir>/src/legacy/core_plugins/$1/public$2',
-    '^ui/(.*)': '<rootDir>/src/legacy/ui/public/$1',
     '^uiExports/(.*)': '<rootDir>/src/dev/jest/mocks/file_mock.js',
     '^test_utils/(.*)': '<rootDir>/src/test_utils/public/$1',
     '^fixtures/(.*)': '<rootDir>/src/fixtures/$1',
diff --git a/src/dev/jest/setup/mocks.js b/src/dev/jest/setup/mocks.js
index 6e7160e858cd7f..cea28d8abdbd13 100644
--- a/src/dev/jest/setup/mocks.js
+++ b/src/dev/jest/setup/mocks.js
@@ -34,10 +34,6 @@
  * The mocks that are enabled that way live inside the `__mocks__` folders beside their implementation files.
  */
 
-jest.mock('ui/metadata');
-jest.mock('ui/documentation_links/documentation_links');
-jest.mock('ui/chrome');
-
 jest.mock('moment-timezone', () => {
   // We always want to mock the timezone moment-timezone guesses, since otherwise
   // test results might be depending on which time zone you are running them.
diff --git a/src/dev/notice/generate_notice_from_source.ts b/src/dev/notice/generate_notice_from_source.ts
index 0bef5bc5f32d42..9f7eb9d9e1aa4b 100644
--- a/src/dev/notice/generate_notice_from_source.ts
+++ b/src/dev/notice/generate_notice_from_source.ts
@@ -41,7 +41,7 @@ interface Options {
  * into the repository.
  */
 export async function generateNoticeFromSource({ productName, directory, log }: Options) {
-  const globs = ['**/*.{js,less,css,ts}'];
+  const globs = ['**/*.{js,less,css,ts,tsx}'];
 
   const options = {
     cwd: directory,
diff --git a/src/dev/run_i18n_integrate.ts b/src/dev/run_i18n_integrate.ts
index 25c3ea32783aa8..c0b2302c91c540 100644
--- a/src/dev/run_i18n_integrate.ts
+++ b/src/dev/run_i18n_integrate.ts
@@ -111,6 +111,7 @@ run(
       const reporter = new ErrorReporter();
       const messages: Map<string, { message: string }> = new Map();
       await list.run({ messages, reporter });
+      process.exitCode = 0;
     } catch (error) {
       process.exitCode = 1;
       if (error instanceof ErrorReporter) {
@@ -120,6 +121,7 @@ run(
         log.error(error);
       }
     }
+    process.exit();
   },
   {
     flags: {
diff --git a/src/dev/typescript/build_refs.ts b/src/dev/typescript/build_refs.ts
new file mode 100644
index 00000000000000..cbb596c185f8b3
--- /dev/null
+++ b/src/dev/typescript/build_refs.ts
@@ -0,0 +1,37 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import execa from 'execa';
+import { run, ToolingLog } from '@kbn/dev-utils';
+
+export async function buildRefs(log: ToolingLog) {
+  try {
+    log.info('Building TypeScript projects refs...');
+    await execa(require.resolve('typescript/bin/tsc'), ['-b', 'tsconfig.refs.json']);
+  } catch (e) {
+    log.error(e);
+    process.exit(1);
+  }
+}
+
+export async function runBuildRefs() {
+  run(async ({ log }) => {
+    await buildRefs(log);
+  });
+}
diff --git a/src/dev/typescript/projects.ts b/src/dev/typescript/projects.ts
index 065321e355256a..e18c82b5b9e96e 100644
--- a/src/dev/typescript/projects.ts
+++ b/src/dev/typescript/projects.ts
@@ -24,6 +24,7 @@ import { Project } from './project';
 
 export const PROJECTS = [
   new Project(resolve(REPO_ROOT, 'tsconfig.json')),
+  new Project(resolve(REPO_ROOT, 'src/test_utils/tsconfig.json')),
   new Project(resolve(REPO_ROOT, 'test/tsconfig.json'), { name: 'kibana/test' }),
   new Project(resolve(REPO_ROOT, 'x-pack/tsconfig.json')),
   new Project(resolve(REPO_ROOT, 'x-pack/test/tsconfig.json'), { name: 'x-pack/test' }),
diff --git a/src/dev/typescript/run_type_check_cli.ts b/src/dev/typescript/run_type_check_cli.ts
index 9eeaeb4da70424..e1fca23274a5aa 100644
--- a/src/dev/typescript/run_type_check_cli.ts
+++ b/src/dev/typescript/run_type_check_cli.ts
@@ -24,8 +24,9 @@ import getopts from 'getopts';
 
 import { execInProjects } from './exec_in_projects';
 import { filterProjectsByFlag } from './projects';
+import { buildRefs } from './build_refs';
 
-export function runTypeCheckCli() {
+export async function runTypeCheckCli() {
   const extraFlags: string[] = [];
   const opts = getopts(process.argv.slice(2), {
     boolean: ['skip-lib-check', 'help'],
@@ -79,7 +80,16 @@ export function runTypeCheckCli() {
     process.exit();
   }
 
-  const tscArgs = ['--noEmit', '--pretty', ...(opts['skip-lib-check'] ? ['--skipLibCheck'] : [])];
+  await buildRefs(log);
+
+  const tscArgs = [
+    // composite project cannot be used with --noEmit
+    ...['--composite', 'false'],
+    ...['--emitDeclarationOnly', 'false'],
+    '--noEmit',
+    '--pretty',
+    ...(opts['skip-lib-check'] ? ['--skipLibCheck'] : []),
+  ];
   const projects = filterProjectsByFlag(opts.project).filter((p) => !p.disableTypeCheck);
 
   if (!projects.length) {
diff --git a/src/fixtures/stubbed_logstash_index_pattern.js b/src/fixtures/stubbed_logstash_index_pattern.js
index 5bb926799fcf6d..5735b01eb3db42 100644
--- a/src/fixtures/stubbed_logstash_index_pattern.js
+++ b/src/fixtures/stubbed_logstash_index_pattern.js
@@ -21,7 +21,12 @@ import StubIndexPattern from 'test_utils/stub_index_pattern';
 import stubbedLogstashFields from 'fixtures/logstash_fields';
 
 import { getKbnFieldType } from '../plugins/data/common';
-import { npSetup } from '../legacy/ui/public/new_platform/new_platform.karma_mock';
+import { uiSettingsServiceMock } from '../core/public/ui_settings/ui_settings_service.mock';
+
+const uiSettingSetupMock = uiSettingsServiceMock.createSetupContract();
+uiSettingSetupMock.get.mockImplementation((item, defaultValue) => {
+  return defaultValue;
+});
 
 export default function stubbedLogstashIndexPatternService() {
   const mockLogstashFields = stubbedLogstashFields();
@@ -41,13 +46,9 @@ export default function stubbedLogstashIndexPatternService() {
     };
   });
 
-  const indexPattern = new StubIndexPattern(
-    'logstash-*',
-    (cfg) => cfg,
-    'time',
-    fields,
-    npSetup.core
-  );
+  const indexPattern = new StubIndexPattern('logstash-*', (cfg) => cfg, 'time', fields, {
+    uiSettings: uiSettingSetupMock,
+  });
 
   indexPattern.id = 'logstash-*';
   indexPattern.isTimeNanosBased = () => false;
diff --git a/src/legacy/core_plugins/kibana/index.js b/src/legacy/core_plugins/kibana/index.js
deleted file mode 100644
index 722d75d00f78fc..00000000000000
--- a/src/legacy/core_plugins/kibana/index.js
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { getUiSettingDefaults } from './server/ui_setting_defaults';
-
-export default function (kibana) {
-  return new kibana.Plugin({
-    id: 'kibana',
-    config: function (Joi) {
-      return Joi.object({
-        enabled: Joi.boolean().default(true),
-        index: Joi.string().default('.kibana'),
-        autocompleteTerminateAfter: Joi.number().integer().min(1).default(100000),
-        // TODO Also allow units here like in elasticsearch config once this is moved to the new platform
-        autocompleteTimeout: Joi.number().integer().min(1).default(1000),
-      }).default();
-    },
-
-    uiExports: {
-      uiSettingDefaults: getUiSettingDefaults(),
-    },
-  });
-}
diff --git a/src/legacy/core_plugins/kibana/package.json b/src/legacy/core_plugins/kibana/package.json
deleted file mode 100644
index 94db646611df0b..00000000000000
--- a/src/legacy/core_plugins/kibana/package.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "name": "kibana",
-  "version": "kibana",
-  "config": {
-    "@elastic/eslint-import-resolver-kibana": {
-      "projectRoot": false
-    }
-  }
-}
diff --git a/src/legacy/core_plugins/kibana/public/index.scss b/src/legacy/core_plugins/kibana/public/index.scss
deleted file mode 100644
index 7de0c8fc15f943..00000000000000
--- a/src/legacy/core_plugins/kibana/public/index.scss
+++ /dev/null
@@ -1,7 +0,0 @@
-// Elastic charts
-@import '@elastic/charts/dist/theme';
-@import '@elastic/eui/src/themes/charts/theme';
-
-// Public UI styles
-@import 'src/legacy/ui/public/index';
-
diff --git a/src/legacy/core_plugins/kibana/server/ui_setting_defaults.js b/src/legacy/core_plugins/kibana/server/ui_setting_defaults.js
deleted file mode 100644
index 7de5fb581643ac..00000000000000
--- a/src/legacy/core_plugins/kibana/server/ui_setting_defaults.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export function getUiSettingDefaults() {
-  // wrapped in provider so that a new instance is given to each app/test
-  return {};
-}
diff --git a/src/legacy/deprecation/__tests__/create_transform.js b/src/legacy/deprecation/__tests__/create_transform.js
deleted file mode 100644
index d3838da5c3399c..00000000000000
--- a/src/legacy/deprecation/__tests__/create_transform.js
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { createTransform } from '../create_transform';
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-
-describe('deprecation', function () {
-  describe('createTransform', function () {
-    it(`doesn't modify settings parameter`, function () {
-      const settings = {
-        original: true,
-      };
-      const deprecations = [
-        (settings) => {
-          settings.original = false;
-        },
-      ];
-      createTransform(deprecations)(settings);
-      expect(settings.original).to.be(true);
-    });
-
-    it('calls single deprecation in array', function () {
-      const deprecations = [sinon.spy()];
-      createTransform(deprecations)({});
-      expect(deprecations[0].calledOnce).to.be(true);
-    });
-
-    it('calls multiple deprecations in array', function () {
-      const deprecations = [sinon.spy(), sinon.spy()];
-      createTransform(deprecations)({});
-      expect(deprecations[0].calledOnce).to.be(true);
-      expect(deprecations[1].calledOnce).to.be(true);
-    });
-
-    it('passes log function to deprecation', function () {
-      const deprecation = sinon.spy();
-      const log = function () {};
-      createTransform([deprecation])({}, log);
-      expect(deprecation.args[0][1]).to.be(log);
-    });
-  });
-});
diff --git a/src/legacy/deprecation/create_transform.js b/src/legacy/deprecation/create_transform.js
deleted file mode 100644
index 72e8e153ed819a..00000000000000
--- a/src/legacy/deprecation/create_transform.js
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { deepCloneWithBuffers as clone } from '../utils';
-import { forEach, noop } from 'lodash';
-
-export function createTransform(deprecations) {
-  return (settings, log = noop) => {
-    const result = clone(settings);
-
-    forEach(deprecations, (deprecation) => {
-      deprecation(result, log);
-    });
-
-    return result;
-  };
-}
diff --git a/src/legacy/deprecation/deprecations/__tests__/rename.js b/src/legacy/deprecation/deprecations/__tests__/rename.js
deleted file mode 100644
index 47c6b3257ff691..00000000000000
--- a/src/legacy/deprecation/deprecations/__tests__/rename.js
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import { rename } from '../rename';
-import sinon from 'sinon';
-
-describe('deprecation/deprecations', function () {
-  describe('rename', function () {
-    it('should rename simple property', function () {
-      const value = 'value';
-      const settings = {
-        before: value,
-      };
-
-      rename('before', 'after')(settings);
-      expect(settings.before).to.be(undefined);
-      expect(settings.after).to.be(value);
-    });
-
-    it('should rename nested property', function () {
-      const value = 'value';
-      const settings = {
-        someObject: {
-          before: value,
-        },
-      };
-
-      rename('someObject.before', 'someObject.after')(settings);
-      expect(settings.someObject.before).to.be(undefined);
-      expect(settings.someObject.after).to.be(value);
-    });
-
-    it('should rename property, even when the value is null', function () {
-      const value = null;
-      const settings = {
-        before: value,
-      };
-
-      rename('before', 'after')(settings);
-      expect(settings.before).to.be(undefined);
-      expect(settings.after).to.be(null);
-    });
-
-    it(`shouldn't log when a rename doesn't occur`, function () {
-      const settings = {
-        exists: true,
-      };
-
-      const log = sinon.spy();
-      rename('doesntExist', 'alsoDoesntExist')(settings, log);
-      expect(log.called).to.be(false);
-    });
-
-    it('should log when a rename does occur', function () {
-      const settings = {
-        exists: true,
-      };
-
-      const log = sinon.spy();
-      rename('exists', 'alsoExists')(settings, log);
-
-      expect(log.calledOnce).to.be(true);
-      expect(log.args[0][0]).to.match(/exists.+deprecated/);
-    });
-  });
-});
diff --git a/src/legacy/deprecation/deprecations/__tests__/unused.js b/src/legacy/deprecation/deprecations/__tests__/unused.js
deleted file mode 100644
index 4907c2b1669890..00000000000000
--- a/src/legacy/deprecation/deprecations/__tests__/unused.js
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-import { unused } from '../unused';
-
-describe('deprecation/deprecations', function () {
-  describe('unused', function () {
-    it('should remove unused setting', function () {
-      const settings = {
-        old: true,
-      };
-
-      unused('old')(settings);
-      expect(settings.old).to.be(undefined);
-    });
-
-    it(`shouldn't remove used setting`, function () {
-      const value = 'value';
-      const settings = {
-        new: value,
-      };
-
-      unused('old')(settings);
-      expect(settings.new).to.be(value);
-    });
-
-    it('should remove unused setting, even when null', function () {
-      const settings = {
-        old: null,
-      };
-
-      unused('old')(settings);
-      expect(settings.old).to.be(undefined);
-    });
-
-    it('should log when removing unused setting', function () {
-      const settings = {
-        old: true,
-      };
-
-      const log = sinon.spy();
-      unused('old')(settings, log);
-
-      expect(log.calledOnce).to.be(true);
-      expect(log.args[0][0]).to.match(/old.+deprecated/);
-    });
-
-    it(`shouldn't log when no setting is unused`, function () {
-      const settings = {
-        new: true,
-      };
-
-      const log = sinon.spy();
-      unused('old')(settings, log);
-      expect(log.called).to.be(false);
-    });
-  });
-});
diff --git a/src/legacy/deprecation/deprecations/index.js b/src/legacy/deprecation/deprecations/index.js
deleted file mode 100644
index 527c99309ba807..00000000000000
--- a/src/legacy/deprecation/deprecations/index.js
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { rename } from './rename';
-export { unused } from './unused';
diff --git a/src/legacy/deprecation/deprecations/rename.js b/src/legacy/deprecation/deprecations/rename.js
deleted file mode 100644
index c96b9146b4e2c0..00000000000000
--- a/src/legacy/deprecation/deprecations/rename.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { set } from '@elastic/safer-lodash-set';
-import { get, isUndefined, noop } from 'lodash';
-import { unset } from '../../utils';
-
-export function rename(oldKey, newKey) {
-  return (settings, log = noop) => {
-    const value = get(settings, oldKey);
-    if (isUndefined(value)) {
-      return;
-    }
-
-    unset(settings, oldKey);
-    set(settings, newKey, value);
-
-    log(`Config key "${oldKey}" is deprecated. It has been replaced with "${newKey}"`);
-  };
-}
diff --git a/src/legacy/deprecation/deprecations/unused.js b/src/legacy/deprecation/deprecations/unused.js
deleted file mode 100644
index 4291063dc482b6..00000000000000
--- a/src/legacy/deprecation/deprecations/unused.js
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { get, isUndefined, noop } from 'lodash';
-import { unset } from '../../utils';
-
-export function unused(oldKey) {
-  return (settings, log = noop) => {
-    const value = get(settings, oldKey);
-    if (isUndefined(value)) {
-      return;
-    }
-
-    unset(settings, oldKey);
-    log(`${oldKey} is deprecated and is no longer used`);
-  };
-}
diff --git a/src/legacy/deprecation/get_transform.js b/src/legacy/deprecation/get_transform.js
deleted file mode 100644
index bf286901af62c7..00000000000000
--- a/src/legacy/deprecation/get_transform.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { noop } from 'lodash';
-
-import { createTransform } from './create_transform';
-import { rename, unused } from './deprecations';
-
-export async function getTransform(spec) {
-  const deprecationsProvider = spec.getDeprecationsProvider() || noop;
-  if (!deprecationsProvider) return;
-  const transforms = (await deprecationsProvider({ rename, unused })) || [];
-  return createTransform(transforms);
-}
diff --git a/src/legacy/deprecation/index.js b/src/legacy/deprecation/index.js
deleted file mode 100644
index 787563e7353ce4..00000000000000
--- a/src/legacy/deprecation/index.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { rename, unused } from './deprecations';
-
-export { createTransform } from './create_transform';
-export { getTransform } from './get_transform';
-export const Deprecations = { rename, unused };
diff --git a/src/legacy/plugin_discovery/plugin_config/__tests__/extend_config_service.js b/src/legacy/plugin_discovery/plugin_config/__tests__/extend_config_service.js
index a74bfb872e99c5..40f84f6f54b3bd 100644
--- a/src/legacy/plugin_discovery/plugin_config/__tests__/extend_config_service.js
+++ b/src/legacy/plugin_discovery/plugin_config/__tests__/extend_config_service.js
@@ -45,10 +45,6 @@ describe('plugin discovery/extend config service', () => {
             enabled: Joi.boolean().default(true),
             test: Joi.string().default('bonk'),
           }).default(),
-
-        deprecations({ rename }) {
-          return [rename('oldTest', 'test')];
-        },
       }),
   })
     .getPluginSpecs()
@@ -74,16 +70,14 @@ describe('plugin discovery/extend config service', () => {
         getConfigPrefix: sandbox.stub().returns(configPrefix),
       };
 
-      const logDeprecation = sandbox.stub();
-
       const getSettings = sandbox.stub(SettingsNS, 'getSettings').returns(rootSettings.foo.bar);
 
       const getSchema = sandbox.stub(SchemaNS, 'getSchema').returns(schema);
 
-      await extendConfigService(pluginSpec, config, rootSettings, logDeprecation);
+      await extendConfigService(pluginSpec, config, rootSettings);
 
       sinon.assert.calledOnce(getSettings);
-      sinon.assert.calledWithExactly(getSettings, pluginSpec, rootSettings, logDeprecation);
+      sinon.assert.calledWithExactly(getSettings, pluginSpec, rootSettings);
 
       sinon.assert.calledOnce(getSchema);
       sinon.assert.calledWithExactly(getSchema, pluginSpec);
@@ -145,41 +139,6 @@ describe('plugin discovery/extend config service', () => {
         expect(error.message).to.contain('"test" must be a string');
       }
     });
-
-    it('calls logDeprecation() with deprecation messages', async () => {
-      const config = Config.withDefaultSchema();
-      const logDeprecation = sinon.stub();
-      await extendConfigService(
-        pluginSpec,
-        config,
-        {
-          foo: {
-            bar: {
-              baz: {
-                oldTest: '123',
-              },
-            },
-          },
-        },
-        logDeprecation
-      );
-      sinon.assert.calledOnce(logDeprecation);
-      sinon.assert.calledWithExactly(logDeprecation, sinon.match('"oldTest" is deprecated'));
-    });
-
-    it('uses settings after transforming deprecations', async () => {
-      const config = Config.withDefaultSchema();
-      await extendConfigService(pluginSpec, config, {
-        foo: {
-          bar: {
-            baz: {
-              oldTest: '123',
-            },
-          },
-        },
-      });
-      expect(config.get('foo.bar.baz.test')).to.be('123');
-    });
   });
 
   describe('disableConfigExtension()', () => {
diff --git a/src/legacy/plugin_discovery/plugin_config/__tests__/settings.js b/src/legacy/plugin_discovery/plugin_config/__tests__/settings.js
index 2a26e29dfd63ab..750c5ee6c6f507 100644
--- a/src/legacy/plugin_discovery/plugin_config/__tests__/settings.js
+++ b/src/legacy/plugin_discovery/plugin_config/__tests__/settings.js
@@ -18,7 +18,6 @@
  */
 
 import expect from '@kbn/expect';
-import sinon from 'sinon';
 
 import { PluginPack } from '../../plugin_pack';
 import { getSettings } from '../settings';
@@ -33,7 +32,6 @@ describe('plugin_discovery/settings', () => {
     provider: ({ Plugin }) =>
       new Plugin({
         configPrefix: 'a.b.c',
-        deprecations: ({ rename }) => [rename('foo', 'bar')],
       }),
   })
     .getPluginSpecs()
@@ -59,28 +57,5 @@ describe('plugin_discovery/settings', () => {
     it('allows rootSettings to be undefined', async () => {
       expect(await getSettings(pluginSpec)).to.eql(undefined);
     });
-
-    it('resolves deprecations', async () => {
-      const logDeprecation = sinon.stub();
-      expect(
-        await getSettings(
-          pluginSpec,
-          {
-            a: {
-              b: {
-                c: {
-                  foo: true,
-                },
-              },
-            },
-          },
-          logDeprecation
-        )
-      ).to.eql({
-        bar: true,
-      });
-
-      sinon.assert.calledOnce(logDeprecation);
-    });
   });
 });
diff --git a/src/legacy/plugin_discovery/plugin_config/extend_config_service.js b/src/legacy/plugin_discovery/plugin_config/extend_config_service.js
index 9257227c0d62b3..a6d5d4ae5f9908 100644
--- a/src/legacy/plugin_discovery/plugin_config/extend_config_service.js
+++ b/src/legacy/plugin_discovery/plugin_config/extend_config_service.js
@@ -30,8 +30,8 @@ import { getSchema, getStubSchema } from './schema';
  *  @param  {Function} [logDeprecation]
  *  @return {Promise<undefined>}
  */
-export async function extendConfigService(spec, config, rootSettings, logDeprecation) {
-  const settings = await getSettings(spec, rootSettings, logDeprecation);
+export async function extendConfigService(spec, config, rootSettings) {
+  const settings = await getSettings(spec, rootSettings);
   const schema = await getSchema(spec);
   config.extendSchema(schema, settings, spec.getConfigPrefix());
 }
diff --git a/src/legacy/plugin_discovery/plugin_config/settings.js b/src/legacy/plugin_discovery/plugin_config/settings.js
index 44ecb5718fe212..e6a4741d76ecaf 100644
--- a/src/legacy/plugin_discovery/plugin_config/settings.js
+++ b/src/legacy/plugin_discovery/plugin_config/settings.js
@@ -19,20 +19,16 @@
 
 import { get } from 'lodash';
 
-import { getTransform } from '../../deprecation';
-
 /**
  *  Get the settings for a pluginSpec from the raw root settings while
  *  optionally calling logDeprecation() with warnings about deprecated
  *  settings that were used
  *  @param  {PluginSpec} spec
  *  @param  {Object} rootSettings
- *  @param  {Function} [logDeprecation]
  *  @return {Promise<Object>}
  */
-export async function getSettings(spec, rootSettings, logDeprecation) {
+export async function getSettings(spec, rootSettings) {
   const prefix = spec.getConfigPrefix();
   const rawSettings = get(rootSettings, prefix);
-  const transform = await getTransform(spec);
-  return transform(rawSettings, logDeprecation);
+  return rawSettings;
 }
diff --git a/src/legacy/server/capabilities/capabilities_mixin.test.ts b/src/legacy/server/capabilities/capabilities_mixin.test.ts
deleted file mode 100644
index 3422d6a8cbb346..00000000000000
--- a/src/legacy/server/capabilities/capabilities_mixin.test.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Server } from 'hapi';
-import KbnServer from '../kbn_server';
-
-import { capabilitiesMixin } from './capabilities_mixin';
-
-describe('capabilitiesMixin', () => {
-  let registerMock: jest.Mock;
-
-  const getKbnServer = (pluginSpecs: any[] = []) => {
-    return ({
-      afterPluginsInit: (callback: () => void) => callback(),
-      pluginSpecs,
-      newPlatform: {
-        setup: {
-          core: {
-            capabilities: {
-              registerProvider: registerMock,
-            },
-          },
-        },
-      },
-    } as unknown) as KbnServer;
-  };
-
-  let server: Server;
-  beforeEach(() => {
-    server = new Server();
-    server.getUiNavLinks = () => [];
-    registerMock = jest.fn();
-  });
-
-  it('calls capabilities#registerCapabilitiesProvider for each legacy plugin specs', async () => {
-    const getPluginSpec = (provider: () => any) => ({
-      getUiCapabilitiesProvider: () => provider,
-    });
-
-    const capaA = { catalogue: { A: true } };
-    const capaB = { catalogue: { B: true } };
-    const kbnServer = getKbnServer([getPluginSpec(() => capaA), getPluginSpec(() => capaB)]);
-    await capabilitiesMixin(kbnServer, server);
-
-    expect(registerMock).toHaveBeenCalledTimes(2);
-    expect(registerMock.mock.calls[0][0]()).toEqual(capaA);
-    expect(registerMock.mock.calls[1][0]()).toEqual(capaB);
-  });
-});
diff --git a/src/legacy/server/capabilities/capabilities_mixin.ts b/src/legacy/server/capabilities/capabilities_mixin.ts
deleted file mode 100644
index 1f8c869f17f663..00000000000000
--- a/src/legacy/server/capabilities/capabilities_mixin.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Server } from 'hapi';
-import KbnServer from '../kbn_server';
-
-export async function capabilitiesMixin(kbnServer: KbnServer, server: Server) {
-  const registerLegacyCapabilities = async () => {
-    const capabilitiesList = await Promise.all(
-      kbnServer.pluginSpecs
-        .map((spec) => spec.getUiCapabilitiesProvider())
-        .filter((provider) => !!provider)
-        .map((provider) => provider(server))
-    );
-
-    capabilitiesList.forEach((capabilities) => {
-      kbnServer.newPlatform.setup.core.capabilities.registerProvider(() => capabilities);
-    });
-  };
-
-  // Some plugin capabilities are derived from data provided by other plugins,
-  // so we need to wait until after all plugins have been init'd to fetch uiCapabilities.
-  kbnServer.afterPluginsInit(async () => {
-    await registerLegacyCapabilities();
-  });
-}
diff --git a/src/legacy/server/capabilities/index.ts b/src/legacy/server/capabilities/index.ts
deleted file mode 100644
index 8c5dea1226f2b6..00000000000000
--- a/src/legacy/server/capabilities/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { capabilitiesMixin } from './capabilities_mixin';
diff --git a/src/legacy/server/config/schema.js b/src/legacy/server/config/schema.js
index 6cd3f8dc448b09..dd65e45659ffce 100644
--- a/src/legacy/server/config/schema.js
+++ b/src/legacy/server/config/schema.js
@@ -231,6 +231,15 @@ export default () =>
       locale: Joi.string().default('en'),
     }).default(),
 
+    // temporarily moved here from the (now deleted) kibana legacy plugin
+    kibana: Joi.object({
+      enabled: Joi.boolean().default(true),
+      index: Joi.string().default('.kibana'),
+      autocompleteTerminateAfter: Joi.number().integer().min(1).default(100000),
+      // TODO Also allow units here like in elasticsearch config once this is moved to the new platform
+      autocompleteTimeout: Joi.number().integer().min(1).default(1000),
+    }).default(),
+
     savedObjects: Joi.object({
       maxImportPayloadBytes: Joi.number().default(10485760),
       maxImportExportSize: Joi.number().default(10000),
diff --git a/src/legacy/server/http/integration_tests/max_payload_size.test.js b/src/legacy/server/http/integration_tests/max_payload_size.test.js
index 789a54f681ba67..2d0718dd356064 100644
--- a/src/legacy/server/http/integration_tests/max_payload_size.test.js
+++ b/src/legacy/server/http/integration_tests/max_payload_size.test.js
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import * as kbnTestServer from '../../../../test_utils/kbn_server';
+import * as kbnTestServer from '../../../../core/test_helpers/kbn_server';
 
 let root;
 beforeAll(async () => {
diff --git a/src/legacy/server/i18n/index.ts b/src/legacy/server/i18n/index.ts
index 09f7022436049d..e895f83fe69017 100644
--- a/src/legacy/server/i18n/index.ts
+++ b/src/legacy/server/i18n/index.ts
@@ -20,7 +20,6 @@
 import { i18n, i18nLoader } from '@kbn/i18n';
 import { basename } from 'path';
 import { Server } from 'hapi';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { fromRoot } from '../../../core/server/utils';
 import { getTranslationPaths } from './get_translations_path';
 import { I18N_RC } from './constants';
diff --git a/src/legacy/server/kbn_server.d.ts b/src/legacy/server/kbn_server.d.ts
index 1a1f43b93f26ed..69fb63fbbd87f1 100644
--- a/src/legacy/server/kbn_server.d.ts
+++ b/src/legacy/server/kbn_server.d.ts
@@ -50,10 +50,6 @@ import { HomeServerPluginSetup } from '../../plugins/home/server';
 // lot of legacy code was assuming this type only had these two methods
 export type KibanaConfig = Pick<LegacyConfig, 'get' | 'has'>;
 
-export interface UiApp {
-  getId(): string;
-}
-
 // Extend the defaults with the plugins and server methods we need.
 declare module 'hapi' {
   interface PluginProperties {
@@ -66,17 +62,6 @@ declare module 'hapi' {
   interface Server {
     config: () => KibanaConfig;
     savedObjects: SavedObjectsLegacyService;
-    injectUiAppVars: (pluginName: string, getAppVars: () => { [key: string]: any }) => void;
-    getHiddenUiAppById(appId: string): UiApp;
-    addScopedTutorialContextFactory: (
-      scopedTutorialContextFactory: (...args: any[]) => any
-    ) => void;
-    getInjectedUiAppVars: (pluginName: string) => { [key: string]: any };
-    getUiNavLinks(): Array<{ _id: string }>;
-    addMemoizedFactoryToRequest: (
-      name: string,
-      factoryFn: (request: Request) => Record<string, any>
-    ) => void;
     logWithMetadata: (tags: string[], message: string, meta: Record<string, any>) => void;
     newPlatform: KbnServer['newPlatform'];
   }
@@ -86,10 +71,6 @@ declare module 'hapi' {
     getBasePath(): string;
     getUiSettingsService(): IUiSettingsClient;
   }
-
-  interface ResponseToolkit {
-    renderAppWithDefaultConfig(app: UiApp): ResponseObject;
-  }
 }
 
 type KbnMixinFunc = (kbnServer: KbnServer, server: Server, config: any) => Promise<any> | void;
diff --git a/src/legacy/server/kbn_server.js b/src/legacy/server/kbn_server.js
index 1084521235ea03..4692262d99bb54 100644
--- a/src/legacy/server/kbn_server.js
+++ b/src/legacy/server/kbn_server.js
@@ -34,8 +34,6 @@ import configCompleteMixin from './config/complete';
 import { optimizeMixin } from '../../optimize';
 import * as Plugins from './plugins';
 import { savedObjectsMixin } from './saved_objects/saved_objects_mixin';
-import { capabilitiesMixin } from './capabilities';
-import { serverExtensionsMixin } from './server_extensions';
 import { uiMixin } from '../ui';
 import { i18nMixin } from './i18n';
 
@@ -92,8 +90,6 @@ export default class KbnServer {
 
         coreMixin,
 
-        // adds methods for extending this.server
-        serverExtensionsMixin,
         loggingMixin,
         warningsMixin,
         statusMixin,
@@ -115,9 +111,6 @@ export default class KbnServer {
         // setup saved object routes
         savedObjectsMixin,
 
-        // setup capabilities routes
-        capabilitiesMixin,
-
         // setup routes that serve the @kbn/optimizer output
         optimizeMixin,
 
diff --git a/src/legacy/server/logging/log_format.js b/src/legacy/server/logging/log_format.js
index 8a80cbef1a9c57..6edda8c4be9076 100644
--- a/src/legacy/server/logging/log_format.js
+++ b/src/legacy/server/logging/log_format.js
@@ -91,7 +91,7 @@ export default class TransformObjStream extends Stream.Transform {
         method: event.method || '',
         headers: event.headers,
         remoteAddress: source.remoteAddress,
-        userAgent: source.remoteAddress,
+        userAgent: source.userAgent,
         referer: source.referer,
       };
 
diff --git a/src/legacy/server/logging/log_format_json.test.js b/src/legacy/server/logging/log_format_json.test.js
index 31e622ecae6113..ec7296d21672b2 100644
--- a/src/legacy/server/logging/log_format_json.test.js
+++ b/src/legacy/server/logging/log_format_json.test.js
@@ -21,7 +21,7 @@ import moment from 'moment';
 
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { attachMetaData } from '../../../../src/core/server/legacy/logging/legacy_logging_server';
-import { createListStream, createPromiseFromStreams } from '../../utils';
+import { createListStream, createPromiseFromStreams } from '../../../core/server/utils';
 
 import KbnLoggerJsonFormat from './log_format_json';
 
@@ -65,12 +65,14 @@ describe('KbnLoggerJsonFormat', () => {
         },
       };
       const result = await createPromiseFromStreams([createListStream([event]), format]);
-      const { type, method, statusCode, message } = JSON.parse(result);
+      const { type, method, statusCode, message, req } = JSON.parse(result);
 
       expect(type).toBe('response');
       expect(method).toBe('GET');
       expect(statusCode).toBe(200);
       expect(message).toBe('GET /path/to/resource 200 12000ms - 13.0B');
+      expect(req.remoteAddress).toBe('127.0.0.1');
+      expect(req.userAgent).toBe('Test Thing');
     });
 
     it('ops', async () => {
diff --git a/src/legacy/server/logging/log_format_string.test.js b/src/legacy/server/logging/log_format_string.test.js
index 067ad70380961e..842325865cce22 100644
--- a/src/legacy/server/logging/log_format_string.test.js
+++ b/src/legacy/server/logging/log_format_string.test.js
@@ -21,7 +21,7 @@ import moment from 'moment';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { attachMetaData } from '../../../../src/core/server/legacy/logging/legacy_logging_server';
 
-import { createListStream, createPromiseFromStreams } from '../../utils';
+import { createListStream, createPromiseFromStreams } from '../../../core/server/utils';
 
 import KbnLoggerStringFormat from './log_format_string';
 
diff --git a/src/legacy/server/saved_objects/saved_objects_mixin.js b/src/legacy/server/saved_objects/saved_objects_mixin.js
index 185c8807ae8b5f..96cf2058839cfb 100644
--- a/src/legacy/server/saved_objects/saved_objects_mixin.js
+++ b/src/legacy/server/saved_objects/saved_objects_mixin.js
@@ -39,14 +39,6 @@ export function savedObjectsMixin(kbnServer, server) {
 
   server.decorate('server', 'kibanaMigrator', migrator);
 
-  const warn = (message) => server.log(['warning', 'saved-objects'], message);
-  // we use kibana.index which is technically defined in the kibana plugin, so if
-  // we don't have the plugin (mainly tests) we can't initialize the saved objects
-  if (!kbnServer.pluginSpecs.some((p) => p.getId() === 'kibana')) {
-    warn('Saved Objects uninitialized because the Kibana plugin is disabled.');
-    return;
-  }
-
   const serializer = kbnServer.newPlatform.start.core.savedObjects.createSerializer();
 
   const createRepository = (callCluster, includedHiddenTypes = []) => {
diff --git a/src/legacy/server/saved_objects/saved_objects_mixin.test.js b/src/legacy/server/saved_objects/saved_objects_mixin.test.js
index 63e4a632ab5e01..d1d6c052ad5891 100644
--- a/src/legacy/server/saved_objects/saved_objects_mixin.test.js
+++ b/src/legacy/server/saved_objects/saved_objects_mixin.test.js
@@ -161,21 +161,6 @@ describe('Saved Objects Mixin', () => {
     };
   });
 
-  describe('no kibana plugin', () => {
-    it('should not try to create anything', () => {
-      mockKbnServer.pluginSpecs.some = () => false;
-      savedObjectsMixin(mockKbnServer, mockServer);
-      expect(mockServer.log).toHaveBeenCalledWith(expect.any(Array), expect.any(String));
-      expect(mockServer.decorate).toHaveBeenCalledWith(
-        'server',
-        'kibanaMigrator',
-        expect.any(Object)
-      );
-      expect(mockServer.decorate).toHaveBeenCalledTimes(1);
-      expect(mockServer.route).not.toHaveBeenCalled();
-    });
-  });
-
   describe('Saved object service', () => {
     let service;
 
diff --git a/src/legacy/server/server_extensions/add_memoized_factory_to_request.test.js b/src/legacy/server/server_extensions/add_memoized_factory_to_request.test.js
deleted file mode 100644
index 48bd0824680619..00000000000000
--- a/src/legacy/server/server_extensions/add_memoized_factory_to_request.test.js
+++ /dev/null
@@ -1,161 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-
-import { serverExtensionsMixin } from './server_extensions_mixin';
-
-describe('server.addMemoizedFactoryToRequest()', () => {
-  const setup = () => {
-    class Request {}
-
-    class Server {
-      constructor() {
-        sinon.spy(this, 'decorate');
-      }
-      decorate(type, name, value) {
-        switch (type) {
-          case 'request':
-            return (Request.prototype[name] = value);
-          case 'server':
-            return (Server.prototype[name] = value);
-          default:
-            throw new Error(`Unexpected decorate type ${type}`);
-        }
-      }
-    }
-
-    const server = new Server();
-    serverExtensionsMixin({}, server);
-    return { server, Request };
-  };
-
-  it('throws when propertyName is not a string', () => {
-    const { server } = setup();
-    expect(() => server.addMemoizedFactoryToRequest()).toThrowError('methodName must be a string');
-    expect(() => server.addMemoizedFactoryToRequest(null)).toThrowError(
-      'methodName must be a string'
-    );
-    expect(() => server.addMemoizedFactoryToRequest(1)).toThrowError('methodName must be a string');
-    expect(() => server.addMemoizedFactoryToRequest(true)).toThrowError(
-      'methodName must be a string'
-    );
-    expect(() => server.addMemoizedFactoryToRequest(/abc/)).toThrowError(
-      'methodName must be a string'
-    );
-    expect(() => server.addMemoizedFactoryToRequest(['foo'])).toThrowError(
-      'methodName must be a string'
-    );
-    expect(() => server.addMemoizedFactoryToRequest([1])).toThrowError(
-      'methodName must be a string'
-    );
-    expect(() => server.addMemoizedFactoryToRequest({})).toThrowError(
-      'methodName must be a string'
-    );
-  });
-
-  it('throws when factory is not a function', () => {
-    const { server } = setup();
-    expect(() => server.addMemoizedFactoryToRequest('name')).toThrowError(
-      'factory must be a function'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', null)).toThrowError(
-      'factory must be a function'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', 1)).toThrowError(
-      'factory must be a function'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', true)).toThrowError(
-      'factory must be a function'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', /abc/)).toThrowError(
-      'factory must be a function'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', ['foo'])).toThrowError(
-      'factory must be a function'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', [1])).toThrowError(
-      'factory must be a function'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', {})).toThrowError(
-      'factory must be a function'
-    );
-  });
-
-  it('throws when factory takes more than one arg', () => {
-    const { server } = setup();
-    /* eslint-disable no-unused-vars */
-    expect(() => server.addMemoizedFactoryToRequest('name', () => {})).not.toThrowError(
-      'more than one argument'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', (a) => {})).not.toThrowError(
-      'more than one argument'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', (a, b) => {})).toThrowError(
-      'more than one argument'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', (a, b, c) => {})).toThrowError(
-      'more than one argument'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', (a, b, c, d) => {})).toThrowError(
-      'more than one argument'
-    );
-    expect(() => server.addMemoizedFactoryToRequest('name', (a, b, c, d, e) => {})).toThrowError(
-      'more than one argument'
-    );
-    /* eslint-enable no-unused-vars */
-  });
-
-  it('decorates request objects with a function at `propertyName`', () => {
-    const { server, Request } = setup();
-
-    expect(new Request()).not.toHaveProperty('decorated');
-    server.addMemoizedFactoryToRequest('decorated', () => {});
-    expect(typeof new Request().decorated).toBe('function');
-  });
-
-  it('caches invocations of the factory to the request instance', () => {
-    const { server, Request } = setup();
-    const factory = sinon.stub().returnsArg(0);
-    server.addMemoizedFactoryToRequest('foo', factory);
-
-    const request1 = new Request();
-    const request2 = new Request();
-
-    // call `foo()` on both requests a bunch of times, each time
-    // the return value should be exactly the same
-    expect(request1.foo()).toBe(request1);
-    expect(request1.foo()).toBe(request1);
-    expect(request1.foo()).toBe(request1);
-    expect(request1.foo()).toBe(request1);
-    expect(request1.foo()).toBe(request1);
-    expect(request1.foo()).toBe(request1);
-
-    expect(request2.foo()).toBe(request2);
-    expect(request2.foo()).toBe(request2);
-    expect(request2.foo()).toBe(request2);
-    expect(request2.foo()).toBe(request2);
-
-    // only two different requests, so factory should have only been
-    // called twice with the two request objects
-    sinon.assert.calledTwice(factory);
-    sinon.assert.calledWithExactly(factory, request1);
-    sinon.assert.calledWithExactly(factory, request2);
-  });
-});
diff --git a/src/legacy/server/server_extensions/index.js b/src/legacy/server/server_extensions/index.js
deleted file mode 100644
index e17bd488897f73..00000000000000
--- a/src/legacy/server/server_extensions/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { serverExtensionsMixin } from './server_extensions_mixin';
diff --git a/src/legacy/server/server_extensions/server_extensions_mixin.js b/src/legacy/server/server_extensions/server_extensions_mixin.js
deleted file mode 100644
index 19c0b24ae15a15..00000000000000
--- a/src/legacy/server/server_extensions/server_extensions_mixin.js
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export function serverExtensionsMixin(kbnServer, server) {
-  /**
-   *  Decorate all request objects with a new method, `methodName`,
-   *  that will call the `factory` on first invocation and return
-   *  the result of the first call to subsequent invocations.
-   *
-   *  @method server.addMemoizedFactoryToRequest
-   *  @param {string} methodName location on the request this
-   *                             factory should be added
-   *  @param {Function} factory the factory to add to the request,
-   *                            which will be called once per request
-   *                            with a single argument, the request.
-   *  @return {undefined}
-   */
-  server.decorate('server', 'addMemoizedFactoryToRequest', (methodName, factory) => {
-    if (typeof methodName !== 'string') {
-      throw new TypeError('methodName must be a string');
-    }
-
-    if (typeof factory !== 'function') {
-      throw new TypeError('factory must be a function');
-    }
-
-    if (factory.length > 1) {
-      throw new TypeError(`
-        factory must not take more than one argument, the request object.
-        Memoization is done based on the request instance and is cached and reused
-        regardless of other arguments. If you want to have a per-request cache that
-        also does some sort of secondary memoization then return an object or function
-        from the memoized decorator and do secondary memoization there.
-      `);
-    }
-
-    const requestCache = new WeakMap();
-    server.decorate('request', methodName, function () {
-      const request = this;
-
-      if (!requestCache.has(request)) {
-        requestCache.set(request, factory(request));
-      }
-
-      return requestCache.get(request);
-    });
-  });
-}
diff --git a/src/legacy/ui/public/.eslintrc b/src/legacy/ui/public/.eslintrc
deleted file mode 100644
index cc44af915ba258..00000000000000
--- a/src/legacy/ui/public/.eslintrc
+++ /dev/null
@@ -1,3 +0,0 @@
-rules:
-  no-console: 2
-  'import/no-default-export': error
diff --git a/src/legacy/ui/public/__mocks__/metadata.ts b/src/legacy/ui/public/__mocks__/metadata.ts
deleted file mode 100644
index b7f944de27463c..00000000000000
--- a/src/legacy/ui/public/__mocks__/metadata.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { metadata as metadataImpl } from '../metadata';
-
-export const metadata: typeof metadataImpl = {
-  branch: 'jest-metadata-mock-branch',
-  version: '42.23.26',
-};
diff --git a/src/legacy/ui/public/__tests__/events.js b/src/legacy/ui/public/__tests__/events.js
deleted file mode 100644
index c225c2a8ac1c0c..00000000000000
--- a/src/legacy/ui/public/__tests__/events.js
+++ /dev/null
@@ -1,244 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import sinon from 'sinon';
-import ngMock from 'ng_mock';
-import { EventsProvider } from '../events';
-import expect from '@kbn/expect';
-import '../private';
-import { createDefer } from 'ui/promises';
-import { createLegacyClass } from '../utils/legacy_class';
-
-describe('Events', function () {
-  require('test_utils/no_digest_promises').activateForSuite();
-
-  let Events;
-  let Promise;
-  let eventsInstance;
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function ($injector, Private) {
-      Promise = $injector.get('Promise');
-      Events = Private(EventsProvider);
-      eventsInstance = new Events();
-    })
-  );
-
-  it('should handle on events', function () {
-    const obj = new Events();
-    const prom = obj.on('test', function (message) {
-      expect(message).to.equal('Hello World');
-    });
-
-    obj.emit('test', 'Hello World');
-
-    return prom;
-  });
-
-  it('should work with inherited objects', function () {
-    createLegacyClass(MyEventedObject).inherits(Events);
-    function MyEventedObject() {
-      MyEventedObject.Super.call(this);
-    }
-    const obj = new MyEventedObject();
-
-    const prom = obj.on('test', function (message) {
-      expect(message).to.equal('Hello World');
-    });
-
-    obj.emit('test', 'Hello World');
-
-    return prom;
-  });
-
-  it('should clear events when off is called', function () {
-    const obj = new Events();
-    obj.on('test', _.noop);
-    expect(obj._listeners).to.have.property('test');
-    expect(obj._listeners.test).to.have.length(1);
-    obj.off();
-    expect(obj._listeners).to.not.have.property('test');
-  });
-
-  it('should clear a specific handler when off is called for an event', function () {
-    const obj = new Events();
-    const handler1 = sinon.stub();
-    const handler2 = sinon.stub();
-    obj.on('test', handler1);
-    obj.on('test', handler2);
-    expect(obj._listeners).to.have.property('test');
-    obj.off('test', handler1);
-
-    return obj.emit('test', 'Hello World').then(function () {
-      sinon.assert.calledOnce(handler2);
-      sinon.assert.notCalled(handler1);
-    });
-  });
-
-  it('should clear a all handlers when off is called for an event', function () {
-    const obj = new Events();
-    const handler1 = sinon.stub();
-    obj.on('test', handler1);
-    expect(obj._listeners).to.have.property('test');
-    obj.off('test');
-    expect(obj._listeners).to.not.have.property('test');
-
-    return obj.emit('test', 'Hello World').then(function () {
-      sinon.assert.notCalled(handler1);
-    });
-  });
-
-  it('should handle multiple identical emits in the same tick', function () {
-    const obj = new Events();
-    const handler1 = sinon.stub();
-
-    obj.on('test', handler1);
-    const emits = [obj.emit('test', 'one'), obj.emit('test', 'two'), obj.emit('test', 'three')];
-
-    return Promise.all(emits).then(function () {
-      expect(handler1.callCount).to.be(emits.length);
-      expect(handler1.getCall(0).calledWith('one')).to.be(true);
-      expect(handler1.getCall(1).calledWith('two')).to.be(true);
-      expect(handler1.getCall(2).calledWith('three')).to.be(true);
-    });
-  });
-
-  it('should handle emits from the handler', function () {
-    const obj = new Events();
-    const secondEmit = createDefer(Promise);
-
-    const handler1 = sinon.spy(function () {
-      if (handler1.calledTwice) {
-        return;
-      }
-      obj.emit('test').then(_.bindKey(secondEmit, 'resolve'));
-    });
-
-    obj.on('test', handler1);
-
-    return Promise.all([obj.emit('test'), secondEmit.promise]).then(function () {
-      expect(handler1.callCount).to.be(2);
-    });
-  });
-
-  it('should only emit to handlers registered before emit is called', function () {
-    const obj = new Events();
-    const handler1 = sinon.stub();
-    const handler2 = sinon.stub();
-
-    obj.on('test', handler1);
-    const emits = [obj.emit('test', 'one'), obj.emit('test', 'two'), obj.emit('test', 'three')];
-
-    return Promise.all(emits).then(function () {
-      expect(handler1.callCount).to.be(emits.length);
-
-      obj.on('test', handler2);
-
-      const emits2 = [obj.emit('test', 'four'), obj.emit('test', 'five'), obj.emit('test', 'six')];
-
-      return Promise.all(emits2).then(function () {
-        expect(handler1.callCount).to.be(emits.length + emits2.length);
-        expect(handler2.callCount).to.be(emits2.length);
-      });
-    });
-  });
-
-  it('should pass multiple arguments from the emitter', function () {
-    const obj = new Events();
-    const handler = sinon.stub();
-    const payload = ['one', { hello: 'tests' }, null];
-
-    obj.on('test', handler);
-
-    return obj.emit('test', payload[0], payload[1], payload[2]).then(function () {
-      expect(handler.callCount).to.be(1);
-      expect(handler.calledWithExactly(payload[0], payload[1], payload[2])).to.be(true);
-    });
-  });
-
-  it('should preserve the scope of the handler', function () {
-    const obj = new Events();
-    const expected = 'some value';
-    let testValue;
-
-    function handler() {
-      testValue = this.getVal();
-    }
-    handler.getVal = _.constant(expected);
-
-    obj.on('test', handler);
-    return obj.emit('test').then(function () {
-      expect(testValue).to.equal(expected);
-    });
-  });
-
-  it('should always emit in the same order', function () {
-    const handler = sinon.stub();
-
-    const obj = new Events();
-    obj.on('block', _.partial(handler, 'block'));
-    obj.on('last', _.partial(handler, 'last'));
-
-    return Promise.all([
-      obj.emit('block'),
-      obj.emit('block'),
-      obj.emit('block'),
-      obj.emit('block'),
-      obj.emit('block'),
-      obj.emit('block'),
-      obj.emit('block'),
-      obj.emit('block'),
-      obj.emit('block'),
-      obj.emit('last'),
-    ]).then(function () {
-      expect(handler.callCount).to.be(10);
-      handler.args.forEach(function (args, i) {
-        expect(args[0]).to.be(i < 9 ? 'block' : 'last');
-      });
-    });
-  });
-
-  it('calls emitted handlers asynchronously', (done) => {
-    const listenerStub = sinon.stub();
-    eventsInstance.on('test', listenerStub);
-    eventsInstance.emit('test');
-    sinon.assert.notCalled(listenerStub);
-
-    setTimeout(() => {
-      sinon.assert.calledOnce(listenerStub);
-      done();
-    }, 100);
-  });
-
-  it('calling off after an emit that has not yet triggered the handler, will not call the handler', (done) => {
-    const listenerStub = sinon.stub();
-    eventsInstance.on('test', listenerStub);
-    eventsInstance.emit('test');
-    // It's called asynchronously so it shouldn't be called yet.
-    sinon.assert.notCalled(listenerStub);
-    eventsInstance.off('test', listenerStub);
-
-    setTimeout(() => {
-      sinon.assert.notCalled(listenerStub);
-      done();
-    }, 100);
-  });
-});
diff --git a/src/legacy/ui/public/__tests__/metadata.js b/src/legacy/ui/public/__tests__/metadata.js
deleted file mode 100644
index c5051d70849cda..00000000000000
--- a/src/legacy/ui/public/__tests__/metadata.js
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import { metadata } from '../metadata';
-describe('ui/metadata', () => {
-  it('is immutable', () => {
-    expect(() => (metadata.foo = 'something')).to.throw;
-    expect(() => (metadata.version = 'something')).to.throw;
-    expect(() => (metadata.vars = {})).to.throw;
-    expect(() => (metadata.vars.kbnIndex = 'something')).to.throw;
-  });
-});
diff --git a/src/legacy/ui/public/_index.scss b/src/legacy/ui/public/_index.scss
deleted file mode 100644
index a441b773d4a4ed..00000000000000
--- a/src/legacy/ui/public/_index.scss
+++ /dev/null
@@ -1,9 +0,0 @@
-// Prefix all styles with "kbn" to avoid conflicts.
-// Examples
-//   kbnChart
-//   kbnChart__legend
-//   kbnChart__legend--small
-//   kbnChart__legend-isLoading
-
-@import './accessibility/index';
-@import './directives/index';
diff --git a/src/legacy/ui/public/accessibility/__tests__/kbn_accessible_click.js b/src/legacy/ui/public/accessibility/__tests__/kbn_accessible_click.js
deleted file mode 100644
index f3b7ab29d8a148..00000000000000
--- a/src/legacy/ui/public/accessibility/__tests__/kbn_accessible_click.js
+++ /dev/null
@@ -1,127 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import angular from 'angular';
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import '../kbn_accessible_click';
-import { keys } from '@elastic/eui';
-
-describe('kbnAccessibleClick directive', () => {
-  let $compile;
-  let $rootScope;
-
-  beforeEach(ngMock.module('kibana'));
-
-  beforeEach(
-    ngMock.inject(function (_$compile_, _$rootScope_) {
-      $compile = _$compile_;
-      $rootScope = _$rootScope_;
-    })
-  );
-
-  describe('throws an error', () => {
-    it('when the element is a button', () => {
-      const html = `<button kbn-accessible-click></button>`;
-      expect(() => {
-        $compile(html)($rootScope);
-      }).to.throwError(/kbnAccessibleClick doesn't need to be used on a button./);
-    });
-
-    it('when the element is a link with an href', () => {
-      const html = `<a href="#" kbn-accessible-click></a>`;
-      expect(() => {
-        $compile(html)($rootScope);
-      }).to.throwError(
-        /kbnAccessibleClick doesn't need to be used on a link if it has a href attribute./
-      );
-    });
-
-    it(`when the element doesn't have an ng-click`, () => {
-      const html = `<div kbn-accessible-click></div>`;
-      expect(() => {
-        $compile(html)($rootScope);
-      }).to.throwError(/kbnAccessibleClick requires ng-click to be defined on its element./);
-    });
-  });
-
-  describe(`doesn't throw an error`, () => {
-    it('when the element is a link without an href', () => {
-      const html = `<a ng-click="noop" kbn-accessible-click></a>`;
-      expect(() => {
-        $compile(html)($rootScope);
-      }).not.to.throwError();
-    });
-  });
-
-  describe('adds accessibility attributes', () => {
-    it('tabindex', () => {
-      const html = `<div ng-click="noop" kbn-accessible-click></div>`;
-      const element = $compile(html)($rootScope);
-      expect(element.attr('tabindex')).to.be('0');
-    });
-
-    it('role', () => {
-      const html = `<div ng-click="noop" kbn-accessible-click></div>`;
-      const element = $compile(html)($rootScope);
-      expect(element.attr('role')).to.be('button');
-    });
-  });
-
-  describe(`doesn't override pre-existing accessibility attributes`, () => {
-    it('tabindex', () => {
-      const html = `<div ng-click="noop" kbn-accessible-click tabindex="1"></div>`;
-      const element = $compile(html)($rootScope);
-      expect(element.attr('tabindex')).to.be('1');
-    });
-
-    it('role', () => {
-      const html = `<div ng-click="noop" kbn-accessible-click role="submit"></div>`;
-      const element = $compile(html)($rootScope);
-      expect(element.attr('role')).to.be('submit');
-    });
-  });
-
-  describe(`calls ng-click`, () => {
-    let scope;
-    let element;
-
-    beforeEach(function () {
-      scope = $rootScope.$new();
-      scope.handleClick = sinon.stub();
-      const html = `<div ng-click="handleClick()" kbn-accessible-click></div>`;
-      element = $compile(html)(scope);
-    });
-
-    it(`on ENTER keyup`, () => {
-      const e = angular.element.Event('keyup'); // eslint-disable-line new-cap
-      e.key = keys.ENTER;
-      element.trigger(e);
-      sinon.assert.calledOnce(scope.handleClick);
-    });
-
-    it(`on SPACE keyup`, () => {
-      const e = angular.element.Event('keyup'); // eslint-disable-line new-cap
-      e.key = keys.SPACE;
-      element.trigger(e);
-      sinon.assert.calledOnce(scope.handleClick);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/accessibility/__tests__/kbn_ui_ace_keyboard_mode.js b/src/legacy/ui/public/accessibility/__tests__/kbn_ui_ace_keyboard_mode.js
deleted file mode 100644
index ce1bf95bf0fb78..00000000000000
--- a/src/legacy/ui/public/accessibility/__tests__/kbn_ui_ace_keyboard_mode.js
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import angular from 'angular';
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import '../kbn_ui_ace_keyboard_mode';
-import { keys } from '@elastic/eui';
-
-describe('kbnUiAceKeyboardMode directive', () => {
-  let element;
-
-  beforeEach(ngMock.module('kibana'));
-
-  beforeEach(
-    ngMock.inject(($compile, $rootScope) => {
-      element = $compile(`<div ui-ace kbn-ui-ace-keyboard-mode></div>`)($rootScope.$new());
-    })
-  );
-
-  it('should add the hint element', () => {
-    expect(element.find('.kbnUiAceKeyboardHint').length).to.be(1);
-  });
-
-  describe('hint element', () => {
-    it('should be tabable', () => {
-      expect(element.find('.kbnUiAceKeyboardHint').attr('tabindex')).to.be('0');
-    });
-
-    it('should move focus to textbox and be inactive if pressed enter on it', () => {
-      const textarea = element.find('textarea');
-      sinon.spy(textarea[0], 'focus');
-      const ev = angular.element.Event('keydown'); // eslint-disable-line new-cap
-      ev.key = keys.ENTER;
-      element.find('.kbnUiAceKeyboardHint').trigger(ev);
-      expect(textarea[0].focus.called).to.be(true);
-      expect(
-        element.find('.kbnUiAceKeyboardHint').hasClass('kbnUiAceKeyboardHint-isInactive')
-      ).to.be(true);
-    });
-
-    it('should be shown again, when pressing Escape in ace editor', () => {
-      const textarea = element.find('textarea');
-      const hint = element.find('.kbnUiAceKeyboardHint');
-      sinon.spy(hint[0], 'focus');
-      const ev = angular.element.Event('keydown'); // eslint-disable-line new-cap
-      ev.key = keys.ESCAPE;
-      textarea.trigger(ev);
-      expect(hint[0].focus.called).to.be(true);
-      expect(hint.hasClass('kbnUiAceKeyboardHint-isInactive')).to.be(false);
-    });
-  });
-
-  describe('ui-ace textarea', () => {
-    it('should not be tabable anymore', () => {
-      expect(element.find('textarea').attr('tabindex')).to.be('-1');
-    });
-  });
-});
-
-describe('kbnUiAceKeyboardModeService', () => {
-  let element;
-
-  beforeEach(ngMock.module('kibana'));
-
-  beforeEach(
-    ngMock.inject(($compile, $rootScope, kbnUiAceKeyboardModeService) => {
-      const scope = $rootScope.$new();
-      element = $compile(`<div ui-ace></div>`)(scope);
-      kbnUiAceKeyboardModeService.initialize(scope, element);
-    })
-  );
-
-  it('should add the hint element', () => {
-    expect(element.find('.kbnUiAceKeyboardHint').length).to.be(1);
-  });
-
-  describe('hint element', () => {
-    it('should be tabable', () => {
-      expect(element.find('.kbnUiAceKeyboardHint').attr('tabindex')).to.be('0');
-    });
-
-    it('should move focus to textbox and be inactive if pressed enter on it', () => {
-      const textarea = element.find('textarea');
-      sinon.spy(textarea[0], 'focus');
-      const ev = angular.element.Event('keydown'); // eslint-disable-line new-cap
-      ev.key = keys.ENTER;
-      element.find('.kbnUiAceKeyboardHint').trigger(ev);
-      expect(textarea[0].focus.called).to.be(true);
-      expect(
-        element.find('.kbnUiAceKeyboardHint').hasClass('kbnUiAceKeyboardHint-isInactive')
-      ).to.be(true);
-    });
-
-    it('should be shown again, when pressing Escape in ace editor', () => {
-      const textarea = element.find('textarea');
-      const hint = element.find('.kbnUiAceKeyboardHint');
-      sinon.spy(hint[0], 'focus');
-      const ev = angular.element.Event('keydown'); // eslint-disable-line new-cap
-      ev.key = keys.ESCAPE;
-      textarea.trigger(ev);
-      expect(hint[0].focus.called).to.be(true);
-      expect(hint.hasClass('kbnUiAceKeyboardHint-isInactive')).to.be(false);
-    });
-  });
-
-  describe('ui-ace textarea', () => {
-    it('should not be tabable anymore', () => {
-      expect(element.find('textarea').attr('tabindex')).to.be('-1');
-    });
-  });
-});
diff --git a/src/legacy/ui/public/accessibility/__tests__/scrollto_activedescendant.js b/src/legacy/ui/public/accessibility/__tests__/scrollto_activedescendant.js
deleted file mode 100644
index d5ccbf887e79b9..00000000000000
--- a/src/legacy/ui/public/accessibility/__tests__/scrollto_activedescendant.js
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import '../scrollto_activedescendant';
-
-describe('scrolltoActivedescendant directive', () => {
-  let $compile;
-  let $rootScope;
-
-  beforeEach(ngMock.module('kibana'));
-
-  beforeEach(
-    ngMock.inject((_$compile_, _$rootScope_) => {
-      $compile = _$compile_;
-      $rootScope = _$rootScope_;
-    })
-  );
-
-  it('should call scrollIntoView on aria-activedescendant changes', () => {
-    const scope = $rootScope.$new();
-    scope.ad = '';
-    const element = $compile(`<div aria-activedescendant="{{ad}}" scrollto-activedescendant>
-      <span id="child1"></span>
-      <span id="child2"></span>
-    </div>`)(scope);
-    const child1 = element.find('#child1');
-    const child2 = element.find('#child2');
-    sinon.spy(child1[0], 'scrollIntoView');
-    sinon.spy(child2[0], 'scrollIntoView');
-    scope.ad = 'child1';
-    scope.$digest();
-    expect(child1[0].scrollIntoView.calledOnce).to.be.eql(true);
-    scope.ad = 'child2';
-    scope.$digest();
-    expect(child2[0].scrollIntoView.calledOnce).to.be.eql(true);
-  });
-});
diff --git a/src/legacy/ui/public/accessibility/_index.scss b/src/legacy/ui/public/accessibility/_index.scss
deleted file mode 100644
index 95062449e4b13c..00000000000000
--- a/src/legacy/ui/public/accessibility/_index.scss
+++ /dev/null
@@ -1 +0,0 @@
-@import './kbn_ui_ace_keyboard_mode';
diff --git a/src/legacy/ui/public/accessibility/_kbn_ui_ace_keyboard_mode.scss b/src/legacy/ui/public/accessibility/_kbn_ui_ace_keyboard_mode.scss
deleted file mode 100644
index 9ace600db4197d..00000000000000
--- a/src/legacy/ui/public/accessibility/_kbn_ui_ace_keyboard_mode.scss
+++ /dev/null
@@ -1,24 +0,0 @@
-.kbnUiAceKeyboardHint {
-  position: absolute;
-  top: 0;
-  bottom: 0;
-  right: 0;
-  left: 0;
-  background: transparentize($euiColorEmptyShade, 0.3);
-  display: flex;
-  flex-direction: column;
-  justify-content: center;
-  align-items: center;
-  text-align: center;
-  opacity: 0;
-
-  &:focus {
-    opacity: 1;
-    border: 2px solid $euiColorPrimary;
-    z-index: 1000;
-  }
-
-  &.kbnUiAceKeyboardHint-isInactive {
-    display: none;
-  }
-}
diff --git a/src/legacy/ui/public/accessibility/angular_aria.js b/src/legacy/ui/public/accessibility/angular_aria.js
deleted file mode 100644
index 4335eddf0d8cdf..00000000000000
--- a/src/legacy/ui/public/accessibility/angular_aria.js
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import 'angular-aria';
-import { uiModules } from '../modules';
-
-/**
- * This module will take care of attaching appropriate aria tags related to some angular stuff,
- * e.g. it will attach aria-invalid if the model state is set to invalid.
- *
- * You can find more infos in the official documentation: https://docs.angularjs.org/api/ngAria.
- *
- * Three settings are disabled: it won't automatically attach `tabindex`, `role=button` or
- * handling keyboard events for `ngClick` directives. Kibana uses `kbnAccessibleClick` to handle
- * those cases where you need an `ngClick` non button element to have keyboard access.
- */
-uiModules.get('kibana', ['ngAria']).config(($ariaProvider) => {
-  $ariaProvider.config({
-    bindKeydown: false,
-    bindRoleForClick: false,
-    tabindex: false,
-  });
-});
diff --git a/src/legacy/ui/public/accessibility/index.js b/src/legacy/ui/public/accessibility/index.js
deleted file mode 100644
index 5ff25214218664..00000000000000
--- a/src/legacy/ui/public/accessibility/index.js
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import './angular_aria';
-import './kbn_accessible_click';
-import './scrollto_activedescendant';
diff --git a/src/legacy/ui/public/accessibility/kbn_accessible_click.js b/src/legacy/ui/public/accessibility/kbn_accessible_click.js
deleted file mode 100644
index a57fbc6be82fd7..00000000000000
--- a/src/legacy/ui/public/accessibility/kbn_accessible_click.js
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * Interactive elements must be able to receive focus.
- *
- * Ideally, this means using elements that are natively keyboard accessible (<a href="">,
- * <input type="button">, or <button>). Note that links should be used when navigating and buttons
- * should be used when performing an action on the page.
- *
- * If you need to use a <div>, <p>, or <a> without the href attribute, then you need to allow
- * them to receive focus and to respond to keyboard input. The workaround is to:
- *
- *   - Give the element tabindex="0" so that it can receive keyboard focus.
- *   - Add a JavaScript onkeyup event handler that triggers element functionality if the Enter key
- *     is pressed while the element is focused. This is necessary because some browsers do not trigger
- *    onclick events for such elements when activated via the keyboard.
- *   - If the item is meant to function as a button, the onkeyup event handler should also detect the
- *     Spacebar in addition to the Enter key, and the element should be given role="button".
- *
- * Apply this directive to any of these elements to automatically do the above.
- */
-
-import { uiModules } from '../modules';
-import { KbnAccessibleClickProvider } from '../../../../plugins/kibana_legacy/public';
-
-uiModules.get('kibana').directive('kbnAccessibleClick', KbnAccessibleClickProvider);
diff --git a/src/legacy/ui/public/accessibility/kbn_ui_ace_keyboard_mode.js b/src/legacy/ui/public/accessibility/kbn_ui_ace_keyboard_mode.js
deleted file mode 100644
index 88b08beb5b3d06..00000000000000
--- a/src/legacy/ui/public/accessibility/kbn_ui_ace_keyboard_mode.js
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * The `kbn-ui-ace-keyboard-mode` directive should be used on any element, that
- * `ui-ace` is used on. It will prevent the keyboard trap, that ui-ace usually
- * has, i.e. tabbing into the box won't give you any possibilities to leave
- * it via keyboard again, since tab inside the textbox works like a tab character.
- *
- * This directive won't change anything, if the user uses the mouse. But if she
- * tabs to the ace editor, an overlay will be shown, that you have to press Enter
- * to enter editing mode, and that it can be left by pressing Escape again.
- *
- * That way the ui-ace editor won't trap keyboard focus, and won't cause that
- * accessibility issue anymore.
- */
-
-import angular from 'angular';
-import { uiModules } from '../modules';
-import { keys } from '@elastic/eui';
-
-let aceKeyboardModeId = 0;
-
-uiModules
-  .get('kibana')
-  .factory('kbnUiAceKeyboardModeService', () => ({
-    initialize(scope, element) {
-      const uniqueId = `kbnUiAceKeyboardHint-${scope.$id}-${aceKeyboardModeId++}`;
-
-      const hint = angular.element(
-        `<div
-          class="kbnUiAceKeyboardHint"
-          id="${uniqueId}"
-          tabindex="0"
-          role="application"
-        >
-          <p class="kuiText kuiVerticalRhythmSmall">
-            Press Enter to start editing.
-          </p>
-          <p class="kuiText kuiVerticalRhythmSmall">
-            When you&rsquo;re done, press Escape to stop editing.
-          </p>
-        </div>`
-      );
-
-      const uiAceTextbox = element.find('textarea');
-
-      function startEditing() {
-        // We are not using ng-class in the element, so that we won't need to $compile it
-        hint.addClass('kbnUiAceKeyboardHint-isInactive');
-        uiAceTextbox.focus();
-      }
-
-      function enableOverlay() {
-        hint.removeClass('kbnUiAceKeyboardHint-isInactive');
-      }
-
-      hint.keydown((ev) => {
-        if (ev.key === keys.ENTER) {
-          ev.preventDefault();
-          startEditing();
-        }
-      });
-
-      uiAceTextbox.blur(() => {
-        enableOverlay();
-      });
-
-      let isAutoCompleterOpen;
-
-      // We have to capture this event on the 'capture' phase, otherwise Ace will have already
-      // dismissed the autocompleter when the user hits ESC.
-      document.addEventListener(
-        'keydown',
-        () => {
-          const autoCompleter = document.querySelector('.ace_autocomplete');
-
-          if (!autoCompleter) {
-            isAutoCompleterOpen = false;
-            return;
-          }
-
-          // The autoComplete is just hidden when it's closed, not removed from the DOM.
-          isAutoCompleterOpen = autoCompleter.style.display !== 'none';
-        },
-        { capture: true }
-      );
-
-      uiAceTextbox.keydown((ev) => {
-        if (ev.key === keys.ESCAPE) {
-          // If the autocompletion context menu is open then we want to let ESC close it but
-          // **not** exit out of editing mode.
-          if (!isAutoCompleterOpen) {
-            ev.preventDefault();
-            ev.stopPropagation();
-            enableOverlay();
-            hint.focus();
-          }
-        }
-      });
-
-      hint.click(startEditing);
-      // Prevent tabbing into the ACE textarea, we now handle all focusing for it
-      uiAceTextbox.attr('tabindex', '-1');
-      element.prepend(hint);
-    },
-  }))
-  .directive('kbnUiAceKeyboardMode', (kbnUiAceKeyboardModeService) => ({
-    restrict: 'A',
-    link(scope, element) {
-      kbnUiAceKeyboardModeService.initialize(scope, element);
-    },
-  }));
diff --git a/src/legacy/ui/public/accessibility/scrollto_activedescendant.js b/src/legacy/ui/public/accessibility/scrollto_activedescendant.js
deleted file mode 100644
index 1034cb1df3ddaa..00000000000000
--- a/src/legacy/ui/public/accessibility/scrollto_activedescendant.js
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * This directive can be applied to an element, that has also aria-activedescendant applied.
- * It will make sure, that whenever aria-activedescendant changes, the new element
- * referenced by it, will be scrolled into visible view, by calling its `scrollIntoView`
- * method.
- */
-
-import { uiModules } from '../modules';
-
-uiModules.get('kibana').directive('scrolltoActivedescendant', () => ({
-  link(scope, element, attrs) {
-    scope.$watch(
-      () => attrs.ariaActivedescendant,
-      (val) => {
-        if (val) {
-          const activeDescendant = element.find(`#${val}`);
-          if (activeDescendant.length) {
-            activeDescendant[0].scrollIntoView();
-          }
-        }
-      }
-    );
-  },
-}));
diff --git a/src/legacy/ui/public/angular_ui_select.js b/src/legacy/ui/public/angular_ui_select.js
deleted file mode 100644
index 99f92587507c92..00000000000000
--- a/src/legacy/ui/public/angular_ui_select.js
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import 'jquery';
-import 'angular';
-// required for `ngSanitize` angular module
-import 'angular-sanitize';
-import 'ui-select/dist/select';
-
-import { uiModules } from 'ui/modules';
-
-uiModules.get('kibana', ['ui.select', 'ngSanitize']);
diff --git a/src/legacy/ui/public/autoload/accessibility.js b/src/legacy/ui/public/autoload/accessibility.js
deleted file mode 100644
index 1c846177eca872..00000000000000
--- a/src/legacy/ui/public/autoload/accessibility.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import '../accessibility';
diff --git a/src/legacy/ui/public/autoload/all.js b/src/legacy/ui/public/autoload/all.js
deleted file mode 100644
index be9b29aa944c95..00000000000000
--- a/src/legacy/ui/public/autoload/all.js
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import './accessibility';
-import './modules';
-import './settings';
diff --git a/src/legacy/ui/public/autoload/modules.js b/src/legacy/ui/public/autoload/modules.js
deleted file mode 100644
index 94929c8ca26d34..00000000000000
--- a/src/legacy/ui/public/autoload/modules.js
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import 'angular';
-import '../chrome';
-import '../config';
-import '../notify';
-import '../private';
-import '../promises';
-import '../state_management/app_state';
-import '../state_management/global_state';
-import '../url';
-import '../directives/watch_multi';
-import '../react_components';
-import '../i18n';
-
-import '@elastic/ui-ace';
-import { uiModules } from 'ui/modules';
-uiModules.get('kibana', ['ui.ace']);
diff --git a/src/legacy/ui/public/autoload/settings.js b/src/legacy/ui/public/autoload/settings.js
deleted file mode 100644
index 50ae67c052b938..00000000000000
--- a/src/legacy/ui/public/autoload/settings.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/** Left intentionally empty to avoid breaking plugins that import this file during the NP migration */
diff --git a/src/legacy/ui/public/binder/__tests__/binder.js b/src/legacy/ui/public/binder/__tests__/binder.js
deleted file mode 100644
index de30df36f6b2b3..00000000000000
--- a/src/legacy/ui/public/binder/__tests__/binder.js
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-
-import { Binder } from '..';
-import $ from 'jquery';
-
-describe('Binder class', function () {
-  let $scope;
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function ($rootScope) {
-      $scope = $rootScope.$new();
-    })
-  );
-
-  describe('Constructing with a $scope', function () {
-    it('accepts a $scope and listens for $destroy', function () {
-      sinon.stub($scope, '$on');
-      new Binder($scope);
-      expect($scope.$on.callCount).to.be(1);
-      expect($scope.$on.args[0][0]).to.be('$destroy');
-    });
-
-    it('unbinds when the $scope is destroyed', function () {
-      const binder = new Binder($scope);
-      sinon.stub(binder, 'destroy');
-      $scope.$destroy();
-      expect(binder.destroy.callCount).to.be(1);
-    });
-  });
-
-  describe('Binder#on', function () {
-    it('binds to normal event emitters', function () {
-      const binder = new Binder();
-      const emitter = {
-        on: sinon.stub(),
-        removeListener: sinon.stub(),
-      };
-      const handler = sinon.stub();
-
-      binder.on(emitter, 'click', handler);
-      expect(emitter.on.callCount).to.be(1);
-      expect(emitter.on.args[0][0]).to.be('click');
-      expect(emitter.on.args[0][1]).to.be(handler);
-
-      binder.destroy();
-      expect(emitter.removeListener.callCount).to.be(1);
-      expect(emitter.removeListener.args[0][0]).to.be('click');
-      expect(emitter.removeListener.args[0][1]).to.be(handler);
-    });
-  });
-
-  describe('Binder#jqOn', function () {
-    it('binds jquery event handlers', function () {
-      const binder = new Binder();
-      const el = document.createElement('div');
-      const handler = sinon.stub();
-
-      binder.jqOn(el, 'click', handler);
-      $(el).click();
-      expect(handler.callCount).to.be(1);
-      binder.destroy();
-      $(el).click();
-      expect(handler.callCount).to.be(1);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/binder/binder.js b/src/legacy/ui/public/binder/binder.js
deleted file mode 100644
index 0d535d3bdcb0ea..00000000000000
--- a/src/legacy/ui/public/binder/binder.js
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import d3 from 'd3';
-import $ from 'jquery';
-
-import { BinderBase } from '../../../utils/binder';
-
-export class Binder extends BinderBase {
-  constructor($scope) {
-    super();
-
-    // support auto-binding to $scope objects
-    if ($scope) {
-      $scope.$on('$destroy', () => this.destroy());
-    }
-  }
-
-  jqOn(el, ...args) {
-    const $el = $(el);
-    $el.on(...args);
-    this.disposal.push(() => $el.off(...args));
-  }
-
-  fakeD3Bind(el, event, handler) {
-    this.jqOn(el, event, (e) => {
-      // mimic https://github.com/mbostock/d3/blob/3abb00113662463e5c19eb87cd33f6d0ddc23bc0/src/selection/on.js#L87-L94
-      const o = d3.event; // Events can be reentrant (e.g., focus).
-      d3.event = e;
-      try {
-        handler.apply(this, [this.__data__]);
-      } finally {
-        d3.event = o;
-      }
-    });
-  }
-}
diff --git a/src/legacy/ui/public/binder/index.js b/src/legacy/ui/public/binder/index.js
deleted file mode 100644
index ce91a987fa570a..00000000000000
--- a/src/legacy/ui/public/binder/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { Binder } from './binder';
diff --git a/src/legacy/ui/public/bound_to_config_obj.js b/src/legacy/ui/public/bound_to_config_obj.js
deleted file mode 100644
index dc1eedebe2b777..00000000000000
--- a/src/legacy/ui/public/bound_to_config_obj.js
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-
-export function BoundToConfigObjProvider(config) {
-  /**
-   * Create an object with properties that may be bound to config values.
-   * The input object is basically cloned unless one of it's own properties
-   * resolved to a string value that starts with an equal sign. When that is
-   * found, that property is forever bound to the corresponding config key.
-   *
-   * example:
-   *
-   * // name is cloned, height is bound to the defaultHeight config key
-   * { name: 'john', height: '=defaultHeight' };
-   *
-   * @param  {Object} input
-   * @return {Object}
-   */
-  function BoundToConfigObj(input) {
-    const self = this;
-
-    _.forOwn(input, function (value, prop) {
-      if (!_.isString(value) || value.charAt(0) !== '=') {
-        self[prop] = value;
-        return;
-      }
-
-      const configKey = value.substr(1);
-
-      config.watch(configKey, function update(value) {
-        self[prop] = value;
-      });
-    });
-  }
-
-  return BoundToConfigObj;
-}
diff --git a/src/legacy/ui/public/capabilities/index.ts b/src/legacy/ui/public/capabilities/index.ts
deleted file mode 100644
index e16116f024a0f5..00000000000000
--- a/src/legacy/ui/public/capabilities/index.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { npStart } from 'ui/new_platform';
-import { Capabilities as UICapabilities } from '../../../../core/public';
-
-export { UICapabilities };
-
-export const capabilities = {
-  get() {
-    return npStart.core.application.capabilities;
-  },
-};
diff --git a/src/legacy/ui/public/capabilities/react/index.ts b/src/legacy/ui/public/capabilities/react/index.ts
deleted file mode 100644
index 78d95a2603290a..00000000000000
--- a/src/legacy/ui/public/capabilities/react/index.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { UICapabilitiesProvider } from './ui_capabilities_provider';
-export { injectUICapabilities } from './inject_ui_capabilities';
diff --git a/src/legacy/ui/public/capabilities/react/inject_ui_capabilities.test.tsx b/src/legacy/ui/public/capabilities/react/inject_ui_capabilities.test.tsx
deleted file mode 100644
index 10fb58783481dc..00000000000000
--- a/src/legacy/ui/public/capabilities/react/inject_ui_capabilities.test.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-jest.mock('ui/capabilities', () => ({
-  capabilities: {
-    get: () => ({
-      uiCapability1: true,
-      uiCapability2: {
-        nestedProp: 'nestedValue',
-      },
-    }),
-  },
-}));
-
-import { mount } from 'enzyme';
-import React from 'react';
-import { UICapabilities } from '..';
-import { injectUICapabilities } from './inject_ui_capabilities';
-import { UICapabilitiesProvider } from './ui_capabilities_provider';
-
-describe('injectUICapabilities', () => {
-  it('provides UICapabilities to FCs', () => {
-    interface FCProps {
-      uiCapabilities: UICapabilities;
-    }
-
-    const MyFC = injectUICapabilities(({ uiCapabilities }: FCProps) => {
-      return <span>{uiCapabilities.uiCapability2.nestedProp}</span>;
-    });
-
-    const wrapper = mount(
-      <UICapabilitiesProvider>
-        <MyFC />
-      </UICapabilitiesProvider>
-    );
-
-    expect(wrapper).toMatchInlineSnapshot(`
-<UICapabilitiesProvider>
-  <InjectUICapabilities(Component)>
-    <Component
-      uiCapabilities={
-        Object {
-          "uiCapability1": true,
-          "uiCapability2": Object {
-            "nestedProp": "nestedValue",
-          },
-        }
-      }
-    >
-      <span>
-        nestedValue
-      </span>
-    </Component>
-  </InjectUICapabilities(Component)>
-</UICapabilitiesProvider>
-`);
-  });
-
-  it('provides UICapabilities to class components', () => {
-    interface ClassProps {
-      uiCapabilities: UICapabilities;
-    }
-
-    // eslint-disable-next-line react/prefer-stateless-function
-    class MyClassComponent extends React.Component<ClassProps, {}> {
-      public render() {
-        return <span>{this.props.uiCapabilities.uiCapability2.nestedProp}</span>;
-      }
-    }
-
-    const WrappedComponent = injectUICapabilities(MyClassComponent);
-
-    const wrapper = mount(
-      <UICapabilitiesProvider>
-        <WrappedComponent />
-      </UICapabilitiesProvider>
-    );
-
-    expect(wrapper).toMatchInlineSnapshot(`
-<UICapabilitiesProvider>
-  <InjectUICapabilities(MyClassComponent)>
-    <MyClassComponent
-      uiCapabilities={
-        Object {
-          "uiCapability1": true,
-          "uiCapability2": Object {
-            "nestedProp": "nestedValue",
-          },
-        }
-      }
-    >
-      <span>
-        nestedValue
-      </span>
-    </MyClassComponent>
-  </InjectUICapabilities(MyClassComponent)>
-</UICapabilitiesProvider>
-`);
-  });
-});
diff --git a/src/legacy/ui/public/capabilities/react/inject_ui_capabilities.tsx b/src/legacy/ui/public/capabilities/react/inject_ui_capabilities.tsx
deleted file mode 100644
index 2841b99263b6f0..00000000000000
--- a/src/legacy/ui/public/capabilities/react/inject_ui_capabilities.tsx
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React, { Component, ComponentClass, ComponentType } from 'react';
-import { UICapabilitiesContext } from './ui_capabilities_context';
-import { UICapabilities } from '..';
-
-function getDisplayName(component: ComponentType<any>) {
-  return component.displayName || component.name || 'Component';
-}
-
-interface InjectedProps {
-  uiCapabilities: UICapabilities;
-}
-
-export function injectUICapabilities<P>(
-  WrappedComponent: ComponentType<P & InjectedProps>
-): ComponentClass<Pick<P, Exclude<keyof P, keyof InjectedProps>>> & {
-  WrappedComponent: ComponentType<P & InjectedProps>;
-} {
-  class InjectUICapabilities extends Component<P, any> {
-    public static displayName = `InjectUICapabilities(${getDisplayName(WrappedComponent)})`;
-
-    public static WrappedComponent: ComponentType<P & InjectedProps> = WrappedComponent;
-
-    public static contextType = UICapabilitiesContext;
-
-    constructor(props: any, context: any) {
-      super(props, context);
-    }
-
-    public render() {
-      return <WrappedComponent {...this.props} {...{ uiCapabilities: this.context }} />;
-    }
-  }
-  return InjectUICapabilities;
-}
diff --git a/src/legacy/ui/public/capabilities/react/legacy/index.ts b/src/legacy/ui/public/capabilities/react/legacy/index.ts
deleted file mode 100644
index 78d95a2603290a..00000000000000
--- a/src/legacy/ui/public/capabilities/react/legacy/index.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { UICapabilitiesProvider } from './ui_capabilities_provider';
-export { injectUICapabilities } from './inject_ui_capabilities';
diff --git a/src/legacy/ui/public/capabilities/react/legacy/inject_ui_capabilities.test.tsx b/src/legacy/ui/public/capabilities/react/legacy/inject_ui_capabilities.test.tsx
deleted file mode 100644
index dbc7cd03e27a3f..00000000000000
--- a/src/legacy/ui/public/capabilities/react/legacy/inject_ui_capabilities.test.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-jest.mock('ui/capabilities', () => ({
-  capabilities: {
-    get: () => ({
-      uiCapability1: true,
-      uiCapability2: {
-        nestedProp: 'nestedValue',
-      },
-    }),
-  },
-}));
-
-import { mount } from 'enzyme';
-import React from 'react';
-import { UICapabilities } from '../..';
-import { injectUICapabilities } from './inject_ui_capabilities';
-import { UICapabilitiesProvider } from './ui_capabilities_provider';
-
-describe('injectUICapabilities', () => {
-  it('provides UICapabilities to FCs', () => {
-    interface FCProps {
-      uiCapabilities: UICapabilities;
-    }
-
-    const MyFC = injectUICapabilities(({ uiCapabilities }: FCProps) => {
-      return <span>{uiCapabilities.uiCapability2.nestedProp}</span>;
-    });
-
-    const wrapper = mount(
-      <UICapabilitiesProvider>
-        <MyFC />
-      </UICapabilitiesProvider>
-    );
-
-    expect(wrapper).toMatchInlineSnapshot(`
-<UICapabilitiesProvider>
-  <InjectUICapabilities(Component)>
-    <Component
-      uiCapabilities={
-        Object {
-          "uiCapability1": true,
-          "uiCapability2": Object {
-            "nestedProp": "nestedValue",
-          },
-        }
-      }
-    >
-      <span>
-        nestedValue
-      </span>
-    </Component>
-  </InjectUICapabilities(Component)>
-</UICapabilitiesProvider>
-`);
-  });
-
-  it('provides UICapabilities to class components', () => {
-    interface ClassProps {
-      uiCapabilities: UICapabilities;
-    }
-
-    // eslint-disable-next-line react/prefer-stateless-function
-    class MyClassComponent extends React.Component<ClassProps, {}> {
-      public render() {
-        return <span>{this.props.uiCapabilities.uiCapability2.nestedProp}</span>;
-      }
-    }
-
-    const WrappedComponent = injectUICapabilities(MyClassComponent);
-
-    const wrapper = mount(
-      <UICapabilitiesProvider>
-        <WrappedComponent />
-      </UICapabilitiesProvider>
-    );
-
-    expect(wrapper).toMatchInlineSnapshot(`
-<UICapabilitiesProvider>
-  <InjectUICapabilities(MyClassComponent)>
-    <MyClassComponent
-      uiCapabilities={
-        Object {
-          "uiCapability1": true,
-          "uiCapability2": Object {
-            "nestedProp": "nestedValue",
-          },
-        }
-      }
-    >
-      <span>
-        nestedValue
-      </span>
-    </MyClassComponent>
-  </InjectUICapabilities(MyClassComponent)>
-</UICapabilitiesProvider>
-`);
-  });
-});
diff --git a/src/legacy/ui/public/capabilities/react/legacy/inject_ui_capabilities.tsx b/src/legacy/ui/public/capabilities/react/legacy/inject_ui_capabilities.tsx
deleted file mode 100644
index 0253326809721c..00000000000000
--- a/src/legacy/ui/public/capabilities/react/legacy/inject_ui_capabilities.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import PropTypes from 'prop-types';
-import React, { Component, ComponentClass, ComponentType } from 'react';
-import { UICapabilities } from '../..';
-
-function getDisplayName(component: ComponentType<any>) {
-  return component.displayName || component.name || 'Component';
-}
-
-interface InjectedProps {
-  uiCapabilities: UICapabilities;
-}
-
-export function injectUICapabilities<P>(
-  WrappedComponent: ComponentType<P & InjectedProps>
-): ComponentClass<Pick<P, Exclude<keyof P, keyof InjectedProps>>> & {
-  WrappedComponent: ComponentType<P & InjectedProps>;
-} {
-  class InjectUICapabilities extends Component<P, any> {
-    public static displayName = `InjectUICapabilities(${getDisplayName(WrappedComponent)})`;
-
-    public static WrappedComponent: ComponentType<P & InjectedProps> = WrappedComponent;
-
-    public static contextTypes = {
-      uiCapabilities: PropTypes.object.isRequired,
-    };
-
-    constructor(props: any, context: any) {
-      super(props, context);
-    }
-
-    public render() {
-      return (
-        <WrappedComponent {...this.props} {...{ uiCapabilities: this.context.uiCapabilities }} />
-      );
-    }
-  }
-  return InjectUICapabilities;
-}
diff --git a/src/legacy/ui/public/capabilities/react/legacy/ui_capabilities_provider.tsx b/src/legacy/ui/public/capabilities/react/legacy/ui_capabilities_provider.tsx
deleted file mode 100644
index 2e1f6add20d091..00000000000000
--- a/src/legacy/ui/public/capabilities/react/legacy/ui_capabilities_provider.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import PropTypes from 'prop-types';
-import React, { ReactNode } from 'react';
-import { capabilities, UICapabilities } from '../..';
-
-interface Props {
-  children: ReactNode;
-}
-
-interface ProviderContext {
-  uiCapabilities: UICapabilities;
-}
-
-export class UICapabilitiesProvider extends React.Component<Props, {}> {
-  public static displayName: string = 'UICapabilitiesProvider';
-
-  public static childContextTypes = {
-    uiCapabilities: PropTypes.object.isRequired,
-  };
-
-  public getChildContext(): ProviderContext {
-    return {
-      uiCapabilities: capabilities.get(),
-    };
-  }
-
-  public render() {
-    return React.Children.only(this.props.children);
-  }
-}
diff --git a/src/legacy/ui/public/capabilities/react/ui_capabilities_context.ts b/src/legacy/ui/public/capabilities/react/ui_capabilities_context.ts
deleted file mode 100644
index ed299662899bb5..00000000000000
--- a/src/legacy/ui/public/capabilities/react/ui_capabilities_context.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React from 'react';
-import { UICapabilities } from '..';
-
-export const UICapabilitiesContext = React.createContext<UICapabilities>({
-  navLinks: {},
-  catalogue: {},
-  management: {},
-});
diff --git a/src/legacy/ui/public/capabilities/react/ui_capabilities_provider.tsx b/src/legacy/ui/public/capabilities/react/ui_capabilities_provider.tsx
deleted file mode 100644
index 90da657cc93e05..00000000000000
--- a/src/legacy/ui/public/capabilities/react/ui_capabilities_provider.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React from 'react';
-import { UICapabilitiesContext } from './ui_capabilities_context';
-import { capabilities } from '..';
-
-export const UICapabilitiesProvider: React.FC = (props) => (
-  <UICapabilitiesContext.Provider value={capabilities.get()}>
-    {props.children}
-  </UICapabilitiesContext.Provider>
-);
-
-UICapabilitiesProvider.displayName = 'UICapabilitiesProvider';
diff --git a/src/legacy/ui/public/chrome/__mocks__/index.js b/src/legacy/ui/public/chrome/__mocks__/index.js
deleted file mode 100644
index cf977cd2c9f816..00000000000000
--- a/src/legacy/ui/public/chrome/__mocks__/index.js
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiSettingsServiceMock } from '../../../../../core/public/mocks';
-
-const uiSettingsClient = {
-  ...uiSettingsServiceMock.createSetupContract(),
-  getUpdate$: () => ({
-    subscribe: jest.fn(),
-  }),
-};
-
-const chrome = {
-  addBasePath: (path) => (path ? path : 'test/base/path'),
-  breadcrumbs: {
-    set: () => ({}),
-  },
-  getBasePath: () => '/test/base/path',
-  getInjected: jest.fn(),
-  getUiSettingsClient: () => uiSettingsClient,
-  getSavedObjectsClient: () => '',
-  getXsrfToken: () => 'kbn-xsrf-token',
-};
-
-// eslint-disable-next-line import/no-default-export
-export default chrome;
-
-// Copied from `src/legacy/ui/public/chrome/chrome.js`
-import _ from 'lodash';
-import angular from 'angular';
-import { metadata } from '../../metadata';
-
-const internals = _.defaults(_.cloneDeep(metadata), {
-  basePath: '',
-  rootController: null,
-  rootTemplate: null,
-  showAppsLink: null,
-  xsrfToken: null,
-  devMode: true,
-  brand: null,
-  nav: [],
-  applicationClasses: [],
-});
-
-const waitForBootstrap = new Promise((resolve) => {
-  chrome.bootstrap = function (targetDomElement) {
-    // sets attribute on body for stylesheet sandboxing
-    document.body.setAttribute('id', `${internals.app.id}-app`);
-
-    chrome.setupAngular();
-    targetDomElement.setAttribute('kbn-chrome', 'true');
-    targetDomElement.setAttribute('ng-class', "{ 'hidden-chrome': !chrome.getVisible() }");
-    targetDomElement.className = 'app-wrapper';
-    angular.bootstrap(targetDomElement, ['kibana']);
-    resolve(targetDomElement);
-  };
-});
-
-chrome.dangerouslyGetActiveInjector = () => {
-  return waitForBootstrap.then((targetDomElement) => {
-    const $injector = angular.element(targetDomElement).injector();
-    if (!$injector) {
-      return Promise.reject('targetDomElement had no angular context after bootstrapping');
-    }
-    return $injector;
-  });
-};
diff --git a/src/legacy/ui/public/chrome/api/__tests__/angular.js b/src/legacy/ui/public/chrome/api/__tests__/angular.js
deleted file mode 100644
index 797498a24265e7..00000000000000
--- a/src/legacy/ui/public/chrome/api/__tests__/angular.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { initAngularApi } from '../angular';
-import { noop } from 'lodash';
-
-describe('Chrome API :: Angular', () => {
-  describe('location helper methods', () => {
-    it('should return the sub app based on the url', () => {
-      const chrome = {
-        getInjected: noop,
-        addBasePath: noop,
-      };
-      initAngularApi(chrome, {
-        devMode: true,
-      });
-    });
-    it('should return breadcrumbs based on the url', () => {});
-  });
-});
diff --git a/src/legacy/ui/public/chrome/api/__tests__/apps.js b/src/legacy/ui/public/chrome/api/__tests__/apps.js
deleted file mode 100644
index 98da8db52bad17..00000000000000
--- a/src/legacy/ui/public/chrome/api/__tests__/apps.js
+++ /dev/null
@@ -1,121 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-
-import setup from '../apps';
-
-describe('Chrome API :: apps', function () {
-  describe('#get/setShowAppsLink()', function () {
-    describe('defaults to false if there are less than two apps', function () {
-      it('appCount = 0', function () {
-        const chrome = {};
-        setup(chrome, { nav: [] });
-        expect(chrome.getShowAppsLink()).to.equal(false);
-      });
-
-      it('appCount = 1', function () {
-        const chrome = {};
-        setup(chrome, { nav: [{ url: '/' }] });
-        expect(chrome.getShowAppsLink()).to.equal(false);
-      });
-    });
-
-    describe('defaults to true if there are two or more apps', function () {
-      it('appCount = 2', function () {
-        const chrome = {};
-        setup(chrome, { nav: [{ url: '/' }, { url: '/2' }] });
-        expect(chrome.getShowAppsLink()).to.equal(true);
-      });
-
-      it('appCount = 3', function () {
-        const chrome = {};
-        setup(chrome, { nav: [{ url: '/' }, { url: '/2' }, { url: '/3' }] });
-        expect(chrome.getShowAppsLink()).to.equal(true);
-      });
-    });
-
-    it('is chainable', function () {
-      const chrome = {};
-      setup(chrome, { nav: [{ url: '/' }] });
-      expect(chrome.setShowAppsLink(true)).to.equal(chrome);
-    });
-
-    it('can be changed', function () {
-      const chrome = {};
-      setup(chrome, { nav: [{ url: '/' }] });
-
-      expect(chrome.setShowAppsLink(true).getShowAppsLink()).to.equal(true);
-      expect(chrome.getShowAppsLink()).to.equal(true);
-
-      expect(chrome.setShowAppsLink(false).getShowAppsLink()).to.equal(false);
-      expect(chrome.getShowAppsLink()).to.equal(false);
-    });
-  });
-
-  describe('#getApp()', function () {
-    it('returns a clone of the current app', function () {
-      const chrome = {};
-      const app = { url: '/' };
-      setup(chrome, { app });
-
-      expect(chrome.getApp()).to.eql(app);
-      expect(chrome.getApp()).to.not.equal(app);
-    });
-
-    it('returns undefined if no active app', function () {
-      const chrome = {};
-      setup(chrome, {});
-      expect(chrome.getApp()).to.equal(undefined);
-    });
-  });
-
-  describe('#getAppTitle()', function () {
-    it('returns the title property of the current app', function () {
-      const chrome = {};
-      const app = { url: '/', title: 'foo' };
-      setup(chrome, { app });
-      expect(chrome.getAppTitle()).to.eql('foo');
-    });
-
-    it('returns undefined if no active app', function () {
-      const chrome = {};
-      setup(chrome, {});
-      expect(chrome.getAppTitle()).to.equal(undefined);
-    });
-  });
-
-  describe('#getAppUrl()', function () {
-    it('returns the resolved url of the current app', function () {
-      const chrome = {};
-      const app = { navLink: { url: '/foo' } };
-      setup(chrome, { app });
-
-      const a = document.createElement('a');
-      a.setAttribute('href', app.navLink.url);
-      expect(chrome.getAppUrl()).to.equal(a.href);
-    });
-
-    it('returns undefined if no active app', function () {
-      const chrome = {};
-      setup(chrome, {});
-      expect(chrome.getAppUrl()).to.equal(undefined);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/chrome/api/__tests__/nav.js b/src/legacy/ui/public/chrome/api/__tests__/nav.js
deleted file mode 100644
index accb56dd42aa3f..00000000000000
--- a/src/legacy/ui/public/chrome/api/__tests__/nav.js
+++ /dev/null
@@ -1,143 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-
-import { initChromeNavApi } from '../nav';
-import { StubBrowserStorage } from 'test_utils/stub_browser_storage';
-import { npStart } from 'ui/new_platform';
-import { absoluteToParsedUrl } from '../../../url/absolute_to_parsed_url';
-
-const basePath = '/someBasePath';
-
-function init(customInternals = { basePath }) {
-  const chrome = {
-    addBasePath: (path) => path,
-    getBasePath: () => customInternals.basePath || '',
-  };
-  const internals = {
-    nav: [],
-    ...customInternals,
-  };
-  initChromeNavApi(chrome, internals);
-  return { chrome, internals };
-}
-
-describe('chrome nav apis', function () {
-  let coreNavLinks;
-  let fakedLinks = [];
-
-  const baseUrl = (function () {
-    const a = document.createElement('a');
-    a.setAttribute('href', '/');
-    return a.href.slice(0, a.href.length - 1);
-  })();
-
-  beforeEach(() => {
-    coreNavLinks = npStart.core.chrome.navLinks;
-    sinon.stub(coreNavLinks, 'update').callsFake((linkId, updateAttrs) => {
-      const link = fakedLinks.find(({ id }) => id === linkId);
-      for (const key of Object.keys(updateAttrs)) {
-        link[key] = updateAttrs[key];
-      }
-      return link;
-    });
-    sinon.stub(coreNavLinks, 'getAll').callsFake(() => fakedLinks);
-    sinon
-      .stub(coreNavLinks, 'get')
-      .callsFake((linkId) => fakedLinks.find(({ id }) => id === linkId));
-  });
-
-  afterEach(() => {
-    coreNavLinks.update.restore();
-    coreNavLinks.getAll.restore();
-    coreNavLinks.get.restore();
-  });
-
-  describe('#untrackNavLinksForDeletedSavedObjects', function () {
-    const appId = 'appId';
-    const appUrl = `${baseUrl}/app/kibana#test`;
-    const deletedId = 'IAMDELETED';
-
-    it('should clear last url when last url contains link to deleted saved object', function () {
-      const appUrlStore = new StubBrowserStorage();
-      fakedLinks = [
-        {
-          id: appId,
-          title: 'Discover',
-          url: `${appUrl}?id=${deletedId}`,
-          baseUrl: appUrl,
-          linkToLastSubUrl: true,
-          legacy: true,
-        },
-      ];
-
-      const { chrome } = init({ appUrlStore });
-      chrome.untrackNavLinksForDeletedSavedObjects([deletedId]);
-      expect(coreNavLinks.update.calledWith(appId, { url: appUrl })).to.be(true);
-    });
-
-    it('should not clear last url when last url does not contains link to deleted saved object', function () {
-      const lastUrl = `${appUrl}?id=anotherSavedObjectId`;
-      const appUrlStore = new StubBrowserStorage();
-      fakedLinks = [
-        {
-          id: appId,
-          title: 'Discover',
-          url: lastUrl,
-          baseUrl: appUrl,
-          linkToLastSubUrl: true,
-          legacy: true,
-        },
-      ];
-
-      const { chrome } = init({ appUrlStore });
-      chrome.untrackNavLinksForDeletedSavedObjects([deletedId]);
-      expect(coreNavLinks.update.calledWith(appId, { url: appUrl })).to.be(false);
-    });
-  });
-
-  describe('chrome.trackSubUrlForApp()', function () {
-    it('injects a manual app url', function () {
-      const appUrlStore = new StubBrowserStorage();
-      fakedLinks = [
-        {
-          id: 'visualize',
-          baseUrl: `${baseUrl}/app/visualize#`,
-          url: `${baseUrl}/app/visualize#`,
-          subUrlBase: '/app/visualize#',
-          legacy: true,
-        },
-      ];
-
-      const { chrome } = init({ appUrlStore });
-      const kibanaParsedUrl = absoluteToParsedUrl(
-        `${baseUrl}/xyz/app/visualize#/1234?_g=globalstate`,
-        '/xyz'
-      );
-      chrome.trackSubUrlForApp('visualize', kibanaParsedUrl);
-      expect(
-        coreNavLinks.update.calledWith('visualize', {
-          url: `${baseUrl}/xyz/app/visualize#/1234?_g=globalstate`,
-        })
-      ).to.be(true);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/chrome/api/__tests__/sub_url_route_filter.js b/src/legacy/ui/public/chrome/api/__tests__/sub_url_route_filter.js
deleted file mode 100644
index 901fbd1d0edf69..00000000000000
--- a/src/legacy/ui/public/chrome/api/__tests__/sub_url_route_filter.js
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import ngMock from 'ng_mock';
-import expect from '@kbn/expect';
-
-import { SubUrlRouteFilterProvider } from '../sub_url_hooks';
-
-describe('kbn-chrome subUrlRouteFilter()', () => {
-  describe('no ngRoute', () => {
-    beforeEach(ngMock.module('kibana/private'));
-    beforeEach(
-      ngMock.inject(($injector) => {
-        expect($injector.has('$route')).to.be(false);
-      })
-    );
-
-    it(
-      'always returns true when there is no $route service',
-      ngMock.inject((Private) => {
-        const subUrlRouteFilter = Private(SubUrlRouteFilterProvider);
-        expect(subUrlRouteFilter()).to.be(true);
-      })
-    );
-  });
-
-  describe('with ngRoute', () => {
-    beforeEach(
-      ngMock.module('kibana/private', 'ngRoute', ($routeProvider) => {
-        $routeProvider.when('/foo', {
-          redirectTo: '/bar',
-        });
-
-        $routeProvider.when('/bar', {
-          template: '<div>foo => bar</div>',
-        });
-      })
-    );
-
-    let test;
-    beforeEach(
-      ngMock.inject((Private, $location, $rootScope, $route) => {
-        test = ({ path, assert }) => {
-          const subUrlRouteFilter = Private(SubUrlRouteFilterProvider);
-          $location.path(path);
-
-          let result;
-          function runAssert() {
-            if (result) {
-              // only run once
-              return;
-            }
-
-            try {
-              assert($route, subUrlRouteFilter);
-              result = {};
-            } catch (error) {
-              result = { error };
-            }
-          }
-
-          $rootScope.$on('$routeUpdate', runAssert);
-          $rootScope.$on('$routeChangeSuccess', runAssert);
-          $rootScope.$apply();
-
-          // when no route matches there is no event so we run manually
-          if (!result) {
-            runAssert();
-          }
-
-          if (result.error) {
-            throw result.error;
-          }
-        };
-      })
-    );
-
-    describe('no current route', () => {
-      it('returns false', () => {
-        test({
-          path: '/baz',
-          assert($route, subUrlRouteFilter) {
-            expect($route.current).to.not.be.ok();
-            expect(subUrlRouteFilter()).to.eql(false);
-          },
-        });
-      });
-    });
-
-    describe('redirectTo route', () => {
-      it('is called on target route', () => {
-        test({
-          path: '/foo',
-          assert($route) {
-            expect($route.current.$$route.originalPath).to.be('/bar');
-          },
-        });
-      });
-    });
-
-    describe('standard route', () => {
-      it('returns true', () => {
-        test({
-          path: '/bar',
-          assert($route, subUrlRouteFilter) {
-            expect($route.current).to.be.ok();
-            expect($route.current.template).to.be.ok();
-            expect(subUrlRouteFilter()).to.eql(true);
-          },
-        });
-      });
-    });
-  });
-});
diff --git a/src/legacy/ui/public/chrome/api/__tests__/xsrf.js b/src/legacy/ui/public/chrome/api/__tests__/xsrf.js
deleted file mode 100644
index 3197b79f407dad..00000000000000
--- a/src/legacy/ui/public/chrome/api/__tests__/xsrf.js
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-
-import { initChromeXsrfApi } from '../xsrf';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { version } from '../../../../../../core/server/utils/package_json';
-
-describe('chrome xsrf apis', function () {
-  const sandbox = sinon.createSandbox();
-
-  afterEach(function () {
-    sandbox.restore();
-  });
-
-  describe('#getXsrfToken()', function () {
-    it('exposes the token', function () {
-      const chrome = {};
-      initChromeXsrfApi(chrome, { version });
-      expect(chrome.getXsrfToken()).to.be(version);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/chrome/api/angular.js b/src/legacy/ui/public/chrome/api/angular.js
deleted file mode 100644
index a9113b2df2ed79..00000000000000
--- a/src/legacy/ui/public/chrome/api/angular.js
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiModules } from '../../modules';
-
-import { directivesProvider } from '../directives';
-import { registerSubUrlHooks } from './sub_url_hooks';
-import { configureAppAngularModule } from 'ui/legacy_compat';
-import { npStart } from '../../new_platform/new_platform';
-
-export function initAngularApi(chrome, internals) {
-  chrome.setupAngular = function () {
-    const kibana = uiModules.get('kibana');
-
-    configureAppAngularModule(kibana, npStart.core, false);
-
-    kibana.value('chrome', chrome);
-
-    registerSubUrlHooks(kibana, internals);
-    directivesProvider(chrome, internals);
-
-    uiModules.link(kibana);
-  };
-}
diff --git a/src/legacy/ui/public/chrome/api/apps.js b/src/legacy/ui/public/chrome/api/apps.js
deleted file mode 100644
index c4cbe7be6f1c38..00000000000000
--- a/src/legacy/ui/public/chrome/api/apps.js
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { clone, get } from 'lodash';
-import { resolve } from 'url';
-
-// eslint-disable-next-line import/no-default-export
-export default function (chrome, internals) {
-  if (get(internals, 'app.navLink.url')) {
-    internals.app.navLink.url = resolve(window.location.href, internals.app.navLink.url);
-  }
-
-  internals.appUrlStore = internals.appUrlStore || window.sessionStorage;
-  try {
-    const verifySessionStorage = 'verify sessionStorage';
-    internals.appUrlStore.setItem(verifySessionStorage, 1);
-    internals.appUrlStore.removeItem(verifySessionStorage);
-  } catch (error) {
-    throw new Error(
-      'Kibana requires access to sessionStorage, and it looks like ' +
-        "your browser is restricting it. If you're " +
-        'using Safari with private browsing enabled, you can solve this ' +
-        'problem by disabling private browsing, or by using another browser.'
-    );
-  }
-
-  /**
-   * ui/chrome apps API
-   *
-   *   ui/chrome has some metadata about the current app, and enables the
-   *   navbar link, a small grid to the left of the tabs, when there is more
-   *   than one app installed.
-   */
-
-  chrome.setShowAppsLink = function (val) {
-    internals.showAppsLink = !!val;
-    return chrome;
-  };
-
-  chrome.getShowAppsLink = function () {
-    return internals.showAppsLink == null ? internals.nav.length > 1 : internals.showAppsLink;
-  };
-
-  chrome.getKibanaVersion = function () {
-    return internals.version;
-  };
-
-  chrome.getApp = function () {
-    return clone(internals.app);
-  };
-
-  chrome.getAppTitle = function () {
-    return get(internals, ['app', 'title']);
-  };
-
-  chrome.getAppUrl = function () {
-    return get(internals, ['app', 'navLink', 'url']);
-  };
-
-  chrome.getLastUrlFor = function (appId) {
-    return internals.appUrlStore.getItem(`appLastUrl:${appId}`);
-  };
-
-  chrome.setLastUrlFor = function (appId, url) {
-    internals.appUrlStore.setItem(`appLastUrl:${appId}`, url);
-  };
-}
diff --git a/src/legacy/ui/public/chrome/api/badge.test.mocks.ts b/src/legacy/ui/public/chrome/api/badge.test.mocks.ts
deleted file mode 100644
index 9e78805272b2d0..00000000000000
--- a/src/legacy/ui/public/chrome/api/badge.test.mocks.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { chromeServiceMock } from '../../../../../core/public/mocks';
-
-export const newPlatformChrome = chromeServiceMock.createStartContract();
-jest.doMock('ui/new_platform', () => ({
-  npStart: {
-    core: { chrome: newPlatformChrome },
-  },
-}));
diff --git a/src/legacy/ui/public/chrome/api/badge.test.ts b/src/legacy/ui/public/chrome/api/badge.test.ts
deleted file mode 100644
index 6a19afb609f8ac..00000000000000
--- a/src/legacy/ui/public/chrome/api/badge.test.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import * as Rx from 'rxjs';
-
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { ChromeBadge } from 'src/core/public/chrome';
-import { newPlatformChrome } from './badge.test.mocks';
-import { initChromeBadgeApi } from './badge';
-
-function setup() {
-  const getBadge$ = new Rx.BehaviorSubject<ChromeBadge | undefined>(undefined);
-  newPlatformChrome.getBadge$.mockReturnValue(getBadge$);
-
-  const chrome: any = {};
-  initChromeBadgeApi(chrome);
-  return { chrome, getBadge$ };
-}
-
-afterEach(() => {
-  jest.resetAllMocks();
-});
-
-describe('badge', () => {
-  describe('#get$()', () => {
-    it('returns newPlatformChrome.getBadge$()', () => {
-      const { chrome } = setup();
-      expect(chrome.badge.get$()).toBe(newPlatformChrome.getBadge$());
-    });
-  });
-
-  describe('#set()', () => {
-    it('calls newPlatformChrome.setBadge', () => {
-      const { chrome } = setup();
-      const badge = {
-        text: 'foo',
-        tooltip: `foo's tooltip`,
-        iconType: 'alert',
-      };
-      chrome.badge.set(badge);
-      expect(newPlatformChrome.setBadge).toHaveBeenCalledTimes(1);
-      expect(newPlatformChrome.setBadge).toHaveBeenCalledWith(badge);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/chrome/api/badge.ts b/src/legacy/ui/public/chrome/api/badge.ts
deleted file mode 100644
index e607e6c47dc390..00000000000000
--- a/src/legacy/ui/public/chrome/api/badge.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Chrome } from 'ui/chrome';
-import { npStart } from 'ui/new_platform';
-import { ChromeBadge } from '../../../../../core/public';
-export type Badge = ChromeBadge;
-
-export type BadgeApi = ReturnType<typeof createBadgeApi>['badge'];
-
-const newPlatformChrome = npStart.core.chrome;
-
-function createBadgeApi() {
-  return {
-    badge: {
-      /**
-       * Get an observable that emits the current badge
-       * and emits each update to the badge
-       */
-      get$() {
-        return newPlatformChrome.getBadge$();
-      },
-
-      /**
-       * Replace the badge with a new one
-       */
-      set(newBadge?: Badge) {
-        newPlatformChrome.setBadge(newBadge);
-      },
-    },
-  };
-}
-
-export function initChromeBadgeApi(chrome: Chrome) {
-  const { badge } = createBadgeApi();
-  chrome.badge = badge;
-}
diff --git a/src/legacy/ui/public/chrome/api/base_path.test.mocks.ts b/src/legacy/ui/public/chrome/api/base_path.test.mocks.ts
deleted file mode 100644
index f2c5fd5734b10f..00000000000000
--- a/src/legacy/ui/public/chrome/api/base_path.test.mocks.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { httpServiceMock } from '../../../../../core/public/mocks';
-
-const newPlatformHttp = httpServiceMock.createSetupContract({ basePath: 'npBasePath' });
-jest.doMock('ui/new_platform', () => ({
-  npSetup: {
-    core: { http: newPlatformHttp },
-  },
-}));
diff --git a/src/legacy/ui/public/chrome/api/base_path.test.ts b/src/legacy/ui/public/chrome/api/base_path.test.ts
deleted file mode 100644
index d3cfc6a3168a83..00000000000000
--- a/src/legacy/ui/public/chrome/api/base_path.test.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import './base_path.test.mocks';
-import { initChromeBasePathApi } from './base_path';
-
-function initChrome() {
-  const chrome: any = {};
-  initChromeBasePathApi(chrome);
-  return chrome;
-}
-
-beforeEach(() => {
-  jest.clearAllMocks();
-});
-
-describe('#getBasePath()', () => {
-  it('proxies to newPlatformHttp.basePath.get()', () => {
-    const chrome = initChrome();
-    expect(chrome.getBasePath()).toBe('npBasePath');
-  });
-});
-
-describe('#addBasePath()', () => {
-  it('proxies to newPlatformHttp.basePath.prepend(path)', () => {
-    const chrome = initChrome();
-    expect(chrome.addBasePath('/foo/bar')).toBe('npBasePath/foo/bar');
-  });
-});
-
-describe('#removeBasePath', () => {
-  it('proxies to newPlatformBasePath.basePath.remove(path)', () => {
-    const chrome = initChrome();
-    expect(chrome.removeBasePath('npBasePath/foo/bar')).toBe('/foo/bar');
-  });
-});
diff --git a/src/legacy/ui/public/chrome/api/base_path.ts b/src/legacy/ui/public/chrome/api/base_path.ts
deleted file mode 100644
index da823425b7c226..00000000000000
--- a/src/legacy/ui/public/chrome/api/base_path.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { npSetup } from 'ui/new_platform';
-
-const newPlatformHttp = npSetup.core.http;
-
-export function initChromeBasePathApi(chrome: { [key: string]: any }) {
-  chrome.getBasePath = newPlatformHttp.basePath.get;
-  chrome.addBasePath = newPlatformHttp.basePath.prepend;
-  chrome.removeBasePath = newPlatformHttp.basePath.remove;
-}
diff --git a/src/legacy/ui/public/chrome/api/breadcrumbs.ts b/src/legacy/ui/public/chrome/api/breadcrumbs.ts
deleted file mode 100644
index df1b7e1736bb42..00000000000000
--- a/src/legacy/ui/public/chrome/api/breadcrumbs.ts
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { npStart } from 'ui/new_platform';
-import { ChromeBreadcrumb } from '../../../../../core/public';
-export type Breadcrumb = ChromeBreadcrumb;
-
-export type BreadcrumbsApi = ReturnType<typeof createBreadcrumbsApi>['breadcrumbs'];
-
-const newPlatformChrome = npStart.core.chrome;
-
-function createBreadcrumbsApi(chrome: { [key: string]: any }) {
-  let currentBreadcrumbs: Breadcrumb[] = [];
-
-  // reset breadcrumbSetSinceRouteChange any time the breadcrumbs change, even
-  // if it was done directly through the new platform
-  newPlatformChrome.getBreadcrumbs$().subscribe({
-    next(nextBreadcrumbs) {
-      currentBreadcrumbs = nextBreadcrumbs;
-    },
-  });
-
-  return {
-    breadcrumbs: {
-      /**
-       * Get an observerable that emits the current list of breadcrumbs
-       * and emits each update to the breadcrumbs
-       */
-      get$() {
-        return newPlatformChrome.getBreadcrumbs$();
-      },
-
-      /**
-       * Replace the set of breadcrumbs with a new set
-       */
-      set(newBreadcrumbs: Breadcrumb[]) {
-        newPlatformChrome.setBreadcrumbs(newBreadcrumbs);
-      },
-
-      /**
-       * Add a breadcrumb to the end of the list of breadcrumbs
-       */
-      push(breadcrumb: Breadcrumb) {
-        newPlatformChrome.setBreadcrumbs([...currentBreadcrumbs, breadcrumb]);
-      },
-
-      /**
-       * Filter the current set of breadcrumbs with a function. Works like Array#filter()
-       */
-      filter(fn: (breadcrumb: Breadcrumb, i: number, all: Breadcrumb[]) => boolean) {
-        newPlatformChrome.setBreadcrumbs(currentBreadcrumbs.filter(fn));
-      },
-
-      /**
-       * Remove last element of the breadcrumb
-       */
-      pop() {
-        newPlatformChrome.setBreadcrumbs(currentBreadcrumbs.slice(0, -1));
-      },
-    },
-  };
-}
-
-export function initBreadcrumbsApi(
-  chrome: { [key: string]: any },
-  internals: { [key: string]: any }
-) {
-  const { breadcrumbs } = createBreadcrumbsApi(chrome);
-  chrome.breadcrumbs = breadcrumbs;
-}
diff --git a/src/legacy/ui/public/chrome/api/controls.test.mocks.ts b/src/legacy/ui/public/chrome/api/controls.test.mocks.ts
deleted file mode 100644
index 9e78805272b2d0..00000000000000
--- a/src/legacy/ui/public/chrome/api/controls.test.mocks.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { chromeServiceMock } from '../../../../../core/public/mocks';
-
-export const newPlatformChrome = chromeServiceMock.createStartContract();
-jest.doMock('ui/new_platform', () => ({
-  npStart: {
-    core: { chrome: newPlatformChrome },
-  },
-}));
diff --git a/src/legacy/ui/public/chrome/api/controls.test.ts b/src/legacy/ui/public/chrome/api/controls.test.ts
deleted file mode 100644
index f41f2041993a3a..00000000000000
--- a/src/legacy/ui/public/chrome/api/controls.test.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import * as Rx from 'rxjs';
-
-import { newPlatformChrome } from './controls.test.mocks';
-import { initChromeControlsApi } from './controls';
-
-function setup() {
-  const isVisible$ = new Rx.BehaviorSubject(true);
-  newPlatformChrome.getIsVisible$.mockReturnValue(isVisible$);
-
-  const chrome: any = {};
-  initChromeControlsApi(chrome);
-  return { chrome, isVisible$ };
-}
-
-afterEach(() => {
-  jest.resetAllMocks();
-});
-
-describe('setVisible', () => {
-  it('passes the visibility to the newPlatform', () => {
-    const { chrome } = setup();
-    chrome.setVisible(true);
-    chrome.setVisible(false);
-    chrome.setVisible(false);
-    expect(newPlatformChrome.setIsVisible.mock.calls).toMatchInlineSnapshot(`
-Array [
-  Array [
-    true,
-  ],
-  Array [
-    false,
-  ],
-  Array [
-    false,
-  ],
-]
-`);
-  });
-});
-
-describe('getVisible', () => {
-  it('returns a the cached value emitted by the newPlatformChrome', () => {
-    const { chrome, isVisible$ } = setup();
-    isVisible$.next(true);
-    expect(chrome.getVisible()).toBe(true);
-    isVisible$.next(false);
-    expect(chrome.getVisible()).toBe(false);
-  });
-});
diff --git a/src/legacy/ui/public/chrome/api/controls.ts b/src/legacy/ui/public/chrome/api/controls.ts
deleted file mode 100644
index a95d53ec2eab69..00000000000000
--- a/src/legacy/ui/public/chrome/api/controls.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import * as Rx from 'rxjs';
-import { npStart } from 'ui/new_platform';
-
-const newPlatformChrome = npStart.core.chrome;
-
-export function initChromeControlsApi(chrome: { [key: string]: any }) {
-  // cache of chrome visibility state
-  const visible$ = new Rx.BehaviorSubject(false);
-  newPlatformChrome.getIsVisible$().subscribe(visible$);
-
-  /**
-   * Set the temporary visibility for the chrome. This does nothing if the chrome is hidden
-   * by default and should be used to hide the chrome for things like full-screen modes
-   * with an exit button.
-   */
-  chrome.setVisible = (visibility: boolean) => {
-    newPlatformChrome.setIsVisible(visibility);
-    return chrome;
-  };
-
-  /**
-   * Get the current visibility state of the chrome. Note that this drives the UI so it
-   * might be incorrect in the moments just before the UI is updated.
-   */
-  chrome.getVisible = () => visible$.getValue();
-
-  chrome.visible$ = visible$.asObservable();
-}
diff --git a/src/legacy/ui/public/chrome/api/help_extension.ts b/src/legacy/ui/public/chrome/api/help_extension.ts
deleted file mode 100644
index b59f27e37512c7..00000000000000
--- a/src/legacy/ui/public/chrome/api/help_extension.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { npStart } from 'ui/new_platform';
-import { ChromeHelpExtension } from '../../../../../core/public';
-
-const newPlatformChrome = npStart.core.chrome;
-
-export type HelpExtensionApi = ReturnType<typeof createHelpExtensionApi>['helpExtension'];
-export type HelpExtension = ChromeHelpExtension;
-
-function createHelpExtensionApi() {
-  return {
-    helpExtension: {
-      /**
-       * Set the custom help extension, or clear it by passing undefined. This
-       * will be rendered within the help popover in the header
-       */
-      set: (helpExtension: HelpExtension | undefined) => {
-        newPlatformChrome.setHelpExtension(helpExtension);
-      },
-
-      /**
-       * Get the current help extension that should be rendered in the header
-       */
-      get$: () => newPlatformChrome.getHelpExtension$(),
-    },
-  };
-}
-
-export function initHelpExtensionApi(
-  chrome: { [key: string]: any },
-  internal: { [key: string]: any }
-) {
-  const { helpExtension } = createHelpExtensionApi();
-  chrome.helpExtension = helpExtension;
-}
diff --git a/src/legacy/ui/public/chrome/api/injected_vars.test.mocks.ts b/src/legacy/ui/public/chrome/api/injected_vars.test.mocks.ts
deleted file mode 100644
index 3ad713ccce9a44..00000000000000
--- a/src/legacy/ui/public/chrome/api/injected_vars.test.mocks.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export const newPlatformInjectedMetadata: any = {
-  getInjectedVars: jest.fn(),
-  getInjectedVar: jest.fn(),
-};
-jest.doMock('ui/new_platform', () => ({
-  npSetup: {
-    core: { injectedMetadata: newPlatformInjectedMetadata },
-  },
-}));
diff --git a/src/legacy/ui/public/chrome/api/injected_vars.test.ts b/src/legacy/ui/public/chrome/api/injected_vars.test.ts
deleted file mode 100644
index 2147aed06320ef..00000000000000
--- a/src/legacy/ui/public/chrome/api/injected_vars.test.ts
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { newPlatformInjectedMetadata } from './injected_vars.test.mocks';
-import { initChromeInjectedVarsApi } from './injected_vars';
-
-function initChrome() {
-  const chrome: any = {};
-  initChromeInjectedVarsApi(chrome);
-  return chrome;
-}
-
-beforeEach(() => {
-  jest.resetAllMocks();
-});
-
-describe('#getInjected()', () => {
-  it('proxies to newPlatformInjectedMetadata service', () => {
-    const chrome = initChrome();
-
-    chrome.getInjected();
-    chrome.getInjected('foo');
-    chrome.getInjected('foo', 'bar');
-    expect(newPlatformInjectedMetadata.getInjectedVars.mock.calls).toMatchInlineSnapshot(`
-Array [
-  Array [],
-]
-`);
-    expect(newPlatformInjectedMetadata.getInjectedVar.mock.calls).toMatchInlineSnapshot(`
-Array [
-  Array [
-    "foo",
-    undefined,
-  ],
-  Array [
-    "foo",
-    "bar",
-  ],
-]
-`);
-  });
-
-  it('returns mutable values, but does not persist changes internally', () => {
-    const chrome = initChrome();
-
-    newPlatformInjectedMetadata.getInjectedVars.mockReturnValue(
-      Object.freeze({
-        foo: Object.freeze({
-          bar: Object.freeze({
-            baz: 1,
-          }),
-        }),
-      })
-    );
-
-    const vars = chrome.getInjected();
-    expect(() => {
-      vars.newProperty = true;
-    }).not.toThrowError();
-    expect(chrome.getInjected()).not.toHaveProperty('newProperty');
-  });
-});
diff --git a/src/legacy/ui/public/chrome/api/injected_vars.ts b/src/legacy/ui/public/chrome/api/injected_vars.ts
deleted file mode 100644
index a827c1bf65f514..00000000000000
--- a/src/legacy/ui/public/chrome/api/injected_vars.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { cloneDeep } from 'lodash';
-import { npSetup } from 'ui/new_platform';
-
-const newPlatformInjectedVars = npSetup.core.injectedMetadata;
-
-export function initChromeInjectedVarsApi(chrome: { [key: string]: any }) {
-  chrome.getInjected = (name?: string, defaultValue?: any) =>
-    cloneDeep(
-      name
-        ? newPlatformInjectedVars.getInjectedVar(name, defaultValue)
-        : newPlatformInjectedVars.getInjectedVars()
-    );
-}
diff --git a/src/legacy/ui/public/chrome/api/loading_count.js b/src/legacy/ui/public/chrome/api/loading_count.js
deleted file mode 100644
index 71d1e354773d5b..00000000000000
--- a/src/legacy/ui/public/chrome/api/loading_count.js
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import * as Rx from 'rxjs';
-import { npSetup } from 'ui/new_platform';
-
-const newPlatformHttp = npSetup.core.http;
-
-export function initLoadingCountApi(chrome) {
-  const manualCount$ = new Rx.BehaviorSubject(0);
-  newPlatformHttp.addLoadingCountSource(manualCount$);
-
-  chrome.loadingCount = new (class ChromeLoadingCountApi {
-    /**
-     * Call to add a subscriber to for the loading count that
-     * will be called every time the loading count changes.
-     *
-     * @type {Observable<number>}
-     * @return {Function} unsubscribe
-     */
-    subscribe(handler) {
-      const subscription = newPlatformHttp.getLoadingCount$().subscribe({
-        next(count) {
-          handler(count);
-        },
-      });
-
-      return () => {
-        subscription.unsubscribe();
-      };
-    }
-
-    /**
-     * Increment the loading count by one
-     * @return {undefined}
-     */
-    increment() {
-      manualCount$.next(manualCount$.getValue() + 1);
-    }
-
-    /**
-     * Decrement the loading count by one
-     * @return {undefined}
-     */
-    decrement() {
-      manualCount$.next(manualCount$.getValue() - 1);
-    }
-  })();
-}
diff --git a/src/legacy/ui/public/chrome/api/nav.ts b/src/legacy/ui/public/chrome/api/nav.ts
deleted file mode 100644
index 2b655419d98aa2..00000000000000
--- a/src/legacy/ui/public/chrome/api/nav.ts
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { KibanaParsedUrl } from 'ui/url/kibana_parsed_url';
-import { absoluteToParsedUrl } from '../../url/absolute_to_parsed_url';
-import { npStart } from '../../new_platform';
-import { ChromeNavLink } from '../../../../../core/public';
-import { relativeToAbsolute } from '../../url/relative_to_absolute';
-
-export interface ChromeNavLinks {
-  untrackNavLinksForDeletedSavedObjects(deletedIds: string[]): void;
-  trackSubUrlForApp(linkId: string, parsedKibanaUrl: KibanaParsedUrl): void;
-}
-
-interface NavInternals {
-  appUrlStore: Storage;
-  trackPossibleSubUrl(url: string): void;
-}
-
-export function initChromeNavApi(chrome: any, internals: NavInternals) {
-  const coreNavLinks = npStart.core.chrome.navLinks;
-
-  /**
-   * Clear last url for deleted saved objects to avoid loading pages with "Could not locate..."
-   */
-  chrome.untrackNavLinksForDeletedSavedObjects = (deletedIds: string[]) => {
-    function urlContainsDeletedId(url: string) {
-      const includedId = deletedIds.find((deletedId) => {
-        return url.includes(deletedId);
-      });
-      return includedId !== undefined;
-    }
-
-    coreNavLinks.getAll().forEach((link) => {
-      if (link.linkToLastSubUrl && urlContainsDeletedId(link.url!)) {
-        setLastUrl(link, link.baseUrl);
-      }
-    });
-  };
-
-  /**
-   * Manually sets the last url for the given app. The last url for a given app is updated automatically during
-   * normal page navigation, so this should only need to be called to insert a last url that was not actually
-   * navigated to. For instance, when saving an object and redirecting to another page, the last url of the app
-   * should be the saved instance, but because of the redirect to a different page (e.g. `Save and Add to Dashboard`
-   * on visualize tab), it won't be tracked automatically and will need to be inserted manually. See
-   * https://github.com/elastic/kibana/pull/11932 for more background on why this was added.
-   *
-   * @param id {String} - an id that represents the navigation link.
-   * @param kibanaParsedUrl {KibanaParsedUrl} the url to track
-   */
-  chrome.trackSubUrlForApp = (id: string, kibanaParsedUrl: KibanaParsedUrl) => {
-    const navLink = coreNavLinks.get(id);
-    if (navLink) {
-      setLastUrl(navLink, kibanaParsedUrl.getAbsoluteUrl());
-    }
-  };
-
-  internals.trackPossibleSubUrl = async function (url: string) {
-    const kibanaParsedUrl = absoluteToParsedUrl(url, chrome.getBasePath());
-
-    coreNavLinks
-      .getAll()
-      // Filter only legacy links
-      .filter((link) => link.legacy && !link.disableSubUrlTracking)
-      .forEach((link) => {
-        const active = url.startsWith(link.subUrlBase!);
-        link = coreNavLinks.update(link.id, { active })!;
-
-        if (active) {
-          setLastUrl(link, url);
-          return;
-        }
-
-        link = refreshLastUrl(link);
-
-        const newGlobalState = kibanaParsedUrl.getGlobalState();
-        if (newGlobalState) {
-          injectNewGlobalState(link, kibanaParsedUrl.appId, newGlobalState);
-        }
-      });
-  };
-
-  function lastSubUrlKey(link: ChromeNavLink) {
-    return `lastSubUrl:${link.baseUrl}`;
-  }
-
-  function getLastUrl(link: ChromeNavLink) {
-    return internals.appUrlStore.getItem(lastSubUrlKey(link));
-  }
-
-  function setLastUrl(link: ChromeNavLink, url: string) {
-    if (link.linkToLastSubUrl === false) {
-      return;
-    }
-
-    internals.appUrlStore.setItem(lastSubUrlKey(link), url);
-    refreshLastUrl(link);
-  }
-
-  function refreshLastUrl(link: ChromeNavLink) {
-    const lastSubUrl = getLastUrl(link);
-
-    return coreNavLinks.update(link.id, {
-      url: lastSubUrl || link.url || link.baseUrl,
-    })!;
-  }
-
-  function injectNewGlobalState(
-    link: ChromeNavLink,
-    fromAppId: string,
-    newGlobalState: string | string[]
-  ) {
-    const kibanaParsedUrl = absoluteToParsedUrl(
-      getLastUrl(link) || link.url || link.baseUrl,
-      chrome.getBasePath()
-    );
-
-    // don't copy global state if links are for different apps
-    if (fromAppId !== kibanaParsedUrl.appId) return;
-
-    kibanaParsedUrl.setGlobalState(newGlobalState);
-
-    coreNavLinks.update(link.id, {
-      url: kibanaParsedUrl.getAbsoluteUrl(),
-    });
-  }
-
-  // simulate a possible change in url to initialize the
-  // link.active and link.lastUrl properties
-  coreNavLinks
-    .getAll()
-    .filter((link) => link.subUrlBase && !link.disableSubUrlTracking)
-    .forEach((link) => {
-      coreNavLinks.update(link.id, {
-        subUrlBase: relativeToAbsolute(chrome.addBasePath(link.subUrlBase)),
-      });
-    });
-
-  internals.trackPossibleSubUrl(document.location.href);
-}
diff --git a/src/legacy/ui/public/chrome/api/saved_object_client.ts b/src/legacy/ui/public/chrome/api/saved_object_client.ts
deleted file mode 100644
index 76d4e301e3c773..00000000000000
--- a/src/legacy/ui/public/chrome/api/saved_object_client.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { npStart } from 'ui/new_platform';
-import { Chrome } from '..';
-
-const savedObjectsClient = npStart.core.savedObjects.client;
-
-export function initSavedObjectClient(chrome: Chrome) {
-  chrome.getSavedObjectsClient = function () {
-    return savedObjectsClient;
-  };
-}
diff --git a/src/legacy/ui/public/chrome/api/sub_url_hooks.js b/src/legacy/ui/public/chrome/api/sub_url_hooks.js
deleted file mode 100644
index f147aef7b4b7d2..00000000000000
--- a/src/legacy/ui/public/chrome/api/sub_url_hooks.js
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { unhashUrl } from '../../../../../plugins/kibana_utils/public';
-import { toastNotifications } from '../../notify/toasts';
-import { npSetup } from '../../new_platform';
-import { areHashesDifferentButDecodedHashesEquals } from './sub_url_hooks_utils';
-
-export function registerSubUrlHooks(angularModule, internals) {
-  angularModule.run(($rootScope, Private, $location) => {
-    const subUrlRouteFilter = Private(SubUrlRouteFilterProvider);
-
-    function updateSubUrls() {
-      const urlWithHashes = window.location.href;
-      let urlWithStates;
-      try {
-        urlWithStates = unhashUrl(urlWithHashes);
-      } catch (e) {
-        toastNotifications.addDanger(e.message);
-      }
-
-      internals.trackPossibleSubUrl(urlWithStates || urlWithHashes);
-    }
-
-    function onRouteChange($event) {
-      if (subUrlRouteFilter($event)) {
-        updateUsage($event);
-        updateSubUrls();
-      }
-    }
-
-    $rootScope.$on('$locationChangeStart', (e, newUrl) => {
-      // This handler fixes issue #31238 where browser back navigation
-      // fails due to angular 1.6 parsing url encoded params wrong.
-      if (areHashesDifferentButDecodedHashesEquals($location.absUrl(), newUrl)) {
-        // replace the urlencoded hash with the version that angular sees.
-        const newHash = newUrl.split('#')[1] || '';
-        $location.url(newHash).replace();
-      }
-    });
-
-    $rootScope.$on('$routeChangeSuccess', onRouteChange);
-    $rootScope.$on('$routeUpdate', onRouteChange);
-    updateSubUrls();
-  });
-}
-
-function updateUsage($event) {
-  const scope = $event.targetScope;
-  const app = scope.chrome.getApp();
-  const appId = app.id === 'kibana' ? scope.getFirstPathSegment() : app.id;
-  if (npSetup.plugins.usageCollection) npSetup.plugins.usageCollection.__LEGACY.appChanged(appId);
-}
-
-/**
- *  Creates a function that will be called on each route change
- *  to determine if the event should be used to update the last
- *  subUrl of chrome links/tabs
- *  @injected
- */
-export function SubUrlRouteFilterProvider($injector) {
-  if (!$injector.has('$route')) {
-    return function alwaysUpdate() {
-      return true;
-    };
-  }
-
-  const $route = $injector.get('$route');
-  return function ignoreRedirectToRoutes() {
-    return Boolean($route.current && !$route.current.redirectTo);
-  };
-}
diff --git a/src/legacy/ui/public/chrome/api/sub_url_hooks_utils.test.ts b/src/legacy/ui/public/chrome/api/sub_url_hooks_utils.test.ts
deleted file mode 100644
index 4dec5263023447..00000000000000
--- a/src/legacy/ui/public/chrome/api/sub_url_hooks_utils.test.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { areHashesDifferentButDecodedHashesEquals } from './sub_url_hooks_utils';
-
-test('false for different hashes', () => {
-  const url1 = `https://localhost/kibana/#/dashboard/id`;
-  const url2 = `https://localhost/kibana/#/dashboard/DIFFERENT`;
-  expect(areHashesDifferentButDecodedHashesEquals(url1, url2)).toBeFalsy();
-});
-
-test('false for same hashes', () => {
-  const hash = `/dashboard/id?_a=(filters:!(),query:(language:kuery,query:''))&_g=(filters:!(),time:(from:now-120m,to:now))`;
-  const url1 = `https://localhost/kibana/#/${hash}`;
-  expect(areHashesDifferentButDecodedHashesEquals(url1, url1)).toBeFalsy();
-});
-
-test('true for same hashes, but one is encoded', () => {
-  const hash = `/dashboard/id?_a=(filters:!(),query:(language:kuery,query:''))&_g=(filters:!(),time:(from:now-120m,to:now))`;
-  const url1 = `https://localhost/kibana/#/${hash}`;
-  const url2 = `https://localhost/kibana/#/${encodeURIComponent(hash)}`;
-  expect(areHashesDifferentButDecodedHashesEquals(url1, url2)).toBeTruthy();
-});
-
-/**
- * This edge case occurs when trying to navigate within kibana app using core's `navigateToApp` api
- * and there is reserved characters in hash (see: query:'' part)
- * For example:
- * ```ts
- * navigateToApp('kibana', {
- *    path: '#/dashboard/f8bc19f0-6918-11ea-9258-a74c2ded064d?_a=(filters:!(),query:(language:kuery,query:''))&_g=(filters:!(),time:(from:now-120m,to:now))'
- *  })
- * ```
- * Core internally is using url.parse which parses ' -> %27 and performs the navigation
- * Then angular decodes it back and causes redundant history record if not the fix which is covered by the test below
- */
-test("true for same hashes, but one has reserved character (') encoded", () => {
-  const hash = `/dashboard/id?_a=(filters:!(),query:(language:kuery,query:''))&_g=(filters:!(),time:(from:now-120m,to:now))`;
-  const url1 = `https://localhost/kibana/#/${hash}`;
-  const url2 = `https://localhost/kibana/#/${hash.replace(/\'/g, '%27')}`;
-  expect(areHashesDifferentButDecodedHashesEquals(url1, url2)).toBeTruthy();
-});
diff --git a/src/legacy/ui/public/chrome/api/sub_url_hooks_utils.ts b/src/legacy/ui/public/chrome/api/sub_url_hooks_utils.ts
deleted file mode 100644
index 8517877acd3877..00000000000000
--- a/src/legacy/ui/public/chrome/api/sub_url_hooks_utils.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export function areHashesDifferentButDecodedHashesEquals(urlA: string, urlB: string): boolean {
-  const getHash = (url: string) => url.split('#')[1] ?? '';
-  const hashA = getHash(urlA);
-  const decodedHashA = decodeURIComponent(hashA);
-
-  const hashB = getHash(urlB);
-  const decodedHashB = decodeURIComponent(hashB);
-
-  return hashA !== hashB && decodedHashA === decodedHashB;
-}
diff --git a/src/legacy/ui/public/chrome/api/template.js b/src/legacy/ui/public/chrome/api/template.js
deleted file mode 100644
index d29a7eba7316f2..00000000000000
--- a/src/legacy/ui/public/chrome/api/template.js
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-// eslint-disable-next-line import/no-default-export
-export default function (chrome, internals) {
-  /**
-   * ui/chrome Template API
-   *
-   *   Root Template
-   *     The root template is rendered within the primary chrome ui and should
-   *     be used when building an app that is more of a page, or to override the
-   *     placement of ng-view. When including a root template, the mark-up will
-   *     look something like this:
-   *
-   *     body
-   *       notifs
-   *       div.content
-   *         nav
-   *         config
-   *         div.application
-   *           <-- your template here -->
-   *
-   *   Root Controller
-   *     To attach a controller to the root of ui/chrome's content area, outside of
-   *     where it attaches the ng-view directive (assuming no rootTemplate is used)
-   *     which will allow cause the controller to persist across views or make for
-   *     a simple place to define some quick global functionality for a very simple
-   *     app (like the status page).
-   */
-
-  /**
-   * @param {string} template
-   * @return {chrome}
-   */
-  chrome.setRootTemplate = function (template) {
-    internals.rootTemplate = template;
-    return chrome;
-  };
-
-  /**
-   * @param {string} as - the name that the controller should bind to
-   * @param {Function} controller - the controller initializer function
-   * @return {chrome}
-   */
-  chrome.setRootController = function (as, controllerName) {
-    if (controllerName === undefined) {
-      controllerName = as;
-      as = null;
-    }
-
-    if (typeof controllerName === 'function') {
-      chrome.$$rootControllerConstruct = controllerName;
-      controllerName = 'chrome.$$rootControllerConstruct';
-    }
-
-    internals.rootController = controllerName + (as ? ' as ' + as : '');
-    return chrome;
-  };
-}
diff --git a/src/legacy/ui/public/chrome/api/theme.test.mocks.ts b/src/legacy/ui/public/chrome/api/theme.test.mocks.ts
deleted file mode 100644
index 9e78805272b2d0..00000000000000
--- a/src/legacy/ui/public/chrome/api/theme.test.mocks.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { chromeServiceMock } from '../../../../../core/public/mocks';
-
-export const newPlatformChrome = chromeServiceMock.createStartContract();
-jest.doMock('ui/new_platform', () => ({
-  npStart: {
-    core: { chrome: newPlatformChrome },
-  },
-}));
diff --git a/src/legacy/ui/public/chrome/api/theme.test.ts b/src/legacy/ui/public/chrome/api/theme.test.ts
deleted file mode 100644
index 1e829329f96803..00000000000000
--- a/src/legacy/ui/public/chrome/api/theme.test.ts
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import * as Rx from 'rxjs';
-
-import { newPlatformChrome } from './theme.test.mocks';
-import { initChromeThemeApi } from './theme';
-
-function setup() {
-  const brand$ = new Rx.BehaviorSubject({ logo: 'foo', smallLogo: 'foo' });
-  newPlatformChrome.getBrand$.mockReturnValue(brand$);
-
-  const applicationClasses$ = new Rx.BehaviorSubject([] as string[]);
-  newPlatformChrome.getApplicationClasses$.mockReturnValue(applicationClasses$);
-
-  const chrome: any = {};
-  initChromeThemeApi(chrome);
-  return { chrome, brand$, applicationClasses$ };
-}
-
-afterEach(() => {
-  jest.resetAllMocks();
-});
-
-describe('setBrand', () => {
-  it('proxies to newPlatformChrome', () => {
-    const { chrome } = setup();
-
-    chrome.setBrand({
-      logo: 'foo.svg',
-      smallLogo: 'smallFoo.svg',
-    });
-
-    chrome.setBrand({
-      logo: 'baz',
-    });
-
-    expect(newPlatformChrome.setBrand.mock.calls).toMatchInlineSnapshot(`
-Array [
-  Array [
-    Object {
-      "logo": "foo.svg",
-      "smallLogo": "smallFoo.svg",
-    },
-  ],
-  Array [
-    Object {
-      "logo": "baz",
-    },
-  ],
-]
-`);
-  });
-});
-
-describe('getBrand', () => {
-  it('returns named properties from cached values emitted from newPlatformChrome', () => {
-    const { chrome, brand$ } = setup();
-    expect(chrome.getBrand('logo')).toBe('foo');
-    expect(chrome.getBrand('smallLogo')).toBe('foo');
-    expect(chrome.getBrand()).toBe(undefined);
-
-    brand$.next({
-      logo: 'bar.svg',
-      smallLogo: 'smallBar.svg',
-    });
-
-    expect(chrome.getBrand('logo')).toBe('bar.svg');
-    expect(chrome.getBrand('smallLogo')).toBe('smallBar.svg');
-    expect(chrome.getBrand()).toBe(undefined);
-  });
-});
-
-describe('addApplicationClass', () => {
-  it('proxies each class as a separate argument to newPlatformChrome', () => {
-    const { chrome } = setup();
-    chrome.addApplicationClass('foo');
-    chrome.addApplicationClass(['bar', 'baz']);
-    chrome.addApplicationClass([]);
-    expect(newPlatformChrome.addApplicationClass.mock.calls).toMatchInlineSnapshot(`
-Array [
-  Array [
-    "foo",
-  ],
-  Array [
-    "bar",
-  ],
-  Array [
-    "baz",
-  ],
-]
-`);
-  });
-});
-
-describe('removeApplicationClass', () => {
-  it('proxies each class as a separate argument to newPlatformChrome', () => {
-    const { chrome } = setup();
-    chrome.removeApplicationClass('foo');
-    chrome.removeApplicationClass(['bar', 'baz']);
-    chrome.removeApplicationClass([]);
-    expect(newPlatformChrome.removeApplicationClass.mock.calls).toMatchInlineSnapshot(`
-Array [
-  Array [
-    "foo",
-  ],
-  Array [
-    "bar",
-  ],
-  Array [
-    "baz",
-  ],
-]
-`);
-  });
-});
-
-describe('getApplicationClasses', () => {
-  it('returns cached values emitted from newPlatformChrome as a single string', () => {
-    const { chrome, applicationClasses$ } = setup();
-
-    expect(chrome.getApplicationClasses()).toBe('');
-    applicationClasses$.next(['foo', 'bar']);
-    expect(chrome.getApplicationClasses()).toBe('foo bar');
-    applicationClasses$.next(['bar']);
-    expect(chrome.getApplicationClasses()).toBe('bar');
-  });
-});
diff --git a/src/legacy/ui/public/chrome/api/theme.ts b/src/legacy/ui/public/chrome/api/theme.ts
deleted file mode 100644
index c01344bf56fe3f..00000000000000
--- a/src/legacy/ui/public/chrome/api/theme.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import * as Rx from 'rxjs';
-
-import { npStart } from 'ui/new_platform';
-import { ChromeBrand } from '../../../../../core/public';
-
-const newPlatformChrome = npStart.core.chrome;
-
-export function initChromeThemeApi(chrome: { [key: string]: any }) {
-  const brandCache$ = new Rx.BehaviorSubject<ChromeBrand>({});
-  newPlatformChrome.getBrand$().subscribe(brandCache$);
-
-  const applicationClassesCache$ = new Rx.BehaviorSubject<string[]>([]);
-  newPlatformChrome.getApplicationClasses$().subscribe(applicationClassesCache$);
-
-  chrome.setBrand = (brand: ChromeBrand) => {
-    newPlatformChrome.setBrand(brand);
-    return chrome;
-  };
-
-  chrome.getBrand = (key: keyof ChromeBrand) => {
-    return brandCache$.getValue()[key];
-  };
-
-  chrome.addApplicationClass = (classNames: string | string[] = []) => {
-    if (typeof classNames === 'string') {
-      classNames = [classNames];
-    }
-
-    for (const className of classNames) {
-      newPlatformChrome.addApplicationClass(className);
-    }
-
-    return chrome;
-  };
-
-  chrome.removeApplicationClass = (classNames: string | string[]) => {
-    if (typeof classNames === 'string') {
-      classNames = [classNames];
-    }
-
-    for (const className of classNames) {
-      newPlatformChrome.removeApplicationClass(className);
-    }
-    return chrome;
-  };
-
-  chrome.getApplicationClasses = () => {
-    return applicationClassesCache$.getValue().join(' ');
-  };
-}
diff --git a/src/legacy/ui/public/chrome/api/ui_settings.js b/src/legacy/ui/public/chrome/api/ui_settings.js
deleted file mode 100644
index dbdd6a9c126534..00000000000000
--- a/src/legacy/ui/public/chrome/api/ui_settings.js
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { npSetup } from 'ui/new_platform';
-
-const newPlatformUiSettingsClient = npSetup.core.uiSettings;
-
-export function initUiSettingsApi(chrome) {
-  chrome.getUiSettingsClient = function () {
-    return newPlatformUiSettingsClient;
-  };
-}
diff --git a/src/legacy/ui/public/chrome/api/xsrf.js b/src/legacy/ui/public/chrome/api/xsrf.js
deleted file mode 100644
index 5086903604667d..00000000000000
--- a/src/legacy/ui/public/chrome/api/xsrf.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export function initChromeXsrfApi(chrome, internals) {
-  chrome.getXsrfToken = function () {
-    return internals.version;
-  };
-}
diff --git a/src/legacy/ui/public/chrome/chrome.js b/src/legacy/ui/public/chrome/chrome.js
deleted file mode 100644
index cdb0734f61622c..00000000000000
--- a/src/legacy/ui/public/chrome/chrome.js
+++ /dev/null
@@ -1,118 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import angular from 'angular';
-
-import { metadata } from '../metadata';
-import '../state_management/global_state';
-import '../config';
-import '../notify';
-import '../private';
-import '../promises';
-import '../directives/storage';
-import '../directives/watch_multi';
-import '../react_components';
-import '../i18n';
-
-import { initAngularApi } from './api/angular';
-import appsApi from './api/apps';
-import { initChromeControlsApi } from './api/controls';
-import { initChromeNavApi } from './api/nav';
-import { initChromeBadgeApi } from './api/badge';
-import { initBreadcrumbsApi } from './api/breadcrumbs';
-import templateApi from './api/template';
-import { initChromeThemeApi } from './api/theme';
-import { initChromeXsrfApi } from './api/xsrf';
-import { initUiSettingsApi } from './api/ui_settings';
-import { initLoadingCountApi } from './api/loading_count';
-import { initSavedObjectClient } from './api/saved_object_client';
-import { initChromeBasePathApi } from './api/base_path';
-import { initChromeInjectedVarsApi } from './api/injected_vars';
-import { initHelpExtensionApi } from './api/help_extension';
-import { npStart } from '../new_platform';
-
-export const chrome = {};
-const internals = _.defaults(_.cloneDeep(metadata), {
-  basePath: '',
-  rootController: null,
-  rootTemplate: null,
-  showAppsLink: null,
-  xsrfToken: null,
-  devMode: true,
-  brand: null,
-  nav: [],
-  applicationClasses: [],
-});
-
-initUiSettingsApi(chrome);
-initSavedObjectClient(chrome);
-appsApi(chrome, internals);
-initChromeXsrfApi(chrome, internals);
-initChromeBasePathApi(chrome);
-initChromeInjectedVarsApi(chrome);
-initChromeNavApi(chrome, internals);
-initChromeBadgeApi(chrome);
-initBreadcrumbsApi(chrome, internals);
-initLoadingCountApi(chrome, internals);
-initHelpExtensionApi(chrome, internals);
-initAngularApi(chrome, internals);
-initChromeControlsApi(chrome);
-templateApi(chrome, internals);
-initChromeThemeApi(chrome);
-
-npStart.core.chrome.setAppTitle(chrome.getAppTitle());
-
-const waitForBootstrap = new Promise((resolve) => {
-  chrome.bootstrap = function (targetDomElement) {
-    // sets attribute on body for stylesheet sandboxing
-    document.body.setAttribute('id', `${internals.app.id}-app`);
-
-    chrome.setupAngular();
-    targetDomElement.setAttribute('kbn-chrome', 'true');
-    targetDomElement.setAttribute('ng-class', "{ 'hidden-chrome': !chrome.getVisible() }");
-    targetDomElement.className = 'app-wrapper';
-    angular.bootstrap(targetDomElement, ['kibana']);
-    resolve(targetDomElement);
-  };
-});
-
-/**
- * ---- ATTENTION: Read documentation carefully before using this! ----
- *
- * Returns a promise, that resolves with an instance of the currently used Angular
- * $injector service for usage outside of Angular.
- * You can use this injector to get access to any other injectable component (service,
- * constant, etc.) by using its get method.
- *
- * If you ever use Angular outside of an Angular context via this method, you should
- * be really sure you know what you are doing!
- *
- * When using this method inside your code, you will need to stub it while running
- * tests. Look into 'src/test_utils/public/stub_get_active_injector' for more information.
- */
-chrome.dangerouslyGetActiveInjector = () => {
-  return waitForBootstrap.then((targetDomElement) => {
-    const $injector = angular.element(targetDomElement).injector();
-    if (!$injector) {
-      return Promise.reject('targetDomElement had no angular context after bootstrapping');
-    }
-    return $injector;
-  });
-};
diff --git a/src/legacy/ui/public/chrome/directives/index.js b/src/legacy/ui/public/chrome/directives/index.js
deleted file mode 100644
index 51d63f086e196a..00000000000000
--- a/src/legacy/ui/public/chrome/directives/index.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { kbnChromeProvider } from './kbn_chrome';
-
-export function directivesProvider(chrome, internals) {
-  kbnChromeProvider(chrome, internals);
-}
diff --git a/src/legacy/ui/public/chrome/directives/kbn_chrome.html b/src/legacy/ui/public/chrome/directives/kbn_chrome.html
deleted file mode 100644
index 7738093fe9dea7..00000000000000
--- a/src/legacy/ui/public/chrome/directives/kbn_chrome.html
+++ /dev/null
@@ -1,9 +0,0 @@
-<div class="app-wrapper-panel" data-test-subj="appA11yRoot">
-  <div id="globalBannerList"></div>
-
-  <div
-    class="application"
-    ng-class="'tab-' + getFirstPathSegment() + ' ' + chrome.getApplicationClasses()"
-    ng-view
-  ></div>
-</div>
diff --git a/src/legacy/ui/public/chrome/directives/kbn_chrome.js b/src/legacy/ui/public/chrome/directives/kbn_chrome.js
deleted file mode 100644
index 5ba34e553201eb..00000000000000
--- a/src/legacy/ui/public/chrome/directives/kbn_chrome.js
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React from 'react';
-import ReactDOM from 'react-dom';
-import $ from 'jquery';
-import { fatalError } from 'ui/notify/fatal_error';
-
-import { uiModules } from '../../modules';
-import template from './kbn_chrome.html';
-
-import { I18nContext } from '../../i18n';
-import { npStart } from '../../new_platform';
-import {
-  chromeHeaderNavControlsRegistry,
-  NavControlSide,
-} from '../../registry/chrome_header_nav_controls';
-import { subscribeWithScope } from '../../../../../plugins/kibana_legacy/public';
-
-export function kbnChromeProvider(chrome, internals) {
-  uiModules.get('kibana').directive('kbnChrome', () => {
-    return {
-      template() {
-        const $content = $(template);
-        const $app = $content.find('.application');
-
-        if (internals.rootController) {
-          $app.attr('ng-controller', internals.rootController);
-        }
-
-        if (internals.rootTemplate) {
-          $app.removeAttr('ng-view');
-          $app.html(internals.rootTemplate);
-        }
-
-        return $content;
-      },
-
-      controllerAs: 'chrome',
-      controller($scope, $location, Private) {
-        $scope.getFirstPathSegment = () => {
-          return $location.path().split('/')[1];
-        };
-
-        // Continue to support legacy nav controls not registered with the NP.
-        const navControls = Private(chromeHeaderNavControlsRegistry);
-        (navControls.bySide[NavControlSide.Left] || []).forEach((navControl) =>
-          npStart.core.chrome.navControls.registerLeft({
-            order: navControl.order,
-            mount: navControl.render,
-          })
-        );
-        (navControls.bySide[NavControlSide.Right] || []).forEach((navControl) =>
-          npStart.core.chrome.navControls.registerRight({
-            order: navControl.order,
-            mount: navControl.render,
-          })
-        );
-
-        // Non-scope based code (e.g., React)
-
-        // Banners
-        const bannerListContainer = document.getElementById('globalBannerList');
-        if (bannerListContainer) {
-          // This gets rendered manually by the legacy platform because this component must be inside the .app-wrapper
-          ReactDOM.render(
-            <I18nContext>{npStart.core.overlays.banners.getComponent()}</I18nContext>,
-            bannerListContainer
-          );
-        }
-
-        const chromeVisibility = subscribeWithScope(
-          $scope,
-          chrome.visible$,
-          {
-            next: () => {
-              // just makes sure change detection is triggered when chrome visibility changes
-            },
-          },
-          fatalError
-        );
-        $scope.$on('$destroy', () => {
-          chromeVisibility.unsubscribe();
-        });
-
-        return chrome;
-      },
-    };
-  });
-}
diff --git a/src/legacy/ui/public/chrome/index.d.ts b/src/legacy/ui/public/chrome/index.d.ts
deleted file mode 100644
index b295746d920545..00000000000000
--- a/src/legacy/ui/public/chrome/index.d.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { SavedObjectsClientContract } from 'src/core/public';
-import { ChromeBrand } from '../../../../core/public';
-import { BadgeApi } from './api/badge';
-import { BreadcrumbsApi } from './api/breadcrumbs';
-import { HelpExtensionApi } from './api/help_extension';
-import { ChromeNavLinks } from './api/nav';
-
-export interface IInjector {
-  get<T>(injectable: string): T;
-  invoke<T, T2>(
-    injectable: (this: T2, ...args: any[]) => T,
-    self?: T2,
-    locals?: { [key: string]: any }
-  ): T;
-  instantiate(constructor: Function, locals?: { [key: string]: any }): any;
-}
-
-declare interface Chrome extends ChromeNavLinks {
-  badge: BadgeApi;
-  breadcrumbs: BreadcrumbsApi;
-  helpExtension: HelpExtensionApi;
-  addBasePath<T = string>(path: T): T;
-  dangerouslyGetActiveInjector(): Promise<IInjector>;
-  getBasePath(): string;
-  getXsrfToken(): string;
-  getKibanaVersion(): string;
-  getSavedObjectsClient(): SavedObjectsClientContract;
-  getUiSettingsClient(): any;
-  setVisible(visible: boolean): any;
-  getInjected(key: string, defaultValue?: any): any;
-  setRootController(name: string, Controller: any): any;
-  setBrand(brand: ChromeBrand): this;
-  getBrand(key: keyof ChromeBrand): ChromeBrand[keyof ChromeBrand];
-  addApplicationClass(classNames: string | string[]): this;
-  removeApplicationClass(classNames: string | string[]): this;
-  getApplicationClasses(): string;
-}
-
-declare const chrome: Chrome;
-
-// eslint-disable-next-line import/no-default-export
-export default chrome;
-export { Chrome };
-export { Breadcrumb } from './api/breadcrumbs';
-export { HelpExtension } from './api/help_extension';
diff --git a/src/legacy/ui/public/chrome/index.js b/src/legacy/ui/public/chrome/index.js
deleted file mode 100644
index 3c6c3d2e74143b..00000000000000
--- a/src/legacy/ui/public/chrome/index.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { chrome } from './chrome';
-
-// eslint-disable-next-line import/no-default-export
-export default chrome;
diff --git a/src/legacy/ui/public/config/__tests__/config.js b/src/legacy/ui/public/config/__tests__/config.js
deleted file mode 100644
index 90dbdaf264a296..00000000000000
--- a/src/legacy/ui/public/config/__tests__/config.js
+++ /dev/null
@@ -1,208 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-
-import ngMock from 'ng_mock';
-import chrome from '../../chrome';
-
-describe('Config service', () => {
-  let config;
-  let uiSettings;
-  let $q;
-  let $rootScope;
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(($injector) => {
-      config = $injector.get('config');
-      uiSettings = chrome.getUiSettingsClient();
-      $q = $injector.get('$q');
-      $rootScope = $injector.get('$rootScope');
-    })
-  );
-
-  describe('#getAll', () => {
-    it('calls uiSettings.getAll()', () => {
-      sinon.stub(uiSettings, 'getAll');
-      config.getAll();
-      sinon.assert.calledOnce(uiSettings.getAll);
-      sinon.assert.calledWithExactly(uiSettings.getAll);
-      uiSettings.getAll.restore();
-    });
-  });
-
-  describe('#get', () => {
-    it('calls uiSettings.get(key, default)', () => {
-      sinon.stub(uiSettings, 'get');
-      config.get('key', 'default');
-      sinon.assert.calledOnce(uiSettings.get);
-      sinon.assert.calledWithExactly(uiSettings.get, 'key', 'default');
-      uiSettings.get.restore();
-    });
-  });
-
-  describe('#isDeclared', () => {
-    it('calls uiSettings.isDeclared(key)', () => {
-      sinon.stub(uiSettings, 'isDeclared');
-      config.isDeclared('key');
-      sinon.assert.calledOnce(uiSettings.isDeclared);
-      sinon.assert.calledWithExactly(uiSettings.isDeclared, 'key');
-      uiSettings.isDeclared.restore();
-    });
-  });
-
-  describe('#isDefault', () => {
-    it('calls uiSettings.isDefault(key)', () => {
-      sinon.stub(uiSettings, 'isDefault');
-      config.isDefault('key');
-      sinon.assert.calledOnce(uiSettings.isDefault);
-      sinon.assert.calledWithExactly(uiSettings.isDefault, 'key');
-      uiSettings.isDefault.restore();
-    });
-  });
-
-  describe('#isCustom', () => {
-    it('calls uiSettings.isCustom(key)', () => {
-      sinon.stub(uiSettings, 'isCustom');
-      config.isCustom('key');
-      sinon.assert.calledOnce(uiSettings.isCustom);
-      sinon.assert.calledWithExactly(uiSettings.isCustom, 'key');
-    });
-  });
-
-  describe('#remove', () => {
-    it('calls uiSettings.remove(key)', () => {
-      sinon.stub(uiSettings, 'remove');
-      config.remove('foobar');
-      sinon.assert.calledOnce(uiSettings.remove);
-      sinon.assert.calledWithExactly(uiSettings.remove, 'foobar');
-      uiSettings.remove.restore();
-    });
-
-    it('returns an angular promise', () => {
-      const promise = config.remove('dateFormat:tz');
-      expect(promise).to.be.a($q);
-    });
-  });
-
-  describe('#set', () => {
-    it('returns an angular promise', () => {
-      const promise = config.set('dateFormat:tz', 'foo');
-      expect(promise).to.be.a($q);
-    });
-
-    it('strips $$-prefixed properties from plain objects', () => {
-      config.set('dateFormat:scaled', {
-        foo: 'bar',
-        $$bax: 'box',
-      });
-
-      expect(config.get('dateFormat:scaled')).to.eql({
-        foo: 'bar',
-      });
-    });
-  });
-
-  describe('$scope events', () => {
-    it('synchronously emits change:config on $rootScope when config changes', () => {
-      const stub = sinon.stub();
-      $rootScope.$on('change:config', stub);
-      config.set('foobar', 'baz');
-      sinon.assert.calledOnce(stub);
-      sinon.assert.calledWithExactly(stub, sinon.match({}), 'baz', undefined, 'foobar', config);
-    });
-
-    it('synchronously emits change:config.${key} on $rootScope when config changes', () => {
-      const stub = sinon.stub();
-      $rootScope.$on('change:config.foobar', stub);
-      config.set('foobar', 'baz');
-      sinon.assert.calledOnce(stub);
-      sinon.assert.calledWithExactly(stub, sinon.match({}), 'baz', undefined, 'foobar', config);
-    });
-
-    it('synchronously emits change:config on child scope when config changes', () => {
-      const stub = sinon.stub();
-      const $parent = $rootScope.$new(false);
-      const $scope = $rootScope.$new(false, $parent);
-      $scope.$on('change:config', stub);
-      config.set('foobar', 'baz');
-      sinon.assert.calledOnce(stub);
-      sinon.assert.calledWithExactly(stub, sinon.match({}), 'baz', undefined, 'foobar', config);
-    });
-
-    it('synchronously emits change:config.${key} on child scope when config changes', () => {
-      const stub = sinon.stub();
-      const $parent = $rootScope.$new(false);
-      const $scope = $rootScope.$new(false, $parent);
-      $scope.$on('change:config.foobar', stub);
-      config.set('foobar', 'baz');
-      sinon.assert.calledOnce(stub);
-      sinon.assert.calledWithExactly(stub, sinon.match({}), 'baz', undefined, 'foobar', config);
-    });
-
-    it('synchronously emits change:config on isolate scope when config changes', () => {
-      const stub = sinon.stub();
-      const $scope = $rootScope.$new(true);
-      $scope.$on('change:config', stub);
-      config.set('foobar', 'baz');
-      sinon.assert.calledOnce(stub);
-      sinon.assert.calledWithExactly(stub, sinon.match({}), 'baz', undefined, 'foobar', config);
-    });
-
-    it('synchronously emits change:config.${key} on isolate scope when config changes', () => {
-      const stub = sinon.stub();
-      const $scope = $rootScope.$new(true);
-      $scope.$on('change:config.foobar', stub);
-      config.set('foobar', 'baz');
-      sinon.assert.calledOnce(stub);
-      sinon.assert.calledWithExactly(stub, sinon.match({}), 'baz', undefined, 'foobar', config);
-    });
-
-    it('synchronously emits events when changes are inside a digest cycle', async () => {
-      const stub = sinon.stub();
-
-      $rootScope.$apply(() => {
-        $rootScope.$on('change:config.foobar', stub);
-        config.set('foobar', 'baz');
-      });
-
-      sinon.assert.calledOnce(stub);
-      sinon.assert.calledWithExactly(stub, sinon.match({}), 'baz', undefined, 'foobar', config);
-    });
-
-    it('synchronously emits events when changes are outside a digest cycle', async () => {
-      const stub = sinon.stub();
-
-      await new Promise((resolve) => {
-        setTimeout(function () {
-          const off = $rootScope.$on('change:config.foobar', stub);
-          config.set('foobar', 'baz');
-          // we unlisten to make sure that stub is not called before our assertions below
-          off();
-          resolve();
-        }, 0);
-      });
-
-      sinon.assert.calledOnce(stub);
-      sinon.assert.calledWithExactly(stub, sinon.match({}), 'baz', undefined, 'foobar', config);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/config/config.js b/src/legacy/ui/public/config/config.js
deleted file mode 100644
index a8f24c126caff6..00000000000000
--- a/src/legacy/ui/public/config/config.js
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import angular from 'angular';
-import { fatalError } from 'ui/notify/fatal_error';
-import chrome from '../chrome';
-import { isPlainObject } from 'lodash';
-import { uiModules } from '../modules';
-import { subscribeWithScope } from '../../../../plugins/kibana_legacy/public';
-
-const module = uiModules.get('kibana/config');
-
-/**
- * Angular tie-in to UiSettingsClient, which is implemented in vanilla JS. Designed
- * to expose the exact same API as the config service that has existed since forever.
- * @name config
- */
-module.service(`config`, function ($rootScope, Promise) {
-  const uiSettings = chrome.getUiSettingsClient();
-
-  // direct bind sync methods
-  this.getAll = (...args) => uiSettings.getAll(...args);
-  this.get = (...args) => uiSettings.get(...args);
-  this.isDeclared = (...args) => uiSettings.isDeclared(...args);
-  this.isDefault = (...args) => uiSettings.isDefault(...args);
-  this.isCustom = (...args) => uiSettings.isCustom(...args);
-  this.isOverridden = (...args) => uiSettings.isOverridden(...args);
-
-  // modify remove() to use angular Promises
-  this.remove = (key) => Promise.resolve(uiSettings.remove(key));
-
-  // modify set() to use angular Promises and angular.toJson()
-  this.set = (key, value) =>
-    Promise.resolve(uiSettings.set(key, isPlainObject(value) ? angular.toJson(value) : value));
-
-  //////////////////////////////
-  //* angular specific methods *
-  //////////////////////////////
-
-  const subscription = subscribeWithScope(
-    $rootScope,
-    uiSettings.getUpdate$(),
-    {
-      next: ({ key, newValue, oldValue }) => {
-        $rootScope.$broadcast('change:config', newValue, oldValue, key, this);
-        $rootScope.$broadcast(`change:config.${key}`, newValue, oldValue, key, this);
-      },
-    },
-    fatalError
-  );
-  $rootScope.$on('$destroy', () => subscription.unsubscribe());
-
-  this.watchAll = function (handler, scope = $rootScope) {
-    // call handler immediately to initialize
-    handler(null, null, null, this);
-
-    return scope.$on('change:config', (event, ...args) => {
-      handler(...args);
-    });
-  };
-
-  this.watch = function (key, handler, scope = $rootScope) {
-    if (!this.isDeclared(key)) {
-      throw new Error(`Unexpected \`config.watch("${key}", fn)\` call on unrecognized configuration setting "${key}".
-Setting an initial value via \`config.set("${key}", value)\` before binding
-any custom setting configuration watchers for "${key}" may fix this issue.`);
-    }
-
-    // call handler immediately with current value
-    handler(this.get(key), null, key, uiSettings);
-
-    // call handler again on each change for this key
-    return scope.$on(`change:config.${key}`, (event, ...args) => {
-      handler(...args);
-    });
-  };
-
-  /**
-   * A little helper for binding config variables to $scopes
-   *
-   * @param  {Scope} $scope - an angular $scope object
-   * @param  {string} key - the config key to bind to
-   * @param  {string} [property] - optional property name where the value should
-   *                             be stored. Defaults to the config key
-   * @return {function} - an unbind function
-   */
-  this.bindToScope = function (scope, key, property = key) {
-    const onUpdate = (newVal) => {
-      scope[property] = newVal;
-    };
-
-    return this.watch(key, onUpdate, scope);
-  };
-});
diff --git a/src/legacy/ui/public/config/index.js b/src/legacy/ui/public/config/index.js
deleted file mode 100644
index 54602df57d65cf..00000000000000
--- a/src/legacy/ui/public/config/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import './config';
diff --git a/src/legacy/ui/public/directives/__tests__/input_focus.js b/src/legacy/ui/public/directives/__tests__/input_focus.js
deleted file mode 100644
index a9cd9b3c87974c..00000000000000
--- a/src/legacy/ui/public/directives/__tests__/input_focus.js
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import $ from 'jquery';
-import '../input_focus';
-import uiRoutes from 'ui/routes';
-
-describe('Input focus directive', function () {
-  let $compile;
-  let $rootScope;
-  let $timeout;
-  let element;
-  let $el;
-  let selectedEl;
-  let selectedText;
-  const inputValue = 'Input Text Value';
-
-  uiRoutes.enable();
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function (_$compile_, _$rootScope_, _$timeout_) {
-      $compile = _$compile_;
-      $rootScope = _$rootScope_;
-      $timeout = _$timeout_;
-
-      $el = $('<div>');
-      $el.appendTo('body');
-    })
-  );
-
-  afterEach(function () {
-    $el.remove();
-    $el = null;
-  });
-
-  function renderEl(html) {
-    $rootScope.value = inputValue;
-    element = $compile(html)($rootScope);
-    element.appendTo($el);
-    $rootScope.$digest();
-    $timeout.flush();
-    selectedEl = document.activeElement;
-    if (selectedEl.value) {
-      selectedText = selectedEl.value.slice(selectedEl.selectionStart, selectedEl.selectionEnd);
-    }
-  }
-
-  it('should focus the input', function () {
-    renderEl('<input type="text" ng-model="value" input-focus />');
-    expect(selectedEl).to.equal(element[0]);
-    expect(selectedText.length).to.equal(0);
-  });
-
-  it('should select the text in the input', function () {
-    renderEl('<input type="text" ng-model="value" input-focus="select" />');
-    expect(selectedEl).to.equal(element[0]);
-    expect(selectedText.length).to.equal(inputValue.length);
-    expect(selectedText).to.equal(inputValue);
-  });
-
-  it('should not focus the input if disable-input-focus is set to true on the same element', function () {
-    renderEl('<input type="text" ng-model="value" input-focus disable-input-focus="true">');
-    expect(selectedEl).not.to.be(element[0]);
-  });
-
-  it('should still focus the input if disable-input-focus is falsy', function () {
-    renderEl('<input type="text" ng-model="value" input-focus disable-input-focus="false">');
-    expect(selectedEl).to.be(element[0]);
-  });
-});
diff --git a/src/legacy/ui/public/directives/_index.scss b/src/legacy/ui/public/directives/_index.scss
deleted file mode 100644
index 7ff5c9b9c540c1..00000000000000
--- a/src/legacy/ui/public/directives/_index.scss
+++ /dev/null
@@ -1,2 +0,0 @@
-@import './input_datetime';
-@import './saved_object_paginated_selectable'
diff --git a/src/legacy/ui/public/directives/_input_datetime.scss b/src/legacy/ui/public/directives/_input_datetime.scss
deleted file mode 100644
index 0704d70e9df1b0..00000000000000
--- a/src/legacy/ui/public/directives/_input_datetime.scss
+++ /dev/null
@@ -1,5 +0,0 @@
-.input-datetime-format {
-  font-size: $euiFontSizeXS;
-  color: $euiColorMediumShade;
-  padding: $euiSizeXS $euiSize;
-}
diff --git a/src/legacy/ui/public/directives/_saved_object_paginated_selectable.scss b/src/legacy/ui/public/directives/_saved_object_paginated_selectable.scss
deleted file mode 100644
index f8b5cdb440997a..00000000000000
--- a/src/legacy/ui/public/directives/_saved_object_paginated_selectable.scss
+++ /dev/null
@@ -1,70 +0,0 @@
-saved-object-finder,
-paginated-selectable-list {
-
-  .list-sort-button {
-    border-top-left-radius: 0 !important;
-    border-top-right-radius: 0 !important;
-    border: none;
-    padding: $euiSizeS $euiSize;
-    font-weight: $euiFontWeightRegular;
-    background-color: $euiColorLightestShade;
-  }
-
-  ul.li-striped {
-    li {
-      border: none;
-    }
-
-    li:nth-child(even) {
-      background-color: $euiColorLightestShade;
-    }
-
-    li:nth-child(odd) {
-      background-color: $euiColorEmptyShade;
-    }
-
-    .paginate-heading {
-      font-weight: $euiFontWeightRegular;
-      color: $euiColorDarkestShade;
-    }
-
-    .list-group-item {
-      padding: $euiSizeS $euiSize;
-
-      ul {
-        padding: 0;
-        display: flex;
-        flex-direction: row;
-
-        .finder-type {
-          margin-right: $euiSizeS;
-        }
-      }
-
-      a {
-        display: block;
-        color: $euiColorPrimary !important;
-
-        i {
-          color: shade($euiColorPrimary, 10%) !important;
-          margin-right: $euiSizeS;
-        }
-      }
-
-      &:first-child {
-        border-top-left-radius: 0 !important;
-        border-top-right-radius: 0 !important;
-      }
-
-      &.list-group-no-results p {
-        margin-bottom: 0 !important;
-      }
-    }
-  }
-
-  paginate {
-    paginate-controls {
-      margin: $euiSize;
-    }
-  }
-}
diff --git a/src/legacy/ui/public/directives/bind/__tests__/bind.js b/src/legacy/ui/public/directives/bind/__tests__/bind.js
deleted file mode 100644
index 658a726e8c4cf6..00000000000000
--- a/src/legacy/ui/public/directives/bind/__tests__/bind.js
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-describe('$scope.$bind', function () {
-  let $rootScope;
-  let $scope;
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function ($injector) {
-      $rootScope = $injector.get('$rootScope');
-      $scope = $rootScope.$new();
-    })
-  );
-
-  it('exposes $bind on all scopes', function () {
-    expect($rootScope.$bind).to.be.a('function');
-    expect($scope).to.have.property('$bind', $rootScope.$bind);
-
-    const $isoScope = $scope.$new(true);
-    expect($isoScope).to.have.property('$bind', $rootScope.$bind);
-  });
-
-  it("sets up binding from a parent scope to it's child", function () {
-    $rootScope.val = 'foo';
-    $scope.$bind('localVal', 'val');
-    expect($scope.localVal).to.be('foo');
-
-    $rootScope.val = 'bar';
-    expect($scope.localVal).to.be('foo'); // shouldn't have changed yet
-
-    $rootScope.$apply();
-    expect($scope.localVal).to.be('bar');
-  });
-
-  it('sets up a binding from the child to the parent scope', function () {
-    $rootScope.val = 'foo';
-    $scope.$bind('localVal', 'val');
-    expect($scope.localVal).to.be('foo');
-
-    $scope.localVal = 'bar';
-    expect($rootScope.val).to.be('foo'); // shouldn't have changed yet
-
-    $scope.$apply();
-    expect($rootScope.val).to.be('bar');
-  });
-
-  it('pulls from the scopes $parent by default', function () {
-    const $parent = $rootScope.$new();
-    const $self = $parent.$new();
-
-    $parent.val = 'foo';
-    $self.val = 'bar';
-
-    $self.$bind('localVal', 'val');
-    expect($self.localVal).to.be('foo');
-  });
-
-  it('accepts an alternate scope to read from', function () {
-    const $parent = $rootScope.$new();
-    const $self = $parent.$new();
-
-    $parent.val = 'foo';
-    $self.val = 'bar';
-
-    $self.$bind('localVal', 'val', $self);
-    expect($self.localVal).to.be('bar');
-  });
-});
diff --git a/src/legacy/ui/public/directives/bind/bind.js b/src/legacy/ui/public/directives/bind/bind.js
deleted file mode 100644
index a9210cace5cea6..00000000000000
--- a/src/legacy/ui/public/directives/bind/bind.js
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import angular from 'angular';
-import { uiModules } from '../../modules';
-
-uiModules.get('kibana').config(function ($provide) {
-  function strictEquality(a, b) {
-    // are the values equal? or, are they both NaN?
-    return a === b || (a !== a && b !== b);
-  }
-
-  function errorNotAssignable(source, target) {
-    throw Error(
-      'Unable to accept change to bound $scope property "' +
-        source +
-        '"' +
-        ' because source expression "' +
-        target +
-        '" is not assignable!'
-    );
-  }
-
-  $provide.decorator('$rootScope', function ($delegate, $parse) {
-    /**
-     * Two-way bind a value from scope to another property on scope. This
-     * allow values on scope that work like they do in an isolate scope, but
-     * without requiring one.
-     *
-     * @param  {expression} to - the location on scope to bind to
-     * @param  {expression} from - the location on scope to bind from
-     * @param  {Scope} $sourceScope - the scope to read "from" expression from
-     * @return {undefined}
-     */
-    $delegate.constructor.prototype.$bind = function (to, from, $sourceScope) {
-      const $source = $sourceScope || this.$parent;
-      const $target = this;
-
-      // parse expressions
-      const $to = $parse(to);
-      if (!$to.assign) errorNotAssignable(to, from);
-      const $from = $parse(from);
-
-      // bind scopes to expressions
-      const getTarget = function () {
-        return $to($target);
-      };
-      const setTarget = function (v) {
-        return $to.assign($target, v);
-      };
-      const getSource = function () {
-        return $from($source);
-      };
-      const setSource = function (v) {
-        return $from.assignOrFail($source, v);
-      };
-
-      // to support writing from the child to the parent we need to know
-      // which source has changed. Track the source value and anytime it
-      // changes (even if the target value changed too) push from source
-      // to target. If the source hasn't changed then the change is from
-      // the target and push accordingly
-      let lastSourceVal = getSource();
-
-      $from.assignOrFail =
-        $from.assign ||
-        function () {
-          // revert the change and throw an error, child writes aren't supported
-          $to($target, (lastSourceVal = $from($source)));
-          errorNotAssignable(from, to);
-        };
-
-      // if we are syncing down a literal, then we use loose equality check
-      const strict = !$from.literal;
-      const compare = strict ? strictEquality : angular.equals;
-
-      // push the initial value down, start off in sync
-      setTarget(lastSourceVal);
-
-      $target.$watch(
-        function () {
-          const sourceVal = getSource();
-          const targetVal = getTarget();
-
-          const outOfSync = !compare(sourceVal, targetVal);
-          const sourceChanged = outOfSync && !compare(sourceVal, lastSourceVal);
-
-          if (sourceChanged) setTarget(sourceVal);
-          else if (outOfSync) setSource(targetVal);
-
-          return (lastSourceVal = sourceVal);
-        },
-        null,
-        !strict
-      );
-    };
-
-    return $delegate;
-  });
-});
diff --git a/src/legacy/ui/public/directives/bind/index.js b/src/legacy/ui/public/directives/bind/index.js
deleted file mode 100644
index d542452d1a80f5..00000000000000
--- a/src/legacy/ui/public/directives/bind/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import './bind';
diff --git a/src/legacy/ui/public/directives/input_focus.js b/src/legacy/ui/public/directives/input_focus.js
deleted file mode 100644
index f047ff2547ba25..00000000000000
--- a/src/legacy/ui/public/directives/input_focus.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiModules } from '../modules';
-const module = uiModules.get('kibana');
-
-module.directive('inputFocus', function ($parse, $timeout) {
-  return {
-    restrict: 'A',
-    link: function ($scope, $elem, attrs) {
-      const isDisabled = attrs.disableInputFocus && $parse(attrs.disableInputFocus)($scope);
-      if (!isDisabled) {
-        $timeout(function () {
-          $elem.focus();
-          if (attrs.inputFocus === 'select') $elem.select();
-        });
-      }
-    },
-  };
-});
diff --git a/src/legacy/ui/public/directives/kbn_href.js b/src/legacy/ui/public/directives/kbn_href.js
deleted file mode 100644
index 5c71396e6c4dea..00000000000000
--- a/src/legacy/ui/public/directives/kbn_href.js
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiModules } from '../modules';
-import { words, kebabCase } from 'lodash';
-
-export function kbnUrlDirective(name) {
-  const attr = kebabCase(words(name).slice(1));
-
-  uiModules.get('kibana').directive(name, function (chrome) {
-    return {
-      restrict: 'A',
-      link: function ($scope, $el, $attr) {
-        $attr.$observe(name, function (val) {
-          $attr.$set(attr, chrome.addBasePath(val));
-        });
-      },
-    };
-  });
-}
-
-kbnUrlDirective('kbnHref');
diff --git a/src/legacy/ui/public/directives/listen/__tests__/listen.js b/src/legacy/ui/public/directives/listen/__tests__/listen.js
deleted file mode 100644
index 9a1d4829561546..00000000000000
--- a/src/legacy/ui/public/directives/listen/__tests__/listen.js
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import '..';
-import { EventsProvider } from '../../../events';
-
-describe('listen component', function () {
-  let $rootScope;
-  let Events;
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function ($injector, Private) {
-      $rootScope = $injector.get('$rootScope');
-      Events = Private(EventsProvider);
-    })
-  );
-
-  it('exposes the $listen method on all scopes', function () {
-    expect($rootScope.$listen).to.be.a('function');
-    expect($rootScope.$new().$listen).to.be.a('function');
-  });
-
-  it('binds to an event emitter', function () {
-    const emitter = new Events();
-    const $scope = $rootScope.$new();
-
-    function handler() {}
-    $scope.$listen(emitter, 'hello', handler);
-
-    expect(emitter._listeners.hello).to.have.length(1);
-    expect(emitter._listeners.hello[0].handler).to.be(handler);
-  });
-
-  it('binds to $scope, waiting for the destroy event', function () {
-    const emitter = new Events();
-    const $scope = $rootScope.$new();
-
-    sinon.stub($scope, '$on');
-    sinon.stub($rootScope, '$on');
-
-    function handler() {}
-    $scope.$listen(emitter, 'hello', handler);
-
-    expect($rootScope.$on).to.have.property('callCount', 0);
-    expect($scope.$on).to.have.property('callCount', 1);
-
-    const call = $scope.$on.firstCall;
-    expect(call.args[0]).to.be('$destroy');
-    expect(call.args[1]).to.be.a('function');
-  });
-
-  it('unbinds the event handler when $destroy is triggered', function () {
-    const emitter = new Events();
-    const $scope = $rootScope.$new();
-
-    sinon.stub($scope, '$on');
-    sinon.stub(emitter, 'off');
-
-    // set the listener
-    function handler() {}
-    $scope.$listen(emitter, 'hello', handler);
-
-    // get the unbinder that was registered to $scope
-    const unbinder = $scope.$on.firstCall.args[1];
-
-    // call the unbinder
-    expect(emitter.off).to.have.property('callCount', 0);
-    unbinder();
-    expect(emitter.off).to.have.property('callCount', 1);
-
-    // check that the off args were as expected
-    const call = emitter.off.firstCall;
-    expect(call.args[0]).to.be('hello');
-    expect(call.args[1]).to.be(handler);
-  });
-});
diff --git a/src/legacy/ui/public/directives/listen/index.js b/src/legacy/ui/public/directives/listen/index.js
deleted file mode 100644
index 6efc1b71431a2e..00000000000000
--- a/src/legacy/ui/public/directives/listen/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import './listen';
diff --git a/src/legacy/ui/public/directives/listen/listen.js b/src/legacy/ui/public/directives/listen/listen.js
deleted file mode 100644
index db19471fdb6405..00000000000000
--- a/src/legacy/ui/public/directives/listen/listen.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiModules } from '../../modules';
-import { registerListenEventListener } from '../../../../../plugins/kibana_legacy/public';
-
-uiModules.get('kibana').run(registerListenEventListener);
diff --git a/src/legacy/ui/public/directives/render_directive/__tests__/render_directive.js b/src/legacy/ui/public/directives/render_directive/__tests__/render_directive.js
deleted file mode 100644
index a604eca52affe0..00000000000000
--- a/src/legacy/ui/public/directives/render_directive/__tests__/render_directive.js
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import angular from 'angular';
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import '..';
-
-let init;
-let $rootScope;
-let $compile;
-
-describe('render_directive', function () {
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function ($injector) {
-      $rootScope = $injector.get('$rootScope');
-      $compile = $injector.get('$compile');
-      init = function init(markup = '', definition = {}) {
-        const $parentScope = $rootScope;
-
-        // create the markup
-        const $elem = angular.element('<render-directive>');
-        $elem.html(markup);
-        if (definition !== null) {
-          $parentScope.definition = definition;
-          $elem.attr('definition', 'definition');
-        }
-
-        // compile the directive
-        $compile($elem)($parentScope);
-        $parentScope.$apply();
-
-        const $directiveScope = $elem.isolateScope();
-
-        return { $parentScope, $directiveScope, $elem };
-      };
-    })
-  );
-
-  describe('directive requirements', function () {
-    it('should throw if not given a definition', function () {
-      expect(() => init('', null)).to.throwException(/must have a definition/);
-    });
-  });
-
-  describe('rendering with definition', function () {
-    it('should call link method', function () {
-      const markup = '<p>hello world</p>';
-      const definition = {
-        link: sinon.stub(),
-      };
-
-      init(markup, definition);
-
-      sinon.assert.callCount(definition.link, 1);
-    });
-
-    it('should call controller method', function () {
-      const markup = '<p>hello world</p>';
-      const definition = {
-        controller: sinon.stub(),
-      };
-
-      init(markup, definition);
-
-      sinon.assert.callCount(definition.controller, 1);
-    });
-  });
-
-  describe('definition scope binding', function () {
-    it('should accept two-way, attribute, and expression binding directives', function () {
-      const $el = angular.element(`
-        <render-directive
-          definition="definition"
-          two-way-prop="parentTwoWay"
-          attr="Simple Attribute"
-          expr="parentExpression()"
-          >
-          {{two}},{{attr}},{{expr()}}
-        </render-directive>
-      `);
-
-      const $parentScope = $rootScope.$new();
-      $parentScope.definition = {
-        scope: {
-          two: '=twoWayProp',
-          attr: '@',
-          expr: '&expr',
-        },
-      };
-      $parentScope.parentTwoWay = true;
-      $parentScope.parentExpression = function () {
-        return !$parentScope.parentTwoWay;
-      };
-
-      $compile($el)($parentScope);
-      $parentScope.$apply();
-
-      expect($el.text().trim()).to.eql('true,Simple Attribute,false');
-      $parentScope.parentTwoWay = false;
-      $parentScope.$apply();
-      expect($el.text().trim()).to.eql('false,Simple Attribute,true');
-    });
-  });
-});
diff --git a/src/legacy/ui/public/directives/render_directive/apply_scope_bindings.js b/src/legacy/ui/public/directives/render_directive/apply_scope_bindings.js
deleted file mode 100644
index 09948bda96b9f8..00000000000000
--- a/src/legacy/ui/public/directives/render_directive/apply_scope_bindings.js
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { forOwn, noop } from 'lodash';
-
-import '../../directives/bind';
-
-const bindingRE = /^(=|=\?|&|@)([a-zA-Z0-9_$]+)?$/;
-
-export function ApplyScopeBindingsProvider($parse) {
-  return function (bindings, $scope, $attrs) {
-    forOwn(bindings, (binding, local) => {
-      if (!bindingRE.test(binding)) {
-        throw new Error(`Invalid scope binding "${binding}". Expected it to match ${bindingRE}`);
-      }
-
-      const [, type, attribute = local] = binding.match(bindingRE);
-      const attr = $attrs[attribute];
-      switch (type) {
-        case '=':
-          $scope.$bind(local, attr);
-          break;
-        case '=?':
-          throw new Error(
-            '<render-directive> does not currently support optional two-way bindings.'
-          );
-          break;
-        case '&':
-          if (attr) {
-            const getter = $parse(attr);
-            $scope[local] = function () {
-              return getter($scope.$parent);
-            };
-          } else {
-            $scope[local] = noop;
-          }
-          break;
-        case '@':
-          $scope[local] = attr;
-          $attrs.$observe(attribute, (v) => ($scope[local] = v));
-          break;
-      }
-    });
-  };
-}
diff --git a/src/legacy/ui/public/directives/render_directive/index.js b/src/legacy/ui/public/directives/render_directive/index.js
deleted file mode 100644
index 8c1f126dc48f07..00000000000000
--- a/src/legacy/ui/public/directives/render_directive/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import './render_directive';
diff --git a/src/legacy/ui/public/directives/render_directive/render_directive.js b/src/legacy/ui/public/directives/render_directive/render_directive.js
deleted file mode 100644
index a5232f39b82c39..00000000000000
--- a/src/legacy/ui/public/directives/render_directive/render_directive.js
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { isPlainObject } from 'lodash';
-import { uiModules } from '../../modules';
-import { ApplyScopeBindingsProvider } from './apply_scope_bindings';
-
-/**
- * The <render-directive> directive is useful for programmatically modifying or
- * extending a view. It allows defining the majority of the directives behavior
- * using a "definition" object, which the implementer can obtain from plugins (for instance).
- *
- * The definition object supports the parts of a directive definition that are
- * easy enough to implement without having to hack angular, and does it's best to
- * make sure standard directive life-cycle timing is respected.
- *
- * @param [Object] definition - the external configuration for this directive to assume
- * @param [Function] definition.controller - a constructor used to create the controller for this directive
- * @param [String] definition.controllerAs - a name where the controller should be stored on scope
- * @param [Object] definition.scope - an object defining the binding properties for values read from
- *                                  attributes and bound to $scope. The keys of this object are the
- *                                  local names of $scope properties, and the values are a combination
- *                                  of the binding style (=, @, or &) and the external attribute name.
- *                                  See [the Angular docs]
- *                                  (https://code.angularjs.org/1.4.9/docs/api/ng/service/$compile#-scope-)
- *                                  for more info
- * @param [Object|Function] definition.link - either a post link function or an object with pre and/or
- *                                          post link functions.
- */
-uiModules.get('kibana').directive('renderDirective', function (Private) {
-  const applyScopeBindings = Private(ApplyScopeBindingsProvider);
-
-  return {
-    restrict: 'E',
-    scope: {
-      definition: '=',
-    },
-    template: function ($el) {
-      return $el.html();
-    },
-    controller: function ($scope, $element, $attrs, $transclude, $injector) {
-      if (!$scope.definition) throw new Error('render-directive must have a definition attribute');
-
-      const { controller, controllerAs, scope } = $scope.definition;
-
-      applyScopeBindings(scope, $scope, $attrs);
-
-      if (controller) {
-        if (controllerAs) {
-          $scope[controllerAs] = this;
-        }
-
-        const locals = { $scope, $element, $attrs, $transclude };
-        const controllerInstance = $injector.invoke(controller, this, locals) || this;
-
-        if (controllerAs) {
-          $scope[controllerAs] = controllerInstance;
-        }
-      }
-    },
-    link: {
-      pre($scope, $el, $attrs, controller) {
-        const { link } = $scope.definition;
-        const preLink = isPlainObject(link) ? link.pre : null;
-        if (preLink) preLink($scope, $el, $attrs, controller);
-      },
-      post($scope, $el, $attrs, controller) {
-        const { link } = $scope.definition;
-        const postLink = isPlainObject(link) ? link.post : link;
-        if (postLink) postLink($scope, $el, $attrs, controller);
-      },
-    },
-  };
-});
diff --git a/src/legacy/ui/public/directives/storage/index.js b/src/legacy/ui/public/directives/storage/index.js
deleted file mode 100644
index 7c195ecc85d2f9..00000000000000
--- a/src/legacy/ui/public/directives/storage/index.js
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiModules } from '../../modules';
-import { Storage } from '../../../../../plugins/kibana_utils/public';
-
-const createService = function (type) {
-  return function ($window) {
-    return new Storage($window[type]);
-  };
-};
-
-uiModules
-  .get('kibana/storage')
-  .service('localStorage', createService('localStorage'))
-  .service('sessionStorage', createService('sessionStorage'));
diff --git a/src/legacy/ui/public/directives/watch_multi/__tests__/watch_multi.js b/src/legacy/ui/public/directives/watch_multi/__tests__/watch_multi.js
deleted file mode 100644
index 0de41a5ae57cb7..00000000000000
--- a/src/legacy/ui/public/directives/watch_multi/__tests__/watch_multi.js
+++ /dev/null
@@ -1,216 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import ngMock from 'ng_mock';
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-
-describe('$scope.$watchMulti', function () {
-  let $rootScope;
-  let $scope;
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function ($injector) {
-      $rootScope = $injector.get('$rootScope');
-      $scope = $rootScope.$new();
-    })
-  );
-
-  describe('basic functionality', function () {
-    it('exposes $watchMulti on all scopes', function () {
-      expect($rootScope.$watchMulti).to.be.a('function');
-      expect($scope).to.have.property('$watchMulti', $rootScope.$watchMulti);
-
-      const $isoScope = $scope.$new(true);
-      expect($isoScope).to.have.property('$watchMulti', $rootScope.$watchMulti);
-    });
-
-    it('returns a working unwatch function', function () {
-      $scope.a = 0;
-      $scope.b = 0;
-      let triggers = 0;
-      const unwatch = $scope.$watchMulti(['a', 'b'], function () {
-        triggers++;
-      });
-
-      // initial watch
-      $scope.$apply();
-      expect(triggers).to.be(1);
-
-      // prove that it triggers on change
-      $scope.a++;
-      $scope.$apply();
-      expect(triggers).to.be(2);
-
-      // remove watchers
-      expect($scope.$$watchers).to.not.have.length(0);
-      unwatch();
-      expect($scope.$$watchers).to.have.length(0);
-
-      // prove that it doesn't trigger anymore
-      $scope.a++;
-      $scope.$apply();
-      expect(triggers).to.be(2);
-    });
-  });
-
-  describe('simple scope watchers', function () {
-    it('only triggers a single watch on initialization', function () {
-      const stub = sinon.stub();
-
-      $scope.$watchMulti(['one', 'two', 'three'], stub);
-      $rootScope.$apply();
-
-      expect(stub.callCount).to.be(1);
-    });
-
-    it('only triggers a single watch when multiple values change', function () {
-      const stub = sinon.spy(function () {});
-
-      $scope.$watchMulti(['one', 'two', 'three'], stub);
-
-      $rootScope.$apply();
-      expect(stub.callCount).to.be(1);
-
-      $scope.one = 'a';
-      $scope.two = 'b';
-      $scope.three = 'c';
-      $rootScope.$apply();
-
-      expect(stub.callCount).to.be(2);
-    });
-
-    it('passes an array of the current and previous values, in order', function () {
-      const stub = sinon.spy(function () {});
-
-      $scope.one = 'a';
-      $scope.two = 'b';
-      $scope.three = 'c';
-      $scope.$watchMulti(['one', 'two', 'three'], stub);
-
-      $rootScope.$apply();
-      expect(stub.firstCall.args).to.eql([
-        ['a', 'b', 'c'],
-        ['a', 'b', 'c'],
-      ]);
-
-      $scope.one = 'do';
-      $scope.two = 're';
-      $scope.three = 'mi';
-      $rootScope.$apply();
-
-      expect(stub.secondCall.args).to.eql([
-        ['do', 're', 'mi'],
-        ['a', 'b', 'c'],
-      ]);
-    });
-
-    it('always has an up to date value', function () {
-      let count = 0;
-
-      $scope.vals = [1, 0];
-      $scope.$watchMulti(['vals[0]', 'vals[1]'], function (cur) {
-        expect(cur).to.eql($scope.vals);
-        count++;
-      });
-
-      const $child = $scope.$new();
-      $child.$watch('vals[0]', function (cur) {
-        $child.vals[1] = cur;
-      });
-
-      $rootScope.$apply();
-      expect(count).to.be(2);
-    });
-  });
-
-  describe('complex watch expressions', function () {
-    let stateWatchers;
-    let firstValue;
-    let secondValue;
-
-    beforeEach(function () {
-      const firstGetter = function () {
-        return firstValue;
-      };
-
-      const secondGetter = function () {
-        return secondValue;
-      };
-
-      stateWatchers = [
-        {
-          fn: $rootScope.$watch,
-          get: firstGetter,
-        },
-        {
-          fn: $rootScope.$watch,
-          get: secondGetter,
-        },
-      ];
-    });
-
-    it('should trigger the watcher on initialization', function () {
-      const stub = sinon.stub();
-      firstValue = 'first';
-      secondValue = 'second';
-
-      $scope.$watchMulti(stateWatchers, stub);
-      $rootScope.$apply();
-
-      expect(stub.callCount).to.be(1);
-
-      expect(stub.firstCall.args[0]).to.eql([firstValue, secondValue]);
-      expect(stub.firstCall.args[1]).to.eql([firstValue, secondValue]);
-    });
-  });
-
-  describe('nested watchers', function () {
-    it('should trigger the handler at least once', function () {
-      const $scope = $rootScope.$new();
-      $scope.$$watchers = [
-        {
-          get: _.noop,
-          fn: _.noop,
-          eq: false,
-          last: false,
-        },
-        {
-          get: _.noop,
-          fn: registerWatchers,
-          eq: false,
-          last: false,
-        },
-      ];
-
-      const first = sinon.stub();
-      const second = sinon.stub();
-
-      function registerWatchers() {
-        $scope.$watchMulti([first, second], function () {
-          expect(first.callCount).to.be.greaterThan(0);
-          expect(second.callCount).to.be.greaterThan(0);
-        });
-      }
-      $scope.$digest();
-    });
-  });
-});
diff --git a/src/legacy/ui/public/directives/watch_multi/index.js b/src/legacy/ui/public/directives/watch_multi/index.js
deleted file mode 100644
index 800bb503088d4f..00000000000000
--- a/src/legacy/ui/public/directives/watch_multi/index.js
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiModules } from '../../modules';
-import { watchMultiDecorator } from '../../../../../plugins/kibana_legacy/public';
-uiModules.get('kibana').config(watchMultiDecorator);
diff --git a/src/legacy/ui/public/doc_title/__tests__/doc_title.js b/src/legacy/ui/public/doc_title/__tests__/doc_title.js
deleted file mode 100644
index fa8b83f755957f..00000000000000
--- a/src/legacy/ui/public/doc_title/__tests__/doc_title.js
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import { docTitle } from '../doc_title';
-import { npStart } from '../../new_platform';
-
-describe('docTitle Service', function () {
-  let initialDocTitle;
-  const MAIN_TITLE = 'Kibana 4';
-  let $rootScope;
-
-  beforeEach(function () {
-    initialDocTitle = document.title;
-    document.title = MAIN_TITLE;
-    npStart.core.chrome.docTitle.__legacy.setBaseTitle(MAIN_TITLE);
-  });
-  afterEach(function () {
-    document.title = initialDocTitle;
-    npStart.core.chrome.docTitle.__legacy.setBaseTitle(initialDocTitle);
-  });
-
-  beforeEach(
-    ngMock.module('kibana', function ($provide) {
-      $provide.decorator('$rootScope', decorateWithSpy('$on'));
-    })
-  );
-
-  beforeEach(
-    ngMock.inject(function ($injector) {
-      $rootScope = $injector.get('$rootScope');
-    })
-  );
-
-  describe('setup', function () {
-    it('resets the title when a route change begins', function () {
-      const spy = $rootScope.$on;
-
-      const found = spy.args.some(function (args) {
-        return args[0] === '$routeChangeStart' && args[1] === docTitle.reset;
-      });
-
-      if (!found) {
-        throw new Error('$rootScope.$on not called');
-      }
-    });
-  });
-
-  describe('#reset', function () {
-    it('clears the internal state', function () {
-      docTitle.change('some title');
-      expect(document.title).to.be('some title - ' + MAIN_TITLE);
-
-      docTitle.reset();
-      expect(document.title).to.be(MAIN_TITLE);
-    });
-  });
-
-  describe('#change', function () {
-    it('writes the first param to as the first part of the doc name', function () {
-      expect(document.title).to.be(MAIN_TITLE);
-      docTitle.change('some secondary title');
-      expect(document.title).to.be('some secondary title - ' + MAIN_TITLE);
-    });
-  });
-
-  function decorateWithSpy(prop) {
-    return function ($delegate) {
-      sinon.spy($delegate, prop);
-      return $delegate;
-    };
-  }
-});
diff --git a/src/legacy/ui/public/doc_title/doc_title.d.ts b/src/legacy/ui/public/doc_title/doc_title.d.ts
deleted file mode 100644
index 8253a45850e191..00000000000000
--- a/src/legacy/ui/public/doc_title/doc_title.d.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export interface DocTitle {
-  change: (title: string) => void;
-}
-
-export const docTitle: DocTitle;
diff --git a/src/legacy/ui/public/doc_title/doc_title.js b/src/legacy/ui/public/doc_title/doc_title.js
deleted file mode 100644
index 096e49e7a6de86..00000000000000
--- a/src/legacy/ui/public/doc_title/doc_title.js
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { isArray } from 'lodash';
-import { uiModules } from '../modules';
-import { npStart } from '../new_platform';
-
-const npDocTitle = () => npStart.core.chrome.docTitle;
-
-function change(title) {
-  npDocTitle().change(isArray(title) ? title : [title]);
-}
-
-function reset() {
-  npDocTitle().reset();
-}
-
-export const docTitle = {
-  change,
-  reset,
-};
-
-uiModules.get('kibana').run(function ($rootScope) {
-  // always bind to the route events
-  $rootScope.$on('$routeChangeStart', docTitle.reset);
-});
diff --git a/src/legacy/ui/public/doc_title/index.js b/src/legacy/ui/public/doc_title/index.js
deleted file mode 100644
index 1507797cc749ca..00000000000000
--- a/src/legacy/ui/public/doc_title/index.js
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import './doc_title';
-
-export { docTitle } from './doc_title';
diff --git a/src/legacy/ui/public/documentation_links/__mocks__/documentation_links.ts b/src/legacy/ui/public/documentation_links/__mocks__/documentation_links.ts
deleted file mode 100644
index 3fe123c3ccb805..00000000000000
--- a/src/legacy/ui/public/documentation_links/__mocks__/documentation_links.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { docLinksServiceMock } from '../../../../../core/public/mocks';
-
-const { DOC_LINK_VERSION, ELASTIC_WEBSITE_URL, links } = docLinksServiceMock.createStartContract();
-
-export { DOC_LINK_VERSION, ELASTIC_WEBSITE_URL };
-export const documentationLinks = links;
diff --git a/src/legacy/ui/public/documentation_links/__tests__/documentation_links.js b/src/legacy/ui/public/documentation_links/__tests__/documentation_links.js
deleted file mode 100644
index 6c9cdd12422cfb..00000000000000
--- a/src/legacy/ui/public/documentation_links/__tests__/documentation_links.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import { documentationLinks } from '../documentation_links';
-import { metadata } from '../../metadata';
-
-const urlVersion = metadata.branch;
-
-describe('documentation link service', function () {
-  it("should inject Kibana's major.minor version into doc links", function () {
-    expect(documentationLinks.filebeat.configuration).to.contain(urlVersion);
-  });
-});
diff --git a/src/legacy/ui/public/documentation_links/documentation_links.ts b/src/legacy/ui/public/documentation_links/documentation_links.ts
index 45aba1a5121fb6..2520fb71801600 100644
--- a/src/legacy/ui/public/documentation_links/documentation_links.ts
+++ b/src/legacy/ui/public/documentation_links/documentation_links.ts
@@ -17,14 +17,12 @@
  * under the License.
  */
 
-import { npStart } from 'ui/new_platform';
-
 /*
   WARNING: The links in this file are validated during the docs build. This is accomplished with some regex magic that
   looks for these particular constants. As a result, we should not add new constants or change the existing ones.
   If you absolutely must make a change, talk to Clinton Gormley first so he can update his Perl scripts.
  */
-export const DOC_LINK_VERSION = npStart.core.docLinks.DOC_LINK_VERSION;
-export const ELASTIC_WEBSITE_URL = npStart.core.docLinks.ELASTIC_WEBSITE_URL;
+export const DOC_LINK_VERSION = 'stub';
+export const ELASTIC_WEBSITE_URL = 'stub';
 
-export const documentationLinks = npStart.core.docLinks.links;
+export const documentationLinks = {};
diff --git a/src/legacy/ui/public/documentation_links/get_doc_link.ts b/src/legacy/ui/public/documentation_links/get_doc_link.ts
deleted file mode 100644
index 7d0d8033e3a5fc..00000000000000
--- a/src/legacy/ui/public/documentation_links/get_doc_link.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { get } from 'lodash';
-import { documentationLinks } from './documentation_links';
-
-export const getDocLink = (id: string): string | undefined => get(documentationLinks, id);
diff --git a/src/legacy/ui/public/documentation_links/index.ts b/src/legacy/ui/public/documentation_links/index.ts
deleted file mode 100644
index 59499d3b8d9aa8..00000000000000
--- a/src/legacy/ui/public/documentation_links/index.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { ELASTIC_WEBSITE_URL, DOC_LINK_VERSION, documentationLinks } from './documentation_links';
-
-export { getDocLink } from './get_doc_link';
diff --git a/src/legacy/ui/public/dom_location.js b/src/legacy/ui/public/dom_location.js
deleted file mode 100644
index baf03ba4c4b1c7..00000000000000
--- a/src/legacy/ui/public/dom_location.js
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export function DomLocationProvider($window) {
-  return {
-    reload: function (forceFetch) {
-      $window.location.reload(forceFetch);
-    },
-
-    get href() {
-      return $window.location.href;
-    },
-
-    set href(val) {
-      return ($window.location.href = val);
-    },
-  };
-}
diff --git a/src/legacy/ui/public/elastic_charts/index.ts b/src/legacy/ui/public/elastic_charts/index.ts
deleted file mode 100644
index 661ea693102a73..00000000000000
--- a/src/legacy/ui/public/elastic_charts/index.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import chrome from 'ui/chrome';
-import { Theme, LIGHT_THEME, DARK_THEME } from '@elastic/charts';
-
-export function getChartTheme(): Theme {
-  const isDarkMode = chrome.getUiSettingsClient().get('theme:darkMode');
-  return isDarkMode ? DARK_THEME : LIGHT_THEME;
-}
diff --git a/src/legacy/ui/public/events.js b/src/legacy/ui/public/events.js
deleted file mode 100644
index 464c03d98b83f0..00000000000000
--- a/src/legacy/ui/public/events.js
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * @name Events
- *
- * @extends EventEmitter
- */
-
-import _ from 'lodash';
-import { EventEmitter } from 'events';
-import { fatalError } from './notify';
-import { createLegacyClass } from './utils/legacy_class';
-import { createDefer } from 'ui/promises';
-
-const location = 'EventEmitter';
-
-export function EventsProvider(Promise) {
-  createLegacyClass(Events).inherits(EventEmitter);
-  function Events() {
-    Events.Super.call(this);
-    this._listeners = {};
-    this._emitChain = Promise.resolve();
-  }
-
-  /**
-   * Listens for events
-   * @param {string} name - The name of the event
-   * @param {function} handler - The function to call when the event is triggered
-   * @return {Events} - this, for chaining
-   */
-  Events.prototype.on = function (name, handler) {
-    if (!Array.isArray(this._listeners[name])) {
-      this._listeners[name] = [];
-    }
-
-    const listener = {
-      handler: handler,
-    };
-    this._listeners[name].push(listener);
-
-    (function rebuildDefer() {
-      listener.defer = createDefer(Promise);
-      listener.resolved = listener.defer.promise.then(function (args) {
-        rebuildDefer();
-
-        // we ignore the completion of handlers, just watch for unhandled errors
-        Promise.resolve(handler.apply(handler, args)).catch((error) => fatalError(error, location));
-
-        // indicate to bluebird not to worry about this promise being a "runaway"
-        return null;
-      });
-    })();
-
-    return this;
-  };
-
-  /**
-   * Removes an event listener
-   * @param {string} [name] - The name of the event
-   * @param {function} [handler] - The handler to remove
-   * @return {Events} - this, for chaining
-   */
-  Events.prototype.off = function (name, handler) {
-    if (!name && !handler) {
-      this._listeners = {};
-      return this.removeAllListeners();
-    }
-
-    // exit early if there is not an event that matches
-    if (!this._listeners[name]) return this;
-
-    // If no hander remove all the events
-    if (!handler) {
-      delete this._listeners[name];
-    } else {
-      this._listeners[name] = _.filter(this._listeners[name], function (listener) {
-        return handler !== listener.handler;
-      });
-    }
-
-    return this;
-  };
-
-  /**
-   * Emits the event to all listeners
-   *
-   * @param {string} name - The name of the event.
-   * @param {any} [value] - The value that will be passed to all event handlers.
-   * @returns {Promise}
-   */
-  Events.prototype.emit = function (name) {
-    const self = this;
-    const args = _.tail(arguments);
-
-    if (!self._listeners[name]) {
-      return self._emitChain;
-    }
-
-    return Promise.map(self._listeners[name], function (listener) {
-      return (self._emitChain = self._emitChain.then(function () {
-        // Double check that off wasn't called after an emit, but before this is fired.
-        if (!self._listeners[name] || self._listeners[name].indexOf(listener) < 0) return;
-
-        listener.defer.resolve(args);
-        return listener.resolved;
-      }));
-    });
-  };
-
-  /**
-   * Get a list of the handler functions for a specific event
-   *
-   * @param  {string} name
-   * @return {array[function]}
-   */
-  Events.prototype.listeners = function (name) {
-    return _.map(this._listeners[name], 'handler');
-  };
-
-  return Events;
-}
diff --git a/src/legacy/ui/public/exit_full_screen/__snapshots__/exit_full_screen_button.test.js.snap b/src/legacy/ui/public/exit_full_screen/__snapshots__/exit_full_screen_button.test.js.snap
deleted file mode 100644
index ad13256c8245ad..00000000000000
--- a/src/legacy/ui/public/exit_full_screen/__snapshots__/exit_full_screen_button.test.js.snap
+++ /dev/null
@@ -1,53 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`is rendered 1`] = `
-<div>
-  <p
-    aria-live="polite"
-    class="euiScreenReaderOnly"
-  >
-    In full screen mode, press ESC to exit.
-  </p>
-  <div>
-    <button
-      aria-label="Exit full screen mode"
-      class="dshExitFullScreenButton"
-      data-test-subj="exitFullScreenModeLogo"
-    >
-      <span
-        class="euiFlexGroup euiFlexGroup--gutterSmall euiFlexGroup--alignItemsCenter euiFlexGroup--directionRow"
-      >
-        <div
-          class="euiFlexItem euiFlexItem--flexGrowZero"
-        >
-          <div
-            data-euiicon-type="logoElastic"
-          />
-        </div>
-        <div
-          class="euiFlexItem euiFlexItem--flexGrowZero"
-          data-test-subj="exitFullScreenModeText"
-        >
-          <div>
-            <div
-              class="euiText euiText--small dshExitFullScreenButton__text"
-            >
-              <p>
-                Exit full screen
-              </p>
-            </div>
-          </div>
-        </div>
-        <div
-          class="euiFlexItem euiFlexItem--flexGrowZero"
-        >
-          <div
-            class="dshExitFullScreenButton__icon"
-            data-euiicon-type="fullScreen"
-          />
-        </div>
-      </span>
-    </button>
-  </div>
-</div>
-`;
diff --git a/src/legacy/ui/public/exit_full_screen/_index.scss b/src/legacy/ui/public/exit_full_screen/_index.scss
deleted file mode 100644
index 33dff05e2a6878..00000000000000
--- a/src/legacy/ui/public/exit_full_screen/_index.scss
+++ /dev/null
@@ -1 +0,0 @@
-@import '../../../../plugins/kibana_react/public/exit_full_screen_button/index';
diff --git a/src/legacy/ui/public/exit_full_screen/exit_full_screen_button.test.js b/src/legacy/ui/public/exit_full_screen/exit_full_screen_button.test.js
deleted file mode 100644
index d4273c0fdb207a..00000000000000
--- a/src/legacy/ui/public/exit_full_screen/exit_full_screen_button.test.js
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-jest.mock(
-  'ui/chrome',
-  () => ({
-    getKibanaVersion: () => '6.0.0',
-    setVisible: () => {},
-  }),
-  { virtual: true }
-);
-
-import React from 'react';
-import { mountWithIntl, renderWithIntl } from 'test_utils/enzyme_helpers';
-import sinon from 'sinon';
-import chrome from 'ui/chrome';
-
-import { ExitFullScreenButton } from './exit_full_screen_button';
-
-import { keys } from '@elastic/eui';
-
-test('is rendered', () => {
-  const component = renderWithIntl(<ExitFullScreenButton onExitFullScreenMode={() => {}} />);
-
-  expect(component).toMatchSnapshot();
-});
-
-describe('onExitFullScreenMode', () => {
-  test('is called when the button is pressed', () => {
-    const onExitHandler = sinon.stub();
-
-    const component = mountWithIntl(<ExitFullScreenButton onExitFullScreenMode={onExitHandler} />);
-
-    component.find('button').simulate('click');
-
-    sinon.assert.calledOnce(onExitHandler);
-  });
-
-  test('is called when the ESC key is pressed', () => {
-    const onExitHandler = sinon.stub();
-
-    mountWithIntl(<ExitFullScreenButton onExitFullScreenMode={onExitHandler} />);
-
-    const escapeKeyEvent = new KeyboardEvent('keydown', { key: keys.ESCAPE });
-    document.dispatchEvent(escapeKeyEvent);
-
-    sinon.assert.calledOnce(onExitHandler);
-  });
-});
-
-describe('chrome.setVisible', () => {
-  test('is called with false when the component is rendered', () => {
-    chrome.setVisible = sinon.stub();
-
-    const component = mountWithIntl(<ExitFullScreenButton onExitFullScreenMode={() => {}} />);
-
-    component.find('button').simulate('click');
-
-    sinon.assert.calledOnce(chrome.setVisible);
-    sinon.assert.calledWith(chrome.setVisible, false);
-  });
-
-  test('is called with true the component is unmounted', () => {
-    const component = mountWithIntl(<ExitFullScreenButton onExitFullScreenMode={() => {}} />);
-
-    chrome.setVisible = sinon.stub();
-    component.unmount();
-
-    sinon.assert.calledOnce(chrome.setVisible);
-    sinon.assert.calledWith(chrome.setVisible, true);
-  });
-});
diff --git a/src/legacy/ui/public/exit_full_screen/exit_full_screen_button.tsx b/src/legacy/ui/public/exit_full_screen/exit_full_screen_button.tsx
deleted file mode 100644
index db4101010f6d67..00000000000000
--- a/src/legacy/ui/public/exit_full_screen/exit_full_screen_button.tsx
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React, { PureComponent } from 'react';
-import chrome from 'ui/chrome';
-import { ExitFullScreenButton as ExitFullScreenButtonUi } from '../../../../plugins/kibana_react/public';
-
-/**
- * DO NOT USE THIS COMPONENT, IT IS DEPRECATED.
- * Use the one in `src/plugins/kibana_react`.
- */
-
-interface Props {
-  onExitFullScreenMode: () => void;
-}
-
-export class ExitFullScreenButton extends PureComponent<Props> {
-  public UNSAFE_componentWillMount() {
-    chrome.setVisible(false);
-  }
-
-  public componentWillUnmount() {
-    chrome.setVisible(true);
-  }
-
-  public render() {
-    return <ExitFullScreenButtonUi onExitFullScreenMode={this.props.onExitFullScreenMode} />;
-  }
-}
diff --git a/src/legacy/ui/public/exit_full_screen/index.ts b/src/legacy/ui/public/exit_full_screen/index.ts
deleted file mode 100644
index a965fd776e0c29..00000000000000
--- a/src/legacy/ui/public/exit_full_screen/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { ExitFullScreenButton } from './exit_full_screen_button';
diff --git a/src/legacy/ui/public/flot-charts/API.md b/src/legacy/ui/public/flot-charts/API.md
deleted file mode 100644
index 699e2500f49420..00000000000000
--- a/src/legacy/ui/public/flot-charts/API.md
+++ /dev/null
@@ -1,1498 +0,0 @@
-# Flot Reference #
-
-**Table of Contents**
-
-[Introduction](#introduction)
-| [Data Format](#data-format)
-| [Plot Options](#plot-options)
-| [Customizing the legend](#customizing-the-legend)
-| [Customizing the axes](#customizing-the-axes)
-| [Multiple axes](#multiple-axes)
-| [Time series data](#time-series-data)
-| [Customizing the data series](#customizing-the-data-series)
-| [Customizing the grid](#customizing-the-grid)
-| [Specifying gradients](#specifying-gradients)
-| [Plot Methods](#plot-methods)
-| [Hooks](#hooks)
-| [Plugins](#plugins)
-| [Version number](#version-number)
-
----
-
-## Introduction ##
-
-Consider a call to the plot function:
-
-```js
-var plot = $.plot(placeholder, data, options)
-```
-
-The placeholder is a jQuery object or DOM element or jQuery expression
-that the plot will be put into. This placeholder needs to have its
-width and height set as explained in the [README](README.md) (go read that now if
-you haven't, it's short). The plot will modify some properties of the
-placeholder so it's recommended you simply pass in a div that you
-don't use for anything else. Make sure you check any fancy styling
-you apply to the div, e.g. background images have been reported to be a
-problem on IE 7.
-
-The plot function can also be used as a jQuery chainable property.  This form
-naturally can't return the plot object directly, but you can still access it
-via the 'plot' data key, like this:
-
-```js
-var plot = $("#placeholder").plot(data, options).data("plot");
-```
-
-The format of the data is documented below, as is the available
-options. The plot object returned from the call has some methods you
-can call. These are documented separately below.
-
-Note that in general Flot gives no guarantees if you change any of the
-objects you pass in to the plot function or get out of it since
-they're not necessarily deep-copied.
-
-
-## Data Format ##
-
-The data is an array of data series:
-
-```js
-[ series1, series2, ... ]
-```
-
-A series can either be raw data or an object with properties. The raw
-data format is an array of points:
-
-```js
-[ [x1, y1], [x2, y2], ... ]
-```
-
-E.g.
-
-```js
-[ [1, 3], [2, 14.01], [3.5, 3.14] ]
-```
-
-Note that to simplify the internal logic in Flot both the x and y
-values must be numbers (even if specifying time series, see below for
-how to do this). This is a common problem because you might retrieve
-data from the database and serialize them directly to JSON without
-noticing the wrong type. If you're getting mysterious errors, double
-check that you're inputting numbers and not strings.
-
-If a null is specified as a point or if one of the coordinates is null
-or couldn't be converted to a number, the point is ignored when
-drawing. As a special case, a null value for lines is interpreted as a
-line segment end, i.e. the points before and after the null value are
-not connected.
-
-Lines and points take two coordinates. For filled lines and bars, you
-can specify a third coordinate which is the bottom of the filled
-area/bar (defaults to 0).
-
-The format of a single series object is as follows:
-
-```js
-{
-    color: color or number
-    data: rawdata
-    label: string
-    lines: specific lines options
-    bars: specific bars options
-    points: specific points options
-    xaxis: number
-    yaxis: number
-    clickable: boolean
-    hoverable: boolean
-    shadowSize: number
-    highlightColor: color or number
-}
-```
-
-You don't have to specify any of them except the data, the rest are
-options that will get default values. Typically you'd only specify
-label and data, like this:
-
-```js
-{
-    label: "y = 3",
-    data: [[0, 3], [10, 3]]
-}
-```
-
-The label is used for the legend, if you don't specify one, the series
-will not show up in the legend.
-
-If you don't specify color, the series will get a color from the
-auto-generated colors. The color is either a CSS color specification
-(like "rgb(255, 100, 123)") or an integer that specifies which of
-auto-generated colors to select, e.g. 0 will get color no. 0, etc.
-
-The latter is mostly useful if you let the user add and remove series,
-in which case you can hard-code the color index to prevent the colors
-from jumping around between the series.
-
-The "xaxis" and "yaxis" options specify which axis to use. The axes
-are numbered from 1 (default), so { yaxis: 2} means that the series
-should be plotted against the second y axis.
-
-"clickable" and "hoverable" can be set to false to disable
-interactivity for specific series if interactivity is turned on in
-the plot, see below.
-
-The rest of the options are all documented below as they are the same
-as the default options passed in via the options parameter in the plot
-command. When you specify them for a specific data series, they will
-override the default options for the plot for that data series.
-
-Here's a complete example of a simple data specification:
-
-```js
-[ { label: "Foo", data: [ [10, 1], [17, -14], [30, 5] ] },
-  { label: "Bar", data: [ [11, 13], [19, 11], [30, -7] ] }
-]
-```
-
-
-## Plot Options ##
-
-All options are completely optional. They are documented individually
-below, to change them you just specify them in an object, e.g.
-
-```js
-var options = {
-    series: {
-        lines: { show: true },
-        points: { show: true }
-    }
-};
-	
-$.plot(placeholder, data, options);
-```
-
-
-## Customizing the legend ##
-
-```js
-legend: {
-    show: boolean
-    labelFormatter: null or (fn: string, series object -> string)
-    labelBoxBorderColor: color
-    noColumns: number
-    position: "ne" or "nw" or "se" or "sw"
-    margin: number of pixels or [x margin, y margin]
-    backgroundColor: null or color
-    backgroundOpacity: number between 0 and 1
-    container: null or jQuery object/DOM element/jQuery expression
-    sorted: null/false, true, "ascending", "descending", "reverse", or a comparator
-}
-```
-
-The legend is generated as a table with the data series labels and
-small label boxes with the color of the series. If you want to format
-the labels in some way, e.g. make them to links, you can pass in a
-function for "labelFormatter". Here's an example that makes them
-clickable:
-
-```js
-labelFormatter: function(label, series) {
-    // series is the series object for the label
-    return '<a href="#' + label + '">' + label + '</a>';
-}
-```
-
-To prevent a series from showing up in the legend, simply have the function
-return null.
-
-"noColumns" is the number of columns to divide the legend table into.
-"position" specifies the overall placement of the legend within the
-plot (top-right, top-left, etc.) and margin the distance to the plot
-edge (this can be either a number or an array of two numbers like [x,
-y]). "backgroundColor" and "backgroundOpacity" specifies the
-background. The default is a partly transparent auto-detected
-background.
-
-If you want the legend to appear somewhere else in the DOM, you can
-specify "container" as a jQuery object/expression to put the legend
-table into. The "position" and "margin" etc. options will then be
-ignored. Note that Flot will overwrite the contents of the container.
-
-Legend entries appear in the same order as their series by default. If "sorted"
-is "reverse" then they appear in the opposite order from their series. To sort
-them alphabetically, you can specify true, "ascending" or "descending", where
-true and "ascending" are equivalent.
-
-You can also provide your own comparator function that accepts two
-objects with "label" and "color" properties, and returns zero if they
-are equal, a positive value if the first is greater than the second,
-and a negative value if the first is less than the second.
-
-```js
-sorted: function(a, b) {
-    // sort alphabetically in ascending order
-    return a.label == b.label ? 0 : (
-        a.label > b.label ? 1 : -1
-    )
-}
-```
-
-
-## Customizing the axes ##
-
-```js
-xaxis, yaxis: {
-    show: null or true/false
-    position: "bottom" or "top" or "left" or "right"
-    mode: null or "time" ("time" requires jquery.flot.time.js plugin)
-    timezone: null, "browser" or timezone (only makes sense for mode: "time")
-
-    color: null or color spec
-    tickColor: null or color spec
-    font: null or font spec object
-
-    min: null or number
-    max: null or number
-    autoscaleMargin: null or number
-    
-    transform: null or fn: number -> number
-    inverseTransform: null or fn: number -> number
-    
-    ticks: null or number or ticks array or (fn: axis -> ticks array)
-    tickSize: number or array
-    minTickSize: number or array
-    tickFormatter: (fn: number, object -> string) or string
-    tickDecimals: null or number
-
-    labelWidth: null or number
-    labelHeight: null or number
-    reserveSpace: null or true
-    
-    tickLength: null or number
-
-    alignTicksWithAxis: null or number
-}
-```
-
-All axes have the same kind of options. The following describes how to
-configure one axis, see below for what to do if you've got more than
-one x axis or y axis.
-
-If you don't set the "show" option (i.e. it is null), visibility is
-auto-detected, i.e. the axis will show up if there's data associated
-with it. You can override this by setting the "show" option to true or
-false.
-
-The "position" option specifies where the axis is placed, bottom or
-top for x axes, left or right for y axes. The "mode" option determines
-how the data is interpreted, the default of null means as decimal
-numbers. Use "time" for time series data; see the time series data
-section. The time plugin (jquery.flot.time.js) is required for time
-series support.
-
-The "color" option determines the color of the line and ticks for the axis, and
-defaults to the grid color with transparency. For more fine-grained control you
-can also set the color of the ticks separately with "tickColor".
-
-You can customize the font and color used to draw the axis tick labels with CSS
-or directly via the "font" option. When "font" is null - the default - each
-tick label is given the 'flot-tick-label' class. For compatibility with Flot
-0.7 and earlier the labels are also given the 'tickLabel' class, but this is
-deprecated and scheduled to be removed with the release of version 1.0.0.
-
-To enable more granular control over styles, labels are divided between a set
-of text containers, with each holding the labels for one axis. These containers
-are given the classes 'flot-[x|y]-axis', and 'flot-[x|y]#-axis', where '#' is
-the number of the axis when there are multiple axes.  For example, the x-axis
-labels for a simple plot with only a single x-axis might look like this:
-
-```html
-<div class='flot-x-axis flot-x1-axis'>
-    <div class='flot-tick-label'>January 2013</div>
-    ...
-</div>
-```
-
-For direct control over label styles you can also provide "font" as an object
-with this format:
-
-```js
-{
-    size: 11,
-    lineHeight: 13,
-    style: "italic",
-    weight: "bold",
-    family: "sans-serif",
-    variant: "small-caps",
-    color: "#545454"
-}
-```
-
-The size and lineHeight must be expressed in pixels; CSS units such as 'em'
-or 'smaller' are not allowed.
-
-The options "min"/"max" are the precise minimum/maximum value on the
-scale. If you don't specify either of them, a value will automatically
-be chosen based on the minimum/maximum data values. Note that Flot
-always examines all the data values you feed to it, even if a
-restriction on another axis may make some of them invisible (this
-makes interactive use more stable).
-
-The "autoscaleMargin" is a bit esoteric: it's the fraction of margin
-that the scaling algorithm will add to avoid that the outermost points
-ends up on the grid border. Note that this margin is only applied when
-a min or max value is not explicitly set. If a margin is specified,
-the plot will furthermore extend the axis end-point to the nearest
-whole tick. The default value is "null" for the x axes and 0.02 for y
-axes which seems appropriate for most cases.
-
-"transform" and "inverseTransform" are callbacks you can put in to
-change the way the data is drawn. You can design a function to
-compress or expand certain parts of the axis non-linearly, e.g.
-suppress weekends or compress far away points with a logarithm or some
-other means. When Flot draws the plot, each value is first put through
-the transform function. Here's an example, the x axis can be turned
-into a natural logarithm axis with the following code:
-
-```js
-xaxis: {
-    transform: function (v) { return Math.log(v); },
-    inverseTransform: function (v) { return Math.exp(v); }
-}
-```
-
-Similarly, for reversing the y axis so the values appear in inverse
-order:
-
-```js
-yaxis: {
-    transform: function (v) { return -v; },
-    inverseTransform: function (v) { return -v; }
-}
-```
-
-Note that for finding extrema, Flot assumes that the transform
-function does not reorder values (it should be monotone).
-
-The inverseTransform is simply the inverse of the transform function
-(so v == inverseTransform(transform(v)) for all relevant v). It is
-required for converting from canvas coordinates to data coordinates,
-e.g. for a mouse interaction where a certain pixel is clicked. If you
-don't use any interactive features of Flot, you may not need it.
-
-
-The rest of the options deal with the ticks.
-
-If you don't specify any ticks, a tick generator algorithm will make
-some for you. The algorithm has two passes. It first estimates how
-many ticks would be reasonable and uses this number to compute a nice
-round tick interval size. Then it generates the ticks.
-
-You can specify how many ticks the algorithm aims for by setting
-"ticks" to a number. The algorithm always tries to generate reasonably
-round tick values so even if you ask for three ticks, you might get
-five if that fits better with the rounding. If you don't want any
-ticks at all, set "ticks" to 0 or an empty array.
-
-Another option is to skip the rounding part and directly set the tick
-interval size with "tickSize". If you set it to 2, you'll get ticks at
-2, 4, 6, etc. Alternatively, you can specify that you just don't want
-ticks at a size less than a specific tick size with "minTickSize".
-Note that for time series, the format is an array like [2, "month"],
-see the next section.
-
-If you want to completely override the tick algorithm, you can specify
-an array for "ticks", either like this:
-
-```js
-ticks: [0, 1.2, 2.4]
-```
-
-Or like this where the labels are also customized:
-
-```js
-ticks: [[0, "zero"], [1.2, "one mark"], [2.4, "two marks"]]
-```
-
-You can mix the two if you like.
-  
-For extra flexibility you can specify a function as the "ticks"
-parameter. The function will be called with an object with the axis
-min and max and should return a ticks array. Here's a simplistic tick
-generator that spits out intervals of pi, suitable for use on the x
-axis for trigonometric functions:
-
-```js
-function piTickGenerator(axis) {
-    var res = [], i = Math.floor(axis.min / Math.PI);
-    do {
-        var v = i * Math.PI;
-        res.push([v, i + "\u03c0"]);
-        ++i;
-    } while (v < axis.max);
-    return res;
-}
-```
-
-You can control how the ticks look like with "tickDecimals", the
-number of decimals to display (default is auto-detected).
-
-Alternatively, for ultimate control over how ticks are formatted you can
-provide a function to "tickFormatter". The function is passed two
-parameters, the tick value and an axis object with information, and
-should return a string. The default formatter looks like this:
-
-```js
-function formatter(val, axis) {
-    return val.toFixed(axis.tickDecimals);
-}
-```
-
-The axis object has "min" and "max" with the range of the axis,
-"tickDecimals" with the number of decimals to round the value to and
-"tickSize" with the size of the interval between ticks as calculated
-by the automatic axis scaling algorithm (or specified by you). Here's
-an example of a custom formatter:
-
-```js
-function suffixFormatter(val, axis) {
-    if (val > 1000000)
-        return (val / 1000000).toFixed(axis.tickDecimals) + " MB";
-    else if (val > 1000)
-        return (val / 1000).toFixed(axis.tickDecimals) + " kB";
-    else
-        return val.toFixed(axis.tickDecimals) + " B";
-}
-```
-
-"labelWidth" and "labelHeight" specifies a fixed size of the tick
-labels in pixels. They're useful in case you need to align several
-plots. "reserveSpace" means that even if an axis isn't shown, Flot
-should reserve space for it - it is useful in combination with
-labelWidth and labelHeight for aligning multi-axis charts.
-
-"tickLength" is the length of the tick lines in pixels. By default, the
-innermost axes will have ticks that extend all across the plot, while
-any extra axes use small ticks. A value of null means use the default,
-while a number means small ticks of that length - set it to 0 to hide
-the lines completely.
-
-If you set "alignTicksWithAxis" to the number of another axis, e.g.
-alignTicksWithAxis: 1, Flot will ensure that the autogenerated ticks
-of this axis are aligned with the ticks of the other axis. This may
-improve the looks, e.g. if you have one y axis to the left and one to
-the right, because the grid lines will then match the ticks in both
-ends. The trade-off is that the forced ticks won't necessarily be at
-natural places.
-
-
-## Multiple axes ##
-
-If you need more than one x axis or y axis, you need to specify for
-each data series which axis they are to use, as described under the
-format of the data series, e.g. { data: [...], yaxis: 2 } specifies
-that a series should be plotted against the second y axis.
-
-To actually configure that axis, you can't use the xaxis/yaxis options
-directly - instead there are two arrays in the options:
-
-```js
-xaxes: []
-yaxes: []
-```
-
-Here's an example of configuring a single x axis and two y axes (we
-can leave options of the first y axis empty as the defaults are fine):
-
-```js
-{
-    xaxes: [ { position: "top" } ],
-    yaxes: [ { }, { position: "right", min: 20 } ]
-}
-```
-
-The arrays get their default values from the xaxis/yaxis settings, so
-say you want to have all y axes start at zero, you can simply specify
-yaxis: { min: 0 } instead of adding a min parameter to all the axes.
-
-Generally, the various interfaces in Flot dealing with data points
-either accept an xaxis/yaxis parameter to specify which axis number to
-use (starting from 1), or lets you specify the coordinate directly as
-x2/x3/... or x2axis/x3axis/... instead of "x" or "xaxis".
-
-
-## Time series data ##
-
-Please note that it is now required to include the time plugin,
-jquery.flot.time.js, for time series support.
-
-Time series are a bit more difficult than scalar data because
-calendars don't follow a simple base 10 system. For many cases, Flot
-abstracts most of this away, but it can still be a bit difficult to
-get the data into Flot. So we'll first discuss the data format.
-
-The time series support in Flot is based on JavaScript timestamps,
-i.e. everywhere a time value is expected or handed over, a JavaScript
-timestamp number is used. This is a number, not a Date object. A
-JavaScript timestamp is the number of milliseconds since January 1,
-1970 00:00:00 UTC. This is almost the same as Unix timestamps, except it's
-in milliseconds, so remember to multiply by 1000!
-
-You can see a timestamp like this
-
-```js
-alert((new Date()).getTime())
-```
-
-There are different schools of thought when it comes to display of
-timestamps. Many will want the timestamps to be displayed according to
-a certain time zone, usually the time zone in which the data has been
-produced. Some want the localized experience, where the timestamps are
-displayed according to the local time of the visitor. Flot supports
-both. Optionally you can include a third-party library to get
-additional timezone support.
-
-Default behavior is that Flot always displays timestamps according to
-UTC. The reason being that the core JavaScript Date object does not
-support other fixed time zones. Often your data is at another time
-zone, so it may take a little bit of tweaking to work around this
-limitation.
-
-The easiest way to think about it is to pretend that the data
-production time zone is UTC, even if it isn't. So if you have a
-datapoint at 2002-02-20 08:00, you can generate a timestamp for eight
-o'clock UTC even if it really happened eight o'clock UTC+0200.
-
-In PHP you can get an appropriate timestamp with:
-
-```php
-strtotime("2002-02-20 UTC") * 1000
-```
-
-In Python you can get it with something like:
-
-```python
-calendar.timegm(datetime_object.timetuple()) * 1000
-```
-In Ruby you can get it using the `#to_i` method on the
-[`Time`](http://apidock.com/ruby/Time/to_i) object. If you're using the
-`active_support` gem (default for Ruby on Rails applications) `#to_i` is also
-available on the `DateTime` and `ActiveSupport::TimeWithZone` objects. You
-simply need to multiply the result by 1000:
-
-```ruby
-Time.now.to_i * 1000     # => 1383582043000
-# ActiveSupport examples:
-DateTime.now.to_i * 1000 # => 1383582043000
-ActiveSupport::TimeZone.new('Asia/Shanghai').now.to_i * 1000
-# => 1383582043000
-```
-
-In .NET you can get it with something like:
-
-```aspx
-public static int GetJavaScriptTimestamp(System.DateTime input)
-{
-    System.TimeSpan span = new System.TimeSpan(System.DateTime.Parse("1/1/1970").Ticks);
-    System.DateTime time = input.Subtract(span);
-    return (long)(time.Ticks / 10000);
-}
-```
-
-JavaScript also has some support for parsing date strings, so it is
-possible to generate the timestamps manually client-side.
-
-If you've already got the real UTC timestamp, it's too late to use the
-pretend trick described above. But you can fix up the timestamps by
-adding the time zone offset, e.g. for UTC+0200 you would add 2 hours
-to the UTC timestamp you got. Then it'll look right on the plot. Most
-programming environments have some means of getting the timezone
-offset for a specific date (note that you need to get the offset for
-each individual timestamp to account for daylight savings).
-
-The alternative with core JavaScript is to interpret the timestamps
-according to the time zone that the visitor is in, which means that
-the ticks will shift with the time zone and daylight savings of each
-visitor. This behavior is enabled by setting the axis option
-"timezone" to the value "browser".
-
-If you need more time zone functionality than this, there is still
-another option. If you include the "timezone-js" library
-<https://github.com/mde/timezone-js> in the page and set axis.timezone
-to a value recognized by said library, Flot will use timezone-js to
-interpret the timestamps according to that time zone.
-
-Once you've gotten the timestamps into the data and specified "time"
-as the axis mode, Flot will automatically generate relevant ticks and
-format them. As always, you can tweak the ticks via the "ticks" option
-- just remember that the values should be timestamps (numbers), not
-Date objects.
-
-Tick generation and formatting can also be controlled separately
-through the following axis options:
-
-```js
-minTickSize: array
-timeformat: null or format string
-monthNames: null or array of size 12 of strings
-dayNames: null or array of size 7 of strings
-twelveHourClock: boolean
-```
-
-Here "timeformat" is a format string to use. You might use it like
-this:
-
-```js
-xaxis: {
-    mode: "time",
-    timeformat: "%Y/%m/%d"
-}
-```
-
-This will result in tick labels like "2000/12/24". A subset of the
-standard strftime specifiers are supported (plus the nonstandard %q):
-
-```js
-%a: weekday name (customizable)
-%b: month name (customizable)
-%d: day of month, zero-padded (01-31)
-%e: day of month, space-padded ( 1-31)
-%H: hours, 24-hour time, zero-padded (00-23)
-%I: hours, 12-hour time, zero-padded (01-12)
-%m: month, zero-padded (01-12)
-%M: minutes, zero-padded (00-59)
-%q: quarter (1-4)
-%S: seconds, zero-padded (00-59)
-%y: year (two digits)
-%Y: year (four digits)
-%p: am/pm
-%P: AM/PM (uppercase version of %p)
-%w: weekday as number (0-6, 0 being Sunday)
-```
-
-Flot 0.8 switched from %h to the standard %H hours specifier. The %h specifier
-is still available, for backwards-compatibility, but is deprecated and
-scheduled to be removed permanently with the release of version 1.0.
-
-You can customize the month names with the "monthNames" option. For
-instance, for Danish you might specify:
-
-```js
-monthNames: ["jan", "feb", "mar", "apr", "maj", "jun", "jul", "aug", "sep", "okt", "nov", "dec"]
-```
-
-Similarly you can customize the weekday names with the "dayNames"
-option. An example in French:
-
-```js
-dayNames: ["dim", "lun", "mar", "mer", "jeu", "ven", "sam"]
-```
-
-If you set "twelveHourClock" to true, the autogenerated timestamps
-will use 12 hour AM/PM timestamps instead of 24 hour. This only
-applies if you have not set "timeformat". Use the "%I" and "%p" or
-"%P" options if you want to build your own format string with 12-hour
-times.
-
-If the Date object has a strftime property (and it is a function), it
-will be used instead of the built-in formatter. Thus you can include
-a strftime library such as http://hacks.bluesmoon.info/strftime/ for
-more powerful date/time formatting.
-
-If everything else fails, you can control the formatting by specifying
-a custom tick formatter function as usual. Here's a simple example
-which will format December 24 as 24/12:
-
-```js
-tickFormatter: function (val, axis) {
-    var d = new Date(val);
-    return d.getUTCDate() + "/" + (d.getUTCMonth() + 1);
-}
-```
-
-Note that for the time mode "tickSize" and "minTickSize" are a bit
-special in that they are arrays on the form "[value, unit]" where unit
-is one of "second", "minute", "hour", "day", "month" and "year". So
-you can specify
-
-```js
-minTickSize: [1, "month"]
-```
-
-to get a tick interval size of at least 1 month and correspondingly,
-if axis.tickSize is [2, "day"] in the tick formatter, the ticks have
-been produced with two days in-between.
-
-
-## Customizing the data series ##
-
-```js
-series: {
-    lines, points, bars: {
-        show: boolean
-        lineWidth: number
-        fill: boolean or number
-        fillColor: null or color/gradient
-    }
-
-    lines, bars: {
-        zero: boolean
-    }
-
-    points: {
-        radius: number
-        symbol: "circle" or function
-    }
-
-    bars: {
-        barWidth: number
-        align: "left", "right" or "center"
-        horizontal: boolean
-    }
-
-    lines: {
-        steps: boolean
-    }
-
-    shadowSize: number
-    highlightColor: color or number
-}
-
-colors: [ color1, color2, ... ]
-```
-
-The options inside "series: {}" are copied to each of the series. So
-you can specify that all series should have bars by putting it in the
-global options, or override it for individual series by specifying
-bars in a particular the series object in the array of data.
-  
-The most important options are "lines", "points" and "bars" that
-specify whether and how lines, points and bars should be shown for
-each data series. In case you don't specify anything at all, Flot will
-default to showing lines (you can turn this off with
-lines: { show: false }). You can specify the various types
-independently of each other, and Flot will happily draw each of them
-in turn (this is probably only useful for lines and points), e.g.
-
-```js
-var options = {
-    series: {
-        lines: { show: true, fill: true, fillColor: "rgba(255, 255, 255, 0.8)" },
-        points: { show: true, fill: false }
-    }
-};
-```
-
-"lineWidth" is the thickness of the line or outline in pixels. You can
-set it to 0 to prevent a line or outline from being drawn; this will
-also hide the shadow.
-
-"fill" is whether the shape should be filled. For lines, this produces
-area graphs. You can use "fillColor" to specify the color of the fill.
-If "fillColor" evaluates to false (default for everything except
-points which are filled with white), the fill color is auto-set to the
-color of the data series. You can adjust the opacity of the fill by
-setting fill to a number between 0 (fully transparent) and 1 (fully
-opaque).
-
-For bars, fillColor can be a gradient, see the gradient documentation
-below. "barWidth" is the width of the bars in units of the x axis (or
-the y axis if "horizontal" is true), contrary to most other measures
-that are specified in pixels. For instance, for time series the unit
-is milliseconds so 24 * 60 * 60 * 1000 produces bars with the width of
-a day. "align" specifies whether a bar should be left-aligned
-(default), right-aligned or centered on top of the value it represents. 
-When "horizontal" is on, the bars are drawn horizontally, i.e. from the 
-y axis instead of the x axis; note that the bar end points are still
-defined in the same way so you'll probably want to swap the
-coordinates if you've been plotting vertical bars first.
-
-Area and bar charts normally start from zero, regardless of the data's range.
-This is because they convey information through size, and starting from a
-different value would distort their meaning. In cases where the fill is purely
-for decorative purposes, however, "zero" allows you to override this behavior.
-It defaults to true for filled lines and bars; setting it to false tells the
-series to use the same automatic scaling as an un-filled line.
-
-For lines, "steps" specifies whether two adjacent data points are
-connected with a straight (possibly diagonal) line or with first a
-horizontal and then a vertical line. Note that this transforms the
-data by adding extra points.
-
-For points, you can specify the radius and the symbol. The only
-built-in symbol type is circles, for other types you can use a plugin
-or define them yourself by specifying a callback:
-
-```js
-function cross(ctx, x, y, radius, shadow) {
-    var size = radius * Math.sqrt(Math.PI) / 2;
-    ctx.moveTo(x - size, y - size);
-    ctx.lineTo(x + size, y + size);
-    ctx.moveTo(x - size, y + size);
-    ctx.lineTo(x + size, y - size);
-}
-```
-
-The parameters are the drawing context, x and y coordinates of the
-center of the point, a radius which corresponds to what the circle
-would have used and whether the call is to draw a shadow (due to
-limited canvas support, shadows are currently faked through extra
-draws). It's good practice to ensure that the area covered by the
-symbol is the same as for the circle with the given radius, this
-ensures that all symbols have approximately the same visual weight.
-
-"shadowSize" is the default size of shadows in pixels. Set it to 0 to
-remove shadows.
-
-"highlightColor" is the default color of the translucent overlay used
-to highlight the series when the mouse hovers over it.
-
-The "colors" array specifies a default color theme to get colors for
-the data series from. You can specify as many colors as you like, like
-this:
-
-```js
-colors: ["#d18b2c", "#dba255", "#919733"]
-```
-
-If there are more data series than colors, Flot will try to generate
-extra colors by lightening and darkening colors in the theme.
-
-
-## Customizing the grid ##
-
-```js
-grid: {
-    show: boolean
-    aboveData: boolean
-    color: color
-    backgroundColor: color/gradient or null
-    margin: number or margin object
-    labelMargin: number
-    axisMargin: number
-    markings: array of markings or (fn: axes -> array of markings)
-    borderWidth: number or object with "top", "right", "bottom" and "left" properties with different widths
-    borderColor: color or null or object with "top", "right", "bottom" and "left" properties with different colors
-    minBorderMargin: number or null
-    clickable: boolean
-    hoverable: boolean
-    autoHighlight: boolean
-    mouseActiveRadius: number
-}
-
-interaction: {
-    redrawOverlayInterval: number or -1
-}
-```
-
-The grid is the thing with the axes and a number of ticks. Many of the
-things in the grid are configured under the individual axes, but not
-all. "color" is the color of the grid itself whereas "backgroundColor"
-specifies the background color inside the grid area, here null means
-that the background is transparent. You can also set a gradient, see
-the gradient documentation below.
-
-You can turn off the whole grid including tick labels by setting
-"show" to false. "aboveData" determines whether the grid is drawn
-above the data or below (below is default).
-
-"margin" is the space in pixels between the canvas edge and the grid,
-which can be either a number or an object with individual margins for
-each side, in the form:
-
-```js
-margin: {
-    top: top margin in pixels
-    left: left margin in pixels
-    bottom: bottom margin in pixels
-    right: right margin in pixels
-}
-```
-
-"labelMargin" is the space in pixels between tick labels and axis
-line, and "axisMargin" is the space in pixels between axes when there
-are two next to each other.
-
-"borderWidth" is the width of the border around the plot. Set it to 0
-to disable the border. Set it to an object with "top", "right",
-"bottom" and "left" properties to use different widths. You can
-also set "borderColor" if you want the border to have a different color
-than the grid lines. Set it to an object with "top", "right", "bottom"
-and "left" properties to use different colors. "minBorderMargin" controls
-the default minimum margin around the border - it's used to make sure
-that points aren't accidentally clipped by the canvas edge so by default
-the value is computed from the point radius.
-
-"markings" is used to draw simple lines and rectangular areas in the
-background of the plot. You can either specify an array of ranges on
-the form { xaxis: { from, to }, yaxis: { from, to } } (with multiple
-axes, you can specify coordinates for other axes instead, e.g. as
-x2axis/x3axis/...) or with a function that returns such an array given
-the axes for the plot in an object as the first parameter.
-
-You can set the color of markings by specifying "color" in the ranges
-object. Here's an example array:
-
-```js
-markings: [ { xaxis: { from: 0, to: 2 }, yaxis: { from: 10, to: 10 }, color: "#bb0000" }, ... ]
-```
-
-If you leave out one of the values, that value is assumed to go to the
-border of the plot. So for example if you only specify { xaxis: {
-from: 0, to: 2 } } it means an area that extends from the top to the
-bottom of the plot in the x range 0-2.
-
-A line is drawn if from and to are the same, e.g.
-
-```js
-markings: [ { yaxis: { from: 1, to: 1 } }, ... ]
-```
-
-would draw a line parallel to the x axis at y = 1. You can control the
-line width with "lineWidth" in the range object.
-
-An example function that makes vertical stripes might look like this:
-
-```js
-markings: function (axes) {
-    var markings = [];
-    for (var x = Math.floor(axes.xaxis.min); x < axes.xaxis.max; x += 2)
-        markings.push({ xaxis: { from: x, to: x + 1 } });
-    return markings;
-}
-```
-
-If you set "clickable" to true, the plot will listen for click events
-on the plot area and fire a "plotclick" event on the placeholder with
-a position and a nearby data item object as parameters. The coordinates
-are available both in the unit of the axes (not in pixels) and in
-global screen coordinates.
-
-Likewise, if you set "hoverable" to true, the plot will listen for
-mouse move events on the plot area and fire a "plothover" event with
-the same parameters as the "plotclick" event. If "autoHighlight" is
-true (the default), nearby data items are highlighted automatically.
-If needed, you can disable highlighting and control it yourself with
-the highlight/unhighlight plot methods described elsewhere.
-
-You can use "plotclick" and "plothover" events like this:
-
-```js
-$.plot($("#placeholder"), [ d ], { grid: { clickable: true } });
-
-$("#placeholder").bind("plotclick", function (event, pos, item) {
-    alert("You clicked at " + pos.x + ", " + pos.y);
-    // axis coordinates for other axes, if present, are in pos.x2, pos.x3, ...
-    // if you need global screen coordinates, they are pos.pageX, pos.pageY
-
-    if (item) {
-        highlight(item.series, item.datapoint);
-        alert("You clicked a point!");
-    }
-});
-```
-
-The item object in this example is either null or a nearby object on the form:
-
-```js
-item: {
-    datapoint: the point, e.g. [0, 2]
-    dataIndex: the index of the point in the data array
-    series: the series object
-    seriesIndex: the index of the series
-    pageX, pageY: the global screen coordinates of the point
-}
-```
-
-For instance, if you have specified the data like this 
-
-```js
-$.plot($("#placeholder"), [ { label: "Foo", data: [[0, 10], [7, 3]] } ], ...);
-```
-
-and the mouse is near the point (7, 3), "datapoint" is [7, 3],
-"dataIndex" will be 1, "series" is a normalized series object with
-among other things the "Foo" label in series.label and the color in
-series.color, and "seriesIndex" is 0. Note that plugins and options
-that transform the data can shift the indexes from what you specified
-in the original data array.
-
-If you use the above events to update some other information and want
-to clear out that info in case the mouse goes away, you'll probably
-also need to listen to "mouseout" events on the placeholder div.
-
-"mouseActiveRadius" specifies how far the mouse can be from an item
-and still activate it. If there are two or more points within this
-radius, Flot chooses the closest item. For bars, the top-most bar
-(from the latest specified data series) is chosen.
-
-If you want to disable interactivity for a specific data series, you
-can set "hoverable" and "clickable" to false in the options for that
-series, like this:
-
-```js
-{ data: [...], label: "Foo", clickable: false }
-```
-
-"redrawOverlayInterval" specifies the maximum time to delay a redraw
-of interactive things (this works as a rate limiting device). The
-default is capped to 60 frames per second. You can set it to -1 to
-disable the rate limiting.
-
-
-## Specifying gradients ##
-
-A gradient is specified like this:
-
-```js
-{ colors: [ color1, color2, ... ] }
-```
-
-For instance, you might specify a background on the grid going from
-black to gray like this:
-
-```js
-grid: {
-    backgroundColor: { colors: ["#000", "#999"] }
-}
-```
-
-For the series you can specify the gradient as an object that
-specifies the scaling of the brightness and the opacity of the series
-color, e.g.
-
-```js
-{ colors: [{ opacity: 0.8 }, { brightness: 0.6, opacity: 0.8 } ] }
-```
-
-where the first color simply has its alpha scaled, whereas the second
-is also darkened. For instance, for bars the following makes the bars
-gradually disappear, without outline:
-
-```js
-bars: {
-    show: true,
-    lineWidth: 0,
-    fill: true,
-    fillColor: { colors: [ { opacity: 0.8 }, { opacity: 0.1 } ] }
-}
-```
-
-Flot currently only supports vertical gradients drawn from top to
-bottom because that's what works with IE.
-
-
-## Plot Methods ##
-
-The Plot object returned from the plot function has some methods you
-can call:
-
- - highlight(series, datapoint)
-
-    Highlight a specific datapoint in the data series. You can either
-    specify the actual objects, e.g. if you got them from a
-    "plotclick" event, or you can specify the indices, e.g.
-    highlight(1, 3) to highlight the fourth point in the second series
-    (remember, zero-based indexing).
-
- - unhighlight(series, datapoint) or unhighlight()
-
-    Remove the highlighting of the point, same parameters as
-    highlight.
-
-    If you call unhighlight with no parameters, e.g. as
-    plot.unhighlight(), all current highlights are removed.
-
- - setData(data)
-
-    You can use this to reset the data used. Note that axis scaling,
-    ticks, legend etc. will not be recomputed (use setupGrid() to do
-    that). You'll probably want to call draw() afterwards.
-
-    You can use this function to speed up redrawing a small plot if
-    you know that the axes won't change. Put in the new data with
-    setData(newdata), call draw(), and you're good to go. Note that
-    for large datasets, almost all the time is consumed in draw()
-    plotting the data so in this case don't bother.
-
- - setupGrid()
-
-    Recalculate and set axis scaling, ticks, legend etc.
-
-    Note that because of the drawing model of the canvas, this
-    function will immediately redraw (actually reinsert in the DOM)
-    the labels and the legend, but not the actual tick lines because
-    they're drawn on the canvas. You need to call draw() to get the
-    canvas redrawn.
-
- - draw()
-
-    Redraws the plot canvas.
-
- - triggerRedrawOverlay()
-
-    Schedules an update of an overlay canvas used for drawing
-    interactive things like a selection and point highlights. This
-    is mostly useful for writing plugins. The redraw doesn't happen
-    immediately, instead a timer is set to catch multiple successive
-    redraws (e.g. from a mousemove). You can get to the overlay by
-    setting up a drawOverlay hook.
-
- - width()/height()
-
-    Gets the width and height of the plotting area inside the grid.
-    This is smaller than the canvas or placeholder dimensions as some
-    extra space is needed (e.g. for labels).
-
- - offset()
-
-    Returns the offset of the plotting area inside the grid relative
-    to the document, useful for instance for calculating mouse
-    positions (event.pageX/Y minus this offset is the pixel position
-    inside the plot).
-
- - pointOffset({ x: xpos, y: ypos })
-
-    Returns the calculated offset of the data point at (x, y) in data
-    space within the placeholder div. If you are working with multiple
-    axes, you can specify the x and y axis references, e.g. 
-
-    ```js
-      o = pointOffset({ x: xpos, y: ypos, xaxis: 2, yaxis: 3 })
-      // o.left and o.top now contains the offset within the div
-    ````
-
- - resize()
-
-    Tells Flot to resize the drawing canvas to the size of the
-    placeholder. You need to run setupGrid() and draw() afterwards as
-    canvas resizing is a destructive operation. This is used
-    internally by the resize plugin.
-
- - shutdown()
-
-    Cleans up any event handlers Flot has currently registered. This
-    is used internally.
-
-There are also some members that let you peek inside the internal
-workings of Flot which is useful in some cases. Note that if you change
-something in the objects returned, you're changing the objects used by
-Flot to keep track of its state, so be careful.
-
-  - getData()
-
-    Returns an array of the data series currently used in normalized
-    form with missing settings filled in according to the global
-    options. So for instance to find out what color Flot has assigned
-    to the data series, you could do this:
-
-    ```js
-    var series = plot.getData();
-    for (var i = 0; i < series.length; ++i)
-        alert(series[i].color);
-    ```
-
-    A notable other interesting field besides color is datapoints
-    which has a field "points" with the normalized data points in a
-    flat array (the field "pointsize" is the increment in the flat
-    array to get to the next point so for a dataset consisting only of
-    (x,y) pairs it would be 2).
-
-  - getAxes()
-
-    Gets an object with the axes. The axes are returned as the
-    attributes of the object, so for instance getAxes().xaxis is the
-    x axis.
-
-    Various things are stuffed inside an axis object, e.g. you could
-    use getAxes().xaxis.ticks to find out what the ticks are for the
-    xaxis. Two other useful attributes are p2c and c2p, functions for
-    transforming from data point space to the canvas plot space and
-    back. Both returns values that are offset with the plot offset.
-    Check the Flot source code for the complete set of attributes (or
-    output an axis with console.log() and inspect it).
-
-    With multiple axes, the extra axes are returned as x2axis, x3axis,
-    etc., e.g. getAxes().y2axis is the second y axis. You can check
-    y2axis.used to see whether the axis is associated with any data
-    points and y2axis.show to see if it is currently shown. 
- 
-  - getPlaceholder()
-
-    Returns placeholder that the plot was put into. This can be useful
-    for plugins for adding DOM elements or firing events.
-
-  - getCanvas()
-
-    Returns the canvas used for drawing in case you need to hack on it
-    yourself. You'll probably need to get the plot offset too.
-  
-  - getPlotOffset()
-
-    Gets the offset that the grid has within the canvas as an object
-    with distances from the canvas edges as "left", "right", "top",
-    "bottom". I.e., if you draw a circle on the canvas with the center
-    placed at (left, top), its center will be at the top-most, left
-    corner of the grid.
-
-  - getOptions()
-
-    Gets the options for the plot, normalized, with default values
-    filled in. You get a reference to actual values used by Flot, so
-    if you modify the values in here, Flot will use the new values.
-    If you change something, you probably have to call draw() or
-    setupGrid() or triggerRedrawOverlay() to see the change.
-    
-
-## Hooks ##
-
-In addition to the public methods, the Plot object also has some hooks
-that can be used to modify the plotting process. You can install a
-callback function at various points in the process, the function then
-gets access to the internal data structures in Flot.
-
-Here's an overview of the phases Flot goes through:
-
-  1. Plugin initialization, parsing options
-  
-  2. Constructing the canvases used for drawing
-
-  3. Set data: parsing data specification, calculating colors,
-     copying raw data points into internal format,
-     normalizing them, finding max/min for axis auto-scaling
-
-  4. Grid setup: calculating axis spacing, ticks, inserting tick
-     labels, the legend
-
-  5. Draw: drawing the grid, drawing each of the series in turn
-
-  6. Setting up event handling for interactive features
-
-  7. Responding to events, if any
-
-  8. Shutdown: this mostly happens in case a plot is overwritten 
-
-Each hook is simply a function which is put in the appropriate array.
-You can add them through the "hooks" option, and they are also available
-after the plot is constructed as the "hooks" attribute on the returned
-plot object, e.g.
-
-```js
-  // define a simple draw hook
-  function hellohook(plot, canvascontext) { alert("hello!"); };
-
-  // pass it in, in an array since we might want to specify several
-  var plot = $.plot(placeholder, data, { hooks: { draw: [hellohook] } });
-
-  // we can now find it again in plot.hooks.draw[0] unless a plugin
-  // has added other hooks
-```
-
-The available hooks are described below. All hook callbacks get the
-plot object as first parameter. You can find some examples of defined
-hooks in the plugins bundled with Flot.
-
- - processOptions  [phase 1]
-
-    ```function(plot, options)```
-   
-    Called after Flot has parsed and merged options. Useful in the
-    instance where customizations beyond simple merging of default
-    values is needed. A plugin might use it to detect that it has been
-    enabled and then turn on or off other options.
-
- 
- - processRawData  [phase 3]
-
-    ```function(plot, series, data, datapoints)```
- 
-    Called before Flot copies and normalizes the raw data for the given
-    series. If the function fills in datapoints.points with normalized
-    points and sets datapoints.pointsize to the size of the points,
-    Flot will skip the copying/normalization step for this series.
-   
-    In any case, you might be interested in setting datapoints.format,
-    an array of objects for specifying how a point is normalized and
-    how it interferes with axis scaling. It accepts the following options:
-
-    ```js
-    {
-        x, y: boolean,
-        number: boolean,
-        required: boolean,
-        defaultValue: value,
-        autoscale: boolean
-    }
-    ```
-
-    "x" and "y" specify whether the value is plotted against the x or y axis,
-    and is currently used only to calculate axis min-max ranges. The default
-    format array, for example, looks like this:
-
-    ```js
-    [
-        { x: true, number: true, required: true },
-        { y: true, number: true, required: true }
-    ]
-    ```
-
-    This indicates that a point, i.e. [0, 25], consists of two values, with the
-    first being plotted on the x axis and the second on the y axis.
-
-    If "number" is true, then the value must be numeric, and is set to null if
-    it cannot be converted to a number.
-
-    "defaultValue" provides a fallback in case the original value is null. This
-    is for instance handy for bars, where one can omit the third coordinate
-    (the bottom of the bar), which then defaults to zero.
-
-    If "required" is true, then the value must exist (be non-null) for the
-    point as a whole to be valid. If no value is provided, then the entire
-    point is cleared out with nulls, turning it into a gap in the series.
-
-    "autoscale" determines whether the value is considered when calculating an
-    automatic min-max range for the axes that the value is plotted against.
-
- - processDatapoints  [phase 3]
-
-    ```function(plot, series, datapoints)```
-
-    Called after normalization of the given series but before finding
-    min/max of the data points. This hook is useful for implementing data
-    transformations. "datapoints" contains the normalized data points in
-    a flat array as datapoints.points with the size of a single point
-    given in datapoints.pointsize. Here's a simple transform that
-    multiplies all y coordinates by 2:
-
-    ```js
-    function multiply(plot, series, datapoints) {
-        var points = datapoints.points, ps = datapoints.pointsize;
-        for (var i = 0; i < points.length; i += ps)
-            points[i + 1] *= 2;
-    }
-    ```
-
-    Note that you must leave datapoints in a good condition as Flot
-    doesn't check it or do any normalization on it afterwards.
-
- - processOffset  [phase 4]
-
-    ```function(plot, offset)```
-
-    Called after Flot has initialized the plot's offset, but before it
-    draws any axes or plot elements. This hook is useful for customizing
-    the margins between the grid and the edge of the canvas. "offset" is
-    an object with attributes "top", "bottom", "left" and "right",
-    corresponding to the margins on the four sides of the plot.
-
- - drawBackground [phase 5]
-
-    ```function(plot, canvascontext)```
-
-    Called before all other drawing operations. Used to draw backgrounds
-    or other custom elements before the plot or axes have been drawn.
-
- - drawSeries  [phase 5]
-
-    ```function(plot, canvascontext, series)```
-
-    Hook for custom drawing of a single series. Called just before the
-    standard drawing routine has been called in the loop that draws
-    each series.
-
- - draw  [phase 5]
-
-    ```function(plot, canvascontext)```
-
-    Hook for drawing on the canvas. Called after the grid is drawn
-    (unless it's disabled or grid.aboveData is set) and the series have
-    been plotted (in case any points, lines or bars have been turned
-    on). For examples of how to draw things, look at the source code.
-
- - bindEvents  [phase 6]
-
-    ```function(plot, eventHolder)```
-
-    Called after Flot has setup its event handlers. Should set any
-    necessary event handlers on eventHolder, a jQuery object with the
-    canvas, e.g.
-
-    ```js
-    function (plot, eventHolder) {
-        eventHolder.mousedown(function (e) {
-            alert("You pressed the mouse at " + e.pageX + " " + e.pageY);
-        });
-    }
-    ```
-
-    Interesting events include click, mousemove, mouseup/down. You can
-    use all jQuery events. Usually, the event handlers will update the
-    state by drawing something (add a drawOverlay hook and call
-    triggerRedrawOverlay) or firing an externally visible event for
-    user code. See the crosshair plugin for an example.
-     
-    Currently, eventHolder actually contains both the static canvas
-    used for the plot itself and the overlay canvas used for
-    interactive features because some versions of IE get the stacking
-    order wrong. The hook only gets one event, though (either for the
-    overlay or for the static canvas).
-
-    Note that custom plot events generated by Flot are not generated on
-    eventHolder, but on the div placeholder supplied as the first
-    argument to the plot call. You can get that with
-    plot.getPlaceholder() - that's probably also the one you should use
-    if you need to fire a custom event.
-
- - drawOverlay  [phase 7]
-
-    ```function (plot, canvascontext)```
-
-    The drawOverlay hook is used for interactive things that need a
-    canvas to draw on. The model currently used by Flot works the way
-    that an extra overlay canvas is positioned on top of the static
-    canvas. This overlay is cleared and then completely redrawn
-    whenever something interesting happens. This hook is called when
-    the overlay canvas is to be redrawn.
-
-    "canvascontext" is the 2D context of the overlay canvas. You can
-    use this to draw things. You'll most likely need some of the
-    metrics computed by Flot, e.g. plot.width()/plot.height(). See the
-    crosshair plugin for an example.
-
- - shutdown  [phase 8]
-
-    ```function (plot, eventHolder)```
-
-    Run when plot.shutdown() is called, which usually only happens in
-    case a plot is overwritten by a new plot. If you're writing a
-    plugin that adds extra DOM elements or event handlers, you should
-    add a callback to clean up after you. Take a look at the section in
-    the [PLUGINS](PLUGINS.md) document for more info.
-
-   
-## Plugins ##
-
-Plugins extend the functionality of Flot. To use a plugin, simply
-include its JavaScript file after Flot in the HTML page.
-
-If you're worried about download size/latency, you can concatenate all
-the plugins you use, and Flot itself for that matter, into one big file
-(make sure you get the order right), then optionally run it through a
-JavaScript minifier such as YUI Compressor.
-
-Here's a brief explanation of how the plugin plumbings work:
-
-Each plugin registers itself in the global array $.plot.plugins. When
-you make a new plot object with $.plot, Flot goes through this array
-calling the "init" function of each plugin and merging default options
-from the "option" attribute of the plugin. The init function gets a
-reference to the plot object created and uses this to register hooks
-and add new public methods if needed.
-
-See the [PLUGINS](PLUGINS.md) document for details on how to write a plugin. As the
-above description hints, it's actually pretty easy.
-
-
-## Version number ##
-
-The version number of Flot is available in ```$.plot.version```.
diff --git a/src/legacy/ui/public/flot-charts/index.js b/src/legacy/ui/public/flot-charts/index.js
deleted file mode 100644
index f98aca30d2decf..00000000000000
--- a/src/legacy/ui/public/flot-charts/index.js
+++ /dev/null
@@ -1,42 +0,0 @@
-/* @notice
- *
- * This product includes code that is based on flot-charts, which was available
- * under a "MIT" license.
- *
- * The MIT License (MIT)
- *
- * Copyright (c) 2007-2014 IOLA and Ole Laursen
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-import $ from 'jquery';
-if (window) window.jQuery = $;
-require('ui/flot-charts/jquery.flot');
-require('ui/flot-charts/jquery.flot.time');
-require('ui/flot-charts/jquery.flot.canvas');
-require('ui/flot-charts/jquery.flot.symbol');
-require('ui/flot-charts/jquery.flot.crosshair');
-require('ui/flot-charts/jquery.flot.selection');
-require('ui/flot-charts/jquery.flot.pie');
-require('ui/flot-charts/jquery.flot.stack');
-require('ui/flot-charts/jquery.flot.threshold');
-require('ui/flot-charts/jquery.flot.fillbetween');
-require('ui/flot-charts/jquery.flot.log');
-module.exports = $;
diff --git a/src/legacy/ui/public/flot-charts/jquery.colorhelpers.js b/src/legacy/ui/public/flot-charts/jquery.colorhelpers.js
deleted file mode 100644
index b2f6dc4e433a31..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.colorhelpers.js
+++ /dev/null
@@ -1,180 +0,0 @@
-/* Plugin for jQuery for working with colors.
- * 
- * Version 1.1.
- * 
- * Inspiration from jQuery color animation plugin by John Resig.
- *
- * Released under the MIT license by Ole Laursen, October 2009.
- *
- * Examples:
- *
- *   $.color.parse("#fff").scale('rgb', 0.25).add('a', -0.5).toString()
- *   var c = $.color.extract($("#mydiv"), 'background-color');
- *   console.log(c.r, c.g, c.b, c.a);
- *   $.color.make(100, 50, 25, 0.4).toString() // returns "rgba(100,50,25,0.4)"
- *
- * Note that .scale() and .add() return the same modified object
- * instead of making a new one.
- *
- * V. 1.1: Fix error handling so e.g. parsing an empty string does
- * produce a color rather than just crashing.
- */ 
-
-(function($) {
-    $.color = {};
-
-    // construct color object with some convenient chainable helpers
-    $.color.make = function (r, g, b, a) {
-        var o = {};
-        o.r = r || 0;
-        o.g = g || 0;
-        o.b = b || 0;
-        o.a = a != null ? a : 1;
-
-        o.add = function (c, d) {
-            for (var i = 0; i < c.length; ++i)
-                o[c.charAt(i)] += d;
-            return o.normalize();
-        };
-        
-        o.scale = function (c, f) {
-            for (var i = 0; i < c.length; ++i)
-                o[c.charAt(i)] *= f;
-            return o.normalize();
-        };
-        
-        o.toString = function () {
-            if (o.a >= 1.0) {
-                return "rgb("+[o.r, o.g, o.b].join(",")+")";
-            } else {
-                return "rgba("+[o.r, o.g, o.b, o.a].join(",")+")";
-            }
-        };
-
-        o.normalize = function () {
-            function clamp(min, value, max) {
-                return value < min ? min: (value > max ? max: value);
-            }
-            
-            o.r = clamp(0, parseInt(o.r), 255);
-            o.g = clamp(0, parseInt(o.g), 255);
-            o.b = clamp(0, parseInt(o.b), 255);
-            o.a = clamp(0, o.a, 1);
-            return o;
-        };
-
-        o.clone = function () {
-            return $.color.make(o.r, o.b, o.g, o.a);
-        };
-
-        return o.normalize();
-    }
-
-    // extract CSS color property from element, going up in the DOM
-    // if it's "transparent"
-    $.color.extract = function (elem, css) {
-        var c;
-
-        do {
-            c = elem.css(css).toLowerCase();
-            // keep going until we find an element that has color, or
-            // we hit the body or root (have no parent)
-            if (c != '' && c != 'transparent')
-                break;
-            elem = elem.parent();
-        } while (elem.length && !$.nodeName(elem.get(0), "body"));
-
-        // catch Safari's way of signalling transparent
-        if (c == "rgba(0, 0, 0, 0)")
-            c = "transparent";
-        
-        return $.color.parse(c);
-    }
-    
-    // parse CSS color string (like "rgb(10, 32, 43)" or "#fff"),
-    // returns color object, if parsing failed, you get black (0, 0,
-    // 0) out
-    $.color.parse = function (str) {
-        var res, m = $.color.make;
-
-        // Look for rgb(num,num,num)
-        if (res = /rgb\(\s*([0-9]{1,3})\s*,\s*([0-9]{1,3})\s*,\s*([0-9]{1,3})\s*\)/.exec(str))
-            return m(parseInt(res[1], 10), parseInt(res[2], 10), parseInt(res[3], 10));
-        
-        // Look for rgba(num,num,num,num)
-        if (res = /rgba\(\s*([0-9]{1,3})\s*,\s*([0-9]{1,3})\s*,\s*([0-9]{1,3})\s*,\s*([0-9]+(?:\.[0-9]+)?)\s*\)/.exec(str))
-            return m(parseInt(res[1], 10), parseInt(res[2], 10), parseInt(res[3], 10), parseFloat(res[4]));
-            
-        // Look for rgb(num%,num%,num%)
-        if (res = /rgb\(\s*([0-9]+(?:\.[0-9]+)?)\%\s*,\s*([0-9]+(?:\.[0-9]+)?)\%\s*,\s*([0-9]+(?:\.[0-9]+)?)\%\s*\)/.exec(str))
-            return m(parseFloat(res[1])*2.55, parseFloat(res[2])*2.55, parseFloat(res[3])*2.55);
-
-        // Look for rgba(num%,num%,num%,num)
-        if (res = /rgba\(\s*([0-9]+(?:\.[0-9]+)?)\%\s*,\s*([0-9]+(?:\.[0-9]+)?)\%\s*,\s*([0-9]+(?:\.[0-9]+)?)\%\s*,\s*([0-9]+(?:\.[0-9]+)?)\s*\)/.exec(str))
-            return m(parseFloat(res[1])*2.55, parseFloat(res[2])*2.55, parseFloat(res[3])*2.55, parseFloat(res[4]));
-        
-        // Look for #a0b1c2
-        if (res = /#([a-fA-F0-9]{2})([a-fA-F0-9]{2})([a-fA-F0-9]{2})/.exec(str))
-            return m(parseInt(res[1], 16), parseInt(res[2], 16), parseInt(res[3], 16));
-
-        // Look for #fff
-        if (res = /#([a-fA-F0-9])([a-fA-F0-9])([a-fA-F0-9])/.exec(str))
-            return m(parseInt(res[1]+res[1], 16), parseInt(res[2]+res[2], 16), parseInt(res[3]+res[3], 16));
-
-        // Otherwise, we're most likely dealing with a named color
-        var name = $.trim(str).toLowerCase();
-        if (name == "transparent")
-            return m(255, 255, 255, 0);
-        else {
-            // default to black
-            res = lookupColors[name] || [0, 0, 0];
-            return m(res[0], res[1], res[2]);
-        }
-    }
-    
-    var lookupColors = {
-        aqua:[0,255,255],
-        azure:[240,255,255],
-        beige:[245,245,220],
-        black:[0,0,0],
-        blue:[0,0,255],
-        brown:[165,42,42],
-        cyan:[0,255,255],
-        darkblue:[0,0,139],
-        darkcyan:[0,139,139],
-        darkgrey:[169,169,169],
-        darkgreen:[0,100,0],
-        darkkhaki:[189,183,107],
-        darkmagenta:[139,0,139],
-        darkolivegreen:[85,107,47],
-        darkorange:[255,140,0],
-        darkorchid:[153,50,204],
-        darkred:[139,0,0],
-        darksalmon:[233,150,122],
-        darkviolet:[148,0,211],
-        fuchsia:[255,0,255],
-        gold:[255,215,0],
-        green:[0,128,0],
-        indigo:[75,0,130],
-        khaki:[240,230,140],
-        lightblue:[173,216,230],
-        lightcyan:[224,255,255],
-        lightgreen:[144,238,144],
-        lightgrey:[211,211,211],
-        lightpink:[255,182,193],
-        lightyellow:[255,255,224],
-        lime:[0,255,0],
-        magenta:[255,0,255],
-        maroon:[128,0,0],
-        navy:[0,0,128],
-        olive:[128,128,0],
-        orange:[255,165,0],
-        pink:[255,192,203],
-        purple:[128,0,128],
-        violet:[128,0,128],
-        red:[255,0,0],
-        silver:[192,192,192],
-        white:[255,255,255],
-        yellow:[255,255,0]
-    };
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.canvas.js b/src/legacy/ui/public/flot-charts/jquery.flot.canvas.js
deleted file mode 100644
index 29328d58121277..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.canvas.js
+++ /dev/null
@@ -1,345 +0,0 @@
-/* Flot plugin for drawing all elements of a plot on the canvas.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-Flot normally produces certain elements, like axis labels and the legend, using
-HTML elements. This permits greater interactivity and customization, and often
-looks better, due to cross-browser canvas text inconsistencies and limitations.
-
-It can also be desirable to render the plot entirely in canvas, particularly
-if the goal is to save it as an image, or if Flot is being used in a context
-where the HTML DOM does not exist, as is the case within Node.js. This plugin
-switches out Flot's standard drawing operations for canvas-only replacements.
-
-Currently the plugin supports only axis labels, but it will eventually allow
-every element of the plot to be rendered directly to canvas.
-
-The plugin supports these options:
-
-{
-    canvas: boolean
-}
-
-The "canvas" option controls whether full canvas drawing is enabled, making it
-possible to toggle on and off. This is useful when a plot uses HTML text in the
-browser, but needs to redraw with canvas text when exporting as an image.
-
-*/
-
-(function($) {
-
-	var options = {
-		canvas: true
-	};
-
-	var render, getTextInfo, addText;
-
-	// Cache the prototype hasOwnProperty for faster access
-
-	var hasOwnProperty = Object.prototype.hasOwnProperty;
-
-	function init(plot, classes) {
-
-		var Canvas = classes.Canvas;
-
-		// We only want to replace the functions once; the second time around
-		// we would just get our new function back.  This whole replacing of
-		// prototype functions is a disaster, and needs to be changed ASAP.
-
-		if (render == null) {
-			getTextInfo = Canvas.prototype.getTextInfo,
-			addText = Canvas.prototype.addText,
-			render = Canvas.prototype.render;
-		}
-
-		// Finishes rendering the canvas, including overlaid text
-
-		Canvas.prototype.render = function() {
-
-			if (!plot.getOptions().canvas) {
-				return render.call(this);
-			}
-
-			var context = this.context,
-				cache = this._textCache;
-
-			// For each text layer, render elements marked as active
-
-			context.save();
-			context.textBaseline = "middle";
-
-			for (var layerKey in cache) {
-				if (hasOwnProperty.call(cache, layerKey)) {
-					var layerCache = cache[layerKey];
-					for (var styleKey in layerCache) {
-						if (hasOwnProperty.call(layerCache, styleKey)) {
-							var styleCache = layerCache[styleKey],
-								updateStyles = true;
-							for (var key in styleCache) {
-								if (hasOwnProperty.call(styleCache, key)) {
-
-									var info = styleCache[key],
-										positions = info.positions,
-										lines = info.lines;
-
-									// Since every element at this level of the cache have the
-									// same font and fill styles, we can just change them once
-									// using the values from the first element.
-
-									if (updateStyles) {
-										context.fillStyle = info.font.color;
-										context.font = info.font.definition;
-										updateStyles = false;
-									}
-
-									for (var i = 0, position; position = positions[i]; i++) {
-										if (position.active) {
-											for (var j = 0, line; line = position.lines[j]; j++) {
-												context.fillText(lines[j].text, line[0], line[1]);
-											}
-										} else {
-											positions.splice(i--, 1);
-										}
-									}
-
-									if (positions.length == 0) {
-										delete styleCache[key];
-									}
-								}
-							}
-						}
-					}
-				}
-			}
-
-			context.restore();
-		};
-
-		// Creates (if necessary) and returns a text info object.
-		//
-		// When the canvas option is set, the object looks like this:
-		//
-		// {
-		//     width: Width of the text's bounding box.
-		//     height: Height of the text's bounding box.
-		//     positions: Array of positions at which this text is drawn.
-		//     lines: [{
-		//         height: Height of this line.
-		//         widths: Width of this line.
-		//         text: Text on this line.
-		//     }],
-		//     font: {
-		//         definition: Canvas font property string.
-		//         color: Color of the text.
-		//     },
-		// }
-		//
-		// The positions array contains objects that look like this:
-		//
-		// {
-		//     active: Flag indicating whether the text should be visible.
-		//     lines: Array of [x, y] coordinates at which to draw the line.
-		//     x: X coordinate at which to draw the text.
-		//     y: Y coordinate at which to draw the text.
-		// }
-
-		Canvas.prototype.getTextInfo = function(layer, text, font, angle, width) {
-
-			if (!plot.getOptions().canvas) {
-				return getTextInfo.call(this, layer, text, font, angle, width);
-			}
-
-			var textStyle, layerCache, styleCache, info;
-
-			// Cast the value to a string, in case we were given a number
-
-			text = "" + text;
-
-			// If the font is a font-spec object, generate a CSS definition
-
-			if (typeof font === "object") {
-				textStyle = font.style + " " + font.variant + " " + font.weight + " " + font.size + "px " + font.family;
-			} else {
-				textStyle = font;
-			}
-
-			// Retrieve (or create) the cache for the text's layer and styles
-
-			layerCache = this._textCache[layer];
-
-			if (layerCache == null) {
-				layerCache = this._textCache[layer] = {};
-			}
-
-			styleCache = layerCache[textStyle];
-
-			if (styleCache == null) {
-				styleCache = layerCache[textStyle] = {};
-			}
-
-			info = styleCache[text];
-
-			if (info == null) {
-
-				var context = this.context;
-
-				// If the font was provided as CSS, create a div with those
-				// classes and examine it to generate a canvas font spec.
-
-				if (typeof font !== "object") {
-
-					var element = $("<div>&nbsp;</div>")
-						.css("position", "absolute")
-						.addClass(typeof font === "string" ? font : null)
-						.appendTo(this.getTextLayer(layer));
-
-					font = {
-						lineHeight: element.height(),
-						style: element.css("font-style"),
-						variant: element.css("font-variant"),
-						weight: element.css("font-weight"),
-						family: element.css("font-family"),
-						color: element.css("color")
-					};
-
-					// Setting line-height to 1, without units, sets it equal
-					// to the font-size, even if the font-size is abstract,
-					// like 'smaller'.  This enables us to read the real size
-					// via the element's height, working around browsers that
-					// return the literal 'smaller' value.
-
-					font.size = element.css("line-height", 1).height();
-
-					element.remove();
-				}
-
-				textStyle = font.style + " " + font.variant + " " + font.weight + " " + font.size + "px " + font.family;
-
-				// Create a new info object, initializing the dimensions to
-				// zero so we can count them up line-by-line.
-
-				info = styleCache[text] = {
-					width: 0,
-					height: 0,
-					positions: [],
-					lines: [],
-					font: {
-						definition: textStyle,
-						color: font.color
-					}
-				};
-
-				context.save();
-				context.font = textStyle;
-
-				// Canvas can't handle multi-line strings; break on various
-				// newlines, including HTML brs, to build a list of lines.
-				// Note that we could split directly on regexps, but IE < 9 is
-				// broken; revisit when we drop IE 7/8 support.
-
-				var lines = (text + "").replace(/<br ?\/?>|\r\n|\r/g, "\n").split("\n");
-
-				for (var i = 0; i < lines.length; ++i) {
-
-					var lineText = lines[i],
-						measured = context.measureText(lineText);
-
-					info.width = Math.max(measured.width, info.width);
-					info.height += font.lineHeight;
-
-					info.lines.push({
-						text: lineText,
-						width: measured.width,
-						height: font.lineHeight
-					});
-				}
-
-				context.restore();
-			}
-
-			return info;
-		};
-
-		// Adds a text string to the canvas text overlay.
-
-		Canvas.prototype.addText = function(layer, x, y, text, font, angle, width, halign, valign) {
-
-			if (!plot.getOptions().canvas) {
-				return addText.call(this, layer, x, y, text, font, angle, width, halign, valign);
-			}
-
-			var info = this.getTextInfo(layer, text, font, angle, width),
-				positions = info.positions,
-				lines = info.lines;
-
-			// Text is drawn with baseline 'middle', which we need to account
-			// for by adding half a line's height to the y position.
-
-			y += info.height / lines.length / 2;
-
-			// Tweak the initial y-position to match vertical alignment
-
-			if (valign == "middle") {
-				y = Math.round(y - info.height / 2);
-			} else if (valign == "bottom") {
-				y = Math.round(y - info.height);
-			} else {
-				y = Math.round(y);
-			}
-
-			// FIXME: LEGACY BROWSER FIX
-			// AFFECTS: Opera < 12.00
-
-			// Offset the y coordinate, since Opera is off pretty
-			// consistently compared to the other browsers.
-
-			if (!!(window.opera && window.opera.version().split(".")[0] < 12)) {
-				y -= 2;
-			}
-
-			// Determine whether this text already exists at this position.
-			// If so, mark it for inclusion in the next render pass.
-
-			for (var i = 0, position; position = positions[i]; i++) {
-				if (position.x == x && position.y == y) {
-					position.active = true;
-					return;
-				}
-			}
-
-			// If the text doesn't exist at this position, create a new entry
-
-			position = {
-				active: true,
-				lines: [],
-				x: x,
-				y: y
-			};
-
-			positions.push(position);
-
-			// Fill in the x & y positions of each line, adjusting them
-			// individually for horizontal alignment.
-
-			for (var i = 0, line; line = lines[i]; i++) {
-				if (halign == "center") {
-					position.lines.push([Math.round(x - line.width / 2), y]);
-				} else if (halign == "right") {
-					position.lines.push([Math.round(x - line.width), y]);
-				} else {
-					position.lines.push([Math.round(x), y]);
-				}
-				y += line.height;
-			}
-		};
-	}
-
-	$.plot.plugins.push({
-		init: init,
-		options: options,
-		name: "canvas",
-		version: "1.0"
-	});
-
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.categories.js b/src/legacy/ui/public/flot-charts/jquery.flot.categories.js
deleted file mode 100644
index 2f9b2579714997..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.categories.js
+++ /dev/null
@@ -1,190 +0,0 @@
-/* Flot plugin for plotting textual data or categories.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-Consider a dataset like [["February", 34], ["March", 20], ...]. This plugin
-allows you to plot such a dataset directly.
-
-To enable it, you must specify mode: "categories" on the axis with the textual
-labels, e.g.
-
-	$.plot("#placeholder", data, { xaxis: { mode: "categories" } });
-
-By default, the labels are ordered as they are met in the data series. If you
-need a different ordering, you can specify "categories" on the axis options
-and list the categories there:
-
-	xaxis: {
-		mode: "categories",
-		categories: ["February", "March", "April"]
-	}
-
-If you need to customize the distances between the categories, you can specify
-"categories" as an object mapping labels to values
-
-	xaxis: {
-		mode: "categories",
-		categories: { "February": 1, "March": 3, "April": 4 }
-	}
-
-If you don't specify all categories, the remaining categories will be numbered
-from the max value plus 1 (with a spacing of 1 between each).
-
-Internally, the plugin works by transforming the input data through an auto-
-generated mapping where the first category becomes 0, the second 1, etc.
-Hence, a point like ["February", 34] becomes [0, 34] internally in Flot (this
-is visible in hover and click events that return numbers rather than the
-category labels). The plugin also overrides the tick generator to spit out the
-categories as ticks instead of the values.
-
-If you need to map a value back to its label, the mapping is always accessible
-as "categories" on the axis object, e.g. plot.getAxes().xaxis.categories.
-
-*/
-
-(function ($) {
-    var options = {
-        xaxis: {
-            categories: null
-        },
-        yaxis: {
-            categories: null
-        }
-    };
-    
-    function processRawData(plot, series, data, datapoints) {
-        // if categories are enabled, we need to disable
-        // auto-transformation to numbers so the strings are intact
-        // for later processing
-
-        var xCategories = series.xaxis.options.mode == "categories",
-            yCategories = series.yaxis.options.mode == "categories";
-        
-        if (!(xCategories || yCategories))
-            return;
-
-        var format = datapoints.format;
-
-        if (!format) {
-            // FIXME: auto-detection should really not be defined here
-            var s = series;
-            format = [];
-            format.push({ x: true, number: true, required: true });
-            format.push({ y: true, number: true, required: true });
-
-            if (s.bars.show || (s.lines.show && s.lines.fill)) {
-                var autoscale = !!((s.bars.show && s.bars.zero) || (s.lines.show && s.lines.zero));
-                format.push({ y: true, number: true, required: false, defaultValue: 0, autoscale: autoscale });
-                if (s.bars.horizontal) {
-                    delete format[format.length - 1].y;
-                    format[format.length - 1].x = true;
-                }
-            }
-            
-            datapoints.format = format;
-        }
-
-        for (var m = 0; m < format.length; ++m) {
-            if (format[m].x && xCategories)
-                format[m].number = false;
-            
-            if (format[m].y && yCategories)
-                format[m].number = false;
-        }
-    }
-
-    function getNextIndex(categories) {
-        var index = -1;
-        
-        for (var v in categories)
-            if (categories[v] > index)
-                index = categories[v];
-
-        return index + 1;
-    }
-
-    function categoriesTickGenerator(axis) {
-        var res = [];
-        for (var label in axis.categories) {
-            var v = axis.categories[label];
-            if (v >= axis.min && v <= axis.max)
-                res.push([v, label]);
-        }
-
-        res.sort(function (a, b) { return a[0] - b[0]; });
-
-        return res;
-    }
-    
-    function setupCategoriesForAxis(series, axis, datapoints) {
-        if (series[axis].options.mode != "categories")
-            return;
-        
-        if (!series[axis].categories) {
-            // parse options
-            var c = {}, o = series[axis].options.categories || {};
-            if ($.isArray(o)) {
-                for (var i = 0; i < o.length; ++i)
-                    c[o[i]] = i;
-            }
-            else {
-                for (var v in o)
-                    c[v] = o[v];
-            }
-            
-            series[axis].categories = c;
-        }
-
-        // fix ticks
-        if (!series[axis].options.ticks)
-            series[axis].options.ticks = categoriesTickGenerator;
-
-        transformPointsOnAxis(datapoints, axis, series[axis].categories);
-    }
-    
-    function transformPointsOnAxis(datapoints, axis, categories) {
-        // go through the points, transforming them
-        var points = datapoints.points,
-            ps = datapoints.pointsize,
-            format = datapoints.format,
-            formatColumn = axis.charAt(0),
-            index = getNextIndex(categories);
-
-        for (var i = 0; i < points.length; i += ps) {
-            if (points[i] == null)
-                continue;
-            
-            for (var m = 0; m < ps; ++m) {
-                var val = points[i + m];
-
-                if (val == null || !format[m][formatColumn])
-                    continue;
-
-                if (!(val in categories)) {
-                    categories[val] = index;
-                    ++index;
-                }
-                
-                points[i + m] = categories[val];
-            }
-        }
-    }
-
-    function processDatapoints(plot, series, datapoints) {
-        setupCategoriesForAxis(series, "xaxis", datapoints);
-        setupCategoriesForAxis(series, "yaxis", datapoints);
-    }
-
-    function init(plot) {
-        plot.hooks.processRawData.push(processRawData);
-        plot.hooks.processDatapoints.push(processDatapoints);
-    }
-    
-    $.plot.plugins.push({
-        init: init,
-        options: options,
-        name: 'categories',
-        version: '1.0'
-    });
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.crosshair.js b/src/legacy/ui/public/flot-charts/jquery.flot.crosshair.js
deleted file mode 100644
index 5111695e3d12ce..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.crosshair.js
+++ /dev/null
@@ -1,176 +0,0 @@
-/* Flot plugin for showing crosshairs when the mouse hovers over the plot.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-The plugin supports these options:
-
-	crosshair: {
-		mode: null or "x" or "y" or "xy"
-		color: color
-		lineWidth: number
-	}
-
-Set the mode to one of "x", "y" or "xy". The "x" mode enables a vertical
-crosshair that lets you trace the values on the x axis, "y" enables a
-horizontal crosshair and "xy" enables them both. "color" is the color of the
-crosshair (default is "rgba(170, 0, 0, 0.80)"), "lineWidth" is the width of
-the drawn lines (default is 1).
-
-The plugin also adds four public methods:
-
-  - setCrosshair( pos )
-
-    Set the position of the crosshair. Note that this is cleared if the user
-    moves the mouse. "pos" is in coordinates of the plot and should be on the
-    form { x: xpos, y: ypos } (you can use x2/x3/... if you're using multiple
-    axes), which is coincidentally the same format as what you get from a
-    "plothover" event. If "pos" is null, the crosshair is cleared.
-
-  - clearCrosshair()
-
-    Clear the crosshair.
-
-  - lockCrosshair(pos)
-
-    Cause the crosshair to lock to the current location, no longer updating if
-    the user moves the mouse. Optionally supply a position (passed on to
-    setCrosshair()) to move it to.
-
-    Example usage:
-
-	var myFlot = $.plot( $("#graph"), ..., { crosshair: { mode: "x" } } };
-	$("#graph").bind( "plothover", function ( evt, position, item ) {
-		if ( item ) {
-			// Lock the crosshair to the data point being hovered
-			myFlot.lockCrosshair({
-				x: item.datapoint[ 0 ],
-				y: item.datapoint[ 1 ]
-			});
-		} else {
-			// Return normal crosshair operation
-			myFlot.unlockCrosshair();
-		}
-	});
-
-  - unlockCrosshair()
-
-    Free the crosshair to move again after locking it.
-*/
-
-(function ($) {
-    var options = {
-        crosshair: {
-            mode: null, // one of null, "x", "y" or "xy",
-            color: "rgba(170, 0, 0, 0.80)",
-            lineWidth: 1
-        }
-    };
-    
-    function init(plot) {
-        // position of crosshair in pixels
-        var crosshair = { x: -1, y: -1, locked: false };
-
-        plot.setCrosshair = function setCrosshair(pos) {
-            if (!pos)
-                crosshair.x = -1;
-            else {
-                var o = plot.p2c(pos);
-                crosshair.x = Math.max(0, Math.min(o.left, plot.width()));
-                crosshair.y = Math.max(0, Math.min(o.top, plot.height()));
-            }
-            
-            plot.triggerRedrawOverlay();
-        };
-        
-        plot.clearCrosshair = plot.setCrosshair; // passes null for pos
-        
-        plot.lockCrosshair = function lockCrosshair(pos) {
-            if (pos)
-                plot.setCrosshair(pos);
-            crosshair.locked = true;
-        };
-
-        plot.unlockCrosshair = function unlockCrosshair() {
-            crosshair.locked = false;
-        };
-
-        function onMouseOut(e) {
-            if (crosshair.locked)
-                return;
-
-            if (crosshair.x != -1) {
-                crosshair.x = -1;
-                plot.triggerRedrawOverlay();
-            }
-        }
-
-        function onMouseMove(e) {
-            if (crosshair.locked)
-                return;
-                
-            if (plot.getSelection && plot.getSelection()) {
-                crosshair.x = -1; // hide the crosshair while selecting
-                return;
-            }
-                
-            var offset = plot.offset();
-            crosshair.x = Math.max(0, Math.min(e.pageX - offset.left, plot.width()));
-            crosshair.y = Math.max(0, Math.min(e.pageY - offset.top, plot.height()));
-            plot.triggerRedrawOverlay();
-        }
-        
-        plot.hooks.bindEvents.push(function (plot, eventHolder) {
-            if (!plot.getOptions().crosshair.mode)
-                return;
-
-            eventHolder.mouseout(onMouseOut);
-            eventHolder.mousemove(onMouseMove);
-        });
-
-        plot.hooks.drawOverlay.push(function (plot, ctx) {
-            var c = plot.getOptions().crosshair;
-            if (!c.mode)
-                return;
-
-            var plotOffset = plot.getPlotOffset();
-            
-            ctx.save();
-            ctx.translate(plotOffset.left, plotOffset.top);
-
-            if (crosshair.x != -1) {
-                var adj = plot.getOptions().crosshair.lineWidth % 2 ? 0.5 : 0;
-
-                ctx.strokeStyle = c.color;
-                ctx.lineWidth = c.lineWidth;
-                ctx.lineJoin = "round";
-
-                ctx.beginPath();
-                if (c.mode.indexOf("x") != -1) {
-                    var drawX = Math.floor(crosshair.x) + adj;
-                    ctx.moveTo(drawX, 0);
-                    ctx.lineTo(drawX, plot.height());
-                }
-                if (c.mode.indexOf("y") != -1) {
-                    var drawY = Math.floor(crosshair.y) + adj;
-                    ctx.moveTo(0, drawY);
-                    ctx.lineTo(plot.width(), drawY);
-                }
-                ctx.stroke();
-            }
-            ctx.restore();
-        });
-
-        plot.hooks.shutdown.push(function (plot, eventHolder) {
-            eventHolder.unbind("mouseout", onMouseOut);
-            eventHolder.unbind("mousemove", onMouseMove);
-        });
-    }
-    
-    $.plot.plugins.push({
-        init: init,
-        options: options,
-        name: 'crosshair',
-        version: '1.0'
-    });
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.errorbars.js b/src/legacy/ui/public/flot-charts/jquery.flot.errorbars.js
deleted file mode 100644
index 655036e0db846f..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.errorbars.js
+++ /dev/null
@@ -1,353 +0,0 @@
-/* Flot plugin for plotting error bars.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-Error bars are used to show standard deviation and other statistical
-properties in a plot.
-
-* Created by Rui Pereira  -  rui (dot) pereira (at) gmail (dot) com
-
-This plugin allows you to plot error-bars over points. Set "errorbars" inside
-the points series to the axis name over which there will be error values in
-your data array (*even* if you do not intend to plot them later, by setting
-"show: null" on xerr/yerr).
-
-The plugin supports these options:
-
-	series: {
-		points: {
-			errorbars: "x" or "y" or "xy",
-			xerr: {
-				show: null/false or true,
-				asymmetric: null/false or true,
-				upperCap: null or "-" or function,
-				lowerCap: null or "-" or function,
-				color: null or color,
-				radius: null or number
-			},
-			yerr: { same options as xerr }
-		}
-	}
-
-Each data point array is expected to be of the type:
-
-	"x"  [ x, y, xerr ]
-	"y"  [ x, y, yerr ]
-	"xy" [ x, y, xerr, yerr ]
-
-Where xerr becomes xerr_lower,xerr_upper for the asymmetric error case, and
-equivalently for yerr. E.g., a datapoint for the "xy" case with symmetric
-error-bars on X and asymmetric on Y would be:
-
-	[ x, y, xerr, yerr_lower, yerr_upper ]
-
-By default no end caps are drawn. Setting upperCap and/or lowerCap to "-" will
-draw a small cap perpendicular to the error bar. They can also be set to a
-user-defined drawing function, with (ctx, x, y, radius) as parameters, as e.g.:
-
-	function drawSemiCircle( ctx, x, y, radius ) {
-		ctx.beginPath();
-		ctx.arc( x, y, radius, 0, Math.PI, false );
-		ctx.moveTo( x - radius, y );
-		ctx.lineTo( x + radius, y );
-		ctx.stroke();
-	}
-
-Color and radius both default to the same ones of the points series if not
-set. The independent radius parameter on xerr/yerr is useful for the case when
-we may want to add error-bars to a line, without showing the interconnecting
-points (with radius: 0), and still showing end caps on the error-bars.
-shadowSize and lineWidth are derived as well from the points series.
-
-*/
-
-(function ($) {
-    var options = {
-        series: {
-            points: {
-                errorbars: null, //should be 'x', 'y' or 'xy'
-                xerr: { err: 'x', show: null, asymmetric: null, upperCap: null, lowerCap: null, color: null, radius: null},
-                yerr: { err: 'y', show: null, asymmetric: null, upperCap: null, lowerCap: null, color: null, radius: null}
-            }
-        }
-    };
-
-    function processRawData(plot, series, data, datapoints){
-        if (!series.points.errorbars)
-            return;
-
-        // x,y values
-        var format = [
-            { x: true, number: true, required: true },
-            { y: true, number: true, required: true }
-        ];
-
-        var errors = series.points.errorbars;
-        // error bars - first X then Y
-        if (errors == 'x' || errors == 'xy') {
-            // lower / upper error
-            if (series.points.xerr.asymmetric) {
-                format.push({ x: true, number: true, required: true });
-                format.push({ x: true, number: true, required: true });
-            } else
-                format.push({ x: true, number: true, required: true });
-        }
-        if (errors == 'y' || errors == 'xy') {
-            // lower / upper error
-            if (series.points.yerr.asymmetric) {
-                format.push({ y: true, number: true, required: true });
-                format.push({ y: true, number: true, required: true });
-            } else
-                format.push({ y: true, number: true, required: true });
-        }
-        datapoints.format = format;
-    }
-
-    function parseErrors(series, i){
-
-        var points = series.datapoints.points;
-
-        // read errors from points array
-        var exl = null,
-                exu = null,
-                eyl = null,
-                eyu = null;
-        var xerr = series.points.xerr,
-                yerr = series.points.yerr;
-
-        var eb = series.points.errorbars;
-        // error bars - first X
-        if (eb == 'x' || eb == 'xy') {
-            if (xerr.asymmetric) {
-                exl = points[i + 2];
-                exu = points[i + 3];
-                if (eb == 'xy')
-                    if (yerr.asymmetric){
-                        eyl = points[i + 4];
-                        eyu = points[i + 5];
-                    } else eyl = points[i + 4];
-            } else {
-                exl = points[i + 2];
-                if (eb == 'xy')
-                    if (yerr.asymmetric) {
-                        eyl = points[i + 3];
-                        eyu = points[i + 4];
-                    } else eyl = points[i + 3];
-            }
-        // only Y
-        } else if (eb == 'y')
-            if (yerr.asymmetric) {
-                eyl = points[i + 2];
-                eyu = points[i + 3];
-            } else eyl = points[i + 2];
-
-        // symmetric errors?
-        if (exu == null) exu = exl;
-        if (eyu == null) eyu = eyl;
-
-        var errRanges = [exl, exu, eyl, eyu];
-        // nullify if not showing
-        if (!xerr.show){
-            errRanges[0] = null;
-            errRanges[1] = null;
-        }
-        if (!yerr.show){
-            errRanges[2] = null;
-            errRanges[3] = null;
-        }
-        return errRanges;
-    }
-
-    function drawSeriesErrors(plot, ctx, s){
-
-        var points = s.datapoints.points,
-                ps = s.datapoints.pointsize,
-                ax = [s.xaxis, s.yaxis],
-                radius = s.points.radius,
-                err = [s.points.xerr, s.points.yerr];
-
-        //sanity check, in case some inverted axis hack is applied to flot
-        var invertX = false;
-        if (ax[0].p2c(ax[0].max) < ax[0].p2c(ax[0].min)) {
-            invertX = true;
-            var tmp = err[0].lowerCap;
-            err[0].lowerCap = err[0].upperCap;
-            err[0].upperCap = tmp;
-        }
-
-        var invertY = false;
-        if (ax[1].p2c(ax[1].min) < ax[1].p2c(ax[1].max)) {
-            invertY = true;
-            var tmp = err[1].lowerCap;
-            err[1].lowerCap = err[1].upperCap;
-            err[1].upperCap = tmp;
-        }
-
-        for (var i = 0; i < s.datapoints.points.length; i += ps) {
-
-            //parse
-            var errRanges = parseErrors(s, i);
-
-            //cycle xerr & yerr
-            for (var e = 0; e < err.length; e++){
-
-                var minmax = [ax[e].min, ax[e].max];
-
-                //draw this error?
-                if (errRanges[e * err.length]){
-
-                    //data coordinates
-                    var x = points[i],
-                        y = points[i + 1];
-
-                    //errorbar ranges
-                    var upper = [x, y][e] + errRanges[e * err.length + 1],
-                        lower = [x, y][e] - errRanges[e * err.length];
-
-                    //points outside of the canvas
-                    if (err[e].err == 'x')
-                        if (y > ax[1].max || y < ax[1].min || upper < ax[0].min || lower > ax[0].max)
-                            continue;
-                    if (err[e].err == 'y')
-                        if (x > ax[0].max || x < ax[0].min || upper < ax[1].min || lower > ax[1].max)
-                            continue;
-
-                    // prevent errorbars getting out of the canvas
-                    var drawUpper = true,
-                        drawLower = true;
-
-                    if (upper > minmax[1]) {
-                        drawUpper = false;
-                        upper = minmax[1];
-                    }
-                    if (lower < minmax[0]) {
-                        drawLower = false;
-                        lower = minmax[0];
-                    }
-
-                    //sanity check, in case some inverted axis hack is applied to flot
-                    if ((err[e].err == 'x' && invertX) || (err[e].err == 'y' && invertY)) {
-                        //swap coordinates
-                        var tmp = lower;
-                        lower = upper;
-                        upper = tmp;
-                        tmp = drawLower;
-                        drawLower = drawUpper;
-                        drawUpper = tmp;
-                        tmp = minmax[0];
-                        minmax[0] = minmax[1];
-                        minmax[1] = tmp;
-                    }
-
-                    // convert to pixels
-                    x = ax[0].p2c(x),
-                        y = ax[1].p2c(y),
-                        upper = ax[e].p2c(upper);
-                    lower = ax[e].p2c(lower);
-                    minmax[0] = ax[e].p2c(minmax[0]);
-                    minmax[1] = ax[e].p2c(minmax[1]);
-
-                    //same style as points by default
-                    var lw = err[e].lineWidth ? err[e].lineWidth : s.points.lineWidth,
-                        sw = s.points.shadowSize != null ? s.points.shadowSize : s.shadowSize;
-
-                    //shadow as for points
-                    if (lw > 0 && sw > 0) {
-                        var w = sw / 2;
-                        ctx.lineWidth = w;
-                        ctx.strokeStyle = "rgba(0,0,0,0.1)";
-                        drawError(ctx, err[e], x, y, upper, lower, drawUpper, drawLower, radius, w + w/2, minmax);
-
-                        ctx.strokeStyle = "rgba(0,0,0,0.2)";
-                        drawError(ctx, err[e], x, y, upper, lower, drawUpper, drawLower, radius, w/2, minmax);
-                    }
-
-                    ctx.strokeStyle = err[e].color? err[e].color: s.color;
-                    ctx.lineWidth = lw;
-                    //draw it
-                    drawError(ctx, err[e], x, y, upper, lower, drawUpper, drawLower, radius, 0, minmax);
-                }
-            }
-        }
-    }
-
-    function drawError(ctx,err,x,y,upper,lower,drawUpper,drawLower,radius,offset,minmax){
-
-        //shadow offset
-        y += offset;
-        upper += offset;
-        lower += offset;
-
-        // error bar - avoid plotting over circles
-        if (err.err == 'x'){
-            if (upper > x + radius) drawPath(ctx, [[upper,y],[Math.max(x + radius,minmax[0]),y]]);
-            else drawUpper = false;
-            if (lower < x - radius) drawPath(ctx, [[Math.min(x - radius,minmax[1]),y],[lower,y]] );
-            else drawLower = false;
-        }
-        else {
-            if (upper < y - radius) drawPath(ctx, [[x,upper],[x,Math.min(y - radius,minmax[0])]] );
-            else drawUpper = false;
-            if (lower > y + radius) drawPath(ctx, [[x,Math.max(y + radius,minmax[1])],[x,lower]] );
-            else drawLower = false;
-        }
-
-        //internal radius value in errorbar, allows to plot radius 0 points and still keep proper sized caps
-        //this is a way to get errorbars on lines without visible connecting dots
-        radius = err.radius != null? err.radius: radius;
-
-        // upper cap
-        if (drawUpper) {
-            if (err.upperCap == '-'){
-                if (err.err=='x') drawPath(ctx, [[upper,y - radius],[upper,y + radius]] );
-                else drawPath(ctx, [[x - radius,upper],[x + radius,upper]] );
-            } else if ($.isFunction(err.upperCap)){
-                if (err.err=='x') err.upperCap(ctx, upper, y, radius);
-                else err.upperCap(ctx, x, upper, radius);
-            }
-        }
-        // lower cap
-        if (drawLower) {
-            if (err.lowerCap == '-'){
-                if (err.err=='x') drawPath(ctx, [[lower,y - radius],[lower,y + radius]] );
-                else drawPath(ctx, [[x - radius,lower],[x + radius,lower]] );
-            } else if ($.isFunction(err.lowerCap)){
-                if (err.err=='x') err.lowerCap(ctx, lower, y, radius);
-                else err.lowerCap(ctx, x, lower, radius);
-            }
-        }
-    }
-
-    function drawPath(ctx, pts){
-        ctx.beginPath();
-        ctx.moveTo(pts[0][0], pts[0][1]);
-        for (var p=1; p < pts.length; p++)
-            ctx.lineTo(pts[p][0], pts[p][1]);
-        ctx.stroke();
-    }
-
-    function draw(plot, ctx){
-        var plotOffset = plot.getPlotOffset();
-
-        ctx.save();
-        ctx.translate(plotOffset.left, plotOffset.top);
-        $.each(plot.getData(), function (i, s) {
-            if (s.points.errorbars && (s.points.xerr.show || s.points.yerr.show))
-                drawSeriesErrors(plot, ctx, s);
-        });
-        ctx.restore();
-    }
-
-    function init(plot) {
-        plot.hooks.processRawData.push(processRawData);
-        plot.hooks.draw.push(draw);
-    }
-
-    $.plot.plugins.push({
-                init: init,
-                options: options,
-                name: 'errorbars',
-                version: '1.0'
-            });
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.fillbetween.js b/src/legacy/ui/public/flot-charts/jquery.flot.fillbetween.js
deleted file mode 100644
index 18b15d26db8c91..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.fillbetween.js
+++ /dev/null
@@ -1,226 +0,0 @@
-/* Flot plugin for computing bottoms for filled line and bar charts.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-The case: you've got two series that you want to fill the area between. In Flot
-terms, you need to use one as the fill bottom of the other. You can specify the
-bottom of each data point as the third coordinate manually, or you can use this
-plugin to compute it for you.
-
-In order to name the other series, you need to give it an id, like this:
-
-	var dataset = [
-		{ data: [ ... ], id: "foo" } ,         // use default bottom
-		{ data: [ ... ], fillBetween: "foo" }, // use first dataset as bottom
-	];
-
-	$.plot($("#placeholder"), dataset, { lines: { show: true, fill: true }});
-
-As a convenience, if the id given is a number that doesn't appear as an id in
-the series, it is interpreted as the index in the array instead (so fillBetween:
-0 can also mean the first series).
-
-Internally, the plugin modifies the datapoints in each series. For line series,
-extra data points might be inserted through interpolation. Note that at points
-where the bottom line is not defined (due to a null point or start/end of line),
-the current line will show a gap too. The algorithm comes from the
-jquery.flot.stack.js plugin, possibly some code could be shared.
-
-*/
-
-(function ( $ ) {
-
-	var options = {
-		series: {
-			fillBetween: null	// or number
-		}
-	};
-
-	function init( plot ) {
-
-		function findBottomSeries( s, allseries ) {
-
-			var i;
-
-			for ( i = 0; i < allseries.length; ++i ) {
-				if ( allseries[ i ].id === s.fillBetween ) {
-					return allseries[ i ];
-				}
-			}
-
-			if ( typeof s.fillBetween === "number" ) {
-				if ( s.fillBetween < 0 || s.fillBetween >= allseries.length ) {
-					return null;
-				}
-				return allseries[ s.fillBetween ];
-			}
-
-			return null;
-		}
-
-		function computeFillBottoms( plot, s, datapoints ) {
-
-			if ( s.fillBetween == null ) {
-				return;
-			}
-
-			var other = findBottomSeries( s, plot.getData() );
-
-			if ( !other ) {
-				return;
-			}
-
-			var ps = datapoints.pointsize,
-				points = datapoints.points,
-				otherps = other.datapoints.pointsize,
-				otherpoints = other.datapoints.points,
-				newpoints = [],
-				px, py, intery, qx, qy, bottom,
-				withlines = s.lines.show,
-				withbottom = ps > 2 && datapoints.format[2].y,
-				withsteps = withlines && s.lines.steps,
-				fromgap = true,
-				i = 0,
-				j = 0,
-				l, m;
-
-			while ( true ) {
-
-				if ( i >= points.length ) {
-					break;
-				}
-
-				l = newpoints.length;
-
-				if ( points[ i ] == null ) {
-
-					// copy gaps
-
-					for ( m = 0; m < ps; ++m ) {
-						newpoints.push( points[ i + m ] );
-					}
-
-					i += ps;
-
-				} else if ( j >= otherpoints.length ) {
-
-					// for lines, we can't use the rest of the points
-
-					if ( !withlines ) {
-						for ( m = 0; m < ps; ++m ) {
-							newpoints.push( points[ i + m ] );
-						}
-					}
-
-					i += ps;
-
-				} else if ( otherpoints[ j ] == null ) {
-
-					// oops, got a gap
-
-					for ( m = 0; m < ps; ++m ) {
-						newpoints.push( null );
-					}
-
-					fromgap = true;
-					j += otherps;
-
-				} else {
-
-					// cases where we actually got two points
-
-					px = points[ i ];
-					py = points[ i + 1 ];
-					qx = otherpoints[ j ];
-					qy = otherpoints[ j + 1 ];
-					bottom = 0;
-
-					if ( px === qx ) {
-
-						for ( m = 0; m < ps; ++m ) {
-							newpoints.push( points[ i + m ] );
-						}
-
-						//newpoints[ l + 1 ] += qy;
-						bottom = qy;
-
-						i += ps;
-						j += otherps;
-
-					} else if ( px > qx ) {
-
-						// we got past point below, might need to
-						// insert interpolated extra point
-
-						if ( withlines && i > 0 && points[ i - ps ] != null ) {
-							intery = py + ( points[ i - ps + 1 ] - py ) * ( qx - px ) / ( points[ i - ps ] - px );
-							newpoints.push( qx );
-							newpoints.push( intery );
-							for ( m = 2; m < ps; ++m ) {
-								newpoints.push( points[ i + m ] );
-							}
-							bottom = qy;
-						}
-
-						j += otherps;
-
-					} else { // px < qx
-
-						// if we come from a gap, we just skip this point
-
-						if ( fromgap && withlines ) {
-							i += ps;
-							continue;
-						}
-
-						for ( m = 0; m < ps; ++m ) {
-							newpoints.push( points[ i + m ] );
-						}
-
-						// we might be able to interpolate a point below,
-						// this can give us a better y
-
-						if ( withlines && j > 0 && otherpoints[ j - otherps ] != null ) {
-							bottom = qy + ( otherpoints[ j - otherps + 1 ] - qy ) * ( px - qx ) / ( otherpoints[ j - otherps ] - qx );
-						}
-
-						//newpoints[l + 1] += bottom;
-
-						i += ps;
-					}
-
-					fromgap = false;
-
-					if ( l !== newpoints.length && withbottom ) {
-						newpoints[ l + 2 ] = bottom;
-					}
-				}
-
-				// maintain the line steps invariant
-
-				if ( withsteps && l !== newpoints.length && l > 0 &&
-					newpoints[ l ] !== null &&
-					newpoints[ l ] !== newpoints[ l - ps ] &&
-					newpoints[ l + 1 ] !== newpoints[ l - ps + 1 ] ) {
-					for (m = 0; m < ps; ++m) {
-						newpoints[ l + ps + m ] = newpoints[ l + m ];
-					}
-					newpoints[ l + 1 ] = newpoints[ l - ps + 1 ];
-				}
-			}
-
-			datapoints.points = newpoints;
-		}
-
-		plot.hooks.processDatapoints.push( computeFillBottoms );
-	}
-
-	$.plot.plugins.push({
-		init: init,
-		options: options,
-		name: "fillbetween",
-		version: "1.0"
-	});
-
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.image.js b/src/legacy/ui/public/flot-charts/jquery.flot.image.js
deleted file mode 100644
index 178f0e69069eff..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.image.js
+++ /dev/null
@@ -1,241 +0,0 @@
-/* Flot plugin for plotting images.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-The data syntax is [ [ image, x1, y1, x2, y2 ], ... ] where (x1, y1) and
-(x2, y2) are where you intend the two opposite corners of the image to end up
-in the plot. Image must be a fully loaded JavaScript image (you can make one
-with new Image()). If the image is not complete, it's skipped when plotting.
-
-There are two helpers included for retrieving images. The easiest work the way
-that you put in URLs instead of images in the data, like this:
-
-	[ "myimage.png", 0, 0, 10, 10 ]
-
-Then call $.plot.image.loadData( data, options, callback ) where data and
-options are the same as you pass in to $.plot. This loads the images, replaces
-the URLs in the data with the corresponding images and calls "callback" when
-all images are loaded (or failed loading). In the callback, you can then call
-$.plot with the data set. See the included example.
-
-A more low-level helper, $.plot.image.load(urls, callback) is also included.
-Given a list of URLs, it calls callback with an object mapping from URL to
-Image object when all images are loaded or have failed loading.
-
-The plugin supports these options:
-
-	series: {
-		images: {
-			show: boolean
-			anchor: "corner" or "center"
-			alpha: [ 0, 1 ]
-		}
-	}
-
-They can be specified for a specific series:
-
-	$.plot( $("#placeholder"), [{
-		data: [ ... ],
-		images: { ... }
-	])
-
-Note that because the data format is different from usual data points, you
-can't use images with anything else in a specific data series.
-
-Setting "anchor" to "center" causes the pixels in the image to be anchored at
-the corner pixel centers inside of at the pixel corners, effectively letting
-half a pixel stick out to each side in the plot.
-
-A possible future direction could be support for tiling for large images (like
-Google Maps).
-
-*/
-
-(function ($) {
-    var options = {
-        series: {
-            images: {
-                show: false,
-                alpha: 1,
-                anchor: "corner" // or "center"
-            }
-        }
-    };
-
-    $.plot.image = {};
-
-    $.plot.image.loadDataImages = function (series, options, callback) {
-        var urls = [], points = [];
-
-        var defaultShow = options.series.images.show;
-        
-        $.each(series, function (i, s) {
-            if (!(defaultShow || s.images.show))
-                return;
-            
-            if (s.data)
-                s = s.data;
-
-            $.each(s, function (i, p) {
-                if (typeof p[0] == "string") {
-                    urls.push(p[0]);
-                    points.push(p);
-                }
-            });
-        });
-
-        $.plot.image.load(urls, function (loadedImages) {
-            $.each(points, function (i, p) {
-                var url = p[0];
-                if (loadedImages[url])
-                    p[0] = loadedImages[url];
-            });
-
-            callback();
-        });
-    }
-    
-    $.plot.image.load = function (urls, callback) {
-        var missing = urls.length, loaded = {};
-        if (missing == 0)
-            callback({});
-
-        $.each(urls, function (i, url) {
-            var handler = function () {
-                --missing;
-                
-                loaded[url] = this;
-                
-                if (missing == 0)
-                    callback(loaded);
-            };
-
-            $('<img />').load(handler).error(handler).attr('src', url);
-        });
-    };
-    
-    function drawSeries(plot, ctx, series) {
-        var plotOffset = plot.getPlotOffset();
-        
-        if (!series.images || !series.images.show)
-            return;
-        
-        var points = series.datapoints.points,
-            ps = series.datapoints.pointsize;
-        
-        for (var i = 0; i < points.length; i += ps) {
-            var img = points[i],
-                x1 = points[i + 1], y1 = points[i + 2],
-                x2 = points[i + 3], y2 = points[i + 4],
-                xaxis = series.xaxis, yaxis = series.yaxis,
-                tmp;
-
-            // actually we should check img.complete, but it
-            // appears to be a somewhat unreliable indicator in
-            // IE6 (false even after load event)
-            if (!img || img.width <= 0 || img.height <= 0)
-                continue;
-
-            if (x1 > x2) {
-                tmp = x2;
-                x2 = x1;
-                x1 = tmp;
-            }
-            if (y1 > y2) {
-                tmp = y2;
-                y2 = y1;
-                y1 = tmp;
-            }
-            
-            // if the anchor is at the center of the pixel, expand the 
-            // image by 1/2 pixel in each direction
-            if (series.images.anchor == "center") {
-                tmp = 0.5 * (x2-x1) / (img.width - 1);
-                x1 -= tmp;
-                x2 += tmp;
-                tmp = 0.5 * (y2-y1) / (img.height - 1);
-                y1 -= tmp;
-                y2 += tmp;
-            }
-            
-            // clip
-            if (x1 == x2 || y1 == y2 ||
-                x1 >= xaxis.max || x2 <= xaxis.min ||
-                y1 >= yaxis.max || y2 <= yaxis.min)
-                continue;
-
-            var sx1 = 0, sy1 = 0, sx2 = img.width, sy2 = img.height;
-            if (x1 < xaxis.min) {
-                sx1 += (sx2 - sx1) * (xaxis.min - x1) / (x2 - x1);
-                x1 = xaxis.min;
-            }
-
-            if (x2 > xaxis.max) {
-                sx2 += (sx2 - sx1) * (xaxis.max - x2) / (x2 - x1);
-                x2 = xaxis.max;
-            }
-
-            if (y1 < yaxis.min) {
-                sy2 += (sy1 - sy2) * (yaxis.min - y1) / (y2 - y1);
-                y1 = yaxis.min;
-            }
-
-            if (y2 > yaxis.max) {
-                sy1 += (sy1 - sy2) * (yaxis.max - y2) / (y2 - y1);
-                y2 = yaxis.max;
-            }
-            
-            x1 = xaxis.p2c(x1);
-            x2 = xaxis.p2c(x2);
-            y1 = yaxis.p2c(y1);
-            y2 = yaxis.p2c(y2);
-            
-            // the transformation may have swapped us
-            if (x1 > x2) {
-                tmp = x2;
-                x2 = x1;
-                x1 = tmp;
-            }
-            if (y1 > y2) {
-                tmp = y2;
-                y2 = y1;
-                y1 = tmp;
-            }
-
-            tmp = ctx.globalAlpha;
-            ctx.globalAlpha *= series.images.alpha;
-            ctx.drawImage(img,
-                          sx1, sy1, sx2 - sx1, sy2 - sy1,
-                          x1 + plotOffset.left, y1 + plotOffset.top,
-                          x2 - x1, y2 - y1);
-            ctx.globalAlpha = tmp;
-        }
-    }
-
-    function processRawData(plot, series, data, datapoints) {
-        if (!series.images.show)
-            return;
-
-        // format is Image, x1, y1, x2, y2 (opposite corners)
-        datapoints.format = [
-            { required: true },
-            { x: true, number: true, required: true },
-            { y: true, number: true, required: true },
-            { x: true, number: true, required: true },
-            { y: true, number: true, required: true }
-        ];
-    }
-    
-    function init(plot) {
-        plot.hooks.processRawData.push(processRawData);
-        plot.hooks.drawSeries.push(drawSeries);
-    }
-    
-    $.plot.plugins.push({
-        init: init,
-        options: options,
-        name: 'image',
-        version: '1.1'
-    });
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.js b/src/legacy/ui/public/flot-charts/jquery.flot.js
deleted file mode 100644
index 43db1cc3d93db1..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.js
+++ /dev/null
@@ -1,3168 +0,0 @@
-/* JavaScript plotting library for jQuery, version 0.8.3.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-*/
-
-// first an inline dependency, jquery.colorhelpers.js, we inline it here
-// for convenience
-
-/* Plugin for jQuery for working with colors.
- *
- * Version 1.1.
- *
- * Inspiration from jQuery color animation plugin by John Resig.
- *
- * Released under the MIT license by Ole Laursen, October 2009.
- *
- * Examples:
- *
- *   $.color.parse("#fff").scale('rgb', 0.25).add('a', -0.5).toString()
- *   var c = $.color.extract($("#mydiv"), 'background-color');
- *   console.log(c.r, c.g, c.b, c.a);
- *   $.color.make(100, 50, 25, 0.4).toString() // returns "rgba(100,50,25,0.4)"
- *
- * Note that .scale() and .add() return the same modified object
- * instead of making a new one.
- *
- * V. 1.1: Fix error handling so e.g. parsing an empty string does
- * produce a color rather than just crashing.
- */
-(function($){$.color={};$.color.make=function(r,g,b,a){var o={};o.r=r||0;o.g=g||0;o.b=b||0;o.a=a!=null?a:1;o.add=function(c,d){for(var i=0;i<c.length;++i)o[c.charAt(i)]+=d;return o.normalize()};o.scale=function(c,f){for(var i=0;i<c.length;++i)o[c.charAt(i)]*=f;return o.normalize()};o.toString=function(){if(o.a>=1){return"rgb("+[o.r,o.g,o.b].join(",")+")"}else{return"rgba("+[o.r,o.g,o.b,o.a].join(",")+")"}};o.normalize=function(){function clamp(min,value,max){return value<min?min:value>max?max:value}o.r=clamp(0,parseInt(o.r),255);o.g=clamp(0,parseInt(o.g),255);o.b=clamp(0,parseInt(o.b),255);o.a=clamp(0,o.a,1);return o};o.clone=function(){return $.color.make(o.r,o.b,o.g,o.a)};return o.normalize()};$.color.extract=function(elem,css){var c;do{c=elem.css(css).toLowerCase();if(c!=""&&c!="transparent")break;elem=elem.parent()}while(elem.length&&!$.nodeName(elem.get(0),"body"));if(c=="rgba(0, 0, 0, 0)")c="transparent";return $.color.parse(c)};$.color.parse=function(str){var res,m=$.color.make;if(res=/rgb\(\s*([0-9]{1,3})\s*,\s*([0-9]{1,3})\s*,\s*([0-9]{1,3})\s*\)/.exec(str))return m(parseInt(res[1],10),parseInt(res[2],10),parseInt(res[3],10));if(res=/rgba\(\s*([0-9]{1,3})\s*,\s*([0-9]{1,3})\s*,\s*([0-9]{1,3})\s*,\s*([0-9]+(?:\.[0-9]+)?)\s*\)/.exec(str))return m(parseInt(res[1],10),parseInt(res[2],10),parseInt(res[3],10),parseFloat(res[4]));if(res=/rgb\(\s*([0-9]+(?:\.[0-9]+)?)\%\s*,\s*([0-9]+(?:\.[0-9]+)?)\%\s*,\s*([0-9]+(?:\.[0-9]+)?)\%\s*\)/.exec(str))return m(parseFloat(res[1])*2.55,parseFloat(res[2])*2.55,parseFloat(res[3])*2.55);if(res=/rgba\(\s*([0-9]+(?:\.[0-9]+)?)\%\s*,\s*([0-9]+(?:\.[0-9]+)?)\%\s*,\s*([0-9]+(?:\.[0-9]+)?)\%\s*,\s*([0-9]+(?:\.[0-9]+)?)\s*\)/.exec(str))return m(parseFloat(res[1])*2.55,parseFloat(res[2])*2.55,parseFloat(res[3])*2.55,parseFloat(res[4]));if(res=/#([a-fA-F0-9]{2})([a-fA-F0-9]{2})([a-fA-F0-9]{2})/.exec(str))return m(parseInt(res[1],16),parseInt(res[2],16),parseInt(res[3],16));if(res=/#([a-fA-F0-9])([a-fA-F0-9])([a-fA-F0-9])/.exec(str))return m(parseInt(res[1]+res[1],16),parseInt(res[2]+res[2],16),parseInt(res[3]+res[3],16));var name=$.trim(str).toLowerCase();if(name=="transparent")return m(255,255,255,0);else{res=lookupColors[name]||[0,0,0];return m(res[0],res[1],res[2])}};var lookupColors={aqua:[0,255,255],azure:[240,255,255],beige:[245,245,220],black:[0,0,0],blue:[0,0,255],brown:[165,42,42],cyan:[0,255,255],darkblue:[0,0,139],darkcyan:[0,139,139],darkgrey:[169,169,169],darkgreen:[0,100,0],darkkhaki:[189,183,107],darkmagenta:[139,0,139],darkolivegreen:[85,107,47],darkorange:[255,140,0],darkorchid:[153,50,204],darkred:[139,0,0],darksalmon:[233,150,122],darkviolet:[148,0,211],fuchsia:[255,0,255],gold:[255,215,0],green:[0,128,0],indigo:[75,0,130],khaki:[240,230,140],lightblue:[173,216,230],lightcyan:[224,255,255],lightgreen:[144,238,144],lightgrey:[211,211,211],lightpink:[255,182,193],lightyellow:[255,255,224],lime:[0,255,0],magenta:[255,0,255],maroon:[128,0,0],navy:[0,0,128],olive:[128,128,0],orange:[255,165,0],pink:[255,192,203],purple:[128,0,128],violet:[128,0,128],red:[255,0,0],silver:[192,192,192],white:[255,255,255],yellow:[255,255,0]}})(jQuery);
-
-// the actual Flot code
-(function($) {
-
-	// Cache the prototype hasOwnProperty for faster access
-
-	var hasOwnProperty = Object.prototype.hasOwnProperty;
-
-    // A shim to provide 'detach' to jQuery versions prior to 1.4.  Using a DOM
-    // operation produces the same effect as detach, i.e. removing the element
-    // without touching its jQuery data.
-
-    // Do not merge this into Flot 0.9, since it requires jQuery 1.4.4+.
-
-    if (!$.fn.detach) {
-        $.fn.detach = function() {
-            return this.each(function() {
-                if (this.parentNode) {
-                    this.parentNode.removeChild( this );
-                }
-            });
-        };
-    }
-
-	///////////////////////////////////////////////////////////////////////////
-	// The Canvas object is a wrapper around an HTML5 <canvas> tag.
-	//
-	// @constructor
-	// @param {string} cls List of classes to apply to the canvas.
-	// @param {element} container Element onto which to append the canvas.
-	//
-	// Requiring a container is a little iffy, but unfortunately canvas
-	// operations don't work unless the canvas is attached to the DOM.
-
-	function Canvas(cls, container) {
-
-		var element = container.children("." + cls)[0];
-
-		if (element == null) {
-
-			element = document.createElement("canvas");
-			element.className = cls;
-
-			$(element).css({ direction: "ltr", position: "absolute", left: 0, top: 0 })
-				.appendTo(container);
-
-			// If HTML5 Canvas isn't available, fall back to [Ex|Flash]canvas
-
-			if (!element.getContext) {
-				if (window.G_vmlCanvasManager) {
-					element = window.G_vmlCanvasManager.initElement(element);
-				} else {
-					throw new Error("Canvas is not available. If you're using IE with a fall-back such as Excanvas, then there's either a mistake in your conditional include, or the page has no DOCTYPE and is rendering in Quirks Mode.");
-				}
-			}
-		}
-
-		this.element = element;
-
-		var context = this.context = element.getContext("2d");
-
-		// Determine the screen's ratio of physical to device-independent
-		// pixels.  This is the ratio between the canvas width that the browser
-		// advertises and the number of pixels actually present in that space.
-
-		// The iPhone 4, for example, has a device-independent width of 320px,
-		// but its screen is actually 640px wide.  It therefore has a pixel
-		// ratio of 2, while most normal devices have a ratio of 1.
-
-		var devicePixelRatio = window.devicePixelRatio || 1,
-			backingStoreRatio =
-				context.webkitBackingStorePixelRatio ||
-				context.mozBackingStorePixelRatio ||
-				context.msBackingStorePixelRatio ||
-				context.oBackingStorePixelRatio ||
-				context.backingStorePixelRatio || 1;
-
-		this.pixelRatio = devicePixelRatio / backingStoreRatio;
-
-		// Size the canvas to match the internal dimensions of its container
-
-		this.resize(container.width(), container.height());
-
-		// Collection of HTML div layers for text overlaid onto the canvas
-
-		this.textContainer = null;
-		this.text = {};
-
-		// Cache of text fragments and metrics, so we can avoid expensively
-		// re-calculating them when the plot is re-rendered in a loop.
-
-		this._textCache = {};
-	}
-
-	// Resizes the canvas to the given dimensions.
-	//
-	// @param {number} width New width of the canvas, in pixels.
-	// @param {number} width New height of the canvas, in pixels.
-
-	Canvas.prototype.resize = function(width, height) {
-
-		if (width <= 0 || height <= 0) {
-			throw new Error("Invalid dimensions for plot, width = " + width + ", height = " + height);
-		}
-
-		var element = this.element,
-			context = this.context,
-			pixelRatio = this.pixelRatio;
-
-		// Resize the canvas, increasing its density based on the display's
-		// pixel ratio; basically giving it more pixels without increasing the
-		// size of its element, to take advantage of the fact that retina
-		// displays have that many more pixels in the same advertised space.
-
-		// Resizing should reset the state (excanvas seems to be buggy though)
-
-		if (this.width != width) {
-			element.width = width * pixelRatio;
-			element.style.width = width + "px";
-			this.width = width;
-		}
-
-		if (this.height != height) {
-			element.height = height * pixelRatio;
-			element.style.height = height + "px";
-			this.height = height;
-		}
-
-		// Save the context, so we can reset in case we get replotted.  The
-		// restore ensure that we're really back at the initial state, and
-		// should be safe even if we haven't saved the initial state yet.
-
-		context.restore();
-		context.save();
-
-		// Scale the coordinate space to match the display density; so even though we
-		// may have twice as many pixels, we still want lines and other drawing to
-		// appear at the same size; the extra pixels will just make them crisper.
-
-		context.scale(pixelRatio, pixelRatio);
-	};
-
-	// Clears the entire canvas area, not including any overlaid HTML text
-
-	Canvas.prototype.clear = function() {
-		this.context.clearRect(0, 0, this.width, this.height);
-	};
-
-	// Finishes rendering the canvas, including managing the text overlay.
-
-	Canvas.prototype.render = function() {
-
-		var cache = this._textCache;
-
-		// For each text layer, add elements marked as active that haven't
-		// already been rendered, and remove those that are no longer active.
-
-		for (var layerKey in cache) {
-			if (hasOwnProperty.call(cache, layerKey)) {
-
-				var layer = this.getTextLayer(layerKey),
-					layerCache = cache[layerKey];
-
-				layer.hide();
-
-				for (var styleKey in layerCache) {
-					if (hasOwnProperty.call(layerCache, styleKey)) {
-						var styleCache = layerCache[styleKey];
-						for (var key in styleCache) {
-							if (hasOwnProperty.call(styleCache, key)) {
-
-								var positions = styleCache[key].positions;
-
-								for (var i = 0, position; position = positions[i]; i++) {
-									if (position.active) {
-										if (!position.rendered) {
-											layer.append(position.element);
-											position.rendered = true;
-										}
-									} else {
-										positions.splice(i--, 1);
-										if (position.rendered) {
-											position.element.detach();
-										}
-									}
-								}
-
-								if (positions.length == 0) {
-									delete styleCache[key];
-								}
-							}
-						}
-					}
-				}
-
-				layer.show();
-			}
-		}
-	};
-
-	// Creates (if necessary) and returns the text overlay container.
-	//
-	// @param {string} classes String of space-separated CSS classes used to
-	//     uniquely identify the text layer.
-	// @return {object} The jQuery-wrapped text-layer div.
-
-	Canvas.prototype.getTextLayer = function(classes) {
-
-		var layer = this.text[classes];
-
-		// Create the text layer if it doesn't exist
-
-		if (layer == null) {
-
-			// Create the text layer container, if it doesn't exist
-
-			if (this.textContainer == null) {
-				this.textContainer = $("<div class='flot-text'></div>")
-					.css({
-						position: "absolute",
-						top: 0,
-						left: 0,
-						bottom: 0,
-						right: 0,
-						'font-size': "smaller",
-						color: "#545454"
-					})
-					.insertAfter(this.element);
-			}
-
-			layer = this.text[classes] = $("<div></div>")
-				.addClass(classes)
-				.css({
-					position: "absolute",
-					top: 0,
-					left: 0,
-					bottom: 0,
-					right: 0
-				})
-				.appendTo(this.textContainer);
-		}
-
-		return layer;
-	};
-
-	// Creates (if necessary) and returns a text info object.
-	//
-	// The object looks like this:
-	//
-	// {
-	//     width: Width of the text's wrapper div.
-	//     height: Height of the text's wrapper div.
-	//     element: The jQuery-wrapped HTML div containing the text.
-	//     positions: Array of positions at which this text is drawn.
-	// }
-	//
-	// The positions array contains objects that look like this:
-	//
-	// {
-	//     active: Flag indicating whether the text should be visible.
-	//     rendered: Flag indicating whether the text is currently visible.
-	//     element: The jQuery-wrapped HTML div containing the text.
-	//     x: X coordinate at which to draw the text.
-	//     y: Y coordinate at which to draw the text.
-	// }
-	//
-	// Each position after the first receives a clone of the original element.
-	//
-	// The idea is that that the width, height, and general 'identity' of the
-	// text is constant no matter where it is placed; the placements are a
-	// secondary property.
-	//
-	// Canvas maintains a cache of recently-used text info objects; getTextInfo
-	// either returns the cached element or creates a new entry.
-	//
-	// @param {string} layer A string of space-separated CSS classes uniquely
-	//     identifying the layer containing this text.
-	// @param {string} text Text string to retrieve info for.
-	// @param {(string|object)=} font Either a string of space-separated CSS
-	//     classes or a font-spec object, defining the text's font and style.
-	// @param {number=} angle Angle at which to rotate the text, in degrees.
-	//     Angle is currently unused, it will be implemented in the future.
-	// @param {number=} width Maximum width of the text before it wraps.
-	// @return {object} a text info object.
-
-	Canvas.prototype.getTextInfo = function(layer, text, font, angle, width) {
-
-		var textStyle, layerCache, styleCache, info;
-
-		// Cast the value to a string, in case we were given a number or such
-
-		text = "" + text;
-
-		// If the font is a font-spec object, generate a CSS font definition
-
-		if (typeof font === "object") {
-			textStyle = font.style + " " + font.variant + " " + font.weight + " " + font.size + "px/" + font.lineHeight + "px " + font.family;
-		} else {
-			textStyle = font;
-		}
-
-		// Retrieve (or create) the cache for the text's layer and styles
-
-		layerCache = this._textCache[layer];
-
-		if (layerCache == null) {
-			layerCache = this._textCache[layer] = {};
-		}
-
-		styleCache = layerCache[textStyle];
-
-		if (styleCache == null) {
-			styleCache = layerCache[textStyle] = {};
-		}
-
-		info = styleCache[text];
-
-		// If we can't find a matching element in our cache, create a new one
-
-		if (info == null) {
-
-			var element = $("<div></div>").html(text)
-				.css({
-					position: "absolute",
-					'max-width': width,
-					top: -9999
-				})
-				.appendTo(this.getTextLayer(layer));
-
-			if (typeof font === "object") {
-				element.css({
-					font: textStyle,
-					color: font.color
-				});
-			} else if (typeof font === "string") {
-				element.addClass(font);
-			}
-
-			info = styleCache[text] = {
-				width: element.outerWidth(true),
-				height: element.outerHeight(true),
-				element: element,
-				positions: []
-			};
-
-			element.detach();
-		}
-
-		return info;
-	};
-
-	// Adds a text string to the canvas text overlay.
-	//
-	// The text isn't drawn immediately; it is marked as rendering, which will
-	// result in its addition to the canvas on the next render pass.
-	//
-	// @param {string} layer A string of space-separated CSS classes uniquely
-	//     identifying the layer containing this text.
-	// @param {number} x X coordinate at which to draw the text.
-	// @param {number} y Y coordinate at which to draw the text.
-	// @param {string} text Text string to draw.
-	// @param {(string|object)=} font Either a string of space-separated CSS
-	//     classes or a font-spec object, defining the text's font and style.
-	// @param {number=} angle Angle at which to rotate the text, in degrees.
-	//     Angle is currently unused, it will be implemented in the future.
-	// @param {number=} width Maximum width of the text before it wraps.
-	// @param {string=} halign Horizontal alignment of the text; either "left",
-	//     "center" or "right".
-	// @param {string=} valign Vertical alignment of the text; either "top",
-	//     "middle" or "bottom".
-
-	Canvas.prototype.addText = function(layer, x, y, text, font, angle, width, halign, valign) {
-
-		var info = this.getTextInfo(layer, text, font, angle, width),
-			positions = info.positions;
-
-		// Tweak the div's position to match the text's alignment
-
-		if (halign == "center") {
-			x -= info.width / 2;
-		} else if (halign == "right") {
-			x -= info.width;
-		}
-
-		if (valign == "middle") {
-			y -= info.height / 2;
-		} else if (valign == "bottom") {
-			y -= info.height;
-		}
-
-		// Determine whether this text already exists at this position.
-		// If so, mark it for inclusion in the next render pass.
-
-		for (var i = 0, position; position = positions[i]; i++) {
-			if (position.x == x && position.y == y) {
-				position.active = true;
-				return;
-			}
-		}
-
-		// If the text doesn't exist at this position, create a new entry
-
-		// For the very first position we'll re-use the original element,
-		// while for subsequent ones we'll clone it.
-
-		position = {
-			active: true,
-			rendered: false,
-			element: positions.length ? info.element.clone() : info.element,
-			x: x,
-			y: y
-		};
-
-		positions.push(position);
-
-		// Move the element to its final position within the container
-
-		position.element.css({
-			top: Math.round(y),
-			left: Math.round(x),
-			'text-align': halign	// In case the text wraps
-		});
-	};
-
-	// Removes one or more text strings from the canvas text overlay.
-	//
-	// If no parameters are given, all text within the layer is removed.
-	//
-	// Note that the text is not immediately removed; it is simply marked as
-	// inactive, which will result in its removal on the next render pass.
-	// This avoids the performance penalty for 'clear and redraw' behavior,
-	// where we potentially get rid of all text on a layer, but will likely
-	// add back most or all of it later, as when redrawing axes, for example.
-	//
-	// @param {string} layer A string of space-separated CSS classes uniquely
-	//     identifying the layer containing this text.
-	// @param {number=} x X coordinate of the text.
-	// @param {number=} y Y coordinate of the text.
-	// @param {string=} text Text string to remove.
-	// @param {(string|object)=} font Either a string of space-separated CSS
-	//     classes or a font-spec object, defining the text's font and style.
-	// @param {number=} angle Angle at which the text is rotated, in degrees.
-	//     Angle is currently unused, it will be implemented in the future.
-
-	Canvas.prototype.removeText = function(layer, x, y, text, font, angle) {
-		if (text == null) {
-			var layerCache = this._textCache[layer];
-			if (layerCache != null) {
-				for (var styleKey in layerCache) {
-					if (hasOwnProperty.call(layerCache, styleKey)) {
-						var styleCache = layerCache[styleKey];
-						for (var key in styleCache) {
-							if (hasOwnProperty.call(styleCache, key)) {
-								var positions = styleCache[key].positions;
-								for (var i = 0, position; position = positions[i]; i++) {
-									position.active = false;
-								}
-							}
-						}
-					}
-				}
-			}
-		} else {
-			var positions = this.getTextInfo(layer, text, font, angle).positions;
-			for (var i = 0, position; position = positions[i]; i++) {
-				if (position.x == x && position.y == y) {
-					position.active = false;
-				}
-			}
-		}
-	};
-
-	///////////////////////////////////////////////////////////////////////////
-	// The top-level container for the entire plot.
-
-    function Plot(placeholder, data_, options_, plugins) {
-        // data is on the form:
-        //   [ series1, series2 ... ]
-        // where series is either just the data as [ [x1, y1], [x2, y2], ... ]
-        // or { data: [ [x1, y1], [x2, y2], ... ], label: "some label", ... }
-
-        var series = [],
-            options = {
-                // the color theme used for graphs
-                colors: ["#edc240", "#afd8f8", "#cb4b4b", "#4da74d", "#9440ed"],
-                legend: {
-                    show: true,
-                    noColumns: 1, // number of columns in legend table
-                    labelFormatter: null, // fn: string -> string
-                    labelBoxBorderColor: "#ccc", // border color for the little label boxes
-                    container: null, // container (as jQuery object) to put legend in, null means default on top of graph
-                    position: "ne", // position of default legend container within plot
-                    margin: 5, // distance from grid edge to default legend container within plot
-                    backgroundColor: null, // null means auto-detect
-                    backgroundOpacity: 0.85, // set to 0 to avoid background
-                    sorted: null    // default to no legend sorting
-                },
-                xaxis: {
-                    show: null, // null = auto-detect, true = always, false = never
-                    position: "bottom", // or "top"
-                    mode: null, // null or "time"
-                    font: null, // null (derived from CSS in placeholder) or object like { size: 11, lineHeight: 13, style: "italic", weight: "bold", family: "sans-serif", variant: "small-caps" }
-                    color: null, // base color, labels, ticks
-                    tickColor: null, // possibly different color of ticks, e.g. "rgba(0,0,0,0.15)"
-                    transform: null, // null or f: number -> number to transform axis
-                    inverseTransform: null, // if transform is set, this should be the inverse function
-                    min: null, // min. value to show, null means set automatically
-                    max: null, // max. value to show, null means set automatically
-                    autoscaleMargin: null, // margin in % to add if auto-setting min/max
-                    ticks: null, // either [1, 3] or [[1, "a"], 3] or (fn: axis info -> ticks) or app. number of ticks for auto-ticks
-                    tickFormatter: null, // fn: number -> string
-                    labelWidth: null, // size of tick labels in pixels
-                    labelHeight: null,
-                    reserveSpace: null, // whether to reserve space even if axis isn't shown
-                    tickLength: null, // size in pixels of ticks, or "full" for whole line
-                    alignTicksWithAxis: null, // axis number or null for no sync
-                    tickDecimals: null, // no. of decimals, null means auto
-                    tickSize: null, // number or [number, "unit"]
-                    minTickSize: null // number or [number, "unit"]
-                },
-                yaxis: {
-                    autoscaleMargin: 0.02,
-                    position: "left" // or "right"
-                },
-                xaxes: [],
-                yaxes: [],
-                series: {
-                    points: {
-                        show: false,
-                        radius: 3,
-                        lineWidth: 2, // in pixels
-                        fill: true,
-                        fillColor: "#ffffff",
-                        symbol: "circle" // or callback
-                    },
-                    lines: {
-                        // we don't put in show: false so we can see
-                        // whether lines were actively disabled
-                        lineWidth: 2, // in pixels
-                        fill: false,
-                        fillColor: null,
-                        steps: false
-                        // Omit 'zero', so we can later default its value to
-                        // match that of the 'fill' option.
-                    },
-                    bars: {
-                        show: false,
-                        lineWidth: 2, // in pixels
-                        barWidth: 1, // in units of the x axis
-                        fill: true,
-                        fillColor: null,
-                        align: "left", // "left", "right", or "center"
-                        horizontal: false,
-                        zero: true
-                    },
-                    shadowSize: 3,
-                    highlightColor: null
-                },
-                grid: {
-                    show: true,
-                    aboveData: false,
-                    color: "#545454", // primary color used for outline and labels
-                    backgroundColor: null, // null for transparent, else color
-                    borderColor: null, // set if different from the grid color
-                    tickColor: null, // color for the ticks, e.g. "rgba(0,0,0,0.15)"
-                    margin: 0, // distance from the canvas edge to the grid
-                    labelMargin: 5, // in pixels
-                    axisMargin: 8, // in pixels
-                    borderWidth: 2, // in pixels
-                    minBorderMargin: null, // in pixels, null means taken from points radius
-                    markings: null, // array of ranges or fn: axes -> array of ranges
-                    markingsColor: "#f4f4f4",
-                    markingsLineWidth: 2,
-                    // interactive stuff
-                    clickable: false,
-                    hoverable: false,
-                    autoHighlight: true, // highlight in case mouse is near
-                    mouseActiveRadius: 10 // how far the mouse can be away to activate an item
-                },
-                interaction: {
-                    redrawOverlayInterval: 1000/60 // time between updates, -1 means in same flow
-                },
-                hooks: {}
-            },
-        surface = null,     // the canvas for the plot itself
-        overlay = null,     // canvas for interactive stuff on top of plot
-        eventHolder = null, // jQuery object that events should be bound to
-        ctx = null, octx = null,
-        xaxes = [], yaxes = [],
-        plotOffset = { left: 0, right: 0, top: 0, bottom: 0},
-        plotWidth = 0, plotHeight = 0,
-        hooks = {
-            processOptions: [],
-            processRawData: [],
-            processDatapoints: [],
-            processOffset: [],
-            drawBackground: [],
-            drawSeries: [],
-            draw: [],
-            bindEvents: [],
-            drawOverlay: [],
-            shutdown: []
-        },
-        plot = this;
-
-        // public functions
-        plot.setData = setData;
-        plot.setupGrid = setupGrid;
-        plot.draw = draw;
-        plot.getPlaceholder = function() { return placeholder; };
-        plot.getCanvas = function() { return surface.element; };
-        plot.getPlotOffset = function() { return plotOffset; };
-        plot.width = function () { return plotWidth; };
-        plot.height = function () { return plotHeight; };
-        plot.offset = function () {
-            var o = eventHolder.offset();
-            o.left += plotOffset.left;
-            o.top += plotOffset.top;
-            return o;
-        };
-        plot.getData = function () { return series; };
-        plot.getAxes = function () {
-            var res = {}, i;
-            $.each(xaxes.concat(yaxes), function (_, axis) {
-                if (axis)
-                    res[axis.direction + (axis.n != 1 ? axis.n : "") + "axis"] = axis;
-            });
-            return res;
-        };
-        plot.getXAxes = function () { return xaxes; };
-        plot.getYAxes = function () { return yaxes; };
-        plot.c2p = canvasToAxisCoords;
-        plot.p2c = axisToCanvasCoords;
-        plot.getOptions = function () { return options; };
-        plot.highlight = highlight;
-        plot.unhighlight = unhighlight;
-        plot.triggerRedrawOverlay = triggerRedrawOverlay;
-        plot.pointOffset = function(point) {
-            return {
-                left: parseInt(xaxes[axisNumber(point, "x") - 1].p2c(+point.x) + plotOffset.left, 10),
-                top: parseInt(yaxes[axisNumber(point, "y") - 1].p2c(+point.y) + plotOffset.top, 10)
-            };
-        };
-        plot.shutdown = shutdown;
-        plot.destroy = function () {
-            shutdown();
-            placeholder.removeData("plot").empty();
-
-            series = [];
-            options = null;
-            surface = null;
-            overlay = null;
-            eventHolder = null;
-            ctx = null;
-            octx = null;
-            xaxes = [];
-            yaxes = [];
-            hooks = null;
-            highlights = [];
-            plot = null;
-        };
-        plot.resize = function () {
-        	var width = placeholder.width(),
-        		height = placeholder.height();
-            surface.resize(width, height);
-            overlay.resize(width, height);
-        };
-
-        // public attributes
-        plot.hooks = hooks;
-
-        // initialize
-        initPlugins(plot);
-        parseOptions(options_);
-        setupCanvases();
-        setData(data_);
-        setupGrid();
-        draw();
-        bindEvents();
-
-
-        function executeHooks(hook, args) {
-            args = [plot].concat(args);
-            for (var i = 0; i < hook.length; ++i)
-                hook[i].apply(this, args);
-        }
-
-        function initPlugins() {
-
-            // References to key classes, allowing plugins to modify them
-
-            var classes = {
-                Canvas: Canvas
-            };
-
-            for (var i = 0; i < plugins.length; ++i) {
-                var p = plugins[i];
-                p.init(plot, classes);
-                if (p.options)
-                    $.extend(true, options, p.options);
-            }
-        }
-
-        function parseOptions(opts) {
-
-            $.extend(true, options, opts);
-
-            // $.extend merges arrays, rather than replacing them.  When less
-            // colors are provided than the size of the default palette, we
-            // end up with those colors plus the remaining defaults, which is
-            // not expected behavior; avoid it by replacing them here.
-
-            if (opts && opts.colors) {
-            	options.colors = opts.colors;
-            }
-
-            if (options.xaxis.color == null)
-                options.xaxis.color = $.color.parse(options.grid.color).scale('a', 0.22).toString();
-            if (options.yaxis.color == null)
-                options.yaxis.color = $.color.parse(options.grid.color).scale('a', 0.22).toString();
-
-            if (options.xaxis.tickColor == null) // grid.tickColor for back-compatibility
-                options.xaxis.tickColor = options.grid.tickColor || options.xaxis.color;
-            if (options.yaxis.tickColor == null) // grid.tickColor for back-compatibility
-                options.yaxis.tickColor = options.grid.tickColor || options.yaxis.color;
-
-            if (options.grid.borderColor == null)
-                options.grid.borderColor = options.grid.color;
-            if (options.grid.tickColor == null)
-                options.grid.tickColor = $.color.parse(options.grid.color).scale('a', 0.22).toString();
-
-            // Fill in defaults for axis options, including any unspecified
-            // font-spec fields, if a font-spec was provided.
-
-            // If no x/y axis options were provided, create one of each anyway,
-            // since the rest of the code assumes that they exist.
-
-            var i, axisOptions, axisCount,
-                fontSize = placeholder.css("font-size"),
-                fontSizeDefault = fontSize ? +fontSize.replace("px", "") : 13,
-                fontDefaults = {
-                    style: placeholder.css("font-style"),
-                    size: Math.round(0.8 * fontSizeDefault),
-                    variant: placeholder.css("font-variant"),
-                    weight: placeholder.css("font-weight"),
-                    family: placeholder.css("font-family")
-                };
-
-            axisCount = options.xaxes.length || 1;
-            for (i = 0; i < axisCount; ++i) {
-
-                axisOptions = options.xaxes[i];
-                if (axisOptions && !axisOptions.tickColor) {
-                    axisOptions.tickColor = axisOptions.color;
-                }
-
-                axisOptions = $.extend(true, {}, options.xaxis, axisOptions);
-                options.xaxes[i] = axisOptions;
-
-                if (axisOptions.font) {
-                    axisOptions.font = $.extend({}, fontDefaults, axisOptions.font);
-                    if (!axisOptions.font.color) {
-                        axisOptions.font.color = axisOptions.color;
-                    }
-                    if (!axisOptions.font.lineHeight) {
-                        axisOptions.font.lineHeight = Math.round(axisOptions.font.size * 1.15);
-                    }
-                }
-            }
-
-            axisCount = options.yaxes.length || 1;
-            for (i = 0; i < axisCount; ++i) {
-
-                axisOptions = options.yaxes[i];
-                if (axisOptions && !axisOptions.tickColor) {
-                    axisOptions.tickColor = axisOptions.color;
-                }
-
-                axisOptions = $.extend(true, {}, options.yaxis, axisOptions);
-                options.yaxes[i] = axisOptions;
-
-                if (axisOptions.font) {
-                    axisOptions.font = $.extend({}, fontDefaults, axisOptions.font);
-                    if (!axisOptions.font.color) {
-                        axisOptions.font.color = axisOptions.color;
-                    }
-                    if (!axisOptions.font.lineHeight) {
-                        axisOptions.font.lineHeight = Math.round(axisOptions.font.size * 1.15);
-                    }
-                }
-            }
-
-            // backwards compatibility, to be removed in future
-            if (options.xaxis.noTicks && options.xaxis.ticks == null)
-                options.xaxis.ticks = options.xaxis.noTicks;
-            if (options.yaxis.noTicks && options.yaxis.ticks == null)
-                options.yaxis.ticks = options.yaxis.noTicks;
-            if (options.x2axis) {
-                options.xaxes[1] = $.extend(true, {}, options.xaxis, options.x2axis);
-                options.xaxes[1].position = "top";
-                // Override the inherit to allow the axis to auto-scale
-                if (options.x2axis.min == null) {
-                    options.xaxes[1].min = null;
-                }
-                if (options.x2axis.max == null) {
-                    options.xaxes[1].max = null;
-                }
-            }
-            if (options.y2axis) {
-                options.yaxes[1] = $.extend(true, {}, options.yaxis, options.y2axis);
-                options.yaxes[1].position = "right";
-                // Override the inherit to allow the axis to auto-scale
-                if (options.y2axis.min == null) {
-                    options.yaxes[1].min = null;
-                }
-                if (options.y2axis.max == null) {
-                    options.yaxes[1].max = null;
-                }
-            }
-            if (options.grid.coloredAreas)
-                options.grid.markings = options.grid.coloredAreas;
-            if (options.grid.coloredAreasColor)
-                options.grid.markingsColor = options.grid.coloredAreasColor;
-            if (options.lines)
-                $.extend(true, options.series.lines, options.lines);
-            if (options.points)
-                $.extend(true, options.series.points, options.points);
-            if (options.bars)
-                $.extend(true, options.series.bars, options.bars);
-            if (options.shadowSize != null)
-                options.series.shadowSize = options.shadowSize;
-            if (options.highlightColor != null)
-                options.series.highlightColor = options.highlightColor;
-
-            // save options on axes for future reference
-            for (i = 0; i < options.xaxes.length; ++i)
-                getOrCreateAxis(xaxes, i + 1).options = options.xaxes[i];
-            for (i = 0; i < options.yaxes.length; ++i)
-                getOrCreateAxis(yaxes, i + 1).options = options.yaxes[i];
-
-            // add hooks from options
-            for (var n in hooks)
-                if (options.hooks[n] && options.hooks[n].length)
-                    hooks[n] = hooks[n].concat(options.hooks[n]);
-
-            executeHooks(hooks.processOptions, [options]);
-        }
-
-        function setData(d) {
-            series = parseData(d);
-            fillInSeriesOptions();
-            processData();
-        }
-
-        function parseData(d) {
-            var res = [];
-            for (var i = 0; i < d.length; ++i) {
-                var s = $.extend(true, {}, options.series);
-
-                if (d[i].data != null) {
-                    s.data = d[i].data; // move the data instead of deep-copy
-                    delete d[i].data;
-
-                    $.extend(true, s, d[i]);
-
-                    d[i].data = s.data;
-                }
-                else
-                    s.data = d[i];
-                res.push(s);
-            }
-
-            return res;
-        }
-
-        function axisNumber(obj, coord) {
-            var a = obj[coord + "axis"];
-            if (typeof a == "object") // if we got a real axis, extract number
-                a = a.n;
-            if (typeof a != "number")
-                a = 1; // default to first axis
-            return a;
-        }
-
-        function allAxes() {
-            // return flat array without annoying null entries
-            return $.grep(xaxes.concat(yaxes), function (a) { return a; });
-        }
-
-        function canvasToAxisCoords(pos) {
-            // return an object with x/y corresponding to all used axes
-            var res = {}, i, axis;
-            for (i = 0; i < xaxes.length; ++i) {
-                axis = xaxes[i];
-                if (axis && axis.used)
-                    res["x" + axis.n] = axis.c2p(pos.left);
-            }
-
-            for (i = 0; i < yaxes.length; ++i) {
-                axis = yaxes[i];
-                if (axis && axis.used)
-                    res["y" + axis.n] = axis.c2p(pos.top);
-            }
-
-            if (res.x1 !== undefined)
-                res.x = res.x1;
-            if (res.y1 !== undefined)
-                res.y = res.y1;
-
-            return res;
-        }
-
-        function axisToCanvasCoords(pos) {
-            // get canvas coords from the first pair of x/y found in pos
-            var res = {}, i, axis, key;
-
-            for (i = 0; i < xaxes.length; ++i) {
-                axis = xaxes[i];
-                if (axis && axis.used) {
-                    key = "x" + axis.n;
-                    if (pos[key] == null && axis.n == 1)
-                        key = "x";
-
-                    if (pos[key] != null) {
-                        res.left = axis.p2c(pos[key]);
-                        break;
-                    }
-                }
-            }
-
-            for (i = 0; i < yaxes.length; ++i) {
-                axis = yaxes[i];
-                if (axis && axis.used) {
-                    key = "y" + axis.n;
-                    if (pos[key] == null && axis.n == 1)
-                        key = "y";
-
-                    if (pos[key] != null) {
-                        res.top = axis.p2c(pos[key]);
-                        break;
-                    }
-                }
-            }
-
-            return res;
-        }
-
-        function getOrCreateAxis(axes, number) {
-            if (!axes[number - 1])
-                axes[number - 1] = {
-                    n: number, // save the number for future reference
-                    direction: axes == xaxes ? "x" : "y",
-                    options: $.extend(true, {}, axes == xaxes ? options.xaxis : options.yaxis)
-                };
-
-            return axes[number - 1];
-        }
-
-        function fillInSeriesOptions() {
-
-            var neededColors = series.length, maxIndex = -1, i;
-
-            // Subtract the number of series that already have fixed colors or
-            // color indexes from the number that we still need to generate.
-
-            for (i = 0; i < series.length; ++i) {
-                var sc = series[i].color;
-                if (sc != null) {
-                    neededColors--;
-                    if (typeof sc == "number" && sc > maxIndex) {
-                        maxIndex = sc;
-                    }
-                }
-            }
-
-            // If any of the series have fixed color indexes, then we need to
-            // generate at least as many colors as the highest index.
-
-            if (neededColors <= maxIndex) {
-                neededColors = maxIndex + 1;
-            }
-
-            // Generate all the colors, using first the option colors and then
-            // variations on those colors once they're exhausted.
-
-            var c, colors = [], colorPool = options.colors,
-                colorPoolSize = colorPool.length, variation = 0;
-
-            for (i = 0; i < neededColors; i++) {
-
-                c = $.color.parse(colorPool[i % colorPoolSize] || "#666");
-
-                // Each time we exhaust the colors in the pool we adjust
-                // a scaling factor used to produce more variations on
-                // those colors. The factor alternates negative/positive
-                // to produce lighter/darker colors.
-
-                // Reset the variation after every few cycles, or else
-                // it will end up producing only white or black colors.
-
-                if (i % colorPoolSize == 0 && i) {
-                    if (variation >= 0) {
-                        if (variation < 0.5) {
-                            variation = -variation - 0.2;
-                        } else variation = 0;
-                    } else variation = -variation;
-                }
-
-                colors[i] = c.scale('rgb', 1 + variation);
-            }
-
-            // Finalize the series options, filling in their colors
-
-            var colori = 0, s;
-            for (i = 0; i < series.length; ++i) {
-                s = series[i];
-
-                // assign colors
-                if (s.color == null) {
-                    s.color = colors[colori].toString();
-                    ++colori;
-                }
-                else if (typeof s.color == "number")
-                    s.color = colors[s.color].toString();
-
-                // turn on lines automatically in case nothing is set
-                if (s.lines.show == null) {
-                    var v, show = true;
-                    for (v in s)
-                        if (s[v] && s[v].show) {
-                            show = false;
-                            break;
-                        }
-                    if (show)
-                        s.lines.show = true;
-                }
-
-                // If nothing was provided for lines.zero, default it to match
-                // lines.fill, since areas by default should extend to zero.
-
-                if (s.lines.zero == null) {
-                    s.lines.zero = !!s.lines.fill;
-                }
-
-                // setup axes
-                s.xaxis = getOrCreateAxis(xaxes, axisNumber(s, "x"));
-                s.yaxis = getOrCreateAxis(yaxes, axisNumber(s, "y"));
-            }
-        }
-
-        function processData() {
-            var topSentry = Number.POSITIVE_INFINITY,
-                bottomSentry = Number.NEGATIVE_INFINITY,
-                fakeInfinity = Number.MAX_VALUE,
-                i, j, k, m, length,
-                s, points, ps, x, y, axis, val, f, p,
-                data, format;
-
-            function updateAxis(axis, min, max) {
-                if (min < axis.datamin && min != -fakeInfinity)
-                    axis.datamin = min;
-                if (max > axis.datamax && max != fakeInfinity)
-                    axis.datamax = max;
-            }
-
-            $.each(allAxes(), function (_, axis) {
-                // init axis
-                axis.datamin = topSentry;
-                axis.datamax = bottomSentry;
-                axis.used = false;
-            });
-
-            for (i = 0; i < series.length; ++i) {
-                s = series[i];
-                s.datapoints = { points: [] };
-
-                executeHooks(hooks.processRawData, [ s, s.data, s.datapoints ]);
-            }
-
-            // first pass: clean and copy data
-            for (i = 0; i < series.length; ++i) {
-                s = series[i];
-
-                data = s.data;
-                format = s.datapoints.format;
-
-                if (!format) {
-                    format = [];
-                    // find out how to copy
-                    format.push({ x: true, number: true, required: true });
-                    format.push({ y: true, number: true, required: true });
-
-                    if (s.bars.show || (s.lines.show && s.lines.fill)) {
-                        var autoscale = !!((s.bars.show && s.bars.zero) || (s.lines.show && s.lines.zero));
-                        format.push({ y: true, number: true, required: false, defaultValue: 0, autoscale: autoscale });
-                        if (s.bars.horizontal) {
-                            delete format[format.length - 1].y;
-                            format[format.length - 1].x = true;
-                        }
-                    }
-
-                    s.datapoints.format = format;
-                }
-
-                if (s.datapoints.pointsize != null)
-                    continue; // already filled in
-
-                s.datapoints.pointsize = format.length;
-
-                ps = s.datapoints.pointsize;
-                points = s.datapoints.points;
-
-                var insertSteps = s.lines.show && s.lines.steps;
-                s.xaxis.used = s.yaxis.used = true;
-
-                for (j = k = 0; j < data.length; ++j, k += ps) {
-                    p = data[j];
-
-                    var nullify = p == null;
-                    if (!nullify) {
-                        for (m = 0; m < ps; ++m) {
-                            val = p[m];
-                            f = format[m];
-
-                            if (f) {
-                                if (f.number && val != null) {
-                                    val = +val; // convert to number
-                                    if (isNaN(val))
-                                        val = null;
-                                    else if (val == Infinity)
-                                        val = fakeInfinity;
-                                    else if (val == -Infinity)
-                                        val = -fakeInfinity;
-                                }
-
-                                if (val == null) {
-                                    if (f.required)
-                                        nullify = true;
-
-                                    if (f.defaultValue != null)
-                                        val = f.defaultValue;
-                                }
-                            }
-
-                            points[k + m] = val;
-                        }
-                    }
-
-                    if (nullify) {
-                        for (m = 0; m < ps; ++m) {
-                            val = points[k + m];
-                            if (val != null) {
-                                f = format[m];
-                                // extract min/max info
-                                if (f.autoscale !== false) {
-                                    if (f.x) {
-                                        updateAxis(s.xaxis, val, val);
-                                    }
-                                    if (f.y) {
-                                        updateAxis(s.yaxis, val, val);
-                                    }
-                                }
-                            }
-                            points[k + m] = null;
-                        }
-                    }
-                    else {
-                        // a little bit of line specific stuff that
-                        // perhaps shouldn't be here, but lacking
-                        // better means...
-                        if (insertSteps && k > 0
-                            && points[k - ps] != null
-                            && points[k - ps] != points[k]
-                            && points[k - ps + 1] != points[k + 1]) {
-                            // copy the point to make room for a middle point
-                            for (m = 0; m < ps; ++m)
-                                points[k + ps + m] = points[k + m];
-
-                            // middle point has same y
-                            points[k + 1] = points[k - ps + 1];
-
-                            // we've added a point, better reflect that
-                            k += ps;
-                        }
-                    }
-                }
-            }
-
-            // give the hooks a chance to run
-            for (i = 0; i < series.length; ++i) {
-                s = series[i];
-
-                executeHooks(hooks.processDatapoints, [ s, s.datapoints]);
-            }
-
-            // second pass: find datamax/datamin for auto-scaling
-            for (i = 0; i < series.length; ++i) {
-                s = series[i];
-                points = s.datapoints.points;
-                ps = s.datapoints.pointsize;
-                format = s.datapoints.format;
-
-                var xmin = topSentry, ymin = topSentry,
-                    xmax = bottomSentry, ymax = bottomSentry;
-
-                for (j = 0; j < points.length; j += ps) {
-                    if (points[j] == null)
-                        continue;
-
-                    for (m = 0; m < ps; ++m) {
-                        val = points[j + m];
-                        f = format[m];
-                        if (!f || f.autoscale === false || val == fakeInfinity || val == -fakeInfinity)
-                            continue;
-
-                        if (f.x) {
-                            if (val < xmin)
-                                xmin = val;
-                            if (val > xmax)
-                                xmax = val;
-                        }
-                        if (f.y) {
-                            if (val < ymin)
-                                ymin = val;
-                            if (val > ymax)
-                                ymax = val;
-                        }
-                    }
-                }
-
-                if (s.bars.show) {
-                    // make sure we got room for the bar on the dancing floor
-                    var delta;
-
-                    switch (s.bars.align) {
-                        case "left":
-                            delta = 0;
-                            break;
-                        case "right":
-                            delta = -s.bars.barWidth;
-                            break;
-                        default:
-                            delta = -s.bars.barWidth / 2;
-                    }
-
-                    if (s.bars.horizontal) {
-                        ymin += delta;
-                        ymax += delta + s.bars.barWidth;
-                    }
-                    else {
-                        xmin += delta;
-                        xmax += delta + s.bars.barWidth;
-                    }
-                }
-
-                updateAxis(s.xaxis, xmin, xmax);
-                updateAxis(s.yaxis, ymin, ymax);
-            }
-
-            $.each(allAxes(), function (_, axis) {
-                if (axis.datamin == topSentry)
-                    axis.datamin = null;
-                if (axis.datamax == bottomSentry)
-                    axis.datamax = null;
-            });
-        }
-
-        function setupCanvases() {
-
-            // Make sure the placeholder is clear of everything except canvases
-            // from a previous plot in this container that we'll try to re-use.
-
-            placeholder.css("padding", 0) // padding messes up the positioning
-                .children().filter(function(){
-                    return !$(this).hasClass("flot-overlay") && !$(this).hasClass('flot-base');
-                }).remove();
-
-            if (placeholder.css("position") == 'static')
-                placeholder.css("position", "relative"); // for positioning labels and overlay
-
-            surface = new Canvas("flot-base", placeholder);
-            overlay = new Canvas("flot-overlay", placeholder); // overlay canvas for interactive features
-
-            ctx = surface.context;
-            octx = overlay.context;
-
-            // define which element we're listening for events on
-            eventHolder = $(overlay.element).unbind();
-
-            // If we're re-using a plot object, shut down the old one
-
-            var existing = placeholder.data("plot");
-
-            if (existing) {
-                existing.shutdown();
-                overlay.clear();
-            }
-
-            // save in case we get replotted
-            placeholder.data("plot", plot);
-        }
-
-        function bindEvents() {
-            // bind events
-            if (options.grid.hoverable) {
-                eventHolder.mousemove(onMouseMove);
-
-                // Use bind, rather than .mouseleave, because we officially
-                // still support jQuery 1.2.6, which doesn't define a shortcut
-                // for mouseenter or mouseleave.  This was a bug/oversight that
-                // was fixed somewhere around 1.3.x.  We can return to using
-                // .mouseleave when we drop support for 1.2.6.
-
-                eventHolder.bind("mouseleave", onMouseLeave);
-            }
-
-            if (options.grid.clickable)
-                eventHolder.click(onClick);
-
-            executeHooks(hooks.bindEvents, [eventHolder]);
-        }
-
-        function shutdown() {
-            if (redrawTimeout)
-                clearTimeout(redrawTimeout);
-
-            eventHolder.unbind("mousemove", onMouseMove);
-            eventHolder.unbind("mouseleave", onMouseLeave);
-            eventHolder.unbind("click", onClick);
-
-            executeHooks(hooks.shutdown, [eventHolder]);
-        }
-
-        function setTransformationHelpers(axis) {
-            // set helper functions on the axis, assumes plot area
-            // has been computed already
-
-            function identity(x) { return x; }
-
-            var s, m, t = axis.options.transform || identity,
-                it = axis.options.inverseTransform;
-
-            // precompute how much the axis is scaling a point
-            // in canvas space
-            if (axis.direction == "x") {
-                s = axis.scale = plotWidth / Math.abs(t(axis.max) - t(axis.min));
-                m = Math.min(t(axis.max), t(axis.min));
-            }
-            else {
-                s = axis.scale = plotHeight / Math.abs(t(axis.max) - t(axis.min));
-                s = -s;
-                m = Math.max(t(axis.max), t(axis.min));
-            }
-
-            // data point to canvas coordinate
-            if (t == identity) // slight optimization
-                axis.p2c = function (p) { return (p - m) * s; };
-            else
-                axis.p2c = function (p) { return (t(p) - m) * s; };
-            // canvas coordinate to data point
-            if (!it)
-                axis.c2p = function (c) { return m + c / s; };
-            else
-                axis.c2p = function (c) { return it(m + c / s); };
-        }
-
-        function measureTickLabels(axis) {
-
-            var opts = axis.options,
-                ticks = axis.ticks || [],
-                labelWidth = opts.labelWidth || 0,
-                labelHeight = opts.labelHeight || 0,
-                maxWidth = labelWidth || (axis.direction == "x" ? Math.floor(surface.width / (ticks.length || 1)) : null),
-                legacyStyles = axis.direction + "Axis " + axis.direction + axis.n + "Axis",
-                layer = "flot-" + axis.direction + "-axis flot-" + axis.direction + axis.n + "-axis " + legacyStyles,
-                font = opts.font || "flot-tick-label tickLabel";
-
-            for (var i = 0; i < ticks.length; ++i) {
-
-                var t = ticks[i];
-
-                if (!t.label)
-                    continue;
-
-                var info = surface.getTextInfo(layer, t.label, font, null, maxWidth);
-
-                labelWidth = Math.max(labelWidth, info.width);
-                labelHeight = Math.max(labelHeight, info.height);
-            }
-
-            axis.labelWidth = opts.labelWidth || labelWidth;
-            axis.labelHeight = opts.labelHeight || labelHeight;
-        }
-
-        function allocateAxisBoxFirstPhase(axis) {
-            // find the bounding box of the axis by looking at label
-            // widths/heights and ticks, make room by diminishing the
-            // plotOffset; this first phase only looks at one
-            // dimension per axis, the other dimension depends on the
-            // other axes so will have to wait
-
-            var lw = axis.labelWidth,
-                lh = axis.labelHeight,
-                pos = axis.options.position,
-                isXAxis = axis.direction === "x",
-                tickLength = axis.options.tickLength,
-                axisMargin = options.grid.axisMargin,
-                padding = options.grid.labelMargin,
-                innermost = true,
-                outermost = true,
-                first = true,
-                found = false;
-
-            // Determine the axis's position in its direction and on its side
-
-            $.each(isXAxis ? xaxes : yaxes, function(i, a) {
-                if (a && (a.show || a.reserveSpace)) {
-                    if (a === axis) {
-                        found = true;
-                    } else if (a.options.position === pos) {
-                        if (found) {
-                            outermost = false;
-                        } else {
-                            innermost = false;
-                        }
-                    }
-                    if (!found) {
-                        first = false;
-                    }
-                }
-            });
-
-            // The outermost axis on each side has no margin
-
-            if (outermost) {
-                axisMargin = 0;
-            }
-
-            // The ticks for the first axis in each direction stretch across
-
-            if (tickLength == null) {
-                tickLength = first ? "full" : 5;
-            }
-
-            if (!isNaN(+tickLength))
-                padding += +tickLength;
-
-            if (isXAxis) {
-                lh += padding;
-
-                if (pos == "bottom") {
-                    plotOffset.bottom += lh + axisMargin;
-                    axis.box = { top: surface.height - plotOffset.bottom, height: lh };
-                }
-                else {
-                    axis.box = { top: plotOffset.top + axisMargin, height: lh };
-                    plotOffset.top += lh + axisMargin;
-                }
-            }
-            else {
-                lw += padding;
-
-                if (pos == "left") {
-                    axis.box = { left: plotOffset.left + axisMargin, width: lw };
-                    plotOffset.left += lw + axisMargin;
-                }
-                else {
-                    plotOffset.right += lw + axisMargin;
-                    axis.box = { left: surface.width - plotOffset.right, width: lw };
-                }
-            }
-
-             // save for future reference
-            axis.position = pos;
-            axis.tickLength = tickLength;
-            axis.box.padding = padding;
-            axis.innermost = innermost;
-        }
-
-        function allocateAxisBoxSecondPhase(axis) {
-            // now that all axis boxes have been placed in one
-            // dimension, we can set the remaining dimension coordinates
-            if (axis.direction == "x") {
-                axis.box.left = plotOffset.left - axis.labelWidth / 2;
-                axis.box.width = surface.width - plotOffset.left - plotOffset.right + axis.labelWidth;
-            }
-            else {
-                axis.box.top = plotOffset.top - axis.labelHeight / 2;
-                axis.box.height = surface.height - plotOffset.bottom - plotOffset.top + axis.labelHeight;
-            }
-        }
-
-        function adjustLayoutForThingsStickingOut() {
-            // possibly adjust plot offset to ensure everything stays
-            // inside the canvas and isn't clipped off
-
-            var minMargin = options.grid.minBorderMargin,
-                axis, i;
-
-            // check stuff from the plot (FIXME: this should just read
-            // a value from the series, otherwise it's impossible to
-            // customize)
-            if (minMargin == null) {
-                minMargin = 0;
-                for (i = 0; i < series.length; ++i)
-                    minMargin = Math.max(minMargin, 2 * (series[i].points.radius + series[i].points.lineWidth/2));
-            }
-
-            var margins = {
-                left: minMargin,
-                right: minMargin,
-                top: minMargin,
-                bottom: minMargin
-            };
-
-            // check axis labels, note we don't check the actual
-            // labels but instead use the overall width/height to not
-            // jump as much around with replots
-            $.each(allAxes(), function (_, axis) {
-                if (axis.reserveSpace && axis.ticks && axis.ticks.length) {
-                    if (axis.direction === "x") {
-                        margins.left = Math.max(margins.left, axis.labelWidth / 2);
-                        margins.right = Math.max(margins.right, axis.labelWidth / 2);
-                    } else {
-                        margins.bottom = Math.max(margins.bottom, axis.labelHeight / 2);
-                        margins.top = Math.max(margins.top, axis.labelHeight / 2);
-                    }
-                }
-            });
-
-            plotOffset.left = Math.ceil(Math.max(margins.left, plotOffset.left));
-            plotOffset.right = Math.ceil(Math.max(margins.right, plotOffset.right));
-            plotOffset.top = Math.ceil(Math.max(margins.top, plotOffset.top));
-            plotOffset.bottom = Math.ceil(Math.max(margins.bottom, plotOffset.bottom));
-        }
-
-        function setupGrid() {
-            var i, axes = allAxes(), showGrid = options.grid.show;
-
-            // Initialize the plot's offset from the edge of the canvas
-
-            for (var a in plotOffset) {
-                var margin = options.grid.margin || 0;
-                plotOffset[a] = typeof margin == "number" ? margin : margin[a] || 0;
-            }
-
-            executeHooks(hooks.processOffset, [plotOffset]);
-
-            // If the grid is visible, add its border width to the offset
-
-            for (var a in plotOffset) {
-                if(typeof(options.grid.borderWidth) == "object") {
-                    plotOffset[a] += showGrid ? options.grid.borderWidth[a] : 0;
-                }
-                else {
-                    plotOffset[a] += showGrid ? options.grid.borderWidth : 0;
-                }
-            }
-
-            $.each(axes, function (_, axis) {
-                var axisOpts = axis.options;
-                axis.show = axisOpts.show == null ? axis.used : axisOpts.show;
-                axis.reserveSpace = axisOpts.reserveSpace == null ? axis.show : axisOpts.reserveSpace;
-                setRange(axis);
-            });
-
-            if (showGrid) {
-
-                var allocatedAxes = $.grep(axes, function (axis) {
-                    return axis.show || axis.reserveSpace;
-                });
-
-                $.each(allocatedAxes, function (_, axis) {
-                    // make the ticks
-                    setupTickGeneration(axis);
-                    setTicks(axis);
-                    snapRangeToTicks(axis, axis.ticks);
-                    // find labelWidth/Height for axis
-                    measureTickLabels(axis);
-                });
-
-                // with all dimensions calculated, we can compute the
-                // axis bounding boxes, start from the outside
-                // (reverse order)
-                for (i = allocatedAxes.length - 1; i >= 0; --i)
-                    allocateAxisBoxFirstPhase(allocatedAxes[i]);
-
-                // make sure we've got enough space for things that
-                // might stick out
-                adjustLayoutForThingsStickingOut();
-
-                $.each(allocatedAxes, function (_, axis) {
-                    allocateAxisBoxSecondPhase(axis);
-                });
-            }
-
-            plotWidth = surface.width - plotOffset.left - plotOffset.right;
-            plotHeight = surface.height - plotOffset.bottom - plotOffset.top;
-
-            // now we got the proper plot dimensions, we can compute the scaling
-            $.each(axes, function (_, axis) {
-                setTransformationHelpers(axis);
-            });
-
-            if (showGrid) {
-                drawAxisLabels();
-            }
-
-            insertLegend();
-        }
-
-        function setRange(axis) {
-            var opts = axis.options,
-                min = +(opts.min != null ? opts.min : axis.datamin),
-                max = +(opts.max != null ? opts.max : axis.datamax),
-                delta = max - min;
-
-            if (delta == 0.0) {
-                // degenerate case
-                var widen = max == 0 ? 1 : 0.01;
-
-                if (opts.min == null)
-                    min -= widen;
-                // always widen max if we couldn't widen min to ensure we
-                // don't fall into min == max which doesn't work
-                if (opts.max == null || opts.min != null)
-                    max += widen;
-            }
-            else {
-                // consider autoscaling
-                var margin = opts.autoscaleMargin;
-                if (margin != null) {
-                    if (opts.min == null) {
-                        min -= delta * margin;
-                        // make sure we don't go below zero if all values
-                        // are positive
-                        if (min < 0 && axis.datamin != null && axis.datamin >= 0)
-                            min = 0;
-                    }
-                    if (opts.max == null) {
-                        max += delta * margin;
-                        if (max > 0 && axis.datamax != null && axis.datamax <= 0)
-                            max = 0;
-                    }
-                }
-            }
-            axis.min = min;
-            axis.max = max;
-        }
-
-        function setupTickGeneration(axis) {
-            var opts = axis.options;
-
-            // estimate number of ticks
-            var noTicks;
-            if (typeof opts.ticks == "number" && opts.ticks > 0)
-                noTicks = opts.ticks;
-            else
-                // heuristic based on the model a*sqrt(x) fitted to
-                // some data points that seemed reasonable
-                noTicks = 0.3 * Math.sqrt(axis.direction == "x" ? surface.width : surface.height);
-
-            var delta = (axis.max - axis.min) / noTicks,
-                dec = -Math.floor(Math.log(delta) / Math.LN10),
-                maxDec = opts.tickDecimals;
-
-            if (maxDec != null && dec > maxDec) {
-                dec = maxDec;
-            }
-
-            var magn = Math.pow(10, -dec),
-                norm = delta / magn, // norm is between 1.0 and 10.0
-                size;
-
-            if (norm < 1.5) {
-                size = 1;
-            } else if (norm < 3) {
-                size = 2;
-                // special case for 2.5, requires an extra decimal
-                if (norm > 2.25 && (maxDec == null || dec + 1 <= maxDec)) {
-                    size = 2.5;
-                    ++dec;
-                }
-            } else if (norm < 7.5) {
-                size = 5;
-            } else {
-                size = 10;
-            }
-
-            size *= magn;
-
-            if (opts.minTickSize != null && size < opts.minTickSize) {
-                size = opts.minTickSize;
-            }
-
-            axis.delta = delta;
-            axis.tickDecimals = Math.max(0, maxDec != null ? maxDec : dec);
-            axis.tickSize = opts.tickSize || size;
-
-            // Time mode was moved to a plug-in in 0.8, and since so many people use it
-            // we'll add an especially friendly reminder to make sure they included it.
-
-            if (opts.mode == "time" && !axis.tickGenerator) {
-                throw new Error("Time mode requires the flot.time plugin.");
-            }
-
-            // Flot supports base-10 axes; any other mode else is handled by a plug-in,
-            // like flot.time.js.
-
-            if (!axis.tickGenerator) {
-
-                axis.tickGenerator = function (axis) {
-
-                    var ticks = [],
-                        start = floorInBase(axis.min, axis.tickSize),
-                        i = 0,
-                        v = Number.NaN,
-                        prev;
-
-                    do {
-                        prev = v;
-                        v = start + i * axis.tickSize;
-                        ticks.push(v);
-                        ++i;
-                    } while (v < axis.max && v != prev);
-                    return ticks;
-                };
-
-				axis.tickFormatter = function (value, axis) {
-
-					var factor = axis.tickDecimals ? Math.pow(10, axis.tickDecimals) : 1;
-					var formatted = "" + Math.round(value * factor) / factor;
-
-					// If tickDecimals was specified, ensure that we have exactly that
-					// much precision; otherwise default to the value's own precision.
-
-					if (axis.tickDecimals != null) {
-						var decimal = formatted.indexOf(".");
-						var precision = decimal == -1 ? 0 : formatted.length - decimal - 1;
-						if (precision < axis.tickDecimals) {
-							return (precision ? formatted : formatted + ".") + ("" + factor).substr(1, axis.tickDecimals - precision);
-						}
-					}
-
-                    return formatted;
-                };
-            }
-
-            if ($.isFunction(opts.tickFormatter))
-                axis.tickFormatter = function (v, axis) { return "" + opts.tickFormatter(v, axis); };
-
-            if (opts.alignTicksWithAxis != null) {
-                var otherAxis = (axis.direction == "x" ? xaxes : yaxes)[opts.alignTicksWithAxis - 1];
-                if (otherAxis && otherAxis.used && otherAxis != axis) {
-                    // consider snapping min/max to outermost nice ticks
-                    var niceTicks = axis.tickGenerator(axis);
-                    if (niceTicks.length > 0) {
-                        if (opts.min == null)
-                            axis.min = Math.min(axis.min, niceTicks[0]);
-                        if (opts.max == null && niceTicks.length > 1)
-                            axis.max = Math.max(axis.max, niceTicks[niceTicks.length - 1]);
-                    }
-
-                    axis.tickGenerator = function (axis) {
-                        // copy ticks, scaled to this axis
-                        var ticks = [], v, i;
-                        for (i = 0; i < otherAxis.ticks.length; ++i) {
-                            v = (otherAxis.ticks[i].v - otherAxis.min) / (otherAxis.max - otherAxis.min);
-                            v = axis.min + v * (axis.max - axis.min);
-                            ticks.push(v);
-                        }
-                        return ticks;
-                    };
-
-                    // we might need an extra decimal since forced
-                    // ticks don't necessarily fit naturally
-                    if (!axis.mode && opts.tickDecimals == null) {
-                        var extraDec = Math.max(0, -Math.floor(Math.log(axis.delta) / Math.LN10) + 1),
-                            ts = axis.tickGenerator(axis);
-
-                        // only proceed if the tick interval rounded
-                        // with an extra decimal doesn't give us a
-                        // zero at end
-                        if (!(ts.length > 1 && /\..*0$/.test((ts[1] - ts[0]).toFixed(extraDec))))
-                            axis.tickDecimals = extraDec;
-                    }
-                }
-            }
-        }
-
-        function setTicks(axis) {
-            var oticks = axis.options.ticks, ticks = [];
-            if (oticks == null || (typeof oticks == "number" && oticks > 0))
-                ticks = axis.tickGenerator(axis);
-            else if (oticks) {
-                if ($.isFunction(oticks))
-                    // generate the ticks
-                    ticks = oticks(axis);
-                else
-                    ticks = oticks;
-            }
-
-            // clean up/labelify the supplied ticks, copy them over
-            var i, v;
-            axis.ticks = [];
-            for (i = 0; i < ticks.length; ++i) {
-                var label = null;
-                var t = ticks[i];
-                if (typeof t == "object") {
-                    v = +t[0];
-                    if (t.length > 1)
-                        label = t[1];
-                }
-                else
-                    v = +t;
-                if (label == null)
-                    label = axis.tickFormatter(v, axis);
-                if (!isNaN(v))
-                    axis.ticks.push({ v: v, label: label });
-            }
-        }
-
-        function snapRangeToTicks(axis, ticks) {
-            if (axis.options.autoscaleMargin && ticks.length > 0) {
-                // snap to ticks
-                if (axis.options.min == null)
-                    axis.min = Math.min(axis.min, ticks[0].v);
-                if (axis.options.max == null && ticks.length > 1)
-                    axis.max = Math.max(axis.max, ticks[ticks.length - 1].v);
-            }
-        }
-
-        function draw() {
-
-            surface.clear();
-
-            executeHooks(hooks.drawBackground, [ctx]);
-
-            var grid = options.grid;
-
-            // draw background, if any
-            if (grid.show && grid.backgroundColor)
-                drawBackground();
-
-            if (grid.show && !grid.aboveData) {
-                drawGrid();
-            }
-
-            for (var i = 0; i < series.length; ++i) {
-                executeHooks(hooks.drawSeries, [ctx, series[i]]);
-                drawSeries(series[i]);
-            }
-
-            executeHooks(hooks.draw, [ctx]);
-
-            if (grid.show && grid.aboveData) {
-                drawGrid();
-            }
-
-            surface.render();
-
-            // A draw implies that either the axes or data have changed, so we
-            // should probably update the overlay highlights as well.
-
-            triggerRedrawOverlay();
-        }
-
-        function extractRange(ranges, coord) {
-            var axis, from, to, key, axes = allAxes();
-
-            for (var i = 0; i < axes.length; ++i) {
-                axis = axes[i];
-                if (axis.direction == coord) {
-                    key = coord + axis.n + "axis";
-                    if (!ranges[key] && axis.n == 1)
-                        key = coord + "axis"; // support x1axis as xaxis
-                    if (ranges[key]) {
-                        from = ranges[key].from;
-                        to = ranges[key].to;
-                        break;
-                    }
-                }
-            }
-
-            // backwards-compat stuff - to be removed in future
-            if (!ranges[key]) {
-                axis = coord == "x" ? xaxes[0] : yaxes[0];
-                from = ranges[coord + "1"];
-                to = ranges[coord + "2"];
-            }
-
-            // auto-reverse as an added bonus
-            if (from != null && to != null && from > to) {
-                var tmp = from;
-                from = to;
-                to = tmp;
-            }
-
-            return { from: from, to: to, axis: axis };
-        }
-
-        function drawBackground() {
-            ctx.save();
-            ctx.translate(plotOffset.left, plotOffset.top);
-
-            ctx.fillStyle = getColorOrGradient(options.grid.backgroundColor, plotHeight, 0, "rgba(255, 255, 255, 0)");
-            ctx.fillRect(0, 0, plotWidth, plotHeight);
-            ctx.restore();
-        }
-
-        function drawGrid() {
-            var i, axes, bw, bc;
-
-            ctx.save();
-            ctx.translate(plotOffset.left, plotOffset.top);
-
-            // draw markings
-            var markings = options.grid.markings;
-            if (markings) {
-                if ($.isFunction(markings)) {
-                    axes = plot.getAxes();
-                    // xmin etc. is backwards compatibility, to be
-                    // removed in the future
-                    axes.xmin = axes.xaxis.min;
-                    axes.xmax = axes.xaxis.max;
-                    axes.ymin = axes.yaxis.min;
-                    axes.ymax = axes.yaxis.max;
-
-                    markings = markings(axes);
-                }
-
-                for (i = 0; i < markings.length; ++i) {
-                    var m = markings[i],
-                        xrange = extractRange(m, "x"),
-                        yrange = extractRange(m, "y");
-
-                    // fill in missing
-                    if (xrange.from == null)
-                        xrange.from = xrange.axis.min;
-                    if (xrange.to == null)
-                        xrange.to = xrange.axis.max;
-                    if (yrange.from == null)
-                        yrange.from = yrange.axis.min;
-                    if (yrange.to == null)
-                        yrange.to = yrange.axis.max;
-
-                    // clip
-                    if (xrange.to < xrange.axis.min || xrange.from > xrange.axis.max ||
-                        yrange.to < yrange.axis.min || yrange.from > yrange.axis.max)
-                        continue;
-
-                    xrange.from = Math.max(xrange.from, xrange.axis.min);
-                    xrange.to = Math.min(xrange.to, xrange.axis.max);
-                    yrange.from = Math.max(yrange.from, yrange.axis.min);
-                    yrange.to = Math.min(yrange.to, yrange.axis.max);
-
-                    var xequal = xrange.from === xrange.to,
-                        yequal = yrange.from === yrange.to;
-
-                    if (xequal && yequal) {
-                        continue;
-                    }
-
-                    // then draw
-                    xrange.from = Math.floor(xrange.axis.p2c(xrange.from));
-                    xrange.to = Math.floor(xrange.axis.p2c(xrange.to));
-                    yrange.from = Math.floor(yrange.axis.p2c(yrange.from));
-                    yrange.to = Math.floor(yrange.axis.p2c(yrange.to));
-
-                    if (xequal || yequal) {
-                        var lineWidth = m.lineWidth || options.grid.markingsLineWidth,
-                            subPixel = lineWidth % 2 ? 0.5 : 0;
-                        ctx.beginPath();
-                        ctx.strokeStyle = m.color || options.grid.markingsColor;
-                        ctx.lineWidth = lineWidth;
-                        if (xequal) {
-                            ctx.moveTo(xrange.to + subPixel, yrange.from);
-                            ctx.lineTo(xrange.to + subPixel, yrange.to);
-                        } else {
-                            ctx.moveTo(xrange.from, yrange.to + subPixel);
-                            ctx.lineTo(xrange.to, yrange.to + subPixel);
-                        }
-                        ctx.stroke();
-                    } else {
-                        ctx.fillStyle = m.color || options.grid.markingsColor;
-                        ctx.fillRect(xrange.from, yrange.to,
-                                     xrange.to - xrange.from,
-                                     yrange.from - yrange.to);
-                    }
-                }
-            }
-
-            // draw the ticks
-            axes = allAxes();
-            bw = options.grid.borderWidth;
-
-            for (var j = 0; j < axes.length; ++j) {
-                var axis = axes[j], box = axis.box,
-                    t = axis.tickLength, x, y, xoff, yoff;
-                if (!axis.show || axis.ticks.length == 0)
-                    continue;
-
-                ctx.lineWidth = 1;
-
-                // find the edges
-                if (axis.direction == "x") {
-                    x = 0;
-                    if (t == "full")
-                        y = (axis.position == "top" ? 0 : plotHeight);
-                    else
-                        y = box.top - plotOffset.top + (axis.position == "top" ? box.height : 0);
-                }
-                else {
-                    y = 0;
-                    if (t == "full")
-                        x = (axis.position == "left" ? 0 : plotWidth);
-                    else
-                        x = box.left - plotOffset.left + (axis.position == "left" ? box.width : 0);
-                }
-
-                // draw tick bar
-                if (!axis.innermost) {
-                    ctx.strokeStyle = axis.options.color;
-                    ctx.beginPath();
-                    xoff = yoff = 0;
-                    if (axis.direction == "x")
-                        xoff = plotWidth + 1;
-                    else
-                        yoff = plotHeight + 1;
-
-                    if (ctx.lineWidth == 1) {
-                        if (axis.direction == "x") {
-                            y = Math.floor(y) + 0.5;
-                        } else {
-                            x = Math.floor(x) + 0.5;
-                        }
-                    }
-
-                    ctx.moveTo(x, y);
-                    ctx.lineTo(x + xoff, y + yoff);
-                    ctx.stroke();
-                }
-
-                // draw ticks
-
-                ctx.strokeStyle = axis.options.tickColor;
-
-                ctx.beginPath();
-                for (i = 0; i < axis.ticks.length; ++i) {
-                    var v = axis.ticks[i].v;
-
-                    xoff = yoff = 0;
-
-                    if (isNaN(v) || v < axis.min || v > axis.max
-                        // skip those lying on the axes if we got a border
-                        || (t == "full"
-                            && ((typeof bw == "object" && bw[axis.position] > 0) || bw > 0)
-                            && (v == axis.min || v == axis.max)))
-                        continue;
-
-                    if (axis.direction == "x") {
-                        x = axis.p2c(v);
-                        yoff = t == "full" ? -plotHeight : t;
-
-                        if (axis.position == "top")
-                            yoff = -yoff;
-                    }
-                    else {
-                        y = axis.p2c(v);
-                        xoff = t == "full" ? -plotWidth : t;
-
-                        if (axis.position == "left")
-                            xoff = -xoff;
-                    }
-
-                    if (ctx.lineWidth == 1) {
-                        if (axis.direction == "x")
-                            x = Math.floor(x) + 0.5;
-                        else
-                            y = Math.floor(y) + 0.5;
-                    }
-
-                    ctx.moveTo(x, y);
-                    ctx.lineTo(x + xoff, y + yoff);
-                }
-
-                ctx.stroke();
-            }
-
-
-            // draw border
-            if (bw) {
-                // If either borderWidth or borderColor is an object, then draw the border
-                // line by line instead of as one rectangle
-                bc = options.grid.borderColor;
-                if(typeof bw == "object" || typeof bc == "object") {
-                    if (typeof bw !== "object") {
-                        bw = {top: bw, right: bw, bottom: bw, left: bw};
-                    }
-                    if (typeof bc !== "object") {
-                        bc = {top: bc, right: bc, bottom: bc, left: bc};
-                    }
-
-                    if (bw.top > 0) {
-                        ctx.strokeStyle = bc.top;
-                        ctx.lineWidth = bw.top;
-                        ctx.beginPath();
-                        ctx.moveTo(0 - bw.left, 0 - bw.top/2);
-                        ctx.lineTo(plotWidth, 0 - bw.top/2);
-                        ctx.stroke();
-                    }
-
-                    if (bw.right > 0) {
-                        ctx.strokeStyle = bc.right;
-                        ctx.lineWidth = bw.right;
-                        ctx.beginPath();
-                        ctx.moveTo(plotWidth + bw.right / 2, 0 - bw.top);
-                        ctx.lineTo(plotWidth + bw.right / 2, plotHeight);
-                        ctx.stroke();
-                    }
-
-                    if (bw.bottom > 0) {
-                        ctx.strokeStyle = bc.bottom;
-                        ctx.lineWidth = bw.bottom;
-                        ctx.beginPath();
-                        ctx.moveTo(plotWidth + bw.right, plotHeight + bw.bottom / 2);
-                        ctx.lineTo(0, plotHeight + bw.bottom / 2);
-                        ctx.stroke();
-                    }
-
-                    if (bw.left > 0) {
-                        ctx.strokeStyle = bc.left;
-                        ctx.lineWidth = bw.left;
-                        ctx.beginPath();
-                        ctx.moveTo(0 - bw.left/2, plotHeight + bw.bottom);
-                        ctx.lineTo(0- bw.left/2, 0);
-                        ctx.stroke();
-                    }
-                }
-                else {
-                    ctx.lineWidth = bw;
-                    ctx.strokeStyle = options.grid.borderColor;
-                    ctx.strokeRect(-bw/2, -bw/2, plotWidth + bw, plotHeight + bw);
-                }
-            }
-
-            ctx.restore();
-        }
-
-        function drawAxisLabels() {
-
-            $.each(allAxes(), function (_, axis) {
-                var box = axis.box,
-                    legacyStyles = axis.direction + "Axis " + axis.direction + axis.n + "Axis",
-                    layer = "flot-" + axis.direction + "-axis flot-" + axis.direction + axis.n + "-axis " + legacyStyles,
-                    font = axis.options.font || "flot-tick-label tickLabel",
-                    tick, x, y, halign, valign;
-
-                // Remove text before checking for axis.show and ticks.length;
-                // otherwise plugins, like flot-tickrotor, that draw their own
-                // tick labels will end up with both theirs and the defaults.
-
-                surface.removeText(layer);
-
-                if (!axis.show || axis.ticks.length == 0)
-                    return;
-
-                for (var i = 0; i < axis.ticks.length; ++i) {
-
-                    tick = axis.ticks[i];
-                    if (!tick.label || tick.v < axis.min || tick.v > axis.max)
-                        continue;
-
-                    if (axis.direction == "x") {
-                        halign = "center";
-                        x = plotOffset.left + axis.p2c(tick.v);
-                        if (axis.position == "bottom") {
-                            y = box.top + box.padding;
-                        } else {
-                            y = box.top + box.height - box.padding;
-                            valign = "bottom";
-                        }
-                    } else {
-                        valign = "middle";
-                        y = plotOffset.top + axis.p2c(tick.v);
-                        if (axis.position == "left") {
-                            x = box.left + box.width - box.padding;
-                            halign = "right";
-                        } else {
-                            x = box.left + box.padding;
-                        }
-                    }
-
-                    surface.addText(layer, x, y, tick.label, font, null, null, halign, valign);
-                }
-            });
-        }
-
-        function drawSeries(series) {
-            if (series.lines.show)
-                drawSeriesLines(series);
-            if (series.bars.show)
-                drawSeriesBars(series);
-            if (series.points.show)
-                drawSeriesPoints(series);
-        }
-
-        function drawSeriesLines(series) {
-            function plotLine(datapoints, xoffset, yoffset, axisx, axisy) {
-                var points = datapoints.points,
-                    ps = datapoints.pointsize,
-                    prevx = null, prevy = null;
-
-                ctx.beginPath();
-                for (var i = ps; i < points.length; i += ps) {
-                    var x1 = points[i - ps], y1 = points[i - ps + 1],
-                        x2 = points[i], y2 = points[i + 1];
-
-                    if (x1 == null || x2 == null)
-                        continue;
-
-                    // clip with ymin
-                    if (y1 <= y2 && y1 < axisy.min) {
-                        if (y2 < axisy.min)
-                            continue;   // line segment is outside
-                        // compute new intersection point
-                        x1 = (axisy.min - y1) / (y2 - y1) * (x2 - x1) + x1;
-                        y1 = axisy.min;
-                    }
-                    else if (y2 <= y1 && y2 < axisy.min) {
-                        if (y1 < axisy.min)
-                            continue;
-                        x2 = (axisy.min - y1) / (y2 - y1) * (x2 - x1) + x1;
-                        y2 = axisy.min;
-                    }
-
-                    // clip with ymax
-                    if (y1 >= y2 && y1 > axisy.max) {
-                        if (y2 > axisy.max)
-                            continue;
-                        x1 = (axisy.max - y1) / (y2 - y1) * (x2 - x1) + x1;
-                        y1 = axisy.max;
-                    }
-                    else if (y2 >= y1 && y2 > axisy.max) {
-                        if (y1 > axisy.max)
-                            continue;
-                        x2 = (axisy.max - y1) / (y2 - y1) * (x2 - x1) + x1;
-                        y2 = axisy.max;
-                    }
-
-                    // clip with xmin
-                    if (x1 <= x2 && x1 < axisx.min) {
-                        if (x2 < axisx.min)
-                            continue;
-                        y1 = (axisx.min - x1) / (x2 - x1) * (y2 - y1) + y1;
-                        x1 = axisx.min;
-                    }
-                    else if (x2 <= x1 && x2 < axisx.min) {
-                        if (x1 < axisx.min)
-                            continue;
-                        y2 = (axisx.min - x1) / (x2 - x1) * (y2 - y1) + y1;
-                        x2 = axisx.min;
-                    }
-
-                    // clip with xmax
-                    if (x1 >= x2 && x1 > axisx.max) {
-                        if (x2 > axisx.max)
-                            continue;
-                        y1 = (axisx.max - x1) / (x2 - x1) * (y2 - y1) + y1;
-                        x1 = axisx.max;
-                    }
-                    else if (x2 >= x1 && x2 > axisx.max) {
-                        if (x1 > axisx.max)
-                            continue;
-                        y2 = (axisx.max - x1) / (x2 - x1) * (y2 - y1) + y1;
-                        x2 = axisx.max;
-                    }
-
-                    if (x1 != prevx || y1 != prevy)
-                        ctx.moveTo(axisx.p2c(x1) + xoffset, axisy.p2c(y1) + yoffset);
-
-                    prevx = x2;
-                    prevy = y2;
-                    ctx.lineTo(axisx.p2c(x2) + xoffset, axisy.p2c(y2) + yoffset);
-                }
-                ctx.stroke();
-            }
-
-            function plotLineArea(datapoints, axisx, axisy) {
-                var points = datapoints.points,
-                    ps = datapoints.pointsize,
-                    bottom = Math.min(Math.max(0, axisy.min), axisy.max),
-                    i = 0, top, areaOpen = false,
-                    ypos = 1, segmentStart = 0, segmentEnd = 0;
-
-                // we process each segment in two turns, first forward
-                // direction to sketch out top, then once we hit the
-                // end we go backwards to sketch the bottom
-                while (true) {
-                    if (ps > 0 && i > points.length + ps)
-                        break;
-
-                    i += ps; // ps is negative if going backwards
-
-                    var x1 = points[i - ps],
-                        y1 = points[i - ps + ypos],
-                        x2 = points[i], y2 = points[i + ypos];
-
-                    if (areaOpen) {
-                        if (ps > 0 && x1 != null && x2 == null) {
-                            // at turning point
-                            segmentEnd = i;
-                            ps = -ps;
-                            ypos = 2;
-                            continue;
-                        }
-
-                        if (ps < 0 && i == segmentStart + ps) {
-                            // done with the reverse sweep
-                            ctx.fill();
-                            areaOpen = false;
-                            ps = -ps;
-                            ypos = 1;
-                            i = segmentStart = segmentEnd + ps;
-                            continue;
-                        }
-                    }
-
-                    if (x1 == null || x2 == null)
-                        continue;
-
-                    // clip x values
-
-                    // clip with xmin
-                    if (x1 <= x2 && x1 < axisx.min) {
-                        if (x2 < axisx.min)
-                            continue;
-                        y1 = (axisx.min - x1) / (x2 - x1) * (y2 - y1) + y1;
-                        x1 = axisx.min;
-                    }
-                    else if (x2 <= x1 && x2 < axisx.min) {
-                        if (x1 < axisx.min)
-                            continue;
-                        y2 = (axisx.min - x1) / (x2 - x1) * (y2 - y1) + y1;
-                        x2 = axisx.min;
-                    }
-
-                    // clip with xmax
-                    if (x1 >= x2 && x1 > axisx.max) {
-                        if (x2 > axisx.max)
-                            continue;
-                        y1 = (axisx.max - x1) / (x2 - x1) * (y2 - y1) + y1;
-                        x1 = axisx.max;
-                    }
-                    else if (x2 >= x1 && x2 > axisx.max) {
-                        if (x1 > axisx.max)
-                            continue;
-                        y2 = (axisx.max - x1) / (x2 - x1) * (y2 - y1) + y1;
-                        x2 = axisx.max;
-                    }
-
-                    if (!areaOpen) {
-                        // open area
-                        ctx.beginPath();
-                        ctx.moveTo(axisx.p2c(x1), axisy.p2c(bottom));
-                        areaOpen = true;
-                    }
-
-                    // now first check the case where both is outside
-                    if (y1 >= axisy.max && y2 >= axisy.max) {
-                        ctx.lineTo(axisx.p2c(x1), axisy.p2c(axisy.max));
-                        ctx.lineTo(axisx.p2c(x2), axisy.p2c(axisy.max));
-                        continue;
-                    }
-                    else if (y1 <= axisy.min && y2 <= axisy.min) {
-                        ctx.lineTo(axisx.p2c(x1), axisy.p2c(axisy.min));
-                        ctx.lineTo(axisx.p2c(x2), axisy.p2c(axisy.min));
-                        continue;
-                    }
-
-                    // else it's a bit more complicated, there might
-                    // be a flat maxed out rectangle first, then a
-                    // triangular cutout or reverse; to find these
-                    // keep track of the current x values
-                    var x1old = x1, x2old = x2;
-
-                    // clip the y values, without shortcutting, we
-                    // go through all cases in turn
-
-                    // clip with ymin
-                    if (y1 <= y2 && y1 < axisy.min && y2 >= axisy.min) {
-                        x1 = (axisy.min - y1) / (y2 - y1) * (x2 - x1) + x1;
-                        y1 = axisy.min;
-                    }
-                    else if (y2 <= y1 && y2 < axisy.min && y1 >= axisy.min) {
-                        x2 = (axisy.min - y1) / (y2 - y1) * (x2 - x1) + x1;
-                        y2 = axisy.min;
-                    }
-
-                    // clip with ymax
-                    if (y1 >= y2 && y1 > axisy.max && y2 <= axisy.max) {
-                        x1 = (axisy.max - y1) / (y2 - y1) * (x2 - x1) + x1;
-                        y1 = axisy.max;
-                    }
-                    else if (y2 >= y1 && y2 > axisy.max && y1 <= axisy.max) {
-                        x2 = (axisy.max - y1) / (y2 - y1) * (x2 - x1) + x1;
-                        y2 = axisy.max;
-                    }
-
-                    // if the x value was changed we got a rectangle
-                    // to fill
-                    if (x1 != x1old) {
-                        ctx.lineTo(axisx.p2c(x1old), axisy.p2c(y1));
-                        // it goes to (x1, y1), but we fill that below
-                    }
-
-                    // fill triangular section, this sometimes result
-                    // in redundant points if (x1, y1) hasn't changed
-                    // from previous line to, but we just ignore that
-                    ctx.lineTo(axisx.p2c(x1), axisy.p2c(y1));
-                    ctx.lineTo(axisx.p2c(x2), axisy.p2c(y2));
-
-                    // fill the other rectangle if it's there
-                    if (x2 != x2old) {
-                        ctx.lineTo(axisx.p2c(x2), axisy.p2c(y2));
-                        ctx.lineTo(axisx.p2c(x2old), axisy.p2c(y2));
-                    }
-                }
-            }
-
-            ctx.save();
-            ctx.translate(plotOffset.left, plotOffset.top);
-            ctx.lineJoin = "round";
-
-            var lw = series.lines.lineWidth,
-                sw = series.shadowSize;
-            // FIXME: consider another form of shadow when filling is turned on
-            if (lw > 0 && sw > 0) {
-                // draw shadow as a thick and thin line with transparency
-                ctx.lineWidth = sw;
-                ctx.strokeStyle = "rgba(0,0,0,0.1)";
-                // position shadow at angle from the mid of line
-                var angle = Math.PI/18;
-                plotLine(series.datapoints, Math.sin(angle) * (lw/2 + sw/2), Math.cos(angle) * (lw/2 + sw/2), series.xaxis, series.yaxis);
-                ctx.lineWidth = sw/2;
-                plotLine(series.datapoints, Math.sin(angle) * (lw/2 + sw/4), Math.cos(angle) * (lw/2 + sw/4), series.xaxis, series.yaxis);
-            }
-
-            ctx.lineWidth = lw;
-            ctx.strokeStyle = series.color;
-            var fillStyle = getFillStyle(series.lines, series.color, 0, plotHeight);
-            if (fillStyle) {
-                ctx.fillStyle = fillStyle;
-                plotLineArea(series.datapoints, series.xaxis, series.yaxis);
-            }
-
-            if (lw > 0)
-                plotLine(series.datapoints, 0, 0, series.xaxis, series.yaxis);
-            ctx.restore();
-        }
-
-        function drawSeriesPoints(series) {
-            function plotPoints(datapoints, radius, fillStyle, offset, shadow, axisx, axisy, symbol) {
-                var points = datapoints.points, ps = datapoints.pointsize;
-
-                for (var i = 0; i < points.length; i += ps) {
-                    var x = points[i], y = points[i + 1];
-                    if (x == null || x < axisx.min || x > axisx.max || y < axisy.min || y > axisy.max)
-                        continue;
-
-                    ctx.beginPath();
-                    x = axisx.p2c(x);
-                    y = axisy.p2c(y) + offset;
-                    if (symbol == "circle")
-                        ctx.arc(x, y, radius, 0, shadow ? Math.PI : Math.PI * 2, false);
-                    else
-                        symbol(ctx, x, y, radius, shadow);
-                    ctx.closePath();
-
-                    if (fillStyle) {
-                        ctx.fillStyle = fillStyle;
-                        ctx.fill();
-                    }
-                    ctx.stroke();
-                }
-            }
-
-            ctx.save();
-            ctx.translate(plotOffset.left, plotOffset.top);
-
-            var lw = series.points.lineWidth,
-                sw = series.shadowSize,
-                radius = series.points.radius,
-                symbol = series.points.symbol;
-
-            // If the user sets the line width to 0, we change it to a very
-            // small value. A line width of 0 seems to force the default of 1.
-            // Doing the conditional here allows the shadow setting to still be
-            // optional even with a lineWidth of 0.
-
-            if( lw == 0 )
-                lw = 0.0001;
-
-            if (lw > 0 && sw > 0) {
-                // draw shadow in two steps
-                var w = sw / 2;
-                ctx.lineWidth = w;
-                ctx.strokeStyle = "rgba(0,0,0,0.1)";
-                plotPoints(series.datapoints, radius, null, w + w/2, true,
-                           series.xaxis, series.yaxis, symbol);
-
-                ctx.strokeStyle = "rgba(0,0,0,0.2)";
-                plotPoints(series.datapoints, radius, null, w/2, true,
-                           series.xaxis, series.yaxis, symbol);
-            }
-
-            ctx.lineWidth = lw;
-            ctx.strokeStyle = series.color;
-            plotPoints(series.datapoints, radius,
-                       getFillStyle(series.points, series.color), 0, false,
-                       series.xaxis, series.yaxis, symbol);
-            ctx.restore();
-        }
-
-        function drawBar(x, y, b, barLeft, barRight, fillStyleCallback, axisx, axisy, c, horizontal, lineWidth) {
-            var left, right, bottom, top,
-                drawLeft, drawRight, drawTop, drawBottom,
-                tmp;
-
-            // in horizontal mode, we start the bar from the left
-            // instead of from the bottom so it appears to be
-            // horizontal rather than vertical
-            if (horizontal) {
-                drawBottom = drawRight = drawTop = true;
-                drawLeft = false;
-                left = b;
-                right = x;
-                top = y + barLeft;
-                bottom = y + barRight;
-
-                // account for negative bars
-                if (right < left) {
-                    tmp = right;
-                    right = left;
-                    left = tmp;
-                    drawLeft = true;
-                    drawRight = false;
-                }
-            }
-            else {
-                drawLeft = drawRight = drawTop = true;
-                drawBottom = false;
-                left = x + barLeft;
-                right = x + barRight;
-                bottom = b;
-                top = y;
-
-                // account for negative bars
-                if (top < bottom) {
-                    tmp = top;
-                    top = bottom;
-                    bottom = tmp;
-                    drawBottom = true;
-                    drawTop = false;
-                }
-            }
-
-            // clip
-            if (right < axisx.min || left > axisx.max ||
-                top < axisy.min || bottom > axisy.max)
-                return;
-
-            if (left < axisx.min) {
-                left = axisx.min;
-                drawLeft = false;
-            }
-
-            if (right > axisx.max) {
-                right = axisx.max;
-                drawRight = false;
-            }
-
-            if (bottom < axisy.min) {
-                bottom = axisy.min;
-                drawBottom = false;
-            }
-
-            if (top > axisy.max) {
-                top = axisy.max;
-                drawTop = false;
-            }
-
-            left = axisx.p2c(left);
-            bottom = axisy.p2c(bottom);
-            right = axisx.p2c(right);
-            top = axisy.p2c(top);
-
-            // fill the bar
-            if (fillStyleCallback) {
-                c.fillStyle = fillStyleCallback(bottom, top);
-                c.fillRect(left, top, right - left, bottom - top)
-            }
-
-            // draw outline
-            if (lineWidth > 0 && (drawLeft || drawRight || drawTop || drawBottom)) {
-                c.beginPath();
-
-                // FIXME: inline moveTo is buggy with excanvas
-                c.moveTo(left, bottom);
-                if (drawLeft)
-                    c.lineTo(left, top);
-                else
-                    c.moveTo(left, top);
-                if (drawTop)
-                    c.lineTo(right, top);
-                else
-                    c.moveTo(right, top);
-                if (drawRight)
-                    c.lineTo(right, bottom);
-                else
-                    c.moveTo(right, bottom);
-                if (drawBottom)
-                    c.lineTo(left, bottom);
-                else
-                    c.moveTo(left, bottom);
-                c.stroke();
-            }
-        }
-
-        function drawSeriesBars(series) {
-            function plotBars(datapoints, barLeft, barRight, fillStyleCallback, axisx, axisy) {
-                var points = datapoints.points, ps = datapoints.pointsize;
-
-                for (var i = 0; i < points.length; i += ps) {
-                    if (points[i] == null)
-                        continue;
-                    drawBar(points[i], points[i + 1], points[i + 2], barLeft, barRight, fillStyleCallback, axisx, axisy, ctx, series.bars.horizontal, series.bars.lineWidth);
-                }
-            }
-
-            ctx.save();
-            ctx.translate(plotOffset.left, plotOffset.top);
-
-            // FIXME: figure out a way to add shadows (for instance along the right edge)
-            ctx.lineWidth = series.bars.lineWidth;
-            ctx.strokeStyle = series.color;
-
-            var barLeft;
-
-            switch (series.bars.align) {
-                case "left":
-                    barLeft = 0;
-                    break;
-                case "right":
-                    barLeft = -series.bars.barWidth;
-                    break;
-                default:
-                    barLeft = -series.bars.barWidth / 2;
-            }
-
-            var fillStyleCallback = series.bars.fill ? function (bottom, top) { return getFillStyle(series.bars, series.color, bottom, top); } : null;
-            plotBars(series.datapoints, barLeft, barLeft + series.bars.barWidth, fillStyleCallback, series.xaxis, series.yaxis);
-            ctx.restore();
-        }
-
-        function getFillStyle(filloptions, seriesColor, bottom, top) {
-            var fill = filloptions.fill;
-            if (!fill)
-                return null;
-
-            if (filloptions.fillColor)
-                return getColorOrGradient(filloptions.fillColor, bottom, top, seriesColor);
-
-            var c = $.color.parse(seriesColor);
-            c.a = typeof fill == "number" ? fill : 0.4;
-            c.normalize();
-            return c.toString();
-        }
-
-        function insertLegend() {
-
-            if (options.legend.container != null) {
-                $(options.legend.container).html("");
-            } else {
-                placeholder.find(".legend").remove();
-            }
-
-            if (!options.legend.show) {
-                return;
-            }
-
-            var fragments = [], entries = [], rowStarted = false,
-                lf = options.legend.labelFormatter, s, label;
-
-            // Build a list of legend entries, with each having a label and a color
-
-            for (var i = 0; i < series.length; ++i) {
-                s = series[i];
-                if (s.label) {
-                    label = lf ? lf(s.label, s) : s.label;
-                    if (label) {
-                        entries.push({
-                            label: label,
-                            color: s.color
-                        });
-                    }
-                }
-            }
-
-            // Sort the legend using either the default or a custom comparator
-
-            if (options.legend.sorted) {
-                if ($.isFunction(options.legend.sorted)) {
-                    entries.sort(options.legend.sorted);
-                } else if (options.legend.sorted == "reverse") {
-                	entries.reverse();
-                } else {
-                    var ascending = options.legend.sorted != "descending";
-                    entries.sort(function(a, b) {
-                        return a.label == b.label ? 0 : (
-                            (a.label < b.label) != ascending ? 1 : -1   // Logical XOR
-                        );
-                    });
-                }
-            }
-
-            // Generate markup for the list of entries, in their final order
-
-            for (var i = 0; i < entries.length; ++i) {
-
-                var entry = entries[i];
-
-                if (i % options.legend.noColumns == 0) {
-                    if (rowStarted)
-                        fragments.push('</tr>');
-                    fragments.push('<tr>');
-                    rowStarted = true;
-                }
-
-                fragments.push(
-                    '<td class="legendColorBox"><div style="border:1px solid ' + options.legend.labelBoxBorderColor + ';padding:1px"><div style="width:4px;height:0;border:5px solid ' + entry.color + ';overflow:hidden"></div></div></td>' +
-                    '<td class="legendLabel" data-test-subj="flotLegendLabel">' + entry.label + '</td>'
-                );
-            }
-
-            if (rowStarted)
-                fragments.push('</tr>');
-
-            if (fragments.length == 0)
-                return;
-
-            var table = '<table style="font-size:smaller;color:' + options.grid.color + '">' + fragments.join("") + '</table>';
-            if (options.legend.container != null)
-                $(options.legend.container).html(table);
-            else {
-                var pos = "",
-                    p = options.legend.position,
-                    m = options.legend.margin;
-                if (m[0] == null)
-                    m = [m, m];
-                if (p.charAt(0) == "n")
-                    pos += 'top:' + (m[1] + plotOffset.top) + 'px;';
-                else if (p.charAt(0) == "s")
-                    pos += 'bottom:' + (m[1] + plotOffset.bottom) + 'px;';
-                if (p.charAt(1) == "e")
-                    pos += 'right:' + (m[0] + plotOffset.right) + 'px;';
-                else if (p.charAt(1) == "w")
-                    pos += 'left:' + (m[0] + plotOffset.left) + 'px;';
-                var legend = $('<div class="legend">' + table.replace('style="', 'style="position:absolute;' + pos +';') + '</div>').appendTo(placeholder);
-                if (options.legend.backgroundOpacity != 0.0) {
-                    // put in the transparent background
-                    // separately to avoid blended labels and
-                    // label boxes
-                    var c = options.legend.backgroundColor;
-                    if (c == null) {
-                        c = options.grid.backgroundColor;
-                        if (c && typeof c == "string")
-                            c = $.color.parse(c);
-                        else
-                            c = $.color.extract(legend, 'background-color');
-                        c.a = 1;
-                        c = c.toString();
-                    }
-                    var div = legend.children();
-                    $('<div style="position:absolute;width:' + div.width() + 'px;height:' + div.height() + 'px;' + pos +'background-color:' + c + ';"> </div>').prependTo(legend).css('opacity', options.legend.backgroundOpacity);
-                }
-            }
-        }
-
-
-        // interactive features
-
-        var highlights = [],
-            redrawTimeout = null;
-
-        // returns the data item the mouse is over, or null if none is found
-        function findNearbyItem(mouseX, mouseY, seriesFilter) {
-            var maxDistance = options.grid.mouseActiveRadius,
-                smallestDistance = maxDistance * maxDistance + 1,
-                item = null, foundPoint = false, i, j, ps;
-
-            for (i = series.length - 1; i >= 0; --i) {
-                if (!seriesFilter(series[i]))
-                    continue;
-
-                var s = series[i],
-                    axisx = s.xaxis,
-                    axisy = s.yaxis,
-                    points = s.datapoints.points,
-                    mx = axisx.c2p(mouseX), // precompute some stuff to make the loop faster
-                    my = axisy.c2p(mouseY),
-                    maxx = maxDistance / axisx.scale,
-                    maxy = maxDistance / axisy.scale;
-
-                ps = s.datapoints.pointsize;
-                // with inverse transforms, we can't use the maxx/maxy
-                // optimization, sadly
-                if (axisx.options.inverseTransform)
-                    maxx = Number.MAX_VALUE;
-                if (axisy.options.inverseTransform)
-                    maxy = Number.MAX_VALUE;
-
-                if (s.lines.show || s.points.show) {
-                    for (j = 0; j < points.length; j += ps) {
-                        var x = points[j], y = points[j + 1];
-                        if (x == null)
-                            continue;
-
-                        // For points and lines, the cursor must be within a
-                        // certain distance to the data point
-                        if (x - mx > maxx || x - mx < -maxx ||
-                            y - my > maxy || y - my < -maxy)
-                            continue;
-
-                        // We have to calculate distances in pixels, not in
-                        // data units, because the scales of the axes may be different
-                        var dx = Math.abs(axisx.p2c(x) - mouseX),
-                            dy = Math.abs(axisy.p2c(y) - mouseY),
-                            dist = dx * dx + dy * dy; // we save the sqrt
-
-                        // use <= to ensure last point takes precedence
-                        // (last generally means on top of)
-                        if (dist < smallestDistance) {
-                            smallestDistance = dist;
-                            item = [i, j / ps];
-                        }
-                    }
-                }
-
-                if (s.bars.show && !item) { // no other point can be nearby
-
-                    var barLeft, barRight;
-
-                    switch (s.bars.align) {
-                        case "left":
-                            barLeft = 0;
-                            break;
-                        case "right":
-                            barLeft = -s.bars.barWidth;
-                            break;
-                        default:
-                            barLeft = -s.bars.barWidth / 2;
-                    }
-
-                    barRight = barLeft + s.bars.barWidth;
-
-                    for (j = 0; j < points.length; j += ps) {
-                        var x = points[j], y = points[j + 1], b = points[j + 2];
-                        if (x == null)
-                            continue;
-
-                        // for a bar graph, the cursor must be inside the bar
-                        if (series[i].bars.horizontal ?
-                            (mx <= Math.max(b, x) && mx >= Math.min(b, x) &&
-                             my >= y + barLeft && my <= y + barRight) :
-                            (mx >= x + barLeft && mx <= x + barRight &&
-                             my >= Math.min(b, y) && my <= Math.max(b, y)))
-                                item = [i, j / ps];
-                    }
-                }
-            }
-
-            if (item) {
-                i = item[0];
-                j = item[1];
-                ps = series[i].datapoints.pointsize;
-
-                return { datapoint: series[i].datapoints.points.slice(j * ps, (j + 1) * ps),
-                         dataIndex: j,
-                         series: series[i],
-                         seriesIndex: i };
-            }
-
-            return null;
-        }
-
-        function onMouseMove(e) {
-            if (options.grid.hoverable)
-                triggerClickHoverEvent("plothover", e,
-                                       function (s) { return s["hoverable"] != false; });
-        }
-
-        function onMouseLeave(e) {
-            if (options.grid.hoverable)
-                triggerClickHoverEvent("plothover", e,
-                                       function (s) { return false; });
-        }
-
-        function onClick(e) {
-            triggerClickHoverEvent("plotclick", e,
-                                   function (s) { return s["clickable"] != false; });
-        }
-
-        // trigger click or hover event (they send the same parameters
-        // so we share their code)
-        function triggerClickHoverEvent(eventname, event, seriesFilter) {
-            var offset = eventHolder.offset(),
-                canvasX = event.pageX - offset.left - plotOffset.left,
-                canvasY = event.pageY - offset.top - plotOffset.top,
-            pos = canvasToAxisCoords({ left: canvasX, top: canvasY });
-
-            pos.pageX = event.pageX;
-            pos.pageY = event.pageY;
-
-            var item = findNearbyItem(canvasX, canvasY, seriesFilter);
-
-            if (item) {
-                // fill in mouse pos for any listeners out there
-                item.pageX = parseInt(item.series.xaxis.p2c(item.datapoint[0]) + offset.left + plotOffset.left, 10);
-                item.pageY = parseInt(item.series.yaxis.p2c(item.datapoint[1]) + offset.top + plotOffset.top, 10);
-            }
-
-            if (options.grid.autoHighlight) {
-                // clear auto-highlights
-                for (var i = 0; i < highlights.length; ++i) {
-                    var h = highlights[i];
-                    if (h.auto == eventname &&
-                        !(item && h.series == item.series &&
-                          h.point[0] == item.datapoint[0] &&
-                          h.point[1] == item.datapoint[1]))
-                        unhighlight(h.series, h.point);
-                }
-
-                if (item)
-                    highlight(item.series, item.datapoint, eventname);
-            }
-
-            placeholder.trigger(eventname, [ pos, item ]);
-        }
-
-        function triggerRedrawOverlay() {
-            var t = options.interaction.redrawOverlayInterval;
-            if (t == -1) {      // skip event queue
-                drawOverlay();
-                return;
-            }
-
-            if (!redrawTimeout)
-                redrawTimeout = setTimeout(drawOverlay, t);
-        }
-
-        function drawOverlay() {
-            redrawTimeout = null;
-
-            // draw highlights
-            octx.save();
-            overlay.clear();
-            octx.translate(plotOffset.left, plotOffset.top);
-
-            var i, hi;
-            for (i = 0; i < highlights.length; ++i) {
-                hi = highlights[i];
-
-                if (hi.series.bars.show)
-                    drawBarHighlight(hi.series, hi.point);
-                else
-                    drawPointHighlight(hi.series, hi.point);
-            }
-            octx.restore();
-
-            executeHooks(hooks.drawOverlay, [octx]);
-        }
-
-        function highlight(s, point, auto) {
-            if (typeof s == "number")
-                s = series[s];
-
-            if (typeof point == "number") {
-                var ps = s.datapoints.pointsize;
-                point = s.datapoints.points.slice(ps * point, ps * (point + 1));
-            }
-
-            var i = indexOfHighlight(s, point);
-            if (i == -1) {
-                highlights.push({ series: s, point: point, auto: auto });
-
-                triggerRedrawOverlay();
-            }
-            else if (!auto)
-                highlights[i].auto = false;
-        }
-
-        function unhighlight(s, point) {
-            if (s == null && point == null) {
-                highlights = [];
-                triggerRedrawOverlay();
-                return;
-            }
-
-            if (typeof s == "number")
-                s = series[s];
-
-            if (typeof point == "number") {
-                var ps = s.datapoints.pointsize;
-                point = s.datapoints.points.slice(ps * point, ps * (point + 1));
-            }
-
-            var i = indexOfHighlight(s, point);
-            if (i != -1) {
-                highlights.splice(i, 1);
-
-                triggerRedrawOverlay();
-            }
-        }
-
-        function indexOfHighlight(s, p) {
-            for (var i = 0; i < highlights.length; ++i) {
-                var h = highlights[i];
-                if (h.series == s && h.point[0] == p[0]
-                    && h.point[1] == p[1])
-                    return i;
-            }
-            return -1;
-        }
-
-        function drawPointHighlight(series, point) {
-            var x = point[0], y = point[1],
-                axisx = series.xaxis, axisy = series.yaxis,
-                highlightColor = (typeof series.highlightColor === "string") ? series.highlightColor : $.color.parse(series.color).scale('a', 0.5).toString();
-
-            if (x < axisx.min || x > axisx.max || y < axisy.min || y > axisy.max)
-                return;
-
-            var pointRadius = series.points.radius + series.points.lineWidth / 2;
-            octx.lineWidth = pointRadius;
-            octx.strokeStyle = highlightColor;
-            var radius = 1.5 * pointRadius;
-            x = axisx.p2c(x);
-            y = axisy.p2c(y);
-
-            octx.beginPath();
-            if (series.points.symbol == "circle")
-                octx.arc(x, y, radius, 0, 2 * Math.PI, false);
-            else
-                series.points.symbol(octx, x, y, radius, false);
-            octx.closePath();
-            octx.stroke();
-        }
-
-        function drawBarHighlight(series, point) {
-            var highlightColor = (typeof series.highlightColor === "string") ? series.highlightColor : $.color.parse(series.color).scale('a', 0.5).toString(),
-                fillStyle = highlightColor,
-                barLeft;
-
-            switch (series.bars.align) {
-                case "left":
-                    barLeft = 0;
-                    break;
-                case "right":
-                    barLeft = -series.bars.barWidth;
-                    break;
-                default:
-                    barLeft = -series.bars.barWidth / 2;
-            }
-
-            octx.lineWidth = series.bars.lineWidth;
-            octx.strokeStyle = highlightColor;
-
-            drawBar(point[0], point[1], point[2] || 0, barLeft, barLeft + series.bars.barWidth,
-                    function () { return fillStyle; }, series.xaxis, series.yaxis, octx, series.bars.horizontal, series.bars.lineWidth);
-        }
-
-        function getColorOrGradient(spec, bottom, top, defaultColor) {
-            if (typeof spec == "string")
-                return spec;
-            else {
-                // assume this is a gradient spec; IE currently only
-                // supports a simple vertical gradient properly, so that's
-                // what we support too
-                var gradient = ctx.createLinearGradient(0, top, 0, bottom);
-
-                for (var i = 0, l = spec.colors.length; i < l; ++i) {
-                    var c = spec.colors[i];
-                    if (typeof c != "string") {
-                        var co = $.color.parse(defaultColor);
-                        if (c.brightness != null)
-                            co = co.scale('rgb', c.brightness);
-                        if (c.opacity != null)
-                            co.a *= c.opacity;
-                        c = co.toString();
-                    }
-                    gradient.addColorStop(i / (l - 1), c);
-                }
-
-                return gradient;
-            }
-        }
-    }
-
-    // Add the plot function to the top level of the jQuery object
-
-    $.plot = function(placeholder, data, options) {
-        //var t0 = new Date();
-        var plot = new Plot($(placeholder), data, options, $.plot.plugins);
-        //(window.console ? console.log : alert)("time used (msecs): " + ((new Date()).getTime() - t0.getTime()));
-        return plot;
-    };
-
-    $.plot.version = "0.8.3";
-
-    $.plot.plugins = [];
-
-    // Also add the plot function as a chainable property
-
-    $.fn.plot = function(data, options) {
-        return this.each(function() {
-            $.plot(this, data, options);
-        });
-    };
-
-    // round to nearby lower multiple of base
-    function floorInBase(n, base) {
-        return base * Math.floor(n / base);
-    }
-
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.log.js b/src/legacy/ui/public/flot-charts/jquery.flot.log.js
deleted file mode 100644
index e32bf5cf7e8173..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.log.js
+++ /dev/null
@@ -1,163 +0,0 @@
-/* @notice
- *
- * Pretty handling of logarithmic axes.
- * Copyright (c) 2007-2014 IOLA and Ole Laursen.
- * Licensed under the MIT license.
- * Created by Arne de Laat
- * Set axis.mode to "log" and make the axis logarithmic using transform:
- *     axis: {
- *         mode: 'log',
- *         transform: function(v) {v <= 0 ? Math.log(v) / Math.LN10 : null},
- *         inverseTransform: function(v) {Math.pow(10, v)}
- *     }
- * The transform filters negative and zero values, because those are
- * invalid on logarithmic scales.
- * This plugin tries to create good looking logarithmic ticks, using
- * unicode superscript characters. If all data to be plotted is between two
- * powers of ten then the default flot tick generator and renderer are
- * used. Logarithmic ticks are places at powers of ten and at half those
- * values if there are not to many ticks already (e.g. [1, 5, 10, 50, 100]).
- * For details,  see https://github.com/flot/flot/pull/1328
-*/
-
-(function($) {
-
-  function log10(value) {
-    /* Get the Log10 of the value
-    */
-    return Math.log(value) / Math.LN10;
-  }
-
-  function floorAsLog10(value) {
-    /* Get power of the first power of 10 below the value
-    */
-    return Math.floor(log10(value));
-  }
-
-  function ceilAsLog10(value) {
-    /* Get power of the first power of 10 above the value
-    */
-    return Math.ceil(log10(value));
-  }
-
-
-  // round to nearby lower multiple of base
-  function floorInBase(n, base) {
-    return base * Math.floor(n / base);
-  }
-
-  function getUnicodePower(power) {
-    var superscripts = ["⁰", "¹", "²", "³", "⁴", "⁵", "⁶", "⁷", "⁸", "⁹"],
-      result = "",
-      str_power = "" + power;
-    for (var i = 0; i < str_power.length; i++) {
-      if (str_power[i] === "+") {
-      }
-      else if (str_power[i] === "-") {
-        result += "⁻";
-      }
-      else {
-        result += superscripts[str_power[i]];
-      }
-    }
-    return result;
-  }
-
-  function init(plot) {
-    plot.hooks.processOptions.push(function (plot) {
-      $.each(plot.getAxes(), function(axisName, axis) {
-
-        var opts = axis.options;
-
-        if (opts.mode === "log") {
-
-          axis.tickGenerator = function (axis) {
-
-            var ticks = [],
-              end = ceilAsLog10(axis.max),
-              start = floorAsLog10(axis.min),
-              tick = Number.NaN,
-              i = 0;
-
-            if (axis.min === null || axis.min <= 0) {
-              // Bad minimum, make ticks from 1 (10**0) to max
-              start = 0;
-              axis.min = 0.6;
-            }
-
-            if (end <= start) {
-              // Start less than end?!
-              ticks = [1e-6, 1e-5, 1e-4, 1e-3, 1e-2, 1e-1,
-                1e0, 1e1, 1e2, 1e3, 1e4, 1e5, 1e6,
-                1e7, 1e8, 1e9];
-            }
-            else if (log10(axis.max) - log10(axis.datamin) < 1) {
-              // Default flot generator incase no powers of 10
-              // are between start and end
-              var prev;
-              start = floorInBase(axis.min, axis.tickSize);
-              do {
-                prev = tick;
-                tick = start + i * axis.tickSize;
-                ticks.push(tick);
-                ++i;
-              } while (tick < axis.max && tick !== prev);
-            }
-            else {
-              // Make ticks at each power of ten
-              for (; i <= (end - start); i++) {
-                tick = Math.pow(10, start + i);
-                ticks.push(tick);
-              }
-
-              var length = ticks.length;
-
-              // If not to many ticks also put a tick between
-              // the powers of ten
-              if (end - start < 6) {
-                for (var j = 1; j < length * 2 - 1; j += 2) {
-                  tick = ticks[j - 1] * 5;
-                  ticks.splice(j, 0, tick);
-                }
-              }
-            }
-            return ticks;
-          };
-
-          axis.tickFormatter = function (value, axis) {
-            var formatted;
-            if (log10(axis.max) - log10(axis.datamin) < 1) {
-              // Default flot formatter
-              var factor = axis.tickDecimals ? Math.pow(10, axis.tickDecimals) : 1;
-              formatted = "" + Math.round(value * factor) / factor;
-              if (axis.tickDecimals !== null) {
-                var decimal = formatted.indexOf(".");
-                var precision = decimal === -1 ? 0 : formatted.length - decimal - 1;
-                if (precision < axis.tickDecimals) {
-                  return (precision ? formatted : formatted + ".") + ("" + factor).substr(1, axis.tickDecimals - precision);
-                }
-              }
-            }
-            else {
-              var multiplier = "",
-                exponential = parseFloat(value).toExponential(0),
-                power = getUnicodePower(exponential.slice(2));
-              if (exponential[0] !== "1") {
-                multiplier = exponential[0] + "x";
-              }
-              formatted = multiplier + "10" + power;
-            }
-            return formatted;
-          };
-        }
-      });
-    });
-  }
-
-  $.plot.plugins.push({
-    init: init,
-    name: "log",
-    version: "0.9"
-  });
-
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.navigate.js b/src/legacy/ui/public/flot-charts/jquery.flot.navigate.js
deleted file mode 100644
index 13fb7f17d04b24..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.navigate.js
+++ /dev/null
@@ -1,346 +0,0 @@
-/* Flot plugin for adding the ability to pan and zoom the plot.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-The default behaviour is double click and scrollwheel up/down to zoom in, drag
-to pan. The plugin defines plot.zoom({ center }), plot.zoomOut() and
-plot.pan( offset ) so you easily can add custom controls. It also fires
-"plotpan" and "plotzoom" events, useful for synchronizing plots.
-
-The plugin supports these options:
-
-	zoom: {
-		interactive: false
-		trigger: "dblclick" // or "click" for single click
-		amount: 1.5         // 2 = 200% (zoom in), 0.5 = 50% (zoom out)
-	}
-
-	pan: {
-		interactive: false
-		cursor: "move"      // CSS mouse cursor value used when dragging, e.g. "pointer"
-		frameRate: 20
-	}
-
-	xaxis, yaxis, x2axis, y2axis: {
-		zoomRange: null  // or [ number, number ] (min range, max range) or false
-		panRange: null   // or [ number, number ] (min, max) or false
-	}
-
-"interactive" enables the built-in drag/click behaviour. If you enable
-interactive for pan, then you'll have a basic plot that supports moving
-around; the same for zoom.
-
-"amount" specifies the default amount to zoom in (so 1.5 = 150%) relative to
-the current viewport.
-
-"cursor" is a standard CSS mouse cursor string used for visual feedback to the
-user when dragging.
-
-"frameRate" specifies the maximum number of times per second the plot will
-update itself while the user is panning around on it (set to null to disable
-intermediate pans, the plot will then not update until the mouse button is
-released).
-
-"zoomRange" is the interval in which zooming can happen, e.g. with zoomRange:
-[1, 100] the zoom will never scale the axis so that the difference between min
-and max is smaller than 1 or larger than 100. You can set either end to null
-to ignore, e.g. [1, null]. If you set zoomRange to false, zooming on that axis
-will be disabled.
-
-"panRange" confines the panning to stay within a range, e.g. with panRange:
-[-10, 20] panning stops at -10 in one end and at 20 in the other. Either can
-be null, e.g. [-10, null]. If you set panRange to false, panning on that axis
-will be disabled.
-
-Example API usage:
-
-	plot = $.plot(...);
-
-	// zoom default amount in on the pixel ( 10, 20 )
-	plot.zoom({ center: { left: 10, top: 20 } });
-
-	// zoom out again
-	plot.zoomOut({ center: { left: 10, top: 20 } });
-
-	// zoom 200% in on the pixel (10, 20)
-	plot.zoom({ amount: 2, center: { left: 10, top: 20 } });
-
-	// pan 100 pixels to the left and 20 down
-	plot.pan({ left: -100, top: 20 })
-
-Here, "center" specifies where the center of the zooming should happen. Note
-that this is defined in pixel space, not the space of the data points (you can
-use the p2c helpers on the axes in Flot to help you convert between these).
-
-"amount" is the amount to zoom the viewport relative to the current range, so
-1 is 100% (i.e. no change), 1.5 is 150% (zoom in), 0.7 is 70% (zoom out). You
-can set the default in the options.
-
-*/
-
-// First two dependencies, jquery.event.drag.js and
-// jquery.mousewheel.js, we put them inline here to save people the
-// effort of downloading them.
-
-/*
-jquery.event.drag.js ~ v1.5 ~ Copyright (c) 2008, Three Dub Media (http://threedubmedia.com)
-Licensed under the MIT License ~ http://threedubmedia.googlecode.com/files/MIT-LICENSE.txt
-*/
-(function(a){function e(h){var k,j=this,l=h.data||{};if(l.elem)j=h.dragTarget=l.elem,h.dragProxy=d.proxy||j,h.cursorOffsetX=l.pageX-l.left,h.cursorOffsetY=l.pageY-l.top,h.offsetX=h.pageX-h.cursorOffsetX,h.offsetY=h.pageY-h.cursorOffsetY;else if(d.dragging||l.which>0&&h.which!=l.which||a(h.target).is(l.not))return;switch(h.type){case"mousedown":return a.extend(l,a(j).offset(),{elem:j,target:h.target,pageX:h.pageX,pageY:h.pageY}),b.add(document,"mousemove mouseup",e,l),i(j,!1),d.dragging=null,!1;case!d.dragging&&"mousemove":if(g(h.pageX-l.pageX)+g(h.pageY-l.pageY)<l.distance)break;h.target=l.target,k=f(h,"dragstart",j),k!==!1&&(d.dragging=j,d.proxy=h.dragProxy=a(k||j)[0]);case"mousemove":if(d.dragging){if(k=f(h,"drag",j),c.drop&&(c.drop.allowed=k!==!1,c.drop.handler(h)),k!==!1)break;h.type="mouseup"}case"mouseup":b.remove(document,"mousemove mouseup",e),d.dragging&&(c.drop&&c.drop.handler(h),f(h,"dragend",j)),i(j,!0),d.dragging=d.proxy=l.elem=!1}return!0}function f(b,c,d){b.type=c;var e=a.event.dispatch.call(d,b);return e===!1?!1:e||b.result}function g(a){return Math.pow(a,2)}function h(){return d.dragging===!1}function i(a,b){a&&(a.unselectable=b?"off":"on",a.onselectstart=function(){return b},a.style&&(a.style.MozUserSelect=b?"":"none"))}a.fn.drag=function(a,b,c){return b&&this.bind("dragstart",a),c&&this.bind("dragend",c),a?this.bind("drag",b?b:a):this.trigger("drag")};var b=a.event,c=b.special,d=c.drag={not:":input",distance:0,which:1,dragging:!1,setup:function(c){c=a.extend({distance:d.distance,which:d.which,not:d.not},c||{}),c.distance=g(c.distance),b.add(this,"mousedown",e,c),this.attachEvent&&this.attachEvent("ondragstart",h)},teardown:function(){b.remove(this,"mousedown",e),this===d.dragging&&(d.dragging=d.proxy=!1),i(this,!0),this.detachEvent&&this.detachEvent("ondragstart",h)}};c.dragstart=c.dragend={setup:function(){},teardown:function(){}}})(jQuery);
-
-/* jquery.mousewheel.min.js
- * Copyright (c) 2011 Brandon Aaron (http://brandonaaron.net)
- * Licensed under the MIT License (LICENSE.txt).
- * Thanks to: http://adomas.org/javascript-mouse-wheel/ for some pointers.
- * Thanks to: Mathias Bank(http://www.mathias-bank.de) for a scope bug fix.
- * Thanks to: Seamus Leahy for adding deltaX and deltaY
- *
- * Version: 3.0.6
- *
- * Requires: 1.2.2+
- */
-(function(d){function e(a){var b=a||window.event,c=[].slice.call(arguments,1),f=0,e=0,g=0,a=d.event.fix(b);a.type="mousewheel";b.wheelDelta&&(f=b.wheelDelta/120);b.detail&&(f=-b.detail/3);g=f;void 0!==b.axis&&b.axis===b.HORIZONTAL_AXIS&&(g=0,e=-1*f);void 0!==b.wheelDeltaY&&(g=b.wheelDeltaY/120);void 0!==b.wheelDeltaX&&(e=-1*b.wheelDeltaX/120);c.unshift(a,f,e,g);return(d.event.dispatch||d.event.handle).apply(this,c)}var c=["DOMMouseScroll","mousewheel"];if(d.event.fixHooks)for(var h=c.length;h;)d.event.fixHooks[c[--h]]=d.event.mouseHooks;d.event.special.mousewheel={setup:function(){if(this.addEventListener)for(var a=c.length;a;)this.addEventListener(c[--a],e,!1);else this.onmousewheel=e},teardown:function(){if(this.removeEventListener)for(var a=c.length;a;)this.removeEventListener(c[--a],e,!1);else this.onmousewheel=null}};d.fn.extend({mousewheel:function(a){return a?this.bind("mousewheel",a):this.trigger("mousewheel")},unmousewheel:function(a){return this.unbind("mousewheel",a)}})})(jQuery);
-
-
-
-
-(function ($) {
-    var options = {
-        xaxis: {
-            zoomRange: null, // or [number, number] (min range, max range)
-            panRange: null // or [number, number] (min, max)
-        },
-        zoom: {
-            interactive: false,
-            trigger: "dblclick", // or "click" for single click
-            amount: 1.5 // how much to zoom relative to current position, 2 = 200% (zoom in), 0.5 = 50% (zoom out)
-        },
-        pan: {
-            interactive: false,
-            cursor: "move",
-            frameRate: 20
-        }
-    };
-
-    function init(plot) {
-        function onZoomClick(e, zoomOut) {
-            var c = plot.offset();
-            c.left = e.pageX - c.left;
-            c.top = e.pageY - c.top;
-            if (zoomOut)
-                plot.zoomOut({ center: c });
-            else
-                plot.zoom({ center: c });
-        }
-
-        function onMouseWheel(e, delta) {
-            e.preventDefault();
-            onZoomClick(e, delta < 0);
-            return false;
-        }
-        
-        var prevCursor = 'default', prevPageX = 0, prevPageY = 0,
-            panTimeout = null;
-
-        function onDragStart(e) {
-            if (e.which != 1)  // only accept left-click
-                return false;
-            var c = plot.getPlaceholder().css('cursor');
-            if (c)
-                prevCursor = c;
-            plot.getPlaceholder().css('cursor', plot.getOptions().pan.cursor);
-            prevPageX = e.pageX;
-            prevPageY = e.pageY;
-        }
-        
-        function onDrag(e) {
-            var frameRate = plot.getOptions().pan.frameRate;
-            if (panTimeout || !frameRate)
-                return;
-
-            panTimeout = setTimeout(function () {
-                plot.pan({ left: prevPageX - e.pageX,
-                           top: prevPageY - e.pageY });
-                prevPageX = e.pageX;
-                prevPageY = e.pageY;
-                                                    
-                panTimeout = null;
-            }, 1 / frameRate * 1000);
-        }
-
-        function onDragEnd(e) {
-            if (panTimeout) {
-                clearTimeout(panTimeout);
-                panTimeout = null;
-            }
-                    
-            plot.getPlaceholder().css('cursor', prevCursor);
-            plot.pan({ left: prevPageX - e.pageX,
-                       top: prevPageY - e.pageY });
-        }
-        
-        function bindEvents(plot, eventHolder) {
-            var o = plot.getOptions();
-            if (o.zoom.interactive) {
-                eventHolder[o.zoom.trigger](onZoomClick);
-                eventHolder.mousewheel(onMouseWheel);
-            }
-
-            if (o.pan.interactive) {
-                eventHolder.bind("dragstart", { distance: 10 }, onDragStart);
-                eventHolder.bind("drag", onDrag);
-                eventHolder.bind("dragend", onDragEnd);
-            }
-        }
-
-        plot.zoomOut = function (args) {
-            if (!args)
-                args = {};
-            
-            if (!args.amount)
-                args.amount = plot.getOptions().zoom.amount;
-
-            args.amount = 1 / args.amount;
-            plot.zoom(args);
-        };
-        
-        plot.zoom = function (args) {
-            if (!args)
-                args = {};
-            
-            var c = args.center,
-                amount = args.amount || plot.getOptions().zoom.amount,
-                w = plot.width(), h = plot.height();
-
-            if (!c)
-                c = { left: w / 2, top: h / 2 };
-                
-            var xf = c.left / w,
-                yf = c.top / h,
-                minmax = {
-                    x: {
-                        min: c.left - xf * w / amount,
-                        max: c.left + (1 - xf) * w / amount
-                    },
-                    y: {
-                        min: c.top - yf * h / amount,
-                        max: c.top + (1 - yf) * h / amount
-                    }
-                };
-
-            $.each(plot.getAxes(), function(_, axis) {
-                var opts = axis.options,
-                    min = minmax[axis.direction].min,
-                    max = minmax[axis.direction].max,
-                    zr = opts.zoomRange,
-                    pr = opts.panRange;
-
-                if (zr === false) // no zooming on this axis
-                    return;
-                    
-                min = axis.c2p(min);
-                max = axis.c2p(max);
-                if (min > max) {
-                    // make sure min < max
-                    var tmp = min;
-                    min = max;
-                    max = tmp;
-                }
-
-                //Check that we are in panRange
-                if (pr) {
-                    if (pr[0] != null && min < pr[0]) {
-                        min = pr[0];
-                    }
-                    if (pr[1] != null && max > pr[1]) {
-                        max = pr[1];
-                    }
-                }
-
-                var range = max - min;
-                if (zr &&
-                    ((zr[0] != null && range < zr[0] && amount >1) ||
-                     (zr[1] != null && range > zr[1] && amount <1)))
-                    return;
-            
-                opts.min = min;
-                opts.max = max;
-            });
-            
-            plot.setupGrid();
-            plot.draw();
-            
-            if (!args.preventEvent)
-                plot.getPlaceholder().trigger("plotzoom", [ plot, args ]);
-        };
-
-        plot.pan = function (args) {
-            var delta = {
-                x: +args.left,
-                y: +args.top
-            };
-
-            if (isNaN(delta.x))
-                delta.x = 0;
-            if (isNaN(delta.y))
-                delta.y = 0;
-
-            $.each(plot.getAxes(), function (_, axis) {
-                var opts = axis.options,
-                    min, max, d = delta[axis.direction];
-
-                min = axis.c2p(axis.p2c(axis.min) + d),
-                max = axis.c2p(axis.p2c(axis.max) + d);
-
-                var pr = opts.panRange;
-                if (pr === false) // no panning on this axis
-                    return;
-                
-                if (pr) {
-                    // check whether we hit the wall
-                    if (pr[0] != null && pr[0] > min) {
-                        d = pr[0] - min;
-                        min += d;
-                        max += d;
-                    }
-                    
-                    if (pr[1] != null && pr[1] < max) {
-                        d = pr[1] - max;
-                        min += d;
-                        max += d;
-                    }
-                }
-                
-                opts.min = min;
-                opts.max = max;
-            });
-            
-            plot.setupGrid();
-            plot.draw();
-            
-            if (!args.preventEvent)
-                plot.getPlaceholder().trigger("plotpan", [ plot, args ]);
-        };
-
-        function shutdown(plot, eventHolder) {
-            eventHolder.unbind(plot.getOptions().zoom.trigger, onZoomClick);
-            eventHolder.unbind("mousewheel", onMouseWheel);
-            eventHolder.unbind("dragstart", onDragStart);
-            eventHolder.unbind("drag", onDrag);
-            eventHolder.unbind("dragend", onDragEnd);
-            if (panTimeout)
-                clearTimeout(panTimeout);
-        }
-        
-        plot.hooks.bindEvents.push(bindEvents);
-        plot.hooks.shutdown.push(shutdown);
-    }
-    
-    $.plot.plugins.push({
-        init: init,
-        options: options,
-        name: 'navigate',
-        version: '1.3'
-    });
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.pie.js b/src/legacy/ui/public/flot-charts/jquery.flot.pie.js
deleted file mode 100644
index 06f900bdc950fa..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.pie.js
+++ /dev/null
@@ -1,824 +0,0 @@
-/* Flot plugin for rendering pie charts.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-The plugin assumes that each series has a single data value, and that each
-value is a positive integer or zero.  Negative numbers don't make sense for a
-pie chart, and have unpredictable results.  The values do NOT need to be
-passed in as percentages; the plugin will calculate the total and per-slice
-percentages internally.
-
-* Created by Brian Medendorp
-
-* Updated with contributions from btburnett3, Anthony Aragues and Xavi Ivars
-
-The plugin supports these options:
-
-	series: {
-		pie: {
-			show: true/false
-			radius: 0-1 for percentage of fullsize, or a specified pixel length, or 'auto'
-			innerRadius: 0-1 for percentage of fullsize or a specified pixel length, for creating a donut effect
-			startAngle: 0-2 factor of PI used for starting angle (in radians) i.e 3/2 starts at the top, 0 and 2 have the same result
-			tilt: 0-1 for percentage to tilt the pie, where 1 is no tilt, and 0 is completely flat (nothing will show)
-			offset: {
-				top: integer value to move the pie up or down
-				left: integer value to move the pie left or right, or 'auto'
-			},
-			stroke: {
-				color: any hexadecimal color value (other formats may or may not work, so best to stick with something like '#FFF')
-				width: integer pixel width of the stroke
-			},
-			label: {
-				show: true/false, or 'auto'
-				formatter:  a user-defined function that modifies the text/style of the label text
-				radius: 0-1 for percentage of fullsize, or a specified pixel length
-				background: {
-					color: any hexadecimal color value (other formats may or may not work, so best to stick with something like '#000')
-					opacity: 0-1
-				},
-				threshold: 0-1 for the percentage value at which to hide labels (if they're too small)
-			},
-			combine: {
-				threshold: 0-1 for the percentage value at which to combine slices (if they're too small)
-				color: any hexadecimal color value (other formats may or may not work, so best to stick with something like '#CCC'), if null, the plugin will automatically use the color of the first slice to be combined
-				label: any text value of what the combined slice should be labeled
-			}
-			highlight: {
-				opacity: 0-1
-			}
-		}
-	}
-
-More detail and specific examples can be found in the included HTML file.
-
-*/
-
-import { i18n } from '@kbn/i18n';
-
-(function($) {
-	// Maximum redraw attempts when fitting labels within the plot
-
-	var REDRAW_ATTEMPTS = 10;
-
-	// Factor by which to shrink the pie when fitting labels within the plot
-
-	var REDRAW_SHRINK = 0.95;
-
-	function init(plot) {
-
-		var canvas = null,
-			target = null,
-			options = null,
-			maxRadius = null,
-			centerLeft = null,
-			centerTop = null,
-			processed = false,
-			ctx = null;
-
-		// interactive variables
-
-		var highlights = [];
-
-		// add hook to determine if pie plugin in enabled, and then perform necessary operations
-
-		plot.hooks.processOptions.push(function(plot, options) {
-			if (options.series.pie.show) {
-
-				options.grid.show = false;
-
-				// set labels.show
-
-				if (options.series.pie.label.show == "auto") {
-					if (options.legend.show) {
-						options.series.pie.label.show = false;
-					} else {
-						options.series.pie.label.show = true;
-					}
-				}
-
-				// set radius
-
-				if (options.series.pie.radius == "auto") {
-					if (options.series.pie.label.show) {
-						options.series.pie.radius = 3/4;
-					} else {
-						options.series.pie.radius = 1;
-					}
-				}
-
-				// ensure sane tilt
-
-				if (options.series.pie.tilt > 1) {
-					options.series.pie.tilt = 1;
-				} else if (options.series.pie.tilt < 0) {
-					options.series.pie.tilt = 0;
-				}
-			}
-		});
-
-		plot.hooks.bindEvents.push(function(plot, eventHolder) {
-			var options = plot.getOptions();
-			if (options.series.pie.show) {
-				if (options.grid.hoverable) {
-					eventHolder.unbind("mousemove").mousemove(onMouseMove);
-				}
-				if (options.grid.clickable) {
-					eventHolder.unbind("click").click(onClick);
-				}
-			}
-		});
-
-		plot.hooks.processDatapoints.push(function(plot, series, data, datapoints) {
-			var options = plot.getOptions();
-			if (options.series.pie.show) {
-				processDatapoints(plot, series, data, datapoints);
-			}
-		});
-
-		plot.hooks.drawOverlay.push(function(plot, octx) {
-			var options = plot.getOptions();
-			if (options.series.pie.show) {
-				drawOverlay(plot, octx);
-			}
-		});
-
-		plot.hooks.draw.push(function(plot, newCtx) {
-			var options = plot.getOptions();
-			if (options.series.pie.show) {
-				draw(plot, newCtx);
-			}
-		});
-
-		function processDatapoints(plot, series, datapoints) {
-			if (!processed)	{
-				processed = true;
-				canvas = plot.getCanvas();
-				target = $(canvas).parent();
-				options = plot.getOptions();
-				plot.setData(combine(plot.getData()));
-			}
-		}
-
-		function combine(data) {
-
-			var total = 0,
-				combined = 0,
-				numCombined = 0,
-				color = options.series.pie.combine.color,
-				newdata = [];
-
-			// Fix up the raw data from Flot, ensuring the data is numeric
-
-			for (var i = 0; i < data.length; ++i) {
-
-				var value = data[i].data;
-
-				// If the data is an array, we'll assume that it's a standard
-				// Flot x-y pair, and are concerned only with the second value.
-
-				// Note how we use the original array, rather than creating a
-				// new one; this is more efficient and preserves any extra data
-				// that the user may have stored in higher indexes.
-
-				if ($.isArray(value) && value.length == 1) {
-    				value = value[0];
-				}
-
-				if ($.isArray(value)) {
-					// Equivalent to $.isNumeric() but compatible with jQuery < 1.7
-					if (!isNaN(parseFloat(value[1])) && isFinite(value[1])) {
-						value[1] = +value[1];
-					} else {
-						value[1] = 0;
-					}
-				} else if (!isNaN(parseFloat(value)) && isFinite(value)) {
-					value = [1, +value];
-				} else {
-					value = [1, 0];
-				}
-
-				data[i].data = [value];
-			}
-
-			// Sum up all the slices, so we can calculate percentages for each
-
-			for (var i = 0; i < data.length; ++i) {
-				total += data[i].data[0][1];
-			}
-
-			// Count the number of slices with percentages below the combine
-			// threshold; if it turns out to be just one, we won't combine.
-
-			for (var i = 0; i < data.length; ++i) {
-				var value = data[i].data[0][1];
-				if (value / total <= options.series.pie.combine.threshold) {
-					combined += value;
-					numCombined++;
-					if (!color) {
-						color = data[i].color;
-					}
-				}
-			}
-
-			for (var i = 0; i < data.length; ++i) {
-				var value = data[i].data[0][1];
-				if (numCombined < 2 || value / total > options.series.pie.combine.threshold) {
-					newdata.push(
-						$.extend(data[i], {     /* extend to allow keeping all other original data values
-						                           and using them e.g. in labelFormatter. */
-							data: [[1, value]],
-							color: data[i].color,
-							label: data[i].label,
-							angle: value * Math.PI * 2 / total,
-							percent: value / (total / 100)
-						})
-					);
-				}
-			}
-
-			if (numCombined > 1) {
-				newdata.push({
-					data: [[1, combined]],
-					color: color,
-					label: options.series.pie.combine.label,
-					angle: combined * Math.PI * 2 / total,
-					percent: combined / (total / 100)
-				});
-			}
-
-			return newdata;
-		}
-
-		function draw(plot, newCtx) {
-
-			if (!target) {
-				return; // if no series were passed
-			}
-
-			var canvasWidth = plot.getPlaceholder().width(),
-				canvasHeight = plot.getPlaceholder().height(),
-				legendWidth = target.children().filter(".legend").children().width() || 0;
-
-			ctx = newCtx;
-
-			// WARNING: HACK! REWRITE THIS CODE AS SOON AS POSSIBLE!
-
-			// When combining smaller slices into an 'other' slice, we need to
-			// add a new series.  Since Flot gives plugins no way to modify the
-			// list of series, the pie plugin uses a hack where the first call
-			// to processDatapoints results in a call to setData with the new
-			// list of series, then subsequent processDatapoints do nothing.
-
-			// The plugin-global 'processed' flag is used to control this hack;
-			// it starts out false, and is set to true after the first call to
-			// processDatapoints.
-
-			// Unfortunately this turns future setData calls into no-ops; they
-			// call processDatapoints, the flag is true, and nothing happens.
-
-			// To fix this we'll set the flag back to false here in draw, when
-			// all series have been processed, so the next sequence of calls to
-			// processDatapoints once again starts out with a slice-combine.
-			// This is really a hack; in 0.9 we need to give plugins a proper
-			// way to modify series before any processing begins.
-
-			processed = false;
-
-			// calculate maximum radius and center point
-
-			maxRadius =  Math.min(canvasWidth, canvasHeight / options.series.pie.tilt) / 2;
-			centerTop = canvasHeight / 2 + options.series.pie.offset.top;
-			centerLeft = canvasWidth / 2;
-
-			if (options.series.pie.offset.left == "auto") {
-				if (options.legend.position.match("w")) {
-					centerLeft += legendWidth / 2;
-				} else {
-					centerLeft -= legendWidth / 2;
-				}
-				if (centerLeft < maxRadius) {
-					centerLeft = maxRadius;
-				} else if (centerLeft > canvasWidth - maxRadius) {
-					centerLeft = canvasWidth - maxRadius;
-				}
-			} else {
-				centerLeft += options.series.pie.offset.left;
-			}
-
-			var slices = plot.getData(),
-				attempts = 0;
-
-			// Keep shrinking the pie's radius until drawPie returns true,
-			// indicating that all the labels fit, or we try too many times.
-
-			do {
-				if (attempts > 0) {
-					maxRadius *= REDRAW_SHRINK;
-				}
-				attempts += 1;
-				clear();
-				if (options.series.pie.tilt <= 0.8) {
-					drawShadow();
-				}
-			} while (!drawPie() && attempts < REDRAW_ATTEMPTS)
-
-			if (attempts >= REDRAW_ATTEMPTS) {
-				clear();
-				const errorMessage = i18n.translate('common.ui.flotCharts.pie.unableToDrawLabelsInsideCanvasErrorMessage', {
-					defaultMessage: 'Could not draw pie with labels contained inside canvas',
-				});
-				target.prepend(`<div class='error'>${errorMessage}</div>`);
-			}
-
-			if (plot.setSeries && plot.insertLegend) {
-				plot.setSeries(slices);
-				plot.insertLegend();
-			}
-
-			// we're actually done at this point, just defining internal functions at this point
-
-			function clear() {
-				ctx.clearRect(0, 0, canvasWidth, canvasHeight);
-				target.children().filter(".pieLabel, .pieLabelBackground").remove();
-			}
-
-			function drawShadow() {
-
-				var shadowLeft = options.series.pie.shadow.left;
-				var shadowTop = options.series.pie.shadow.top;
-				var edge = 10;
-				var alpha = options.series.pie.shadow.alpha;
-				var radius = options.series.pie.radius > 1 ? options.series.pie.radius : maxRadius * options.series.pie.radius;
-
-				if (radius >= canvasWidth / 2 - shadowLeft || radius * options.series.pie.tilt >= canvasHeight / 2 - shadowTop || radius <= edge) {
-					return;	// shadow would be outside canvas, so don't draw it
-				}
-
-				ctx.save();
-				ctx.translate(shadowLeft,shadowTop);
-				ctx.globalAlpha = alpha;
-				ctx.fillStyle = "#000";
-
-				// center and rotate to starting position
-
-				ctx.translate(centerLeft,centerTop);
-				ctx.scale(1, options.series.pie.tilt);
-
-				//radius -= edge;
-
-				for (var i = 1; i <= edge; i++) {
-					ctx.beginPath();
-					ctx.arc(0, 0, radius, 0, Math.PI * 2, false);
-					ctx.fill();
-					radius -= i;
-				}
-
-				ctx.restore();
-			}
-
-			function drawPie() {
-
-				var startAngle = Math.PI * options.series.pie.startAngle;
-				var radius = options.series.pie.radius > 1 ? options.series.pie.radius : maxRadius * options.series.pie.radius;
-
-				// center and rotate to starting position
-
-				ctx.save();
-				ctx.translate(centerLeft,centerTop);
-				ctx.scale(1, options.series.pie.tilt);
-				//ctx.rotate(startAngle); // start at top; -- This doesn't work properly in Opera
-
-				// draw slices
-
-				ctx.save();
-				var currentAngle = startAngle;
-				for (var i = 0; i < slices.length; ++i) {
-					slices[i].startAngle = currentAngle;
-					drawSlice(slices[i].angle, slices[i].color, true);
-				}
-				ctx.restore();
-
-				// draw slice outlines
-
-				if (options.series.pie.stroke.width > 0) {
-					ctx.save();
-					ctx.lineWidth = options.series.pie.stroke.width;
-					currentAngle = startAngle;
-					for (var i = 0; i < slices.length; ++i) {
-						drawSlice(slices[i].angle, options.series.pie.stroke.color, false);
-					}
-					ctx.restore();
-				}
-
-				// draw donut hole
-
-				drawDonutHole(ctx);
-
-				ctx.restore();
-
-				// Draw the labels, returning true if they fit within the plot
-
-				if (options.series.pie.label.show) {
-					return drawLabels();
-				} else return true;
-
-				function drawSlice(angle, color, fill) {
-
-					if (angle <= 0 || isNaN(angle)) {
-						return;
-					}
-
-					if (fill) {
-						ctx.fillStyle = color;
-					} else {
-						ctx.strokeStyle = color;
-						ctx.lineJoin = "round";
-					}
-
-					ctx.beginPath();
-					if (Math.abs(angle - Math.PI * 2) > 0.000000001) {
-						ctx.moveTo(0, 0); // Center of the pie
-					}
-
-					//ctx.arc(0, 0, radius, 0, angle, false); // This doesn't work properly in Opera
-					ctx.arc(0, 0, radius,currentAngle, currentAngle + angle / 2, false);
-					ctx.arc(0, 0, radius,currentAngle + angle / 2, currentAngle + angle, false);
-					ctx.closePath();
-					//ctx.rotate(angle); // This doesn't work properly in Opera
-					currentAngle += angle;
-
-					if (fill) {
-						ctx.fill();
-					} else {
-						ctx.stroke();
-					}
-				}
-
-				function drawLabels() {
-
-					var currentAngle = startAngle;
-					var radius = options.series.pie.label.radius > 1 ? options.series.pie.label.radius : maxRadius * options.series.pie.label.radius;
-
-					for (var i = 0; i < slices.length; ++i) {
-						if (slices[i].percent >= options.series.pie.label.threshold * 100) {
-							if (!drawLabel(slices[i], currentAngle, i)) {
-								return false;
-							}
-						}
-						currentAngle += slices[i].angle;
-					}
-
-					return true;
-
-					function drawLabel(slice, startAngle, index) {
-
-						if (slice.data[0][1] == 0) {
-							return true;
-						}
-
-						// format label text
-
-						var lf = options.legend.labelFormatter, text, plf = options.series.pie.label.formatter;
-
-						if (lf) {
-							text = lf(slice.label, slice);
-						} else {
-							text = slice.label;
-						}
-
-						if (plf) {
-							text = plf(text, slice);
-						}
-
-						var halfAngle = ((startAngle + slice.angle) + startAngle) / 2;
-						var x = centerLeft + Math.round(Math.cos(halfAngle) * radius);
-						var y = centerTop + Math.round(Math.sin(halfAngle) * radius) * options.series.pie.tilt;
-
-						var html = "<span class='pieLabel' id='pieLabel" + index + "' style='position:absolute;top:" + y + "px;left:" + x + "px;'>" + text + "</span>";
-						target.append(html);
-
-						var label = target.children("#pieLabel" + index);
-						var labelTop = (y - label.height() / 2);
-						var labelLeft = (x - label.width() / 2);
-
-						label.css("top", labelTop);
-						label.css("left", labelLeft);
-
-						// check to make sure that the label is not outside the canvas
-
-						if (0 - labelTop > 0 || 0 - labelLeft > 0 || canvasHeight - (labelTop + label.height()) < 0 || canvasWidth - (labelLeft + label.width()) < 0) {
-							return false;
-						}
-
-						if (options.series.pie.label.background.opacity != 0) {
-
-							// put in the transparent background separately to avoid blended labels and label boxes
-
-							var c = options.series.pie.label.background.color;
-
-							if (c == null) {
-								c = slice.color;
-							}
-
-							var pos = "top:" + labelTop + "px;left:" + labelLeft + "px;";
-							$("<div class='pieLabelBackground' style='position:absolute;width:" + label.width() + "px;height:" + label.height() + "px;" + pos + "background-color:" + c + ";'></div>")
-								.css("opacity", options.series.pie.label.background.opacity)
-								.insertBefore(label);
-						}
-
-						return true;
-					} // end individual label function
-				} // end drawLabels function
-			} // end drawPie function
-		} // end draw function
-
-		// Placed here because it needs to be accessed from multiple locations
-
-		function drawDonutHole(layer) {
-			if (options.series.pie.innerRadius > 0) {
-
-				// subtract the center
-
-				layer.save();
-				var innerRadius = options.series.pie.innerRadius > 1 ? options.series.pie.innerRadius : maxRadius * options.series.pie.innerRadius;
-				layer.globalCompositeOperation = "destination-out"; // this does not work with excanvas, but it will fall back to using the stroke color
-				layer.beginPath();
-				layer.fillStyle = options.series.pie.stroke.color;
-				layer.arc(0, 0, innerRadius, 0, Math.PI * 2, false);
-				layer.fill();
-				layer.closePath();
-				layer.restore();
-
-				// add inner stroke
-
-				layer.save();
-				layer.beginPath();
-				layer.strokeStyle = options.series.pie.stroke.color;
-				layer.arc(0, 0, innerRadius, 0, Math.PI * 2, false);
-				layer.stroke();
-				layer.closePath();
-				layer.restore();
-
-				// TODO: add extra shadow inside hole (with a mask) if the pie is tilted.
-			}
-		}
-
-		//-- Additional Interactive related functions --
-
-		function isPointInPoly(poly, pt) {
-			for(var c = false, i = -1, l = poly.length, j = l - 1; ++i < l; j = i)
-				((poly[i][1] <= pt[1] && pt[1] < poly[j][1]) || (poly[j][1] <= pt[1] && pt[1]< poly[i][1]))
-				&& (pt[0] < (poly[j][0] - poly[i][0]) * (pt[1] - poly[i][1]) / (poly[j][1] - poly[i][1]) + poly[i][0])
-				&& (c = !c);
-			return c;
-		}
-
-		function findNearbySlice(mouseX, mouseY) {
-
-			var slices = plot.getData(),
-				options = plot.getOptions(),
-				radius = options.series.pie.radius > 1 ? options.series.pie.radius : maxRadius * options.series.pie.radius,
-				x, y;
-
-			for (var i = 0; i < slices.length; ++i) {
-
-				var s = slices[i];
-
-				if (s.pie.show) {
-
-					ctx.save();
-					ctx.beginPath();
-					ctx.moveTo(0, 0); // Center of the pie
-					//ctx.scale(1, options.series.pie.tilt);	// this actually seems to break everything when here.
-					ctx.arc(0, 0, radius, s.startAngle, s.startAngle + s.angle / 2, false);
-					ctx.arc(0, 0, radius, s.startAngle + s.angle / 2, s.startAngle + s.angle, false);
-					ctx.closePath();
-					x = mouseX - centerLeft;
-					y = mouseY - centerTop;
-
-					if (ctx.isPointInPath) {
-						if (ctx.isPointInPath(mouseX - centerLeft, mouseY - centerTop)) {
-							ctx.restore();
-							return {
-								datapoint: [s.percent, s.data],
-								dataIndex: 0,
-								series: s,
-								seriesIndex: i
-							};
-						}
-					} else {
-
-						// excanvas for IE doesn;t support isPointInPath, this is a workaround.
-
-						var p1X = radius * Math.cos(s.startAngle),
-							p1Y = radius * Math.sin(s.startAngle),
-							p2X = radius * Math.cos(s.startAngle + s.angle / 4),
-							p2Y = radius * Math.sin(s.startAngle + s.angle / 4),
-							p3X = radius * Math.cos(s.startAngle + s.angle / 2),
-							p3Y = radius * Math.sin(s.startAngle + s.angle / 2),
-							p4X = radius * Math.cos(s.startAngle + s.angle / 1.5),
-							p4Y = radius * Math.sin(s.startAngle + s.angle / 1.5),
-							p5X = radius * Math.cos(s.startAngle + s.angle),
-							p5Y = radius * Math.sin(s.startAngle + s.angle),
-							arrPoly = [[0, 0], [p1X, p1Y], [p2X, p2Y], [p3X, p3Y], [p4X, p4Y], [p5X, p5Y]],
-							arrPoint = [x, y];
-
-						// TODO: perhaps do some mathematical trickery here with the Y-coordinate to compensate for pie tilt?
-
-						if (isPointInPoly(arrPoly, arrPoint)) {
-							ctx.restore();
-							return {
-								datapoint: [s.percent, s.data],
-								dataIndex: 0,
-								series: s,
-								seriesIndex: i
-							};
-						}
-					}
-
-					ctx.restore();
-				}
-			}
-
-			return null;
-		}
-
-		function onMouseMove(e) {
-			triggerClickHoverEvent("plothover", e);
-		}
-
-		function onClick(e) {
-			triggerClickHoverEvent("plotclick", e);
-		}
-
-		// trigger click or hover event (they send the same parameters so we share their code)
-
-		function triggerClickHoverEvent(eventname, e) {
-
-			var offset = plot.offset();
-			var canvasX = parseInt(e.pageX - offset.left);
-			var canvasY =  parseInt(e.pageY - offset.top);
-			var item = findNearbySlice(canvasX, canvasY);
-
-			if (options.grid.autoHighlight) {
-
-				// clear auto-highlights
-
-				for (var i = 0; i < highlights.length; ++i) {
-					var h = highlights[i];
-					if (h.auto == eventname && !(item && h.series == item.series)) {
-						unhighlight(h.series);
-					}
-				}
-			}
-
-			// highlight the slice
-
-			if (item) {
-				highlight(item.series, eventname);
-			}
-
-			// trigger any hover bind events
-
-			var pos = { pageX: e.pageX, pageY: e.pageY };
-			target.trigger(eventname, [pos, item]);
-		}
-
-		function highlight(s, auto) {
-			//if (typeof s == "number") {
-			//	s = series[s];
-			//}
-
-			var i = indexOfHighlight(s);
-
-			if (i == -1) {
-				highlights.push({ series: s, auto: auto });
-				plot.triggerRedrawOverlay();
-			} else if (!auto) {
-				highlights[i].auto = false;
-			}
-		}
-
-		function unhighlight(s) {
-			if (s == null) {
-				highlights = [];
-				plot.triggerRedrawOverlay();
-			}
-
-			//if (typeof s == "number") {
-			//	s = series[s];
-			//}
-
-			var i = indexOfHighlight(s);
-
-			if (i != -1) {
-				highlights.splice(i, 1);
-				plot.triggerRedrawOverlay();
-			}
-		}
-
-		function indexOfHighlight(s) {
-			for (var i = 0; i < highlights.length; ++i) {
-				var h = highlights[i];
-				if (h.series == s)
-					return i;
-			}
-			return -1;
-		}
-
-		function drawOverlay(plot, octx) {
-
-			var options = plot.getOptions();
-
-			var radius = options.series.pie.radius > 1 ? options.series.pie.radius : maxRadius * options.series.pie.radius;
-
-			octx.save();
-			octx.translate(centerLeft, centerTop);
-			octx.scale(1, options.series.pie.tilt);
-
-			for (var i = 0; i < highlights.length; ++i) {
-				drawHighlight(highlights[i].series);
-			}
-
-			drawDonutHole(octx);
-
-			octx.restore();
-
-			function drawHighlight(series) {
-
-				if (series.angle <= 0 || isNaN(series.angle)) {
-					return;
-				}
-
-				//octx.fillStyle = parseColor(options.series.pie.highlight.color).scale(null, null, null, options.series.pie.highlight.opacity).toString();
-				octx.fillStyle = "rgba(255, 255, 255, " + options.series.pie.highlight.opacity + ")"; // this is temporary until we have access to parseColor
-				octx.beginPath();
-				if (Math.abs(series.angle - Math.PI * 2) > 0.000000001) {
-					octx.moveTo(0, 0); // Center of the pie
-				}
-				octx.arc(0, 0, radius, series.startAngle, series.startAngle + series.angle / 2, false);
-				octx.arc(0, 0, radius, series.startAngle + series.angle / 2, series.startAngle + series.angle, false);
-				octx.closePath();
-				octx.fill();
-			}
-		}
-	} // end init (plugin body)
-
-	// define pie specific options and their default values
-
-	var options = {
-		series: {
-			pie: {
-				show: false,
-				radius: "auto",	// actual radius of the visible pie (based on full calculated radius if <=1, or hard pixel value)
-				innerRadius: 0, /* for donut */
-				startAngle: 3/2,
-				tilt: 1,
-				shadow: {
-					left: 5,	// shadow left offset
-					top: 15,	// shadow top offset
-					alpha: 0.02	// shadow alpha
-				},
-				offset: {
-					top: 0,
-					left: "auto"
-				},
-				stroke: {
-					color: "#fff",
-					width: 1
-				},
-				label: {
-					show: "auto",
-					formatter: function(label, slice) {
-						return "<div style='font-size:x-small;text-align:center;padding:2px;color:" + slice.color + ";'>" + label + "<br/>" + Math.round(slice.percent) + "%</div>";
-					},	// formatter function
-					radius: 1,	// radius at which to place the labels (based on full calculated radius if <=1, or hard pixel value)
-					background: {
-						color: null,
-						opacity: 0
-					},
-					threshold: 0	// percentage at which to hide the label (i.e. the slice is too narrow)
-				},
-				combine: {
-					threshold: -1,	// percentage at which to combine little slices into one larger slice
-					color: null,	// color to give the new slice (auto-generated if null)
-					label: "Other"	// label to give the new slice
-				},
-				highlight: {
-					//color: "#fff",		// will add this functionality once parseColor is available
-					opacity: 0.5
-				}
-			}
-		}
-	};
-
-	$.plot.plugins.push({
-		init: init,
-		options: options,
-		name: "pie",
-		version: "1.1"
-	});
-
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.resize.js b/src/legacy/ui/public/flot-charts/jquery.flot.resize.js
deleted file mode 100644
index 8a626dda0addbc..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.resize.js
+++ /dev/null
@@ -1,59 +0,0 @@
-/* Flot plugin for automatically redrawing plots as the placeholder resizes.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-It works by listening for changes on the placeholder div (through the jQuery
-resize event plugin) - if the size changes, it will redraw the plot.
-
-There are no options. If you need to disable the plugin for some plots, you
-can just fix the size of their placeholders.
-
-*/
-
-/* Inline dependency:
- * jQuery resize event - v1.1 - 3/14/2010
- * http://benalman.com/projects/jquery-resize-plugin/
- *
- * Copyright (c) 2010 "Cowboy" Ben Alman
- * Dual licensed under the MIT and GPL licenses.
- * http://benalman.com/about/license/
- */
-(function($,e,t){"$:nomunge";var i=[],n=$.resize=$.extend($.resize,{}),a,r=false,s="setTimeout",u="resize",m=u+"-special-event",o="pendingDelay",l="activeDelay",f="throttleWindow";n[o]=200;n[l]=20;n[f]=true;$.event.special[u]={setup:function(){if(!n[f]&&this[s]){return false}var e=$(this);i.push(this);e.data(m,{w:e.width(),h:e.height()});if(i.length===1){a=t;h()}},teardown:function(){if(!n[f]&&this[s]){return false}var e=$(this);for(var t=i.length-1;t>=0;t--){if(i[t]==this){i.splice(t,1);break}}e.removeData(m);if(!i.length){if(r){cancelAnimationFrame(a)}else{clearTimeout(a)}a=null}},add:function(e){if(!n[f]&&this[s]){return false}var i;function a(e,n,a){var r=$(this),s=r.data(m)||{};s.w=n!==t?n:r.width();s.h=a!==t?a:r.height();i.apply(this,arguments)}if($.isFunction(e)){i=e;return a}else{i=e.handler;e.handler=a}}};function h(t){if(r===true){r=t||1}for(var s=i.length-1;s>=0;s--){var l=$(i[s]);if(l[0]==e||l.is(":visible")){var f=l.width(),c=l.height(),d=l.data(m);if(d&&(f!==d.w||c!==d.h)){l.trigger(u,[d.w=f,d.h=c]);r=t||true}}else{d=l.data(m);d.w=0;d.h=0}}if(a!==null){if(r&&(t==null||t-r<1e3)){a=e.requestAnimationFrame(h)}else{a=setTimeout(h,n[o]);r=false}}}if(!e.requestAnimationFrame){e.requestAnimationFrame=function(){return e.webkitRequestAnimationFrame||e.mozRequestAnimationFrame||e.oRequestAnimationFrame||e.msRequestAnimationFrame||function(t,i){return e.setTimeout(function(){t((new Date).getTime())},n[l])}}()}if(!e.cancelAnimationFrame){e.cancelAnimationFrame=function(){return e.webkitCancelRequestAnimationFrame||e.mozCancelRequestAnimationFrame||e.oCancelRequestAnimationFrame||e.msCancelRequestAnimationFrame||clearTimeout}()}})(jQuery,this);
-
-(function ($) {
-    var options = { }; // no options
-
-    function init(plot) {
-        function onResize() {
-            var placeholder = plot.getPlaceholder();
-
-            // somebody might have hidden us and we can't plot
-            // when we don't have the dimensions
-            if (placeholder.width() == 0 || placeholder.height() == 0)
-                return;
-
-            plot.resize();
-            plot.setupGrid();
-            plot.draw();
-        }
-        
-        function bindEvents(plot, eventHolder) {
-            plot.getPlaceholder().resize(onResize);
-        }
-
-        function shutdown(plot, eventHolder) {
-            plot.getPlaceholder().unbind("resize", onResize);
-        }
-        
-        plot.hooks.bindEvents.push(bindEvents);
-        plot.hooks.shutdown.push(shutdown);
-    }
-    
-    $.plot.plugins.push({
-        init: init,
-        options: options,
-        name: 'resize',
-        version: '1.0'
-    });
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.selection.js b/src/legacy/ui/public/flot-charts/jquery.flot.selection.js
deleted file mode 100644
index c8707b30f4e6ff..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.selection.js
+++ /dev/null
@@ -1,360 +0,0 @@
-/* Flot plugin for selecting regions of a plot.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-The plugin supports these options:
-
-selection: {
-	mode: null or "x" or "y" or "xy",
-	color: color,
-	shape: "round" or "miter" or "bevel",
-	minSize: number of pixels
-}
-
-Selection support is enabled by setting the mode to one of "x", "y" or "xy".
-In "x" mode, the user will only be able to specify the x range, similarly for
-"y" mode. For "xy", the selection becomes a rectangle where both ranges can be
-specified. "color" is color of the selection (if you need to change the color
-later on, you can get to it with plot.getOptions().selection.color). "shape"
-is the shape of the corners of the selection.
-
-"minSize" is the minimum size a selection can be in pixels. This value can
-be customized to determine the smallest size a selection can be and still
-have the selection rectangle be displayed. When customizing this value, the
-fact that it refers to pixels, not axis units must be taken into account.
-Thus, for example, if there is a bar graph in time mode with BarWidth set to 1
-minute, setting "minSize" to 1 will not make the minimum selection size 1
-minute, but rather 1 pixel. Note also that setting "minSize" to 0 will prevent
-"plotunselected" events from being fired when the user clicks the mouse without
-dragging.
-
-When selection support is enabled, a "plotselected" event will be emitted on
-the DOM element you passed into the plot function. The event handler gets a
-parameter with the ranges selected on the axes, like this:
-
-	placeholder.bind( "plotselected", function( event, ranges ) {
-		alert("You selected " + ranges.xaxis.from + " to " + ranges.xaxis.to)
-		// similar for yaxis - with multiple axes, the extra ones are in
-		// x2axis, x3axis, ...
-	});
-
-The "plotselected" event is only fired when the user has finished making the
-selection. A "plotselecting" event is fired during the process with the same
-parameters as the "plotselected" event, in case you want to know what's
-happening while it's happening,
-
-A "plotunselected" event with no arguments is emitted when the user clicks the
-mouse to remove the selection. As stated above, setting "minSize" to 0 will
-destroy this behavior.
-
-The plugin also adds the following methods to the plot object:
-
-- setSelection( ranges, preventEvent )
-
-  Set the selection rectangle. The passed in ranges is on the same form as
-  returned in the "plotselected" event. If the selection mode is "x", you
-  should put in either an xaxis range, if the mode is "y" you need to put in
-  an yaxis range and both xaxis and yaxis if the selection mode is "xy", like
-  this:
-
-	setSelection({ xaxis: { from: 0, to: 10 }, yaxis: { from: 40, to: 60 } });
-
-  setSelection will trigger the "plotselected" event when called. If you don't
-  want that to happen, e.g. if you're inside a "plotselected" handler, pass
-  true as the second parameter. If you are using multiple axes, you can
-  specify the ranges on any of those, e.g. as x2axis/x3axis/... instead of
-  xaxis, the plugin picks the first one it sees.
-
-- clearSelection( preventEvent )
-
-  Clear the selection rectangle. Pass in true to avoid getting a
-  "plotunselected" event.
-
-- getSelection()
-
-  Returns the current selection in the same format as the "plotselected"
-  event. If there's currently no selection, the function returns null.
-
-*/
-
-(function ($) {
-    function init(plot) {
-        var selection = {
-                first: { x: -1, y: -1}, second: { x: -1, y: -1},
-                show: false,
-                active: false
-            };
-
-        // FIXME: The drag handling implemented here should be
-        // abstracted out, there's some similar code from a library in
-        // the navigation plugin, this should be massaged a bit to fit
-        // the Flot cases here better and reused. Doing this would
-        // make this plugin much slimmer.
-        var savedhandlers = {};
-
-        var mouseUpHandler = null;
-        
-        function onMouseMove(e) {
-            if (selection.active) {
-                updateSelection(e);
-                
-                plot.getPlaceholder().trigger("plotselecting", [ getSelection() ]);
-            }
-        }
-
-        function onMouseDown(e) {
-            if (e.which != 1)  // only accept left-click
-                return;
-            
-            // cancel out any text selections
-            document.body.focus();
-
-            // prevent text selection and drag in old-school browsers
-            if (document.onselectstart !== undefined && savedhandlers.onselectstart == null) {
-                savedhandlers.onselectstart = document.onselectstart;
-                document.onselectstart = function () { return false; };
-            }
-            if (document.ondrag !== undefined && savedhandlers.ondrag == null) {
-                savedhandlers.ondrag = document.ondrag;
-                document.ondrag = function () { return false; };
-            }
-
-            setSelectionPos(selection.first, e);
-
-            selection.active = true;
-
-            // this is a bit silly, but we have to use a closure to be
-            // able to whack the same handler again
-            mouseUpHandler = function (e) { onMouseUp(e); };
-            
-            $(document).one("mouseup", mouseUpHandler);
-        }
-
-        function onMouseUp(e) {
-            mouseUpHandler = null;
-            
-            // revert drag stuff for old-school browsers
-            if (document.onselectstart !== undefined)
-                document.onselectstart = savedhandlers.onselectstart;
-            if (document.ondrag !== undefined)
-                document.ondrag = savedhandlers.ondrag;
-
-            // no more dragging
-            selection.active = false;
-            updateSelection(e);
-
-            if (selectionIsSane())
-                triggerSelectedEvent();
-            else {
-                // this counts as a clear
-                plot.getPlaceholder().trigger("plotunselected", [ ]);
-                plot.getPlaceholder().trigger("plotselecting", [ null ]);
-            }
-
-            return false;
-        }
-
-        function getSelection() {
-            if (!selectionIsSane())
-                return null;
-            
-            if (!selection.show) return null;
-
-            var r = {}, c1 = selection.first, c2 = selection.second;
-            $.each(plot.getAxes(), function (name, axis) {
-                if (axis.used) {
-                    var p1 = axis.c2p(c1[axis.direction]), p2 = axis.c2p(c2[axis.direction]); 
-                    r[name] = { from: Math.min(p1, p2), to: Math.max(p1, p2) };
-                }
-            });
-            return r;
-        }
-
-        function triggerSelectedEvent() {
-            var r = getSelection();
-
-            plot.getPlaceholder().trigger("plotselected", [ r ]);
-
-            // backwards-compat stuff, to be removed in future
-            if (r.xaxis && r.yaxis)
-                plot.getPlaceholder().trigger("selected", [ { x1: r.xaxis.from, y1: r.yaxis.from, x2: r.xaxis.to, y2: r.yaxis.to } ]);
-        }
-
-        function clamp(min, value, max) {
-            return value < min ? min: (value > max ? max: value);
-        }
-
-        function setSelectionPos(pos, e) {
-            var o = plot.getOptions();
-            var offset = plot.getPlaceholder().offset();
-            var plotOffset = plot.getPlotOffset();
-            pos.x = clamp(0, e.pageX - offset.left - plotOffset.left, plot.width());
-            pos.y = clamp(0, e.pageY - offset.top - plotOffset.top, plot.height());
-
-            if (o.selection.mode == "y")
-                pos.x = pos == selection.first ? 0 : plot.width();
-
-            if (o.selection.mode == "x")
-                pos.y = pos == selection.first ? 0 : plot.height();
-        }
-
-        function updateSelection(pos) {
-            if (pos.pageX == null)
-                return;
-
-            setSelectionPos(selection.second, pos);
-            if (selectionIsSane()) {
-                selection.show = true;
-                plot.triggerRedrawOverlay();
-            }
-            else
-                clearSelection(true);
-        }
-
-        function clearSelection(preventEvent) {
-            if (selection.show) {
-                selection.show = false;
-                plot.triggerRedrawOverlay();
-                if (!preventEvent)
-                    plot.getPlaceholder().trigger("plotunselected", [ ]);
-            }
-        }
-
-        // function taken from markings support in Flot
-        function extractRange(ranges, coord) {
-            var axis, from, to, key, axes = plot.getAxes();
-
-            for (var k in axes) {
-                axis = axes[k];
-                if (axis.direction == coord) {
-                    key = coord + axis.n + "axis";
-                    if (!ranges[key] && axis.n == 1)
-                        key = coord + "axis"; // support x1axis as xaxis
-                    if (ranges[key]) {
-                        from = ranges[key].from;
-                        to = ranges[key].to;
-                        break;
-                    }
-                }
-            }
-
-            // backwards-compat stuff - to be removed in future
-            if (!ranges[key]) {
-                axis = coord == "x" ? plot.getXAxes()[0] : plot.getYAxes()[0];
-                from = ranges[coord + "1"];
-                to = ranges[coord + "2"];
-            }
-
-            // auto-reverse as an added bonus
-            if (from != null && to != null && from > to) {
-                var tmp = from;
-                from = to;
-                to = tmp;
-            }
-            
-            return { from: from, to: to, axis: axis };
-        }
-        
-        function setSelection(ranges, preventEvent) {
-            var axis, range, o = plot.getOptions();
-
-            if (o.selection.mode == "y") {
-                selection.first.x = 0;
-                selection.second.x = plot.width();
-            }
-            else {
-                range = extractRange(ranges, "x");
-
-                selection.first.x = range.axis.p2c(range.from);
-                selection.second.x = range.axis.p2c(range.to);
-            }
-
-            if (o.selection.mode == "x") {
-                selection.first.y = 0;
-                selection.second.y = plot.height();
-            }
-            else {
-                range = extractRange(ranges, "y");
-
-                selection.first.y = range.axis.p2c(range.from);
-                selection.second.y = range.axis.p2c(range.to);
-            }
-
-            selection.show = true;
-            plot.triggerRedrawOverlay();
-            if (!preventEvent && selectionIsSane())
-                triggerSelectedEvent();
-        }
-
-        function selectionIsSane() {
-            var minSize = plot.getOptions().selection.minSize;
-            return Math.abs(selection.second.x - selection.first.x) >= minSize &&
-                Math.abs(selection.second.y - selection.first.y) >= minSize;
-        }
-
-        plot.clearSelection = clearSelection;
-        plot.setSelection = setSelection;
-        plot.getSelection = getSelection;
-
-        plot.hooks.bindEvents.push(function(plot, eventHolder) {
-            var o = plot.getOptions();
-            if (o.selection.mode != null) {
-                eventHolder.mousemove(onMouseMove);
-                eventHolder.mousedown(onMouseDown);
-            }
-        });
-
-
-        plot.hooks.drawOverlay.push(function (plot, ctx) {
-            // draw selection
-            if (selection.show && selectionIsSane()) {
-                var plotOffset = plot.getPlotOffset();
-                var o = plot.getOptions();
-
-                ctx.save();
-                ctx.translate(plotOffset.left, plotOffset.top);
-
-                var c = $.color.parse(o.selection.color);
-
-                ctx.strokeStyle = c.scale('a', 0.8).toString();
-                ctx.lineWidth = 1;
-                ctx.lineJoin = o.selection.shape;
-                ctx.fillStyle = c.scale('a', 0.4).toString();
-
-                var x = Math.min(selection.first.x, selection.second.x) + 0.5,
-                    y = Math.min(selection.first.y, selection.second.y) + 0.5,
-                    w = Math.abs(selection.second.x - selection.first.x) - 1,
-                    h = Math.abs(selection.second.y - selection.first.y) - 1;
-
-                ctx.fillRect(x, y, w, h);
-                ctx.strokeRect(x, y, w, h);
-
-                ctx.restore();
-            }
-        });
-        
-        plot.hooks.shutdown.push(function (plot, eventHolder) {
-            eventHolder.unbind("mousemove", onMouseMove);
-            eventHolder.unbind("mousedown", onMouseDown);
-            
-            if (mouseUpHandler)
-                $(document).unbind("mouseup", mouseUpHandler);
-        });
-
-    }
-
-    $.plot.plugins.push({
-        init: init,
-        options: {
-            selection: {
-                mode: null, // one of null, "x", "y" or "xy"
-                color: "#e8cfac",
-                shape: "round", // one of "round", "miter", or "bevel"
-                minSize: 5 // minimum number of pixels
-            }
-        },
-        name: 'selection',
-        version: '1.1'
-    });
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.stack.js b/src/legacy/ui/public/flot-charts/jquery.flot.stack.js
deleted file mode 100644
index 0d91c0f3c01608..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.stack.js
+++ /dev/null
@@ -1,188 +0,0 @@
-/* Flot plugin for stacking data sets rather than overlaying them.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-The plugin assumes the data is sorted on x (or y if stacking horizontally).
-For line charts, it is assumed that if a line has an undefined gap (from a
-null point), then the line above it should have the same gap - insert zeros
-instead of "null" if you want another behaviour. This also holds for the start
-and end of the chart. Note that stacking a mix of positive and negative values
-in most instances doesn't make sense (so it looks weird).
-
-Two or more series are stacked when their "stack" attribute is set to the same
-key (which can be any number or string or just "true"). To specify the default
-stack, you can set the stack option like this:
-
-	series: {
-		stack: null/false, true, or a key (number/string)
-	}
-
-You can also specify it for a single series, like this:
-
-	$.plot( $("#placeholder"), [{
-		data: [ ... ],
-		stack: true
-	}])
-
-The stacking order is determined by the order of the data series in the array
-(later series end up on top of the previous).
-
-Internally, the plugin modifies the datapoints in each series, adding an
-offset to the y value. For line series, extra data points are inserted through
-interpolation. If there's a second y value, it's also adjusted (e.g for bar
-charts or filled areas).
-
-*/
-
-(function ($) {
-    var options = {
-        series: { stack: null } // or number/string
-    };
-    
-    function init(plot) {
-        function findMatchingSeries(s, allseries) {
-            var res = null;
-            for (var i = 0; i < allseries.length; ++i) {
-                if (s == allseries[i])
-                    break;
-                
-                if (allseries[i].stack == s.stack)
-                    res = allseries[i];
-            }
-            
-            return res;
-        }
-        
-        function stackData(plot, s, datapoints) {
-            if (s.stack == null || s.stack === false)
-                return;
-
-            var other = findMatchingSeries(s, plot.getData());
-            if (!other)
-                return;
-
-            var ps = datapoints.pointsize,
-                points = datapoints.points,
-                otherps = other.datapoints.pointsize,
-                otherpoints = other.datapoints.points,
-                newpoints = [],
-                px, py, intery, qx, qy, bottom,
-                withlines = s.lines.show,
-                horizontal = s.bars.horizontal,
-                withbottom = ps > 2 && (horizontal ? datapoints.format[2].x : datapoints.format[2].y),
-                withsteps = withlines && s.lines.steps,
-                fromgap = true,
-                keyOffset = horizontal ? 1 : 0,
-                accumulateOffset = horizontal ? 0 : 1,
-                i = 0, j = 0, l, m;
-
-            while (true) {
-                if (i >= points.length)
-                    break;
-
-                l = newpoints.length;
-
-                if (points[i] == null) {
-                    // copy gaps
-                    for (m = 0; m < ps; ++m)
-                        newpoints.push(points[i + m]);
-                    i += ps;
-                }
-                else if (j >= otherpoints.length) {
-                    // for lines, we can't use the rest of the points
-                    if (!withlines) {
-                        for (m = 0; m < ps; ++m)
-                            newpoints.push(points[i + m]);
-                    }
-                    i += ps;
-                }
-                else if (otherpoints[j] == null) {
-                    // oops, got a gap
-                    for (m = 0; m < ps; ++m)
-                        newpoints.push(null);
-                    fromgap = true;
-                    j += otherps;
-                }
-                else {
-                    // cases where we actually got two points
-                    px = points[i + keyOffset];
-                    py = points[i + accumulateOffset];
-                    qx = otherpoints[j + keyOffset];
-                    qy = otherpoints[j + accumulateOffset];
-                    bottom = 0;
-
-                    if (px == qx) {
-                        for (m = 0; m < ps; ++m)
-                            newpoints.push(points[i + m]);
-
-                        newpoints[l + accumulateOffset] += qy;
-                        bottom = qy;
-                        
-                        i += ps;
-                        j += otherps;
-                    }
-                    else if (px > qx) {
-                        // we got past point below, might need to
-                        // insert interpolated extra point
-                        if (withlines && i > 0 && points[i - ps] != null) {
-                            intery = py + (points[i - ps + accumulateOffset] - py) * (qx - px) / (points[i - ps + keyOffset] - px);
-                            newpoints.push(qx);
-                            newpoints.push(intery + qy);
-                            for (m = 2; m < ps; ++m)
-                                newpoints.push(points[i + m]);
-                            bottom = qy; 
-                        }
-
-                        j += otherps;
-                    }
-                    else { // px < qx
-                        if (fromgap && withlines) {
-                            // if we come from a gap, we just skip this point
-                            i += ps;
-                            continue;
-                        }
-                            
-                        for (m = 0; m < ps; ++m)
-                            newpoints.push(points[i + m]);
-                        
-                        // we might be able to interpolate a point below,
-                        // this can give us a better y
-                        if (withlines && j > 0 && otherpoints[j - otherps] != null)
-                            bottom = qy + (otherpoints[j - otherps + accumulateOffset] - qy) * (px - qx) / (otherpoints[j - otherps + keyOffset] - qx);
-
-                        newpoints[l + accumulateOffset] += bottom;
-                        
-                        i += ps;
-                    }
-
-                    fromgap = false;
-                    
-                    if (l != newpoints.length && withbottom)
-                        newpoints[l + 2] += bottom;
-                }
-
-                // maintain the line steps invariant
-                if (withsteps && l != newpoints.length && l > 0
-                    && newpoints[l] != null
-                    && newpoints[l] != newpoints[l - ps]
-                    && newpoints[l + 1] != newpoints[l - ps + 1]) {
-                    for (m = 0; m < ps; ++m)
-                        newpoints[l + ps + m] = newpoints[l + m];
-                    newpoints[l + 1] = newpoints[l - ps + 1];
-                }
-            }
-
-            datapoints.points = newpoints;
-        }
-        
-        plot.hooks.processDatapoints.push(stackData);
-    }
-    
-    $.plot.plugins.push({
-        init: init,
-        options: options,
-        name: 'stack',
-        version: '1.2'
-    });
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.symbol.js b/src/legacy/ui/public/flot-charts/jquery.flot.symbol.js
deleted file mode 100644
index 79f634971b6fa6..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.symbol.js
+++ /dev/null
@@ -1,71 +0,0 @@
-/* Flot plugin that adds some extra symbols for plotting points.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-The symbols are accessed as strings through the standard symbol options:
-
-	series: {
-		points: {
-			symbol: "square" // or "diamond", "triangle", "cross"
-		}
-	}
-
-*/
-
-(function ($) {
-    function processRawData(plot, series, datapoints) {
-        // we normalize the area of each symbol so it is approximately the
-        // same as a circle of the given radius
-
-        var handlers = {
-            square: function (ctx, x, y, radius, shadow) {
-                // pi * r^2 = (2s)^2  =>  s = r * sqrt(pi)/2
-                var size = radius * Math.sqrt(Math.PI) / 2;
-                ctx.rect(x - size, y - size, size + size, size + size);
-            },
-            diamond: function (ctx, x, y, radius, shadow) {
-                // pi * r^2 = 2s^2  =>  s = r * sqrt(pi/2)
-                var size = radius * Math.sqrt(Math.PI / 2);
-                ctx.moveTo(x - size, y);
-                ctx.lineTo(x, y - size);
-                ctx.lineTo(x + size, y);
-                ctx.lineTo(x, y + size);
-                ctx.lineTo(x - size, y);
-            },
-            triangle: function (ctx, x, y, radius, shadow) {
-                // pi * r^2 = 1/2 * s^2 * sin (pi / 3)  =>  s = r * sqrt(2 * pi / sin(pi / 3))
-                var size = radius * Math.sqrt(2 * Math.PI / Math.sin(Math.PI / 3));
-                var height = size * Math.sin(Math.PI / 3);
-                ctx.moveTo(x - size/2, y + height/2);
-                ctx.lineTo(x + size/2, y + height/2);
-                if (!shadow) {
-                    ctx.lineTo(x, y - height/2);
-                    ctx.lineTo(x - size/2, y + height/2);
-                }
-            },
-            cross: function (ctx, x, y, radius, shadow) {
-                // pi * r^2 = (2s)^2  =>  s = r * sqrt(pi)/2
-                var size = radius * Math.sqrt(Math.PI) / 2;
-                ctx.moveTo(x - size, y - size);
-                ctx.lineTo(x + size, y + size);
-                ctx.moveTo(x - size, y + size);
-                ctx.lineTo(x + size, y - size);
-            }
-        };
-
-        var s = series.points.symbol;
-        if (handlers[s])
-            series.points.symbol = handlers[s];
-    }
-    
-    function init(plot) {
-        plot.hooks.processDatapoints.push(processRawData);
-    }
-    
-    $.plot.plugins.push({
-        init: init,
-        name: 'symbols',
-        version: '1.0'
-    });
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.threshold.js b/src/legacy/ui/public/flot-charts/jquery.flot.threshold.js
deleted file mode 100644
index 8c99c401d87e5a..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.threshold.js
+++ /dev/null
@@ -1,142 +0,0 @@
-/* Flot plugin for thresholding data.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-The plugin supports these options:
-
-	series: {
-		threshold: {
-			below: number
-			color: colorspec
-		}
-	}
-
-It can also be applied to a single series, like this:
-
-	$.plot( $("#placeholder"), [{
-		data: [ ... ],
-		threshold: { ... }
-	}])
-
-An array can be passed for multiple thresholding, like this:
-
-	threshold: [{
-		below: number1
-		color: color1
-	},{
-		below: number2
-		color: color2
-	}]
-
-These multiple threshold objects can be passed in any order since they are
-sorted by the processing function.
-
-The data points below "below" are drawn with the specified color. This makes
-it easy to mark points below 0, e.g. for budget data.
-
-Internally, the plugin works by splitting the data into two series, above and
-below the threshold. The extra series below the threshold will have its label
-cleared and the special "originSeries" attribute set to the original series.
-You may need to check for this in hover events.
-
-*/
-
-(function ($) {
-    var options = {
-        series: { threshold: null } // or { below: number, color: color spec}
-    };
-    
-    function init(plot) {
-        function thresholdData(plot, s, datapoints, below, color) {
-            var ps = datapoints.pointsize, i, x, y, p, prevp,
-                thresholded = $.extend({}, s); // note: shallow copy
-
-            thresholded.datapoints = { points: [], pointsize: ps, format: datapoints.format };
-            thresholded.label = null;
-            thresholded.color = color;
-            thresholded.threshold = null;
-            thresholded.originSeries = s;
-            thresholded.data = [];
- 
-            var origpoints = datapoints.points,
-                addCrossingPoints = s.lines.show;
-
-            var threspoints = [];
-            var newpoints = [];
-            var m;
-
-            for (i = 0; i < origpoints.length; i += ps) {
-                x = origpoints[i];
-                y = origpoints[i + 1];
-
-                prevp = p;
-                if (y < below)
-                    p = threspoints;
-                else
-                    p = newpoints;
-
-                if (addCrossingPoints && prevp != p && x != null
-                    && i > 0 && origpoints[i - ps] != null) {
-                    var interx = x + (below - y) * (x - origpoints[i - ps]) / (y - origpoints[i - ps + 1]);
-                    prevp.push(interx);
-                    prevp.push(below);
-                    for (m = 2; m < ps; ++m)
-                        prevp.push(origpoints[i + m]);
-                    
-                    p.push(null); // start new segment
-                    p.push(null);
-                    for (m = 2; m < ps; ++m)
-                        p.push(origpoints[i + m]);
-                    p.push(interx);
-                    p.push(below);
-                    for (m = 2; m < ps; ++m)
-                        p.push(origpoints[i + m]);
-                }
-
-                p.push(x);
-                p.push(y);
-                for (m = 2; m < ps; ++m)
-                    p.push(origpoints[i + m]);
-            }
-
-            datapoints.points = newpoints;
-            thresholded.datapoints.points = threspoints;
-            
-            if (thresholded.datapoints.points.length > 0) {
-                var origIndex = $.inArray(s, plot.getData());
-                // Insert newly-generated series right after original one (to prevent it from becoming top-most)
-                plot.getData().splice(origIndex + 1, 0, thresholded);
-            }
-                
-            // FIXME: there are probably some edge cases left in bars
-        }
-        
-        function processThresholds(plot, s, datapoints) {
-            if (!s.threshold)
-                return;
-            
-            if (s.threshold instanceof Array) {
-                s.threshold.sort(function(a, b) {
-                    return a.below - b.below;
-                });
-                
-                $(s.threshold).each(function(i, th) {
-                    thresholdData(plot, s, datapoints, th.below, th.color);
-                });
-            }
-            else {
-                thresholdData(plot, s, datapoints, s.threshold.below, s.threshold.color);
-            }
-        }
-        
-        plot.hooks.processDatapoints.push(processThresholds);
-    }
-    
-    $.plot.plugins.push({
-        init: init,
-        options: options,
-        name: 'threshold',
-        version: '1.2'
-    });
-})(jQuery);
diff --git a/src/legacy/ui/public/flot-charts/jquery.flot.time.js b/src/legacy/ui/public/flot-charts/jquery.flot.time.js
deleted file mode 100644
index 7612a033027646..00000000000000
--- a/src/legacy/ui/public/flot-charts/jquery.flot.time.js
+++ /dev/null
@@ -1,473 +0,0 @@
-/* Pretty handling of time axes.
-
-Copyright (c) 2007-2014 IOLA and Ole Laursen.
-Licensed under the MIT license.
-
-Set axis.mode to "time" to enable. See the section "Time series data" in
-API.txt for details.
-
-*/
-
-import { i18n } from '@kbn/i18n';
-
-(function($) {
-
-	var options = {
-		xaxis: {
-			timezone: null,		// "browser" for local to the client or timezone for timezone-js
-			timeformat: null,	// format string to use
-			twelveHourClock: false,	// 12 or 24 time in time mode
-			monthNames: null	// list of names of months
-		}
-	};
-
-	// round to nearby lower multiple of base
-
-	function floorInBase(n, base) {
-		return base * Math.floor(n / base);
-	}
-
-	// Returns a string with the date d formatted according to fmt.
-	// A subset of the Open Group's strftime format is supported.
-
-	function formatDate(d, fmt, monthNames, dayNames) {
-
-		if (typeof d.strftime == "function") {
-			return d.strftime(fmt);
-		}
-
-		var leftPad = function(n, pad) {
-			n = "" + n;
-			pad = "" + (pad == null ? "0" : pad);
-			return n.length == 1 ? pad + n : n;
-		};
-
-		var r = [];
-		var escape = false;
-		var hours = d.getHours();
-		var isAM = hours < 12;
-
-		if (monthNames == null) {
-			monthNames = [
-        i18n.translate('common.ui.flotCharts.janLabel', {
-					defaultMessage: 'Jan',
-				}), i18n.translate('common.ui.flotCharts.febLabel', {
-					defaultMessage: 'Feb',
-				}), i18n.translate('common.ui.flotCharts.marLabel', {
-					defaultMessage: 'Mar',
-				}), i18n.translate('common.ui.flotCharts.aprLabel', {
-					defaultMessage: 'Apr',
-				}), i18n.translate('common.ui.flotCharts.mayLabel', {
-					defaultMessage: 'May',
-				}), i18n.translate('common.ui.flotCharts.junLabel', {
-					defaultMessage: 'Jun',
-				}), i18n.translate('common.ui.flotCharts.julLabel', {
-					defaultMessage: 'Jul',
-				}), i18n.translate('common.ui.flotCharts.augLabel', {
-					defaultMessage: 'Aug',
-				}), i18n.translate('common.ui.flotCharts.sepLabel', {
-					defaultMessage: 'Sep',
-				}), i18n.translate('common.ui.flotCharts.octLabel', {
-					defaultMessage: 'Oct',
-				}), i18n.translate('common.ui.flotCharts.novLabel', {
-					defaultMessage: 'Nov',
-				}), i18n.translate('common.ui.flotCharts.decLabel', {
-					defaultMessage: 'Dec',
-				})];
-		}
-
-		if (dayNames == null) {
-			dayNames = [i18n.translate('common.ui.flotCharts.sunLabel', {
-        defaultMessage: 'Sun',
-      }), i18n.translate('common.ui.flotCharts.monLabel', {
-        defaultMessage: 'Mon',
-      }), i18n.translate('common.ui.flotCharts.tueLabel', {
-        defaultMessage: 'Tue',
-      }), i18n.translate('common.ui.flotCharts.wedLabel', {
-        defaultMessage: 'Wed',
-      }), i18n.translate('common.ui.flotCharts.thuLabel', {
-        defaultMessage: 'Thu',
-      }), i18n.translate('common.ui.flotCharts.friLabel', {
-        defaultMessage: 'Fri',
-      }), i18n.translate('common.ui.flotCharts.satLabel', {
-        defaultMessage: 'Sat',
-      })];
-		}
-
-		var hours12;
-
-		if (hours > 12) {
-			hours12 = hours - 12;
-		} else if (hours == 0) {
-			hours12 = 12;
-		} else {
-			hours12 = hours;
-		}
-
-		for (var i = 0; i < fmt.length; ++i) {
-
-			var c = fmt.charAt(i);
-
-			if (escape) {
-				switch (c) {
-					case 'a': c = "" + dayNames[d.getDay()]; break;
-					case 'b': c = "" + monthNames[d.getMonth()]; break;
-					case 'd': c = leftPad(d.getDate()); break;
-					case 'e': c = leftPad(d.getDate(), " "); break;
-					case 'h':	// For back-compat with 0.7; remove in 1.0
-					case 'H': c = leftPad(hours); break;
-					case 'I': c = leftPad(hours12); break;
-					case 'l': c = leftPad(hours12, " "); break;
-					case 'm': c = leftPad(d.getMonth() + 1); break;
-					case 'M': c = leftPad(d.getMinutes()); break;
-					// quarters not in Open Group's strftime specification
-					case 'q':
-						c = "" + (Math.floor(d.getMonth() / 3) + 1); break;
-					case 'S': c = leftPad(d.getSeconds()); break;
-					case 'y': c = leftPad(d.getFullYear() % 100); break;
-					case 'Y': c = "" + d.getFullYear(); break;
-					case 'p': c = (isAM) ? ("" + "am") : ("" + "pm"); break;
-					case 'P': c = (isAM) ? ("" + "AM") : ("" + "PM"); break;
-					case 'w': c = "" + d.getDay(); break;
-				}
-				r.push(c);
-				escape = false;
-			} else {
-				if (c == "%") {
-					escape = true;
-				} else {
-					r.push(c);
-				}
-			}
-		}
-
-		return r.join("");
-	}
-
-	// To have a consistent view of time-based data independent of which time
-	// zone the client happens to be in we need a date-like object independent
-	// of time zones.  This is done through a wrapper that only calls the UTC
-	// versions of the accessor methods.
-
-	function makeUtcWrapper(d) {
-
-		function addProxyMethod(sourceObj, sourceMethod, targetObj, targetMethod) {
-			sourceObj[sourceMethod] = function() {
-				return targetObj[targetMethod].apply(targetObj, arguments);
-			};
-		};
-
-		var utc = {
-			date: d
-		};
-
-		// support strftime, if found
-
-		if (d.strftime != undefined) {
-			addProxyMethod(utc, "strftime", d, "strftime");
-		}
-
-		addProxyMethod(utc, "getTime", d, "getTime");
-		addProxyMethod(utc, "setTime", d, "setTime");
-
-		var props = ["Date", "Day", "FullYear", "Hours", "Milliseconds", "Minutes", "Month", "Seconds"];
-
-		for (var p = 0; p < props.length; p++) {
-			addProxyMethod(utc, "get" + props[p], d, "getUTC" + props[p]);
-			addProxyMethod(utc, "set" + props[p], d, "setUTC" + props[p]);
-		}
-
-		return utc;
-	};
-
-	// select time zone strategy.  This returns a date-like object tied to the
-	// desired timezone
-
-	function dateGenerator(ts, opts) {
-		if (opts.timezone == "browser") {
-			return new Date(ts);
-		} else if (!opts.timezone || opts.timezone == "utc") {
-			return makeUtcWrapper(new Date(ts));
-		} else if (typeof timezoneJS != "undefined" && typeof timezoneJS.Date != "undefined") {
-			var d = new timezoneJS.Date();
-			// timezone-js is fickle, so be sure to set the time zone before
-			// setting the time.
-			d.setTimezone(opts.timezone);
-			d.setTime(ts);
-			return d;
-		} else {
-			return makeUtcWrapper(new Date(ts));
-		}
-	}
-
-	// map of app. size of time units in milliseconds
-
-	var timeUnitSize = {
-		"second": 1000,
-		"minute": 60 * 1000,
-		"hour": 60 * 60 * 1000,
-		"day": 24 * 60 * 60 * 1000,
-		"month": 30 * 24 * 60 * 60 * 1000,
-		"quarter": 3 * 30 * 24 * 60 * 60 * 1000,
-		"year": 365.2425 * 24 * 60 * 60 * 1000
-	};
-
-	// the allowed tick sizes, after 1 year we use
-	// an integer algorithm
-
-	var baseSpec = [
-		[1, "second"], [2, "second"], [5, "second"], [10, "second"],
-		[30, "second"],
-		[1, "minute"], [2, "minute"], [5, "minute"], [10, "minute"],
-		[30, "minute"],
-		[1, "hour"], [2, "hour"], [4, "hour"],
-		[8, "hour"], [12, "hour"],
-		[1, "day"], [2, "day"], [3, "day"],
-		[0.25, "month"], [0.5, "month"], [1, "month"],
-		[2, "month"]
-	];
-
-	// we don't know which variant(s) we'll need yet, but generating both is
-	// cheap
-
-	var specMonths = baseSpec.concat([[3, "month"], [6, "month"],
-		[1, "year"]]);
-	var specQuarters = baseSpec.concat([[1, "quarter"], [2, "quarter"],
-		[1, "year"]]);
-
-	function init(plot) {
-		plot.hooks.processOptions.push(function (plot, options) {
-			$.each(plot.getAxes(), function(axisName, axis) {
-
-				var opts = axis.options;
-
-				if (opts.mode == "time") {
-					axis.tickGenerator = function(axis) {
-
-						var ticks = [];
-						var d = dateGenerator(axis.min, opts);
-						var minSize = 0;
-
-						// make quarter use a possibility if quarters are
-						// mentioned in either of these options
-
-						var spec = (opts.tickSize && opts.tickSize[1] ===
-							"quarter") ||
-							(opts.minTickSize && opts.minTickSize[1] ===
-							"quarter") ? specQuarters : specMonths;
-
-						if (opts.minTickSize != null) {
-							if (typeof opts.tickSize == "number") {
-								minSize = opts.tickSize;
-							} else {
-								minSize = opts.minTickSize[0] * timeUnitSize[opts.minTickSize[1]];
-							}
-						}
-
-						for (var i = 0; i < spec.length - 1; ++i) {
-							if (axis.delta < (spec[i][0] * timeUnitSize[spec[i][1]]
-											  + spec[i + 1][0] * timeUnitSize[spec[i + 1][1]]) / 2
-								&& spec[i][0] * timeUnitSize[spec[i][1]] >= minSize) {
-								break;
-							}
-						}
-
-						var size = spec[i][0];
-						var unit = spec[i][1];
-
-						// special-case the possibility of several years
-
-						if (unit == "year") {
-
-							// if given a minTickSize in years, just use it,
-							// ensuring that it's an integer
-
-							if (opts.minTickSize != null && opts.minTickSize[1] == "year") {
-								size = Math.floor(opts.minTickSize[0]);
-							} else {
-
-								var magn = Math.pow(10, Math.floor(Math.log(axis.delta / timeUnitSize.year) / Math.LN10));
-								var norm = (axis.delta / timeUnitSize.year) / magn;
-
-								if (norm < 1.5) {
-									size = 1;
-								} else if (norm < 3) {
-									size = 2;
-								} else if (norm < 7.5) {
-									size = 5;
-								} else {
-									size = 10;
-								}
-
-								size *= magn;
-							}
-
-							// minimum size for years is 1
-
-							if (size < 1) {
-								size = 1;
-							}
-						}
-
-						axis.tickSize = opts.tickSize || [size, unit];
-						var tickSize = axis.tickSize[0];
-						unit = axis.tickSize[1];
-
-						var step = tickSize * timeUnitSize[unit];
-
-						if (unit == "second") {
-							d.setSeconds(floorInBase(d.getSeconds(), tickSize));
-						} else if (unit == "minute") {
-							d.setMinutes(floorInBase(d.getMinutes(), tickSize));
-						} else if (unit == "hour") {
-							d.setHours(floorInBase(d.getHours(), tickSize));
-						} else if (unit == "month") {
-							d.setMonth(floorInBase(d.getMonth(), tickSize));
-						} else if (unit == "quarter") {
-							d.setMonth(3 * floorInBase(d.getMonth() / 3,
-								tickSize));
-						} else if (unit == "year") {
-							d.setFullYear(floorInBase(d.getFullYear(), tickSize));
-						}
-
-						// reset smaller components
-
-						d.setMilliseconds(0);
-
-						if (step >= timeUnitSize.minute) {
-							d.setSeconds(0);
-						}
-						if (step >= timeUnitSize.hour) {
-							d.setMinutes(0);
-						}
-						if (step >= timeUnitSize.day) {
-							d.setHours(0);
-						}
-						if (step >= timeUnitSize.day * 4) {
-							d.setDate(1);
-						}
-						if (step >= timeUnitSize.month * 2) {
-							d.setMonth(floorInBase(d.getMonth(), 3));
-						}
-						if (step >= timeUnitSize.quarter * 2) {
-							d.setMonth(floorInBase(d.getMonth(), 6));
-						}
-						if (step >= timeUnitSize.year) {
-							d.setMonth(0);
-						}
-
-						var carry = 0;
-						var v = Number.NaN;
-						var prev;
-
-						do {
-
-							prev = v;
-							v = d.getTime();
-							ticks.push(v);
-
-							if (unit == "month" || unit == "quarter") {
-								if (tickSize < 1) {
-
-									// a bit complicated - we'll divide the
-									// month/quarter up but we need to take
-									// care of fractions so we don't end up in
-									// the middle of a day
-
-									d.setDate(1);
-									var start = d.getTime();
-									d.setMonth(d.getMonth() +
-										(unit == "quarter" ? 3 : 1));
-									var end = d.getTime();
-									d.setTime(v + carry * timeUnitSize.hour + (end - start) * tickSize);
-									carry = d.getHours();
-									d.setHours(0);
-								} else {
-									d.setMonth(d.getMonth() +
-										tickSize * (unit == "quarter" ? 3 : 1));
-								}
-							} else if (unit == "year") {
-								d.setFullYear(d.getFullYear() + tickSize);
-							} else {
-								d.setTime(v + step);
-							}
-						} while (v < axis.max && v != prev);
-
-						return ticks;
-					};
-
-					axis.tickFormatter = function (v, axis) {
-
-						var d = dateGenerator(v, axis.options);
-
-						// first check global format
-
-						if (opts.timeformat != null) {
-							return formatDate(d, opts.timeformat, opts.monthNames, opts.dayNames);
-						}
-
-						// possibly use quarters if quarters are mentioned in
-						// any of these places
-
-						var useQuarters = (axis.options.tickSize &&
-								axis.options.tickSize[1] == "quarter") ||
-							(axis.options.minTickSize &&
-								axis.options.minTickSize[1] == "quarter");
-
-						var t = axis.tickSize[0] * timeUnitSize[axis.tickSize[1]];
-						var span = axis.max - axis.min;
-						var suffix = (opts.twelveHourClock) ? " %p" : "";
-						var hourCode = (opts.twelveHourClock) ? "%I" : "%H";
-						var fmt;
-
-						if (t < timeUnitSize.minute) {
-							fmt = hourCode + ":%M:%S" + suffix;
-						} else if (t < timeUnitSize.day) {
-							if (span < 2 * timeUnitSize.day) {
-								fmt = hourCode + ":%M" + suffix;
-							} else {
-								fmt = "%b %d " + hourCode + ":%M" + suffix;
-							}
-						} else if (t < timeUnitSize.month) {
-							fmt = "%b %d";
-						} else if ((useQuarters && t < timeUnitSize.quarter) ||
-							(!useQuarters && t < timeUnitSize.year)) {
-							if (span < timeUnitSize.year) {
-								fmt = "%b";
-							} else {
-								fmt = "%b %Y";
-							}
-						} else if (useQuarters && t < timeUnitSize.year) {
-							if (span < timeUnitSize.year) {
-								fmt = "Q%q";
-							} else {
-								fmt = "Q%q %Y";
-							}
-						} else {
-							fmt = "%Y";
-						}
-
-						var rt = formatDate(d, fmt, opts.monthNames, opts.dayNames);
-
-						return rt;
-					};
-				}
-			});
-		});
-	}
-
-	$.plot.plugins.push({
-		init: init,
-		options: options,
-		name: 'time',
-		version: '1.0'
-	});
-
-	// Time-axis support used to be in Flot core, which exposed the
-	// formatDate function on the plot object.  Various plugins depend
-	// on the function, so we need to re-expose it here.
-
-	$.plot.formatDate = formatDate;
-	$.plot.dateGenerator = dateGenerator;
-
-})(jQuery);
diff --git a/src/legacy/ui/public/i18n/__snapshots__/index.test.tsx.snap b/src/legacy/ui/public/i18n/__snapshots__/index.test.tsx.snap
deleted file mode 100644
index fd6a0a07ba39ce..00000000000000
--- a/src/legacy/ui/public/i18n/__snapshots__/index.test.tsx.snap
+++ /dev/null
@@ -1,10 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`ui/i18n renders children and forwards properties 1`] = `
-<div>
-  Context: 
-  <span>
-    Child: some prop:100500
-  </span>
-</div>
-`;
diff --git a/src/legacy/ui/public/i18n/index.test.tsx b/src/legacy/ui/public/i18n/index.test.tsx
deleted file mode 100644
index be8ab4cf8d6962..00000000000000
--- a/src/legacy/ui/public/i18n/index.test.tsx
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { render } from 'enzyme';
-import PropTypes from 'prop-types';
-import React from 'react';
-
-jest.mock('angular-sanitize', () => {});
-jest.mock('ui/new_platform', () => ({
-  npStart: {
-    core: {
-      i18n: { Context: ({ children }: any) => <div>Context: {children}</div> },
-    },
-  },
-}));
-
-import { wrapInI18nContext } from '.';
-
-describe('ui/i18n', () => {
-  test('renders children and forwards properties', () => {
-    const mockPropTypes = {
-      stringProp: PropTypes.string.isRequired,
-      numberProp: PropTypes.number,
-    };
-
-    const WrappedComponent = wrapInI18nContext(
-      class extends React.PureComponent<{ [P in keyof typeof mockPropTypes]: unknown }> {
-        public static propTypes = mockPropTypes;
-
-        public render() {
-          return (
-            <span>
-              Child: {this.props.stringProp}:{this.props.numberProp}
-            </span>
-          );
-        }
-      }
-    );
-
-    expect(WrappedComponent.propTypes).toBe(mockPropTypes);
-    expect(
-      render(<WrappedComponent stringProp={'some prop'} numberProp={100500} />)
-    ).toMatchSnapshot();
-  });
-});
diff --git a/src/legacy/ui/public/i18n/index.tsx b/src/legacy/ui/public/i18n/index.tsx
deleted file mode 100644
index 290e82a1334b96..00000000000000
--- a/src/legacy/ui/public/i18n/index.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React from 'react';
-// required for `ngSanitize` angular module
-import 'angular-sanitize';
-
-import { i18nDirective, i18nFilter, I18nProvider } from '@kbn/i18n/angular';
-// @ts-ignore
-import { uiModules } from 'ui/modules';
-import { npStart } from 'ui/new_platform';
-
-export const I18nContext = npStart.core.i18n.Context;
-
-export function wrapInI18nContext<P>(ComponentToWrap: React.ComponentType<P>) {
-  const ContextWrapper: React.FC<P> = (props) => {
-    return (
-      <I18nContext>
-        <ComponentToWrap {...props} />
-      </I18nContext>
-    );
-  };
-
-  // Original propTypes from the wrapped component should be re-exposed
-  // since it will be used by reactDirective Angular service
-  // that will rely on propTypes to watch attributes with these names
-  ContextWrapper.propTypes = ComponentToWrap.propTypes;
-
-  return ContextWrapper;
-}
-
-uiModules
-  .get('i18n', ['ngSanitize'])
-  .provider('i18n', I18nProvider)
-  .filter('i18n', i18nFilter)
-  .directive('i18nId', i18nDirective);
diff --git a/src/legacy/ui/public/indexed_array/__tests__/indexed_array.js b/src/legacy/ui/public/indexed_array/__tests__/indexed_array.js
deleted file mode 100644
index df96a58a6e99fa..00000000000000
--- a/src/legacy/ui/public/indexed_array/__tests__/indexed_array.js
+++ /dev/null
@@ -1,208 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import expect from '@kbn/expect';
-import { IndexedArray } from '..';
-
-// this is generally a data-structure that IndexedArray is good for managing
-const users = [
-  { name: 'John', id: 6, username: 'beast', group: 'admins' },
-  { name: 'Anon', id: 0, username: 'shhhh', group: 'secret' },
-  { name: 'Fern', id: 42, username: 'kitty', group: 'editor' },
-  { name: 'Mary', id: 55, username: 'sheep', group: 'editor' },
-];
-
-// this is how we used to accomplish this, before IndexedArray
-users.byName = _.keyBy(users, 'name');
-users.byUsername = _.keyBy(users, 'username');
-users.byGroup = _.groupBy(users, 'group');
-users.inIdOrder = _.sortBy(users, 'id');
-
-// then things started becoming unruly... so IndexedArray!
-
-describe('IndexedArray', function () {
-  describe('Basics', function () {
-    let reg;
-
-    beforeEach(function () {
-      reg = new IndexedArray();
-    });
-
-    it('Extends Array', function () {
-      expect(reg).to.be.a(Array);
-    });
-
-    it('fails basic lodash check', function () {
-      expect(Array.isArray(reg)).to.be(false);
-    });
-
-    it('clones to an object', function () {
-      expect(_.isObject(_.clone(reg))).to.be(true);
-      expect(Array.isArray(_.clone(reg))).to.be(false);
-    });
-  });
-
-  describe('Indexing', function () {
-    it('provides the initial set', function () {
-      const reg = new IndexedArray({
-        initialSet: [1, 2, 3],
-      });
-
-      expect(reg).to.have.length(3);
-
-      reg.forEach(function (v, i) {
-        expect(v).to.eql(i + 1);
-      });
-    });
-
-    it('indexes the initial set', function () {
-      const reg = new IndexedArray({
-        index: ['username'],
-        initialSet: users,
-      });
-
-      expect(reg).to.have.property('byUsername');
-      expect(reg.byUsername).to.eql(users.byUsername);
-    });
-
-    it('updates indices after values are added', function () {
-      // split up the user list, and add it in chunks
-      const firstUser = users.slice(0, 1).pop();
-      const otherUsers = users.slice(1);
-
-      // start off with all but the first
-      const reg = new IndexedArray({
-        group: ['group'],
-        order: ['id'],
-        initialSet: otherUsers,
-      });
-
-      // add the first
-      reg.push(firstUser);
-
-      // end up with the same structure that is in the users fixture
-      expect(Object.keys(reg.byGroup).length).to.be(Object.keys(users.byGroup).length);
-      for (const group of Object.keys(reg.byGroup)) {
-        expect(reg.byGroup[group].toJSON()).to.eql(users.byGroup[group]);
-      }
-
-      expect(reg.inIdOrder).to.eql(users.inIdOrder);
-    });
-
-    it('updates indices after values are removed', function () {
-      // start off with all
-      const reg = new IndexedArray({
-        group: ['group'],
-        order: ['id'],
-        initialSet: users,
-      });
-
-      // remove the last
-      reg.pop();
-
-      const expectedCount = users.length - 1;
-      // indexed lists should be updated
-      expect(reg).to.have.length(expectedCount);
-
-      const sumOfGroups = _.reduce(
-        reg.byGroup,
-        function (note, group) {
-          return note + group.length;
-        },
-        0
-      );
-      expect(sumOfGroups).to.eql(expectedCount);
-    });
-
-    it('removes items based on a predicate', function () {
-      const reg = new IndexedArray({
-        group: ['group'],
-        order: ['id'],
-        initialSet: users,
-      });
-
-      reg.remove({ name: 'John' });
-
-      expect(_.isEqual(reg.raw, reg.slice(0))).to.be(true);
-      expect(reg.length).to.be(3);
-      expect(reg[0].name).to.be('Anon');
-    });
-
-    it('updates indices after values are re-ordered', function () {
-      const rawUsers = users.slice(0);
-
-      // collect and shuffle the ids available
-      let ids = [];
-      _.times(rawUsers.length, function (i) {
-        ids.push(i);
-      });
-      ids = _.shuffle(ids);
-
-      // move something here
-      const toI = ids.shift();
-      // from here
-      const fromI = ids.shift();
-      // do the move
-      const move = function (arr) {
-        arr.splice(toI, 0, arr.splice(fromI, 1)[0]);
-      };
-
-      const reg = new IndexedArray({
-        index: ['username'],
-        initialSet: rawUsers,
-      });
-
-      const index = reg.byUsername;
-
-      move(reg);
-
-      expect(reg.byUsername).to.eql(index);
-      expect(reg.byUsername).to.not.be(index);
-    });
-  });
-
-  describe('Ordering', function () {
-    it('ordering is case insensitive', function () {
-      const reg = new IndexedArray({
-        index: ['title'],
-        order: ['title'],
-        initialSet: [{ title: 'APM' }, { title: 'Advanced Settings' }],
-      });
-
-      const ordered = reg.inTitleOrder;
-      expect(ordered[0].title).to.be('Advanced Settings');
-      expect(ordered[1].title).to.be('APM');
-    });
-
-    it('ordering handles numbers', function () {
-      const reg = new IndexedArray({
-        index: ['id'],
-        order: ['id'],
-        initialSet: users,
-      });
-
-      const ordered = reg.inIdOrder;
-      expect(ordered[0].id).to.be(0);
-      expect(ordered[1].id).to.be(6);
-      expect(ordered[2].id).to.be(42);
-      expect(ordered[3].id).to.be(55);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/indexed_array/__tests__/inflector.js b/src/legacy/ui/public/indexed_array/__tests__/inflector.js
deleted file mode 100644
index 49ac79094e5018..00000000000000
--- a/src/legacy/ui/public/indexed_array/__tests__/inflector.js
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { inflector } from '../inflector';
-import expect from '@kbn/expect';
-
-describe('IndexedArray Inflector', function () {
-  it('returns a function', function () {
-    const getter = inflector();
-    expect(getter).to.be.a('function');
-  });
-
-  describe('fn', function () {
-    it('prepends a prefix', function () {
-      const inflect = inflector('my');
-
-      expect(inflect('Family')).to.be('myFamily');
-      expect(inflect('family')).to.be('myFamily');
-      expect(inflect('fAmIlY')).to.be('myFAmIlY');
-    });
-
-    it('adds both a prefix and suffix', function () {
-      const inflect = inflector('foo', 'Bar');
-
-      expect(inflect('box')).to.be('fooBoxBar');
-      expect(inflect('box.car.MAX')).to.be('fooBoxCarMaxBar');
-      expect(inflect('BaZzY')).to.be('fooBaZzYBar');
-    });
-
-    it('ignores prefix if it is already at the end of the inflected string', function () {
-      const inflect = inflector('foo', 'Bar');
-      expect(inflect('fooBox')).to.be('fooBoxBar');
-      expect(inflect('FooBox')).to.be('FooBoxBar');
-    });
-
-    it('ignores postfix if it is already at the end of the inflected string', function () {
-      const inflect = inflector('foo', 'Bar');
-      expect(inflect('bar')).to.be('fooBar');
-      expect(inflect('showBoxBar')).to.be('fooShowBoxBar');
-    });
-
-    it('works with "name"', function () {
-      const inflect = inflector('in', 'Order');
-      expect(inflect('name')).to.be('inNameOrder');
-    });
-  });
-});
diff --git a/src/legacy/ui/public/indexed_array/helpers/organize_by.test.ts b/src/legacy/ui/public/indexed_array/helpers/organize_by.test.ts
deleted file mode 100644
index fc4ca8469382ad..00000000000000
--- a/src/legacy/ui/public/indexed_array/helpers/organize_by.test.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { groupBy } from 'lodash';
-import { organizeBy } from './organize_by';
-
-describe('organizeBy', () => {
-  test('it works', () => {
-    const col = [
-      {
-        name: 'one',
-        roles: ['user', 'admin', 'owner'],
-      },
-      {
-        name: 'two',
-        roles: ['user'],
-      },
-      {
-        name: 'three',
-        roles: ['user'],
-      },
-      {
-        name: 'four',
-        roles: ['user', 'admin'],
-      },
-    ];
-
-    const resp = organizeBy(col, 'roles');
-    expect(resp).toHaveProperty('user');
-    expect(resp.user.length).toBe(4);
-
-    expect(resp).toHaveProperty('admin');
-    expect(resp.admin.length).toBe(2);
-
-    expect(resp).toHaveProperty('owner');
-    expect(resp.owner.length).toBe(1);
-  });
-
-  test('behaves just like groupBy in normal scenarios', () => {
-    const col = [{ name: 'one' }, { name: 'two' }, { name: 'three' }, { name: 'four' }];
-
-    const orgs = organizeBy(col, 'name');
-    const groups = groupBy(col, 'name');
-
-    expect(orgs).toEqual(groups);
-  });
-});
diff --git a/src/legacy/ui/public/indexed_array/helpers/organize_by.ts b/src/legacy/ui/public/indexed_array/helpers/organize_by.ts
deleted file mode 100644
index e923767c892cd5..00000000000000
--- a/src/legacy/ui/public/indexed_array/helpers/organize_by.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { each, isFunction } from 'lodash';
-
-/**
- * Like _.groupBy, but allows specifying multiple groups for a
- * single object.
- *
- * organizeBy([{ a: [1, 2, 3] }, { b: true, a: [1, 4] }], 'a')
- * // Object {1: Array[2], 2: Array[1], 3: Array[1], 4: Array[1]}
- *
- * _.groupBy([{ a: [1, 2, 3] }, { b: true, a: [1, 4] }], 'a')
- * // Object {'1,2,3': Array[1], '1,4': Array[1]}
- *
- * @param  {array} collection - the list of values to organize
- * @param  {Function} callback - either a property name, or a callback.
- * @return {object}
- */
-export function organizeBy(collection: object[], callback: ((obj: object) => string) | string) {
-  const buckets: { [key: string]: object[] } = {};
-
-  function add(key: string, obj: object) {
-    if (!buckets[key]) {
-      buckets[key] = [];
-    }
-    buckets[key].push(obj);
-  }
-
-  each(collection, (obj: Record<string, any>) => {
-    const keys = isFunction(callback) ? callback(obj) : obj[callback];
-
-    if (!Array.isArray(keys)) {
-      add(keys, obj);
-      return;
-    }
-
-    let length = keys.length;
-    while (length-- > 0) {
-      add(keys[length], obj);
-    }
-  });
-
-  return buckets;
-}
diff --git a/src/legacy/ui/public/indexed_array/index.d.ts b/src/legacy/ui/public/indexed_array/index.d.ts
deleted file mode 100644
index 21c0a818731ac5..00000000000000
--- a/src/legacy/ui/public/indexed_array/index.d.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { ListIterator } from 'lodash';
-
-interface IndexedArrayConfig<T> {
-  index?: string[];
-  group?: string[];
-  order?: string[];
-  initialSet?: T[];
-  immutable?: boolean;
-}
-
-declare class IndexedArray<T> extends Array<T> {
-  public immutable: boolean;
-  public raw: T[];
-
-  // These may not actually be present, as they are dynamically defined
-  public inOrder: T[];
-  public byType: Record<string, T[]>;
-  public byName: Record<string, T>;
-
-  constructor(config: IndexedArrayConfig<T>);
-
-  public remove(predicate: ListIterator<T, boolean>): T[];
-
-  public toJSON(): T[];
-}
diff --git a/src/legacy/ui/public/indexed_array/index.js b/src/legacy/ui/public/indexed_array/index.js
deleted file mode 100644
index 6a42961c9e680b..00000000000000
--- a/src/legacy/ui/public/indexed_array/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { IndexedArray } from './indexed_array';
diff --git a/src/legacy/ui/public/indexed_array/indexed_array.js b/src/legacy/ui/public/indexed_array/indexed_array.js
deleted file mode 100644
index b9a427b8da7adc..00000000000000
--- a/src/legacy/ui/public/indexed_array/indexed_array.js
+++ /dev/null
@@ -1,235 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import { inflector } from './inflector';
-import { organizeBy } from './helpers/organize_by';
-
-const pathGetter = _(_.get).rearg(1, 0).ary(2);
-const inflectIndex = inflector('by');
-const inflectOrder = inflector('in', 'Order');
-
-const CLEAR_CACHE = {};
-const OPT_NAMES = ['index', 'group', 'order', 'initialSet', 'immutable'];
-
-/**
- *  Generic extension of Array class, which will index (and reindex) the
- *  objects it contains based on their properties.
- *
- *  @param {Object} config describes the properties of this registry object
- *  @param {Array<string>} [config.index] a list of props/paths that should be used to index the docs.
- *  @param {Array<string>} [config.group] a list of keys/paths to group docs by.
- *  @param {Array<string>} [config.order] a list of keys/paths to order the keys by.
- *  @param {Array<any>} [config.initialSet] the initial dataset the IndexedArray should contain.
- *  @param {boolean} [config.immutable] a flag that hints to people reading the implementation that this IndexedArray
- *                                      should not be modified
- */
-
-export class IndexedArray {
-  static OPT_NAMES = OPT_NAMES;
-
-  constructor(config) {
-    config = _.pick(config || {}, OPT_NAMES);
-
-    // use defineProperty so that value can't be changed
-    Object.defineProperty(this, 'raw', { value: [] });
-
-    this._indexNames = _.union(
-      this._setupIndex(config.group, inflectIndex, organizeByIndexedArray(config)),
-      this._setupIndex(config.index, inflectIndex, _.keyBy),
-      this._setupIndex(config.order, inflectOrder, (raw, pluckValue) => {
-        return [...raw].sort((itemA, itemB) => {
-          const a = pluckValue(itemA);
-          const b = pluckValue(itemB);
-          if (typeof a === 'number' && typeof b === 'number') {
-            return a - b;
-          }
-          return String(a).toLowerCase().localeCompare(String(b).toLowerCase());
-        });
-      })
-    );
-
-    if (config.initialSet) {
-      this.push.apply(this, config.initialSet);
-    }
-
-    Object.defineProperty(this, 'immutable', { value: !!config.immutable });
-  }
-
-  /**
-   * Remove items from this based on a predicate
-   * @param {Function|Object|string} predicate - the predicate used to decide what is removed
-   * @return {array} - the removed data
-   */
-  remove(predicate) {
-    this._assertMutable('remove');
-    const out = _.remove(this, predicate);
-    _.remove(this.raw, predicate);
-    this._clearIndices();
-    return out;
-  }
-
-  /**
-   * provide a hook for the JSON serializer
-   * @return {array} - a plain, vanilla array with our same data
-   */
-  toJSON() {
-    return this.raw;
-  }
-
-  // wrappers for mutable Array methods
-  copyWithin(...args) {
-    return this._mutation('copyWithin', args);
-  }
-  fill(...args) {
-    return this._mutation('fill', args);
-  }
-  pop(...args) {
-    return this._mutation('pop', args);
-  }
-  push(...args) {
-    return this._mutation('push', args);
-  }
-  reverse(...args) {
-    return this._mutation('reverse', args);
-  }
-  shift(...args) {
-    return this._mutation('shift', args);
-  }
-  sort(...args) {
-    return this._mutation('sort', args);
-  }
-  splice(...args) {
-    return this._mutation('splice', args);
-  }
-  unshift(...args) {
-    return this._mutation('unshift', args);
-  }
-
-  /**
-   *  If this instance of IndexedArray is not mutable, throw an error
-   *  @private
-   *  @param  {String} methodName - user facing method name, for error message
-   *  @return {undefined}
-   */
-  _assertMutable(methodName) {
-    if (this.immutable) {
-      throw new Error(`${methodName}() is not allowed on immutable IndexedArray instances`);
-    }
-  }
-
-  /**
-   *  Execute some mutable method from the Array prototype
-   *  on the IndexedArray and this.raw
-   *
-   *  @private
-   *  @param  {string} methodName
-   *  @param  {Array<any>} args
-   *  @return {any}
-   */
-  _mutation(methodName, args) {
-    this._assertMutable(methodName);
-    super[methodName].apply(this, args);
-    this._clearIndices();
-    return super[methodName].apply(this.raw, args);
-  }
-
-  /**
-   * Create indices for a group of object properties. getters and setters are used to
-   * read and control the indices.
-   * @private
-   * @param  {string[]} props   - the properties that should be used to index docs
-   * @param  {function} inflect - a function that will be called with a property name, and
-   *                            creates the public property at which the index will be exposed
-   * @param  {function} op      - the function that will be used to create the indices, it is passed
-   *                            the raw representation of the registry, and a getter for reading the
-   *                            right prop
-   *
-   * @returns {string[]}        - the public keys of all indices created
-   */
-  _setupIndex(props, inflect, op) {
-    // shortcut for empty props
-    if (!props || props.length === 0) return;
-
-    return props.map((prop) => {
-      const indexName = inflect(prop);
-      const getIndexValueFromItem = pathGetter.partial(prop).value();
-      let cache;
-
-      Object.defineProperty(this, indexName, {
-        enumerable: false,
-        configurable: false,
-
-        set: (val) => {
-          // can't set any value other than the CLEAR_CACHE constant
-          if (val === CLEAR_CACHE) {
-            cache = false;
-          } else {
-            throw new TypeError(indexName + ' can not be set, it is a computed index of values');
-          }
-        },
-        get: () => {
-          if (!cache) {
-            cache = op(this.raw, getIndexValueFromItem);
-          }
-
-          return cache;
-        },
-      });
-
-      return indexName;
-    });
-  }
-
-  /**
-   * Clear cached index/group/order caches so they will be recreated
-   * on next access
-   * @private
-   * @return {undefined}
-   */
-  _clearIndices() {
-    this._indexNames.forEach((name) => {
-      this[name] = CLEAR_CACHE;
-    });
-  }
-}
-
-// using traditional `extends Array` syntax doesn't work with babel
-// See https://babeljs.io/docs/usage/caveats/
-Object.setPrototypeOf(IndexedArray.prototype, Array.prototype);
-
-// Similar to `organizeBy` but returns IndexedArrays instead of normal Arrays.
-function organizeByIndexedArray(config) {
-  return (...args) => {
-    const grouped = organizeBy(...args);
-
-    return _.reduce(
-      grouped,
-      (acc, value, group) => {
-        acc[group] = new IndexedArray({
-          ...config,
-          initialSet: value,
-        });
-
-        return acc;
-      },
-      {}
-    );
-  };
-}
diff --git a/src/legacy/ui/public/indexed_array/inflector.js b/src/legacy/ui/public/indexed_array/inflector.js
deleted file mode 100644
index e034146f5f62f3..00000000000000
--- a/src/legacy/ui/public/indexed_array/inflector.js
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-function upFirst(str, total) {
-  return str.charAt(0).toUpperCase() + (total ? str.substr(1).toLowerCase() : str.substr(1));
-}
-
-function startsWith(str, test) {
-  return str.substr(0, test.length).toLowerCase() === test.toLowerCase();
-}
-
-function endsWith(str, test) {
-  const tooShort = str.length < test.length;
-  if (tooShort) return;
-
-  return str.substr(str.length - test.length).toLowerCase() === test.toLowerCase();
-}
-
-export function inflector(prefix, postfix) {
-  return function inflect(key) {
-    let inflected;
-
-    if (key.indexOf('.') !== -1) {
-      inflected = key
-        .split('.')
-        .map(function (step, i) {
-          return i === 0 ? step : upFirst(step, true);
-        })
-        .join('');
-    } else {
-      inflected = key;
-    }
-
-    if (prefix && !startsWith(key, prefix)) {
-      inflected = prefix + upFirst(inflected);
-    }
-
-    if (postfix && !endsWith(key, postfix)) {
-      inflected = inflected + postfix;
-    }
-
-    return inflected;
-  };
-}
diff --git a/src/legacy/ui/public/kfetch/__mocks__/index.ts b/src/legacy/ui/public/kfetch/__mocks__/index.ts
deleted file mode 100644
index 1a128e2b85260f..00000000000000
--- a/src/legacy/ui/public/kfetch/__mocks__/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export const kfetch = () => Promise.resolve();
diff --git a/src/legacy/ui/public/kfetch/_import_objects.ndjson b/src/legacy/ui/public/kfetch/_import_objects.ndjson
deleted file mode 100644
index 3511fb44cdfb24..00000000000000
--- a/src/legacy/ui/public/kfetch/_import_objects.ndjson
+++ /dev/null
@@ -1 +0,0 @@
-{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Log Agents","uiStateJSON":"{}","visState":"{\"title\":\"Log Agents\",\"type\":\"area\",\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{\"text\":\"agent.raw: Descending\"}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"area\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"agent.raw\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}]}"},"id":"082f1d60-a2e7-11e7-bb30-233be9be6a15","migrationVersion":{"visualization":"7.0.0"},"references":[{"id":"f1e4c910-a2e6-11e7-bb30-233be9be6a15","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","version":1}
diff --git a/src/legacy/ui/public/kfetch/index.ts b/src/legacy/ui/public/kfetch/index.ts
deleted file mode 100644
index 105df171ad3702..00000000000000
--- a/src/legacy/ui/public/kfetch/index.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { npSetup } from 'ui/new_platform';
-import { createKfetch, KFetchKibanaOptions, KFetchOptions } from './kfetch';
-export { addInterceptor, KFetchOptions, KFetchQuery } from './kfetch';
-
-const kfetchInstance = createKfetch(npSetup.core.http);
-
-export const kfetch = (options: KFetchOptions, kfetchOptions?: KFetchKibanaOptions) => {
-  return kfetchInstance(options, kfetchOptions);
-};
diff --git a/src/legacy/ui/public/kfetch/kfetch.test.mocks.ts b/src/legacy/ui/public/kfetch/kfetch.test.mocks.ts
deleted file mode 100644
index ea066b3623f134..00000000000000
--- a/src/legacy/ui/public/kfetch/kfetch.test.mocks.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { setup } from '../../../../test_utils/public/http_test_setup';
-
-jest.doMock('ui/new_platform', () => ({
-  npSetup: {
-    core: setup(),
-  },
-}));
diff --git a/src/legacy/ui/public/kfetch/kfetch.test.ts b/src/legacy/ui/public/kfetch/kfetch.test.ts
deleted file mode 100644
index c45a142d54e9b5..00000000000000
--- a/src/legacy/ui/public/kfetch/kfetch.test.ts
+++ /dev/null
@@ -1,487 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-// @ts-ignore
-import fetchMock from 'fetch-mock/es5/client';
-import './kfetch.test.mocks';
-import { readFileSync } from 'fs';
-import { join } from 'path';
-import { addInterceptor, kfetch, KFetchOptions } from '.';
-import { Interceptor, resetInterceptors, withDefaultOptions } from './kfetch';
-import { KFetchError } from './kfetch_error';
-
-describe('kfetch', () => {
-  afterEach(() => {
-    fetchMock.restore();
-    resetInterceptors();
-  });
-
-  it('should use supplied request method', async () => {
-    fetchMock.post('*', {});
-    await kfetch({ pathname: '/my/path', method: 'POST' });
-    expect(fetchMock.lastOptions()!.method).toBe('POST');
-  });
-
-  it('should use supplied Content-Type', async () => {
-    fetchMock.get('*', {});
-    await kfetch({ pathname: '/my/path', headers: { 'Content-Type': 'CustomContentType' } });
-    expect(fetchMock.lastOptions()!.headers).toMatchObject({
-      'content-type': 'CustomContentType',
-    });
-  });
-
-  it('should use supplied pathname and querystring', async () => {
-    fetchMock.get('*', {});
-    await kfetch({ pathname: '/my/path', query: { a: 'b' } });
-    expect(fetchMock.lastUrl()).toBe('http://localhost/myBase/my/path?a=b');
-  });
-
-  it('should use supplied headers', async () => {
-    fetchMock.get('*', {});
-    await kfetch({
-      pathname: '/my/path',
-      headers: { myHeader: 'foo' },
-    });
-
-    expect(fetchMock.lastOptions()!.headers).toEqual({
-      'content-type': 'application/json',
-      'kbn-version': 'kibanaVersion',
-      myheader: 'foo',
-    });
-  });
-
-  it('should return response', async () => {
-    fetchMock.get('*', { foo: 'bar' });
-    const res = await kfetch({ pathname: '/my/path' });
-    expect(res).toEqual({ foo: 'bar' });
-  });
-
-  it('should prepend url with basepath by default', async () => {
-    fetchMock.get('*', {});
-    await kfetch({ pathname: '/my/path' });
-    expect(fetchMock.lastUrl()).toBe('http://localhost/myBase/my/path');
-  });
-
-  it('should not prepend url with basepath when disabled', async () => {
-    fetchMock.get('*', {});
-    await kfetch({ pathname: '/my/path' }, { prependBasePath: false });
-    expect(fetchMock.lastUrl()).toBe('/my/path');
-  });
-
-  it('should make request with defaults', async () => {
-    fetchMock.get('*', {});
-    await kfetch({ pathname: '/my/path' });
-
-    expect(fetchMock.lastCall()!.request.credentials).toBe('same-origin');
-    expect(fetchMock.lastOptions()!).toMatchObject({
-      method: 'GET',
-      headers: {
-        'content-type': 'application/json',
-        'kbn-version': 'kibanaVersion',
-      },
-    });
-  });
-
-  it('should make requests for NDJSON content', async () => {
-    const content = readFileSync(join(__dirname, '_import_objects.ndjson'), { encoding: 'utf-8' });
-
-    fetchMock.post('*', {
-      body: content,
-      headers: { 'Content-Type': 'application/ndjson' },
-    });
-
-    const data = await kfetch({
-      method: 'POST',
-      pathname: '/my/path',
-      body: content,
-      headers: {
-        'Content-Type': 'multipart/form-data',
-      },
-    });
-
-    expect(data).toBeInstanceOf(Blob);
-
-    const ndjson = await new Response(data).text();
-
-    expect(ndjson).toEqual(content);
-  });
-
-  it('should reject on network error', async () => {
-    expect.assertions(1);
-    fetchMock.get('*', { status: 500 });
-
-    try {
-      await kfetch({ pathname: '/my/path' });
-    } catch (e) {
-      expect(e.message).toBe('Internal Server Error');
-    }
-  });
-
-  describe('when throwing response error (KFetchError)', () => {
-    let error: KFetchError;
-    beforeEach(async () => {
-      fetchMock.get('*', { status: 404, body: { foo: 'bar' } });
-      try {
-        await kfetch({ pathname: '/my/path' });
-      } catch (e) {
-        error = e;
-      }
-    });
-
-    it('should contain error message', () => {
-      expect(error.message).toBe('Not Found');
-    });
-
-    it('should return response body', () => {
-      expect(error.body).toEqual({ foo: 'bar' });
-    });
-
-    it('should contain response properties', () => {
-      expect(error.res.status).toBe(404);
-      expect(error.res.url).toBe('http://localhost/myBase/my/path');
-    });
-  });
-
-  describe('when all interceptor resolves', () => {
-    let resp: any;
-    let interceptorCalls: string[];
-
-    beforeEach(async () => {
-      fetchMock.get('*', { foo: 'bar' });
-
-      interceptorCalls = mockInterceptorCalls([{}, {}, {}]);
-      resp = await kfetch({ pathname: '/my/path' });
-    });
-
-    it('should call interceptors in correct order', () => {
-      expect(interceptorCalls).toEqual([
-        'Request #3',
-        'Request #2',
-        'Request #1',
-        'Response #1',
-        'Response #2',
-        'Response #3',
-      ]);
-    });
-
-    it('should make request', () => {
-      expect(fetchMock.called()).toBe(true);
-    });
-
-    it('should return response', () => {
-      expect(resp).toEqual({ foo: 'bar' });
-    });
-  });
-
-  describe('when a request interceptor throws; and the next requestError interceptor resolves', () => {
-    let resp: any;
-    let interceptorCalls: string[];
-
-    beforeEach(async () => {
-      fetchMock.get('*', { foo: 'bar' });
-
-      interceptorCalls = mockInterceptorCalls([
-        { requestError: () => ({ pathname: '/my/path' } as KFetchOptions) },
-        { request: () => Promise.reject(new Error('Error in request')) },
-        {},
-      ]);
-
-      resp = await kfetch({ pathname: '/my/path' });
-    });
-
-    it('should call interceptors in correct order', () => {
-      expect(interceptorCalls).toEqual([
-        'Request #3',
-        'Request #2',
-        'RequestError #1',
-        'Response #1',
-        'Response #2',
-        'Response #3',
-      ]);
-    });
-
-    it('should make request', () => {
-      expect(fetchMock.called()).toBe(true);
-    });
-
-    it('should return response', () => {
-      expect(resp).toEqual({ foo: 'bar' });
-    });
-  });
-
-  describe('when a request interceptor throws', () => {
-    let error: Error;
-    let interceptorCalls: string[];
-
-    beforeEach(async () => {
-      fetchMock.get('*', { foo: 'bar' });
-
-      interceptorCalls = mockInterceptorCalls([
-        {},
-        { request: () => Promise.reject(new Error('Error in request')) },
-        {},
-      ]);
-
-      try {
-        await kfetch({ pathname: '/my/path' });
-      } catch (e) {
-        error = e;
-      }
-    });
-
-    it('should call interceptors in correct order', () => {
-      expect(interceptorCalls).toEqual([
-        'Request #3',
-        'Request #2',
-        'RequestError #1',
-        'ResponseError #1',
-        'ResponseError #2',
-        'ResponseError #3',
-      ]);
-    });
-
-    it('should not make request', () => {
-      expect(fetchMock.called()).toBe(false);
-    });
-
-    it('should throw error', () => {
-      expect(error.message).toEqual('Error in request');
-    });
-  });
-
-  describe('when a response interceptor throws', () => {
-    let error: Error;
-    let interceptorCalls: string[];
-
-    beforeEach(async () => {
-      fetchMock.get('*', { foo: 'bar' });
-
-      interceptorCalls = mockInterceptorCalls([
-        { response: () => Promise.reject(new Error('Error in response')) },
-        {},
-        {},
-      ]);
-
-      try {
-        await kfetch({ pathname: '/my/path' });
-      } catch (e) {
-        error = e;
-      }
-    });
-
-    it('should call in correct order', () => {
-      expect(interceptorCalls).toEqual([
-        'Request #3',
-        'Request #2',
-        'Request #1',
-        'Response #1',
-        'ResponseError #2',
-        'ResponseError #3',
-      ]);
-    });
-
-    it('should make request', () => {
-      expect(fetchMock.called()).toBe(true);
-    });
-
-    it('should throw error', () => {
-      expect(error.message).toEqual('Error in response');
-    });
-  });
-
-  describe('when request interceptor throws; and a responseError interceptor resolves', () => {
-    let resp: any;
-    let interceptorCalls: string[];
-
-    beforeEach(async () => {
-      fetchMock.get('*', { foo: 'bar' });
-
-      interceptorCalls = mockInterceptorCalls([
-        {},
-        {
-          request: () => {
-            throw new Error('My request error');
-          },
-          responseError: () => {
-            return { custom: 'response' };
-          },
-        },
-        {},
-      ]);
-
-      resp = await kfetch({ pathname: '/my/path' });
-    });
-
-    it('should call in correct order', () => {
-      expect(interceptorCalls).toEqual([
-        'Request #3',
-        'Request #2',
-        'RequestError #1',
-        'ResponseError #1',
-        'ResponseError #2',
-        'Response #3',
-      ]);
-    });
-
-    it('should not make request', () => {
-      expect(fetchMock.called()).toBe(false);
-    });
-
-    it('should resolve', () => {
-      expect(resp).toEqual({ custom: 'response' });
-    });
-  });
-
-  describe('when interceptors return synchronously', () => {
-    let resp: any;
-    beforeEach(async () => {
-      fetchMock.get('*', { foo: 'bar' });
-      addInterceptor({
-        request: (config) => ({
-          ...config,
-          pathname: '/my/intercepted-route',
-        }),
-        response: (res) => ({
-          ...res,
-          addedByResponseInterceptor: true,
-        }),
-      });
-
-      resp = await kfetch({ pathname: '/my/path' });
-    });
-
-    it('should modify request', () => {
-      expect(fetchMock.lastUrl()).toContain('/my/intercepted-route');
-      expect(fetchMock.lastOptions()!).toMatchObject({
-        method: 'GET',
-      });
-    });
-
-    it('should modify response', () => {
-      expect(resp).toEqual({
-        addedByResponseInterceptor: true,
-        foo: 'bar',
-      });
-    });
-  });
-
-  describe('when interceptors return promise', () => {
-    let resp: any;
-    beforeEach(async () => {
-      fetchMock.get('*', { foo: 'bar' });
-      addInterceptor({
-        request: (config) =>
-          Promise.resolve({
-            ...config,
-            pathname: '/my/intercepted-route',
-          }),
-        response: (res) =>
-          Promise.resolve({
-            ...res,
-            addedByResponseInterceptor: true,
-          }),
-      });
-
-      resp = await kfetch({ pathname: '/my/path' });
-    });
-
-    it('should modify request', () => {
-      expect(fetchMock.lastUrl()).toContain('/my/intercepted-route');
-      expect(fetchMock.lastOptions()!).toMatchObject({
-        method: 'GET',
-      });
-    });
-
-    it('should modify response', () => {
-      expect(resp).toEqual({
-        addedByResponseInterceptor: true,
-        foo: 'bar',
-      });
-    });
-  });
-});
-
-function mockInterceptorCalls(interceptors: Interceptor[]) {
-  const interceptorCalls: string[] = [];
-  interceptors.forEach((interceptor, i) => {
-    addInterceptor({
-      request: (config) => {
-        interceptorCalls.push(`Request #${i + 1}`);
-
-        if (interceptor.request) {
-          return interceptor.request(config);
-        }
-
-        return config;
-      },
-      requestError: (e) => {
-        interceptorCalls.push(`RequestError #${i + 1}`);
-        if (interceptor.requestError) {
-          return interceptor.requestError(e);
-        }
-
-        throw e;
-      },
-      response: (res) => {
-        interceptorCalls.push(`Response #${i + 1}`);
-
-        if (interceptor.response) {
-          return interceptor.response(res);
-        }
-
-        return res;
-      },
-      responseError: (e) => {
-        interceptorCalls.push(`ResponseError #${i + 1}`);
-
-        if (interceptor.responseError) {
-          return interceptor.responseError(e);
-        }
-
-        throw e;
-      },
-    });
-  });
-
-  return interceptorCalls;
-}
-
-describe('withDefaultOptions', () => {
-  it('should remove undefined query params', () => {
-    const { query } = withDefaultOptions({
-      pathname: '/withDefaultOptions',
-      query: {
-        foo: 'bar',
-        param1: (undefined as any) as string,
-        param2: (null as any) as string,
-        param3: '',
-      },
-    });
-    expect(query).toEqual({ foo: 'bar', param2: null, param3: '' });
-  });
-
-  it('should add default options', () => {
-    expect(withDefaultOptions({ pathname: '/addDefaultOptions' })).toEqual({
-      pathname: '/addDefaultOptions',
-      credentials: 'same-origin',
-      headers: { 'Content-Type': 'application/json' },
-      method: 'GET',
-    });
-  });
-});
diff --git a/src/legacy/ui/public/kfetch/kfetch.ts b/src/legacy/ui/public/kfetch/kfetch.ts
deleted file mode 100644
index 4eb71499315757..00000000000000
--- a/src/legacy/ui/public/kfetch/kfetch.ts
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { merge } from 'lodash';
-// @ts-ignore not really worth typing
-import { KFetchError } from './kfetch_error';
-
-import { HttpSetup } from '../../../../core/public';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { HttpRequestInit } from '../../../../core/public/http/types';
-
-export interface KFetchQuery {
-  [key: string]: string | number | boolean | undefined;
-}
-
-export interface KFetchOptions extends HttpRequestInit {
-  pathname: string;
-  query?: KFetchQuery;
-  asSystemRequest?: boolean;
-}
-
-export interface KFetchKibanaOptions {
-  prependBasePath?: boolean;
-}
-
-export interface Interceptor {
-  request?: (config: KFetchOptions) => Promise<KFetchOptions> | KFetchOptions;
-  requestError?: (e: any) => Promise<KFetchOptions> | KFetchOptions;
-  response?: (res: any) => any;
-  responseError?: (e: any) => any;
-}
-
-const interceptors: Interceptor[] = [];
-export const resetInterceptors = () => (interceptors.length = 0);
-export const addInterceptor = (interceptor: Interceptor) => interceptors.push(interceptor);
-
-export function createKfetch(http: HttpSetup) {
-  return function kfetch(
-    options: KFetchOptions,
-    { prependBasePath = true }: KFetchKibanaOptions = {}
-  ) {
-    return responseInterceptors(
-      requestInterceptors(withDefaultOptions(options))
-        .then(({ pathname, ...restOptions }) =>
-          http.fetch(pathname, { ...restOptions, prependBasePath })
-        )
-        .catch((err) => {
-          throw new KFetchError(err.response || { statusText: err.message }, err.body);
-        })
-    );
-  };
-}
-
-// Request/response interceptors are called in opposite orders.
-// Request hooks start from the newest interceptor and end with the oldest.
-function requestInterceptors(config: KFetchOptions): Promise<KFetchOptions> {
-  return interceptors.reduceRight((acc, interceptor) => {
-    return acc.then(interceptor.request, interceptor.requestError);
-  }, Promise.resolve(config));
-}
-
-// Response hooks start from the oldest interceptor and end with the newest.
-function responseInterceptors(responsePromise: Promise<any>) {
-  return interceptors.reduce((acc, interceptor) => {
-    return acc.then(interceptor.response, interceptor.responseError);
-  }, responsePromise);
-}
-
-export function withDefaultOptions(options?: KFetchOptions): KFetchOptions {
-  const withDefaults = merge(
-    {
-      method: 'GET',
-      credentials: 'same-origin',
-      headers: {
-        'Content-Type': 'application/json',
-      },
-    },
-    options
-  ) as KFetchOptions;
-
-  if (
-    options &&
-    options.headers &&
-    'Content-Type' in options.headers &&
-    options.headers['Content-Type'] === undefined
-  ) {
-    // TS thinks headers could be undefined here, but that isn't possible because
-    // of the merge above.
-    // @ts-ignore
-    withDefaults.headers['Content-Type'] = undefined;
-  }
-
-  return withDefaults;
-}
diff --git a/src/legacy/ui/public/kfetch/kfetch_error.ts b/src/legacy/ui/public/kfetch/kfetch_error.ts
deleted file mode 100644
index f351959e624b85..00000000000000
--- a/src/legacy/ui/public/kfetch/kfetch_error.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export class KFetchError extends Error {
-  constructor(public readonly res: Response, public readonly body?: any) {
-    super(res.statusText);
-
-    // captureStackTrace is only available in the V8 engine, so any browser using
-    // a different JS engine won't have access to this method.
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, KFetchError);
-    }
-  }
-}
diff --git a/src/legacy/ui/public/legacy_compat/__tests__/xsrf.js b/src/legacy/ui/public/legacy_compat/__tests__/xsrf.js
deleted file mode 100644
index efcfb779972655..00000000000000
--- a/src/legacy/ui/public/legacy_compat/__tests__/xsrf.js
+++ /dev/null
@@ -1,149 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import $ from 'jquery';
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-import ngMock from 'ng_mock';
-
-import { $setupXsrfRequestInterceptor } from '../../../../../plugins/kibana_legacy/public';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { version } from '../../../../../core/server/utils/package_json';
-
-const xsrfHeader = 'kbn-version';
-
-describe('chrome xsrf apis', function () {
-  const sandbox = sinon.createSandbox();
-
-  afterEach(function () {
-    sandbox.restore();
-  });
-
-  describe('jQuery support', function () {
-    it('adds a global jQuery prefilter', function () {
-      sandbox.stub($, 'ajaxPrefilter');
-      $setupXsrfRequestInterceptor(version);
-      expect($.ajaxPrefilter.callCount).to.be(1);
-    });
-
-    describe('jQuery prefilter', function () {
-      let prefilter;
-
-      beforeEach(function () {
-        sandbox.stub($, 'ajaxPrefilter');
-        $setupXsrfRequestInterceptor(version);
-        prefilter = $.ajaxPrefilter.args[0][0];
-      });
-
-      it(`sets the ${xsrfHeader} header`, function () {
-        const setHeader = sinon.stub();
-        prefilter({}, {}, { setRequestHeader: setHeader });
-
-        expect(setHeader.callCount).to.be(1);
-        expect(setHeader.args[0]).to.eql([xsrfHeader, version]);
-      });
-
-      it('can be canceled by setting the kbnXsrfToken option', function () {
-        const setHeader = sinon.stub();
-        prefilter({ kbnXsrfToken: false }, {}, { setRequestHeader: setHeader });
-        expect(setHeader.callCount).to.be(0);
-      });
-    });
-
-    describe('Angular support', function () {
-      let $http;
-      let $httpBackend;
-
-      beforeEach(function () {
-        sandbox.stub($, 'ajaxPrefilter');
-        ngMock.module($setupXsrfRequestInterceptor(version));
-      });
-
-      beforeEach(
-        ngMock.inject(function ($injector) {
-          $http = $injector.get('$http');
-          $httpBackend = $injector.get('$httpBackend');
-
-          $httpBackend.when('POST', '/api/test').respond('ok');
-        })
-      );
-
-      afterEach(function () {
-        $httpBackend.verifyNoOutstandingExpectation();
-        $httpBackend.verifyNoOutstandingRequest();
-      });
-
-      it(`injects a ${xsrfHeader} header on every request`, function () {
-        $httpBackend
-          .expectPOST('/api/test', undefined, function (headers) {
-            return headers[xsrfHeader] === version;
-          })
-          .respond(200, '');
-
-        $http.post('/api/test');
-        $httpBackend.flush();
-      });
-
-      it('skips requests with the kbnXsrfToken set falsy', function () {
-        $httpBackend
-          .expectPOST('/api/test', undefined, function (headers) {
-            return !(xsrfHeader in headers);
-          })
-          .respond(200, '');
-
-        $http({
-          method: 'POST',
-          url: '/api/test',
-          kbnXsrfToken: 0,
-        });
-
-        $http({
-          method: 'POST',
-          url: '/api/test',
-          kbnXsrfToken: '',
-        });
-
-        $http({
-          method: 'POST',
-          url: '/api/test',
-          kbnXsrfToken: false,
-        });
-
-        $httpBackend.flush();
-      });
-
-      it('treats the kbnXsrfToken option as boolean-y', function () {
-        const customToken = `custom:${version}`;
-        $httpBackend
-          .expectPOST('/api/test', undefined, function (headers) {
-            return headers[xsrfHeader] === version;
-          })
-          .respond(200, '');
-
-        $http({
-          method: 'POST',
-          url: '/api/test',
-          kbnXsrfToken: customToken,
-        });
-
-        $httpBackend.flush();
-      });
-    });
-  });
-});
diff --git a/src/legacy/ui/public/legacy_compat/index.ts b/src/legacy/ui/public/legacy_compat/index.ts
deleted file mode 100644
index 2067fa6489304f..00000000000000
--- a/src/legacy/ui/public/legacy_compat/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { configureAppAngularModule } from '../../../../plugins/kibana_legacy/public';
diff --git a/src/legacy/ui/public/metadata.ts b/src/legacy/ui/public/metadata.ts
deleted file mode 100644
index fade0f0d8629a0..00000000000000
--- a/src/legacy/ui/public/metadata.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { npSetup } from 'ui/new_platform';
-
-export const metadata: {
-  branch: string;
-  version: string;
-} = npSetup.core.injectedMetadata.getLegacyMetadata();
diff --git a/src/legacy/ui/public/modules.js b/src/legacy/ui/public/modules.js
deleted file mode 100644
index bb1c8aead1c34e..00000000000000
--- a/src/legacy/ui/public/modules.js
+++ /dev/null
@@ -1,142 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import angular from 'angular';
-import _ from 'lodash';
-/**
- * This module is used by Kibana to create and reuse angular modules. Angular modules
- * can only be created once and need to have their dependencies at creation. This is
- * hard/impossible to do in require.js since all of the dependencies for a module are
- * loaded before it is.
- *
- * Here is an example:
- *
- * 	In the scenario below, require.js would load directive.js first because it is a
- * 	dependency of app.js. This would cause the call to `angular.module('app')` to
- * 	execute before the module is actually created. This causes angular to throw an
- * 	error. This effect is magnified when app.js links off to many different modules.
- *
- * 	This is normally solved by creating unique modules per file, listed as the 1st
- * 	alternate solution below. Unfortunately this solution would have required that
- * 	we replicate our require statements.
- *
- *  	app.js
- *      ```
- *      angular.module('app', ['ui.bootstrap'])
- *      .controller('AppController', function () { ... });
- *
- *      require('./directive');
- *      ```
- *
- *    directive.js
- *      ```
- *      angular.module('app')
- *      .directive('someDirective', function () { ... });
- *      ```
- *
- * Before taking this approach we saw three possible solutions:
- *   1. replicate our js modules in angular modules/use a different module per file
- *   2. create a single module outside of our js modules and share it
- *   3. use a helper lib to dynamically create modules as needed.
- *
- * We decided to go with #3
- *
- * This ends up working by creating a list of modules that the code base creates by
- * calling `modules.get(name)` with different names, and then before bootstrapping
- * the application kibana uses `modules.link()` to set the dependencies of the "kibana"
- * module to include every defined module. This guarantees that kibana can always find
- * any angular dependency defined in the kibana code base. This **also** means that
- * Private modules are able to find any dependency, since they are injected using the
- * "kibana" module's injector.
- *
- */
-const existingModules = {};
-const links = [];
-
-/**
- * Take an angular module and extends the dependencies for that module to include all of the modules
- * created using `ui/modules`
- *
- * @param  {AngularModule} module - the module to extend
- * @return {undefined}
- */
-export function link(module) {
-  // as modules are defined they will be set as requirements for this app
-  links.push(module);
-
-  // merge in the existing modules
-  module.requires = _.union(module.requires, _.keys(existingModules));
-}
-
-/**
- * The primary means of interacting with `ui/modules`. Returns an angular module. If the module already
- * exists the existing version will be returned. `dependencies` are either set as or merged into the
- * modules total dependencies.
- *
- * This is in contrast to the `angular.module(name, [dependencies])` function which will only
- * create a module if the `dependencies` list is passed and get an existing module if no dependencies
- * are passed. This requires knowing the order that your files will load, which we can't guarantee.
- *
- * @param  {string} moduleName - the unique name for this module
- * @param  {array[string]} [requires=[]] - the other modules this module requires
- * @return {AngularModule}
- */
-export function get(moduleName, requires) {
-  let module = existingModules[moduleName];
-
-  if (module === void 0) {
-    // create the module
-    module = existingModules[moduleName] = angular.module(moduleName, []);
-
-    module.close = _.partial(close, moduleName);
-
-    // ensure that it is required by linked modules
-    _.each(links, function (app) {
-      if (!~app.requires.indexOf(moduleName)) app.requires.push(moduleName);
-    });
-  }
-
-  if (requires) {
-    // update requires list with possibly new requirements
-    module.requires = _.union(module.requires, requires);
-  }
-
-  return module;
-}
-
-export function close(moduleName) {
-  const module = existingModules[moduleName];
-
-  // already closed
-  if (!module) return;
-
-  // if the module is currently linked, unlink it
-  const i = links.indexOf(module);
-  if (i > -1) links.splice(i, 1);
-
-  // remove from linked modules list of required modules
-  _.each(links, function (app) {
-    _.pull(app.requires, moduleName);
-  });
-
-  // remove module from existingModules
-  delete existingModules[moduleName];
-}
-
-export const uiModules = { link, get, close };
diff --git a/src/legacy/ui/public/new_platform/__mocks__/helpers.ts b/src/legacy/ui/public/new_platform/__mocks__/helpers.ts
deleted file mode 100644
index 35aa8e48304289..00000000000000
--- a/src/legacy/ui/public/new_platform/__mocks__/helpers.ts
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { coreMock } from '../../../../../core/public/mocks';
-import { dataPluginMock } from '../../../../../plugins/data/public/mocks';
-import { embeddablePluginMock } from '../../../../../plugins/embeddable/public/mocks';
-import { navigationPluginMock } from '../../../../../plugins/navigation/public/mocks';
-import { expressionsPluginMock } from '../../../../../plugins/expressions/public/mocks';
-import { inspectorPluginMock } from '../../../../../plugins/inspector/public/mocks';
-import { uiActionsPluginMock } from '../../../../../plugins/ui_actions/public/mocks';
-import { managementPluginMock } from '../../../../../plugins/management/public/mocks';
-import { usageCollectionPluginMock } from '../../../../../plugins/usage_collection/public/mocks';
-import { kibanaLegacyPluginMock } from '../../../../../plugins/kibana_legacy/public/mocks';
-import { chartPluginMock } from '../../../../../plugins/charts/public/mocks';
-import { advancedSettingsMock } from '../../../../../plugins/advanced_settings/public/mocks';
-import { savedObjectsManagementPluginMock } from '../../../../../plugins/saved_objects_management/public/mocks';
-import { visualizationsPluginMock } from '../../../../../plugins/visualizations/public/mocks';
-import { discoverPluginMock } from '../../../../../plugins/discover/public/mocks';
-
-export const pluginsMock = {
-  createSetup: () => ({
-    data: dataPluginMock.createSetupContract(),
-    charts: chartPluginMock.createSetupContract(),
-    navigation: navigationPluginMock.createSetupContract(),
-    embeddable: embeddablePluginMock.createSetupContract(),
-    inspector: inspectorPluginMock.createSetupContract(),
-    expressions: expressionsPluginMock.createSetupContract(),
-    uiActions: uiActionsPluginMock.createSetupContract(),
-    usageCollection: usageCollectionPluginMock.createSetupContract(),
-    advancedSettings: advancedSettingsMock.createSetupContract(),
-    visualizations: visualizationsPluginMock.createSetupContract(),
-    kibanaLegacy: kibanaLegacyPluginMock.createSetupContract(),
-    savedObjectsManagement: savedObjectsManagementPluginMock.createSetupContract(),
-    discover: discoverPluginMock.createSetupContract(),
-  }),
-  createStart: () => ({
-    data: dataPluginMock.createStartContract(),
-    charts: chartPluginMock.createStartContract(),
-    navigation: navigationPluginMock.createStartContract(),
-    embeddable: embeddablePluginMock.createStartContract(),
-    inspector: inspectorPluginMock.createStartContract(),
-    expressions: expressionsPluginMock.createStartContract(),
-    uiActions: uiActionsPluginMock.createStartContract(),
-    management: managementPluginMock.createStartContract(),
-    advancedSettings: advancedSettingsMock.createStartContract(),
-    visualizations: visualizationsPluginMock.createStartContract(),
-    kibanaLegacy: kibanaLegacyPluginMock.createStartContract(),
-    savedObjectsManagement: savedObjectsManagementPluginMock.createStartContract(),
-    discover: discoverPluginMock.createStartContract(),
-  }),
-};
-
-export const createUiNewPlatformMock = () => {
-  const mock = {
-    npSetup: {
-      core: coreMock.createSetup(),
-      plugins: pluginsMock.createSetup(),
-    },
-    npStart: {
-      core: coreMock.createStart(),
-      plugins: pluginsMock.createStart(),
-    },
-  };
-  return mock;
-};
diff --git a/src/legacy/ui/public/new_platform/__mocks__/index.ts b/src/legacy/ui/public/new_platform/__mocks__/index.ts
deleted file mode 100644
index d469960ddd7b7a..00000000000000
--- a/src/legacy/ui/public/new_platform/__mocks__/index.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { createUiNewPlatformMock } from './helpers';
-
-const { npSetup, npStart } = createUiNewPlatformMock();
-export { npSetup, npStart };
diff --git a/src/legacy/ui/public/new_platform/index.ts b/src/legacy/ui/public/new_platform/index.ts
deleted file mode 100644
index ca5890854f3aa1..00000000000000
--- a/src/legacy/ui/public/new_platform/index.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-export { __setup__, __start__, npSetup, npStart } from './new_platform';
diff --git a/src/legacy/ui/public/new_platform/new_platform.karma_mock.js b/src/legacy/ui/public/new_platform/new_platform.karma_mock.js
deleted file mode 100644
index b8d48b784dba71..00000000000000
--- a/src/legacy/ui/public/new_platform/new_platform.karma_mock.js
+++ /dev/null
@@ -1,550 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-import { getFieldFormatsRegistry } from '../../../../test_utils/public/stub_field_formats';
-import { METRIC_TYPE } from '@kbn/analytics';
-import { setSetupServices, setStartServices } from './set_services';
-import {
-  AggTypesRegistry,
-  getAggTypes,
-  AggConfigs,
-  // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-} from '../../../../../src/plugins/data/common/search/aggs';
-import { ComponentRegistry } from '../../../../../src/plugins/advanced_settings/public/';
-import { UI_SETTINGS } from '../../../../../src/plugins/data/public/';
-import {
-  CSV_SEPARATOR_SETTING,
-  CSV_QUOTE_VALUES_SETTING,
-} from '../../../../../src/plugins/share/public';
-
-const mockObservable = () => {
-  return {
-    subscribe: () => {},
-    pipe: () => {
-      return {
-        subscribe: () => {},
-      };
-    },
-  };
-};
-
-const mockComponent = () => {
-  return null;
-};
-
-let refreshInterval = undefined;
-let isTimeRangeSelectorEnabled = true;
-let isAutoRefreshSelectorEnabled = true;
-
-export const mockUiSettings = {
-  get: (item, defaultValue) => {
-    const defaultValues = {
-      dateFormat: 'MMM D, YYYY @ HH:mm:ss.SSS',
-      'dateFormat:tz': 'UTC',
-      [UI_SETTINGS.SHORT_DOTS_ENABLE]: true,
-      [UI_SETTINGS.COURIER_IGNORE_FILTER_IF_FIELD_NOT_IN_INDEX]: true,
-      [UI_SETTINGS.QUERY_ALLOW_LEADING_WILDCARDS]: true,
-      [UI_SETTINGS.QUERY_STRING_OPTIONS]: {},
-      [UI_SETTINGS.FORMAT_CURRENCY_DEFAULT_PATTERN]: '($0,0.[00])',
-      [UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN]: '0,0.[000]',
-      [UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN]: '0,0.[000]%',
-      [UI_SETTINGS.FORMAT_NUMBER_DEFAULT_LOCALE]: 'en',
-      [UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP]: {},
-      [CSV_SEPARATOR_SETTING]: ',',
-      [CSV_QUOTE_VALUES_SETTING]: true,
-      [UI_SETTINGS.SEARCH_QUERY_LANGUAGE]: 'kuery',
-      'state:storeInSessionStorage': false,
-    };
-
-    return defaultValues[item] || defaultValue;
-  },
-  getUpdate$: () => ({
-    subscribe: sinon.fake(),
-  }),
-  isDefault: sinon.fake(),
-};
-
-const mockCoreSetup = {
-  chrome: {},
-  http: {
-    basePath: {
-      get: sinon.fake.returns(''),
-    },
-  },
-  injectedMetadata: {},
-  uiSettings: mockUiSettings,
-};
-
-const mockCoreStart = {
-  application: {
-    capabilities: {},
-  },
-  chrome: {
-    overlays: {
-      openModal: sinon.fake(),
-    },
-  },
-  http: {
-    basePath: {
-      get: sinon.fake.returns(''),
-    },
-  },
-  notifications: {
-    toasts: {},
-  },
-  i18n: {},
-  overlays: {},
-  savedObjects: {
-    client: {},
-  },
-  uiSettings: mockUiSettings,
-};
-
-const querySetup = {
-  state$: mockObservable(),
-  filterManager: {
-    getFetches$: sinon.fake(),
-    getFilters: sinon.fake(),
-    getAppFilters: sinon.fake(),
-    getGlobalFilters: sinon.fake(),
-    removeFilter: sinon.fake(),
-    addFilters: sinon.fake(),
-    setFilters: sinon.fake(),
-    removeAll: sinon.fake(),
-    getUpdates$: mockObservable,
-  },
-  timefilter: {
-    timefilter: {
-      getFetch$: mockObservable,
-      getAutoRefreshFetch$: mockObservable,
-      getEnabledUpdated$: mockObservable,
-      getTimeUpdate$: mockObservable,
-      getRefreshIntervalUpdate$: mockObservable,
-      isTimeRangeSelectorEnabled: () => {
-        return isTimeRangeSelectorEnabled;
-      },
-      isAutoRefreshSelectorEnabled: () => {
-        return isAutoRefreshSelectorEnabled;
-      },
-      disableAutoRefreshSelector: () => {
-        isAutoRefreshSelectorEnabled = false;
-      },
-      enableAutoRefreshSelector: () => {
-        isAutoRefreshSelectorEnabled = true;
-      },
-      getRefreshInterval: () => {
-        return refreshInterval;
-      },
-      setRefreshInterval: (interval) => {
-        refreshInterval = interval;
-      },
-      enableTimeRangeSelector: () => {
-        isTimeRangeSelectorEnabled = true;
-      },
-      disableTimeRangeSelector: () => {
-        isTimeRangeSelectorEnabled = false;
-      },
-      getTime: sinon.fake(),
-      setTime: sinon.fake(),
-      getActiveBounds: sinon.fake(),
-      getBounds: sinon.fake(),
-      calculateBounds: sinon.fake(),
-      createFilter: sinon.fake(),
-    },
-    history: sinon.fake(),
-  },
-  savedQueries: {
-    saveQuery: sinon.fake(),
-    getAllSavedQueries: sinon.fake(),
-    findSavedQueries: sinon.fake(),
-    getSavedQuery: sinon.fake(),
-    deleteSavedQuery: sinon.fake(),
-    getSavedQueryCount: sinon.fake(),
-  },
-};
-
-const mockAggTypesRegistry = () => {
-  const registry = new AggTypesRegistry();
-  const registrySetup = registry.setup();
-  const aggTypes = getAggTypes({
-    calculateBounds: sinon.fake(),
-    getConfig: sinon.fake(),
-    getFieldFormatsStart: () => ({
-      deserialize: sinon.fake(),
-      getDefaultInstance: sinon.fake(),
-    }),
-    isDefaultTimezone: () => true,
-  });
-  aggTypes.buckets.forEach((type) => registrySetup.registerBucket(type));
-  aggTypes.metrics.forEach((type) => registrySetup.registerMetric(type));
-
-  return registry;
-};
-
-const aggTypesRegistry = mockAggTypesRegistry();
-
-export const npSetup = {
-  core: mockCoreSetup,
-  plugins: {
-    advancedSettings: {
-      component: {
-        register: sinon.fake(),
-        componentType: ComponentRegistry.componentType,
-      },
-    },
-    usageCollection: {
-      allowTrackUserAgent: sinon.fake(),
-      reportUiStats: sinon.fake(),
-      METRIC_TYPE,
-    },
-    embeddable: {
-      registerEmbeddableFactory: sinon.fake(),
-    },
-    expressions: {
-      registerFunction: sinon.fake(),
-      registerRenderer: sinon.fake(),
-      registerType: sinon.fake(),
-    },
-    data: {
-      autocomplete: {
-        addProvider: sinon.fake(),
-        getProvider: sinon.fake(),
-      },
-      query: querySetup,
-      search: {
-        aggs: {
-          types: aggTypesRegistry.setup(),
-        },
-        __LEGACY: {
-          esClient: {
-            search: sinon.fake(),
-            msearch: sinon.fake(),
-          },
-        },
-      },
-      fieldFormats: getFieldFormatsRegistry(mockCoreSetup),
-    },
-    share: {
-      register: () => {},
-      urlGenerators: {
-        registerUrlGenerator: () => {},
-      },
-    },
-    devTools: {
-      register: () => {},
-    },
-    kibanaLegacy: {
-      registerLegacyApp: () => {},
-      forwardApp: () => {},
-      config: {
-        defaultAppId: 'home',
-      },
-    },
-    inspector: {
-      registerView: () => undefined,
-      __LEGACY: {
-        views: {
-          register: () => undefined,
-        },
-      },
-    },
-    uiActions: {
-      attachAction: sinon.fake(),
-      registerAction: sinon.fake(),
-      registerTrigger: sinon.fake(),
-    },
-    home: {
-      featureCatalogue: {
-        register: sinon.fake(),
-      },
-      environment: {
-        update: sinon.fake(),
-      },
-      config: {
-        disableWelcomeScreen: false,
-      },
-      tutorials: {
-        setVariable: sinon.fake(),
-      },
-    },
-    charts: {
-      theme: {
-        chartsTheme$: mockObservable,
-        useChartsTheme: sinon.fake(),
-      },
-      colors: {
-        seedColors: ['white', 'black'],
-      },
-    },
-    management: {
-      sections: {
-        getSection: () => ({
-          registerApp: sinon.fake(),
-        }),
-      },
-    },
-    indexPatternManagement: {
-      list: { addListConfig: sinon.fake() },
-      creation: { addCreationConfig: sinon.fake() },
-    },
-    discover: {
-      docViews: {
-        addDocView: sinon.fake(),
-        setAngularInjectorGetter: sinon.fake(),
-      },
-    },
-    visTypeVega: {
-      config: sinon.fake(),
-    },
-    visualizations: {
-      createBaseVisualization: sinon.fake(),
-      createReactVisualization: sinon.fake(),
-      registerAlias: sinon.fake(),
-      hideTypes: sinon.fake(),
-    },
-
-    mapsLegacy: {
-      serviceSettings: sinon.fake(),
-      getPrecision: sinon.fake(),
-      getZoomPrecision: sinon.fake(),
-    },
-  },
-};
-
-export const npStart = {
-  core: mockCoreStart,
-  plugins: {
-    management: {
-      legacy: {
-        getSection: () => ({
-          register: sinon.fake(),
-          deregister: sinon.fake(),
-          hasItem: sinon.fake(),
-        }),
-      },
-      sections: {
-        getSection: () => ({
-          registerApp: sinon.fake(),
-        }),
-      },
-    },
-    indexPatternManagement: {
-      list: {
-        getType: sinon.fake(),
-        getIndexPatternCreationOptions: sinon.fake(),
-      },
-      creation: {
-        getIndexPatternTags: sinon.fake(),
-        getFieldInfo: sinon.fake(),
-        areScriptedFieldsEnabled: sinon.fake(),
-      },
-    },
-    embeddable: {
-      getEmbeddableFactory: sinon.fake(),
-      getEmbeddableFactories: sinon.fake(),
-      registerEmbeddableFactory: sinon.fake(),
-    },
-    expressions: {
-      registerFunction: sinon.fake(),
-      registerRenderer: sinon.fake(),
-      registerType: sinon.fake(),
-    },
-    kibanaLegacy: {
-      getForwards: () => [],
-      loadFontAwesome: () => {},
-      config: {
-        defaultAppId: 'home',
-      },
-      dashboardConfig: {
-        turnHideWriteControlsOn: sinon.fake(),
-        getHideWriteControls: sinon.fake(),
-      },
-    },
-    dashboard: {
-      getSavedDashboardLoader: sinon.fake(),
-    },
-    data: {
-      actions: {
-        createFiltersFromValueClickAction: Promise.resolve(['yes']),
-        createFiltersFromRangeSelectAction: sinon.fake(),
-      },
-      autocomplete: {
-        getProvider: sinon.fake(),
-      },
-      getSuggestions: sinon.fake(),
-      indexPatterns: {
-        get: sinon.spy((indexPatternId) =>
-          Promise.resolve({
-            id: indexPatternId,
-            isTimeNanosBased: () => false,
-            popularizeField: () => {},
-          })
-        ),
-      },
-      ui: {
-        IndexPatternSelect: mockComponent,
-        SearchBar: mockComponent,
-      },
-      query: {
-        filterManager: {
-          getFetches$: sinon.fake(),
-          getFilters: sinon.fake(),
-          getAppFilters: sinon.fake(),
-          getGlobalFilters: sinon.fake(),
-          removeFilter: sinon.fake(),
-          addFilters: sinon.fake(),
-          setFilters: sinon.fake(),
-          removeAll: sinon.fake(),
-          getUpdates$: mockObservable,
-        },
-        timefilter: {
-          timefilter: {
-            getFetch$: mockObservable,
-            getAutoRefreshFetch$: mockObservable,
-            getEnabledUpdated$: mockObservable,
-            getTimeUpdate$: mockObservable,
-            getRefreshIntervalUpdate$: mockObservable,
-            isTimeRangeSelectorEnabled: () => {
-              return isTimeRangeSelectorEnabled;
-            },
-            isAutoRefreshSelectorEnabled: () => {
-              return isAutoRefreshSelectorEnabled;
-            },
-            disableAutoRefreshSelector: () => {
-              isAutoRefreshSelectorEnabled = false;
-            },
-            enableAutoRefreshSelector: () => {
-              isAutoRefreshSelectorEnabled = true;
-            },
-            getRefreshInterval: () => {
-              return refreshInterval;
-            },
-            setRefreshInterval: (interval) => {
-              refreshInterval = interval;
-            },
-            enableTimeRangeSelector: () => {
-              isTimeRangeSelectorEnabled = true;
-            },
-            disableTimeRangeSelector: () => {
-              isTimeRangeSelectorEnabled = false;
-            },
-            getTime: sinon.fake(),
-            setTime: sinon.fake(),
-            getActiveBounds: sinon.fake(),
-            getBounds: sinon.fake(),
-            calculateBounds: sinon.fake(),
-            createFilter: sinon.fake(),
-          },
-          history: sinon.fake(),
-        },
-      },
-      search: {
-        aggs: {
-          calculateAutoTimeExpression: sinon.fake(),
-          createAggConfigs: (indexPattern, configStates = []) => {
-            return new AggConfigs(indexPattern, configStates, {
-              typesRegistry: aggTypesRegistry.start(),
-              fieldFormats: getFieldFormatsRegistry(mockCoreStart),
-            });
-          },
-          types: aggTypesRegistry.start(),
-        },
-        __LEGACY: {
-          esClient: {
-            search: sinon.fake(),
-            msearch: sinon.fake(),
-          },
-        },
-      },
-      fieldFormats: getFieldFormatsRegistry(mockCoreStart),
-    },
-    share: {
-      toggleShareContextMenu: () => {},
-    },
-    inspector: {
-      isAvailable: () => false,
-      open: () => ({
-        onClose: Promise.resolve(undefined),
-        close: () => Promise.resolve(undefined),
-      }),
-    },
-    uiActions: {
-      attachAction: sinon.fake(),
-      registerAction: sinon.fake(),
-      registerTrigger: sinon.fake(),
-      detachAction: sinon.fake(),
-      executeTriggerActions: sinon.fake(),
-      getTrigger: sinon.fake(),
-      getTriggerActions: sinon.fake(),
-      getTriggerCompatibleActions: sinon.fake(),
-    },
-    visualizations: {
-      get: sinon.fake(),
-      all: sinon.fake(),
-      getAliases: sinon.fake(),
-      savedVisualizationsLoader: {},
-      showNewVisModal: sinon.fake(),
-      createVis: sinon.fake(),
-      convertFromSerializedVis: sinon.fake(),
-      convertToSerializedVis: sinon.fake(),
-    },
-    navigation: {
-      ui: {
-        TopNavMenu: mockComponent,
-      },
-    },
-    charts: {
-      theme: {
-        chartsTheme$: mockObservable,
-        useChartsTheme: sinon.fake(),
-      },
-    },
-    discover: {
-      docViews: {
-        DocViewer: () => null,
-      },
-      savedSearchLoader: {},
-    },
-  },
-};
-
-export function __setup__(coreSetup) {
-  npSetup.core = coreSetup;
-
-  // no-op application register calls (this is overwritten to
-  // bootstrap an LP plugin outside of tests)
-  npSetup.core.application.register = () => {};
-
-  npSetup.core.uiSettings.get = mockUiSettings.get;
-
-  // Services that need to be set in the legacy platform since the legacy data
-  // & vis plugins which previously provided them have been removed.
-  setSetupServices(npSetup);
-}
-
-export function __start__(coreStart) {
-  npStart.core = coreStart;
-
-  npStart.core.uiSettings.get = mockUiSettings.get;
-
-  // Services that need to be set in the legacy platform since the legacy data
-  // & vis plugins which previously provided them have been removed.
-  setStartServices(npStart);
-}
diff --git a/src/legacy/ui/public/new_platform/new_platform.test.mocks.ts b/src/legacy/ui/public/new_platform/new_platform.test.mocks.ts
deleted file mode 100644
index f44efe17ef8eee..00000000000000
--- a/src/legacy/ui/public/new_platform/new_platform.test.mocks.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { scopedHistoryMock } from '../../../../core/public/mocks';
-
-export const setRootControllerMock = jest.fn();
-
-jest.doMock('ui/chrome', () => ({
-  setRootController: setRootControllerMock,
-}));
-
-export const historyMock = scopedHistoryMock.create();
-jest.doMock('../../../../core/public', () => ({
-  ScopedHistory: jest.fn(() => historyMock),
-}));
diff --git a/src/legacy/ui/public/new_platform/new_platform.test.ts b/src/legacy/ui/public/new_platform/new_platform.test.ts
deleted file mode 100644
index d515c348ca440b..00000000000000
--- a/src/legacy/ui/public/new_platform/new_platform.test.ts
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-jest.mock('history');
-
-import { setRootControllerMock, historyMock } from './new_platform.test.mocks';
-import { legacyAppRegister, __reset__, __setup__, __start__ } from './new_platform';
-import { coreMock } from '../../../../core/public/mocks';
-import { AppMount } from '../../../../core/public';
-
-describe('ui/new_platform', () => {
-  describe('legacyAppRegister', () => {
-    beforeEach(() => {
-      setRootControllerMock.mockReset();
-      __reset__();
-      __setup__(coreMock.createSetup({ basePath: '/test/base/path' }) as any, {} as any);
-    });
-
-    const registerApp = () => {
-      const unmountMock = jest.fn();
-      const mountMock = jest.fn<ReturnType<AppMount>, Parameters<AppMount>>(() => unmountMock);
-      legacyAppRegister({
-        id: 'test',
-        title: 'Test',
-        mount: mountMock,
-      });
-      return { mountMock, unmountMock };
-    };
-
-    test('sets ui/chrome root controller', () => {
-      registerApp();
-      expect(setRootControllerMock).toHaveBeenCalledWith('test', expect.any(Function));
-    });
-
-    test('throws if called more than once', () => {
-      registerApp();
-      expect(registerApp).toThrowErrorMatchingInlineSnapshot(
-        `"core.application.register may only be called once for legacy plugins."`
-      );
-    });
-
-    test('controller calls app.mount when invoked', () => {
-      const { mountMock } = registerApp();
-      const controller = setRootControllerMock.mock.calls[0][1];
-      const scopeMock = { $on: jest.fn() };
-      const elementMock = [document.createElement('div')];
-
-      controller(scopeMock, elementMock);
-      expect(mountMock).toHaveBeenCalledWith({
-        element: expect.any(HTMLElement),
-        appBasePath: '/test/base/path/app/test',
-        onAppLeave: expect.any(Function),
-        history: historyMock,
-      });
-    });
-
-    test('app is mounted in new div inside containing element', () => {
-      const { mountMock } = registerApp();
-      const controller = setRootControllerMock.mock.calls[0][1];
-      const scopeMock = { $on: jest.fn() };
-      const elementMock = [document.createElement('div')];
-
-      controller(scopeMock, elementMock);
-
-      const { element } = mountMock.mock.calls[0][0];
-      expect(element.parentElement).toEqual(elementMock[0]);
-    });
-
-    test('controller calls deprecated context app.mount when invoked', () => {
-      const unmountMock = jest.fn();
-      // Two arguments changes how this is called.
-      const mountMock = jest.fn((context, params) => unmountMock);
-      legacyAppRegister({
-        id: 'test',
-        title: 'Test',
-        mount: mountMock,
-      });
-      const controller = setRootControllerMock.mock.calls[0][1];
-      const scopeMock = { $on: jest.fn() };
-      const elementMock = [document.createElement('div')];
-
-      controller(scopeMock, elementMock);
-      expect(mountMock).toHaveBeenCalledWith(expect.any(Object), {
-        element: expect.any(HTMLElement),
-        appBasePath: '/test/base/path/app/test',
-        onAppLeave: expect.any(Function),
-        history: historyMock,
-      });
-    });
-
-    test('controller calls unmount when $scope.$destroy', async () => {
-      const { unmountMock } = registerApp();
-      const controller = setRootControllerMock.mock.calls[0][1];
-      const scopeMock = { $on: jest.fn() };
-      const elementMock = [document.createElement('div')];
-
-      controller(scopeMock, elementMock);
-      // Flush promise queue. Must be done this way because the controller cannot return a Promise without breaking
-      // angular.
-      await new Promise((resolve) => setTimeout(resolve, 1));
-
-      const [event, eventHandler] = scopeMock.$on.mock.calls[0];
-      expect(event).toEqual('$destroy');
-      eventHandler();
-      expect(unmountMock).toHaveBeenCalled();
-    });
-  });
-});
diff --git a/src/legacy/ui/public/new_platform/new_platform.ts b/src/legacy/ui/public/new_platform/new_platform.ts
deleted file mode 100644
index 37787ffbde4fc4..00000000000000
--- a/src/legacy/ui/public/new_platform/new_platform.ts
+++ /dev/null
@@ -1,208 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { IScope } from 'angular';
-
-import { UiActionsStart, UiActionsSetup } from 'src/plugins/ui_actions/public';
-import { EmbeddableStart, EmbeddableSetup } from 'src/plugins/embeddable/public';
-import { createBrowserHistory } from 'history';
-import { VisTypeXyPluginSetup } from 'src/plugins/vis_type_xy/public';
-import { DashboardStart } from '../../../../plugins/dashboard/public';
-import { setSetupServices, setStartServices } from './set_services';
-import {
-  LegacyCoreSetup,
-  LegacyCoreStart,
-  App,
-  AppMountDeprecated,
-  ScopedHistory,
-} from '../../../../core/public';
-import { Plugin as DataPlugin } from '../../../../plugins/data/public';
-import { Plugin as ExpressionsPlugin } from '../../../../plugins/expressions/public';
-import {
-  Setup as InspectorSetup,
-  Start as InspectorStart,
-} from '../../../../plugins/inspector/public';
-import { ChartsPluginSetup, ChartsPluginStart } from '../../../../plugins/charts/public';
-import { DevToolsSetup } from '../../../../plugins/dev_tools/public';
-import { KibanaLegacySetup, KibanaLegacyStart } from '../../../../plugins/kibana_legacy/public';
-import { HomePublicPluginSetup } from '../../../../plugins/home/public';
-import { SharePluginSetup, SharePluginStart } from '../../../../plugins/share/public';
-import {
-  AdvancedSettingsSetup,
-  AdvancedSettingsStart,
-} from '../../../../plugins/advanced_settings/public';
-import { ManagementSetup, ManagementStart } from '../../../../plugins/management/public';
-import {
-  IndexPatternManagementSetup,
-  IndexPatternManagementStart,
-} from '../../../../plugins/index_pattern_management/public';
-import { BfetchPublicSetup, BfetchPublicStart } from '../../../../plugins/bfetch/public';
-import { UsageCollectionSetup } from '../../../../plugins/usage_collection/public';
-import { TelemetryPluginSetup, TelemetryPluginStart } from '../../../../plugins/telemetry/public';
-import {
-  NavigationPublicPluginSetup,
-  NavigationPublicPluginStart,
-} from '../../../../plugins/navigation/public';
-import { DiscoverSetup, DiscoverStart } from '../../../../plugins/discover/public';
-import {
-  SavedObjectsManagementPluginSetup,
-  SavedObjectsManagementPluginStart,
-} from '../../../../plugins/saved_objects_management/public';
-import {
-  VisualizationsSetup,
-  VisualizationsStart,
-} from '../../../../plugins/visualizations/public';
-import { VisTypeTimelionPluginStart } from '../../../../plugins/vis_type_timelion/public';
-import { MapsLegacyPluginSetup } from '../../../../plugins/maps_legacy/public';
-
-export interface PluginsSetup {
-  bfetch: BfetchPublicSetup;
-  charts: ChartsPluginSetup;
-  data: ReturnType<DataPlugin['setup']>;
-  embeddable: EmbeddableSetup;
-  expressions: ReturnType<ExpressionsPlugin['setup']>;
-  home: HomePublicPluginSetup;
-  inspector: InspectorSetup;
-  uiActions: UiActionsSetup;
-  navigation: NavigationPublicPluginSetup;
-  devTools: DevToolsSetup;
-  kibanaLegacy: KibanaLegacySetup;
-  share: SharePluginSetup;
-  usageCollection: UsageCollectionSetup;
-  advancedSettings: AdvancedSettingsSetup;
-  management: ManagementSetup;
-  discover: DiscoverSetup;
-  visualizations: VisualizationsSetup;
-  telemetry?: TelemetryPluginSetup;
-  savedObjectsManagement: SavedObjectsManagementPluginSetup;
-  mapsLegacy: MapsLegacyPluginSetup;
-  indexPatternManagement: IndexPatternManagementSetup;
-  visTypeXy?: VisTypeXyPluginSetup;
-}
-
-export interface PluginsStart {
-  bfetch: BfetchPublicStart;
-  charts: ChartsPluginStart;
-  data: ReturnType<DataPlugin['start']>;
-  embeddable: EmbeddableStart;
-  expressions: ReturnType<ExpressionsPlugin['start']>;
-  inspector: InspectorStart;
-  uiActions: UiActionsStart;
-  navigation: NavigationPublicPluginStart;
-  kibanaLegacy: KibanaLegacyStart;
-  share: SharePluginStart;
-  management: ManagementStart;
-  advancedSettings: AdvancedSettingsStart;
-  discover: DiscoverStart;
-  visualizations: VisualizationsStart;
-  telemetry?: TelemetryPluginStart;
-  dashboard: DashboardStart;
-  savedObjectsManagement: SavedObjectsManagementPluginStart;
-  visTypeTimelion: VisTypeTimelionPluginStart;
-  indexPatternManagement: IndexPatternManagementStart;
-}
-
-export const npSetup = {
-  core: (null as unknown) as LegacyCoreSetup,
-  plugins: {} as PluginsSetup,
-};
-
-export const npStart = {
-  core: (null as unknown) as LegacyCoreStart,
-  plugins: {} as PluginsStart,
-};
-
-/**
- * Only used by unit tests
- * @internal
- */
-export function __reset__() {
-  npSetup.core = (null as unknown) as LegacyCoreSetup;
-  npSetup.plugins = {} as any;
-  npStart.core = (null as unknown) as LegacyCoreStart;
-  npStart.plugins = {} as any;
-  legacyAppRegistered = false;
-}
-
-export function __setup__(coreSetup: LegacyCoreSetup, plugins: PluginsSetup) {
-  npSetup.core = coreSetup;
-  npSetup.plugins = plugins;
-
-  // Setup compatibility layer for AppService in legacy platform
-  npSetup.core.application.register = legacyAppRegister;
-
-  // Services that need to be set in the legacy platform since the legacy data
-  // & vis plugins which previously provided them have been removed.
-  setSetupServices(npSetup);
-}
-
-export function __start__(coreStart: LegacyCoreStart, plugins: PluginsStart) {
-  npStart.core = coreStart;
-  npStart.plugins = plugins;
-
-  // Services that need to be set in the legacy platform since the legacy data
-  // & vis plugins which previously provided them have been removed.
-  setStartServices(npStart);
-}
-
-/** Flag used to ensure `legacyAppRegister` is only called once. */
-let legacyAppRegistered = false;
-
-/**
- * Exported for testing only. Use `npSetup.core.application.register` in legacy apps.
- * @internal
- */
-export const legacyAppRegister = (app: App<any>) => {
-  if (legacyAppRegistered) {
-    throw new Error(`core.application.register may only be called once for legacy plugins.`);
-  }
-  legacyAppRegistered = true;
-
-  // eslint-disable-next-line @typescript-eslint/no-var-requires
-  require('ui/chrome').setRootController(app.id, ($scope: IScope, $element: JQLite) => {
-    const element = document.createElement('div');
-    $element[0].appendChild(element);
-
-    // Root controller cannot return a Promise so use an internal async function and call it immediately
-    (async () => {
-      const appRoute = app.appRoute || `/app/${app.id}`;
-      const appBasePath = npSetup.core.http.basePath.prepend(appRoute);
-      const params = {
-        element,
-        appBasePath,
-        history: new ScopedHistory(
-          createBrowserHistory({ basename: npSetup.core.http.basePath.get() }),
-          appRoute
-        ),
-        onAppLeave: () => undefined,
-      };
-      const unmount = isAppMountDeprecated(app.mount)
-        ? await app.mount({ core: npStart.core }, params)
-        : await app.mount(params);
-      $scope.$on('$destroy', () => {
-        unmount();
-      });
-    })();
-  });
-};
-
-function isAppMountDeprecated(mount: (...args: any[]) => any): mount is AppMountDeprecated {
-  // Mount functions with two arguments are assumed to expect deprecated `context` object.
-  return mount.length === 2;
-}
diff --git a/src/legacy/ui/public/new_platform/set_services.test.ts b/src/legacy/ui/public/new_platform/set_services.test.ts
deleted file mode 100644
index 74e789ec220b1b..00000000000000
--- a/src/legacy/ui/public/new_platform/set_services.test.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { __reset__, __setup__, __start__, PluginsSetup, PluginsStart } from './new_platform';
-import * as dataServices from '../../../../plugins/data/public/services';
-import * as visualizationsServices from '../../../../plugins/visualizations/public/services';
-import { LegacyCoreSetup, LegacyCoreStart } from '../../../../core/public';
-import { coreMock } from '../../../../core/public/mocks';
-import { npSetup, npStart } from './__mocks__';
-
-describe('ui/new_platform', () => {
-  describe('set service getters', () => {
-    const testServiceGetters = (name: string, services: Record<string, Function>) => {
-      const getters = Object.keys(services).filter((k) => k.substring(0, 3) === 'get');
-      getters.forEach((g) => {
-        it(`ui/new_platform sets a value for ${name} getter ${g}`, () => {
-          __reset__();
-          __setup__(
-            (coreMock.createSetup() as unknown) as LegacyCoreSetup,
-            (npSetup.plugins as unknown) as PluginsSetup
-          );
-          __start__(
-            (coreMock.createStart() as unknown) as LegacyCoreStart,
-            (npStart.plugins as unknown) as PluginsStart
-          );
-
-          expect(services[g]()).toBeDefined();
-        });
-      });
-    };
-
-    testServiceGetters('data', dataServices);
-    testServiceGetters('visualizations', visualizationsServices);
-  });
-});
diff --git a/src/legacy/ui/public/new_platform/set_services.ts b/src/legacy/ui/public/new_platform/set_services.ts
deleted file mode 100644
index 036157a9f3fbc4..00000000000000
--- a/src/legacy/ui/public/new_platform/set_services.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { pick } from 'lodash';
-
-import { PluginsSetup, PluginsStart } from './new_platform';
-import { LegacyCoreSetup, LegacyCoreStart } from '../../../../core/public';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import * as dataServices from '../../../../plugins/data/public/services';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import * as visualizationsServices from '../../../../plugins/visualizations/public/services';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { createSavedVisLoader } from '../../../../plugins/visualizations/public/saved_visualizations/saved_visualizations';
-
-interface NpSetup {
-  core: LegacyCoreSetup;
-  plugins: PluginsSetup;
-}
-
-interface NpStart {
-  core: LegacyCoreStart;
-  plugins: PluginsStart;
-}
-
-export function setSetupServices(npSetup: NpSetup) {
-  // Services that need to be set in the legacy platform since the legacy data plugin
-  // which previously provided them has been removed.
-  visualizationsServices.setUISettings(npSetup.core.uiSettings);
-  visualizationsServices.setUsageCollector(npSetup.plugins.usageCollection);
-}
-
-export function setStartServices(npStart: NpStart) {
-  // Services that need to be set in the legacy platform since the legacy data plugin
-  // which previously provided them has been removed.
-  dataServices.setNotifications(npStart.core.notifications);
-  dataServices.setOverlays(npStart.core.overlays);
-  dataServices.setUiSettings(npStart.core.uiSettings);
-  dataServices.setFieldFormats(npStart.plugins.data.fieldFormats);
-  dataServices.setIndexPatterns(npStart.plugins.data.indexPatterns);
-  dataServices.setQueryService(npStart.plugins.data.query);
-  dataServices.setSearchService(npStart.plugins.data.search);
-
-  visualizationsServices.setI18n(npStart.core.i18n);
-  visualizationsServices.setTypes(
-    pick(npStart.plugins.visualizations, ['get', 'all', 'getAliases'])
-  );
-  visualizationsServices.setCapabilities(npStart.core.application.capabilities);
-  visualizationsServices.setHttp(npStart.core.http);
-  visualizationsServices.setApplication(npStart.core.application);
-  visualizationsServices.setEmbeddable(npStart.plugins.embeddable);
-  visualizationsServices.setSavedObjects(npStart.core.savedObjects);
-  visualizationsServices.setIndexPatterns(npStart.plugins.data.indexPatterns);
-  visualizationsServices.setFilterManager(npStart.plugins.data.query.filterManager);
-  visualizationsServices.setExpressions(npStart.plugins.expressions);
-  visualizationsServices.setUiActions(npStart.plugins.uiActions);
-  visualizationsServices.setTimeFilter(npStart.plugins.data.query.timefilter.timefilter);
-  visualizationsServices.setAggs(npStart.plugins.data.search.aggs);
-  visualizationsServices.setOverlays(npStart.core.overlays);
-  visualizationsServices.setChrome(npStart.core.chrome);
-  visualizationsServices.setSearch(npStart.plugins.data.search);
-  const savedVisualizationsLoader = createSavedVisLoader({
-    savedObjectsClient: npStart.core.savedObjects.client,
-    indexPatterns: npStart.plugins.data.indexPatterns,
-    search: npStart.plugins.data.search,
-    chrome: npStart.core.chrome,
-    overlays: npStart.core.overlays,
-    visualizationTypes: visualizationsServices.getTypes(),
-  });
-  visualizationsServices.setSavedVisualizationsLoader(savedVisualizationsLoader);
-  visualizationsServices.setSavedSearchLoader(npStart.plugins.discover.savedSearchLoader);
-}
diff --git a/src/legacy/ui/public/notify/banners/BANNERS.md b/src/legacy/ui/public/notify/banners/BANNERS.md
deleted file mode 100644
index fc6bddc3aa4edd..00000000000000
--- a/src/legacy/ui/public/notify/banners/BANNERS.md
+++ /dev/null
@@ -1,360 +0,0 @@
-# Banners
-
-Use this service to surface banners at the top of the screen. The expectation is that the banner will used an
-`<EuiCallOut />` to render, but that is not a requirement. See [the EUI docs](https://elastic.github.io/eui/) for
-more information on banners and their role within the UI.
-
-Banners should be considered with respect to their lifecycle. Most banners are best served by using the `add` and
-`remove` functions.
-
-## Importing the module
-
-```js
-import { banners } from 'ui/notify';
-```
-
-## Interface
-
-There are three methods defined to manipulate the list of banners: `add`, `set`, and `remove`. A fourth method,
-`onChange` exists to listen to changes made via `add`, `set`, and `remove`.
-
-### `add()`
-
-This is the preferred way to add banners because it implies the best usage of the banner: added once during a page's
-lifecycle. For other usages, consider *not* using a banner.
-
-#### Syntax
-
-```js
-const bannerId = banners.add({
-  // required:
-  component,
-  // optional:
-  priority,
-});
-```
-
-##### Parameters
-
-| Field | Type | Description |
-|-------|------|-------------|
-| `component` | Any | The value displayed as the banner. |
-| `priority` | Number | Optional priority, which defaults to `0` used to place the banner. |
-
-To add a banner, you only need to define the `component` field.
-
-The `priority` sorts in descending order. Items sharing the same priority are sorted from oldest to newest. For example:
-
-```js
-const banner1 = banners.add({ component: <EuiCallOut title="fake1" /> });
-const banner2 = banners.add({ component: <EuiCallOut title="fake2" />, priority: 0 });
-const banner3 = banners.add({ component: <EuiCallOut title="fake3" />, priority: 1 });
-```
-
-That would be displayed as:
-
-```
-[ fake3 ]
-[ fake1 ]
-[ fake2 ]
-```
-
-##### Returns
-
-| Type | Description |
-|------|-------------|
-| String | A newly generated ID. |
-
-#### Example
-
-This example includes buttons that allow the user to remove the banner. In some cases, you may not want any buttons
-and in other cases you will want an action to proceed the banner's removal (e.g., apply an Advanced Setting).
-
-This makes the most sense to use when a banner is added at the beginning of the page life cycle and not expected to
-be touched, except by its own buttons triggering an action or navigating away.
-
-```js
-const bannerId = banners.add({
-  component: (
-    <EuiCallOut
-      iconType="iInCircle"
-      title="In order to visualize and explore data in Kibana, you'll need to create an index pattern to retrieve data from Elasticsearch."
-    >
-      <EuiFlexGroup
-        gutterSize="s"
-        alignItems="center"
-      >
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButton
-            size="s"
-            fill
-            onClick={() => banners.remove(bannerId)}
-          >
-            Dismiss
-          </EuiButton>
-        </EuiFlexItem>
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButton
-            size="s"
-            onClick={() => window.alert('Do Something Else')}
-          >
-            Do Something Else
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiCallOut>
-  ),
-});
-```
-
-### `remove()`
-
-Unlike toast notifications, banners stick around until they are explicitly removed. Using the `add` example above,you can remove it by calling `remove`.
-
-Note: They will stick around as long as the scope is remembered by whatever set it; navigating away won't remove it
-unless the scope is forgotten (e.g., when the "app" changes)!
-
-#### Syntax
-
-```js
-const removed = banners.remove(bannerId);
-```
-
-##### Parameters
-
-| Field | Type | Description |
-|-------|------|-------------|
-| `id`  | String | ID of a banner. |
-
-##### Returns
-
-| Type | Description |
-|------|-------------|
-| Boolean | `true` if the ID was recognized and the banner was removed. `false` otherwise. |
-
-#### Example
-
-To remove a banner, you need to pass the `id` of the banner.
-
-```js
-if (banners.remove(bannerId)) {
-  // removed; otherwise it didn't exist (maybe it was already removed)
-}
-```
-
-#### Scheduled removal
-
-Like toast notifications do automatically, you can have a banner automatically removed after a set of time, by
-setting a timer:
-
-```js
-setTimeout(() => banners.remove(bannerId), 15000);
-```
-
-Note: It is safe to remove a banner more than once as unknown IDs will be ignored.
-
-### `set()`
-
-Banners can be replaced once added by supplying their `id`. If one is supplied, then the ID will be used to replace
-any banner with the same ID and a **new** `id` will be returned.
-
-You should only consider using `set` when the banner is manipulated frequently in the lifecycle of the page, where
-maintaining the banner's `id` can be a burden. It is easier to allow `banners` to create the ID for you in most
-situations where a banner is useful (e.g., set once), which safely avoids any chance to have an ID-based collision,
-which happens automatically with `add`.
-
-Usage of `set` can imply that your use case is abusing the banner system.
-
-Note: `set` will only trigger the callback once for both the implicit remove and add operation.
-
-#### Syntax
-
-```js
-const id = banners.set({
-  // required:
-  component,
-  // optional:
-  id,
-  priority,
-});
-```
-
-##### Parameters
-
-| Field | Type | Description |
-|-------|------|-------------|
-| `component` | Any | The value displayed as the banner. |
-| `id`  | String | Optional ID used to remove an existing banner. |
-| `priority` | Number | Optional priority, which defaults to `0` used to place the banner. |
-
-The `id` is optional because it follows the same semantics as the `remove` method: unknown IDs are ignored. This
-is useful when first creating a banner so that you do not have to call `add` instead.
-
-##### Returns
-
-| Type | Description |
-|------|-------------|
-| String | A newly generated ID. |
-
-#### Example
-
-This example does not include any way for the user to clear the banner directly. Instead, it is cleared based on
-time. Related to it being cleared by time, it can also reappear within the same page life cycle by navigating between
-different paths that need it displayed. Instead of adding a new banner for every navigation, you should replace any
-existing banner.
-
-```js
-let bannerId;
-let timeoutId;
-
-function displayBanner() {
-  clearTimeout(timeoutId);
-
-  bannerId = banners.set({
-    id: bannerId, // the first time it will be undefined, but reused as long as this is in the same lifecycle
-    component: (
-      <EuiCallOut
-        color="warning"
-        iconType="iInCircle"
-        title={
-          `In order to visualize and explore data in Kibana,
-          you'll need to create an index pattern to retrieve data from Elasticsearch.`
-        }
-      />
-    )
-  });
-
-  // hide the message after the user has had a chance to acknowledge it -- so it doesn't permanently stick around
-  banner.timeoutId = setTimeout(() => {
-    banners.remove(bannerId);
-    timeoutId = undefined;
-  }, 6000);
-}
-```
-
-### `onChange()`
-
-For React components that intend to display the banners, it is not enough to simply `render` the `banners.list`
-values. Because they can change after being rendered, the React component that renders the list must be alerted
-to changes to the list.
-
-#### Syntax
-
-```js
-// inside your React component
-banners.onChange(() => this.forceUpdate());
-```
-
-##### Parameters
-
-| Field | Type | Description |
-|-------|------|-------------|
-| `callback` | Function | The function to invoke whenever the internal banner list is changed. |
-
-Every new `callback` replaces the previous callback. So calling this with `null` or `undefined` will unset the
-callback.
-
-##### Returns
-
-Nothing.
-
-#### Example
-
-This can be used inside of a React component to trigger a re-`render` of the banners.
-
-```js
-import { GlobalBannerList } from 'ui/notify';
-
-<GlobalBannerList
-  banners={banners.list}
-  subscribe={banners.onChange}
-/>
-```
-
-### `list`
-
-For React components that intend to display the banners, it is not enough to simply `render` the `banners.list`
-values. Because they can change after being rendered, the React component that renders the list must be alerted
-to changes to the list.
-
-#### Syntax
-
-```js
-<GlobalBannerList
-  banners={banners.list}
-  subscribe={banners.onChange}
-/>
-```
-
-##### Returns
-
-| Type | Description |
-|------|-------------|
-| Array | The array of banner objects. |
-
-Banner objects are sorted in descending order based on their `priority`, in the form:
-
-```js
-{
-  id: 'banner-123',
-  component: <EuiCallOut />,
-  priority: 12,
-}
-```
-
-| Field | Type | Description |
-|-------|------|-------------|
-| `component` | Any | The value displayed as the banner. |
-| `id`  | String | The ID of the banner, which can be used as a React "key". |
-| `priority` | Number | The priority of the banner. |
-
-#### Example
-
-This can be used to supply the banners to the `GlobalBannerList` React component (which is done for you).
-
-```js
-import { GlobalBannerList } from 'ui/notify';
-
-<GlobalBannerList
-  banners={banners.list}
-  subscribe={banners.onChange}
-/>
-```
-
-## Use in functional tests
-
-Functional tests are commonly used to verify that an action yielded a successful outcome. You can place a
-`data-test-subj` attribute on the banner and use it to check if the banner exists inside of your functional test.
-This acts as a proxy for verifying the successful outcome. Any unrecognized field will be added as a property of the
-containing element.
-
-```js
-banners.add({
-  component: (
-    <EuiCallOut
-      title="Look at me!"
-    />
-  ),
-  data-test-subj: 'my-tested-banner',
-});
-```
-
-This will apply the `data-test-subj` to the element containing the `component`, so the inner HTML of that element
-will exclusively be the specified `component`.
-
-Given that `component` is expected to be a React component, you could also add the `data-test-subj` directly to it:
-
-```js
-banners.add({
-  component: (
-    <EuiCallOut
-      title="Look at me!"
-      data-test-subj="my-tested-banner"
-    />
-  ),
-});
-```
\ No newline at end of file
diff --git a/src/legacy/ui/public/notify/banners/banners.tsx b/src/legacy/ui/public/notify/banners/banners.tsx
deleted file mode 100644
index 777e408b8dfc40..00000000000000
--- a/src/legacy/ui/public/notify/banners/banners.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React from 'react';
-import ReactDOM from 'react-dom';
-import { npStart } from 'ui/new_platform';
-import { I18nProvider } from '@kbn/i18n/react';
-
-const npBanners = npStart.core.overlays.banners;
-
-/** compatibility layer for new platform */
-const mountForComponent = (component: React.ReactElement) => (element: HTMLElement) => {
-  ReactDOM.render(<I18nProvider>{component}</I18nProvider>, element);
-  return () => ReactDOM.unmountComponentAtNode(element);
-};
-
-/**
- * Banners represents a prioritized list of displayed components.
- */
-export class Banners {
-  /**
-   * Add a new banner.
-   *
-   * @param {Object} component The React component to display.
-   * @param {Number} priority The optional priority order to display this banner. Higher priority values are shown first.
-   * @return {String} A newly generated ID. This value can be used to remove/replace the banner.
-   */
-  add = ({ component, priority }: { component: React.ReactElement; priority?: number }) => {
-    return npBanners.add(mountForComponent(component), priority);
-  };
-
-  /**
-   * Remove an existing banner.
-   *
-   * @param {String} id The ID of the banner to remove.
-   * @return {Boolean} {@code true} if the ID is recognized and the banner is removed. {@code false} otherwise.
-   */
-  remove = (id: string): boolean => {
-    return npBanners.remove(id);
-  };
-
-  /**
-   * Replace an existing banner by removing it, if it exists, and adding a new one in its place.
-   *
-   * This is similar to calling banners.remove, followed by banners.add, except that it only notifies the listener
-   * after adding.
-   *
-   * @param {Object} component The React component to display.
-   * @param {String} id The ID of the Banner to remove.
-   * @param {Number} priority The optional priority order to display this banner. Higher priority values are shown first.
-   * @return {String} A newly generated ID. This value can be used to remove/replace the banner.
-   */
-  set = ({
-    component,
-    id,
-    priority = 0,
-  }: {
-    component: React.ReactElement;
-    id: string;
-    priority?: number;
-  }): string => {
-    return npBanners.replace(id, mountForComponent(component), priority);
-  };
-}
-
-/**
- * A singleton instance meant to represent all Kibana banners.
- */
-export const banners = new Banners();
diff --git a/src/legacy/ui/public/notify/banners/index.ts b/src/legacy/ui/public/notify/banners/index.ts
deleted file mode 100644
index 9221f95074cd96..00000000000000
--- a/src/legacy/ui/public/notify/banners/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { banners } from './banners';
diff --git a/src/legacy/ui/public/notify/fatal_error.ts b/src/legacy/ui/public/notify/fatal_error.ts
deleted file mode 100644
index 5614ffea7913e7..00000000000000
--- a/src/legacy/ui/public/notify/fatal_error.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { npSetup } from 'ui/new_platform';
-import { AngularHttpError, addFatalError } from '../../../../plugins/kibana_legacy/public';
-
-export function fatalError(error: AngularHttpError | Error | string, location?: string) {
-  addFatalError(npSetup.core.fatalErrors, error, location);
-}
diff --git a/src/legacy/ui/public/notify/index.d.ts b/src/legacy/ui/public/notify/index.d.ts
deleted file mode 100644
index 3c1a7ba02db72b..00000000000000
--- a/src/legacy/ui/public/notify/index.d.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { toastNotifications } from './toasts';
-export { fatalError } from './fatal_error';
diff --git a/src/legacy/ui/public/notify/index.js b/src/legacy/ui/public/notify/index.js
deleted file mode 100644
index 51394033e4d2e0..00000000000000
--- a/src/legacy/ui/public/notify/index.js
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { fatalError } from './fatal_error';
-export { toastNotifications } from './toasts';
-export { banners } from './banners';
diff --git a/src/legacy/ui/public/notify/toasts/index.ts b/src/legacy/ui/public/notify/toasts/index.ts
deleted file mode 100644
index c5e8e3b7ca7a3a..00000000000000
--- a/src/legacy/ui/public/notify/toasts/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-export { ToastNotifications } from './toast_notifications';
-export { toastNotifications } from './toasts';
diff --git a/src/legacy/ui/public/notify/toasts/toast_notifications.ts b/src/legacy/ui/public/notify/toasts/toast_notifications.ts
deleted file mode 100644
index d3ec8edb5d73a0..00000000000000
--- a/src/legacy/ui/public/notify/toasts/toast_notifications.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-/**
- * ToastNotifications is deprecated! Please use npSetup.core.notifications.toasts instead
- */
-export { ToastNotifications } from '../../../../../plugins/kibana_legacy/public';
diff --git a/src/legacy/ui/public/notify/toasts/toasts.ts b/src/legacy/ui/public/notify/toasts/toasts.ts
deleted file mode 100644
index 15be7a7891553a..00000000000000
--- a/src/legacy/ui/public/notify/toasts/toasts.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { npSetup } from 'ui/new_platform';
-import { ToastNotifications } from './toast_notifications';
-export const toastNotifications = new ToastNotifications(npSetup.core.notifications.toasts);
diff --git a/src/legacy/ui/public/private/__tests__/private.js b/src/legacy/ui/public/private/__tests__/private.js
deleted file mode 100644
index 1f9d696bb440f3..00000000000000
--- a/src/legacy/ui/public/private/__tests__/private.js
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-
-describe('Private module loader', function () {
-  let Private;
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function ($injector) {
-      Private = $injector.get('Private');
-    })
-  );
-
-  it('accepts a provider that will be called to init a module', function () {
-    const football = {};
-    function Provider() {
-      return football;
-    }
-
-    const instance = Private(Provider);
-    expect(instance).to.be(football);
-  });
-
-  it('injects angular dependencies into the Provider', function () {
-    function Provider(Private) {
-      return Private;
-    }
-
-    const instance = Private(Provider);
-    expect(instance).to.be(Private);
-  });
-
-  it('detects circular dependencies', function () {
-    expect(function () {
-      function Provider1() {
-        Private(Provider2);
-      }
-
-      function Provider2() {
-        Private(Provider1);
-      }
-
-      Private(Provider1);
-    }).to.throwException(/circular/i);
-  });
-
-  it('always provides the same instance form the Provider', function () {
-    function Provider() {
-      return {};
-    }
-
-    expect(Private(Provider)).to.be(Private(Provider));
-  });
-
-  describe('#stub', function () {
-    it('accepts a replacement instance for a Provider', function () {
-      const replaced = {};
-      const replacement = {};
-
-      function Provider() {
-        return replaced;
-      }
-
-      const instance = Private(Provider);
-      expect(instance).to.be(replaced);
-
-      Private.stub(Provider, replacement);
-
-      const instance2 = Private(Provider);
-      expect(instance2).to.be(replacement);
-
-      Private.stub(Provider, replaced);
-
-      const instance3 = Private(Provider);
-      expect(instance3).to.be(replaced);
-    });
-  });
-
-  describe('#swap', function () {
-    it('accepts a new Provider that should replace an existing Provider', function () {
-      function Provider1() {
-        return {};
-      }
-
-      function Provider2() {
-        return {};
-      }
-
-      const instance1 = Private(Provider1);
-      expect(instance1).to.be.an('object');
-
-      Private.swap(Provider1, Provider2);
-
-      const instance2 = Private(Provider1);
-      expect(instance2).to.be.an('object');
-      expect(instance2).to.not.be(instance1);
-
-      Private.swap(Provider1, Provider1);
-
-      const instance3 = Private(Provider1);
-      expect(instance3).to.be(instance1);
-    });
-
-    it('gives the new Provider access to the Provider it replaced via an injectable dependency called $decorate', function () {
-      function Provider1() {
-        return {};
-      }
-
-      function Provider2($decorate) {
-        return {
-          instance1: $decorate(),
-        };
-      }
-
-      const instance1 = Private(Provider1);
-      expect(instance1).to.be.an('object');
-
-      Private.swap(Provider1, Provider2);
-
-      const instance2 = Private(Provider1);
-      expect(instance2).to.have.property('instance1');
-      expect(instance2.instance1).to.be(instance1);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/private/index.d.ts b/src/legacy/ui/public/private/index.d.ts
deleted file mode 100644
index 3b692ba58cbe1f..00000000000000
--- a/src/legacy/ui/public/private/index.d.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { IPrivate } from '../../../../plugins/kibana_legacy/public/';
diff --git a/src/legacy/ui/public/private/index.js b/src/legacy/ui/public/private/index.js
deleted file mode 100644
index 3815f230df4664..00000000000000
--- a/src/legacy/ui/public/private/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import './private';
diff --git a/src/legacy/ui/public/private/private.js b/src/legacy/ui/public/private/private.js
deleted file mode 100644
index 7a0751959417ee..00000000000000
--- a/src/legacy/ui/public/private/private.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiModules } from '../modules';
-import { PrivateProvider } from '../../../../plugins/kibana_legacy/public';
-
-uiModules.get('kibana/private').provider('Private', PrivateProvider);
diff --git a/src/legacy/ui/public/promises/__tests__/promises.js b/src/legacy/ui/public/promises/__tests__/promises.js
deleted file mode 100644
index 7041aa2993376e..00000000000000
--- a/src/legacy/ui/public/promises/__tests__/promises.js
+++ /dev/null
@@ -1,277 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import sinon from 'sinon';
-
-describe('Promise service', () => {
-  let Promise;
-  let $rootScope;
-
-  const sandbox = sinon.createSandbox();
-  function tick(ms = 0) {
-    sandbox.clock.tick(ms);
-
-    // Ugly, but necessary for promises to resolve: https://github.com/angular/angular.js/issues/12555
-    $rootScope.$apply();
-  }
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(($injector) => {
-      sandbox.useFakeTimers();
-
-      Promise = $injector.get('Promise');
-      $rootScope = $injector.get('$rootScope');
-    })
-  );
-
-  afterEach(() => sandbox.restore());
-
-  describe('Constructor', () => {
-    it('provides resolve and reject function', () => {
-      const executor = sinon.stub();
-      new Promise(executor);
-
-      sinon.assert.calledOnce(executor);
-      sinon.assert.calledWithExactly(executor, sinon.match.func, sinon.match.func);
-    });
-  });
-
-  it('Promise.resolve', () => {
-    const onResolve = sinon.stub();
-    Promise.resolve(true).then(onResolve);
-
-    tick();
-
-    sinon.assert.calledOnce(onResolve);
-    sinon.assert.calledWithExactly(onResolve, true);
-  });
-
-  describe('Promise.fromNode', () => {
-    it('creates a callback that controls a promise', () => {
-      const callback = sinon.stub();
-      Promise.fromNode(callback);
-
-      tick();
-
-      sinon.assert.calledOnce(callback);
-      sinon.assert.calledWithExactly(callback, sinon.match.func);
-    });
-
-    it('rejects if the callback receives an error', () => {
-      const err = new Error();
-      const onReject = sinon.stub();
-      Promise.fromNode(sinon.stub().yields(err)).catch(onReject);
-
-      tick();
-
-      sinon.assert.calledOnce(onReject);
-      sinon.assert.calledWithExactly(onReject, sinon.match.same(err));
-    });
-
-    it('resolves with the second argument', () => {
-      const result = {};
-      const onResolve = sinon.stub();
-      Promise.fromNode(sinon.stub().yields(null, result)).then(onResolve);
-
-      tick();
-
-      sinon.assert.calledOnce(onResolve);
-      sinon.assert.calledWithExactly(onResolve, sinon.match.same(result));
-    });
-
-    it('resolves with an array if multiple arguments are received', () => {
-      const result1 = {};
-      const result2 = {};
-      const onResolve = sinon.stub();
-      Promise.fromNode(sinon.stub().yields(null, result1, result2)).then(onResolve);
-
-      tick();
-
-      sinon.assert.calledOnce(onResolve);
-      sinon.assert.calledWithExactly(onResolve, [
-        sinon.match.same(result1),
-        sinon.match.same(result2),
-      ]);
-    });
-
-    it('resolves with an array if multiple undefined are received', () => {
-      const onResolve = sinon.stub();
-      Promise.fromNode(sinon.stub().yields(null, undefined, undefined)).then(onResolve);
-
-      tick();
-
-      sinon.assert.calledOnce(onResolve);
-      sinon.assert.calledWithExactly(onResolve, [undefined, undefined]);
-    });
-  });
-
-  describe('Promise.race()', () => {
-    it(`resolves with the first resolved promise's value`, () => {
-      const p1 = new Promise((resolve) => setTimeout(resolve, 100, 1));
-      const p2 = new Promise((resolve) => setTimeout(resolve, 200, 2));
-      const onResolve = sinon.stub();
-      Promise.race([p1, p2]).then(onResolve);
-
-      tick(200);
-
-      sinon.assert.calledOnce(onResolve);
-      sinon.assert.calledWithExactly(onResolve, 1);
-    });
-
-    it(`rejects with the first rejected promise's rejection reason`, () => {
-      const p1Error = new Error('1');
-      const p1 = new Promise((r, reject) => setTimeout(reject, 200, p1Error));
-
-      const p2Error = new Error('2');
-      const p2 = new Promise((r, reject) => setTimeout(reject, 100, p2Error));
-
-      const onReject = sinon.stub();
-      Promise.race([p1, p2]).catch(onReject);
-
-      tick(200);
-
-      sinon.assert.calledOnce(onReject);
-      sinon.assert.calledWithExactly(onReject, sinon.match.same(p2Error));
-    });
-
-    it('does not wait for subsequent promises to resolve/reject', () => {
-      const onP1Resolve = sinon.stub();
-      const p1 = new Promise((resolve) => setTimeout(resolve, 100)).then(onP1Resolve);
-
-      const onP2Resolve = sinon.stub();
-      const p2 = new Promise((resolve) => setTimeout(resolve, 101)).then(onP2Resolve);
-
-      const onResolve = sinon.stub();
-      Promise.race([p1, p2]).then(onResolve);
-
-      tick(100);
-
-      sinon.assert.calledOnce(onResolve);
-      sinon.assert.calledOnce(onP1Resolve);
-      sinon.assert.callOrder(onP1Resolve, onResolve);
-      sinon.assert.notCalled(onP2Resolve);
-    });
-
-    it('allows non-promises in the array', () => {
-      const onResolve = sinon.stub();
-      Promise.race([1, 2, 3]).then(onResolve);
-
-      tick();
-
-      sinon.assert.calledOnce(onResolve);
-      sinon.assert.calledWithExactly(onResolve, 1);
-    });
-
-    describe('argument is undefined', () => {
-      it('rejects the promise', () => {
-        const football = {};
-        const onReject = sinon.stub();
-        Promise.race()
-          .catch(() => football)
-          .then(onReject);
-
-        tick();
-
-        sinon.assert.calledOnce(onReject);
-        sinon.assert.calledWithExactly(onReject, sinon.match.same(football));
-      });
-    });
-
-    describe('argument is a string', () => {
-      it(`resolves with the first character`, () => {
-        const onResolve = sinon.stub();
-        Promise.race('abc').then(onResolve);
-
-        tick();
-
-        sinon.assert.calledOnce(onResolve);
-        sinon.assert.calledWithExactly(onResolve, 'a');
-      });
-    });
-
-    describe('argument is a non-iterable object', () => {
-      it('reject the promise', () => {
-        const football = {};
-        const onReject = sinon.stub();
-        Promise.race({})
-          .catch(() => football)
-          .then(onReject);
-
-        tick();
-
-        sinon.assert.calledOnce(onReject);
-        sinon.assert.calledWithExactly(onReject, sinon.match.same(football));
-      });
-    });
-
-    describe('argument is a generator', () => {
-      it('resolves with the first resolved value', () => {
-        function* gen() {
-          yield new Promise((resolve) => setTimeout(resolve, 100, 1));
-          yield new Promise((resolve) => setTimeout(resolve, 200, 2));
-        }
-
-        const onResolve = sinon.stub();
-        Promise.race(gen()).then(onResolve);
-
-        tick(200);
-
-        sinon.assert.calledOnce(onResolve);
-        sinon.assert.calledWithExactly(onResolve, 1);
-      });
-
-      it('resolves with the first non-promise value', () => {
-        function* gen() {
-          yield 1;
-          yield new Promise((resolve) => setTimeout(resolve, 200, 2));
-        }
-
-        const onResolve = sinon.stub();
-        Promise.race(gen()).then(onResolve);
-
-        tick(200);
-
-        sinon.assert.calledOnce(onResolve);
-        sinon.assert.calledWithExactly(onResolve, 1);
-      });
-
-      it('iterates all values from the generator, even if one is already "resolved"', () => {
-        let yieldCount = 0;
-        function* gen() {
-          yieldCount += 1;
-          yield 1;
-          yieldCount += 1;
-          yield new Promise((resolve) => setTimeout(resolve, 200, 2));
-        }
-
-        const onResolve = sinon.stub();
-        Promise.race(gen()).then(onResolve);
-
-        tick(200);
-
-        sinon.assert.calledOnce(onResolve);
-        sinon.assert.calledWithExactly(onResolve, 1);
-        expect(yieldCount).to.be(2);
-      });
-    });
-  });
-});
diff --git a/src/legacy/ui/public/promises/defer.ts b/src/legacy/ui/public/promises/defer.ts
deleted file mode 100644
index 3d435f2ba8dfdf..00000000000000
--- a/src/legacy/ui/public/promises/defer.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export interface Defer<T> {
-  promise: Promise<T>;
-  resolve(value: T): void;
-  reject(reason: Error): void;
-}
-
-export function createDefer<T = unknown>(Class: typeof Promise): Defer<T> {
-  const defer: Partial<Defer<T>> = {};
-  defer.promise = new Class<T>((resolve, reject) => {
-    defer.resolve = resolve;
-    defer.reject = reject;
-  });
-  return defer as Defer<T>;
-}
diff --git a/src/legacy/ui/public/promises/index.ts b/src/legacy/ui/public/promises/index.ts
deleted file mode 100644
index 07bb2554c5eda6..00000000000000
--- a/src/legacy/ui/public/promises/index.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { PromiseServiceCreator } from '../../../../plugins/kibana_legacy/public';
-export { createDefer } from './defer';
-// @ts-ignore
-import { uiModules } from '../modules';
-
-const module = uiModules.get('kibana');
-// Provides a tiny subset of the excellent API from
-// bluebird, reimplemented using the $q service
-module.service('Promise', PromiseServiceCreator);
diff --git a/src/legacy/ui/public/react_components.js b/src/legacy/ui/public/react_components.js
deleted file mode 100644
index 21fb53d6407fa9..00000000000000
--- a/src/legacy/ui/public/react_components.js
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import 'ngreact';
-
-import { EuiIcon, EuiIconTip } from '@elastic/eui';
-
-import { uiModules } from './modules';
-
-const app = uiModules.get('app/kibana', ['react']);
-
-app.directive('icon', (reactDirective) => reactDirective(EuiIcon));
-
-app.directive('iconTip', (reactDirective) =>
-  reactDirective(EuiIconTip, ['content', 'type', 'position', 'title', 'color'])
-);
diff --git a/src/legacy/ui/public/registry/__tests__/registry.js b/src/legacy/ui/public/registry/__tests__/registry.js
deleted file mode 100644
index 10b2423abc0e3b..00000000000000
--- a/src/legacy/ui/public/registry/__tests__/registry.js
+++ /dev/null
@@ -1,168 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiRegistry } from '../_registry';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-
-describe('Registry', function () {
-  let Private;
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function ($injector) {
-      Private = $injector.get('Private');
-    })
-  );
-
-  it('is technically a function', function () {
-    const reg = uiRegistry();
-    expect(reg).to.be.a('function');
-  });
-
-  describe('#register', function () {
-    it('accepts a Private module', function () {
-      const reg = uiRegistry();
-      const mod = function SomePrivateModule() {};
-
-      reg.register(mod);
-      // modules are not exposed, so this is the most that we can test
-    });
-
-    it('applies the filter function if one is specified', function () {
-      const reg = uiRegistry({
-        filter: (item) => item.value % 2 === 0, // register only even numbers
-      });
-
-      reg.register(() => ({ value: 17 }));
-      reg.register(() => ({ value: 18 })); // only this one should get registered
-      reg.register(() => ({ value: 19 }));
-
-      const modules = Private(reg);
-      expect(modules).to.have.length(1);
-      expect(modules[0].value).to.be(18);
-    });
-  });
-
-  describe('as a module', function () {
-    it('exposes the list of registered modules', function () {
-      const reg = uiRegistry();
-      const mod = function SomePrivateModule(Private) {
-        this.PrivateModuleLoader = Private;
-      };
-
-      reg.register(mod);
-      const modules = Private(reg);
-      expect(modules).to.have.length(1);
-      expect(modules[0]).to.have.property('PrivateModuleLoader', Private);
-    });
-  });
-
-  describe('spec', function () {
-    it('executes with the module list as "this", and can override it', function () {
-      let self;
-
-      const reg = uiRegistry({
-        constructor: function () {
-          return { mods: (self = this) };
-        },
-      });
-
-      const modules = Private(reg);
-      expect(modules).to.be.an('object');
-      expect(modules).to.have.property('mods', self);
-    });
-  });
-
-  describe('spec.name', function () {
-    it('sets the displayName of the registry and the name param on the final instance', function () {
-      const reg = uiRegistry({
-        name: 'visTypes',
-      });
-
-      expect(reg).to.have.property('displayName', '[registry visTypes]');
-      expect(Private(reg)).to.have.property('name', 'visTypes');
-    });
-  });
-
-  describe('spec.constructor', function () {
-    it('executes before the modules are returned', function () {
-      let i = 0;
-
-      const reg = uiRegistry({
-        constructor: function () {
-          i = i + 1;
-        },
-      });
-
-      Private(reg);
-      expect(i).to.be(1);
-    });
-
-    it('executes with the module list as "this", and can override it', function () {
-      let self;
-
-      const reg = uiRegistry({
-        constructor: function () {
-          return { mods: (self = this) };
-        },
-      });
-
-      const modules = Private(reg);
-      expect(modules).to.be.an('object');
-      expect(modules).to.have.property('mods', self);
-    });
-  });
-
-  describe('spec.invokeProviders', () => {
-    it('is called with the registered providers and defines the initial set of values in the registry', () => {
-      const reg = uiRegistry({
-        invokeProviders(providers) {
-          return providers.map((i) => i * 1000);
-        },
-      });
-
-      reg.register(1);
-      reg.register(2);
-      reg.register(3);
-      expect(Private(reg).toJSON()).to.eql([1000, 2000, 3000]);
-    });
-    it('does not get assigned as a property of the registry', () => {
-      expect(
-        uiRegistry({
-          invokeProviders() {},
-        })
-      ).to.not.have.property('invokeProviders');
-    });
-  });
-
-  describe('spec[any]', function () {
-    it('mixes the extra properties into the module list', function () {
-      const reg = uiRegistry({
-        someMethod: function () {
-          return this;
-        },
-      });
-
-      const modules = Private(reg);
-      expect(modules).to.have.property('someMethod');
-      expect(modules.someMethod()).to.be(modules);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/registry/_registry.d.ts b/src/legacy/ui/public/registry/_registry.d.ts
deleted file mode 100644
index 42f1bb521763ca..00000000000000
--- a/src/legacy/ui/public/registry/_registry.d.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { IndexedArray, IndexedArrayConfig } from '../indexed_array';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-interface
-interface UIRegistry<T> extends IndexedArray<T> {}
-
-interface UIRegistrySpec<T> extends IndexedArrayConfig<T> {
-  name: string;
-  filter?(item: T): boolean;
-}
-
-/**
- * Creates a new UiRegistry (See js method for detailed documentation)
- * The generic type T is the type of objects which are stored in the registry.
- * The generic type A is an interface of accessors which depend on the
- * fields of the objects stored in the registry.
- * Example: if there is a string field "name" in type T, then A should be
- * `{ byName: { [typeName: string]: T }; }`
- */
-declare function uiRegistry<T, A = {}>(
-  spec: UIRegistrySpec<T>
-): { (): UIRegistry<T> & A; register<T>(privateModule: T): UIRegistry<T> & A };
diff --git a/src/legacy/ui/public/registry/_registry.js b/src/legacy/ui/public/registry/_registry.js
deleted file mode 100644
index 85aa1d9f2eca8f..00000000000000
--- a/src/legacy/ui/public/registry/_registry.js
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import { IndexedArray } from '../indexed_array';
-
-const notPropsOptNames = IndexedArray.OPT_NAMES.concat('constructor', 'invokeProviders');
-
-/**
- * Create a registry, which is just a Private module provider.
- *
- * The registry allows modifying the values it will provide
- * using the #register method.
- *
- * To access these modules, pass the registry to the Private
- * module loader.
- *
- * # Examples
- *
- * + register a module
- * ```js
- * let registry = require('ui/registry/vis_types');
- * registry.add(function InjectablePrivateModule($http, Promise) {
- *   ...
- * })
- * ```
- *
- * + get all registered modules
- * ```js
- * let visTypes = Private(RegistryVisTypesProvider);
- * ```
- *
- *
- * @param  {object} [spec] - an object describing the properties of
- *                         the registry to create. Any property specified
- *                         that is not listed below will be mixed into the
- *                         final IndexedArray object.
- *
- * # init
- * @param {Function} [spec.constructor] - an injectable function that is called when
- *                                      the registry is first instantiated by the app.
- * @param {boolean} [spec.filter] - function that will be used to filter items before
- *                                registering them. Function will called on each item and
- *                                should return true to keep the item (register it) or
- *                                skip it (don't register it)
- *
- * # IndexedArray params
- * @param {array[String]} [spec.index] - passed to the IndexedArray constructor
- * @param {array[String]} [spec.group] - passed to the IndexedArray constructor
- * @param {array[String]} [spec.order] - passed to the IndexedArray constructor
- * @param {array[String]} [spec.initialSet] - passed to the IndexedArray constructor
- * @param {array[String]} [spec.immutable] - passed to the IndexedArray constructor
- *
- * @return {[type]}      [description]
- */
-export function uiRegistry(spec) {
-  spec = spec || {};
-
-  const constructor = _.has(spec, 'constructor') && spec.constructor;
-  const filter = _.has(spec, 'filter') && spec.filter;
-  const invokeProviders = _.has(spec, 'invokeProviders') && spec.invokeProviders;
-  const iaOpts = _.defaults(_.pick(spec, IndexedArray.OPT_NAMES), { index: ['name'] });
-  const props = _.omit(spec, notPropsOptNames);
-  const providers = [];
-
-  let isInstantiated = false;
-  let getInvokedProviders;
-  let modules;
-
-  /**
-   * This is the Private module that will be instantiated by
-   *
-   * @tag:PrivateModule
-   * @return {IndexedArray} - an indexed array containing the values
-   *                          that were registered, the registry spec
-   *                          defines how things will be indexed.
-   */
-  const registry = function (Private, $injector) {
-    getInvokedProviders = function (newProviders) {
-      let set = invokeProviders
-        ? $injector.invoke(invokeProviders, undefined, { providers: newProviders })
-        : newProviders.map(Private);
-
-      if (filter && _.isFunction(filter)) {
-        set = set.filter((item) => filter(item));
-      }
-
-      return set;
-    };
-
-    iaOpts.initialSet = getInvokedProviders(providers);
-
-    modules = new IndexedArray(iaOpts);
-
-    // mixin other props
-    _.assign(modules, props);
-
-    // construct
-    if (constructor) {
-      modules = $injector.invoke(constructor, modules) || modules;
-    }
-
-    isInstantiated = true;
-
-    return modules;
-  };
-
-  registry.displayName = '[registry ' + props.name + ']';
-
-  registry.register = function (privateModule) {
-    providers.push(privateModule);
-
-    if (isInstantiated) {
-      const [provider] = getInvokedProviders([privateModule]);
-
-      if (provider) {
-        modules.push(provider);
-      }
-    }
-
-    return registry;
-  };
-
-  return registry;
-}
diff --git a/src/legacy/ui/public/registry/chrome_header_nav_controls.ts b/src/legacy/ui/public/registry/chrome_header_nav_controls.ts
deleted file mode 100644
index 7e6c80692cd634..00000000000000
--- a/src/legacy/ui/public/registry/chrome_header_nav_controls.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { IndexedArray } from '../indexed_array';
-import { uiRegistry, UIRegistry } from './_registry';
-
-interface ChromeHeaderNavControlsRegistryAccessors {
-  bySide: { [typeName: string]: IndexedArray<NavControl> };
-}
-
-export enum NavControlSide {
-  Left = 'left',
-  Right = 'right',
-}
-
-export interface NavControl {
-  name: string;
-  order: number;
-  side: NavControlSide;
-  render: (targetDomElement: HTMLDivElement) => () => void;
-}
-
-export type ChromeHeaderNavControlsRegistry = UIRegistry<NavControl> &
-  ChromeHeaderNavControlsRegistryAccessors;
-
-export const chromeHeaderNavControlsRegistry = uiRegistry<
-  NavControl,
-  ChromeHeaderNavControlsRegistryAccessors
->({
-  name: 'chromeHeaderNavControls',
-  order: ['order'],
-  group: ['side'],
-});
diff --git a/src/legacy/ui/public/registry/field_format_editors.ts b/src/legacy/ui/public/registry/field_format_editors.ts
deleted file mode 100644
index 5489ce9250e043..00000000000000
--- a/src/legacy/ui/public/registry/field_format_editors.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiRegistry } from './_registry';
-
-export const RegistryFieldFormatEditorsProvider = uiRegistry({
-  name: 'fieldFormatEditors',
-  index: ['formatId'],
-});
diff --git a/src/legacy/ui/public/routes/__tests__/_route_manager.js b/src/legacy/ui/public/routes/__tests__/_route_manager.js
deleted file mode 100644
index eb47a3e9ace709..00000000000000
--- a/src/legacy/ui/public/routes/__tests__/_route_manager.js
+++ /dev/null
@@ -1,218 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import ngMock from 'ng_mock';
-import sinon from 'sinon';
-import RouteManager from '../route_manager';
-import expect from '@kbn/expect';
-
-let routes; // will contain an new instance of RouteManager for each test
-const chainableMethods = [
-  { name: 'when', args: ['', {}] },
-  { name: 'otherwise', args: [{}] },
-  { name: 'defaults', args: [/regexp/, {}] },
-];
-
-let $rp;
-describe('routes/route_manager', function () {
-  beforeEach(
-    ngMock.module('kibana', function ($routeProvider) {
-      $rp = $routeProvider;
-      sinon.stub($rp, 'otherwise');
-      sinon.stub($rp, 'when');
-    })
-  );
-
-  beforeEach(
-    ngMock.inject(function () {
-      routes = new RouteManager();
-    })
-  );
-
-  it('should have chainable methods: ' + _.map(chainableMethods, 'name').join(', '), function () {
-    chainableMethods.forEach(function (meth) {
-      expect(routes[meth.name].apply(routes, _.clone(meth.args))).to.be(routes);
-    });
-  });
-
-  describe('#otherwise', function () {
-    it('should forward the last otherwise route', function () {
-      const otherRoute = {};
-      routes.otherwise({});
-      routes.otherwise(otherRoute);
-
-      routes.config($rp);
-
-      expect($rp.otherwise.callCount).to.be(1);
-      expect($rp.otherwise.getCall(0).args[0]).to.be(otherRoute);
-    });
-  });
-
-  describe('#when', function () {
-    it('should merge the additions into the when() defined routes', function () {
-      routes.when('/some/route');
-      routes.when('/some/other/route');
-
-      // add the addition resolve to every route
-      routes.defaults(/.*/, {
-        resolve: {
-          addition: function () {},
-        },
-      });
-
-      routes.config($rp);
-
-      // should have run once for each when route
-      expect($rp.when.callCount).to.be(2);
-      expect($rp.otherwise.callCount).to.be(0);
-
-      // every route should have the "addition" resolve
-      expect($rp.when.getCall(0).args[1].resolve.addition).to.be.a('function');
-      expect($rp.when.getCall(1).args[1].resolve.addition).to.be.a('function');
-    });
-  });
-
-  describe('#config', function () {
-    it('should add defined routes to the global $routeProvider service in order', function () {
-      const args = [
-        ['/one', {}],
-        ['/two', {}],
-      ];
-
-      args.forEach(function (a) {
-        routes.when(a[0], a[1]);
-      });
-
-      routes.config($rp);
-
-      expect($rp.when.callCount).to.be(args.length);
-      _.times(args.length, function (i) {
-        const call = $rp.when.getCall(i);
-        const a = args.shift();
-
-        expect(call.args[0]).to.be(a[0]);
-        expect(call.args[1]).to.be(a[1]);
-      });
-    });
-
-    it('sets route.reloadOnSearch to false by default', function () {
-      routes.when('/nothing-set');
-      routes.when('/no-reload', { reloadOnSearch: false });
-      routes.when('/always-reload', { reloadOnSearch: true });
-      routes.config($rp);
-
-      expect($rp.when.callCount).to.be(3);
-      expect($rp.when.firstCall.args[1]).to.have.property('reloadOnSearch', false);
-      expect($rp.when.secondCall.args[1]).to.have.property('reloadOnSearch', false);
-      expect($rp.when.lastCall.args[1]).to.have.property('reloadOnSearch', true);
-    });
-  });
-
-  describe('#defaults()', () => {
-    it('adds defaults to routes with matching paths', () => {
-      routes.when('/foo', { name: 'foo' });
-      routes.when('/bar', { name: 'bar' });
-      routes.when('/baz', { name: 'baz' });
-      routes.defaults(/^\/ba/, {
-        withDefaults: true,
-      });
-      routes.config($rp);
-
-      sinon.assert.calledWithExactly(
-        $rp.when,
-        '/foo',
-        sinon.match({ name: 'foo', withDefaults: undefined })
-      );
-      sinon.assert.calledWithExactly(
-        $rp.when,
-        '/bar',
-        sinon.match({ name: 'bar', withDefaults: true })
-      );
-      sinon.assert.calledWithExactly(
-        $rp.when,
-        '/baz',
-        sinon.match({ name: 'baz', withDefaults: true })
-      );
-    });
-
-    it('does not override values specified in the route', () => {
-      routes.when('/foo', { name: 'foo' });
-      routes.defaults(/./, { name: 'bar' });
-      routes.config($rp);
-
-      sinon.assert.calledWithExactly($rp.when, '/foo', sinon.match({ name: 'foo' }));
-    });
-
-    // See https://github.com/elastic/kibana/issues/13294
-    it('does not assign defaults by reference, to prevent accidentally merging unrelated defaults together', () => {
-      routes.when('/foo', { name: 'foo' });
-      routes.when('/bar', { name: 'bar' });
-      routes.when('/baz', { name: 'baz', funcs: { bazFunc() {} } });
-
-      // multiple defaults must be defined that, when applied correctly, will
-      // create a new object property on all routes that is unique to all of them
-      routes.defaults(/./, { funcs: { all() {} } });
-      routes.defaults(/^\/foo/, { funcs: { fooFunc() {} } });
-      routes.defaults(/^\/bar/, { funcs: { barFunc() {} } });
-      routes.config($rp);
-
-      sinon.assert.calledThrice($rp.when);
-      sinon.assert.calledWithExactly(
-        $rp.when,
-        '/foo',
-        sinon.match({
-          name: 'foo',
-          funcs: sinon.match({
-            all: sinon.match.func,
-            fooFunc: sinon.match.func,
-            barFunc: undefined,
-            bazFunc: undefined,
-          }),
-        })
-      );
-      sinon.assert.calledWithExactly(
-        $rp.when,
-        '/bar',
-        sinon.match({
-          name: 'bar',
-          funcs: sinon.match({
-            all: sinon.match.func,
-            fooFunc: undefined,
-            barFunc: sinon.match.func,
-            bazFunc: undefined,
-          }),
-        })
-      );
-      sinon.assert.calledWithExactly(
-        $rp.when,
-        '/baz',
-        sinon.match({
-          name: 'baz',
-          funcs: sinon.match({
-            all: sinon.match.func,
-            fooFunc: undefined,
-            barFunc: undefined,
-            bazFunc: sinon.match.func,
-          }),
-        })
-      );
-    });
-  });
-});
diff --git a/src/legacy/ui/public/routes/__tests__/_work_queue.js b/src/legacy/ui/public/routes/__tests__/_work_queue.js
deleted file mode 100644
index 72891f7321fbd7..00000000000000
--- a/src/legacy/ui/public/routes/__tests__/_work_queue.js
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import { WorkQueue } from '../work_queue';
-import sinon from 'sinon';
-import { createDefer } from 'ui/promises';
-
-describe('work queue', function () {
-  let queue;
-  let Promise;
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function (_Promise_) {
-      Promise = _Promise_;
-    })
-  );
-  beforeEach(function () {
-    queue = new WorkQueue();
-  });
-  afterEach(function () {
-    queue.empty();
-  });
-
-  describe('#push', function () {
-    it('adds to the interval queue', function () {
-      queue.push(createDefer(Promise));
-      expect(queue).to.have.length(1);
-    });
-  });
-
-  describe('#resolveWhenFull', function () {
-    it('resolves requests waiting for the queue to fill when appropriate', function () {
-      const size = _.random(5, 50);
-      queue.limit = size;
-
-      const whenFull = createDefer(Promise);
-      sinon.stub(whenFull, 'resolve');
-      queue.resolveWhenFull(whenFull);
-
-      // push all but one into the queue
-      _.times(size - 1, function () {
-        queue.push(createDefer(Promise));
-      });
-
-      expect(whenFull.resolve.callCount).to.be(0);
-      queue.push(createDefer(Promise));
-      expect(whenFull.resolve.callCount).to.be(1);
-
-      queue.empty();
-    });
-  });
-
-  /**
-   * Fills the queue with a random number of work defers, but stubs all defer methods
-   * with the same stub and passed it back.
-   *
-   * @param  {function} then - called with then(size, stub) so that the test
-   *                         can manipulate the filled queue
-   */
-  function fillWithStubs(then) {
-    const size = _.random(5, 50);
-    const stub = sinon.stub();
-
-    _.times(size, function () {
-      const d = createDefer(Promise);
-      // overwrite the defer methods with the stub
-      d.resolve = stub;
-      d.reject = stub;
-      queue.push(d);
-    });
-
-    then(size, stub);
-  }
-
-  describe('#doWork', function () {
-    it('flushes the queue and resolves all promises', function () {
-      fillWithStubs(function (size, stub) {
-        expect(queue).to.have.length(size);
-        queue.doWork();
-        expect(queue).to.have.length(0);
-        expect(stub.callCount).to.be(size);
-      });
-    });
-  });
-
-  describe('#empty()', function () {
-    it('empties the internal queue WITHOUT resolving any promises', function () {
-      fillWithStubs(function (size, stub) {
-        expect(queue).to.have.length(size);
-        queue.empty();
-        expect(queue).to.have.length(0);
-        expect(stub.callCount).to.be(0);
-      });
-    });
-  });
-});
diff --git a/src/legacy/ui/public/routes/__tests__/_wrap_route_with_prep.js b/src/legacy/ui/public/routes/__tests__/_wrap_route_with_prep.js
deleted file mode 100644
index 8ae85fce591a11..00000000000000
--- a/src/legacy/ui/public/routes/__tests__/_wrap_route_with_prep.js
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import RouteManager from '../route_manager';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-
-import _ from 'lodash';
-import '../../private';
-
-let routes;
-
-describe('wrapRouteWithPrep fn', function () {
-  require('test_utils/no_digest_promises').activateForSuite();
-
-  beforeEach(function () {
-    routes = new RouteManager();
-  });
-
-  const SchedulingTest = function (opts) {
-    opts = opts || {};
-
-    const delaySetup = opts.delayUserWork ? 0 : 50;
-    const delayUserWork = opts.delayUserWork ? 50 : 0;
-
-    return function () {
-      ngMock.module('kibana');
-      let setupComplete = false;
-      let userWorkComplete = false;
-      let route;
-      let Promise;
-      let $injector;
-
-      ngMock.inject(function (_Promise_, _$injector_) {
-        Promise = _Promise_;
-        $injector = _$injector_;
-      });
-
-      routes.addSetupWork(function () {
-        return new Promise(function (resolve) {
-          setTimeout(function () {
-            setupComplete = true;
-            resolve();
-          }, delaySetup);
-        });
-      });
-
-      routes
-        .when('/', {
-          resolve: {
-            test: function () {
-              expect(setupComplete).to.be(true);
-              userWorkComplete = true;
-            },
-          },
-        })
-        .config({
-          when: function (p, _r) {
-            route = _r;
-          },
-        });
-
-      return new Promise(function (resolve, reject) {
-        setTimeout(function () {
-          Promise.all(
-            _.map(route.resolve, function (fn) {
-              return $injector.invoke(fn);
-            })
-          )
-            .then(function () {
-              expect(setupComplete).to.be(true);
-              expect(userWorkComplete).to.be(true);
-            })
-            .then(resolve, reject);
-        }, delayUserWork);
-      });
-    };
-  };
-
-  it('always waits for setup to complete before calling user work', new SchedulingTest());
-
-  it('does not call user work when setup fails', new SchedulingTest({ failSetup: true }));
-
-  it(
-    'calls all user work even if it is not initialized until after setup is complete',
-    new SchedulingTest({
-      delayUserWork: false,
-    })
-  );
-});
diff --git a/src/legacy/ui/public/routes/__tests__/index.js b/src/legacy/ui/public/routes/__tests__/index.js
deleted file mode 100644
index 30cedaaca3d19f..00000000000000
--- a/src/legacy/ui/public/routes/__tests__/index.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import './_route_manager';
-import './_work_queue';
-import './_wrap_route_with_prep';
-describe('Custom Route Management', function () {});
diff --git a/src/legacy/ui/public/routes/breadcrumbs.js b/src/legacy/ui/public/routes/breadcrumbs.js
deleted file mode 100644
index 7917ffbd7c6e61..00000000000000
--- a/src/legacy/ui/public/routes/breadcrumbs.js
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { trim, startCase } from 'lodash';
-
-/**
- *  Take a path (from $location.path() usually) and parse
- *  it's segments into a list of breadcrumbs
- *
- *  @param  {string} path
- *  @return {Array<Breadcrumb>}
- */
-export function parsePathToBreadcrumbs(path) {
-  return trim(path, '/')
-    .split('/')
-    .reduce(
-      (acc, id, i, parts) => [
-        ...acc,
-        {
-          id,
-          display: startCase(id),
-          href: i === 0 ? `#/${id}` : `${acc[i - 1].href}/${id}`,
-          current: i === parts.length - 1,
-        },
-      ],
-      []
-    );
-}
diff --git a/src/legacy/ui/public/routes/index.d.ts b/src/legacy/ui/public/routes/index.d.ts
deleted file mode 100644
index 84e17b0a69452d..00000000000000
--- a/src/legacy/ui/public/routes/index.d.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiRoutes, UIRoutes } from 'ui/routes/routes';
-
-// eslint-disable-next-line import/no-default-export
-export default uiRoutes;
-export { UIRoutes };
diff --git a/src/legacy/ui/public/routes/index.js b/src/legacy/ui/public/routes/index.js
deleted file mode 100644
index 9c826ebee12302..00000000000000
--- a/src/legacy/ui/public/routes/index.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { uiRoutes } from './routes';
-
-// eslint-disable-next-line import/no-default-export
-export default uiRoutes;
diff --git a/src/legacy/ui/public/routes/route_manager.d.ts b/src/legacy/ui/public/routes/route_manager.d.ts
deleted file mode 100644
index a5261a7c8ee3a8..00000000000000
--- a/src/legacy/ui/public/routes/route_manager.d.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * WARNING: these types are incomplete
- */
-
-import { ChromeBreadcrumb } from '../../../../core/public';
-
-export interface RouteConfiguration {
-  controller?: string | ((...args: any[]) => void);
-  redirectTo?: string;
-  resolveRedirectTo?: (...args: any[]) => void;
-  reloadOnSearch?: boolean;
-  reloadOnUrl?: boolean;
-  outerAngularWrapperRoute?: boolean;
-  resolve?: object;
-  template?: string;
-  k7Breadcrumbs?: (...args: any[]) => ChromeBreadcrumb[];
-  requireUICapability?: string;
-}
-
-interface RouteManager {
-  addSetupWork(cb: (...args: any[]) => void): void;
-  when(path: string, routeConfiguration: RouteConfiguration): RouteManager;
-  otherwise(routeConfiguration: RouteConfiguration): RouteManager;
-  defaults(path: string | RegExp, defaults: RouteConfiguration): RouteManager;
-}
-
-// eslint-disable-next-line import/no-default-export
-export default RouteManager;
diff --git a/src/legacy/ui/public/routes/route_manager.js b/src/legacy/ui/public/routes/route_manager.js
deleted file mode 100644
index de8a541d1c50a8..00000000000000
--- a/src/legacy/ui/public/routes/route_manager.js
+++ /dev/null
@@ -1,115 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { cloneDeep, defaultsDeep, wrap } from 'lodash';
-
-import { wrapRouteWithPrep } from './wrap_route_with_prep';
-import { RouteSetupManager } from './route_setup_manager';
-import { parsePathToBreadcrumbs } from './breadcrumbs';
-
-// eslint-disable-next-line import/no-default-export
-export default function RouteManager() {
-  const self = this;
-  const setup = new RouteSetupManager();
-  const when = [];
-  const defaults = [];
-  let otherwise;
-
-  self.config = function ($routeProvider) {
-    when.forEach(function (args) {
-      const path = args[0];
-      const route = args[1] || {};
-
-      defaults.forEach((def) => {
-        if (def.regex.test(path)) {
-          defaultsDeep(route, cloneDeep(def.value));
-        }
-      });
-
-      if (route.reloadOnSearch == null) {
-        route.reloadOnSearch = false;
-      }
-
-      wrapRouteWithPrep(route, setup);
-      $routeProvider.when(path, route);
-    });
-
-    if (otherwise) {
-      wrapRouteWithPrep(otherwise, setup);
-      $routeProvider.otherwise(otherwise);
-    }
-  };
-
-  self.run = function ($location, $route, $injector, $rootScope) {
-    if (window.elasticApm && typeof window.elasticApm.startTransaction === 'function') {
-      /**
-       * capture route-change events as transactions which happens after
-       * the browser's on load event.
-       *
-       * In Kibana app, this logic would run after the boostrap js files gets
-       * downloaded and get associated with the page-load transaction
-       */
-      $rootScope.$on('$routeChangeStart', (_, nextRoute) => {
-        if (nextRoute.$$route) {
-          const name = nextRoute.$$route.originalPath;
-          window.elasticApm.startTransaction(name, 'route-change');
-        }
-      });
-    }
-
-    self.getBreadcrumbs = () => {
-      const breadcrumbs = parsePathToBreadcrumbs($location.path());
-      const map = $route.current.mapBreadcrumbs;
-      return map ? $injector.invoke(map, null, { breadcrumbs }) : breadcrumbs;
-    };
-  };
-
-  const wrapSetupAndChain = (fn, ...args) => {
-    fn.apply(setup, args);
-    return this;
-  };
-
-  this.addSetupWork = wrap(setup.addSetupWork, wrapSetupAndChain);
-  this.afterSetupWork = wrap(setup.afterSetupWork, wrapSetupAndChain);
-  this.afterWork = wrap(setup.afterWork, wrapSetupAndChain);
-
-  self.when = function (path, route) {
-    when.push([path, route]);
-    return self;
-  };
-
-  // before attaching the routes to the routeProvider, test the RE
-  // against the .when() path and add/override the resolves if there is a match
-  self.defaults = function (regex, value) {
-    defaults.push({ regex, value });
-    return self;
-  };
-
-  self.otherwise = function (route) {
-    otherwise = route;
-    return self;
-  };
-
-  self.getBreadcrumbs = function () {
-    // overwritten in self.run();
-    return [];
-  };
-
-  self.RouteManager = RouteManager;
-}
diff --git a/src/legacy/ui/public/routes/route_setup_manager.js b/src/legacy/ui/public/routes/route_setup_manager.js
deleted file mode 100644
index a7a2f078f40fb7..00000000000000
--- a/src/legacy/ui/public/routes/route_setup_manager.js
+++ /dev/null
@@ -1,112 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import { createDefer } from 'ui/promises';
-
-// Throw this inside of an Angular route resolver after calling `kbnUrl.change`
-// so that the $router can observe the $location update. Otherwise, the location
-// route setup work will resolve before the route update occurs.
-export const WAIT_FOR_URL_CHANGE_TOKEN = new Error('WAIT_FOR_URL_CHANGE_TOKEN');
-
-export class RouteSetupManager {
-  constructor() {
-    this.setupWork = [];
-    this.onSetupComplete = [];
-    this.onSetupError = [];
-    this.onWorkComplete = [];
-    this.onWorkError = [];
-  }
-
-  addSetupWork(fn) {
-    this.setupWork.push(fn);
-  }
-
-  afterSetupWork(onComplete, onError) {
-    this.onSetupComplete.push(onComplete);
-    this.onSetupError.push(onError);
-  }
-
-  afterWork(onComplete, onError) {
-    this.onWorkComplete.push(onComplete);
-    this.onWorkError.push(onError);
-  }
-
-  /**
-   * Do each setupWork function by injecting it with angular dependencies
-   * and accepting promises from it.
-   * @return {[type]} [description]
-   */
-  doWork(Promise, $injector, userWork) {
-    const invokeEach = (arr, locals) => {
-      return Promise.map(arr, (fn) => {
-        if (!fn) return;
-        return $injector.invoke(fn, null, locals);
-      });
-    };
-
-    // call each error handler in order, until one of them resolves
-    // or we run out of handlers
-    const callErrorHandlers = (handlers, origError) => {
-      if (!_.size(handlers)) throw origError;
-
-      // clone so we don't discard handlers or loose them
-      handlers = handlers.slice(0);
-
-      const next = (err) => {
-        if (!handlers.length) throw err;
-
-        const handler = handlers.shift();
-        if (!handler) return next(err);
-
-        return Promise.try(function () {
-          return $injector.invoke(handler, null, { err });
-        }).catch(next);
-      };
-
-      return next(origError);
-    };
-
-    return invokeEach(this.setupWork)
-      .then(
-        () => invokeEach(this.onSetupComplete),
-        (err) => callErrorHandlers(this.onSetupError, err)
-      )
-      .then(() => {
-        // wait for the queue to fill up, then do all the work
-        const defer = createDefer(Promise);
-        userWork.resolveWhenFull(defer);
-
-        return defer.promise.then(() => Promise.all(userWork.doWork()));
-      })
-      .catch((error) => {
-        if (error === WAIT_FOR_URL_CHANGE_TOKEN) {
-          // prevent moving forward, return a promise that never resolves
-          // so that the $router can observe the $location update
-          return Promise.halt();
-        }
-
-        throw error;
-      })
-      .then(
-        () => invokeEach(this.onWorkComplete),
-        (err) => callErrorHandlers(this.onWorkError, err)
-      );
-  }
-}
diff --git a/src/legacy/ui/public/routes/routes.d.ts b/src/legacy/ui/public/routes/routes.d.ts
deleted file mode 100644
index d48230e9d56f92..00000000000000
--- a/src/legacy/ui/public/routes/routes.d.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import RouteManager from 'ui/routes/route_manager';
-
-interface DefaultRouteManager extends RouteManager {
-  WAIT_FOR_URL_CHANGE_TOKEN: string;
-  enable(): void;
-}
-
-export const uiRoutes: DefaultRouteManager;
-export type UIRoutes = DefaultRouteManager;
diff --git a/src/legacy/ui/public/routes/routes.js b/src/legacy/ui/public/routes/routes.js
deleted file mode 100644
index 2cfb7a608e853b..00000000000000
--- a/src/legacy/ui/public/routes/routes.js
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import RouteManager from './route_manager';
-import 'angular-route/angular-route';
-import { uiModules } from '../modules';
-import { WAIT_FOR_URL_CHANGE_TOKEN } from './route_setup_manager';
-const defaultRouteManager = new RouteManager();
-
-export const uiRoutes = Object.create(defaultRouteManager, {
-  WAIT_FOR_URL_CHANGE_TOKEN: {
-    value: WAIT_FOR_URL_CHANGE_TOKEN,
-  },
-
-  enable: {
-    value() {
-      uiModules
-        .get('kibana', ['ngRoute'])
-        .config(defaultRouteManager.config)
-        .run(defaultRouteManager.run);
-    },
-  },
-});
diff --git a/src/legacy/ui/public/routes/work_queue.js b/src/legacy/ui/public/routes/work_queue.js
deleted file mode 100644
index 5c4c83663c5902..00000000000000
--- a/src/legacy/ui/public/routes/work_queue.js
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export function WorkQueue() {
-  const q = this;
-
-  const work = [];
-  const fullDefers = [];
-
-  q.limit = 0;
-  Object.defineProperty(q, 'length', {
-    get: function () {
-      return work.length;
-    },
-  });
-
-  const resolve = function (defers) {
-    return defers.splice(0).map(function (defer) {
-      return defer.resolve();
-    });
-  };
-
-  const checkIfFull = function () {
-    if (work.length >= q.limit && fullDefers.length) {
-      resolve(fullDefers);
-    }
-  };
-
-  q.resolveWhenFull = function (defer) {
-    fullDefers.push(defer);
-    checkIfFull();
-  };
-
-  q.doWork = function () {
-    const resps = resolve(work);
-    checkIfFull();
-    return resps;
-  };
-
-  q.empty = function () {
-    work.splice(0);
-    checkIfFull();
-  };
-
-  q.push = function (defer) {
-    work.push(defer);
-    checkIfFull();
-  };
-}
diff --git a/src/legacy/ui/public/routes/wrap_route_with_prep.js b/src/legacy/ui/public/routes/wrap_route_with_prep.js
deleted file mode 100644
index e9ed33148d9acf..00000000000000
--- a/src/legacy/ui/public/routes/wrap_route_with_prep.js
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import angular from 'angular';
-import _ from 'lodash';
-import { createDefer } from 'ui/promises';
-import { WorkQueue } from './work_queue';
-
-export function wrapRouteWithPrep(route, setup) {
-  if (!route.resolve && route.redirectTo) return;
-
-  const userWork = new WorkQueue();
-  // the point at which we will consider the queue "full"
-  userWork.limit = _.keys(route.resolve).length;
-
-  const resolve = {
-    __prep__: function ($injector) {
-      return $injector.invoke(setup.doWork, setup, { userWork });
-    },
-  };
-
-  // send each user resolve to the userWork queue, which will prevent it from running before the
-  // prep is complete
-  _.forOwn(route.resolve || {}, function (expr, name) {
-    resolve[name] = function ($injector, Promise) {
-      const defer = createDefer(Promise);
-      userWork.push(defer);
-      return defer.promise.then(function () {
-        return $injector[angular.isString(expr) ? 'get' : 'invoke'](expr);
-      });
-    };
-  });
-
-  // we're copied everything over so now overwrite
-  route.resolve = resolve;
-}
diff --git a/src/legacy/ui/public/state_management/__tests__/app_state.js b/src/legacy/ui/public/state_management/__tests__/app_state.js
deleted file mode 100644
index c47fa3bb0417f4..00000000000000
--- a/src/legacy/ui/public/state_management/__tests__/app_state.js
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import { AppStateProvider } from '../app_state';
-
-describe('State Management', function () {
-  let $rootScope;
-  let AppState;
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function (_$rootScope_, _$location_, Private) {
-      $rootScope = _$rootScope_;
-      AppState = Private(AppStateProvider);
-    })
-  );
-
-  describe('App State', function () {
-    let appState;
-
-    beforeEach(function () {
-      appState = new AppState();
-    });
-
-    it('should have _urlParam of _a', function () {
-      expect(appState).to.have.property('_urlParam');
-      expect(appState._urlParam).to.equal('_a');
-    });
-
-    it('should use passed in params', function () {
-      const params = {
-        test: true,
-        mock: false,
-      };
-
-      appState = new AppState(params);
-      expect(appState).to.have.property('_defaults');
-
-      Object.keys(params).forEach(function (key) {
-        expect(appState._defaults).to.have.property(key);
-        expect(appState._defaults[key]).to.equal(params[key]);
-      });
-    });
-
-    it('should have a destroy method', function () {
-      expect(appState).to.have.property('destroy');
-    });
-
-    it('should be destroyed on $routeChangeStart', function () {
-      const destroySpy = sinon.spy(appState, 'destroy');
-
-      $rootScope.$emit('$routeChangeStart');
-
-      expect(destroySpy.callCount).to.be(1);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/state_management/__tests__/config_provider.js b/src/legacy/ui/public/state_management/__tests__/config_provider.js
deleted file mode 100644
index 9f756bc51dcb0b..00000000000000
--- a/src/legacy/ui/public/state_management/__tests__/config_provider.js
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import '../config_provider';
-
-describe('State Management Config', function () {
-  let stateManagementConfig;
-
-  describe('is enabled', () => {
-    beforeEach(ngMock.module('kibana'));
-    beforeEach(
-      ngMock.inject(function (_stateManagementConfig_) {
-        stateManagementConfig = _stateManagementConfig_;
-      })
-    );
-
-    it('should be enabled by default', () => {
-      expect(stateManagementConfig.enabled).to.be(true);
-    });
-  });
-
-  describe('can be disabled', () => {
-    beforeEach(
-      ngMock.module('kibana', function (stateManagementConfigProvider) {
-        stateManagementConfigProvider.disable();
-      })
-    );
-
-    beforeEach(
-      ngMock.inject(function (_stateManagementConfig_) {
-        stateManagementConfig = _stateManagementConfig_;
-      })
-    );
-
-    it('is disabled by config', () => {
-      expect(stateManagementConfig.enabled).to.be(false);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/state_management/__tests__/global_state.js b/src/legacy/ui/public/state_management/__tests__/global_state.js
deleted file mode 100644
index e9dae5880a8d13..00000000000000
--- a/src/legacy/ui/public/state_management/__tests__/global_state.js
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import '../global_state';
-
-describe('State Management', function () {
-  let $location;
-  let state;
-
-  beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(function (_$location_, globalState) {
-      $location = _$location_;
-      state = globalState;
-    })
-  );
-
-  describe('Global State', function () {
-    it('should use previous state when not in URL', function () {
-      // set satte via URL
-      $location.search({ _g: '(foo:(bar:baz))' });
-      state.fetch();
-      expect(state.toObject()).to.eql({ foo: { bar: 'baz' } });
-
-      $location.search({ _g: '(fizz:buzz)' });
-      state.fetch();
-      expect(state.toObject()).to.eql({ fizz: 'buzz' });
-
-      $location.search({});
-      state.fetch();
-      expect(state.toObject()).to.eql({ fizz: 'buzz' });
-    });
-  });
-});
diff --git a/src/legacy/ui/public/state_management/__tests__/state.js b/src/legacy/ui/public/state_management/__tests__/state.js
deleted file mode 100644
index b6c705e8145094..00000000000000
--- a/src/legacy/ui/public/state_management/__tests__/state.js
+++ /dev/null
@@ -1,393 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import { encode as encodeRison } from 'rison-node';
-import uiRoutes from 'ui/routes';
-import '../../private';
-import { toastNotifications } from '../../notify';
-import * as FatalErrorNS from '../../notify/fatal_error';
-import { StateProvider } from '../state';
-import {
-  unhashQuery,
-  createStateHash,
-  isStateHash,
-  HashedItemStore,
-} from '../../../../../plugins/kibana_utils/public';
-import { StubBrowserStorage } from 'test_utils/stub_browser_storage';
-import { EventsProvider } from '../../events';
-
-describe('State Management', () => {
-  const sandbox = sinon.createSandbox();
-  afterEach(() => sandbox.restore());
-
-  uiRoutes.enable();
-
-  describe('Enabled', () => {
-    let $rootScope;
-    let $location;
-    let Events;
-    let setup;
-
-    beforeEach(ngMock.module('kibana'));
-    beforeEach(
-      ngMock.inject(function (_$rootScope_, _$location_, Private, config) {
-        const State = Private(StateProvider);
-        $location = _$location_;
-        $rootScope = _$rootScope_;
-        Events = Private(EventsProvider);
-
-        setup = (opts) => {
-          const { param, initial, storeInHash } = opts || {};
-          sinon.stub(config, 'get').withArgs('state:storeInSessionStorage').returns(!!storeInHash);
-          const store = new StubBrowserStorage();
-          const hashedItemStore = new HashedItemStore(store);
-          const state = new State(param, initial, hashedItemStore);
-
-          const getUnhashedSearch = () => unhashQuery($location.search());
-
-          return { store, hashedItemStore, state, getUnhashedSearch };
-        };
-      })
-    );
-
-    describe('Provider', () => {
-      it('should reset the state to the defaults', () => {
-        const { state, getUnhashedSearch } = setup({ initial: { message: ['test'] } });
-        state.reset();
-        const search = getUnhashedSearch(state);
-        expect(search).to.have.property('_s');
-        expect(search._s).to.equal('(message:!(test))');
-        expect(state.message).to.eql(['test']);
-      });
-
-      it('should apply the defaults upon initialization', () => {
-        const { state } = setup({ initial: { message: 'test' } });
-        expect(state).to.have.property('message', 'test');
-      });
-
-      it('should inherit from Events', () => {
-        const { state } = setup();
-        expect(state).to.be.an(Events);
-      });
-
-      it('should emit an event if reset with changes', (done) => {
-        const { state } = setup({ initial: { message: ['test'] } });
-        state.on('reset_with_changes', (keys) => {
-          expect(keys).to.eql(['message']);
-          done();
-        });
-        state.save();
-        state.message = 'foo';
-        state.reset();
-        $rootScope.$apply();
-      });
-
-      it('should not emit an event if reset without changes', () => {
-        const { state } = setup({ initial: { message: 'test' } });
-        state.on('reset_with_changes', () => {
-          expect().fail();
-        });
-        state.save();
-        state.message = 'test';
-        state.reset();
-        $rootScope.$apply();
-      });
-    });
-
-    describe('Search', () => {
-      it('should save to $location.search()', () => {
-        const { state, getUnhashedSearch } = setup({ initial: { test: 'foo' } });
-        state.save();
-        const search = getUnhashedSearch(state);
-        expect(search).to.have.property('_s');
-        expect(search._s).to.equal('(test:foo)');
-      });
-
-      it('should emit an event if changes are saved', (done) => {
-        const { state, getUnhashedSearch } = setup();
-        state.on('save_with_changes', (keys) => {
-          expect(keys).to.eql(['test']);
-          done();
-        });
-        state.test = 'foo';
-        state.save();
-        getUnhashedSearch(state);
-        $rootScope.$apply();
-      });
-    });
-
-    describe('Fetch', () => {
-      it('should emit an event if changes are fetched', (done) => {
-        const { state } = setup();
-        state.on('fetch_with_changes', (keys) => {
-          expect(keys).to.eql(['foo']);
-          done();
-        });
-        $location.search({ _s: '(foo:bar)' });
-        state.fetch();
-        expect(state).to.have.property('foo', 'bar');
-        $rootScope.$apply();
-      });
-
-      it('should have events that attach to scope', (done) => {
-        const { state } = setup();
-        state.on('test', (message) => {
-          expect(message).to.equal('foo');
-          done();
-        });
-        state.emit('test', 'foo');
-        $rootScope.$apply();
-      });
-
-      it('should fire listeners for #onUpdate() on #fetch()', (done) => {
-        const { state } = setup();
-        state.on('fetch_with_changes', (keys) => {
-          expect(keys).to.eql(['foo']);
-          done();
-        });
-        $location.search({ _s: '(foo:bar)' });
-        state.fetch();
-        expect(state).to.have.property('foo', 'bar');
-        $rootScope.$apply();
-      });
-
-      it('should apply defaults to fetches', () => {
-        const { state } = setup({ initial: { message: 'test' } });
-        $location.search({ _s: '(foo:bar)' });
-        state.fetch();
-        expect(state).to.have.property('foo', 'bar');
-        expect(state).to.have.property('message', 'test');
-      });
-
-      it('should call fetch when $routeUpdate is fired on $rootScope', () => {
-        const { state } = setup();
-        const spy = sinon.spy(state, 'fetch');
-        $rootScope.$emit('$routeUpdate', 'test');
-        sinon.assert.calledOnce(spy);
-      });
-
-      it('should clear state when missing form URL', () => {
-        let stateObj;
-        const { state } = setup();
-
-        // set state via URL
-        $location.search({ _s: '(foo:(bar:baz))' });
-        state.fetch();
-        stateObj = state.toObject();
-        expect(stateObj).to.eql({ foo: { bar: 'baz' } });
-
-        // ensure changing URL changes state
-        $location.search({ _s: '(one:two)' });
-        state.fetch();
-        stateObj = state.toObject();
-        expect(stateObj).to.eql({ one: 'two' });
-
-        // remove search, state should be empty
-        $location.search({});
-        state.fetch();
-        stateObj = state.toObject();
-        expect(stateObj).to.eql({});
-      });
-
-      it('should clear state when it is invalid', () => {
-        let stateObj;
-        const { state } = setup();
-
-        $location.search({ _s: '' });
-        state.fetch();
-        stateObj = state.toObject();
-        expect(stateObj).to.eql({});
-
-        $location.search({ _s: '!n' });
-        state.fetch();
-        stateObj = state.toObject();
-        expect(stateObj).to.eql({});
-
-        $location.search({ _s: 'alert(1)' });
-        state.fetch();
-        stateObj = state.toObject();
-        expect(stateObj).to.eql({});
-      });
-
-      it('does not replace the state value on read', () => {
-        const { state } = setup();
-        sinon.stub($location, 'search').callsFake((newSearch) => {
-          if (newSearch) {
-            return $location;
-          } else {
-            return {
-              [state.getQueryParamName()]: '(a:1)',
-            };
-          }
-        });
-        const replaceStub = sinon.stub($location, 'replace').returns($location);
-
-        state.fetch();
-        sinon.assert.notCalled(replaceStub);
-      });
-    });
-
-    describe('Hashing', () => {
-      it('stores state values in a hashedItemStore, writing the hash to the url', () => {
-        const { state, hashedItemStore } = setup({ storeInHash: true });
-        state.foo = 'bar';
-        state.save();
-        const urlVal = $location.search()[state.getQueryParamName()];
-
-        expect(isStateHash(urlVal)).to.be(true);
-        expect(hashedItemStore.getItem(urlVal)).to.eql(JSON.stringify({ foo: 'bar' }));
-      });
-
-      it('should replace rison in the URL with a hash', () => {
-        const { state, hashedItemStore } = setup({ storeInHash: true });
-        const obj = { foo: { bar: 'baz' } };
-        const rison = encodeRison(obj);
-
-        $location.search({ _s: rison });
-        state.fetch();
-
-        const urlVal = $location.search()._s;
-        expect(urlVal).to.not.be(rison);
-        expect(isStateHash(urlVal)).to.be(true);
-        expect(hashedItemStore.getItem(urlVal)).to.eql(JSON.stringify(obj));
-      });
-
-      describe('error handling', () => {
-        it('notifies the user when a hash value does not map to a stored value', () => {
-          // Ideally, state.js shouldn't be tightly coupled to toastNotifications. Instead, it
-          // should notify its consumer of this error state and the consumer should be responsible
-          // for notifying the user of the error. This test verifies the side effect of the error
-          // until we can remove this coupling.
-
-          // Clear existing toasts.
-          toastNotifications.list.splice(0);
-
-          const { state } = setup({ storeInHash: true });
-          const search = $location.search();
-          const badHash = createStateHash('{"a": "b"}', () => null);
-
-          search[state.getQueryParamName()] = badHash;
-          $location.search(search);
-
-          expect(toastNotifications.list).to.have.length(0);
-          state.fetch();
-          expect(toastNotifications.list).to.have.length(1);
-          expect(toastNotifications.list[0].title).to.match(/use the share functionality/i);
-        });
-
-        it.skip('triggers fatal error linking to github when setting item fails', () => {
-          // NOTE: this test needs to be written in jest and removed from the browser ones
-          // More info could be read in the opened issue:
-          // https://github.com/elastic/kibana/issues/22751
-          const { state, hashedItemStore } = setup({ storeInHash: true });
-          const fatalErrorStub = sandbox.stub();
-          Object.defineProperty(FatalErrorNS, 'fatalError', {
-            writable: true,
-            value: fatalErrorStub,
-          });
-
-          sandbox.stub(hashedItemStore, 'setItem').returns(false);
-          state.toQueryParam();
-          sinon.assert.calledOnce(fatalErrorStub);
-          sinon.assert.calledWith(
-            fatalErrorStub,
-            sinon.match((error) => error instanceof Error && error.message.includes('github.com'))
-          );
-        });
-
-        it('translateHashToRison should gracefully fallback if parameter can not be parsed', () => {
-          const { state, hashedItemStore } = setup({ storeInHash: false });
-
-          expect(state.translateHashToRison('(a:b)')).to.be('(a:b)');
-          expect(state.translateHashToRison('')).to.be('');
-
-          const existingHash = createStateHash('{"a": "b"}', () => null);
-          hashedItemStore.setItem(existingHash, '{"a": "b"}');
-
-          const nonExistingHash = createStateHash('{"b": "c"}', () => null);
-
-          expect(state.translateHashToRison(existingHash)).to.be('(a:b)');
-          expect(state.translateHashToRison(nonExistingHash)).to.be('!n');
-        });
-      });
-    });
-  });
-
-  describe('Disabled with persisted state', () => {
-    let state;
-    let $location;
-    let $rootScope;
-    const stateParam = '_config_test';
-
-    const getLocationState = () => {
-      const search = $location.search();
-      return search[stateParam];
-    };
-
-    beforeEach(
-      ngMock.module('kibana', function (stateManagementConfigProvider) {
-        stateManagementConfigProvider.disable();
-      })
-    );
-    beforeEach(
-      ngMock.inject(function (_$rootScope_, _$location_, Private, config) {
-        const State = Private(StateProvider);
-        $location = _$location_;
-        $rootScope = _$rootScope_;
-
-        sinon.stub(config, 'get').withArgs('state:storeInSessionStorage').returns(false);
-
-        class MockPersistedState extends State {
-          _persistAcrossApps = true;
-        }
-
-        MockPersistedState.prototype._persistAcrossApps = true;
-
-        state = new MockPersistedState(stateParam);
-      })
-    );
-
-    describe('changing state', () => {
-      const methods = ['save', 'replace', 'reset'];
-
-      methods.forEach((method) => {
-        it(`${method} should not change the URL`, () => {
-          $location.search({ _s: '(foo:bar)' });
-          state[method]();
-          $rootScope.$apply();
-          expect(getLocationState()).to.be(undefined);
-        });
-      });
-    });
-
-    describe('reading state', () => {
-      it('should not change the URL', () => {
-        const saveSpy = sinon.spy(state, 'save');
-        $location.search({ _s: '(foo:bar)' });
-        state.fetch();
-        $rootScope.$apply();
-        sinon.assert.notCalled(saveSpy);
-        expect(getLocationState()).to.be(undefined);
-      });
-    });
-  });
-});
diff --git a/src/legacy/ui/public/state_management/__tests__/state_monitor_factory.js b/src/legacy/ui/public/state_management/__tests__/state_monitor_factory.js
deleted file mode 100644
index dc00d4e05e82f4..00000000000000
--- a/src/legacy/ui/public/state_management/__tests__/state_monitor_factory.js
+++ /dev/null
@@ -1,265 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-import { EventEmitter } from 'events';
-import { cloneDeep } from 'lodash';
-import { stateMonitorFactory } from '../state_monitor_factory';
-
-describe('stateMonitorFactory', function () {
-  const noop = () => {};
-  const eventTypes = ['save_with_changes', 'reset_with_changes', 'fetch_with_changes'];
-
-  let mockState;
-
-  function setState(mockState, obj, emit = true) {
-    mockState.toJSON = () => cloneDeep(obj);
-    if (emit) mockState.emit(eventTypes[0]);
-  }
-
-  function createMockState(state = {}) {
-    const mockState = new EventEmitter();
-    setState(mockState, state, false);
-    return mockState;
-  }
-
-  beforeEach(() => {
-    mockState = createMockState({});
-  });
-
-  it('should have a create method', function () {
-    expect(stateMonitorFactory).to.have.property('create');
-    expect(stateMonitorFactory.create).to.be.a('function');
-  });
-
-  describe('factory creation', function () {
-    it('should not call onChange with only the state', function () {
-      const monitor = stateMonitorFactory.create(mockState);
-      const changeStub = sinon.stub();
-      monitor.onChange(changeStub);
-      sinon.assert.notCalled(changeStub);
-    });
-
-    it('should not call onChange with matching defaultState', function () {
-      const monitor = stateMonitorFactory.create(mockState, {});
-      const changeStub = sinon.stub();
-      monitor.onChange(changeStub);
-      sinon.assert.notCalled(changeStub);
-    });
-
-    it('should call onChange with differing defaultState', function () {
-      const monitor = stateMonitorFactory.create(mockState, { test: true });
-      const changeStub = sinon.stub();
-      monitor.onChange(changeStub);
-      sinon.assert.calledOnce(changeStub);
-    });
-  });
-
-  describe('instance', function () {
-    let monitor;
-
-    beforeEach(() => {
-      monitor = stateMonitorFactory.create(mockState);
-    });
-
-    describe('onChange', function () {
-      it('should throw if not given a handler function', function () {
-        const fn = () => monitor.onChange('not a function');
-        expect(fn).to.throwException(/must be a function/);
-      });
-
-      eventTypes.forEach((eventType) => {
-        describe(`when ${eventType} is emitted`, function () {
-          let handlerFn;
-
-          beforeEach(() => {
-            handlerFn = sinon.stub();
-            monitor.onChange(handlerFn);
-            sinon.assert.notCalled(handlerFn);
-          });
-
-          it('should get called', function () {
-            mockState.emit(eventType);
-            sinon.assert.calledOnce(handlerFn);
-          });
-
-          it('should be given the state status', function () {
-            mockState.emit(eventType);
-            const args = handlerFn.firstCall.args;
-            expect(args[0]).to.be.an('object');
-          });
-
-          it('should be given the event type', function () {
-            mockState.emit(eventType);
-            const args = handlerFn.firstCall.args;
-            expect(args[1]).to.equal(eventType);
-          });
-
-          it('should be given the changed keys', function () {
-            const keys = ['one', 'two', 'three'];
-            mockState.emit(eventType, keys);
-            const args = handlerFn.firstCall.args;
-            expect(args[2]).to.equal(keys);
-          });
-        });
-      });
-    });
-
-    describe('ignoreProps', function () {
-      it('should not set status to dirty when ignored properties change', function () {
-        let status;
-        const mockState = createMockState({ messages: { world: 'hello', foo: 'bar' } });
-        const monitor = stateMonitorFactory.create(mockState);
-        const changeStub = sinon.stub();
-        monitor.ignoreProps('messages.world');
-        monitor.onChange(changeStub);
-        sinon.assert.notCalled(changeStub);
-
-        // update the ignored state prop
-        setState(mockState, { messages: { world: 'howdy', foo: 'bar' } });
-        sinon.assert.calledOnce(changeStub);
-        status = changeStub.firstCall.args[0];
-        expect(status).to.have.property('clean', true);
-        expect(status).to.have.property('dirty', false);
-
-        // update a prop that is not ignored
-        setState(mockState, { messages: { world: 'howdy', foo: 'baz' } });
-        sinon.assert.calledTwice(changeStub);
-        status = changeStub.secondCall.args[0];
-        expect(status).to.have.property('clean', false);
-        expect(status).to.have.property('dirty', true);
-      });
-    });
-
-    describe('setInitialState', function () {
-      let changeStub;
-
-      beforeEach(() => {
-        changeStub = sinon.stub();
-        monitor.onChange(changeStub);
-        sinon.assert.notCalled(changeStub);
-      });
-
-      it('should throw if no state is provided', function () {
-        const fn = () => monitor.setInitialState();
-        expect(fn).to.throwException(/must be an object/);
-      });
-
-      it('should throw if given the wrong type', function () {
-        const fn = () => monitor.setInitialState([]);
-        expect(fn).to.throwException(/must be an object/);
-      });
-
-      it('should trigger the onChange handler', function () {
-        monitor.setInitialState({ new: 'state' });
-        sinon.assert.calledOnce(changeStub);
-      });
-
-      it('should change the status with differing state', function () {
-        monitor.setInitialState({ new: 'state' });
-        sinon.assert.calledOnce(changeStub);
-
-        const status = changeStub.firstCall.args[0];
-        expect(status).to.have.property('clean', false);
-        expect(status).to.have.property('dirty', true);
-      });
-
-      it('should not trigger the onChange handler without state change', function () {
-        monitor.setInitialState(cloneDeep(mockState.toJSON()));
-        sinon.assert.notCalled(changeStub);
-      });
-    });
-
-    describe('status object', function () {
-      let handlerFn;
-
-      beforeEach(() => {
-        handlerFn = sinon.stub();
-        monitor.onChange(handlerFn);
-      });
-
-      it('should be clean by default', function () {
-        mockState.emit(eventTypes[0]);
-        const status = handlerFn.firstCall.args[0];
-        expect(status).to.have.property('clean', true);
-        expect(status).to.have.property('dirty', false);
-      });
-
-      it('should be dirty when state changes', function () {
-        setState(mockState, { message: 'i am dirty now' });
-        const status = handlerFn.firstCall.args[0];
-        expect(status).to.have.property('clean', false);
-        expect(status).to.have.property('dirty', true);
-      });
-
-      it('should be clean when state is reset', function () {
-        const defaultState = { message: 'i am the original state' };
-        const handlerFn = sinon.stub();
-
-        let status;
-
-        // initial state and monitor setup
-        const mockState = createMockState(defaultState);
-        const monitor = stateMonitorFactory.create(mockState);
-        monitor.onChange(handlerFn);
-        sinon.assert.notCalled(handlerFn);
-
-        // change the state and emit an event
-        setState(mockState, { message: 'i am dirty now' });
-        sinon.assert.calledOnce(handlerFn);
-        status = handlerFn.firstCall.args[0];
-        expect(status).to.have.property('clean', false);
-        expect(status).to.have.property('dirty', true);
-
-        // reset the state and emit an event
-        setState(mockState, defaultState);
-        sinon.assert.calledTwice(handlerFn);
-        status = handlerFn.secondCall.args[0];
-        expect(status).to.have.property('clean', true);
-        expect(status).to.have.property('dirty', false);
-      });
-    });
-
-    describe('destroy', function () {
-      let stateSpy;
-
-      beforeEach(() => {
-        stateSpy = sinon.spy(mockState, 'off');
-        sinon.assert.notCalled(stateSpy);
-      });
-
-      it('should remove the listeners', function () {
-        monitor.onChange(noop);
-        monitor.destroy();
-        sinon.assert.callCount(stateSpy, eventTypes.length);
-        eventTypes.forEach((eventType) => {
-          sinon.assert.calledWith(stateSpy, eventType);
-        });
-      });
-
-      it('should stop the instance from being used any more', function () {
-        monitor.onChange(noop);
-        monitor.destroy();
-        const fn = () => monitor.onChange(noop);
-        expect(fn).to.throwException(/has been destroyed/);
-      });
-    });
-  });
-});
diff --git a/src/legacy/ui/public/state_management/app_state.d.ts b/src/legacy/ui/public/state_management/app_state.d.ts
deleted file mode 100644
index ddd0b907107665..00000000000000
--- a/src/legacy/ui/public/state_management/app_state.d.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { State } from './state';
-
-export class AppState extends State {}
-
-export type AppStateClass<
-  TAppState extends AppState = AppState,
-  TDefaults = { [key: string]: any }
-> = new (defaults: TDefaults) => TAppState;
diff --git a/src/legacy/ui/public/state_management/app_state.js b/src/legacy/ui/public/state_management/app_state.js
deleted file mode 100644
index ec680d163b9da6..00000000000000
--- a/src/legacy/ui/public/state_management/app_state.js
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * @name AppState
- *
- * @extends State
- *
- * @description Inherits State, which inherits Events. This class seems to be
- * concerned with mapping "props" to PersistedState instances, and surfacing the
- * ability to destroy those mappings.
- */
-
-import { uiModules } from '../modules';
-import { StateProvider } from './state';
-import { PersistedState } from '../../../../plugins/visualizations/public';
-import { createLegacyClass } from '../utils/legacy_class';
-
-const urlParam = '_a';
-
-export function AppStateProvider(Private, $location) {
-  const State = Private(StateProvider);
-
-  let persistedStates;
-  let eventUnsubscribers;
-
-  createLegacyClass(AppState).inherits(State);
-  function AppState(defaults) {
-    // Initialize persistedStates. This object maps "prop" names to
-    // PersistedState instances. These are used to make properties "stateful".
-    persistedStates = {};
-
-    // Initialize eventUnsubscribers. These will be called in `destroy`, to
-    // remove handlers for the 'change' and 'fetch_with_changes' events which
-    // are dispatched via the rootScope.
-    eventUnsubscribers = [];
-
-    AppState.Super.call(this, urlParam, defaults);
-    AppState.getAppState._set(this);
-  }
-
-  // if the url param is missing, write it back
-  AppState.prototype._persistAcrossApps = false;
-
-  AppState.prototype.destroy = function () {
-    AppState.Super.prototype.destroy.call(this);
-    AppState.getAppState._set(null);
-
-    eventUnsubscribers.forEach((listener) => listener());
-  };
-
-  /**
-   * @returns PersistedState instance.
-   */
-  AppState.prototype.makeStateful = function (prop) {
-    if (persistedStates[prop]) return persistedStates[prop];
-    const self = this;
-
-    // set up the ui state
-    persistedStates[prop] = new PersistedState();
-
-    // update the app state when the stateful instance changes
-    const updateOnChange = function () {
-      const replaceState = false; // TODO: debouncing logic
-      self[prop] = persistedStates[prop].getChanges();
-      // Save state to the URL.
-      self.save(replaceState);
-    };
-    const handlerOnChange = (method) => persistedStates[prop][method]('change', updateOnChange);
-    handlerOnChange('on');
-    eventUnsubscribers.push(() => handlerOnChange('off'));
-
-    // update the stateful object when the app state changes
-    const persistOnChange = function (changes) {
-      if (!changes) return;
-
-      if (changes.indexOf(prop) !== -1) {
-        persistedStates[prop].set(self[prop]);
-      }
-    };
-    const handlePersist = (method) => this[method]('fetch_with_changes', persistOnChange);
-    handlePersist('on');
-    eventUnsubscribers.push(() => handlePersist('off'));
-
-    // if the thing we're making stateful has an appState value, write to persisted state
-    if (self[prop]) persistedStates[prop].setSilent(self[prop]);
-
-    return persistedStates[prop];
-  };
-
-  AppState.getAppState = (function () {
-    let currentAppState;
-
-    function get() {
-      return currentAppState;
-    }
-
-    // Checks to see if the appState might already exist, even if it hasn't been newed up
-    get.previouslyStored = function () {
-      const search = $location.search();
-      return search[urlParam] ? true : false;
-    };
-
-    get._set = function (current) {
-      currentAppState = current;
-    };
-
-    return get;
-  })();
-
-  return AppState;
-}
-
-uiModules
-  .get('kibana/global_state')
-  .factory('AppState', function (Private) {
-    return Private(AppStateProvider);
-  })
-  .service('getAppState', function (Private) {
-    return Private(AppStateProvider).getAppState;
-  });
diff --git a/src/legacy/ui/public/state_management/config_provider.js b/src/legacy/ui/public/state_management/config_provider.js
deleted file mode 100644
index 68de449a57a56e..00000000000000
--- a/src/legacy/ui/public/state_management/config_provider.js
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * @name stateManagementConfig
- *
- * @description Allows apps to configure state management
- */
-
-import { uiModules } from '../modules';
-
-export class StateManagementConfigProvider {
-  _enabled = true;
-
-  $get(/* inject stuff */) {
-    return {
-      enabled: this._enabled,
-    };
-  }
-
-  disable() {
-    this._enabled = false;
-  }
-
-  enable() {
-    this._enabled = true;
-  }
-}
-
-uiModules
-  .get('kibana/state_management')
-  .provider('stateManagementConfig', StateManagementConfigProvider);
diff --git a/src/legacy/ui/public/state_management/global_state.d.ts b/src/legacy/ui/public/state_management/global_state.d.ts
deleted file mode 100644
index 66a85d88956c77..00000000000000
--- a/src/legacy/ui/public/state_management/global_state.d.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { State } from './state';
-
-export type GlobalState = State;
diff --git a/src/legacy/ui/public/state_management/global_state.js b/src/legacy/ui/public/state_management/global_state.js
deleted file mode 100644
index 0e8dfe40d5950b..00000000000000
--- a/src/legacy/ui/public/state_management/global_state.js
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { StateProvider } from './state';
-import { uiModules } from '../modules';
-import { createLegacyClass } from '../utils/legacy_class';
-
-const module = uiModules.get('kibana/global_state');
-
-export function GlobalStateProvider(Private) {
-  const State = Private(StateProvider);
-
-  createLegacyClass(GlobalState).inherits(State);
-  function GlobalState(defaults) {
-    GlobalState.Super.call(this, '_g', defaults);
-  }
-
-  // if the url param is missing, write it back
-  GlobalState.prototype._persistAcrossApps = true;
-
-  return new GlobalState();
-}
-
-module.service('globalState', function (Private) {
-  return Private(GlobalStateProvider);
-});
diff --git a/src/legacy/ui/public/state_management/state.d.ts b/src/legacy/ui/public/state_management/state.d.ts
deleted file mode 100644
index b31862b681f55a..00000000000000
--- a/src/legacy/ui/public/state_management/state.d.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export class State {
-  [key: string]: any;
-  translateHashToRison: (stateHashOrRison: string | string[]) => string | string[];
-  getQueryParamName: () => string;
-}
diff --git a/src/legacy/ui/public/state_management/state.js b/src/legacy/ui/public/state_management/state.js
deleted file mode 100644
index d91834adb4a79e..00000000000000
--- a/src/legacy/ui/public/state_management/state.js
+++ /dev/null
@@ -1,359 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * @name State
- *
- * @extends Events
- *
- * @description Persists generic "state" to and reads it from the URL.
- */
-
-import _ from 'lodash';
-import { i18n } from '@kbn/i18n';
-import angular from 'angular';
-import rison from 'rison-node';
-import { EventsProvider } from '../events';
-import { fatalError, toastNotifications } from '../notify';
-import './config_provider';
-import { createLegacyClass } from '../utils/legacy_class';
-import {
-  hashedItemStore,
-  isStateHash,
-  createStateHash,
-  applyDiff,
-} from '../../../../plugins/kibana_utils/public';
-
-export function StateProvider(
-  Private,
-  $rootScope,
-  $location,
-  stateManagementConfig,
-  config,
-  kbnUrl,
-  $injector
-) {
-  const Events = Private(EventsProvider);
-
-  const isDummyRoute = () =>
-    $injector.has('$route') &&
-    $injector.get('$route').current &&
-    $injector.get('$route').current.outerAngularWrapperRoute;
-
-  createLegacyClass(State).inherits(Events);
-  function State(urlParam, defaults, _hashedItemStore = hashedItemStore) {
-    State.Super.call(this);
-
-    this.setDefaults(defaults);
-    this._urlParam = urlParam || '_s';
-    this._hashedItemStore = _hashedItemStore;
-
-    // When the URL updates we need to fetch the values from the URL
-    this._cleanUpListeners = [
-      // partial route update, no app reload
-      $rootScope.$on('$routeUpdate', () => {
-        this.fetch();
-      }),
-
-      // beginning of full route update, new app will be initialized before
-      // $routeChangeSuccess or $routeChangeError
-      $rootScope.$on('$routeChangeStart', () => {
-        if (!this._persistAcrossApps) {
-          this.destroy();
-        }
-      }),
-
-      $rootScope.$on('$routeChangeSuccess', () => {
-        if (this._persistAcrossApps) {
-          this.fetch();
-        }
-      }),
-    ];
-
-    // Initialize the State with fetch
-    this.fetch();
-  }
-
-  State.prototype._readFromURL = function () {
-    const search = $location.search();
-    const urlVal = search[this._urlParam];
-
-    if (!urlVal) {
-      return null;
-    }
-
-    if (isStateHash(urlVal)) {
-      return this._parseStateHash(urlVal);
-    }
-
-    let risonEncoded;
-    let unableToParse;
-    try {
-      risonEncoded = rison.decode(urlVal);
-    } catch (e) {
-      unableToParse = true;
-    }
-
-    if (unableToParse) {
-      toastNotifications.addDanger(
-        i18n.translate('common.ui.stateManagement.unableToParseUrlErrorMessage', {
-          defaultMessage: 'Unable to parse URL',
-        })
-      );
-      search[this._urlParam] = this.toQueryParam(this._defaults);
-      $location.search(search).replace();
-    }
-
-    if (!risonEncoded) {
-      return null;
-    }
-
-    if (this.isHashingEnabled()) {
-      // RISON can find its way into the URL any number of ways, including the navbar links or
-      // shared urls with the entire state embedded. These values need to be translated into
-      // hashes and replaced in the browser history when state-hashing is enabled
-      search[this._urlParam] = this.toQueryParam(risonEncoded);
-      $location.search(search).replace();
-    }
-
-    return risonEncoded;
-  };
-
-  /**
-   * Fetches the state from the url
-   * @returns {void}
-   */
-  State.prototype.fetch = function () {
-    if (!stateManagementConfig.enabled) {
-      return;
-    }
-
-    let stash = this._readFromURL();
-
-    // nothing to read from the url? save if ordered to persist, but only if it's not on a wrapper route
-    if (stash === null) {
-      if (this._persistAcrossApps) {
-        return this.save();
-      } else {
-        stash = {};
-      }
-    }
-
-    _.defaults(stash, this._defaults);
-    // apply diff to state from stash, will change state in place via side effect
-    const diffResults = applyDiff(this, stash);
-
-    if (!isDummyRoute() && diffResults.keys.length) {
-      this.emit('fetch_with_changes', diffResults.keys);
-    }
-  };
-
-  /**
-   * Saves the state to the url
-   * @returns {void}
-   */
-  State.prototype.save = function (replace) {
-    if (!stateManagementConfig.enabled) {
-      return;
-    }
-
-    if (isDummyRoute()) {
-      return;
-    }
-
-    let stash = this._readFromURL();
-    const state = this.toObject();
-    replace = replace || false;
-
-    if (!stash) {
-      replace = true;
-      stash = {};
-    }
-
-    // apply diff to state from stash, will change state in place via side effect
-    const diffResults = applyDiff(stash, _.defaults({}, state, this._defaults));
-
-    if (diffResults.keys.length) {
-      this.emit('save_with_changes', diffResults.keys);
-    }
-
-    // persist the state in the URL
-    const search = $location.search();
-    search[this._urlParam] = this.toQueryParam(state);
-    if (replace) {
-      $location.search(search).replace();
-    } else {
-      $location.search(search);
-    }
-  };
-
-  /**
-   * Calls save with a forced replace
-   * @returns {void}
-   */
-  State.prototype.replace = function () {
-    if (!stateManagementConfig.enabled) {
-      return;
-    }
-
-    this.save(true);
-  };
-
-  /**
-   * Resets the state to the defaults
-   *
-   * @returns {void}
-   */
-  State.prototype.reset = function () {
-    if (!stateManagementConfig.enabled) {
-      return;
-    }
-
-    kbnUrl.removeParam(this.getQueryParamName());
-    // apply diff to attributes from defaults, this is side effecting so
-    // it will change the state in place.
-    const diffResults = applyDiff(this, this._defaults);
-    if (diffResults.keys.length) {
-      this.emit('reset_with_changes', diffResults.keys);
-    }
-    this.save();
-  };
-
-  /**
-   * Cleans up the state object
-   * @returns {void}
-   */
-  State.prototype.destroy = function () {
-    this.off(); // removes all listeners
-
-    // Removes the $routeUpdate listener
-    this._cleanUpListeners.forEach((listener) => listener(this));
-  };
-
-  State.prototype.setDefaults = function (defaults) {
-    this._defaults = defaults || {};
-  };
-
-  /**
-   *  Parse the state hash to it's unserialized value. Hashes are restored
-   *  to their pre-hashed state.
-   *
-   *  @param  {string} stateHash - state hash value from the query string.
-   *  @return {any} - the stored value, or null if hash does not resolve.
-   */
-  State.prototype._parseStateHash = function (stateHash) {
-    const json = this._hashedItemStore.getItem(stateHash);
-    if (json === null) {
-      toastNotifications.addDanger(
-        i18n.translate('common.ui.stateManagement.unableToRestoreUrlErrorMessage', {
-          defaultMessage:
-            'Unable to completely restore the URL, be sure to use the share functionality.',
-        })
-      );
-    }
-
-    return JSON.parse(json);
-  };
-
-  /**
-   *  Lookup the value for a hash and return it's value in rison format or just
-   *  return passed argument if it's not recognized as state hash.
-   *
-   *  @param  {string} stateHashOrRison - either state hash value or rison string.
-   *  @return {string} rison
-   */
-  State.prototype.translateHashToRison = function (stateHashOrRison) {
-    if (isStateHash(stateHashOrRison)) {
-      return rison.encode(this._parseStateHash(stateHashOrRison));
-    }
-
-    return stateHashOrRison;
-  };
-
-  State.prototype.isHashingEnabled = function () {
-    return !!config.get('state:storeInSessionStorage');
-  };
-
-  /**
-   *  Produce the hash version of the state in it's current position
-   *
-   *  @return {string}
-   */
-  State.prototype.toQueryParam = function (state = this.toObject()) {
-    if (!this.isHashingEnabled()) {
-      return rison.encode(state);
-    }
-
-    // We need to strip out Angular-specific properties.
-    const json = angular.toJson(state);
-    const hash = createStateHash(json);
-    const isItemSet = this._hashedItemStore.setItem(hash, json);
-
-    if (isItemSet) {
-      return hash;
-    }
-
-    // If we ran out of space trying to persist the state, notify the user.
-    const message = i18n.translate(
-      'common.ui.stateManagement.unableToStoreHistoryInSessionErrorMessage',
-      {
-        defaultMessage:
-          'Kibana is unable to store history items in your session ' +
-          `because it is full and there don't seem to be items any items safe ` +
-          'to delete.\n\n' +
-          'This can usually be fixed by moving to a fresh tab, but could ' +
-          'be caused by a larger issue. If you are seeing this message regularly, ' +
-          'please file an issue at {gitHubIssuesUrl}.',
-        values: { gitHubIssuesUrl: 'https://github.com/elastic/kibana/issues' },
-      }
-    );
-    fatalError(new Error(message));
-  };
-
-  /**
-   *  Get the query string parameter name where this state writes and reads
-   *  @return {string}
-   */
-  State.prototype.getQueryParamName = function () {
-    return this._urlParam;
-  };
-
-  /**
-   * Returns an object with each property name and value corresponding to the entries in this collection
-   * excluding fields started from '$', '_' and all methods
-   *
-   * @return {object}
-   */
-  State.prototype.toObject = function () {
-    return _.omitBy(this, (value, key) => {
-      return key.charAt(0) === '$' || key.charAt(0) === '_' || _.isFunction(value);
-    });
-  };
-
-  /** Alias for method 'toObject'
-   *
-   * @obsolete Please use 'toObject' method instead
-   * @return {object}
-   */
-  State.prototype.toJSON = function () {
-    return this.toObject();
-  };
-
-  return State;
-}
diff --git a/src/legacy/ui/public/state_management/state_monitor_factory.ts b/src/legacy/ui/public/state_management/state_monitor_factory.ts
deleted file mode 100644
index 968ececfe3be5d..00000000000000
--- a/src/legacy/ui/public/state_management/state_monitor_factory.ts
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { set } from '@elastic/safer-lodash-set';
-import { cloneDeep, isEqual, isPlainObject } from 'lodash';
-import { State } from './state';
-
-export const stateMonitorFactory = {
-  create: <TStateDefault extends { [key: string]: unknown }>(
-    state: State,
-    customInitialState: TStateDefault
-  ) => stateMonitor<TStateDefault>(state, customInitialState),
-};
-
-interface StateStatus {
-  clean: boolean;
-  dirty: boolean;
-}
-
-export interface StateMonitor<TStateDefault extends { [key: string]: unknown }> {
-  setInitialState: (innerCustomInitialState: TStateDefault) => void;
-  ignoreProps: (props: string[] | string) => void;
-  onChange: (callback: ChangeHandlerFn) => StateMonitor<TStateDefault>;
-  destroy: () => void;
-}
-
-type ChangeHandlerFn = (status: StateStatus, type: string | null, keys: string[]) => void;
-
-function stateMonitor<TStateDefault extends { [key: string]: unknown }>(
-  state: State,
-  customInitialState: TStateDefault
-): StateMonitor<TStateDefault> {
-  let destroyed = false;
-  let ignoredProps: string[] = [];
-  let changeHandlers: ChangeHandlerFn[] | undefined = [];
-  let initialState: TStateDefault;
-
-  setInitialState(customInitialState);
-
-  function setInitialState(innerCustomInitialState: TStateDefault) {
-    // state.toJSON returns a reference, clone so we can mutate it safely
-    initialState = cloneDeep(innerCustomInitialState) || cloneDeep(state.toJSON());
-  }
-
-  function removeIgnoredProps(innerState: TStateDefault) {
-    ignoredProps.forEach((path) => {
-      set(innerState, path, true);
-    });
-    return innerState;
-  }
-
-  function getStatus(): StateStatus {
-    // state.toJSON returns a reference, clone so we can mutate it safely
-    const currentState = removeIgnoredProps(cloneDeep(state.toJSON()));
-    const isClean = isEqual(currentState, initialState);
-
-    return {
-      clean: isClean,
-      dirty: !isClean,
-    };
-  }
-
-  function dispatchChange(type: string | null = null, keys: string[] = []) {
-    const status = getStatus();
-    if (!changeHandlers) {
-      throw new Error('Change handlers is undefined, this object has been destroyed');
-    }
-    changeHandlers.forEach((changeHandler) => {
-      changeHandler(status, type, keys);
-    });
-  }
-
-  function dispatchFetch(keys: string[]) {
-    dispatchChange('fetch_with_changes', keys);
-  }
-
-  function dispatchSave(keys: string[]) {
-    dispatchChange('save_with_changes', keys);
-  }
-
-  function dispatchReset(keys: string[]) {
-    dispatchChange('reset_with_changes', keys);
-  }
-
-  return {
-    setInitialState(innerCustomInitialState: TStateDefault) {
-      if (!isPlainObject(innerCustomInitialState)) {
-        throw new TypeError('The default state must be an object');
-      }
-
-      // check the current status
-      const previousStatus = getStatus();
-
-      // update the initialState and apply ignoredProps
-      setInitialState(innerCustomInitialState);
-      removeIgnoredProps(initialState);
-
-      // fire the change handler if the status has changed
-      if (!isEqual(previousStatus, getStatus())) {
-        dispatchChange();
-      }
-    },
-
-    ignoreProps(props: string[] | string) {
-      ignoredProps = ignoredProps.concat(props);
-      removeIgnoredProps(initialState);
-      return this;
-    },
-
-    onChange(callback: ChangeHandlerFn) {
-      if (destroyed || !changeHandlers) {
-        throw new Error('Monitor has been destroyed');
-      }
-      if (typeof callback !== 'function') {
-        throw new Error('onChange handler must be a function');
-      }
-
-      changeHandlers.push(callback);
-
-      // Listen for state events.
-      state.on('fetch_with_changes', dispatchFetch);
-      state.on('save_with_changes', dispatchSave);
-      state.on('reset_with_changes', dispatchReset);
-
-      // if the state is already dirty, fire the change handler immediately
-      const status = getStatus();
-      if (status.dirty) {
-        dispatchChange();
-      }
-
-      return this;
-    },
-
-    destroy() {
-      destroyed = true;
-      changeHandlers = undefined;
-      state.off('fetch_with_changes', dispatchFetch);
-      state.off('save_with_changes', dispatchSave);
-      state.off('reset_with_changes', dispatchReset);
-    },
-  };
-}
diff --git a/src/legacy/ui/public/system_api/__tests__/system_api.js b/src/legacy/ui/public/system_api/__tests__/system_api.js
deleted file mode 100644
index 816024f13f8b25..00000000000000
--- a/src/legacy/ui/public/system_api/__tests__/system_api.js
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import {
-  addSystemApiHeader,
-  isSystemApiRequest,
-} from '../../../../../plugins/kibana_legacy/public';
-
-describe('system_api', () => {
-  describe('#addSystemApiHeader', () => {
-    it('adds the correct system API header', () => {
-      const headers = {
-        'kbn-version': '4.6.0',
-      };
-      const newHeaders = addSystemApiHeader(headers);
-
-      expect(newHeaders).to.have.property('kbn-system-request');
-      expect(newHeaders['kbn-system-request']).to.be(true);
-
-      expect(newHeaders).to.have.property('kbn-version');
-      expect(newHeaders['kbn-version']).to.be('4.6.0');
-    });
-  });
-
-  describe('#isSystemApiRequest', () => {
-    it('returns true for a system HTTP request', () => {
-      const mockRequest = {
-        headers: {
-          'kbn-system-request': true,
-        },
-      };
-      expect(isSystemApiRequest(mockRequest)).to.be(true);
-    });
-
-    it('returns true for a legacy system API HTTP request', () => {
-      const mockRequest = {
-        headers: {
-          'kbn-system-api': true,
-        },
-      };
-      expect(isSystemApiRequest(mockRequest)).to.be(true);
-    });
-
-    it('returns false for a non-system API HTTP request', () => {
-      const mockRequest = {
-        headers: {},
-      };
-      expect(isSystemApiRequest(mockRequest)).to.be(false);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/system_api/index.js b/src/legacy/ui/public/system_api/index.js
deleted file mode 100644
index 6361c0ea6c69ad..00000000000000
--- a/src/legacy/ui/public/system_api/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { addSystemApiHeader, isSystemApiRequest } from '../../../../plugins/kibana_legacy/public';
diff --git a/src/legacy/ui/public/timefilter/index.ts b/src/legacy/ui/public/timefilter/index.ts
deleted file mode 100644
index 83795c73112be1..00000000000000
--- a/src/legacy/ui/public/timefilter/index.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import uiRoutes from 'ui/routes';
-import { npStart } from 'ui/new_platform';
-
-import { TimefilterContract, TimeHistoryContract } from '../../../../plugins/data/public';
-import { registerTimefilterWithGlobalState } from './setup_router';
-
-export {
-  getTime,
-  InputTimeRange,
-  TimeHistoryContract,
-  TimefilterContract,
-} from '../../../../plugins/data/public';
-export type Timefilter = TimefilterContract;
-export type TimeHistory = TimeHistoryContract;
-export const timeHistory = npStart.plugins.data.query.timefilter.history;
-export const timefilter = npStart.plugins.data.query.timefilter.timefilter;
-
-uiRoutes.addSetupWork((globalState, $rootScope) => {
-  return registerTimefilterWithGlobalState(timefilter, globalState, $rootScope);
-});
diff --git a/src/legacy/ui/public/timefilter/setup_router.test.js b/src/legacy/ui/public/timefilter/setup_router.test.js
deleted file mode 100644
index 2ae9a053ae2db1..00000000000000
--- a/src/legacy/ui/public/timefilter/setup_router.test.js
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { registerTimefilterWithGlobalState } from './setup_router';
-
-jest.mock('../../../../plugins/kibana_legacy/public', () => ({
-  subscribeWithScope: jest.fn(),
-}));
-
-describe('registerTimefilterWithGlobalState()', () => {
-  it('should always use iso8601 strings', async () => {
-    const setTime = jest.fn();
-    const timefilter = {
-      setTime,
-      setRefreshInterval: jest.fn(),
-      getRefreshIntervalUpdate$: jest.fn(),
-      getTimeUpdate$: jest.fn(),
-    };
-
-    const globalState = {
-      time: {
-        from: '2017-09-07T20:12:04.011Z',
-        to: '2017-09-07T20:18:55.733Z',
-      },
-      on: (eventName, callback) => {
-        callback();
-      },
-    };
-
-    const rootScope = {
-      $on: jest.fn(),
-    };
-
-    registerTimefilterWithGlobalState(timefilter, globalState, rootScope);
-
-    expect(setTime.mock.calls.length).toBe(2);
-    expect(setTime.mock.calls[1][0]).toEqual(globalState.time);
-  });
-});
diff --git a/src/legacy/ui/public/timefilter/setup_router.ts b/src/legacy/ui/public/timefilter/setup_router.ts
deleted file mode 100644
index 7c25c6aa3166e3..00000000000000
--- a/src/legacy/ui/public/timefilter/setup_router.ts
+++ /dev/null
@@ -1,118 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import { IScope } from 'angular';
-import moment from 'moment';
-import chrome from 'ui/chrome';
-import { Subscription } from 'rxjs';
-import { fatalError } from 'ui/notify/fatal_error';
-import { subscribeWithScope } from '../../../../plugins/kibana_legacy/public';
-import {
-  RefreshInterval,
-  TimeRange,
-  TimefilterContract,
-  UI_SETTINGS,
-} from '../../../../plugins/data/public';
-
-// TODO
-// remove everything underneath once globalState is no longer an angular service
-// and listener can be registered without angular.
-function convertISO8601(stringTime: string): string {
-  const obj = moment(stringTime, 'YYYY-MM-DDTHH:mm:ss.SSSZ', true);
-  return obj.isValid() ? obj.toISOString() : stringTime;
-}
-
-export function getTimefilterConfig() {
-  const settings = chrome.getUiSettingsClient();
-  return {
-    timeDefaults: settings.get('timepicker:timeDefaults'),
-    refreshIntervalDefaults: settings.get(UI_SETTINGS.TIMEPICKER_REFRESH_INTERVAL_DEFAULTS),
-  };
-}
-
-export const registerTimefilterWithGlobalStateFactory = (
-  timefilter: TimefilterContract,
-  globalState: any,
-  $rootScope: IScope
-) => {
-  // settings have to be re-fetched here, to make sure that settings changed by overrideLocalDefault are taken into account.
-  const config = getTimefilterConfig();
-  timefilter.setTime(_.defaults(globalState.time || {}, config.timeDefaults));
-  timefilter.setRefreshInterval(
-    _.defaults(globalState.refreshInterval || {}, config.refreshIntervalDefaults)
-  );
-
-  globalState.on('fetch_with_changes', () => {
-    // clone and default to {} in one
-    const newTime: TimeRange = _.defaults({}, globalState.time, config.timeDefaults);
-    const newRefreshInterval: RefreshInterval = _.defaults(
-      {},
-      globalState.refreshInterval,
-      config.refreshIntervalDefaults
-    );
-
-    if (newTime) {
-      if (newTime.to) newTime.to = convertISO8601(newTime.to);
-      if (newTime.from) newTime.from = convertISO8601(newTime.from);
-    }
-
-    timefilter.setTime(newTime);
-    timefilter.setRefreshInterval(newRefreshInterval);
-  });
-
-  const updateGlobalStateWithTime = () => {
-    globalState.time = timefilter.getTime();
-    globalState.refreshInterval = timefilter.getRefreshInterval();
-    globalState.save();
-  };
-
-  const subscriptions = new Subscription();
-  subscriptions.add(
-    subscribeWithScope(
-      $rootScope,
-      timefilter.getRefreshIntervalUpdate$(),
-      {
-        next: updateGlobalStateWithTime,
-      },
-      fatalError
-    )
-  );
-
-  subscriptions.add(
-    subscribeWithScope(
-      $rootScope,
-      timefilter.getTimeUpdate$(),
-      {
-        next: updateGlobalStateWithTime,
-      },
-      fatalError
-    )
-  );
-
-  $rootScope.$on('$destroy', () => {
-    subscriptions.unsubscribe();
-  });
-};
-
-// Currently some parts of Kibana (index patterns, timefilter) rely on addSetupWork in the uiRouter
-// and require it to be executed to properly function.
-// This function is exposed for applications that do not use uiRoutes like APM
-// Kibana issue https://github.com/elastic/kibana/issues/19110 tracks the removal of this dependency on uiRouter
-export const registerTimefilterWithGlobalState = _.once(registerTimefilterWithGlobalStateFactory);
diff --git a/src/legacy/ui/public/url/__tests__/extract_app_path_and_id.js b/src/legacy/ui/public/url/__tests__/extract_app_path_and_id.js
deleted file mode 100644
index 965e8f4bc9f383..00000000000000
--- a/src/legacy/ui/public/url/__tests__/extract_app_path_and_id.js
+++ /dev/null
@@ -1,122 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-
-import { extractAppPathAndId } from '../extract_app_path_and_id';
-
-describe('extractAppPathAndId', function () {
-  describe('from an absolute url with a base path', function () {
-    describe('with a base path', function () {
-      const basePath = '/gza';
-      const absoluteUrl = 'http://www.test.com:5601/gza/app/appId#appPathIsHere?query=here';
-      it('extracts app path', function () {
-        expect(extractAppPathAndId(absoluteUrl, basePath).appPath).to.be(
-          'appPathIsHere?query=here'
-        );
-      });
-
-      it('extracts app id', function () {
-        expect(extractAppPathAndId(absoluteUrl, basePath).appId).to.be('appId');
-      });
-
-      it('returns an empty object when there is no app path', function () {
-        const appPathAndId = extractAppPathAndId('http://www.test.com:5601/gza/noapppath');
-        expect(appPathAndId.appId).to.be(undefined);
-        expect(appPathAndId.appPath).to.be(undefined);
-      });
-    });
-
-    describe('without a base path', function () {
-      const absoluteUrl = 'http://www.test.com:5601/app/appId#appPathIsHere?query=here';
-      it('extracts app path', function () {
-        expect(extractAppPathAndId(absoluteUrl).appPath).to.be('appPathIsHere?query=here');
-      });
-
-      it('extracts app id', function () {
-        expect(extractAppPathAndId(absoluteUrl).appId).to.be('appId');
-      });
-
-      it('returns an empty object when there is no app path', function () {
-        const appPathAndId = extractAppPathAndId('http://www.test.com:5601/noapppath');
-        expect(appPathAndId.appId).to.be(undefined);
-        expect(appPathAndId.appPath).to.be(undefined);
-      });
-    });
-
-    describe('when appPath is empty', function () {
-      const absoluteUrl = 'http://www.test.com:5601/app/appId';
-      it('extracts app id', function () {
-        expect(extractAppPathAndId(absoluteUrl).appId).to.be('appId');
-      });
-      it('extracts empty appPath', function () {
-        expect(extractAppPathAndId(absoluteUrl).appPath).to.be('');
-      });
-    });
-  });
-
-  describe('from a root relative url', function () {
-    describe('with a base path', function () {
-      const basePath = '/gza';
-      const rootRelativePath = '/gza/app/appId#appPathIsHere?query=here';
-      it('extracts app path', function () {
-        expect(extractAppPathAndId(rootRelativePath, basePath).appPath).to.be(
-          'appPathIsHere?query=here'
-        );
-      });
-
-      it('extracts app id', function () {
-        expect(extractAppPathAndId(rootRelativePath, basePath).appId).to.be('appId');
-      });
-
-      it('returns an empty object when there is no app path', function () {
-        const appPathAndId = extractAppPathAndId('/gza/notformattedright');
-        expect(appPathAndId.appId).to.be(undefined);
-        expect(appPathAndId.appPath).to.be(undefined);
-      });
-    });
-
-    describe('without a base path', function () {
-      const rootRelativePath = '/app/appId#appPathIsHere?query=here';
-      it('extracts app path', function () {
-        expect(extractAppPathAndId(rootRelativePath).appPath).to.be('appPathIsHere?query=here');
-      });
-
-      it('extracts app id', function () {
-        expect(extractAppPathAndId(rootRelativePath).appId).to.be('appId');
-      });
-
-      it('returns an empty object when there is no app path', function () {
-        const appPathAndId = extractAppPathAndId('/notformattedright');
-        expect(appPathAndId.appId).to.be(undefined);
-        expect(appPathAndId.appPath).to.be(undefined);
-      });
-    });
-
-    describe('when appPath is empty', function () {
-      const rootRelativePath = '/app/appId';
-      it('extracts app id', function () {
-        expect(extractAppPathAndId(rootRelativePath).appId).to.be('appId');
-      });
-      it('extracts empty appPath', function () {
-        expect(extractAppPathAndId(rootRelativePath).appPath).to.be('');
-      });
-    });
-  });
-});
diff --git a/src/legacy/ui/public/url/__tests__/kibana_parsed_url.js b/src/legacy/ui/public/url/__tests__/kibana_parsed_url.js
deleted file mode 100644
index 6ea199c3d22cc1..00000000000000
--- a/src/legacy/ui/public/url/__tests__/kibana_parsed_url.js
+++ /dev/null
@@ -1,217 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-
-import { KibanaParsedUrl } from '../kibana_parsed_url';
-
-describe('KibanaParsedUrl', function () {
-  it('getHashedAppPath', function () {
-    const kibanaParsedUrl = new KibanaParsedUrl({
-      basePath: '/hi',
-      appId: 'bye',
-      appPath: 'visualize?hi=there&bye',
-    });
-    expect(kibanaParsedUrl.getHashedAppPath()).to.be('#visualize?hi=there&bye');
-  });
-
-  it('getAppRootPath', function () {
-    const kibanaParsedUrl = new KibanaParsedUrl({
-      basePath: '/hi',
-      appId: 'appId',
-      appPath: 'dashboard?edit=123',
-    });
-    expect(kibanaParsedUrl.getAppRootPath()).to.be('/app/appId#dashboard?edit=123');
-  });
-
-  describe('when basePath is specified', function () {
-    it('getRootRelativePath', function () {
-      const kibanaParsedUrl = new KibanaParsedUrl({
-        basePath: '/base',
-        appId: 'appId',
-        appPath: 'visualize?hi=there&bye',
-      });
-      expect(kibanaParsedUrl.getRootRelativePath()).to.be('/base/app/appId#visualize?hi=there&bye');
-    });
-
-    describe('getAbsolutePath', function () {
-      const protocol = 'http';
-      const hostname = 'www.test.com';
-      const port = '5601';
-
-      it('returns the absolute url when there is a port', function () {
-        const kibanaParsedUrl = new KibanaParsedUrl({
-          basePath: '/base',
-          appId: 'appId',
-          appPath: 'visualize?hi=there&bye',
-          hostname,
-          protocol,
-          port,
-        });
-        expect(kibanaParsedUrl.getAbsoluteUrl()).to.be(
-          'http://www.test.com:5601/base/app/appId#visualize?hi=there&bye'
-        );
-      });
-
-      it('returns the absolute url when there are no query parameters', function () {
-        const kibanaParsedUrl = new KibanaParsedUrl({
-          basePath: '/base',
-          appId: 'appId',
-          appPath: 'visualize',
-          hostname,
-          protocol,
-        });
-        expect(kibanaParsedUrl.getAbsoluteUrl()).to.be(
-          'http://www.test.com/base/app/appId#visualize'
-        );
-      });
-
-      it('returns the absolute url when the are query parameters', function () {
-        const kibanaParsedUrl = new KibanaParsedUrl({
-          basePath: '/base',
-          appId: 'appId',
-          appPath: 'visualize?hi=bye&tata',
-          hostname,
-          protocol,
-        });
-        expect(kibanaParsedUrl.getAbsoluteUrl()).to.be(
-          'http://www.test.com/base/app/appId#visualize?hi=bye&tata'
-        );
-      });
-    });
-  });
-
-  describe('when basePath is not specified', function () {
-    it('getRootRelativePath', function () {
-      const kibanaParsedUrl = new KibanaParsedUrl({
-        appId: 'appId',
-        appPath: 'visualize?hi=there&bye',
-      });
-      expect(kibanaParsedUrl.getRootRelativePath()).to.be('/app/appId#visualize?hi=there&bye');
-    });
-
-    describe('getAbsolutePath', function () {
-      const protocol = 'http';
-      const hostname = 'www.test.com';
-      const port = '5601';
-
-      it('returns the absolute url when there is a port', function () {
-        const kibanaParsedUrl = new KibanaParsedUrl({
-          appId: 'appId',
-          appPath: 'visualize?hi=there&bye',
-          hostname,
-          protocol,
-          port,
-        });
-        expect(kibanaParsedUrl.getAbsoluteUrl()).to.be(
-          'http://www.test.com:5601/app/appId#visualize?hi=there&bye'
-        );
-      });
-
-      it('returns the absolute url when there are no query parameters', function () {
-        const kibanaParsedUrl = new KibanaParsedUrl({
-          appId: 'appId',
-          appPath: 'visualize',
-          hostname,
-          protocol,
-        });
-        expect(kibanaParsedUrl.getAbsoluteUrl()).to.be('http://www.test.com/app/appId#visualize');
-      });
-
-      it('returns the absolute url when there are query parameters', function () {
-        const kibanaParsedUrl = new KibanaParsedUrl({
-          appId: 'appId',
-          appPath: 'visualize?hi=bye&tata',
-          hostname,
-          protocol,
-        });
-        expect(kibanaParsedUrl.getAbsoluteUrl()).to.be(
-          'http://www.test.com/app/appId#visualize?hi=bye&tata'
-        );
-      });
-    });
-  });
-
-  describe('getGlobalState', function () {
-    const basePath = '/xyz';
-    const appId = 'myApp';
-
-    it('returns an empty string when the KibanaParsedUrl is in an invalid state', function () {
-      const url = new KibanaParsedUrl({ basePath });
-      expect(url.getGlobalState()).to.be('');
-    });
-
-    it('returns an empty string when there is no global state', function () {
-      const url = new KibanaParsedUrl({ basePath, appId, appPath: '/hi?notg=something' });
-      expect(url.getGlobalState()).to.be('');
-    });
-
-    it('returns the global state when it is the last parameter', function () {
-      const url = new KibanaParsedUrl({
-        basePath,
-        appId,
-        appPath: '/hi?notg=something&_g=(thisismyglobalstate)',
-      });
-      expect(url.getGlobalState()).to.be('(thisismyglobalstate)');
-    });
-
-    it('returns the global state when it is the first parameter', function () {
-      const url = new KibanaParsedUrl({
-        basePath,
-        appId,
-        appPath: '/hi?_g=(thisismyglobalstate)&hi=bye',
-      });
-      expect(url.getGlobalState()).to.be('(thisismyglobalstate)');
-    });
-  });
-
-  describe('setGlobalState', function () {
-    const basePath = '/xyz';
-    const appId = 'myApp';
-
-    it('does nothing when KibanaParsedUrl is in an invalid state', function () {
-      const url = new KibanaParsedUrl({ basePath });
-      url.setGlobalState('newglobalstate');
-      expect(url.getGlobalState()).to.be('');
-    });
-
-    it('clears the global state when setting it to an empty string', function () {
-      const url = new KibanaParsedUrl({ basePath, appId, appPath: '/hi?_g=globalstate' });
-      url.setGlobalState('');
-      expect(url.getGlobalState()).to.be('');
-    });
-
-    it('updates the global state when a string is passed in', function () {
-      const url = new KibanaParsedUrl({
-        basePath,
-        appId,
-        appPath: '/hi?notg=something&_g=oldstate',
-      });
-      url.setGlobalState('newstate');
-      expect(url.getGlobalState()).to.be('newstate');
-    });
-
-    it('adds the global state parameters if it did not exist before', function () {
-      const url = new KibanaParsedUrl({ basePath, appId, appPath: '/hi' });
-      url.setGlobalState('newstate');
-      expect(url.getGlobalState()).to.be('newstate');
-      expect(url.appPath).to.be('/hi?_g=newstate');
-    });
-  });
-});
diff --git a/src/legacy/ui/public/url/__tests__/prepend_path.js b/src/legacy/ui/public/url/__tests__/prepend_path.js
deleted file mode 100644
index 36991b77553e40..00000000000000
--- a/src/legacy/ui/public/url/__tests__/prepend_path.js
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-
-import { prependPath } from '../prepend_path';
-
-describe('url prependPath', function () {
-  describe('returns the relative path unchanged', function () {
-    it('if it is null', function () {
-      expect(prependPath(null, 'kittens')).to.be(null);
-    });
-
-    it('if it is undefined', function () {
-      expect(prependPath(undefined, 'kittens')).to.be(undefined);
-    });
-
-    it('if it is an absolute url', function () {
-      expect(prependPath('http://www.hithere.com/howareyou', 'welcome')).to.be(
-        'http://www.hithere.com/howareyou'
-      );
-    });
-
-    it('if it does not start with a /', function () {
-      expect(prependPath('are/so/cool', 'cats')).to.be('are/so/cool');
-    });
-
-    it('when new path is empty', function () {
-      expect(prependPath('/are/so/cool', '')).to.be('/are/so/cool');
-    });
-
-    it('when it is only a slash and new path is empty', function () {
-      expect(prependPath('/', '')).to.be('/');
-    });
-  });
-
-  describe('returns an updated relative path', function () {
-    it('when it starts with a slash', function () {
-      expect(prependPath('/are/so/cool', 'dinosaurs')).to.be('dinosaurs/are/so/cool');
-    });
-
-    it('when new path starts with a slash', function () {
-      expect(prependPath('/are/so/cool', '/fish')).to.be('/fish/are/so/cool');
-    });
-
-    it('with two slashes if new path is a slash', function () {
-      expect(prependPath('/are/so/cool', '/')).to.be('//are/so/cool');
-    });
-
-    it('when there is a slash on the end', function () {
-      expect(prependPath('/are/delicious/', 'lollipops')).to.be('lollipops/are/delicious/');
-    });
-
-    it('when pathname that ends with a file', function () {
-      expect(prependPath('/are/delicious/index.html', 'donuts')).to.be(
-        'donuts/are/delicious/index.html'
-      );
-    });
-
-    it('when it is only a slash', function () {
-      expect(prependPath('/', 'kittens')).to.be('kittens/');
-    });
-  });
-});
diff --git a/src/legacy/ui/public/url/__tests__/url.js b/src/legacy/ui/public/url/__tests__/url.js
deleted file mode 100644
index 8b173482e1bb4d..00000000000000
--- a/src/legacy/ui/public/url/__tests__/url.js
+++ /dev/null
@@ -1,562 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import faker from 'faker';
-import _ from 'lodash';
-import { AppStateProvider } from '../../state_management/app_state';
-import '..';
-
-// global vars, injected and mocked in init()
-let kbnUrl;
-let $route;
-let $location;
-let $rootScope;
-let appState;
-
-class StubAppState {
-  constructor() {
-    this.getQueryParamName = () => '_a';
-    this.toQueryParam = () => 'stateQueryParam';
-    this.destroy = sinon.stub();
-  }
-}
-
-function init() {
-  ngMock.module('kibana/url', 'kibana', function ($provide, PrivateProvider) {
-    $provide.service('$route', function () {
-      return {
-        reload: _.noop,
-      };
-    });
-
-    appState = new StubAppState();
-    PrivateProvider.swap(AppStateProvider, ($decorate) => {
-      const AppState = $decorate();
-      AppState.getAppState = () => appState;
-      return AppState;
-    });
-  });
-
-  ngMock.inject(function ($injector) {
-    $route = $injector.get('$route');
-    $location = $injector.get('$location');
-    $rootScope = $injector.get('$rootScope');
-    kbnUrl = $injector.get('kbnUrl');
-  });
-}
-
-describe('kbnUrl', function () {
-  beforeEach(function () {
-    init();
-  });
-
-  describe('forcing reload', function () {
-    it('schedules a listener for $locationChangeSuccess on the $rootScope', function () {
-      $location.url('/url');
-      $route.current = {
-        $$route: {
-          regex: /.*/,
-        },
-      };
-
-      sinon.stub($rootScope, '$on');
-
-      expect($rootScope.$on.callCount).to.be(0);
-      kbnUrl.change('/url');
-      sinon.assert.calledOnce(appState.destroy);
-      expect($rootScope.$on.callCount).to.be(1);
-      expect($rootScope.$on.firstCall.args[0]).to.be('$locationChangeSuccess');
-    });
-
-    it('handler unbinds the listener and calls reload', function () {
-      $location.url('/url');
-      $route.current = {
-        $$route: {
-          regex: /.*/,
-        },
-      };
-
-      const unbind = sinon.stub();
-      sinon.stub($rootScope, '$on').returns(unbind);
-      $route.reload = sinon.stub();
-
-      expect($rootScope.$on.callCount).to.be(0);
-      kbnUrl.change('/url');
-      expect($rootScope.$on.callCount).to.be(1);
-
-      const handler = $rootScope.$on.firstCall.args[1];
-      handler();
-      expect(unbind.callCount).to.be(1);
-      expect($route.reload.callCount).to.be(1);
-    });
-
-    it('reloads requested before the first are ignored', function () {
-      $location.url('/url');
-      $route.current = {
-        $$route: {
-          regex: /.*/,
-        },
-      };
-      $route.reload = sinon.stub();
-
-      sinon.stub($rootScope, '$on').returns(sinon.stub());
-
-      expect($rootScope.$on.callCount).to.be(0);
-      kbnUrl.change('/url');
-      expect($rootScope.$on.callCount).to.be(1);
-
-      // don't call the first handler
-
-      kbnUrl.change('/url');
-      expect($rootScope.$on.callCount).to.be(1);
-    });
-
-    it('one reload can happen once the first has completed', function () {
-      $location.url('/url');
-      $route.current = {
-        $$route: {
-          regex: /.*/,
-        },
-      };
-      $route.reload = sinon.stub();
-
-      sinon.stub($rootScope, '$on').returns(sinon.stub());
-
-      expect($rootScope.$on.callCount).to.be(0);
-      kbnUrl.change('/url');
-      expect($rootScope.$on.callCount).to.be(1);
-
-      // call the first handler
-      $rootScope.$on.firstCall.args[1]();
-      expect($route.reload.callCount).to.be(1);
-
-      expect($rootScope.$on.callCount).to.be(1);
-      kbnUrl.change('/url');
-      expect($rootScope.$on.callCount).to.be(2);
-    });
-  });
-
-  describe('remove', function () {
-    it('removes a parameter with a value from the url', function () {
-      $location.url('/myurl?exist&WithAParamToRemove=2&anothershouldexist=5');
-      kbnUrl.removeParam('WithAParamToRemove');
-      expect($location.url()).to.be('/myurl?exist&anothershouldexist=5');
-    });
-
-    it('removes a parameter with no value from the url', function () {
-      $location.url('/myurl?removeme&hi=5');
-      kbnUrl.removeParam('removeme');
-      expect($location.url()).to.be('/myurl?hi=5');
-    });
-
-    it('is noop if the given parameter doesn\t exist in the url', function () {
-      $location.url('/myurl?hi&bye');
-      kbnUrl.removeParam('noexist');
-      expect($location.url()).to.be('/myurl?hi&bye');
-    });
-
-    it('is noop if given empty string param', function () {
-      $location.url('/myurl?hi&bye');
-      kbnUrl.removeParam('');
-      expect($location.url()).to.be('/myurl?hi&bye');
-    });
-  });
-
-  describe('change', function () {
-    it('should set $location.url', function () {
-      sinon.stub($location, 'url');
-
-      expect($location.url.callCount).to.be(0);
-      kbnUrl.change('/some-url');
-      expect($location.url.callCount).to.be(1);
-    });
-
-    it('should uri encode replaced params', function () {
-      const url = '/some/path/';
-      const params = { replace: faker.Lorem.words(3).join(' ') };
-      const check = encodeURIComponent(params.replace);
-      sinon.stub($location, 'url');
-
-      kbnUrl.change(url + '{{replace}}', params);
-
-      expect($location.url.firstCall.args[0]).to.be(url + check);
-    });
-
-    it('should parse angular expression in substitutions and uri encode the results', function () {
-      // build url by piecing together these parts
-      const urlParts = ['/', '/', '?', '&', '#'];
-      // make sure it can parse templates with weird spacing
-      const wrappers = [
-        ['{{', '}}'],
-        ['{{ ', ' }}'],
-        ['{{', '  }}'],
-        ['{{    ', '}}'],
-        ['{{    ', '         }}'],
-      ];
-      // make sure filters are evaluated via angular expressions
-      const objIndex = 4; // used to case one replace as an object
-      const filters = ['', 'uppercase', '', 'uppercase', ''];
-
-      // the words (template keys) used must all be unique
-      const words = _.uniq(faker.Lorem.words(10))
-        .slice(0, urlParts.length)
-        .map(function (word, i) {
-          if (filters[i].length) {
-            return word + '|' + filters[i];
-          }
-          return word;
-        });
-
-      const replacements = faker.Lorem.words(urlParts.length).map(function (word, i) {
-        // make selected replacement into an object
-        if (i === objIndex) {
-          return { replace: word };
-        }
-
-        return word;
-      });
-
-      // build the url and test url
-      let url = '';
-      let testUrl = '';
-      urlParts.forEach(function (part, i) {
-        url += part + wrappers[i][0] + words[i] + wrappers[i][1];
-        const locals = {};
-        locals[words[i].split('|')[0]] = replacements[i];
-        testUrl += part + encodeURIComponent($rootScope.$eval(words[i], locals));
-      });
-
-      // create the locals replacement object
-      const params = {};
-      replacements.forEach(function (replacement, i) {
-        const word = words[i].split('|')[0];
-        params[word] = replacement;
-      });
-
-      sinon.stub($location, 'url');
-
-      kbnUrl.change(url, params);
-
-      expect($location.url.firstCall.args[0]).to.not.be(url);
-      expect($location.url.firstCall.args[0]).to.be(testUrl);
-    });
-
-    it('should handle dot notation', function () {
-      const url = '/some/thing/{{that.is.substituted}}';
-
-      kbnUrl.change(url, {
-        that: {
-          is: {
-            substituted: 'test',
-          },
-        },
-      });
-
-      expect($location.url()).to.be('/some/thing/test');
-    });
-
-    it('should throw when params are missing', function () {
-      const url = '/{{replace_me}}';
-      const params = {};
-
-      try {
-        kbnUrl.change(url, params);
-        throw new Error('this should not run');
-      } catch (err) {
-        expect(err).to.be.an(Error);
-        expect(err.message).to.match(/replace_me/);
-      }
-    });
-
-    it('should throw when filtered params are missing', function () {
-      const url = '/{{replace_me|number}}';
-      const params = {};
-
-      try {
-        kbnUrl.change(url, params);
-        throw new Error('this should not run');
-      } catch (err) {
-        expect(err).to.be.an(Error);
-        expect(err.message).to.match(/replace_me\|number/);
-      }
-    });
-
-    it('should change the entire url', function () {
-      const path = '/test/path';
-      const search = { search: 'test' };
-      const hash = 'hash';
-      const newPath = '/new/location';
-
-      $location.path(path).search(search).hash(hash);
-
-      // verify the starting state
-      expect($location.path()).to.be(path);
-      expect($location.search()).to.eql(search);
-      expect($location.hash()).to.be(hash);
-
-      kbnUrl.change(newPath);
-
-      // verify the ending state
-      expect($location.path()).to.be(newPath);
-      expect($location.search()).to.eql({});
-      expect($location.hash()).to.be('');
-    });
-
-    it('should allow setting app state on the target url', function () {
-      const path = '/test/path';
-      const search = { search: 'test' };
-      const hash = 'hash';
-      const newPath = '/new/location';
-
-      $location.path(path).search(search).hash(hash);
-
-      // verify the starting state
-      expect($location.path()).to.be(path);
-      expect($location.search()).to.eql(search);
-      expect($location.hash()).to.be(hash);
-
-      kbnUrl.change(newPath, null, new StubAppState());
-
-      // verify the ending state
-      expect($location.path()).to.be(newPath);
-      expect($location.search()).to.eql({ _a: 'stateQueryParam' });
-      expect($location.hash()).to.be('');
-    });
-  });
-
-  describe('changePath', function () {
-    it('should change just the path', function () {
-      const path = '/test/path';
-      const search = { search: 'test' };
-      const hash = 'hash';
-      const newPath = '/new/location';
-
-      $location.path(path).search(search).hash(hash);
-
-      // verify the starting state
-      expect($location.path()).to.be(path);
-      expect($location.search()).to.eql(search);
-      expect($location.hash()).to.be(hash);
-
-      kbnUrl.changePath(newPath);
-
-      // verify the ending state
-      expect($location.path()).to.be(newPath);
-      expect($location.search()).to.eql(search);
-      expect($location.hash()).to.be(hash);
-    });
-  });
-
-  describe('redirect', function () {
-    it('should change the entire url', function () {
-      const path = '/test/path';
-      const search = { search: 'test' };
-      const hash = 'hash';
-      const newPath = '/new/location';
-
-      $location.path(path).search(search).hash(hash);
-
-      // verify the starting state
-      expect($location.path()).to.be(path);
-      expect($location.search()).to.eql(search);
-      expect($location.hash()).to.be(hash);
-
-      kbnUrl.redirect(newPath);
-
-      // verify the ending state
-      expect($location.path()).to.be(newPath);
-      expect($location.search()).to.eql({});
-      expect($location.hash()).to.be('');
-    });
-
-    it('should allow setting app state on the target url', function () {
-      const path = '/test/path';
-      const search = { search: 'test' };
-      const hash = 'hash';
-      const newPath = '/new/location';
-
-      $location.path(path).search(search).hash(hash);
-
-      // verify the starting state
-      expect($location.path()).to.be(path);
-      expect($location.search()).to.eql(search);
-      expect($location.hash()).to.be(hash);
-
-      kbnUrl.redirect(newPath, null, new StubAppState());
-
-      // verify the ending state
-      expect($location.path()).to.be(newPath);
-      expect($location.search()).to.eql({ _a: 'stateQueryParam' });
-      expect($location.hash()).to.be('');
-    });
-
-    it('should replace the current history entry', function () {
-      sinon.stub($location, 'replace');
-      $location.url('/some/path');
-
-      expect($location.replace.callCount).to.be(0);
-      kbnUrl.redirect('/new/path/');
-      expect($location.replace.callCount).to.be(1);
-    });
-
-    it('should call replace on $location', function () {
-      sinon.stub(kbnUrl, '_shouldForceReload').returns(false);
-      sinon.stub($location, 'replace');
-
-      expect($location.replace.callCount).to.be(0);
-      kbnUrl.redirect('/poop');
-      expect($location.replace.callCount).to.be(1);
-    });
-  });
-
-  describe('redirectPath', function () {
-    it('should only change the path', function () {
-      const path = '/test/path';
-      const search = { search: 'test' };
-      const hash = 'hash';
-      const newPath = '/new/location';
-
-      $location.path(path).search(search).hash(hash);
-
-      // verify the starting state
-      expect($location.path()).to.be(path);
-      expect($location.search()).to.eql(search);
-      expect($location.hash()).to.be(hash);
-
-      kbnUrl.redirectPath(newPath);
-
-      // verify the ending state
-      expect($location.path()).to.be(newPath);
-      expect($location.search()).to.eql(search);
-      expect($location.hash()).to.be(hash);
-    });
-
-    it('should call replace on $location', function () {
-      sinon.stub(kbnUrl, '_shouldForceReload').returns(false);
-      sinon.stub($location, 'replace');
-
-      expect($location.replace.callCount).to.be(0);
-      kbnUrl.redirectPath('/poop');
-      expect($location.replace.callCount).to.be(1);
-    });
-  });
-
-  describe('_shouldForceReload', function () {
-    let next;
-    let prev;
-
-    beforeEach(function () {
-      $route.current = {
-        $$route: {
-          regexp: /^\/is-current-route\/(\d+)/,
-          reloadOnSearch: true,
-        },
-      };
-
-      prev = { path: '/is-current-route/1', search: {} };
-      next = { path: '/is-current-route/1', search: {} };
-    });
-
-    it("returns false if the passed url doesn't match the current route", function () {
-      next.path = '/not current';
-      expect(kbnUrl._shouldForceReload(next, prev, $route)).to.be(false);
-    });
-
-    describe('if the passed url does match the route', function () {
-      describe('and the route reloads on search', function () {
-        describe('and the path is the same', function () {
-          describe('and the search params are the same', function () {
-            it('returns true', function () {
-              expect(kbnUrl._shouldForceReload(next, prev, $route)).to.be(true);
-            });
-          });
-          describe('but the search params are different', function () {
-            it('returns false', function () {
-              next.search = {};
-              prev.search = { q: 'search term' };
-              expect(kbnUrl._shouldForceReload(next, prev, $route)).to.be(false);
-            });
-          });
-        });
-
-        describe('and the path is different', function () {
-          beforeEach(function () {
-            next.path = '/not-same';
-          });
-
-          describe('and the search params are the same', function () {
-            it('returns false', function () {
-              expect(kbnUrl._shouldForceReload(next, prev, $route)).to.be(false);
-            });
-          });
-          describe('but the search params are different', function () {
-            it('returns false', function () {
-              next.search = {};
-              prev.search = { q: 'search term' };
-              expect(kbnUrl._shouldForceReload(next, prev, $route)).to.be(false);
-            });
-          });
-        });
-      });
-
-      describe('but the route does not reload on search', function () {
-        beforeEach(function () {
-          $route.current.$$route.reloadOnSearch = false;
-        });
-
-        describe('and the path is the same', function () {
-          describe('and the search params are the same', function () {
-            it('returns true', function () {
-              expect(kbnUrl._shouldForceReload(next, prev, $route)).to.be(true);
-            });
-          });
-          describe('but the search params are different', function () {
-            it('returns true', function () {
-              next.search = {};
-              prev.search = { q: 'search term' };
-              expect(kbnUrl._shouldForceReload(next, prev, $route)).to.be(true);
-            });
-          });
-        });
-
-        describe('and the path is different', function () {
-          beforeEach(function () {
-            next.path = '/not-same';
-          });
-
-          describe('and the search params are the same', function () {
-            it('returns false', function () {
-              expect(kbnUrl._shouldForceReload(next, prev, $route)).to.be(false);
-            });
-          });
-          describe('but the search params are different', function () {
-            it('returns false', function () {
-              next.search = {};
-              prev.search = { q: 'search term' };
-              expect(kbnUrl._shouldForceReload(next, prev, $route)).to.be(false);
-            });
-          });
-        });
-      });
-    });
-  });
-});
diff --git a/src/legacy/ui/public/url/absolute_to_parsed_url.ts b/src/legacy/ui/public/url/absolute_to_parsed_url.ts
deleted file mode 100644
index 30f493c25776c2..00000000000000
--- a/src/legacy/ui/public/url/absolute_to_parsed_url.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { parse } from 'url';
-
-import { extractAppPathAndId } from './extract_app_path_and_id';
-import { KibanaParsedUrl } from './kibana_parsed_url';
-
-/**
- *
- * @param absoluteUrl - an absolute url, e.g. https://localhost:5601/gra/app/visualize#/edit/viz_id?hi=bye
- * @param basePath - An optional base path for kibana. If supplied, should start with a "/".
- * e.g. in https://localhost:5601/gra/app/visualize#/edit/viz_id the basePath is
- * "/gra".
- * @return {KibanaParsedUrl}
- */
-export function absoluteToParsedUrl(absoluteUrl: string, basePath = '') {
-  const { appPath, appId } = extractAppPathAndId(absoluteUrl, basePath);
-  const { hostname, port, protocol } = parse(absoluteUrl);
-  return new KibanaParsedUrl({
-    basePath,
-    appId: appId!,
-    appPath,
-    hostname,
-    port,
-    protocol,
-  });
-}
diff --git a/src/legacy/ui/public/url/extract_app_path_and_id.ts b/src/legacy/ui/public/url/extract_app_path_and_id.ts
deleted file mode 100644
index 44bba272e0873a..00000000000000
--- a/src/legacy/ui/public/url/extract_app_path_and_id.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { parse } from 'url';
-
-/**
- * If the url is determined to contain an appId and appPath, it returns those portions. If it is not in the right
- * format and an appId and appPath can't be extracted, it returns an empty object.
- * @param {string} url - a relative or absolute url which contains an appPath, an appId, and optionally, a basePath.
- * @param {string} basePath - optional base path, if given should start with "/".
- */
-export function extractAppPathAndId(url: string, basePath = '') {
-  const parsedUrl = parse(url);
-  if (!parsedUrl.path) {
-    return {};
-  }
-  const pathWithoutBase = parsedUrl.path.slice(basePath.length);
-
-  if (!pathWithoutBase.startsWith('/app/')) {
-    return {};
-  }
-
-  const appPath = parsedUrl.hash && parsedUrl.hash.length > 0 ? parsedUrl.hash.slice(1) : '';
-  return { appId: pathWithoutBase.slice('/app/'.length), appPath };
-}
diff --git a/src/legacy/ui/public/url/index.js b/src/legacy/ui/public/url/index.js
deleted file mode 100644
index 8ef267de2890c2..00000000000000
--- a/src/legacy/ui/public/url/index.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { KbnUrlProvider } from './url';
-export { RedirectWhenMissingProvider } from './redirect_when_missing';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-export { modifyUrl } from '../../../../core/utils';
diff --git a/src/legacy/ui/public/url/kbn_url.ts b/src/legacy/ui/public/url/kbn_url.ts
deleted file mode 100644
index 42b6a8f19f9a9d..00000000000000
--- a/src/legacy/ui/public/url/kbn_url.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export interface KbnUrl {
-  change: (url: string) => void;
-  removeParam: (param: string) => void;
-}
diff --git a/src/legacy/ui/public/url/kibana_parsed_url.ts b/src/legacy/ui/public/url/kibana_parsed_url.ts
deleted file mode 100644
index 1c60e8729e0ff6..00000000000000
--- a/src/legacy/ui/public/url/kibana_parsed_url.ts
+++ /dev/null
@@ -1,148 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { parse } from 'url';
-
-import { modifyUrl } from '../../../../core/public';
-import { prependPath } from './prepend_path';
-
-interface Options {
-  /**
-   * An optional base path for kibana. If supplied, should start with a "/".
-   * e.g. in https://localhost:5601/gra/app/visualize#/edit/viz_id the
-   * basePath is "/gra"
-   */
-  basePath?: string;
-
-  /**
-   * The app id.
-   * e.g. in https://localhost:5601/gra/app/visualize#/edit/viz_id the app id is "kibana".
-   */
-  appId: string;
-
-  /**
-   * The path for a page in the the app. Should start with a "/". Don't include the hash sign. Can
-   * include all query parameters.
-   * e.g. in https://localhost:5601/gra/app/visualize#/edit/viz_id?g=state the appPath is
-   * "/edit/viz_id?g=state"
-   */
-  appPath?: string;
-
-  /**
-   * Optional hostname. Uses current window location's hostname if hostname, port,
-   * and protocol are undefined.
-   */
-  hostname?: string;
-
-  /**
-   * Optional port. Uses current window location's port if hostname, port,
-   * and protocol are undefined.
-   */
-  port?: string;
-
-  /**
-   * Optional protocol. Uses current window location's protocol if hostname, port,
-   * and protocol are undefined.
-   */
-  protocol?: string;
-}
-
-/**
- * Represents the pieces that make up a url in Kibana, offering some helpful functionality
- * for translating those pieces into absolute or relative urls. A Kibana url with a basePath
- * looks like this: http://localhost:5601/basePath/app/appId#/an/appPath?with=query&params
- *
- *  - basePath is "/basePath"
- *  - appId is "appId"
- *  - appPath is "/an/appPath?with=query&params"
- *
- * Almost all urls in Kibana should have this structure, including the "/app" portion in front of the appId
- * (one exception is the login link).
- */
-export class KibanaParsedUrl {
-  public appId: string;
-  public appPath: string;
-  public basePath: string;
-  public hostname?: string;
-  public protocol?: string;
-  public port?: string;
-
-  constructor(options: Options) {
-    const { appId, basePath = '', appPath = '', hostname, protocol, port } = options;
-
-    // We'll use window defaults
-    const hostOrProtocolSpecified = hostname || protocol || port;
-
-    this.basePath = basePath;
-    this.appId = appId;
-    this.appPath = appPath;
-    this.hostname = hostOrProtocolSpecified ? hostname : window.location.hostname;
-    this.port = hostOrProtocolSpecified ? port : window.location.port;
-    this.protocol = hostOrProtocolSpecified ? protocol : window.location.protocol;
-  }
-
-  public getGlobalState() {
-    if (!this.appPath) {
-      return '';
-    }
-    const parsedUrl = parse(this.appPath, true);
-    const query = parsedUrl.query || {};
-    return query._g || '';
-  }
-
-  public setGlobalState(newGlobalState: string | string[]) {
-    if (!this.appPath) {
-      return;
-    }
-
-    this.appPath = modifyUrl(this.appPath, (parsed) => {
-      parsed.query._g = newGlobalState;
-    });
-  }
-
-  public addQueryParameter(name: string, val: string) {
-    this.appPath = modifyUrl(this.appPath, (parsed) => {
-      parsed.query[name] = val;
-    });
-  }
-
-  public getHashedAppPath() {
-    return `#${this.appPath}`;
-  }
-
-  public getAppBasePath() {
-    return `/${this.appId}`;
-  }
-
-  public getAppRootPath() {
-    return `/app${this.getAppBasePath()}${this.getHashedAppPath()}`;
-  }
-
-  public getRootRelativePath() {
-    return prependPath(this.getAppRootPath(), this.basePath);
-  }
-
-  public getAbsoluteUrl() {
-    return modifyUrl(this.getRootRelativePath(), (parsed) => {
-      parsed.protocol = this.protocol;
-      parsed.port = this.port;
-      parsed.hostname = this.hostname;
-    });
-  }
-}
diff --git a/src/legacy/ui/public/url/prepend_path.ts b/src/legacy/ui/public/url/prepend_path.ts
deleted file mode 100644
index b8a77d5c23beeb..00000000000000
--- a/src/legacy/ui/public/url/prepend_path.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { isString } from 'lodash';
-import { format, parse } from 'url';
-
-/**
- *
- * @param {string} relativePath - a relative path that must start with a "/".
- * @param {string} newPath - the new path to prefix. ex: 'xyz'
- * @return {string} the url with the basePath prepended. ex. '/xyz/app/kibana#/management'. If
- * the relative path isn't in the right format (e.g. doesn't start with a "/") the relativePath is returned
- * unchanged.
- */
-export function prependPath(relativePath: string, newPath = '') {
-  if (!relativePath || !isString(relativePath)) {
-    return relativePath;
-  }
-
-  const parsed = parse(relativePath, true, true);
-  if (!parsed.host && parsed.pathname) {
-    if (parsed.pathname[0] === '/') {
-      parsed.pathname = newPath + parsed.pathname;
-    }
-  }
-
-  return format({
-    protocol: parsed.protocol,
-    host: parsed.host,
-    pathname: parsed.pathname,
-    query: parsed.query,
-    hash: parsed.hash,
-  });
-}
diff --git a/src/legacy/ui/public/url/redirect_when_missing.js b/src/legacy/ui/public/url/redirect_when_missing.js
deleted file mode 100644
index 85c90a14d9fd78..00000000000000
--- a/src/legacy/ui/public/url/redirect_when_missing.js
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React from 'react';
-import { i18n } from '@kbn/i18n';
-import { MarkdownSimple } from '../../../../plugins/kibana_react/public';
-import { toastNotifications } from 'ui/notify';
-import { SavedObjectNotFound } from '../../../../plugins/kibana_utils/public';
-import { uiModules } from '../modules';
-
-uiModules.get('kibana/url').service('redirectWhenMissing', function (Private) {
-  return Private(RedirectWhenMissingProvider);
-});
-
-export function RedirectWhenMissingProvider(kbnUrl, Promise) {
-  /**
-   * Creates an error handler that will redirect to a url when a SavedObjectNotFound
-   * error is thrown
-   *
-   * @param  {string|object} mapping - a mapping of url's to redirect to based on the saved object that
-   *                                 couldn't be found, or just a string that will be used for all types
-   * @return {function} - the handler to pass to .catch()
-   */
-  return function (mapping) {
-    if (typeof mapping === 'string') {
-      mapping = { '*': mapping };
-    }
-
-    return function (error) {
-      // if this error is not "404", rethrow
-      const savedObjectNotFound = error instanceof SavedObjectNotFound;
-      const unknownVisType = error.message.indexOf('Invalid type') === 0;
-      if (unknownVisType) {
-        error.savedObjectType = 'visualization';
-      } else if (!savedObjectNotFound) {
-        throw error;
-      }
-
-      let url = mapping[error.savedObjectType] || mapping['*'];
-      if (!url) url = '/';
-
-      url += (url.indexOf('?') >= 0 ? '&' : '?') + `notFound=${error.savedObjectType}`;
-
-      toastNotifications.addWarning({
-        title: i18n.translate('common.ui.url.savedObjectIsMissingNotificationMessage', {
-          defaultMessage: 'Saved object is missing',
-        }),
-        text: <MarkdownSimple>{error.message}</MarkdownSimple>,
-      });
-
-      kbnUrl.redirect(url);
-      return Promise.halt();
-    };
-  };
-}
diff --git a/src/legacy/ui/public/url/relative_to_absolute.ts b/src/legacy/ui/public/url/relative_to_absolute.ts
deleted file mode 100644
index 7d0737d145a1b2..00000000000000
--- a/src/legacy/ui/public/url/relative_to_absolute.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- *
- * @param {string} url - a relative or root relative url.  If a relative path is given then the
- * absolute url returned will depend on the current page where this function is called from. For example
- * if you are on page "http://www.mysite.com/shopping/kids" and you pass this function "adults", you would get
- * back "http://www.mysite.com/shopping/adults".  If you passed this function a root relative path, or one that
- * starts with a "/", for example "/account/cart", you would get back "http://www.mysite.com/account/cart".
- * @return {string} the relative url transformed into an absolute url
- */
-export function relativeToAbsolute(url: string) {
-  // convert all link urls to absolute urls
-  const a = document.createElement('a');
-  a.setAttribute('href', url);
-  return a.href;
-}
diff --git a/src/legacy/ui/public/url/url.js b/src/legacy/ui/public/url/url.js
deleted file mode 100644
index fb243b02e05c7c..00000000000000
--- a/src/legacy/ui/public/url/url.js
+++ /dev/null
@@ -1,247 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import { i18n } from '@kbn/i18n';
-import { uiModules } from '../modules';
-import { AppStateProvider } from '../state_management/app_state';
-
-uiModules.get('kibana/url').service('kbnUrl', function (Private, $injector) {
-  //config is not directly used but registers global event listeners to kbnUrl to function
-  $injector.get('config');
-  return Private(KbnUrlProvider);
-});
-
-export function KbnUrlProvider($injector, $location, $rootScope, $parse, Private) {
-  /**
-   *  the `kbnUrl` service was created to smooth over some of the
-   *  inconsistent behavior that occurs when modifying the url via
-   *  the `$location` api. In general it is recommended that you use
-   *  the `kbnUrl` service any time you want to modify the url.
-   *
-   *  "features" that `kbnUrl` does it's best to guarantee, which
-   *  are not guaranteed with the `$location` service:
-   *   - calling `kbnUrl.change()` with a url that resolves to the current
-   *     route will force a full transition (rather than just updating the
-   *     properties of the $route object)
-   *
-   *  Additional features of `kbnUrl`
-   *   - parameterized urls
-   *   - easily include an app state with the url
-   *
-   *  @type {KbnUrl}
-   */
-  const self = this;
-
-  /**
-   * Navigate to a url
-   *
-   * @param  {String} url - the new url, can be a template. See #eval
-   * @param  {Object} [paramObj] - optional set of parameters for the url template
-   * @return {undefined}
-   */
-  self.change = function (url, paramObj, appState) {
-    self._changeLocation('url', url, paramObj, false, appState);
-  };
-
-  /**
-   * Same as #change except only changes the url's path,
-   * leaving the search string and such intact
-   *
-   * @param  {String} path - the new path, can be a template. See #eval
-   * @param  {Object} [paramObj] - optional set of parameters for the path template
-   * @return {undefined}
-   */
-  self.changePath = function (path, paramObj) {
-    self._changeLocation('path', path, paramObj);
-  };
-
-  /**
-   * Same as #change except that it removes the current url from history
-   *
-   * @param  {String} url - the new url, can be a template. See #eval
-   * @param  {Object} [paramObj] - optional set of parameters for the url template
-   * @return {undefined}
-   */
-  self.redirect = function (url, paramObj, appState) {
-    self._changeLocation('url', url, paramObj, true, appState);
-  };
-
-  /**
-   * Same as #redirect except only changes the url's path,
-   * leaving the search string and such intact
-   *
-   * @param  {String} path - the new path, can be a template. See #eval
-   * @param  {Object} [paramObj] - optional set of parameters for the path template
-   * @return {undefined}
-   */
-  self.redirectPath = function (path, paramObj) {
-    self._changeLocation('path', path, paramObj, true);
-  };
-
-  /**
-   * Evaluate a url template. templates can contain double-curly wrapped
-   * expressions that are evaluated in the context of the paramObj
-   *
-   * @param  {String} template - the url template to evaluate
-   * @param  {Object} [paramObj] - the variables to expose to the template
-   * @return {String} - the evaluated result
-   * @throws {Error} If any of the expressions can't be parsed.
-   */
-  self.eval = function (template, paramObj) {
-    paramObj = paramObj || {};
-
-    return template.replace(/\{\{([^\}]+)\}\}/g, function (match, expr) {
-      // remove filters
-      const key = expr.split('|')[0].trim();
-
-      // verify that the expression can be evaluated
-      const p = $parse(key)(paramObj);
-
-      // if evaluation can't be made, throw
-      if (_.isUndefined(p)) {
-        throw new Error(
-          i18n.translate('common.ui.url.replacementFailedErrorMessage', {
-            defaultMessage: 'Replacement failed, unresolved expression: {expr}',
-            values: { expr },
-          })
-        );
-      }
-
-      return encodeURIComponent($parse(expr)(paramObj));
-    });
-  };
-
-  /**
-   * convert an object's route to an href, compatible with
-   * window.location.href= and <a href="">
-   *
-   * @param  {Object} obj - any object that list's it's routes at obj.routes{}
-   * @param  {string} route - the route name
-   * @return {string} - the computed href
-   */
-  self.getRouteHref = function (obj, route) {
-    return '#' + self.getRouteUrl(obj, route);
-  };
-
-  /**
-   * convert an object's route to a url, compatible with url.change() or $location.url()
-   *
-   * @param  {Object} obj - any object that list's it's routes at obj.routes{}
-   * @param  {string} route - the route name
-   * @return {string} - the computed url
-   */
-  self.getRouteUrl = function (obj, route) {
-    const template = obj && obj.routes && obj.routes[route];
-    if (template) return self.eval(template, obj);
-  };
-
-  /**
-   * Similar to getRouteUrl, supports objects which list their routes,
-   * and redirects to the named route. See #redirect
-   *
-   * @param  {Object} obj - any object that list's it's routes at obj.routes{}
-   * @param  {string} route - the route name
-   * @return {undefined}
-   */
-  self.redirectToRoute = function (obj, route) {
-    self.redirect(self.getRouteUrl(obj, route));
-  };
-
-  /**
-   * Similar to getRouteUrl, supports objects which list their routes,
-   * and changes the url to the named route. See #change
-   *
-   * @param  {Object} obj - any object that list's it's routes at obj.routes{}
-   * @param  {string} route - the route name
-   * @return {undefined}
-   */
-  self.changeToRoute = function (obj, route) {
-    self.change(self.getRouteUrl(obj, route));
-  };
-
-  /**
-   * Removes the given parameter from the url. Does so without modifying the browser
-   * history.
-   * @param param
-   */
-  self.removeParam = function (param) {
-    $location.search(param, null).replace();
-  };
-
-  /////
-  // private api
-  /////
-  let reloading;
-
-  self._changeLocation = function (type, url, paramObj, replace, appState) {
-    const prev = {
-      path: $location.path(),
-      search: $location.search(),
-    };
-
-    url = self.eval(url, paramObj);
-    $location[type](url);
-    if (replace) $location.replace();
-
-    if (appState) {
-      $location.search(appState.getQueryParamName(), appState.toQueryParam());
-    }
-
-    const next = {
-      path: $location.path(),
-      search: $location.search(),
-    };
-
-    if ($injector.has('$route')) {
-      const $route = $injector.get('$route');
-
-      if (self._shouldForceReload(next, prev, $route)) {
-        const appState = Private(AppStateProvider).getAppState();
-        if (appState) appState.destroy();
-
-        reloading = $rootScope.$on('$locationChangeSuccess', function () {
-          // call the "unlisten" function returned by $on
-          reloading();
-          reloading = false;
-
-          $route.reload();
-        });
-      }
-    }
-  };
-
-  // determine if the router will automatically reload the route
-  self._shouldForceReload = function (next, prev, $route) {
-    if (reloading) return false;
-
-    const route = $route.current && $route.current.$$route;
-    if (!route) return false;
-
-    // for the purposes of determining whether the router will
-    // automatically be reloading, '' and '/' are equal
-    const nextPath = next.path || '/';
-    const prevPath = prev.path || '/';
-    if (nextPath !== prevPath) return false;
-
-    const reloadOnSearch = route.reloadOnSearch;
-    const searchSame = _.isEqual(next.search, prev.search);
-    return (reloadOnSearch && searchSame) || !reloadOnSearch;
-  };
-}
diff --git a/src/legacy/ui/public/utils/collection.test.ts b/src/legacy/ui/public/utils/collection.test.ts
deleted file mode 100644
index 0841e3554c0d09..00000000000000
--- a/src/legacy/ui/public/utils/collection.test.ts
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { move } from './collection';
-
-describe('collection', () => {
-  describe('move', () => {
-    test('accepts previous from->to syntax', () => {
-      const list = [1, 1, 1, 1, 1, 1, 1, 1, 8, 1, 1];
-
-      expect(list[3]).toBe(1);
-      expect(list[8]).toBe(8);
-
-      move(list, 8, 3);
-
-      expect(list[8]).toBe(1);
-      expect(list[3]).toBe(8);
-    });
-
-    test('moves an object up based on a function callback', () => {
-      const list = [1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1];
-
-      expect(list[4]).toBe(0);
-      expect(list[5]).toBe(1);
-      expect(list[6]).toBe(0);
-
-      move(list, 5, false, (v: any) => v === 0);
-
-      expect(list[4]).toBe(1);
-      expect(list[5]).toBe(0);
-      expect(list[6]).toBe(0);
-    });
-
-    test('moves an object down based on a function callback', () => {
-      const list = [1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1];
-
-      expect(list[4]).toBe(0);
-      expect(list[5]).toBe(1);
-      expect(list[6]).toBe(0);
-
-      move(list, 5, true, (v: any) => v === 0);
-
-      expect(list[4]).toBe(0);
-      expect(list[5]).toBe(0);
-      expect(list[6]).toBe(1);
-    });
-
-    test('moves an object up based on a where callback', () => {
-      const list = [
-        { v: 1 },
-        { v: 1 },
-        { v: 1 },
-        { v: 1 },
-        { v: 0 },
-        { v: 1 },
-        { v: 0 },
-        { v: 1 },
-        { v: 1 },
-        { v: 1 },
-        { v: 1 },
-      ];
-
-      expect(list[4]).toHaveProperty('v', 0);
-      expect(list[5]).toHaveProperty('v', 1);
-      expect(list[6]).toHaveProperty('v', 0);
-
-      move(list, 5, false, { v: 0 });
-
-      expect(list[4]).toHaveProperty('v', 1);
-      expect(list[5]).toHaveProperty('v', 0);
-      expect(list[6]).toHaveProperty('v', 0);
-    });
-
-    test('moves an object down based on a where callback', () => {
-      const list = [
-        { v: 1 },
-        { v: 1 },
-        { v: 1 },
-        { v: 1 },
-        { v: 0 },
-        { v: 1 },
-        { v: 0 },
-        { v: 1 },
-        { v: 1 },
-        { v: 1 },
-        { v: 1 },
-      ];
-
-      expect(list[4]).toHaveProperty('v', 0);
-      expect(list[5]).toHaveProperty('v', 1);
-      expect(list[6]).toHaveProperty('v', 0);
-
-      move(list, 5, true, { v: 0 });
-
-      expect(list[4]).toHaveProperty('v', 0);
-      expect(list[5]).toHaveProperty('v', 0);
-      expect(list[6]).toHaveProperty('v', 1);
-    });
-
-    test('moves an object down based on a pluck callback', () => {
-      const list = [
-        { id: 0, normal: true },
-        { id: 1, normal: true },
-        { id: 2, normal: true },
-        { id: 3, normal: true },
-        { id: 4, normal: true },
-        { id: 5, normal: false },
-        { id: 6, normal: true },
-        { id: 7, normal: true },
-        { id: 8, normal: true },
-        { id: 9, normal: true },
-      ];
-
-      expect(list[4]).toHaveProperty('id', 4);
-      expect(list[5]).toHaveProperty('id', 5);
-      expect(list[6]).toHaveProperty('id', 6);
-
-      move(list, 5, true, 'normal');
-
-      expect(list[4]).toHaveProperty('id', 4);
-      expect(list[5]).toHaveProperty('id', 6);
-      expect(list[6]).toHaveProperty('id', 5);
-    });
-  });
-});
diff --git a/src/legacy/ui/public/utils/collection.ts b/src/legacy/ui/public/utils/collection.ts
deleted file mode 100644
index b882a2bbe6e5b9..00000000000000
--- a/src/legacy/ui/public/utils/collection.ts
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-
-/**
- * move an obj either up or down in the collection by
- * injecting it either before/after the prev/next obj that
- * satisfied the qualifier
- *
- * or, just from one index to another...
- *
- * @param  {array} objs - the list to move the object within
- * @param  {number|any} obj - the object that should be moved, or the index that the object is currently at
- * @param  {number|boolean} below - the index to move the object to, or whether it should be moved up or down
- * @param  {function} qualifier - a lodash-y callback, object = _.where, string = _.pluck
- * @return {array} - the objs argument
- */
-export function move(
-  objs: any[],
-  obj: object | number,
-  below: number | boolean,
-  qualifier?: ((object: object, index: number) => any) | Record<string, any> | string
-): object[] {
-  const origI = _.isNumber(obj) ? obj : objs.indexOf(obj);
-  if (origI === -1) {
-    return objs;
-  }
-
-  if (_.isNumber(below)) {
-    // move to a specific index
-    objs.splice(below, 0, objs.splice(origI, 1)[0]);
-    return objs;
-  }
-
-  below = !!below;
-  qualifier = qualifier && _.iteratee(qualifier);
-
-  const above = !below;
-  const finder = below ? _.findIndex : _.findLastIndex;
-
-  // find the index of the next/previous obj that meets the qualifications
-  const targetI = finder(objs, (otherAgg, otherI) => {
-    if (below && otherI <= origI) {
-      return;
-    }
-    if (above && otherI >= origI) {
-      return;
-    }
-    return Boolean(_.isFunction(qualifier) && qualifier(otherAgg, otherI));
-  });
-
-  if (targetI === -1) {
-    return objs;
-  }
-
-  // place the obj at it's new index
-  objs.splice(targetI, 0, objs.splice(origI, 1)[0]);
-  return objs;
-}
diff --git a/src/legacy/ui/public/utils/legacy_class.js b/src/legacy/ui/public/utils/legacy_class.js
deleted file mode 100644
index f47650a77bb6d4..00000000000000
--- a/src/legacy/ui/public/utils/legacy_class.js
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-// create a property descriptor for properties
-// that won't change
-function describeConst(val) {
-  return {
-    writable: false,
-    enumerable: false,
-    configurable: false,
-    value: val,
-  };
-}
-
-const props = {
-  inherits: describeConst(function (SuperClass) {
-    const prototype = Object.create(SuperClass.prototype, {
-      constructor: describeConst(this),
-      superConstructor: describeConst(SuperClass),
-    });
-
-    Object.defineProperties(this, {
-      prototype: describeConst(prototype),
-      Super: describeConst(SuperClass),
-    });
-
-    return this;
-  }),
-};
-
-/**
- * Add class-related behavior to a function, currently this
- * only attaches an .inherits() method.
- *
- * @param  {Constructor} ClassConstructor - The function that should be extended
- * @return {Constructor} - the constructor passed in;
- */
-export function createLegacyClass(ClassConstructor) {
-  return Object.defineProperties(ClassConstructor, props);
-}
diff --git a/src/legacy/ui/ui_apps/__snapshots__/ui_apps_mixin.test.js.snap b/src/legacy/ui/ui_apps/__snapshots__/ui_apps_mixin.test.js.snap
deleted file mode 100644
index cb2b6cda26a816..00000000000000
--- a/src/legacy/ui/ui_apps/__snapshots__/ui_apps_mixin.test.js.snap
+++ /dev/null
@@ -1,92 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`UiAppsMixin creates kbnServer.uiApps from uiExports 1`] = `
-Array [
-  StubUiApp {
-    "_hidden": true,
-    "_id": "foo",
-  },
-  StubUiApp {
-    "_hidden": false,
-    "_id": "bar",
-  },
-]
-`;
-
-exports[`UiAppsMixin decorates server with methods 1`] = `
-Array [
-  Array [
-    "server",
-    "getAllUiApps",
-    [Function],
-  ],
-  Array [
-    "server",
-    "getUiAppById",
-    [Function],
-  ],
-  Array [
-    "server",
-    "getHiddenUiAppById",
-    [Function],
-  ],
-  Array [
-    "server",
-    "injectUiAppVars",
-    [Function],
-  ],
-  Array [
-    "server",
-    "getInjectedUiAppVars",
-    [Function],
-  ],
-]
-`;
-
-exports[`UiAppsMixin server.getAllUiApps() returns hidden and non-hidden apps 1`] = `
-Array [
-  StubUiApp {
-    "_hidden": true,
-    "_id": "foo",
-  },
-  StubUiApp {
-    "_hidden": false,
-    "_id": "bar",
-  },
-]
-`;
-
-exports[`UiAppsMixin server.getHiddenUiAppById() returns hidden apps when requested, undefined for non-hidden and unknown apps 1`] = `
-StubUiApp {
-  "_hidden": true,
-  "_id": "foo",
-}
-`;
-
-exports[`UiAppsMixin server.getUiAppById() returns non-hidden apps when requested, undefined for non-hidden and unknown apps 1`] = `
-StubUiApp {
-  "_hidden": false,
-  "_id": "bar",
-}
-`;
-
-exports[`UiAppsMixin server.injectUiAppVars()/server.getInjectedUiAppVars() merges injected vars provided by multiple providers in the order they are registered: foo 1`] = `
-Object {
-  "bar": false,
-  "baz": 1,
-  "box": true,
-  "foo": true,
-}
-`;
-
-exports[`UiAppsMixin server.injectUiAppVars()/server.getInjectedUiAppVars() stored injectVars provider and returns provider result when requested: bar 1`] = `
-Object {
-  "thisIsFoo": false,
-}
-`;
-
-exports[`UiAppsMixin server.injectUiAppVars()/server.getInjectedUiAppVars() stored injectVars provider and returns provider result when requested: foo 1`] = `
-Object {
-  "thisIsFoo": true,
-}
-`;
diff --git a/src/legacy/ui/ui_apps/__tests__/ui_app.js b/src/legacy/ui/ui_apps/__tests__/ui_app.js
deleted file mode 100644
index bb4bcfe2d74432..00000000000000
--- a/src/legacy/ui/ui_apps/__tests__/ui_app.js
+++ /dev/null
@@ -1,306 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-
-import { UiApp } from '../ui_app';
-import { UiNavLink } from '../../ui_nav_links';
-
-function createStubUiAppSpec(extraParams) {
-  return {
-    id: 'uiapp-test',
-    main: 'main.js',
-    title: 'UIApp Test',
-    order: 9000,
-    icon: 'ui_app_test.svg',
-    linkToLastSubUrl: true,
-    hidden: false,
-    listed: false,
-    ...extraParams,
-  };
-}
-
-function createStubKbnServer(extraParams) {
-  return {
-    plugins: [],
-    config: {
-      get: sinon.stub().withArgs('server.basePath').returns(''),
-    },
-    server: {},
-    ...extraParams,
-  };
-}
-
-function createUiApp(spec = createStubUiAppSpec(), kbnServer = createStubKbnServer()) {
-  return new UiApp(kbnServer, spec);
-}
-
-describe('ui apps / UiApp', () => {
-  describe('constructor', () => {
-    it('throws an exception if an ID is not given', () => {
-      const spec = {}; // should have id property
-      expect(() => createUiApp(spec)).to.throwException();
-    });
-
-    describe('defaults', () => {
-      const spec = { id: 'uiapp-test-defaults' };
-      const app = createUiApp(spec);
-
-      it('has the ID from the spec', () => {
-        expect(app.getId()).to.be(spec.id);
-      });
-
-      it('has no plugin ID', () => {
-        expect(app.getPluginId()).to.be(undefined);
-      });
-
-      it('is not hidden', () => {
-        expect(app.isHidden()).to.be(false);
-      });
-
-      it('is listed', () => {
-        expect(app.isListed()).to.be(true);
-      });
-
-      it('has a navLink', () => {
-        expect(app.getNavLink()).to.be.a(UiNavLink);
-      });
-
-      it('has no main module', () => {
-        expect(app.getMainModuleId()).to.be(undefined);
-      });
-
-      it('has a mostly empty JSON representation', () => {
-        expect(JSON.parse(JSON.stringify(app))).to.eql({
-          id: spec.id,
-          navLink: {
-            id: 'uiapp-test-defaults',
-            order: 0,
-            url: '/app/uiapp-test-defaults',
-            subUrlBase: '/app/uiapp-test-defaults',
-            linkToLastSubUrl: true,
-            hidden: false,
-            disabled: false,
-            tooltip: '',
-          },
-        });
-      });
-    });
-
-    describe('mock spec', () => {
-      const spec = createStubUiAppSpec();
-      const app = createUiApp(spec);
-
-      it('has the ID from the spec', () => {
-        expect(app.getId()).to.be(spec.id);
-      });
-
-      it('has no plugin ID', () => {
-        expect(app.getPluginId()).to.be(undefined);
-      });
-
-      it('is not hidden', () => {
-        expect(app.isHidden()).to.be(false);
-      });
-
-      it('is also not listed', () => {
-        expect(app.isListed()).to.be(false);
-      });
-
-      it('has no navLink', () => {
-        expect(app.getNavLink()).to.be(undefined);
-      });
-
-      it('has a main module', () => {
-        expect(app.getMainModuleId()).to.be('main.js');
-      });
-
-      it('has spec values in JSON representation', () => {
-        expect(JSON.parse(JSON.stringify(app))).to.eql({
-          id: spec.id,
-          title: spec.title,
-          icon: spec.icon,
-          main: spec.main,
-          linkToLastSubUrl: spec.linkToLastSubUrl,
-          navLink: {
-            id: 'uiapp-test',
-            title: 'UIApp Test',
-            order: 9000,
-            url: '/app/uiapp-test',
-            subUrlBase: '/app/uiapp-test',
-            icon: 'ui_app_test.svg',
-            linkToLastSubUrl: true,
-            hidden: false,
-            disabled: false,
-            tooltip: '',
-          },
-        });
-      });
-    });
-
-    /*
-     * The "hidden" and "listed" flags have an bound relationship. The "hidden"
-     * flag gets cast to a boolean value, and the "listed" flag is dependent on
-     * "hidden"
-     */
-    describe('hidden flag', () => {
-      describe('is cast to boolean value', () => {
-        it('when undefined', () => {
-          const kbnServer = createStubKbnServer();
-          const spec = {
-            id: 'uiapp-test',
-          };
-          const newApp = new UiApp(kbnServer, spec);
-          expect(newApp.isHidden()).to.be(false);
-        });
-
-        it('when null', () => {
-          const kbnServer = createStubKbnServer();
-          const spec = {
-            id: 'uiapp-test',
-            hidden: null,
-          };
-          const newApp = new UiApp(kbnServer, spec);
-          expect(newApp.isHidden()).to.be(false);
-        });
-
-        it('when 0', () => {
-          const kbnServer = createStubKbnServer();
-          const spec = {
-            id: 'uiapp-test',
-            hidden: 0,
-          };
-          const newApp = new UiApp(kbnServer, spec);
-          expect(newApp.isHidden()).to.be(false);
-        });
-
-        it('when true', () => {
-          const kbnServer = createStubKbnServer();
-          const spec = {
-            id: 'uiapp-test',
-            hidden: true,
-          };
-          const newApp = new UiApp(kbnServer, spec);
-          expect(newApp.isHidden()).to.be(true);
-        });
-
-        it('when 1', () => {
-          const kbnServer = createStubKbnServer();
-          const spec = {
-            id: 'uiapp-test',
-            hidden: 1,
-          };
-          const newApp = new UiApp(kbnServer, spec);
-          expect(newApp.isHidden()).to.be(true);
-        });
-      });
-    });
-
-    describe('listed flag', () => {
-      describe('defaults to the opposite value of hidden', () => {
-        it(`when it's null and hidden is true`, () => {
-          const kbnServer = createStubKbnServer();
-          const spec = {
-            id: 'uiapp-test',
-            hidden: true,
-            listed: null,
-          };
-          const newApp = new UiApp(kbnServer, spec);
-          expect(newApp.isListed()).to.be(false);
-        });
-
-        it(`when it's null and hidden is false`, () => {
-          const kbnServer = createStubKbnServer();
-          const spec = {
-            id: 'uiapp-test',
-            hidden: false,
-            listed: null,
-          };
-          const newApp = new UiApp(kbnServer, spec);
-          expect(newApp.isListed()).to.be(true);
-        });
-
-        it(`when it's undefined and hidden is false`, () => {
-          const kbnServer = createStubKbnServer();
-          const spec = {
-            id: 'uiapp-test',
-            hidden: false,
-          };
-          const newApp = new UiApp(kbnServer, spec);
-          expect(newApp.isListed()).to.be(true);
-        });
-
-        it(`when it's undefined and hidden is true`, () => {
-          const kbnServer = createStubKbnServer();
-          const spec = {
-            id: 'uiapp-test',
-            hidden: true,
-          };
-          const newApp = new UiApp(kbnServer, spec);
-          expect(newApp.isListed()).to.be(false);
-        });
-      });
-
-      it(`is set to true when it's passed as true`, () => {
-        const kbnServer = createStubKbnServer();
-        const spec = {
-          id: 'uiapp-test',
-          listed: true,
-        };
-        const newApp = new UiApp(kbnServer, spec);
-        expect(newApp.isListed()).to.be(true);
-      });
-
-      it(`is set to false when it's passed as false`, () => {
-        const kbnServer = createStubKbnServer();
-        const spec = {
-          id: 'uiapp-test',
-          listed: false,
-        };
-        const newApp = new UiApp(kbnServer, spec);
-        expect(newApp.isListed()).to.be(false);
-      });
-    });
-  });
-
-  describe('pluginId', () => {
-    describe('does not match a kbnServer plugin', () => {
-      it('throws an error at instantiation', () => {
-        expect(() => {
-          createUiApp(createStubUiAppSpec({ pluginId: 'foo' }));
-        }).to.throwException((error) => {
-          expect(error.message).to.match(/Unknown plugin id/);
-        });
-      });
-    });
-  });
-
-  describe('#getMainModuleId', () => {
-    it('returns undefined by default', () => {
-      const app = createUiApp({ id: 'foo' });
-      expect(app.getMainModuleId()).to.be(undefined);
-    });
-
-    it('returns main module id', () => {
-      const app = createUiApp({ id: 'foo', main: 'bar' });
-      expect(app.getMainModuleId()).to.be('bar');
-    });
-  });
-});
diff --git a/src/legacy/ui/ui_apps/index.js b/src/legacy/ui/ui_apps/index.js
deleted file mode 100644
index d64848b2c1a92d..00000000000000
--- a/src/legacy/ui/ui_apps/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { uiAppsMixin } from './ui_apps_mixin';
diff --git a/src/legacy/ui/ui_apps/ui_app.js b/src/legacy/ui/ui_apps/ui_app.js
deleted file mode 100644
index 7da9e39394debd..00000000000000
--- a/src/legacy/ui/ui_apps/ui_app.js
+++ /dev/null
@@ -1,128 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { UiNavLink } from '../ui_nav_links';
-
-export class UiApp {
-  constructor(kbnServer, spec) {
-    const {
-      pluginId,
-      id = pluginId,
-      main,
-      title,
-      order = 0,
-      icon,
-      euiIconType,
-      hidden,
-      linkToLastSubUrl,
-      disableSubUrlTracking,
-      listed,
-      category,
-      url = `/app/${id}`,
-    } = spec;
-
-    if (!id) {
-      throw new Error('Every app must specify an id');
-    }
-
-    this._id = id;
-    this._main = main;
-    this._title = title;
-    this._order = order;
-    this._icon = icon;
-    this._euiIconType = euiIconType;
-    this._linkToLastSubUrl = linkToLastSubUrl;
-    this._disableSubUrlTracking = disableSubUrlTracking;
-    this._category = category;
-    this._hidden = hidden;
-    this._listed = listed;
-    this._url = url;
-    this._pluginId = pluginId;
-    this._kbnServer = kbnServer;
-
-    if (this._pluginId && !this._getPlugin()) {
-      throw new Error(`Unknown plugin id "${this._pluginId}"`);
-    }
-
-    if (!this.isHidden()) {
-      // unless an app is hidden it gets a navlink, but we only respond to `getNavLink()`
-      // if the app is also listed. This means that all apps in the kibanaPayload will
-      // have a navLink property since that list includes all normally accessible apps
-      this._navLink = new UiNavLink({
-        id: this._id,
-        title: this._title,
-        order: this._order,
-        icon: this._icon,
-        euiIconType: this._euiIconType,
-        url: this._url,
-        linkToLastSubUrl: this._linkToLastSubUrl,
-        disableSubUrlTracking: this._disableSubUrlTracking,
-        category: this._category,
-      });
-    }
-  }
-
-  getId() {
-    return this._id;
-  }
-
-  getPluginId() {
-    const plugin = this._getPlugin();
-    return plugin ? plugin.id : undefined;
-  }
-
-  isHidden() {
-    return !!this._hidden;
-  }
-
-  isListed() {
-    return !this.isHidden() && (this._listed == null || !!this._listed);
-  }
-
-  getNavLink() {
-    if (this.isListed()) {
-      return this._navLink;
-    }
-  }
-
-  getMainModuleId() {
-    return this._main;
-  }
-
-  _getPlugin() {
-    const pluginId = this._pluginId;
-    const { plugins } = this._kbnServer;
-
-    return pluginId ? plugins.find((plugin) => plugin.id === pluginId) : undefined;
-  }
-
-  toJSON() {
-    return {
-      id: this._id,
-      title: this._title,
-      icon: this._icon,
-      euiIconType: this._euiIconType,
-      main: this._main,
-      navLink: this._navLink,
-      linkToLastSubUrl: this._linkToLastSubUrl,
-      disableSubUrlTracking: this._disableSubUrlTracking,
-      category: this._category,
-    };
-  }
-}
diff --git a/src/legacy/ui/ui_apps/ui_apps_mixin.js b/src/legacy/ui/ui_apps/ui_apps_mixin.js
deleted file mode 100644
index c80b12a46bee30..00000000000000
--- a/src/legacy/ui/ui_apps/ui_apps_mixin.js
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { UiApp } from './ui_app';
-
-/**
- * @typedef {import('../../server/kbn_server').default} KbnServer
- */
-
-/**
- *
- * @param {KbnServer} kbnServer
- * @param {KbnServer['server']} server
- */
-export function uiAppsMixin(kbnServer, server) {
-  const { uiAppSpecs = [] } = kbnServer.uiExports;
-  const existingIds = new Set();
-  const appsById = new Map();
-  const hiddenAppsById = new Map();
-
-  kbnServer.uiApps = uiAppSpecs.map((spec) => {
-    const app = new UiApp(kbnServer, spec);
-    const id = app.getId();
-
-    if (!existingIds.has(id)) {
-      existingIds.add(id);
-    } else {
-      throw new Error(`Unable to create two apps with the id ${id}.`);
-    }
-
-    if (app.isHidden()) {
-      hiddenAppsById.set(id, app);
-    } else {
-      appsById.set(id, app);
-    }
-
-    return app;
-  });
-
-  server.decorate('server', 'getAllUiApps', () => kbnServer.uiApps.slice(0));
-  server.decorate('server', 'getUiAppById', (id) => appsById.get(id));
-  server.decorate('server', 'getHiddenUiAppById', (id) => hiddenAppsById.get(id));
-  server.decorate('server', 'injectUiAppVars', (appId, provider) =>
-    kbnServer.newPlatform.__internals.legacy.injectUiAppVars(appId, provider)
-  );
-  server.decorate(
-    'server',
-    'getInjectedUiAppVars',
-    async (appId) => await kbnServer.newPlatform.__internals.legacy.getInjectedUiAppVars(appId)
-  );
-}
diff --git a/src/legacy/ui/ui_apps/ui_apps_mixin.test.js b/src/legacy/ui/ui_apps/ui_apps_mixin.test.js
deleted file mode 100644
index 048358edfc10b9..00000000000000
--- a/src/legacy/ui/ui_apps/ui_apps_mixin.test.js
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { LegacyInternals } from '../../../core/server';
-
-import { uiAppsMixin } from './ui_apps_mixin';
-
-jest.mock('./ui_app', () => ({
-  UiApp: class StubUiApp {
-    constructor(kbnServer, spec) {
-      this._id = spec.id;
-      this._hidden = !!spec.hidden;
-    }
-    getId() {
-      return this._id;
-    }
-    isHidden() {
-      return this._hidden;
-    }
-  },
-}));
-
-describe('UiAppsMixin', () => {
-  let kbnServer;
-  let server;
-  let uiExports;
-
-  beforeEach(() => {
-    uiExports = {
-      uiAppSpecs: [
-        {
-          id: 'foo',
-          hidden: true,
-        },
-        {
-          id: 'bar',
-          hidden: false,
-        },
-      ],
-    };
-    server = {
-      decorate: jest.fn((type, name, value) => {
-        if (type !== 'server') {
-          return;
-        }
-
-        server[name] = value;
-      }),
-    };
-    kbnServer = {
-      uiExports,
-      newPlatform: {
-        __internals: {
-          legacy: new LegacyInternals(uiExports, {}, server),
-        },
-      },
-    };
-
-    uiAppsMixin(kbnServer, server);
-  });
-
-  it('creates kbnServer.uiApps from uiExports', () => {
-    expect(kbnServer.uiApps).toMatchSnapshot();
-  });
-
-  it('decorates server with methods', () => {
-    expect(server.decorate.mock.calls).toMatchSnapshot();
-  });
-
-  describe('server.getAllUiApps()', () => {
-    it('returns hidden and non-hidden apps', () => {
-      expect(server.getAllUiApps()).toMatchSnapshot();
-    });
-  });
-
-  describe('server.getUiAppById()', () => {
-    it('returns non-hidden apps when requested, undefined for non-hidden and unknown apps', () => {
-      expect(server.getUiAppById('foo')).toBe(undefined);
-      expect(server.getUiAppById('bar')).toMatchSnapshot();
-      expect(server.getUiAppById('baz')).toBe(undefined);
-    });
-  });
-
-  describe('server.getHiddenUiAppById()', () => {
-    it('returns hidden apps when requested, undefined for non-hidden and unknown apps', () => {
-      expect(server.getHiddenUiAppById('foo')).toMatchSnapshot();
-      expect(server.getHiddenUiAppById('bar')).toBe(undefined);
-      expect(server.getHiddenUiAppById('baz')).toBe(undefined);
-    });
-  });
-
-  describe('server.injectUiAppVars()/server.getInjectedUiAppVars()', () => {
-    it('stored injectVars provider and returns provider result when requested', async () => {
-      server.injectUiAppVars('foo', () => ({
-        thisIsFoo: true,
-      }));
-
-      server.injectUiAppVars('bar', async () => ({
-        thisIsFoo: false,
-      }));
-
-      await expect(server.getInjectedUiAppVars('foo')).resolves.toMatchSnapshot('foo');
-      await expect(server.getInjectedUiAppVars('bar')).resolves.toMatchSnapshot('bar');
-      await expect(server.getInjectedUiAppVars('baz')).resolves.toEqual({});
-    });
-
-    it('merges injected vars provided by multiple providers in the order they are registered', async () => {
-      server.injectUiAppVars('foo', () => ({
-        foo: true,
-        bar: true,
-        baz: true,
-      }));
-
-      server.injectUiAppVars('foo', async () => ({
-        bar: false,
-        box: true,
-      }));
-
-      server.injectUiAppVars('foo', async () => ({
-        baz: 1,
-      }));
-
-      await expect(server.getInjectedUiAppVars('foo')).resolves.toMatchSnapshot('foo');
-      await expect(server.getInjectedUiAppVars('bar')).resolves.toEqual({});
-      await expect(server.getInjectedUiAppVars('baz')).resolves.toEqual({});
-    });
-  });
-});
diff --git a/src/legacy/ui/ui_exports/README.md b/src/legacy/ui/ui_exports/README.md
index ab81febe679938..7fb117b1c25b90 100644
--- a/src/legacy/ui/ui_exports/README.md
+++ b/src/legacy/ui/ui_exports/README.md
@@ -88,7 +88,6 @@ This reducer format was chosen so that it will be easier to look back at these r
 
 The [`ui_exports/ui_export_defaults`][UiExportDefaults] module defines the default shape of the uiExports object produced by `collectUiExports()`. The defaults generally describe the `uiExports` from the UI System itself, like default visTypes and such.
 
-[UiApp]: ../ui_apps/ui_app.js "UiApp class definition"
 [UiExportDefaults]: ./ui_export_defaults.js "uiExport defaults definition"
 [UiExportTypes]: ./ui_export_types/index.js "Index of default ui_export_types module"
 [UiAppExportType]: ./ui_export_types/ui_apps.js "UiApp extension type definition"
diff --git a/src/legacy/ui/ui_mixin.js b/src/legacy/ui/ui_mixin.js
index 54da001d20669c..caa0ca48906615 100644
--- a/src/legacy/ui/ui_mixin.js
+++ b/src/legacy/ui/ui_mixin.js
@@ -17,10 +17,8 @@
  * under the License.
  */
 
-import { uiAppsMixin } from './ui_apps';
 import { uiRenderMixin } from './ui_render';
 
 export async function uiMixin(kbnServer) {
-  await kbnServer.mixin(uiAppsMixin);
   await kbnServer.mixin(uiRenderMixin);
 }
diff --git a/src/legacy/ui/ui_nav_links/__tests__/ui_nav_link.js b/src/legacy/ui/ui_nav_links/__tests__/ui_nav_link.js
deleted file mode 100644
index 42368722f11ffa..00000000000000
--- a/src/legacy/ui/ui_nav_links/__tests__/ui_nav_link.js
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-
-import { UiNavLink } from '../ui_nav_link';
-
-describe('UiNavLink', () => {
-  describe('constructor', () => {
-    it('initializes the object properties as expected', () => {
-      const spec = {
-        id: 'discover',
-        title: 'Discover',
-        order: -1003,
-        url: '/app/discover#/',
-        euiIconType: 'discoverApp',
-        hidden: true,
-        disabled: true,
-      };
-
-      const link = new UiNavLink(spec);
-      expect(link.toJSON()).to.eql({
-        id: spec.id,
-        title: spec.title,
-        order: spec.order,
-        url: spec.url,
-        subUrlBase: spec.url,
-        icon: spec.icon,
-        euiIconType: spec.euiIconType,
-        hidden: spec.hidden,
-        disabled: spec.disabled,
-        category: undefined,
-
-        // defaults
-        linkToLastSubUrl: true,
-        disableSubUrlTracking: undefined,
-        tooltip: '',
-      });
-    });
-
-    it('initializes the order property to 0 when order is not specified in the spec', () => {
-      const spec = {
-        id: 'discover',
-        title: 'Discover',
-        url: '/app/discover#/',
-      };
-      const link = new UiNavLink(spec);
-
-      expect(link.toJSON()).to.have.property('order', 0);
-    });
-
-    it('initializes the linkToLastSubUrl property to false when false is specified in the spec', () => {
-      const spec = {
-        id: 'discover',
-        title: 'Discover',
-        order: -1003,
-        url: '/app/discover#/',
-        linkToLastSubUrl: false,
-      };
-      const link = new UiNavLink(spec);
-
-      expect(link.toJSON()).to.have.property('linkToLastSubUrl', false);
-    });
-
-    it('initializes the linkToLastSubUrl property to true by default', () => {
-      const spec = {
-        id: 'discover',
-        title: 'Discover',
-        order: -1003,
-        url: '/app/discover#/',
-      };
-      const link = new UiNavLink(spec);
-
-      expect(link.toJSON()).to.have.property('linkToLastSubUrl', true);
-    });
-
-    it('initializes the hidden property to false by default', () => {
-      const spec = {
-        id: 'discover',
-        title: 'Discover',
-        order: -1003,
-        url: '/app/discover#/',
-      };
-      const link = new UiNavLink(spec);
-
-      expect(link.toJSON()).to.have.property('hidden', false);
-    });
-
-    it('initializes the disabled property to false by default', () => {
-      const spec = {
-        id: 'discover',
-        title: 'Discover',
-        order: -1003,
-        url: '/app/discover#/',
-      };
-      const link = new UiNavLink(spec);
-
-      expect(link.toJSON()).to.have.property('disabled', false);
-    });
-
-    it('initializes the tooltip property to an empty string by default', () => {
-      const spec = {
-        id: 'discover',
-        title: 'Discover',
-        order: -1003,
-        url: '/app/discover#/',
-      };
-      const link = new UiNavLink(spec);
-
-      expect(link.toJSON()).to.have.property('tooltip', '');
-    });
-  });
-});
diff --git a/src/legacy/ui/ui_nav_links/index.js b/src/legacy/ui/ui_nav_links/index.js
deleted file mode 100644
index e725a77ee11836..00000000000000
--- a/src/legacy/ui/ui_nav_links/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { UiNavLink } from './ui_nav_link';
diff --git a/src/legacy/ui/ui_nav_links/ui_nav_link.js b/src/legacy/ui/ui_nav_links/ui_nav_link.js
deleted file mode 100644
index f56809f7ebb80b..00000000000000
--- a/src/legacy/ui/ui_nav_links/ui_nav_link.js
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export class UiNavLink {
-  constructor(spec) {
-    const {
-      id,
-      title,
-      order = 0,
-      url,
-      subUrlBase,
-      disableSubUrlTracking,
-      icon,
-      euiIconType,
-      linkToLastSubUrl = true,
-      hidden = false,
-      disabled = false,
-      tooltip = '',
-      category,
-    } = spec;
-
-    this._id = id;
-    this._title = title;
-    this._order = order;
-    this._url = url;
-    this._subUrlBase = subUrlBase || url;
-    this._disableSubUrlTracking = disableSubUrlTracking;
-    this._icon = icon;
-    this._euiIconType = euiIconType;
-    this._linkToLastSubUrl = linkToLastSubUrl;
-    this._hidden = hidden;
-    this._disabled = disabled;
-    this._tooltip = tooltip;
-    this._category = category;
-  }
-
-  getOrder() {
-    return this._order;
-  }
-
-  toJSON() {
-    return {
-      id: this._id,
-      title: this._title,
-      order: this._order,
-      url: this._url,
-      subUrlBase: this._subUrlBase,
-      icon: this._icon,
-      euiIconType: this._euiIconType,
-      linkToLastSubUrl: this._linkToLastSubUrl,
-      disableSubUrlTracking: this._disableSubUrlTracking,
-      hidden: this._hidden,
-      disabled: this._disabled,
-      tooltip: this._tooltip,
-      category: this._category,
-    };
-  }
-}
diff --git a/src/legacy/ui/ui_render/ui_render_mixin.js b/src/legacy/ui/ui_render/ui_render_mixin.js
index 8cc2cd1321a62d..cd8dcf5aff71dc 100644
--- a/src/legacy/ui/ui_render/ui_render_mixin.js
+++ b/src/legacy/ui/ui_render/ui_render_mixin.js
@@ -182,22 +182,16 @@ export function uiRenderMixin(kbnServer, server, config) {
     path: '/app/{id}/{any*}',
     method: 'GET',
     async handler(req, h) {
-      const id = req.params.id;
-      const app = server.getUiAppById(id);
       try {
-        return await h.renderApp(app);
+        return await h.renderApp();
       } catch (err) {
         throw Boom.boomify(err);
       }
     },
   });
 
-  async function renderApp(
-    h,
-    app = { getId: () => 'core' },
-    includeUserSettings = true,
-    overrides = {}
-  ) {
+  async function renderApp(h) {
+    const app = { getId: () => 'core' };
     const { http } = kbnServer.newPlatform.setup.core;
     const {
       rendering,
@@ -209,22 +203,17 @@ export function uiRenderMixin(kbnServer, server, config) {
     );
     const vars = await legacy.getVars(app.getId(), h.request, {
       apmConfig: getApmConfig(h.request.path),
-      ...overrides,
     });
     const content = await rendering.render(h.request, uiSettings, {
       app,
-      includeUserSettings,
+      includeUserSettings: true,
       vars,
     });
 
     return h.response(content).type('text/html').header('content-security-policy', http.csp.header);
   }
 
-  server.decorate('toolkit', 'renderApp', function (app, overrides) {
-    return renderApp(this, app, true, overrides);
-  });
-
-  server.decorate('toolkit', 'renderAppWithDefaultConfig', function (app) {
-    return renderApp(this, app, false);
+  server.decorate('toolkit', 'renderApp', function () {
+    return renderApp(this);
   });
 }
diff --git a/src/legacy/utils/artifact_type.ts b/src/legacy/utils/artifact_type.ts
index 69f728e9e2220b..ef471ef8e050d6 100644
--- a/src/legacy/utils/artifact_type.ts
+++ b/src/legacy/utils/artifact_type.ts
@@ -17,7 +17,6 @@
  * under the License.
  */
 
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { pkg } from '../../core/server/utils';
 export const IS_KIBANA_DISTRIBUTABLE = pkg.build && pkg.build.distributable === true;
 export const IS_KIBANA_RELEASE = pkg.build && pkg.build.release === true;
diff --git a/src/legacy/utils/index.d.ts b/src/legacy/utils/index.d.ts
index c294c79542bbe9..a57caad1d34bf8 100644
--- a/src/legacy/utils/index.d.ts
+++ b/src/legacy/utils/index.d.ts
@@ -18,16 +18,3 @@
  */
 
 export function unset(object: object, rawPath: string): void;
-
-export {
-  concatStreamProviders,
-  createConcatStream,
-  createFilterStream,
-  createIntersperseStream,
-  createListStream,
-  createMapStream,
-  createPromiseFromStreams,
-  createReduceStream,
-  createReplaceStream,
-  createSplitStream,
-} from './streams';
diff --git a/src/legacy/utils/index.js b/src/legacy/utils/index.js
index 4274fb2e4901a0..529b1ddfd8a4d9 100644
--- a/src/legacy/utils/index.js
+++ b/src/legacy/utils/index.js
@@ -23,15 +23,3 @@ export { deepCloneWithBuffers } from './deep_clone_with_buffers';
 export { unset } from './unset';
 export { IS_KIBANA_DISTRIBUTABLE } from './artifact_type';
 export { IS_KIBANA_RELEASE } from './artifact_type';
-
-export {
-  concatStreamProviders,
-  createConcatStream,
-  createIntersperseStream,
-  createListStream,
-  createPromiseFromStreams,
-  createReduceStream,
-  createSplitStream,
-  createMapStream,
-  createReplaceStream,
-} from './streams';
diff --git a/src/legacy/utils/streams/concat_stream.js b/src/legacy/utils/streams/concat_stream.js
deleted file mode 100644
index e3f8f7261d2b7a..00000000000000
--- a/src/legacy/utils/streams/concat_stream.js
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { createReduceStream } from './reduce_stream';
-
-/**
- *  Creates a Transform stream that consumes all provided
- *  values and concatenates them using each values `concat`
- *  method.
- *
- *  Concatenate strings:
- *    createListStream(['f', 'o', 'o'])
- *      .pipe(createConcatStream())
- *      .on('data', console.log)
- *      // logs "foo"
- *
- *  Concatenate values into an array:
- *    createListStream([1,2,3])
- *      .pipe(createConcatStream([]))
- *      .on('data', console.log)
- *      // logs "[1,2,3]"
- *
- *
- *  @param {any} initial The initial value that subsequent
- *                       items will concat with
- *  @return {Transform}
- */
-export function createConcatStream(initial) {
-  return createReduceStream((acc, chunk) => acc.concat(chunk), initial);
-}
diff --git a/src/legacy/utils/streams/concat_stream_providers.js b/src/legacy/utils/streams/concat_stream_providers.js
deleted file mode 100644
index 11dfb84284df38..00000000000000
--- a/src/legacy/utils/streams/concat_stream_providers.js
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { PassThrough } from 'stream';
-
-/**
- *  Write the data and errors from a list of stream providers
- *  to a single stream in order. Stream providers are only
- *  called right before they will be consumed, and only one
- *  provider will be active at a time.
- *
- *  @param {Array<() => ReadableStream>} sourceProviders
- *  @param {PassThroughOptions} options options passed to the PassThrough constructor
- *  @return {WritableStream} combined stream
- */
-export function concatStreamProviders(sourceProviders, options = {}) {
-  const destination = new PassThrough(options);
-  const queue = sourceProviders.slice();
-
-  (function pipeNext() {
-    const provider = queue.shift();
-
-    if (!provider) {
-      return;
-    }
-
-    const source = provider();
-    const isLast = !queue.length;
-
-    // if there are more sources to pipe, hook
-    // into the source completion
-    if (!isLast) {
-      source.once('end', pipeNext);
-    }
-
-    source
-      // proxy errors from the source to the destination
-      .once('error', (error) => destination.emit('error', error))
-      // pipe the source to the destination but only proxy the
-      // end event if this is the last source
-      .pipe(destination, { end: isLast });
-  })();
-
-  return destination;
-}
diff --git a/src/legacy/utils/streams/index.d.ts b/src/legacy/utils/streams/index.d.ts
deleted file mode 100644
index 470b5d9fa35051..00000000000000
--- a/src/legacy/utils/streams/index.d.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Readable, Writable, Transform, TransformOptions } from 'stream';
-
-export function concatStreamProviders(
-  sourceProviders: Array<() => Readable>,
-  options: TransformOptions
-): Transform;
-export function createIntersperseStream(intersperseChunk: string | Buffer): Transform;
-export function createSplitStream<T>(splitChunk: T): Transform;
-export function createListStream(items: any | any[]): Readable;
-export function createReduceStream<T>(reducer: (value: any, chunk: T, enc: string) => T): Transform;
-export function createPromiseFromStreams<T>([first, ...rest]: [Readable, ...Writable[]]): Promise<
-  T
->;
-export function createConcatStream(initial?: any): Transform;
-export function createMapStream<T>(fn: (value: T, i: number) => void): Transform;
-export function createReplaceStream(toReplace: string, replacement: string | Buffer): Transform;
-export function createFilterStream<T>(fn: (obj: T) => boolean): Transform;
diff --git a/src/legacy/utils/streams/intersperse_stream.js b/src/legacy/utils/streams/intersperse_stream.js
deleted file mode 100644
index 5f9f0b03cd7eb8..00000000000000
--- a/src/legacy/utils/streams/intersperse_stream.js
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Transform } from 'stream';
-
-/**
- *  Create a Transform stream that receives values in object mode,
- *  and intersperses a chunk between each object received.
- *
- *  This is useful for writing lists:
- *
- *    createListStream(['foo', 'bar'])
- *      .pipe(createIntersperseStream('\n'))
- *      .pipe(process.stdout) // outputs "foo\nbar"
- *
- *  Combine with a concat stream to get "join" like functionality:
- *
- *    await createPromiseFromStreams([
- *      createListStream(['foo', 'bar']),
- *      createIntersperseStream(' '),
- *      createConcatStream()
- *    ]) // produces a single value "foo bar"
- *
- *  @param  {String|Buffer} intersperseChunk
- *  @return {Transform}
- */
-export function createIntersperseStream(intersperseChunk) {
-  let first = true;
-
-  return new Transform({
-    writableObjectMode: true,
-    readableObjectMode: true,
-    transform(chunk, enc, callback) {
-      try {
-        if (first) {
-          first = false;
-        } else {
-          this.push(intersperseChunk);
-        }
-
-        this.push(chunk);
-        callback(null);
-      } catch (err) {
-        callback(err);
-      }
-    },
-  });
-}
diff --git a/src/legacy/utils/streams/list_stream.js b/src/legacy/utils/streams/list_stream.js
deleted file mode 100644
index a614620b054b7f..00000000000000
--- a/src/legacy/utils/streams/list_stream.js
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Readable } from 'stream';
-
-/**
- *  Create a Readable stream that provides the items
- *  from a list as objects to subscribers
- *
- *  @param  {Array<any>} items - the list of items to provide
- *  @return {Readable}
- */
-export function createListStream(items = []) {
-  const queue = [].concat(items);
-
-  return new Readable({
-    objectMode: true,
-    read(size) {
-      queue.splice(0, size).forEach((item) => {
-        this.push(item);
-      });
-
-      if (!queue.length) {
-        this.push(null);
-      }
-    },
-  });
-}
diff --git a/src/legacy/utils/streams/map_stream.js b/src/legacy/utils/streams/map_stream.js
deleted file mode 100644
index 4e906471330f1d..00000000000000
--- a/src/legacy/utils/streams/map_stream.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Transform } from 'stream';
-
-export function createMapStream(fn) {
-  let i = 0;
-
-  return new Transform({
-    objectMode: true,
-    async transform(value, enc, done) {
-      try {
-        this.push(await fn(value, i++));
-        done();
-      } catch (err) {
-        done(err);
-      }
-    },
-  });
-}
diff --git a/src/legacy/utils/streams/promise_from_streams.js b/src/legacy/utils/streams/promise_from_streams.js
deleted file mode 100644
index 05f6a08aa1a09b..00000000000000
--- a/src/legacy/utils/streams/promise_from_streams.js
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- *  Take an array of streams, pipe the output
- *  from each one into the next, listening for
- *  errors from any of the streams, and then resolve
- *  the promise once the final stream has finished
- *  writing/reading.
- *
- *  If the last stream is readable, it's final value
- *  will be provided as the promise value.
- *
- *  Errors emitted from any stream will cause
- *  the promise to be rejected with that error.
- *
- *  @param  {Array<Stream>} streams
- *  @return {Promise<any>}
- */
-
-import { pipeline, Writable } from 'stream';
-
-export async function createPromiseFromStreams(streams) {
-  let finalChunk;
-  const last = streams[streams.length - 1];
-  if (typeof last.read !== 'function' && streams.length === 1) {
-    // For a nicer error than what stream.pipeline throws
-    throw new Error('A minimum of 2 streams is required when a non-readable stream is given');
-  }
-  if (typeof last.read === 'function') {
-    // We are pushing a writable stream to capture the last chunk
-    streams.push(
-      new Writable({
-        // Use object mode even when "last" stream isn't. This allows to
-        // capture the last chunk as-is.
-        objectMode: true,
-        write(chunk, enc, done) {
-          finalChunk = chunk;
-          done();
-        },
-      })
-    );
-  }
-  return new Promise((resolve, reject) => {
-    pipeline(...streams, (err) => {
-      if (err) return reject(err);
-      resolve(finalChunk);
-    });
-  });
-}
diff --git a/src/legacy/utils/streams/reduce_stream.js b/src/legacy/utils/streams/reduce_stream.js
deleted file mode 100644
index d66b0124d1dab9..00000000000000
--- a/src/legacy/utils/streams/reduce_stream.js
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Transform } from 'stream';
-
-/**
- *  Create a transform stream that consumes each chunk it receives
- *  and passes it to the reducer, which will return the new value
- *  for the stream. Once all chunks have been received the reduce
- *  stream provides the result of final call to the reducer to
- *  subscribers.
- *
- *  @param  {Function}
- *  @param  {any} initial Initial value for the stream, if undefined
- *                        then the first chunk provided is used as the
- *                        initial value.
- *  @return {Transform}
- */
-export function createReduceStream(reducer, initial) {
-  let i = -1;
-  let value = initial;
-
-  // if the reducer throws an error then the value is
-  // considered invalid and the stream will never provide
-  // it to subscribers. We will also stop calling the
-  // reducer for any new data that is provided to us
-  let failed = false;
-
-  if (typeof reducer !== 'function') {
-    throw new TypeError('reducer must be a function');
-  }
-
-  return new Transform({
-    readableObjectMode: true,
-    writableObjectMode: true,
-    async transform(chunk, enc, callback) {
-      try {
-        if (failed) {
-          return callback();
-        }
-
-        i += 1;
-        if (i === 0 && initial === undefined) {
-          value = chunk;
-        } else {
-          value = await reducer(value, chunk, enc);
-        }
-
-        callback();
-      } catch (err) {
-        failed = true;
-        callback(err);
-      }
-    },
-
-    flush(callback) {
-      if (!failed) {
-        this.push(value);
-      }
-
-      callback();
-    },
-  });
-}
diff --git a/src/legacy/utils/streams/replace_stream.js b/src/legacy/utils/streams/replace_stream.js
deleted file mode 100644
index 7309bd241fa521..00000000000000
--- a/src/legacy/utils/streams/replace_stream.js
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Transform } from 'stream';
-
-export function createReplaceStream(toReplace, replacement) {
-  if (typeof toReplace !== 'string') {
-    throw new TypeError('toReplace must be a string');
-  }
-
-  let buffer = Buffer.alloc(0);
-  return new Transform({
-    objectMode: false,
-    async transform(value, enc, done) {
-      try {
-        buffer = Buffer.concat([buffer, value], buffer.length + value.length);
-
-        while (true) {
-          // try to find the next instance of `toReplace` in buffer
-          const index = buffer.indexOf(toReplace);
-
-          // if there is no next instance, break
-          if (index === -1) {
-            break;
-          }
-
-          // flush everything to the left of the next instance
-          // of `toReplace`
-          this.push(buffer.slice(0, index));
-
-          // then flush an instance of `replacement`
-          this.push(replacement);
-
-          // and finally update the buffer to include everything
-          // to the right of `toReplace`, dropping to replace from the buffer
-          buffer = buffer.slice(index + toReplace.length);
-        }
-
-        // until now we have only flushed data that is to the left
-        // of a discovered instance of `toReplace`. If `toReplace` is
-        // never found this would lead to us buffering the entire stream.
-        //
-        // Instead, we only keep enough buffer to complete a potentially
-        // partial instance of `toReplace`
-        if (buffer.length > toReplace.length) {
-          // the entire buffer except the last `toReplace.length` bytes
-          // so that if all but one byte from `toReplace` is in the buffer,
-          // and the next chunk delivers the necessary byte, the buffer will then
-          // contain a complete `toReplace` token.
-          this.push(buffer.slice(0, buffer.length - toReplace.length));
-          buffer = buffer.slice(-toReplace.length);
-        }
-
-        done();
-      } catch (err) {
-        done(err);
-      }
-    },
-
-    flush(callback) {
-      if (buffer.length) {
-        this.push(buffer);
-      }
-
-      buffer = null;
-      callback();
-    },
-  });
-}
diff --git a/src/legacy/utils/streams/split_stream.js b/src/legacy/utils/streams/split_stream.js
deleted file mode 100644
index f55cbc7bd290d7..00000000000000
--- a/src/legacy/utils/streams/split_stream.js
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Transform } from 'stream';
-
-/**
- *  Creates a Transform stream that consumes a stream of Buffers
- *  and produces a stream of strings (in object mode) by splitting
- *  the received bytes using the splitChunk.
- *
- *  Ways this is behaves like String#split:
- *    - instances of splitChunk are removed from the input
- *    - splitChunk can be on any size
- *    - if there are no bytes found after the last splitChunk
- *      a final empty chunk is emitted
- *
- *  Ways this deviates from String#split:
- *    - splitChunk cannot be a regexp
- *    - an empty string or Buffer will not produce a stream of individual
- *      bytes like `string.split('')` would
- *
- *  @param  {String} splitChunk
- *  @return {Transform}
- */
-export function createSplitStream(splitChunk) {
-  let unsplitBuffer = Buffer.alloc(0);
-
-  return new Transform({
-    writableObjectMode: false,
-    readableObjectMode: true,
-    transform(chunk, enc, callback) {
-      try {
-        let i;
-        let toSplit = Buffer.concat([unsplitBuffer, chunk]);
-        while ((i = toSplit.indexOf(splitChunk)) !== -1) {
-          const slice = toSplit.slice(0, i);
-          toSplit = toSplit.slice(i + splitChunk.length);
-          this.push(slice.toString('utf8'));
-        }
-
-        unsplitBuffer = toSplit;
-        callback(null);
-      } catch (err) {
-        callback(err);
-      }
-    },
-
-    flush(callback) {
-      try {
-        this.push(unsplitBuffer.toString('utf8'));
-
-        callback(null);
-      } catch (err) {
-        callback(err);
-      }
-    },
-  });
-}
diff --git a/src/plugins/advanced_settings/public/management_app/advanced_settings.test.tsx b/src/plugins/advanced_settings/public/management_app/advanced_settings.test.tsx
index 6103041cf0a4c8..68a21c6a1587c4 100644
--- a/src/plugins/advanced_settings/public/management_app/advanced_settings.test.tsx
+++ b/src/plugins/advanced_settings/public/management_app/advanced_settings.test.tsx
@@ -32,10 +32,6 @@ import { AdvancedSettingsComponent } from './advanced_settings';
 import { notificationServiceMock, docLinksServiceMock } from '../../../../core/public/mocks';
 import { ComponentRegistry } from '../component_registry';
 
-jest.mock('ui/new_platform', () => ({
-  npStart: mockConfig(),
-}));
-
 jest.mock('./components/field', () => ({
   Field: () => {
     return 'field';
diff --git a/src/plugins/console/server/lib/spec_definitions/js/mappings.ts b/src/plugins/console/server/lib/spec_definitions/js/mappings.ts
index d09637b05a3cb5..aa09278d075538 100644
--- a/src/plugins/console/server/lib/spec_definitions/js/mappings.ts
+++ b/src/plugins/console/server/lib/spec_definitions/js/mappings.ts
@@ -17,8 +17,6 @@
  * under the License.
  */
 
-import _ from 'lodash';
-
 import { SpecDefinitionsService } from '../../../services';
 
 import { BOOLEAN } from './shared';
@@ -159,28 +157,25 @@ export const mappings = (specService: SpecDefinitionsService) => {
 
           // dates
           format: {
-            __one_of: _.flatten([
-              _.map(
-                [
-                  'date',
-                  'date_time',
-                  'date_time_no_millis',
-                  'ordinal_date',
-                  'ordinal_date_time',
-                  'ordinal_date_time_no_millis',
-                  'time',
-                  'time_no_millis',
-                  't_time',
-                  't_time_no_millis',
-                  'week_date',
-                  'week_date_time',
-                  'week_date_time_no_millis',
-                ],
-                function (s) {
-                  return ['basic_' + s, 'strict_' + s];
-                }
-              ),
-              [
+            __one_of: [
+              ...[
+                'date',
+                'date_time',
+                'date_time_no_millis',
+                'ordinal_date',
+                'ordinal_date_time',
+                'ordinal_date_time_no_millis',
+                'time',
+                'time_no_millis',
+                't_time',
+                't_time_no_millis',
+                'week_date',
+                'week_date_time',
+                'week_date_time_no_millis',
+              ].map(function (s) {
+                return ['basic_' + s, 'strict_' + s];
+              }),
+              ...[
                 'date',
                 'date_hour',
                 'date_hour_minute',
@@ -214,7 +209,7 @@ export const mappings = (specService: SpecDefinitionsService) => {
                 'epoch_millis',
                 'epoch_second',
               ],
-            ]),
+            ],
           },
 
           fielddata: {
diff --git a/src/plugins/dashboard/public/application/actions/index.ts b/src/plugins/dashboard/public/application/actions/index.ts
index 4343a3409b6967..cd32c2025456f5 100644
--- a/src/plugins/dashboard/public/application/actions/index.ts
+++ b/src/plugins/dashboard/public/application/actions/index.ts
@@ -42,3 +42,8 @@ export {
   UnlinkFromLibraryActionContext,
   ACTION_UNLINK_FROM_LIBRARY,
 } from './unlink_from_library_action';
+export {
+  LibraryNotificationActionContext,
+  LibraryNotificationAction,
+  ACTION_LIBRARY_NOTIFICATION,
+} from './library_notification_action';
diff --git a/src/plugins/dashboard/public/application/actions/library_notification_action.test.tsx b/src/plugins/dashboard/public/application/actions/library_notification_action.test.tsx
new file mode 100644
index 00000000000000..385f6f14ba94ce
--- /dev/null
+++ b/src/plugins/dashboard/public/application/actions/library_notification_action.test.tsx
@@ -0,0 +1,100 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { isErrorEmbeddable, ReferenceOrValueEmbeddable } from '../../embeddable_plugin';
+import { DashboardContainer } from '../embeddable';
+import { getSampleDashboardInput } from '../test_helpers';
+import {
+  CONTACT_CARD_EMBEDDABLE,
+  ContactCardEmbeddableFactory,
+  ContactCardEmbeddable,
+  ContactCardEmbeddableInput,
+  ContactCardEmbeddableOutput,
+} from '../../embeddable_plugin_test_samples';
+import { coreMock } from '../../../../../core/public/mocks';
+import { CoreStart } from 'kibana/public';
+import { LibraryNotificationAction } from '.';
+import { embeddablePluginMock } from 'src/plugins/embeddable/public/mocks';
+import { ViewMode } from '../../../../embeddable/public';
+
+const { setup, doStart } = embeddablePluginMock.createInstance();
+setup.registerEmbeddableFactory(
+  CONTACT_CARD_EMBEDDABLE,
+  new ContactCardEmbeddableFactory((() => null) as any, {} as any)
+);
+const start = doStart();
+
+let container: DashboardContainer;
+let embeddable: ContactCardEmbeddable & ReferenceOrValueEmbeddable;
+let coreStart: CoreStart;
+beforeEach(async () => {
+  coreStart = coreMock.createStart();
+
+  const containerOptions = {
+    ExitFullScreenButton: () => null,
+    SavedObjectFinder: () => null,
+    application: {} as any,
+    embeddable: start,
+    inspector: {} as any,
+    notifications: {} as any,
+    overlays: coreStart.overlays,
+    savedObjectMetaData: {} as any,
+    uiActions: {} as any,
+  };
+
+  container = new DashboardContainer(getSampleDashboardInput(), containerOptions);
+
+  const contactCardEmbeddable = await container.addNewEmbeddable<
+    ContactCardEmbeddableInput,
+    ContactCardEmbeddableOutput,
+    ContactCardEmbeddable
+  >(CONTACT_CARD_EMBEDDABLE, {
+    firstName: 'Kibanana',
+  });
+
+  if (isErrorEmbeddable(contactCardEmbeddable)) {
+    throw new Error('Failed to create embeddable');
+  }
+  embeddable = embeddablePluginMock.mockRefOrValEmbeddable<
+    ContactCardEmbeddable,
+    ContactCardEmbeddableInput
+  >(contactCardEmbeddable, {
+    mockedByReferenceInput: { savedObjectId: 'testSavedObjectId', id: contactCardEmbeddable.id },
+    mockedByValueInput: { firstName: 'Kibanana', id: contactCardEmbeddable.id },
+  });
+  embeddable.updateInput({ viewMode: ViewMode.EDIT });
+});
+
+test('Notification is shown when embeddable on dashboard has reference type input', async () => {
+  const action = new LibraryNotificationAction();
+  embeddable.updateInput(await embeddable.getInputAsRefType());
+  expect(await action.isCompatible({ embeddable })).toBe(true);
+});
+
+test('Notification is not shown when embeddable input is by value', async () => {
+  const action = new LibraryNotificationAction();
+  embeddable.updateInput(await embeddable.getInputAsValueType());
+  expect(await action.isCompatible({ embeddable })).toBe(false);
+});
+
+test('Notification is not shown when view mode is set to view', async () => {
+  const action = new LibraryNotificationAction();
+  embeddable.updateInput(await embeddable.getInputAsRefType());
+  embeddable.updateInput({ viewMode: ViewMode.VIEW });
+  expect(await action.isCompatible({ embeddable })).toBe(false);
+});
diff --git a/src/plugins/dashboard/public/application/actions/library_notification_action.tsx b/src/plugins/dashboard/public/application/actions/library_notification_action.tsx
new file mode 100644
index 00000000000000..974b55275ccc1d
--- /dev/null
+++ b/src/plugins/dashboard/public/application/actions/library_notification_action.tsx
@@ -0,0 +1,89 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiBadge } from '@elastic/eui';
+import { IEmbeddable, ViewMode, isReferenceOrValueEmbeddable } from '../../embeddable_plugin';
+import { ActionByType, IncompatibleActionError } from '../../ui_actions_plugin';
+import { reactToUiComponent } from '../../../../kibana_react/public';
+
+export const ACTION_LIBRARY_NOTIFICATION = 'ACTION_LIBRARY_NOTIFICATION';
+
+export interface LibraryNotificationActionContext {
+  embeddable: IEmbeddable;
+}
+
+export class LibraryNotificationAction implements ActionByType<typeof ACTION_LIBRARY_NOTIFICATION> {
+  public readonly id = ACTION_LIBRARY_NOTIFICATION;
+  public readonly type = ACTION_LIBRARY_NOTIFICATION;
+  public readonly order = 1;
+
+  private displayName = i18n.translate('dashboard.panel.LibraryNotification', {
+    defaultMessage: 'Library',
+  });
+
+  private icon = 'folderCheck';
+
+  public readonly MenuItem = reactToUiComponent(() => (
+    <EuiBadge
+      data-test-subj={`embeddablePanelNotification-${this.id}`}
+      iconType={this.icon}
+      key={this.id}
+      style={{ marginTop: '2px', marginRight: '4px' }}
+      color="hollow"
+    >
+      {this.displayName}
+    </EuiBadge>
+  ));
+
+  public getDisplayName({ embeddable }: LibraryNotificationActionContext) {
+    if (!embeddable.getRoot() || !embeddable.getRoot().isContainer) {
+      throw new IncompatibleActionError();
+    }
+    return this.displayName;
+  }
+
+  public getIconType({ embeddable }: LibraryNotificationActionContext) {
+    if (!embeddable.getRoot() || !embeddable.getRoot().isContainer) {
+      throw new IncompatibleActionError();
+    }
+    return this.icon;
+  }
+
+  public getDisplayNameTooltip = ({ embeddable }: LibraryNotificationActionContext) => {
+    if (!embeddable.getRoot() || !embeddable.getRoot().isContainer) {
+      throw new IncompatibleActionError();
+    }
+    return i18n.translate('dashboard.panel.libraryNotification.toolTip', {
+      defaultMessage:
+        'This panel is linked to a Library item. Editing the panel might affect other dashboards.',
+    });
+  };
+
+  public isCompatible = async ({ embeddable }: LibraryNotificationActionContext) => {
+    return (
+      embeddable.getInput()?.viewMode !== ViewMode.VIEW &&
+      isReferenceOrValueEmbeddable(embeddable) &&
+      embeddable.inputIsRefType(embeddable.getInput())
+    );
+  };
+
+  public execute = async () => {};
+}
diff --git a/src/plugins/dashboard/public/application/dashboard_app_controller.tsx b/src/plugins/dashboard/public/application/dashboard_app_controller.tsx
index 0d20fdee07df51..212b54be9ae046 100644
--- a/src/plugins/dashboard/public/application/dashboard_app_controller.tsx
+++ b/src/plugins/dashboard/public/application/dashboard_app_controller.tsx
@@ -24,9 +24,18 @@ import { EuiCheckboxGroupIdToSelectedMap } from '@elastic/eui/src/components/for
 import React, { useState, ReactElement } from 'react';
 import ReactDOM from 'react-dom';
 import angular from 'angular';
+import deepEqual from 'fast-deep-equal';
 
 import { Observable, pipe, Subscription, merge } from 'rxjs';
-import { filter, map, debounceTime, mapTo, startWith, switchMap } from 'rxjs/operators';
+import {
+  filter,
+  map,
+  debounceTime,
+  mapTo,
+  startWith,
+  switchMap,
+  distinctUntilChanged,
+} from 'rxjs/operators';
 import { History } from 'history';
 import { SavedObjectSaveOpts } from 'src/plugins/saved_objects/public';
 import { NavigationPublicPluginStart as NavigationStart } from 'src/plugins/navigation/public';
@@ -279,6 +288,12 @@ export class DashboardAppController {
     const updateIndexPatternsOperator = pipe(
       filter((container: DashboardContainer) => !!container && !isErrorEmbeddable(container)),
       map(getDashboardIndexPatterns),
+      distinctUntilChanged((a, b) =>
+        deepEqual(
+          a.map((ip) => ip.id),
+          b.map((ip) => ip.id)
+        )
+      ),
       // using switchMap for previous task cancellation
       switchMap((panelIndexPatterns: IndexPattern[]) => {
         return new Observable((observer) => {
@@ -405,17 +420,29 @@ export class DashboardAppController {
               ) : null;
             };
 
-            outputSubscription = new Subscription();
-            outputSubscription.add(
-              dashboardContainer
-                .getOutput$()
-                .pipe(
-                  mapTo(dashboardContainer),
-                  startWith(dashboardContainer), // to trigger initial index pattern update
-                  updateIndexPatternsOperator
+            outputSubscription = merge(
+              // output of dashboard container itself
+              dashboardContainer.getOutput$(),
+              // plus output of dashboard container children,
+              // children may change, so make sure we subscribe/unsubscribe with switchMap
+              dashboardContainer.getOutput$().pipe(
+                map(() => dashboardContainer!.getChildIds()),
+                distinctUntilChanged(deepEqual),
+                switchMap((newChildIds: string[]) =>
+                  merge(
+                    ...newChildIds.map((childId) =>
+                      dashboardContainer!.getChild(childId).getOutput$()
+                    )
+                  )
                 )
-                .subscribe()
-            );
+              )
+            )
+              .pipe(
+                mapTo(dashboardContainer),
+                startWith(dashboardContainer), // to trigger initial index pattern update
+                updateIndexPatternsOperator
+              )
+              .subscribe();
 
             inputSubscription = dashboardContainer.getInput$().subscribe(() => {
               let dirty = false;
diff --git a/src/plugins/dashboard/public/attribute_service/attribute_service.test.ts b/src/plugins/dashboard/public/attribute_service/attribute_service.test.ts
new file mode 100644
index 00000000000000..06f380ca3862b6
--- /dev/null
+++ b/src/plugins/dashboard/public/attribute_service/attribute_service.test.ts
@@ -0,0 +1,193 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { ATTRIBUTE_SERVICE_KEY } from './attribute_service';
+import { mockAttributeService } from './attribute_service_mock';
+import { coreMock } from '../../../../core/public/mocks';
+
+interface TestAttributes {
+  title: string;
+  testAttr1?: string;
+  testAttr2?: { array: unknown[]; testAttr3: string };
+}
+
+interface TestByValueInput {
+  id: string;
+  [ATTRIBUTE_SERVICE_KEY]: TestAttributes;
+}
+
+describe('attributeService', () => {
+  const defaultTestType = 'defaultTestType';
+  let attributes: TestAttributes;
+  let byValueInput: TestByValueInput;
+  let byReferenceInput: { id: string; savedObjectId: string };
+
+  beforeEach(() => {
+    attributes = {
+      title: 'ultra title',
+      testAttr1: 'neat first attribute',
+      testAttr2: { array: [1, 2, 3], testAttr3: 'super attribute' },
+    };
+    byValueInput = {
+      id: '456',
+      attributes,
+    };
+    byReferenceInput = {
+      id: '456',
+      savedObjectId: '123',
+    };
+  });
+
+  describe('determining input type', () => {
+    const defaultAttributeService = mockAttributeService<TestAttributes>(defaultTestType);
+    const customAttributeService = mockAttributeService<TestAttributes, TestByValueInput>(
+      defaultTestType
+    );
+
+    it('can determine input type given default types', () => {
+      expect(
+        defaultAttributeService.inputIsRefType({ id: '456', savedObjectId: '123' })
+      ).toBeTruthy();
+      expect(
+        defaultAttributeService.inputIsRefType({
+          id: '456',
+          attributes: { title: 'wow I am by value' },
+        })
+      ).toBeFalsy();
+    });
+    it('can determine input type given custom types', () => {
+      expect(
+        customAttributeService.inputIsRefType({ id: '456', savedObjectId: '123' })
+      ).toBeTruthy();
+      expect(
+        customAttributeService.inputIsRefType({
+          id: '456',
+          [ATTRIBUTE_SERVICE_KEY]: { title: 'wow I am by value' },
+        })
+      ).toBeFalsy();
+    });
+  });
+
+  describe('unwrapping attributes', () => {
+    it('can unwrap all default attributes when given reference type input', async () => {
+      const core = coreMock.createStart();
+      core.savedObjects.client.get = jest.fn().mockResolvedValueOnce({
+        attributes,
+      });
+      const attributeService = mockAttributeService<TestAttributes>(
+        defaultTestType,
+        undefined,
+        core
+      );
+      expect(await attributeService.unwrapAttributes(byReferenceInput)).toEqual(attributes);
+    });
+
+    it('returns attributes when when given value type input', async () => {
+      const attributeService = mockAttributeService<TestAttributes>(defaultTestType);
+      expect(await attributeService.unwrapAttributes(byValueInput)).toEqual(attributes);
+    });
+
+    it('runs attributes through a custom unwrap method', async () => {
+      const core = coreMock.createStart();
+      core.savedObjects.client.get = jest.fn().mockResolvedValueOnce({
+        attributes,
+      });
+      const attributeService = mockAttributeService<TestAttributes>(
+        defaultTestType,
+        {
+          customUnwrapMethod: (savedObject) => ({
+            ...savedObject.attributes,
+            testAttr2: { array: [1, 2, 3, 4, 5], testAttr3: 'kibanana' },
+          }),
+        },
+        core
+      );
+      expect(await attributeService.unwrapAttributes(byReferenceInput)).toEqual({
+        ...attributes,
+        testAttr2: { array: [1, 2, 3, 4, 5], testAttr3: 'kibanana' },
+      });
+    });
+  });
+
+  describe('wrapping attributes', () => {
+    it('returns given attributes when use ref type is false', async () => {
+      const attributeService = mockAttributeService<TestAttributes>(defaultTestType);
+      expect(await attributeService.wrapAttributes(attributes, false)).toEqual({ attributes });
+    });
+
+    it('updates existing saved object with new attributes when given id', async () => {
+      const core = coreMock.createStart();
+      const attributeService = mockAttributeService<TestAttributes>(
+        defaultTestType,
+        undefined,
+        core
+      );
+      expect(await attributeService.wrapAttributes(attributes, true, byReferenceInput)).toEqual(
+        byReferenceInput
+      );
+      expect(core.savedObjects.client.update).toHaveBeenCalledWith(
+        defaultTestType,
+        '123',
+        attributes
+      );
+    });
+
+    it('creates new saved object with attributes when given no id', async () => {
+      const core = coreMock.createStart();
+      core.savedObjects.client.create = jest.fn().mockResolvedValueOnce({
+        id: '678',
+      });
+      const attributeService = mockAttributeService<TestAttributes>(
+        defaultTestType,
+        undefined,
+        core
+      );
+      expect(await attributeService.wrapAttributes(attributes, true)).toEqual({
+        savedObjectId: '678',
+      });
+      expect(core.savedObjects.client.create).toHaveBeenCalledWith(defaultTestType, attributes);
+    });
+
+    it('uses custom save method when given an id', async () => {
+      const customSaveMethod = jest.fn().mockReturnValue({ id: '123' });
+      const attributeService = mockAttributeService<TestAttributes>(defaultTestType, {
+        customSaveMethod,
+      });
+      expect(await attributeService.wrapAttributes(attributes, true, byReferenceInput)).toEqual(
+        byReferenceInput
+      );
+      expect(customSaveMethod).toHaveBeenCalledWith(
+        defaultTestType,
+        attributes,
+        byReferenceInput.savedObjectId
+      );
+    });
+
+    it('uses custom save method given no id', async () => {
+      const customSaveMethod = jest.fn().mockReturnValue({ id: '678' });
+      const attributeService = mockAttributeService<TestAttributes>(defaultTestType, {
+        customSaveMethod,
+      });
+      expect(await attributeService.wrapAttributes(attributes, true)).toEqual({
+        savedObjectId: '678',
+      });
+      expect(customSaveMethod).toHaveBeenCalledWith(defaultTestType, attributes, undefined);
+    });
+  });
+});
diff --git a/src/plugins/dashboard/public/attribute_service/attribute_service.tsx b/src/plugins/dashboard/public/attribute_service/attribute_service.tsx
index fe5f6a0c8e2bd4..a36363d22d87da 100644
--- a/src/plugins/dashboard/public/attribute_service/attribute_service.tsx
+++ b/src/plugins/dashboard/public/attribute_service/attribute_service.tsx
@@ -19,11 +19,16 @@
 
 import React from 'react';
 import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import {
   EmbeddableInput,
   SavedObjectEmbeddableInput,
   isSavedObjectEmbeddableInput,
   IEmbeddable,
+  Container,
+  EmbeddableStart,
+  EmbeddableFactory,
+  EmbeddableFactoryNotFoundError,
 } from '../embeddable_plugin';
 import {
   SavedObjectsClientContract,
@@ -34,17 +39,10 @@ import {
 } from '../../../../core/public';
 import {
   SavedObjectSaveModal,
-  showSaveModal,
   OnSaveProps,
   SaveResult,
   checkForDuplicateTitle,
 } from '../../../saved_objects/public';
-import {
-  EmbeddableStart,
-  EmbeddableFactory,
-  EmbeddableFactoryNotFoundError,
-  Container,
-} from '../../../embeddable/public';
 
 /**
  * The attribute service is a shared, generic service that embeddables can use to provide the functionality
@@ -52,26 +50,46 @@ import {
  * can also be used as a higher level wrapper to transform an embeddable input shape that references a saved object
  * into an embeddable input shape that contains that saved object's attributes by value.
  */
+export const ATTRIBUTE_SERVICE_KEY = 'attributes';
+
+export interface AttributeServiceOptions<A extends { title: string }> {
+  customSaveMethod?: (
+    type: string,
+    attributes: A,
+    savedObjectId?: string
+  ) => Promise<{ id: string }>;
+  customUnwrapMethod?: (savedObject: SimpleSavedObject<A>) => A;
+}
+
 export class AttributeService<
   SavedObjectAttributes extends { title: string },
-  ValType extends EmbeddableInput & { attributes: SavedObjectAttributes },
-  RefType extends SavedObjectEmbeddableInput
+  ValType extends EmbeddableInput & {
+    [ATTRIBUTE_SERVICE_KEY]: SavedObjectAttributes;
+  } = EmbeddableInput & { [ATTRIBUTE_SERVICE_KEY]: SavedObjectAttributes },
+  RefType extends SavedObjectEmbeddableInput = SavedObjectEmbeddableInput
 > {
-  private embeddableFactory: EmbeddableFactory;
+  private embeddableFactory?: EmbeddableFactory;
 
   constructor(
     private type: string,
+    private showSaveModal: (
+      saveModal: React.ReactElement,
+      I18nContext: I18nStart['Context']
+    ) => void,
     private savedObjectsClient: SavedObjectsClientContract,
     private overlays: OverlayStart,
     private i18nContext: I18nStart['Context'],
     private toasts: NotificationsStart['toasts'],
-    getEmbeddableFactory: EmbeddableStart['getEmbeddableFactory']
+    getEmbeddableFactory?: EmbeddableStart['getEmbeddableFactory'],
+    private options?: AttributeServiceOptions<SavedObjectAttributes>
   ) {
-    const factory = getEmbeddableFactory(this.type);
-    if (!factory) {
-      throw new EmbeddableFactoryNotFoundError(this.type);
+    if (getEmbeddableFactory) {
+      const factory = getEmbeddableFactory(this.type);
+      if (!factory) {
+        throw new EmbeddableFactoryNotFoundError(this.type);
+      }
+      this.embeddableFactory = factory;
     }
-    this.embeddableFactory = factory;
   }
 
   public async unwrapAttributes(input: RefType | ValType): Promise<SavedObjectAttributes> {
@@ -79,43 +97,54 @@ export class AttributeService<
       const savedObject: SimpleSavedObject<SavedObjectAttributes> = await this.savedObjectsClient.get<
         SavedObjectAttributes
       >(this.type, input.savedObjectId);
-      return savedObject.attributes;
+      return this.options?.customUnwrapMethod
+        ? this.options?.customUnwrapMethod(savedObject)
+        : { ...savedObject.attributes };
     }
-    return input.attributes;
+    return input[ATTRIBUTE_SERVICE_KEY];
   }
 
   public async wrapAttributes(
     newAttributes: SavedObjectAttributes,
     useRefType: boolean,
-    embeddable?: IEmbeddable
+    input?: ValType | RefType
   ): Promise<Omit<ValType | RefType, 'id'>> {
+    const originalInput = input ? input : {};
     const savedObjectId =
-      embeddable && isSavedObjectEmbeddableInput(embeddable.getInput())
-        ? (embeddable.getInput() as SavedObjectEmbeddableInput).savedObjectId
+      input && this.inputIsRefType(input)
+        ? (input as SavedObjectEmbeddableInput).savedObjectId
         : undefined;
     if (!useRefType) {
-      return { attributes: newAttributes } as ValType;
-    } else {
-      try {
-        if (savedObjectId) {
-          await this.savedObjectsClient.update(this.type, savedObjectId, newAttributes);
-          return { savedObjectId } as RefType;
-        } else {
-          const savedItem = await this.savedObjectsClient.create(this.type, newAttributes);
-          return { savedObjectId: savedItem.id } as RefType;
-        }
-      } catch (error) {
-        this.toasts.addDanger({
-          title: i18n.translate('dashboard.attributeService.saveToLibraryError', {
-            defaultMessage: `Panel was not saved to the library. Error: {errorMessage}`,
-            values: {
-              errorMessage: error.message,
-            },
-          }),
-          'data-test-subj': 'saveDashboardFailure',
-        });
-        return Promise.reject({ error });
+      return { [ATTRIBUTE_SERVICE_KEY]: newAttributes } as ValType;
+    }
+    try {
+      if (this.options?.customSaveMethod) {
+        const savedItem = await this.options.customSaveMethod(
+          this.type,
+          newAttributes,
+          savedObjectId
+        );
+        return { ...originalInput, savedObjectId: savedItem.id } as RefType;
+      }
+
+      if (savedObjectId) {
+        await this.savedObjectsClient.update(this.type, savedObjectId, newAttributes);
+        return { ...originalInput, savedObjectId } as RefType;
       }
+
+      const savedItem = await this.savedObjectsClient.create(this.type, newAttributes);
+      return { ...originalInput, savedObjectId: savedItem.id } as RefType;
+    } catch (error) {
+      this.toasts.addDanger({
+        title: i18n.translate('dashboard.attributeService.saveToLibraryError', {
+          defaultMessage: `Panel was not saved to the library. Error: {errorMessage}`,
+          values: {
+            errorMessage: error.message,
+          },
+        }),
+        'data-test-subj': 'saveDashboardFailure',
+      });
+      return Promise.reject({ error });
     }
   }
 
@@ -146,7 +175,7 @@ export class AttributeService<
 
   getInputAsRefType = async (
     input: ValType | RefType,
-    saveOptions?: { showSaveModal: boolean } | { title: string }
+    saveOptions?: { showSaveModal: boolean; saveModalTitle?: string } | { title: string }
   ): Promise<RefType> => {
     if (this.inputIsRefType(input)) {
       return input;
@@ -159,7 +188,7 @@ export class AttributeService<
             copyOnSave: false,
             lastSavedTitle: '',
             getEsType: () => this.type,
-            getDisplayName: this.embeddableFactory.getDisplayName,
+            getDisplayName: this.embeddableFactory?.getDisplayName || (() => this.type),
           },
           props.isTitleDuplicateConfirmed,
           props.onTitleDuplicate,
@@ -169,7 +198,7 @@ export class AttributeService<
           }
         );
         try {
-          const newAttributes = { ...input.attributes };
+          const newAttributes = { ...input[ATTRIBUTE_SERVICE_KEY] };
           newAttributes.title = props.newTitle;
           const wrappedInput = (await this.wrapAttributes(newAttributes, true)) as RefType;
           resolve(wrappedInput);
@@ -181,11 +210,11 @@ export class AttributeService<
       };
 
       if (saveOptions && (saveOptions as { showSaveModal: boolean }).showSaveModal) {
-        showSaveModal(
+        this.showSaveModal(
           <SavedObjectSaveModal
             onSave={onSave}
             onClose={() => reject()}
-            title={input.attributes.title}
+            title={get(saveOptions, 'saveModalTitle', input[ATTRIBUTE_SERVICE_KEY].title)}
             showCopyOnSave={false}
             objectType={this.type}
             showDescription={false}
diff --git a/src/plugins/dashboard/public/attribute_service/attribute_service_mock.tsx b/src/plugins/dashboard/public/attribute_service/attribute_service_mock.tsx
new file mode 100644
index 00000000000000..321a53361fc7aa
--- /dev/null
+++ b/src/plugins/dashboard/public/attribute_service/attribute_service_mock.tsx
@@ -0,0 +1,49 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { EmbeddableInput, SavedObjectEmbeddableInput } from '../embeddable_plugin';
+import { coreMock } from '../../../../core/public/mocks';
+import { AttributeServiceOptions } from './attribute_service';
+import { CoreStart } from '../../../../core/public';
+import { AttributeService, ATTRIBUTE_SERVICE_KEY } from '..';
+
+export const mockAttributeService = <
+  A extends { title: string },
+  V extends EmbeddableInput & { [ATTRIBUTE_SERVICE_KEY]: A } = EmbeddableInput & {
+    [ATTRIBUTE_SERVICE_KEY]: A;
+  },
+  R extends SavedObjectEmbeddableInput = SavedObjectEmbeddableInput
+>(
+  type: string,
+  options?: AttributeServiceOptions<A>,
+  customCore?: jest.Mocked<CoreStart>
+): AttributeService<A, V, R> => {
+  const core = customCore ? customCore : coreMock.createStart();
+  const service = new AttributeService<A, V, R>(
+    type,
+    jest.fn(),
+    core.savedObjects.client,
+    core.overlays,
+    core.i18n.Context,
+    core.notifications.toasts,
+    jest.fn().mockReturnValue(() => ({ getDisplayName: () => type })),
+    options
+  );
+  return service;
+};
diff --git a/src/plugins/dashboard/public/index.ts b/src/plugins/dashboard/public/index.ts
index 8a9954cc77a2e5..e22d1f038a4560 100644
--- a/src/plugins/dashboard/public/index.ts
+++ b/src/plugins/dashboard/public/index.ts
@@ -40,7 +40,7 @@ export {
 export { addEmbeddableToDashboardUrl } from './url_utils/url_helper';
 export { SavedObjectDashboard } from './saved_dashboards';
 export { SavedDashboardPanel } from './types';
-export { AttributeService } from './attribute_service/attribute_service';
+export { AttributeService, ATTRIBUTE_SERVICE_KEY } from './attribute_service/attribute_service';
 
 export function plugin(initializerContext: PluginInitializerContext) {
   return new DashboardPlugin(initializerContext);
diff --git a/src/plugins/dashboard/public/plugin.tsx b/src/plugins/dashboard/public/plugin.tsx
index 8b9b92faf90316..0ce6f9489ea022 100644
--- a/src/plugins/dashboard/public/plugin.tsx
+++ b/src/plugins/dashboard/public/plugin.tsx
@@ -40,6 +40,7 @@ import {
   EmbeddableStart,
   SavedObjectEmbeddableInput,
   EmbeddableInput,
+  PANEL_NOTIFICATION_TRIGGER,
 } from '../../embeddable/public';
 import { DataPublicPluginSetup, DataPublicPluginStart, esFilters } from '../../data/public';
 import { SharePluginSetup, SharePluginStart, UrlGeneratorContract } from '../../share/public';
@@ -51,6 +52,7 @@ import {
   getSavedObjectFinder,
   SavedObjectLoader,
   SavedObjectsStart,
+  showSaveModal,
 } from '../../saved_objects/public';
 import {
   ExitFullScreenButton as ExitFullScreenButtonUi,
@@ -83,6 +85,12 @@ import {
   ACTION_UNLINK_FROM_LIBRARY,
   UnlinkFromLibraryActionContext,
   UnlinkFromLibraryAction,
+  ACTION_ADD_TO_LIBRARY,
+  AddToLibraryActionContext,
+  AddToLibraryAction,
+  ACTION_LIBRARY_NOTIFICATION,
+  LibraryNotificationActionContext,
+  LibraryNotificationAction,
 } from './application';
 import {
   createDashboardUrlGenerator,
@@ -96,10 +104,9 @@ import { PlaceholderEmbeddableFactory } from './application/embeddable/placehold
 import { UrlGeneratorState } from '../../share/public';
 import { AttributeService } from '.';
 import {
-  AddToLibraryAction,
-  ACTION_ADD_TO_LIBRARY,
-  AddToLibraryActionContext,
-} from './application/actions/add_to_library_action';
+  AttributeServiceOptions,
+  ATTRIBUTE_SERVICE_KEY,
+} from './attribute_service/attribute_service';
 
 declare module '../../share/public' {
   export interface UrlGeneratorStateMapping {
@@ -148,10 +155,13 @@ export interface DashboardStart {
   DashboardContainerByValueRenderer: ReturnType<typeof createDashboardContainerByValueRenderer>;
   getAttributeService: <
     A extends { title: string },
-    V extends EmbeddableInput & { attributes: A },
-    R extends SavedObjectEmbeddableInput
+    V extends EmbeddableInput & { [ATTRIBUTE_SERVICE_KEY]: A } = EmbeddableInput & {
+      [ATTRIBUTE_SERVICE_KEY]: A;
+    },
+    R extends SavedObjectEmbeddableInput = SavedObjectEmbeddableInput
   >(
-    type: string
+    type: string,
+    options?: AttributeServiceOptions<A>
   ) => AttributeService<A, V, R>;
 }
 
@@ -162,6 +172,7 @@ declare module '../../../plugins/ui_actions/public' {
     [ACTION_CLONE_PANEL]: ClonePanelActionContext;
     [ACTION_ADD_TO_LIBRARY]: AddToLibraryActionContext;
     [ACTION_UNLINK_FROM_LIBRARY]: UnlinkFromLibraryActionContext;
+    [ACTION_LIBRARY_NOTIFICATION]: LibraryNotificationActionContext;
   }
 }
 
@@ -437,6 +448,10 @@ export class DashboardPlugin
       const unlinkFromLibraryAction = new UnlinkFromLibraryAction();
       uiActions.registerAction(unlinkFromLibraryAction);
       uiActions.attachAction(CONTEXT_MENU_TRIGGER, unlinkFromLibraryAction.id);
+
+      const libraryNotificationAction = new LibraryNotificationAction();
+      uiActions.registerAction(libraryNotificationAction);
+      uiActions.attachAction(PANEL_NOTIFICATION_TRIGGER, libraryNotificationAction.id);
     }
 
     const savedDashboardLoader = createSavedDashboardLoader({
@@ -458,14 +473,16 @@ export class DashboardPlugin
       DashboardContainerByValueRenderer: createDashboardContainerByValueRenderer({
         factory: dashboardContainerFactory,
       }),
-      getAttributeService: (type: string) =>
+      getAttributeService: (type: string, options) =>
         new AttributeService(
           type,
+          showSaveModal,
           core.savedObjects.client,
           core.overlays,
           core.i18n.Context,
           core.notifications.toasts,
-          embeddable.getEmbeddableFactory
+          embeddable.getEmbeddableFactory,
+          options
         ),
     };
   }
diff --git a/src/plugins/dashboard/public/saved_dashboards/saved_dashboards.ts b/src/plugins/dashboard/public/saved_dashboards/saved_dashboards.ts
index 09357072a13a63..3bd4d66a693b1c 100644
--- a/src/plugins/dashboard/public/saved_dashboards/saved_dashboards.ts
+++ b/src/plugins/dashboard/public/saved_dashboards/saved_dashboards.ts
@@ -35,5 +35,5 @@ interface Services {
  */
 export function createSavedDashboardLoader(services: Services) {
   const SavedDashboard = createSavedDashboardClass(services);
-  return new SavedObjectLoader(SavedDashboard, services.savedObjectsClient, services.chrome);
+  return new SavedObjectLoader(SavedDashboard, services.savedObjectsClient);
 }
diff --git a/src/plugins/data/common/es_query/filters/get_display_value.ts b/src/plugins/data/common/es_query/filters/get_display_value.ts
index 10b4dab3f46efa..28ba0ab629e8f1 100644
--- a/src/plugins/data/common/es_query/filters/get_display_value.ts
+++ b/src/plugins/data/common/es_query/filters/get_display_value.ts
@@ -17,30 +17,26 @@
  * under the License.
  */
 
-import { get } from 'lodash';
 import { i18n } from '@kbn/i18n';
-import { IIndexPattern, IFieldType } from '../..';
+import { IIndexPattern } from '../..';
 import { getIndexPatternFromFilter } from './get_index_pattern_from_filter';
 import { Filter } from '../filters';
 
 function getValueFormatter(indexPattern?: IIndexPattern, key?: string) {
-  if (!indexPattern || !key) return;
+  // checking getFormatterForField exists because there is at least once case where an index pattern
+  // is an object rather than an IndexPattern class
+  if (!indexPattern || !indexPattern.getFormatterForField || !key) return;
 
-  let format = get(indexPattern, ['fields', 'byName', key, 'format']);
-  if (!format && (indexPattern.fields as any).getByName) {
-    // TODO: Why is indexPatterns sometimes a map and sometimes an array?
-    const field: IFieldType = (indexPattern.fields as any).getByName(key);
-    if (!field) {
-      throw new Error(
-        i18n.translate('data.filter.filterBar.fieldNotFound', {
-          defaultMessage: 'Field {key} not found in index pattern {indexPattern}',
-          values: { key, indexPattern: indexPattern.title },
-        })
-      );
-    }
-    format = field.format;
+  const field = indexPattern.fields.find((f) => f.name === key);
+  if (!field) {
+    throw new Error(
+      i18n.translate('data.filter.filterBar.fieldNotFound', {
+        defaultMessage: 'Field {key} not found in index pattern {indexPattern}',
+        values: { key, indexPattern: indexPattern.title },
+      })
+    );
   }
-  return format;
+  return indexPattern.getFormatterForField(field);
 }
 
 export function getDisplayValueFromFilter(filter: Filter, indexPatterns: IIndexPattern[]): string {
diff --git a/src/plugins/data/common/field_formats/converters/source.ts b/src/plugins/data/common/field_formats/converters/source.ts
index 9c81bb011e127e..e7dce82c725d2b 100644
--- a/src/plugins/data/common/field_formats/converters/source.ts
+++ b/src/plugins/data/common/field_formats/converters/source.ts
@@ -60,7 +60,7 @@ export class SourceFormat extends FieldFormat {
   textConvert: TextContextTypeConvert = (value) => JSON.stringify(value);
 
   htmlConvert: HtmlContextTypeConvert = (value, options = {}) => {
-    const { field, hit } = options;
+    const { field, hit, indexPattern } = options;
 
     if (!field) {
       const converter = this.getConverterFor('text') as Function;
@@ -69,7 +69,7 @@ export class SourceFormat extends FieldFormat {
     }
 
     const highlights = (hit && hit.highlight) || {};
-    const formatted = field.indexPattern.formatHit(hit);
+    const formatted = indexPattern.formatHit(hit);
     const highlightPairs: any[] = [];
     const sourcePairs: any[] = [];
     const isShortDots = this.getConfig!(UI_SETTINGS.SHORT_DOTS_ENABLE);
diff --git a/src/plugins/data/common/field_formats/field_formats_registry.ts b/src/plugins/data/common/field_formats/field_formats_registry.ts
index 4b46adf399363c..dbc3693c99779a 100644
--- a/src/plugins/data/common/field_formats/field_formats_registry.ts
+++ b/src/plugins/data/common/field_formats/field_formats_registry.ts
@@ -181,11 +181,11 @@ export class FieldFormatsRegistry {
    * @param  {ES_FIELD_TYPES[]} esTypes
    * @return {FieldFormat}
    */
-  getDefaultInstancePlain(
+  getDefaultInstancePlain = (
     fieldType: KBN_FIELD_TYPES,
     esTypes?: ES_FIELD_TYPES[],
     params: Record<string, any> = {}
-  ): FieldFormat {
+  ): FieldFormat => {
     const conf = this.getDefaultConfig(fieldType, esTypes);
     const instanceParams = {
       ...conf.params,
@@ -193,7 +193,7 @@ export class FieldFormatsRegistry {
     };
 
     return this.getInstance(conf.id, instanceParams);
-  }
+  };
   /**
    * Returns a cache key built by the given variables for caching in memoized
    * Where esType contains fieldType, fieldType is returned
diff --git a/src/plugins/data/common/field_formats/types.ts b/src/plugins/data/common/field_formats/types.ts
index daa44b2b0f85be..af956a20c0dc51 100644
--- a/src/plugins/data/common/field_formats/types.ts
+++ b/src/plugins/data/common/field_formats/types.ts
@@ -27,6 +27,7 @@ export type FieldFormatsContentType = 'html' | 'text';
 /** @internal **/
 export interface HtmlContextTypeOptions {
   field?: any;
+  indexPattern?: any;
   hit?: Record<string, any>;
 }
 
diff --git a/src/plugins/data/common/index_patterns/errors.ts b/src/plugins/data/common/index_patterns/errors.ts
new file mode 100644
index 00000000000000..3d92bae1968fb5
--- /dev/null
+++ b/src/plugins/data/common/index_patterns/errors.ts
@@ -0,0 +1,29 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { FieldSpec } from './types';
+
+export class FieldTypeUnknownError extends Error {
+  public readonly fieldSpec: FieldSpec;
+  constructor(message: string, spec: FieldSpec) {
+    super(message);
+    this.name = 'FieldTypeUnknownError';
+    this.fieldSpec = spec;
+  }
+}
diff --git a/src/plugins/data/common/index_patterns/fields/__snapshots__/index_pattern_field.test.ts.snap b/src/plugins/data/common/index_patterns/fields/__snapshots__/index_pattern_field.test.ts.snap
index e61593f6bfb27b..4279dd320ad621 100644
--- a/src/plugins/data/common/index_patterns/fields/__snapshots__/index_pattern_field.test.ts.snap
+++ b/src/plugins/data/common/index_patterns/fields/__snapshots__/index_pattern_field.test.ts.snap
@@ -14,7 +14,7 @@ Object {
   },
   "count": 1,
   "esTypes": Array [
-    "type",
+    "text",
   ],
   "lang": "lang",
   "name": "name",
@@ -30,7 +30,7 @@ Object {
       "path": "path",
     },
   },
-  "type": "type",
+  "type": "string",
 }
 `;
 
@@ -48,7 +48,7 @@ Object {
   },
   "count": 1,
   "esTypes": Array [
-    "type",
+    "text",
   ],
   "format": Object {
     "id": "number",
@@ -70,6 +70,6 @@ Object {
       "path": "path",
     },
   },
-  "type": "type",
+  "type": "string",
 }
 `;
diff --git a/src/plugins/data/common/index_patterns/fields/field_list.ts b/src/plugins/data/common/index_patterns/fields/field_list.ts
index d2489a5d1f7e33..4cf60758698513 100644
--- a/src/plugins/data/common/index_patterns/fields/field_list.ts
+++ b/src/plugins/data/common/index_patterns/fields/field_list.ts
@@ -35,6 +35,7 @@ export interface IIndexPatternFieldList extends Array<IndexPatternField> {
   removeAll(): void;
   replaceAll(specs: FieldSpec[]): void;
   update(field: FieldSpec): void;
+  toSpec(options?: { getFormatterForField?: IndexPattern['getFormatterForField'] }): FieldSpec[];
 }
 
 export type CreateIndexPatternFieldList = (
@@ -44,87 +45,79 @@ export type CreateIndexPatternFieldList = (
   onNotification?: OnNotification
 ) => IIndexPatternFieldList;
 
-export class FieldList extends Array<IndexPatternField> implements IIndexPatternFieldList {
-  private byName: FieldMap = new Map();
-  private groups: Map<IndexPatternField['type'], FieldMap> = new Map();
-  private indexPattern: IndexPattern;
-  private shortDotsEnable: boolean;
-  private onNotification: OnNotification;
-  private setByName = (field: IndexPatternField) => this.byName.set(field.name, field);
-  private setByGroup = (field: IndexPatternField) => {
-    if (typeof this.groups.get(field.type) === 'undefined') {
-      this.groups.set(field.type, new Map());
+// extending the array class and using a constructor doesn't work well
+// when calling filter and similar so wrapping in a callback.
+// to be removed in the future
+export const fieldList = (
+  specs: FieldSpec[] = [],
+  shortDotsEnable = false
+): IIndexPatternFieldList => {
+  class FldList extends Array<IndexPatternField> implements IIndexPatternFieldList {
+    private byName: FieldMap = new Map();
+    private groups: Map<IndexPatternField['type'], FieldMap> = new Map();
+    private setByName = (field: IndexPatternField) => this.byName.set(field.name, field);
+    private setByGroup = (field: IndexPatternField) => {
+      if (typeof this.groups.get(field.type) === 'undefined') {
+        this.groups.set(field.type, new Map());
+      }
+      this.groups.get(field.type)!.set(field.name, field);
+    };
+    private removeByGroup = (field: IFieldType) => this.groups.get(field.type)!.delete(field.name);
+    private calcDisplayName = (name: string) =>
+      shortDotsEnable ? shortenDottedString(name) : name;
+    constructor() {
+      super();
+      specs.map((field) => this.add(field));
     }
-    this.groups.get(field.type)!.set(field.name, field);
-  };
-  private removeByGroup = (field: IFieldType) => this.groups.get(field.type)!.delete(field.name);
-  private calcDisplayName = (name: string) =>
-    this.shortDotsEnable ? shortenDottedString(name) : name;
-  constructor(
-    indexPattern: IndexPattern,
-    specs: FieldSpec[] = [],
-    shortDotsEnable = false,
-    onNotification: OnNotification = () => {}
-  ) {
-    super();
-    this.indexPattern = indexPattern;
-    this.shortDotsEnable = shortDotsEnable;
-    this.onNotification = onNotification;
 
-    specs.map((field) => this.add(field));
-  }
+    public readonly getAll = () => [...this.byName.values()];
+    public readonly getByName = (name: IndexPatternField['name']) => this.byName.get(name);
+    public readonly getByType = (type: IndexPatternField['type']) => [
+      ...(this.groups.get(type) || new Map()).values(),
+    ];
+    public readonly add = (field: FieldSpec) => {
+      const newField = new IndexPatternField(field, this.calcDisplayName(field.name));
+      this.push(newField);
+      this.setByName(newField);
+      this.setByGroup(newField);
+    };
 
-  public readonly getAll = () => [...this.byName.values()];
-  public readonly getByName = (name: IndexPatternField['name']) => this.byName.get(name);
-  public readonly getByType = (type: IndexPatternField['type']) => [
-    ...(this.groups.get(type) || new Map()).values(),
-  ];
-  public readonly add = (field: FieldSpec) => {
-    const newField = new IndexPatternField(
-      this.indexPattern,
-      field,
-      this.calcDisplayName(field.name),
-      this.onNotification
-    );
-    this.push(newField);
-    this.setByName(newField);
-    this.setByGroup(newField);
-  };
+    public readonly remove = (field: IFieldType) => {
+      this.removeByGroup(field);
+      this.byName.delete(field.name);
 
-  public readonly remove = (field: IFieldType) => {
-    this.removeByGroup(field);
-    this.byName.delete(field.name);
+      const fieldIndex = findIndex(this, { name: field.name });
+      this.splice(fieldIndex, 1);
+    };
 
-    const fieldIndex = findIndex(this, { name: field.name });
-    this.splice(fieldIndex, 1);
-  };
+    public readonly update = (field: FieldSpec) => {
+      const newField = new IndexPatternField(field, this.calcDisplayName(field.name));
+      const index = this.findIndex((f) => f.name === newField.name);
+      this.splice(index, 1, newField);
+      this.setByName(newField);
+      this.removeByGroup(newField);
+      this.setByGroup(newField);
+    };
 
-  public readonly update = (field: FieldSpec) => {
-    const newField = new IndexPatternField(
-      this.indexPattern,
-      field,
-      this.calcDisplayName(field.name),
-      this.onNotification
-    );
-    const index = this.findIndex((f) => f.name === newField.name);
-    this.splice(index, 1, newField);
-    this.setByName(newField);
-    this.removeByGroup(newField);
-    this.setByGroup(newField);
-  };
+    public readonly removeAll = () => {
+      this.length = 0;
+      this.byName.clear();
+      this.groups.clear();
+    };
 
-  public readonly removeAll = () => {
-    this.length = 0;
-    this.byName.clear();
-    this.groups.clear();
-  };
+    public readonly replaceAll = (spcs: FieldSpec[]) => {
+      this.removeAll();
+      spcs.forEach(this.add);
+    };
 
-  public readonly replaceAll = (specs: FieldSpec[]) => {
-    this.removeAll();
-    specs.forEach(this.add);
-  };
+    public toSpec({
+      getFormatterForField,
+    }: {
+      getFormatterForField?: IndexPattern['getFormatterForField'];
+    } = {}) {
+      return [...this.map((field) => field.toSpec({ getFormatterForField }))];
+    }
+  }
 
-  public readonly toSpec = () => {
-    return [...this.map((field) => field.toSpec())];
-  };
-}
+  return new FldList();
+};
diff --git a/src/plugins/data/common/index_patterns/fields/index_pattern_field.test.ts b/src/plugins/data/common/index_patterns/fields/index_pattern_field.test.ts
index 0cd0fe8324809c..3c4fac81c2c7ce 100644
--- a/src/plugins/data/common/index_patterns/fields/index_pattern_field.test.ts
+++ b/src/plugins/data/common/index_patterns/fields/index_pattern_field.test.ts
@@ -19,7 +19,7 @@
 
 import { IndexPatternField } from './index_pattern_field';
 import { IndexPattern } from '../index_patterns';
-import { KBN_FIELD_TYPES } from '../../../common';
+import { KBN_FIELD_TYPES, FieldFormat } from '../../../common';
 import { FieldSpec } from '../types';
 
 describe('Field', function () {
@@ -28,21 +28,16 @@ describe('Field', function () {
   }
 
   function getField(values = {}) {
-    return new IndexPatternField(
-      fieldValues.indexPattern as IndexPattern,
-      { ...fieldValues, ...values },
-      'displayName',
-      () => {}
-    );
+    return new IndexPatternField({ ...fieldValues, ...values }, 'displayName');
   }
 
   const fieldValues = {
     name: 'name',
-    type: 'type',
+    type: 'string',
     script: 'script',
     lang: 'lang',
     count: 1,
-    esTypes: ['type'],
+    esTypes: ['text'],
     aggregatable: true,
     filterable: true,
     searchable: true,
@@ -125,7 +120,7 @@ describe('Field', function () {
     const fieldB = getField({ indexed: true, type: KBN_FIELD_TYPES.STRING });
     expect(fieldB.sortable).toEqual(true);
 
-    const fieldC = getField({ indexed: false });
+    const fieldC = getField({ indexed: false, aggregatable: false, scripted: false });
     expect(fieldC.sortable).toEqual(false);
   });
 
@@ -139,31 +134,26 @@ describe('Field', function () {
     const fieldC = getField({ indexed: true, type: KBN_FIELD_TYPES.STRING });
     expect(fieldC.filterable).toEqual(true);
 
-    const fieldD = getField({ scripted: false, indexed: false });
+    const fieldD = getField({ scripted: false, indexed: false, searchable: false });
     expect(fieldD.filterable).toEqual(false);
   });
 
   it('exports the property to JSON', () => {
-    const field = new IndexPatternField(
-      { fieldFormatMap: { name: {} } } as IndexPattern,
-      fieldValues,
-      'displayName',
-      () => {}
-    );
+    const field = new IndexPatternField(fieldValues, 'displayName');
     expect(flatten(field)).toMatchSnapshot();
   });
 
   it('spec snapshot', () => {
-    const field = new IndexPatternField(
-      {
-        fieldFormatMap: {
-          name: { toJSON: () => ({ id: 'number', params: { pattern: '$0,0.[00]' } }) },
-        },
-      } as IndexPattern,
-      fieldValues,
-      'displayName',
-      () => {}
-    );
-    expect(field.toSpec()).toMatchSnapshot();
+    const field = new IndexPatternField(fieldValues, 'displayName');
+    const getFormatterForField = () =>
+      ({
+        toJSON: () => ({
+          id: 'number',
+          params: {
+            pattern: '$0,0.[00]',
+          },
+        }),
+      } as FieldFormat);
+    expect(field.toSpec({ getFormatterForField })).toMatchSnapshot();
   });
 });
diff --git a/src/plugins/data/common/index_patterns/fields/index_pattern_field.ts b/src/plugins/data/common/index_patterns/fields/index_pattern_field.ts
index 965f1a7f630651..7f72bfe55c7cd5 100644
--- a/src/plugins/data/common/index_patterns/fields/index_pattern_field.ts
+++ b/src/plugins/data/common/index_patterns/fields/index_pattern_field.ts
@@ -20,40 +20,27 @@
 import { i18n } from '@kbn/i18n';
 import { KbnFieldType, getKbnFieldType } from '../../kbn_field_types';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
-import { FieldFormat } from '../../field_formats';
 import { IFieldType } from './types';
-import { OnNotification, FieldSpec } from '../types';
-
-import { IndexPattern } from '../index_patterns';
+import { FieldSpec, IndexPattern } from '../..';
+import { FieldTypeUnknownError } from '../errors';
 
 export class IndexPatternField implements IFieldType {
   readonly spec: FieldSpec;
   // not writable or serialized
-  readonly indexPattern: IndexPattern;
   readonly displayName: string;
   private readonly kbnFieldType: KbnFieldType;
 
-  constructor(
-    indexPattern: IndexPattern,
-    spec: FieldSpec,
-    displayName: string,
-    onNotification: OnNotification
-  ) {
-    this.indexPattern = indexPattern;
+  constructor(spec: FieldSpec, displayName: string) {
     this.spec = { ...spec, type: spec.name === '_source' ? '_source' : spec.type };
     this.displayName = displayName;
 
     this.kbnFieldType = getKbnFieldType(spec.type);
     if (spec.type && this.kbnFieldType?.name === KBN_FIELD_TYPES.UNKNOWN) {
-      const title = i18n.translate('data.indexPatterns.unknownFieldHeader', {
-        values: { type: spec.type },
-        defaultMessage: 'Unknown field type {type}',
-      });
-      const text = i18n.translate('data.indexPatterns.unknownFieldErrorMessage', {
-        values: { name: spec.name, title: indexPattern.title },
-        defaultMessage: 'Field {name} in indexPattern {title} is using an unknown field type.',
+      const msg = i18n.translate('data.indexPatterns.unknownFieldTypeErrorMsg', {
+        values: { type: spec.type, name: spec.name },
+        defaultMessage: `Field '{name}' Unknown field type '{type}'`,
       });
-      onNotification({ title, text, color: 'danger', iconType: 'alert' });
+      throw new FieldTypeUnknownError(msg, spec);
     }
   }
 
@@ -143,10 +130,6 @@ export class IndexPatternField implements IFieldType {
     return this.aggregatable;
   }
 
-  public get format(): FieldFormat {
-    return this.indexPattern.getFormatterForField(this);
-  }
-
   public toJSON() {
     return {
       count: this.count,
@@ -165,7 +148,11 @@ export class IndexPatternField implements IFieldType {
     };
   }
 
-  public toSpec() {
+  public toSpec({
+    getFormatterForField,
+  }: {
+    getFormatterForField?: IndexPattern['getFormatterForField'];
+  } = {}) {
     return {
       count: this.count,
       script: this.script,
@@ -179,7 +166,7 @@ export class IndexPatternField implements IFieldType {
       aggregatable: this.aggregatable,
       readFromDocValues: this.readFromDocValues,
       subType: this.subType,
-      format: this.indexPattern?.fieldFormatMap[this.name]?.toJSON() || undefined,
+      format: getFormatterForField ? getFormatterForField(this).toJSON() : undefined,
     };
   }
 }
diff --git a/src/plugins/data/common/index_patterns/fields/types.ts b/src/plugins/data/common/index_patterns/fields/types.ts
index 558b5b57dce40a..5814760601a675 100644
--- a/src/plugins/data/common/index_patterns/fields/types.ts
+++ b/src/plugins/data/common/index_patterns/fields/types.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { FieldSpec, IFieldSubType } from '../types';
+import { FieldSpec, IFieldSubType, IndexPattern } from '../..';
 
 export interface IFieldType {
   name: string;
@@ -38,5 +38,5 @@ export interface IFieldType {
   subType?: IFieldSubType;
   displayName?: string;
   format?: any;
-  toSpec?: () => FieldSpec;
+  toSpec?: (options?: { getFormatterForField?: IndexPattern['getFormatterForField'] }) => FieldSpec;
 }
diff --git a/src/plugins/data/common/index_patterns/index.ts b/src/plugins/data/common/index_patterns/index.ts
index 51a642b775c29c..08f478404be2cf 100644
--- a/src/plugins/data/common/index_patterns/index.ts
+++ b/src/plugins/data/common/index_patterns/index.ts
@@ -20,3 +20,5 @@
 export * from './fields';
 export * from './types';
 export { IndexPatternsService } from './index_patterns';
+export type { IndexPattern } from './index_patterns';
+export * from './errors';
diff --git a/src/plugins/data/common/index_patterns/index_patterns/__snapshots__/index_pattern.test.ts.snap b/src/plugins/data/common/index_patterns/index_patterns/__snapshots__/index_pattern.test.ts.snap
index 047ac836a87d1f..a0c380ec55bf67 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/__snapshots__/index_pattern.test.ts.snap
+++ b/src/plugins/data/common/index_patterns/index_patterns/__snapshots__/index_pattern.test.ts.snap
@@ -32,7 +32,12 @@ Object {
       "esTypes": Array [
         "boolean",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "ssl",
       "readFromDocValues": true,
@@ -49,7 +54,12 @@ Object {
       "esTypes": Array [
         "date",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "@timestamp",
       "readFromDocValues": true,
@@ -66,7 +76,12 @@ Object {
       "esTypes": Array [
         "date",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "time",
       "readFromDocValues": true,
@@ -83,7 +98,12 @@ Object {
       "esTypes": Array [
         "keyword",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "@tags",
       "readFromDocValues": true,
@@ -100,7 +120,12 @@ Object {
       "esTypes": Array [
         "date",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "utc_time",
       "readFromDocValues": true,
@@ -117,7 +142,12 @@ Object {
       "esTypes": Array [
         "integer",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "phpmemory",
       "readFromDocValues": true,
@@ -134,7 +164,12 @@ Object {
       "esTypes": Array [
         "ip",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "ip",
       "readFromDocValues": true,
@@ -151,7 +186,12 @@ Object {
       "esTypes": Array [
         "attachment",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "request_body",
       "readFromDocValues": true,
@@ -168,7 +208,12 @@ Object {
       "esTypes": Array [
         "geo_point",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "point",
       "readFromDocValues": true,
@@ -185,7 +230,12 @@ Object {
       "esTypes": Array [
         "geo_shape",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "area",
       "readFromDocValues": false,
@@ -202,7 +252,12 @@ Object {
       "esTypes": Array [
         "murmur3",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "hashed",
       "readFromDocValues": false,
@@ -219,7 +274,12 @@ Object {
       "esTypes": Array [
         "geo_point",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "geo.coordinates",
       "readFromDocValues": true,
@@ -236,7 +296,12 @@ Object {
       "esTypes": Array [
         "text",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "extension",
       "readFromDocValues": false,
@@ -253,7 +318,12 @@ Object {
       "esTypes": Array [
         "keyword",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "extension.keyword",
       "readFromDocValues": true,
@@ -274,7 +344,12 @@ Object {
       "esTypes": Array [
         "text",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "machine.os",
       "readFromDocValues": false,
@@ -291,7 +366,12 @@ Object {
       "esTypes": Array [
         "keyword",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "machine.os.raw",
       "readFromDocValues": true,
@@ -312,7 +392,12 @@ Object {
       "esTypes": Array [
         "keyword",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "geo.src",
       "readFromDocValues": true,
@@ -329,7 +414,12 @@ Object {
       "esTypes": Array [
         "_id",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "_id",
       "readFromDocValues": false,
@@ -346,7 +436,12 @@ Object {
       "esTypes": Array [
         "_type",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "_type",
       "readFromDocValues": false,
@@ -363,7 +458,12 @@ Object {
       "esTypes": Array [
         "_source",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "_source",
       "readFromDocValues": false,
@@ -380,7 +480,12 @@ Object {
       "esTypes": Array [
         "text",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "non-filterable",
       "readFromDocValues": false,
@@ -397,7 +502,12 @@ Object {
       "esTypes": Array [
         "text",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "non-sortable",
       "readFromDocValues": false,
@@ -414,7 +524,12 @@ Object {
       "esTypes": Array [
         "conflict",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": undefined,
       "name": "custom_user_field",
       "readFromDocValues": true,
@@ -431,7 +546,12 @@ Object {
       "esTypes": Array [
         "text",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": "expression",
       "name": "script string",
       "readFromDocValues": false,
@@ -448,7 +568,12 @@ Object {
       "esTypes": Array [
         "long",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": "expression",
       "name": "script number",
       "readFromDocValues": false,
@@ -465,7 +590,12 @@ Object {
       "esTypes": Array [
         "date",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": "painless",
       "name": "script date",
       "readFromDocValues": false,
@@ -482,7 +612,12 @@ Object {
       "esTypes": Array [
         "murmur3",
       ],
-      "format": undefined,
+      "format": Object {
+        "id": "number",
+        "params": Object {
+          "pattern": "$0,0.[00]",
+        },
+      },
       "lang": "expression",
       "name": "script murmur3",
       "readFromDocValues": false,
diff --git a/src/plugins/data/common/index_patterns/index_patterns/format_hit.ts b/src/plugins/data/common/index_patterns/index_patterns/format_hit.ts
index a0597ed4b90269..b47fef107258ac 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/format_hit.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/format_hit.ts
@@ -34,9 +34,9 @@ export function formatHitProvider(indexPattern: IndexPattern, defaultFormat: any
     type: FieldFormatsContentType = 'html'
   ) {
     const field = indexPattern.fields.getByName(fieldName);
-    const format = field ? field.format : defaultFormat;
+    const format = field ? indexPattern.getFormatterForField(field) : defaultFormat;
 
-    return format.convert(val, type, { field, hit });
+    return format.convert(val, type, { field, hit, indexPattern });
   }
 
   function formatHit(hit: Record<string, any>, type: string = 'html') {
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts
index f7e1156170f032..f037a71b508a27 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts
@@ -29,6 +29,7 @@ import { stubbedSavedObjectIndexPattern } from '../../../../../fixtures/stubbed_
 import { IndexPatternField } from '../fields';
 
 import { fieldFormatsMock } from '../../field_formats/mocks';
+import { FieldFormat } from '../..';
 
 class MockFieldFormatter {}
 
@@ -150,8 +151,6 @@ describe('IndexPattern', () => {
       expect(indexPattern).toHaveProperty('getNonScriptedFields');
       expect(indexPattern).toHaveProperty('addScriptedField');
       expect(indexPattern).toHaveProperty('removeScriptedField');
-      expect(indexPattern).toHaveProperty('toString');
-      expect(indexPattern).toHaveProperty('toJSON');
       expect(indexPattern).toHaveProperty('save');
 
       // properties
@@ -170,7 +169,6 @@ describe('IndexPattern', () => {
     test('should have expected properties on fields', function () {
       expect(indexPattern.fields[0]).toHaveProperty('displayName');
       expect(indexPattern.fields[0]).toHaveProperty('filterable');
-      expect(indexPattern.fields[0]).toHaveProperty('format');
       expect(indexPattern.fields[0]).toHaveProperty('sortable');
       expect(indexPattern.fields[0]).toHaveProperty('scripted');
     });
@@ -319,16 +317,18 @@ describe('IndexPattern', () => {
 
   describe('toSpec', () => {
     test('should match snapshot', () => {
-      indexPattern.fieldFormatMap.bytes = {
+      const formatter = {
         toJSON: () => ({ id: 'number', params: { pattern: '$0,0.[00]' } }),
-      };
+      } as FieldFormat;
+      indexPattern.getFormatterForField = () => formatter;
       expect(indexPattern.toSpec()).toMatchSnapshot();
     });
 
     test('can restore from spec', async () => {
-      indexPattern.fieldFormatMap.bytes = {
+      const formatter = {
         toJSON: () => ({ id: 'number', params: { pattern: '$0,0.[00]' } }),
-      };
+      } as FieldFormat;
+      indexPattern.getFormatterForField = () => formatter;
       const spec = indexPattern.toSpec();
       const restoredPattern = await create(spec.id as string);
       restoredPattern.initFromSpec(spec);
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts
index ea91a9bb14e1f5..05588085735808 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts
@@ -26,11 +26,12 @@ import {
   ES_FIELD_TYPES,
   KBN_FIELD_TYPES,
   IIndexPattern,
+  FieldTypeUnknownError,
   FieldFormatNotFoundError,
 } from '../../../common';
 import { findByTitle } from '../utils';
 import { IndexPatternMissingIndices } from '../lib';
-import { IndexPatternField, IIndexPatternFieldList, FieldList } from '../fields';
+import { IndexPatternField, IIndexPatternFieldList, fieldList } from '../fields';
 import { createFieldsFetcher } from './_fields_fetcher';
 import { formatHitProvider } from './format_hit';
 import { flattenHitWrapper } from './flatten_hit';
@@ -125,8 +126,7 @@ export class IndexPattern implements IIndexPattern {
 
     this.shortDotsEnable = shortDotsEnable;
     this.metaFields = metaFields;
-
-    this.fields = new FieldList(this, [], this.shortDotsEnable, this.onNotification);
+    this.fields = fieldList([], this.shortDotsEnable);
 
     this.apiClient = apiClient;
     this.fieldsFetcher = createFieldsFetcher(this, apiClient, metaFields);
@@ -138,6 +138,22 @@ export class IndexPattern implements IIndexPattern {
     this.formatField = this.formatHit.formatField;
   }
 
+  private unknownFieldErrorNotification(
+    fieldType: string,
+    fieldName: string,
+    indexPatternTitle: string
+  ) {
+    const title = i18n.translate('data.indexPatterns.unknownFieldHeader', {
+      values: { type: fieldType },
+      defaultMessage: 'Unknown field type {type}',
+    });
+    const text = i18n.translate('data.indexPatterns.unknownFieldErrorMessage', {
+      values: { name: fieldName, title: indexPatternTitle },
+      defaultMessage: 'Field {name} in indexPattern {title} is using an unknown field type.',
+    });
+    this.onNotification({ title, text, color: 'danger', iconType: 'alert' });
+  }
+
   private serializeFieldFormatMap(flat: any, format: string, field: string | undefined) {
     if (format && field) {
       flat[field] = format;
@@ -181,7 +197,15 @@ export class IndexPattern implements IIndexPattern {
       await this.refreshFields();
     } else {
       if (specs) {
-        this.fields.replaceAll(specs);
+        try {
+          this.fields.replaceAll(specs);
+        } catch (err) {
+          if (err instanceof FieldTypeUnknownError) {
+            this.unknownFieldErrorNotification(err.fieldSpec.name, err.fieldSpec.type, this.title);
+          } else {
+            throw err;
+          }
+        }
       }
     }
   }
@@ -203,7 +227,15 @@ export class IndexPattern implements IIndexPattern {
     this.timeFieldName = spec.timeFieldName;
     this.sourceFilters = spec.sourceFilters;
 
-    this.fields.replaceAll(spec.fields || []);
+    try {
+      this.fields.replaceAll(spec.fields || []);
+    } catch (err) {
+      if (err instanceof FieldTypeUnknownError) {
+        this.unknownFieldErrorNotification(err.fieldSpec.name, err.fieldSpec.type, this.title);
+      } else {
+        throw err;
+      }
+    }
     this.typeMeta = spec.typeMeta;
 
     this.fieldFormatMap = _.mapValues(fieldFormatMap, (mapping) => {
@@ -322,7 +354,7 @@ export class IndexPattern implements IIndexPattern {
       title: this.title,
       timeFieldName: this.timeFieldName,
       sourceFilters: this.sourceFilters,
-      fields: this.fields.toSpec(),
+      fields: this.fields.toSpec({ getFormatterForField: this.getFormatterForField.bind(this) }),
       typeMeta: this.typeMeta,
     };
   }
@@ -342,19 +374,27 @@ export class IndexPattern implements IIndexPattern {
       throw new DuplicateField(name);
     }
 
-    this.fields.add({
-      name,
-      script,
-      type: fieldType,
-      scripted: true,
-      lang,
-      aggregatable: true,
-      searchable: true,
-      count: 0,
-      readFromDocValues: false,
-    });
+    try {
+      this.fields.add({
+        name,
+        script,
+        type: fieldType,
+        scripted: true,
+        lang,
+        aggregatable: true,
+        searchable: true,
+        count: 0,
+        readFromDocValues: false,
+      });
+    } catch (err) {
+      if (err instanceof FieldTypeUnknownError) {
+        this.unknownFieldErrorNotification(err.fieldSpec.name, err.fieldSpec.type, this.title);
+      } else {
+        throw err;
+      }
 
-    await this.save();
+      await this.save();
+    }
   }
 
   removeScriptedField(fieldName: string) {
@@ -441,7 +481,7 @@ export class IndexPattern implements IIndexPattern {
       fields: this.mapping.fields._serialize!(this.fields),
       fieldFormatMap: this.mapping.fieldFormatMap._serialize!(this.fieldFormatMap),
       type: this.type,
-      typeMeta: this.mapping.typeMeta._serialize!(this.mapping),
+      typeMeta: this.mapping.typeMeta._serialize!(this.typeMeta),
     };
   }
 
@@ -572,7 +612,15 @@ export class IndexPattern implements IIndexPattern {
   async _fetchFields() {
     const fields = await this.fieldsFetcher.fetch(this);
     const scripted = this.getScriptedFields().map((field) => field.spec);
-    this.fields.replaceAll([...fields, ...scripted]);
+    try {
+      this.fields.replaceAll([...fields, ...scripted]);
+    } catch (err) {
+      if (err instanceof FieldTypeUnknownError) {
+        this.unknownFieldErrorNotification(err.fieldSpec.name, err.fieldSpec.type, this.title);
+      } else {
+        throw err;
+      }
+    }
   }
 
   refreshFields() {
@@ -602,12 +650,4 @@ export class IndexPattern implements IIndexPattern {
         });
       });
   }
-
-  toJSON() {
-    return this.id;
-  }
-
-  toString() {
-    return '' + this.toJSON();
-  }
 }
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
index 0ad9ae8f2014f8..fe0d14b2d9c19a 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
@@ -25,7 +25,6 @@ import {
   createEnsureDefaultIndexPattern,
   EnsureDefaultIndexPattern,
 } from './ensure_default_index_pattern';
-import { IndexPatternField } from '../fields';
 import {
   OnNotification,
   OnError,
@@ -86,15 +85,6 @@ export class IndexPatternsService {
     );
   }
 
-  public createField(
-    indexPattern: IndexPattern,
-    spec: IndexPatternField['spec'],
-    displayName: string,
-    onNotification: OnNotification
-  ) {
-    return new IndexPatternField(indexPattern, spec, displayName, onNotification);
-  }
-
   private async refreshSavedObjectsCache() {
     this.savedObjectsCache = await this.savedObjectsClient.find<IndexPatternSavedObjectAttrs>({
       type: 'index-pattern',
diff --git a/src/plugins/data/common/search/aggs/agg_config.test.ts b/src/plugins/data/common/search/aggs/agg_config.test.ts
index a443eacee731c4..f6fcc29805dc45 100644
--- a/src/plugins/data/common/search/aggs/agg_config.test.ts
+++ b/src/plugins/data/common/search/aggs/agg_config.test.ts
@@ -25,8 +25,7 @@ import { AggType } from './agg_type';
 import { AggTypesRegistryStart } from './agg_types_registry';
 import { mockAggTypesRegistry } from './test_helpers';
 import { MetricAggType } from './metrics/metric_agg_type';
-import { IndexPattern } from '../../index_patterns/index_patterns/index_pattern';
-import { IIndexPatternFieldList } from '../../index_patterns/fields';
+import { IndexPattern, IndexPatternField, IIndexPatternFieldList } from '../../index_patterns';
 
 describe('AggConfig', () => {
   let indexPattern: IndexPattern;
@@ -67,6 +66,9 @@ describe('AggConfig', () => {
         getByName: (name: string) => fields.find((f) => f.name === name),
         filter: () => fields,
       } as unknown) as IndexPattern['fields'],
+      getFormatterForField: (field: IndexPatternField) => ({
+        toJSON: () => ({}),
+      }),
     } as IndexPattern;
     typesRegistry = mockAggTypesRegistry();
   });
diff --git a/src/plugins/data/common/search/aggs/agg_config.ts b/src/plugins/data/common/search/aggs/agg_config.ts
index b5747ce7bb9bdf..201e9f1ec402cd 100644
--- a/src/plugins/data/common/search/aggs/agg_config.ts
+++ b/src/plugins/data/common/search/aggs/agg_config.ts
@@ -21,12 +21,13 @@ import _ from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { Assign, Ensure } from '@kbn/utility-types';
 
-import { FetchOptions, ISearchSource } from 'src/plugins/data/public';
+import { ISearchSource } from 'src/plugins/data/public';
 import {
   ExpressionAstFunction,
   ExpressionAstArgument,
   SerializedFieldFormat,
 } from 'src/plugins/expressions/common';
+import { ISearchOptions } from '../es_search';
 
 import { IAggType } from './agg_type';
 import { writeParams } from './agg_params';
@@ -213,11 +214,11 @@ export class AggConfig {
 
   /**
    *  Hook for pre-flight logic, see AggType#onSearchRequestStart
-   *  @param {Courier.SearchSource} searchSource
-   *  @param {Courier.FetchOptions} options
+   *  @param {SearchSource} searchSource
+   *  @param {ISearchOptions} options
    *  @return {Promise<undefined>}
    */
-  onSearchRequestStart(searchSource: ISearchSource, options?: FetchOptions) {
+  onSearchRequestStart(searchSource: ISearchSource, options?: ISearchOptions) {
     if (!this.type) {
       return Promise.resolve();
     }
diff --git a/src/plugins/data/common/search/aggs/agg_configs.ts b/src/plugins/data/common/search/aggs/agg_configs.ts
index 203eda3a907eeb..282e6f3b538a49 100644
--- a/src/plugins/data/common/search/aggs/agg_configs.ts
+++ b/src/plugins/data/common/search/aggs/agg_configs.ts
@@ -20,7 +20,7 @@
 import _ from 'lodash';
 import { Assign } from '@kbn/utility-types';
 
-import { FetchOptions, ISearchSource } from 'src/plugins/data/public';
+import { ISearchOptions, ISearchSource } from 'src/plugins/data/public';
 import { AggConfig, AggConfigSerialized, IAggConfig } from './agg_config';
 import { IAggType } from './agg_type';
 import { AggTypesRegistryStart } from './agg_types_registry';
@@ -300,7 +300,7 @@ export class AggConfigs {
     return _.find(reqAgg.getResponseAggs(), { id });
   }
 
-  onSearchRequestStart(searchSource: ISearchSource, options?: FetchOptions) {
+  onSearchRequestStart(searchSource: ISearchSource, options?: ISearchOptions) {
     return Promise.all(
       // @ts-ignore
       this.getRequestAggs().map((agg: AggConfig) => agg.onSearchRequestStart(searchSource, options))
diff --git a/src/plugins/data/common/search/aggs/agg_type.test.ts b/src/plugins/data/common/search/aggs/agg_type.test.ts
index bf1136159dfe86..16a5586858ab9f 100644
--- a/src/plugins/data/common/search/aggs/agg_type.test.ts
+++ b/src/plugins/data/common/search/aggs/agg_type.test.ts
@@ -147,6 +147,9 @@ describe('AggType Class', () => {
               },
             },
           },
+          aggConfigs: {
+            indexPattern: { getFormatterForField: () => ({ toJSON: () => ({ id: 'format' }) }) },
+          },
         } as unknown) as IAggConfig;
         const aggType = new AggType({
           name: 'name',
diff --git a/src/plugins/data/common/search/aggs/agg_type.ts b/src/plugins/data/common/search/aggs/agg_type.ts
index 2ee604c1bf25da..1e3839038b0f71 100644
--- a/src/plugins/data/common/search/aggs/agg_type.ts
+++ b/src/plugins/data/common/search/aggs/agg_type.ts
@@ -271,7 +271,9 @@ export class AggType<
     this.getSerializedFormat =
       config.getSerializedFormat ||
       ((agg: TAggConfig) => {
-        return agg.params.field ? agg.params.field.format.toJSON() : {};
+        return agg.params.field
+          ? agg.aggConfigs.indexPattern.getFormatterForField(agg.params.field).toJSON()
+          : {};
       });
 
     this.getValue = config.getValue || ((agg: TAggConfig, bucket: any) => {});
diff --git a/src/plugins/data/common/search/aggs/buckets/_interval_options.ts b/src/plugins/data/common/search/aggs/buckets/_interval_options.ts
index 00cf50c272fa04..f94484a6edc2e4 100644
--- a/src/plugins/data/common/search/aggs/buckets/_interval_options.ts
+++ b/src/plugins/data/common/search/aggs/buckets/_interval_options.ts
@@ -20,12 +20,15 @@
 import { i18n } from '@kbn/i18n';
 import { IBucketAggConfig } from './bucket_agg_type';
 
+export const autoInterval = 'auto';
+export const isAutoInterval = (value: unknown) => value === autoInterval;
+
 export const intervalOptions = [
   {
     display: i18n.translate('data.search.aggs.buckets.intervalOptions.autoDisplayName', {
       defaultMessage: 'Auto',
     }),
-    val: 'auto',
+    val: autoInterval,
     enabled(agg: IBucketAggConfig) {
       // not only do we need a time field, but the selected field needs
       // to be the time field. (see #3028)
diff --git a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
index 1a7deafb548aed..7c09d2e64e8b73 100644
--- a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
+++ b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
@@ -140,7 +140,7 @@ export const buildOtherBucketAgg = (
   const bucketAggs = aggConfigs.aggs.filter((agg) => agg.type.type === AggGroupNames.Buckets);
   const index = bucketAggs.findIndex((agg) => agg.id === aggWithOtherBucket.id);
   const aggs = aggConfigs.toDsl();
-  const indexPattern = aggWithOtherBucket.params.field.indexPattern;
+  const indexPattern = aggWithOtherBucket.aggConfigs.indexPattern;
 
   // create filters aggregation
   const filterAgg = aggConfigs.createAggConfig(
@@ -211,7 +211,7 @@ export const buildOtherBucketAgg = (
       filters.push(
         buildExistsFilter(
           aggWithOtherBucket.params.field,
-          aggWithOtherBucket.params.field.indexPattern
+          aggWithOtherBucket.aggConfigs.indexPattern
         )
       );
     }
@@ -264,7 +264,7 @@ export const mergeOtherBucketAggResponse = (
     const phraseFilter = buildPhrasesFilter(
       otherAgg.params.field,
       requestFilterTerms,
-      otherAgg.params.field.indexPattern
+      otherAgg.aggConfigs.indexPattern
     );
     phraseFilter.meta.negate = true;
     bucket.filters = [phraseFilter];
@@ -276,7 +276,7 @@ export const mergeOtherBucketAggResponse = (
       )
     ) {
       bucket.filters.push(
-        buildExistsFilter(otherAgg.params.field, otherAgg.params.field.indexPattern)
+        buildExistsFilter(otherAgg.params.field, otherAgg.aggConfigs.indexPattern)
       );
     }
     aggResultBuckets.push(bucket);
diff --git a/src/plugins/data/common/search/aggs/buckets/create_filter/date_histogram.test.ts b/src/plugins/data/common/search/aggs/buckets/create_filter/date_histogram.test.ts
index 143d5498369003..3d0224b213e8d8 100644
--- a/src/plugins/data/common/search/aggs/buckets/create_filter/date_histogram.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/create_filter/date_histogram.test.ts
@@ -19,7 +19,7 @@
 
 import moment from 'moment';
 import { createFilterDateHistogram } from './date_histogram';
-import { intervalOptions } from '../_interval_options';
+import { intervalOptions, autoInterval } from '../_interval_options';
 import { AggConfigs } from '../../agg_configs';
 import { mockAggTypesRegistry } from '../../test_helpers';
 import { IBucketDateHistogramAggConfig } from '../date_histogram';
@@ -33,7 +33,10 @@ describe('AggConfig Filters', () => {
     let bucketStart: any;
     let field: any;
 
-    const init = (interval: string = 'auto', duration: any = moment.duration(15, 'minutes')) => {
+    const init = (
+      interval: string = autoInterval,
+      duration: any = moment.duration(15, 'minutes')
+    ) => {
       field = {
         name: 'date',
       };
diff --git a/src/plugins/data/common/search/aggs/buckets/create_filter/histogram.test.ts b/src/plugins/data/common/search/aggs/buckets/create_filter/histogram.test.ts
index b57d530ef40e8d..dc1d0ec0a152f6 100644
--- a/src/plugins/data/common/search/aggs/buckets/create_filter/histogram.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/create_filter/histogram.test.ts
@@ -40,6 +40,7 @@ describe('AggConfig Filters', () => {
           getByName: () => field,
           filter: () => [field],
         },
+        getFormatterForField: () => new BytesFormat({}, getConfig),
       } as any;
 
       return new AggConfigs(
diff --git a/src/plugins/data/common/search/aggs/buckets/create_filter/range.test.ts b/src/plugins/data/common/search/aggs/buckets/create_filter/range.test.ts
index 30af970f55aa9a..b53ae44c05075c 100644
--- a/src/plugins/data/common/search/aggs/buckets/create_filter/range.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/create_filter/range.test.ts
@@ -30,7 +30,6 @@ describe('AggConfig Filters', () => {
     const getAggConfigs = () => {
       const field = {
         name: 'bytes',
-        format: new BytesFormat({}, getConfig),
       };
 
       const indexPattern = {
@@ -40,6 +39,7 @@ describe('AggConfig Filters', () => {
           getByName: () => field,
           filter: () => [field],
         },
+        getFormatterForField: () => new BytesFormat({}, getConfig),
       } as any;
 
       return new AggConfigs(
diff --git a/src/plugins/data/common/search/aggs/buckets/create_filter/terms.ts b/src/plugins/data/common/search/aggs/buckets/create_filter/terms.ts
index 95de19b96abd4f..ccd1cf6e358b4e 100644
--- a/src/plugins/data/common/search/aggs/buckets/create_filter/terms.ts
+++ b/src/plugins/data/common/search/aggs/buckets/create_filter/terms.ts
@@ -27,7 +27,7 @@ import {
 
 export const createFilterTerms = (aggConfig: IBucketAggConfig, key: string, params: any) => {
   const field = aggConfig.params.field;
-  const indexPattern = field.indexPattern;
+  const indexPattern = aggConfig.aggConfigs.indexPattern;
 
   if (key === '__other__') {
     const terms = params.terms;
diff --git a/src/plugins/data/common/search/aggs/buckets/date_histogram.ts b/src/plugins/data/common/search/aggs/buckets/date_histogram.ts
index fdf9c456b38760..c273ca53a5fed4 100644
--- a/src/plugins/data/common/search/aggs/buckets/date_histogram.ts
+++ b/src/plugins/data/common/search/aggs/buckets/date_histogram.ts
@@ -23,7 +23,7 @@ import { i18n } from '@kbn/i18n';
 
 import { KBN_FIELD_TYPES, TimeRange, TimeRangeBounds, UI_SETTINGS } from '../../../../common';
 
-import { intervalOptions } from './_interval_options';
+import { intervalOptions, autoInterval, isAutoInterval } from './_interval_options';
 import { createFilterDateHistogram } from './create_filter/date_histogram';
 import { BucketAggType, IBucketAggConfig } from './bucket_agg_type';
 import { BUCKET_TYPES } from './bucket_agg_types';
@@ -44,7 +44,7 @@ const updateTimeBuckets = (
   customBuckets?: IBucketDateHistogramAggConfig['buckets']
 ) => {
   const bounds =
-    agg.params.timeRange && (agg.fieldIsTimeField() || agg.params.interval === 'auto')
+    agg.params.timeRange && (agg.fieldIsTimeField() || isAutoInterval(agg.params.interval))
       ? calculateBounds(agg.params.timeRange)
       : undefined;
   const buckets = customBuckets || agg.buckets;
@@ -149,7 +149,7 @@ export const getDateHistogramBucketAgg = ({
           return agg.getIndexPattern().timeFieldName;
         },
         onChange(agg: IBucketDateHistogramAggConfig) {
-          if (get(agg, 'params.interval') === 'auto' && !agg.fieldIsTimeField()) {
+          if (isAutoInterval(get(agg, 'params.interval')) && !agg.fieldIsTimeField()) {
             delete agg.params.interval;
           }
         },
@@ -187,7 +187,7 @@ export const getDateHistogramBucketAgg = ({
           }
           return state;
         },
-        default: 'auto',
+        default: autoInterval,
         options: intervalOptions,
         write(agg, output, aggs) {
           updateTimeBuckets(agg, calculateBounds);
diff --git a/src/plugins/data/common/search/aggs/buckets/date_range.ts b/src/plugins/data/common/search/aggs/buckets/date_range.ts
index eda35a77afa5ff..f9a3acb990fbf8 100644
--- a/src/plugins/data/common/search/aggs/buckets/date_range.ts
+++ b/src/plugins/data/common/search/aggs/buckets/date_range.ts
@@ -58,7 +58,9 @@ export const getDateRangeBucketAgg = ({
     getSerializedFormat(agg) {
       return {
         id: 'date_range',
-        params: agg.params.field ? agg.params.field.format.toJSON() : {},
+        params: agg.params.field
+          ? agg.aggConfigs.indexPattern.getFormatterForField(agg.params.field).toJSON()
+          : {},
       };
     },
     makeLabel(aggConfig) {
diff --git a/src/plugins/data/common/search/aggs/buckets/histogram.test.ts b/src/plugins/data/common/search/aggs/buckets/histogram.test.ts
index 3727747984d3e1..a8ac72c174c726 100644
--- a/src/plugins/data/common/search/aggs/buckets/histogram.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/histogram.test.ts
@@ -103,7 +103,28 @@ describe('Histogram Agg', () => {
       });
     });
 
+    describe('maxBars', () => {
+      test('should not be written to the DSL', () => {
+        const aggConfigs = getAggConfigs({
+          maxBars: 50,
+          field: {
+            name: 'field',
+          },
+        });
+        const { [BUCKET_TYPES.HISTOGRAM]: params } = aggConfigs.aggs[0].toDsl();
+
+        expect(params).not.toHaveProperty('maxBars');
+      });
+    });
+
     describe('interval', () => {
+      test('accepts "auto" value', () => {
+        const params = getParams({
+          interval: 'auto',
+        });
+
+        expect(params).toHaveProperty('interval', 1);
+      });
       test('accepts a whole number', () => {
         const params = getParams({
           interval: 100,
diff --git a/src/plugins/data/common/search/aggs/buckets/histogram.ts b/src/plugins/data/common/search/aggs/buckets/histogram.ts
index 2b263013e55a2a..4b631e1fd7cd7e 100644
--- a/src/plugins/data/common/search/aggs/buckets/histogram.ts
+++ b/src/plugins/data/common/search/aggs/buckets/histogram.ts
@@ -28,6 +28,8 @@ import { BucketAggType, IBucketAggConfig } from './bucket_agg_type';
 import { createFilterHistogram } from './create_filter/histogram';
 import { BUCKET_TYPES } from './bucket_agg_types';
 import { ExtendedBounds } from './lib/extended_bounds';
+import { isAutoInterval, autoInterval } from './_interval_options';
+import { calculateHistogramInterval } from './lib/histogram_calculate_interval';
 
 export interface AutoBounds {
   min: number;
@@ -47,6 +49,7 @@ export interface IBucketHistogramAggConfig extends IBucketAggConfig {
 export interface AggParamsHistogram extends BaseAggParams {
   field: string;
   interval: string;
+  maxBars?: number;
   intervalBase?: number;
   min_doc_count?: boolean;
   has_extended_bounds?: boolean;
@@ -102,6 +105,7 @@ export const getHistogramBucketAgg = ({
       },
       {
         name: 'interval',
+        default: autoInterval,
         modifyAggConfigOnSearchRequestStart(
           aggConfig: IBucketHistogramAggConfig,
           searchSource: any,
@@ -127,9 +131,12 @@ export const getHistogramBucketAgg = ({
           return childSearchSource
             .fetch(options)
             .then((resp: any) => {
+              const min = resp.aggregations?.minAgg?.value ?? 0;
+              const max = resp.aggregations?.maxAgg?.value ?? 0;
+
               aggConfig.setAutoBounds({
-                min: get(resp, 'aggregations.minAgg.value'),
-                max: get(resp, 'aggregations.maxAgg.value'),
+                min,
+                max,
               });
             })
             .catch((e: Error) => {
@@ -143,46 +150,24 @@ export const getHistogramBucketAgg = ({
             });
         },
         write(aggConfig, output) {
-          let interval = parseFloat(aggConfig.params.interval);
-          if (interval <= 0) {
-            interval = 1;
-          }
-          const autoBounds = aggConfig.getAutoBounds();
-
-          // ensure interval does not create too many buckets and crash browser
-          if (autoBounds) {
-            const range = autoBounds.max - autoBounds.min;
-            const bars = range / interval;
-
-            if (bars > getConfig(UI_SETTINGS.HISTOGRAM_MAX_BARS)) {
-              const minInterval = range / getConfig(UI_SETTINGS.HISTOGRAM_MAX_BARS);
-
-              // Round interval by order of magnitude to provide clean intervals
-              // Always round interval up so there will always be less buckets than histogram:maxBars
-              const orderOfMagnitude = Math.pow(10, Math.floor(Math.log10(minInterval)));
-              let roundInterval = orderOfMagnitude;
-
-              while (roundInterval < minInterval) {
-                roundInterval += orderOfMagnitude;
-              }
-              interval = roundInterval;
-            }
-          }
-          const base = aggConfig.params.intervalBase;
-
-          if (base) {
-            if (interval < base) {
-              // In case the specified interval is below the base, just increase it to it's base
-              interval = base;
-            } else if (interval % base !== 0) {
-              // In case the interval is not a multiple of the base round it to the next base
-              interval = Math.round(interval / base) * base;
-            }
-          }
-
-          output.params.interval = interval;
+          const values = aggConfig.getAutoBounds();
+
+          output.params.interval = calculateHistogramInterval({
+            values,
+            interval: aggConfig.params.interval,
+            maxBucketsUiSettings: getConfig(UI_SETTINGS.HISTOGRAM_MAX_BARS),
+            maxBucketsUserInput: aggConfig.params.maxBars,
+            intervalBase: aggConfig.params.intervalBase,
+          });
         },
       },
+      {
+        name: 'maxBars',
+        shouldShow(agg) {
+          return isAutoInterval(get(agg, 'params.interval'));
+        },
+        write: () => {},
+      },
       {
         name: 'min_doc_count',
         default: false,
diff --git a/src/plugins/data/common/search/aggs/buckets/histogram_fn.test.ts b/src/plugins/data/common/search/aggs/buckets/histogram_fn.test.ts
index 34b6fa1a6dcd6d..354946f99a2f58 100644
--- a/src/plugins/data/common/search/aggs/buckets/histogram_fn.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/histogram_fn.test.ts
@@ -43,6 +43,7 @@ describe('agg_expression_functions', () => {
               "interval": "10",
               "intervalBase": undefined,
               "json": undefined,
+              "maxBars": undefined,
               "min_doc_count": undefined,
             },
             "schema": undefined,
@@ -55,8 +56,9 @@ describe('agg_expression_functions', () => {
     test('includes optional params when they are provided', () => {
       const actual = fn({
         field: 'field',
-        interval: '10',
+        interval: 'auto',
         intervalBase: 1,
+        maxBars: 25,
         min_doc_count: false,
         has_extended_bounds: false,
         extended_bounds: JSON.stringify({
@@ -77,9 +79,10 @@ describe('agg_expression_functions', () => {
             },
             "field": "field",
             "has_extended_bounds": false,
-            "interval": "10",
+            "interval": "auto",
             "intervalBase": 1,
             "json": undefined,
+            "maxBars": 25,
             "min_doc_count": false,
           },
           "schema": undefined,
diff --git a/src/plugins/data/common/search/aggs/buckets/histogram_fn.ts b/src/plugins/data/common/search/aggs/buckets/histogram_fn.ts
index 877fd13e59f879..2e833bbe0a3ebb 100644
--- a/src/plugins/data/common/search/aggs/buckets/histogram_fn.ts
+++ b/src/plugins/data/common/search/aggs/buckets/histogram_fn.ts
@@ -85,6 +85,12 @@ export const aggHistogram = (): FunctionDefinition => ({
         defaultMessage: 'Specifies whether to use min_doc_count for this aggregation',
       }),
     },
+    maxBars: {
+      types: ['number'],
+      help: i18n.translate('data.search.aggs.buckets.histogram.maxBars.help', {
+        defaultMessage: 'Calculate interval to get approximately this many bars',
+      }),
+    },
     has_extended_bounds: {
       types: ['boolean'],
       help: i18n.translate('data.search.aggs.buckets.histogram.hasExtendedBounds.help', {
diff --git a/src/plugins/data/common/search/aggs/buckets/ip_range.ts b/src/plugins/data/common/search/aggs/buckets/ip_range.ts
index 46e0b62d0f8d7d..d0a6174b011fc4 100644
--- a/src/plugins/data/common/search/aggs/buckets/ip_range.ts
+++ b/src/plugins/data/common/search/aggs/buckets/ip_range.ts
@@ -59,7 +59,9 @@ export const getIpRangeBucketAgg = () =>
     getSerializedFormat(agg) {
       return {
         id: 'ip_range',
-        params: agg.params.field ? agg.params.field.format.toJSON() : {},
+        params: agg.params.field
+          ? agg.aggConfigs.indexPattern.getFormatterForField(agg.params.field).toJSON()
+          : {},
       };
     },
     makeLabel(aggConfig) {
diff --git a/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.test.ts b/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.test.ts
new file mode 100644
index 00000000000000..fd788d33392951
--- /dev/null
+++ b/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.test.ts
@@ -0,0 +1,144 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import {
+  calculateHistogramInterval,
+  CalculateHistogramIntervalParams,
+} from './histogram_calculate_interval';
+
+describe('calculateHistogramInterval', () => {
+  describe('auto calculating mode', () => {
+    let params: CalculateHistogramIntervalParams;
+
+    beforeEach(() => {
+      params = {
+        interval: 'auto',
+        intervalBase: undefined,
+        maxBucketsUiSettings: 100,
+        maxBucketsUserInput: undefined,
+        values: {
+          min: 0,
+          max: 1,
+        },
+      };
+    });
+
+    describe('maxBucketsUserInput is defined', () => {
+      test('should not set interval which more than largest possible', () => {
+        const p = {
+          ...params,
+          maxBucketsUserInput: 200,
+          values: {
+            min: 150,
+            max: 250,
+          },
+        };
+        expect(calculateHistogramInterval(p)).toEqual(1);
+      });
+
+      test('should correctly work for float numbers (small numbers)', () => {
+        expect(
+          calculateHistogramInterval({
+            ...params,
+            maxBucketsUserInput: 50,
+            values: {
+              min: 0.1,
+              max: 0.9,
+            },
+          })
+        ).toBe(0.02);
+      });
+
+      test('should correctly work for float numbers (big numbers)', () => {
+        expect(
+          calculateHistogramInterval({
+            ...params,
+            maxBucketsUserInput: 10,
+            values: {
+              min: 10.45,
+              max: 1000.05,
+            },
+          })
+        ).toBe(100);
+      });
+    });
+
+    describe('maxBucketsUserInput is not defined', () => {
+      test('should not set interval which more than largest possible', () => {
+        expect(
+          calculateHistogramInterval({
+            ...params,
+            values: {
+              min: 0,
+              max: 100,
+            },
+          })
+        ).toEqual(1);
+      });
+
+      test('should set intervals for integer numbers (diff less than maxBucketsUiSettings)', () => {
+        expect(
+          calculateHistogramInterval({
+            ...params,
+            values: {
+              min: 1,
+              max: 10,
+            },
+          })
+        ).toEqual(0.1);
+      });
+
+      test('should set intervals for integer numbers (diff more than maxBucketsUiSettings)', () => {
+        // diff === 44445; interval === 500; buckets === 89
+        expect(
+          calculateHistogramInterval({
+            ...params,
+            values: {
+              min: 45678,
+              max: 90123,
+            },
+          })
+        ).toEqual(500);
+      });
+
+      test('should set intervals the same for the same interval', () => {
+        // both diffs are the same
+        // diff === 1.655; interval === 0.02; buckets === 82
+        expect(
+          calculateHistogramInterval({
+            ...params,
+            values: {
+              min: 1.245,
+              max: 2.9,
+            },
+          })
+        ).toEqual(0.02);
+        expect(
+          calculateHistogramInterval({
+            ...params,
+            values: {
+              min: 0.5,
+              max: 2.3,
+            },
+          })
+        ).toEqual(0.02);
+      });
+    });
+  });
+});
diff --git a/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.ts b/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.ts
new file mode 100644
index 00000000000000..f4e42fa8881ef5
--- /dev/null
+++ b/src/plugins/data/common/search/aggs/buckets/lib/histogram_calculate_interval.ts
@@ -0,0 +1,143 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { isAutoInterval } from '../_interval_options';
+
+interface IntervalValuesRange {
+  min: number;
+  max: number;
+}
+
+export interface CalculateHistogramIntervalParams {
+  interval: string;
+  maxBucketsUiSettings: number;
+  maxBucketsUserInput?: number;
+  intervalBase?: number;
+  values?: IntervalValuesRange;
+}
+
+/**
+ * Round interval by order of magnitude to provide clean intervals
+ */
+const roundInterval = (minInterval: number) => {
+  const orderOfMagnitude = Math.pow(10, Math.floor(Math.log10(minInterval)));
+  let interval = orderOfMagnitude;
+
+  while (interval < minInterval) {
+    interval += orderOfMagnitude;
+  }
+
+  return interval;
+};
+
+const calculateForGivenInterval = (
+  diff: number,
+  interval: number,
+  maxBucketsUiSettings: CalculateHistogramIntervalParams['maxBucketsUiSettings']
+) => {
+  const bars = diff / interval;
+
+  if (bars > maxBucketsUiSettings) {
+    const minInterval = diff / maxBucketsUiSettings;
+
+    return roundInterval(minInterval);
+  }
+
+  return interval;
+};
+
+/**
+ * Algorithm for determining auto-interval
+
+   1. Define maxBars as Math.min(<user input>, <max buckets setting>)
+   2. Find the min and max values in the data
+   3. Subtract the min from max to get diff
+   4. Set exactInterval to diff / maxBars
+   5. Based on exactInterval, find the power of 10 that's lower and higher
+   6. Find the number of expected buckets that lowerPower would create: diff / lowerPower
+   7. Find the number of expected buckets that higherPower would create: diff / higherPower
+   8. There are three possible final intervals, pick the one that's closest to maxBars:
+     - The lower power of 10
+     - The lower power of 10, times 2
+     - The lower power of 10, times 5
+ **/
+const calculateAutoInterval = (
+  diff: number,
+  maxBucketsUiSettings: CalculateHistogramIntervalParams['maxBucketsUiSettings'],
+  maxBucketsUserInput: CalculateHistogramIntervalParams['maxBucketsUserInput']
+) => {
+  const maxBars = Math.min(maxBucketsUiSettings, maxBucketsUserInput ?? maxBucketsUiSettings);
+  const exactInterval = diff / maxBars;
+
+  const lowerPower = Math.pow(10, Math.floor(Math.log10(exactInterval)));
+
+  const autoBuckets = diff / lowerPower;
+
+  if (autoBuckets > maxBars) {
+    if (autoBuckets / 2 <= maxBars) {
+      return lowerPower * 2;
+    } else if (autoBuckets / 5 <= maxBars) {
+      return lowerPower * 5;
+    } else {
+      return lowerPower * 10;
+    }
+  }
+
+  return lowerPower;
+};
+
+export const calculateHistogramInterval = ({
+  interval,
+  maxBucketsUiSettings,
+  maxBucketsUserInput,
+  intervalBase,
+  values,
+}: CalculateHistogramIntervalParams) => {
+  const isAuto = isAutoInterval(interval);
+  let calculatedInterval = isAuto ? 0 : parseFloat(interval);
+
+  // should return NaN on non-numeric or invalid values
+  if (Number.isNaN(calculatedInterval)) {
+    return calculatedInterval;
+  }
+
+  if (values) {
+    const diff = values.max - values.min;
+
+    if (diff) {
+      calculatedInterval = isAuto
+        ? calculateAutoInterval(diff, maxBucketsUiSettings, maxBucketsUserInput)
+        : calculateForGivenInterval(diff, calculatedInterval, maxBucketsUiSettings);
+    }
+  }
+
+  if (intervalBase) {
+    if (calculatedInterval < intervalBase) {
+      // In case the specified interval is below the base, just increase it to it's base
+      calculatedInterval = intervalBase;
+    } else if (calculatedInterval % intervalBase !== 0) {
+      // In case the interval is not a multiple of the base round it to the next base
+      calculatedInterval = Math.round(calculatedInterval / intervalBase) * intervalBase;
+    }
+  }
+
+  const defaultValueForUnspecifiedInterval = 1;
+
+  return calculatedInterval || defaultValueForUnspecifiedInterval;
+};
diff --git a/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.test.ts b/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.test.ts
index ae7630ecd3dac0..04e64233ce1965 100644
--- a/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.test.ts
@@ -20,6 +20,7 @@
 import moment from 'moment';
 
 import { TimeBuckets, TimeBucketsConfig } from './time_buckets';
+import { autoInterval } from '../../_interval_options';
 
 describe('TimeBuckets', () => {
   const timeBucketConfig: TimeBucketsConfig = {
@@ -103,7 +104,7 @@ describe('TimeBuckets', () => {
 
   test('setInterval/getInterval - intreval is a "auto"', () => {
     const timeBuckets = new TimeBuckets(timeBucketConfig);
-    timeBuckets.setInterval('auto');
+    timeBuckets.setInterval(autoInterval);
     const interval = timeBuckets.getInterval();
 
     expect(interval.description).toEqual('0 milliseconds');
diff --git a/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.ts b/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.ts
index 6402a6e83ead9a..d054df0c9274ed 100644
--- a/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.ts
+++ b/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.ts
@@ -28,6 +28,7 @@ import {
   convertIntervalToEsInterval,
   EsInterval,
 } from './calc_es_interval';
+import { autoInterval } from '../../_interval_options';
 
 interface TimeBucketsInterval extends moment.Duration {
   // TODO double-check whether all of these are needed
@@ -189,8 +190,8 @@ export class TimeBuckets {
       interval = input.val;
     }
 
-    if (!interval || interval === 'auto') {
-      this._i = 'auto';
+    if (!interval || interval === autoInterval) {
+      this._i = autoInterval;
       return;
     }
 
diff --git a/src/plugins/data/common/search/aggs/buckets/range.test.ts b/src/plugins/data/common/search/aggs/buckets/range.test.ts
index b23b03db6a9ec2..b8241e04ea1ee8 100644
--- a/src/plugins/data/common/search/aggs/buckets/range.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/range.test.ts
@@ -27,12 +27,6 @@ describe('Range Agg', () => {
   const getAggConfigs = () => {
     const field = {
       name: 'bytes',
-      format: new NumberFormat(
-        {
-          pattern: '0,0.[000] b',
-        },
-        getConfig
-      ),
     };
 
     const indexPattern = {
@@ -42,6 +36,13 @@ describe('Range Agg', () => {
         getByName: () => field,
         filter: () => [field],
       },
+      getFormatterForField: () =>
+        new NumberFormat(
+          {
+            pattern: '0,0.[000] b',
+          },
+          getConfig
+        ),
     } as any;
 
     return new AggConfigs(
diff --git a/src/plugins/data/common/search/aggs/buckets/range.ts b/src/plugins/data/common/search/aggs/buckets/range.ts
index 91a357b6359504..169b234845274c 100644
--- a/src/plugins/data/common/search/aggs/buckets/range.ts
+++ b/src/plugins/data/common/search/aggs/buckets/range.ts
@@ -78,7 +78,9 @@ export const getRangeBucketAgg = ({ getFieldFormatsStart }: RangeBucketAggDepend
       return key;
     },
     getSerializedFormat(agg) {
-      const format = agg.params.field ? agg.params.field.format.toJSON() : {};
+      const format = agg.params.field
+        ? agg.aggConfigs.indexPattern.getFormatterForField(agg.params.field).toJSON()
+        : { id: undefined, params: undefined };
       return {
         id: 'range',
         params: {
diff --git a/src/plugins/data/common/search/aggs/buckets/terms.ts b/src/plugins/data/common/search/aggs/buckets/terms.ts
index 5c8483cf213695..1363d38748c8ba 100644
--- a/src/plugins/data/common/search/aggs/buckets/terms.ts
+++ b/src/plugins/data/common/search/aggs/buckets/terms.ts
@@ -82,7 +82,9 @@ export const getTermsBucketAgg = () =>
       return agg.getFieldDisplayName() + ': ' + params.order.text;
     },
     getSerializedFormat(agg) {
-      const format = agg.params.field ? agg.params.field.format.toJSON() : {};
+      const format = agg.params.field
+        ? agg.aggConfigs.indexPattern.getFormatterForField(agg.params.field).toJSON()
+        : { id: undefined, params: undefined };
       return {
         id: 'terms',
         params: {
diff --git a/src/plugins/data/common/search/aggs/metrics/parent_pipeline.test.ts b/src/plugins/data/common/search/aggs/metrics/parent_pipeline.test.ts
index c6bba56f73ec78..4815ab0ac56dca 100644
--- a/src/plugins/data/common/search/aggs/metrics/parent_pipeline.test.ts
+++ b/src/plugins/data/common/search/aggs/metrics/parent_pipeline.test.ts
@@ -66,9 +66,6 @@ describe('parent pipeline aggs', function () {
       ) => {
         const field = {
           name: 'field',
-          format: {
-            toJSON: () => ({ id: 'bytes' }),
-          },
         };
         const indexPattern = {
           id: '1234',
@@ -77,6 +74,9 @@ describe('parent pipeline aggs', function () {
             getByName: () => field,
             filter: () => [field],
           },
+          getFormatterForField: () => ({
+            toJSON: () => ({ id: 'bytes' }),
+          }),
         } as any;
 
         const aggConfigs = new AggConfigs(
diff --git a/src/plugins/data/common/search/aggs/metrics/sibling_pipeline.test.ts b/src/plugins/data/common/search/aggs/metrics/sibling_pipeline.test.ts
index a157d225c839cb..32737f7b7237d3 100644
--- a/src/plugins/data/common/search/aggs/metrics/sibling_pipeline.test.ts
+++ b/src/plugins/data/common/search/aggs/metrics/sibling_pipeline.test.ts
@@ -72,6 +72,9 @@ describe('sibling pipeline aggs', () => {
             getByName: () => field,
             filter: () => [field],
           },
+          getFormatterForField: () => ({
+            toJSON: () => ({ id: 'bytes' }),
+          }),
         } as any;
 
         const aggConfigs = new AggConfigs(
diff --git a/src/plugins/data/common/search/aggs/param_types/base.ts b/src/plugins/data/common/search/aggs/param_types/base.ts
index 3a12a9a54500f4..c0316c974e26fb 100644
--- a/src/plugins/data/common/search/aggs/param_types/base.ts
+++ b/src/plugins/data/common/search/aggs/param_types/base.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { FetchOptions, ISearchSource } from 'src/plugins/data/public';
+import { ISearchOptions, ISearchSource } from 'src/plugins/data/public';
 import { ExpressionAstFunction } from 'src/plugins/expressions/common';
 import { IAggConfigs } from '../agg_configs';
 import { IAggConfig } from '../agg_config';
@@ -56,7 +56,7 @@ export class BaseParamType<TAggConfig extends IAggConfig = IAggConfig> {
   modifyAggConfigOnSearchRequestStart: (
     aggConfig: TAggConfig,
     searchSource?: ISearchSource,
-    options?: FetchOptions
+    options?: ISearchOptions
   ) => void;
 
   constructor(config: Record<string, any>) {
diff --git a/src/plugins/data/common/search/aggs/utils/calculate_auto_time_expression.ts b/src/plugins/data/common/search/aggs/utils/calculate_auto_time_expression.ts
index 622e8101f34aba..3637ded44c50ab 100644
--- a/src/plugins/data/common/search/aggs/utils/calculate_auto_time_expression.ts
+++ b/src/plugins/data/common/search/aggs/utils/calculate_auto_time_expression.ts
@@ -21,6 +21,7 @@ import { UI_SETTINGS } from '../../../../common/constants';
 import { TimeRange } from '../../../../common/query';
 import { TimeBuckets } from '../buckets/lib/time_buckets';
 import { toAbsoluteDates } from './date_interval_utils';
+import { autoInterval } from '../buckets/_interval_options';
 
 export function getCalculateAutoTimeExpression(getConfig: (key: string) => any) {
   return function calculateAutoTimeExpression(range: TimeRange) {
@@ -36,7 +37,7 @@ export function getCalculateAutoTimeExpression(getConfig: (key: string) => any)
       'dateFormat:scaled': getConfig('dateFormat:scaled'),
     });
 
-    buckets.setInterval('auto');
+    buckets.setInterval(autoInterval);
     buckets.setBounds({
       min: moment(dates.from),
       max: moment(dates.to),
diff --git a/src/plugins/data/common/search/es_search/index.ts b/src/plugins/data/common/search/es_search/index.ts
index 7bc9cada8f0eee..54757b53b8665d 100644
--- a/src/plugins/data/common/search/es_search/index.ts
+++ b/src/plugins/data/common/search/es_search/index.ts
@@ -22,4 +22,5 @@ export {
   IEsSearchRequest,
   IEsSearchResponse,
   ES_SEARCH_STRATEGY,
+  ISearchOptions,
 } from './types';
diff --git a/src/plugins/data/common/search/es_search/types.ts b/src/plugins/data/common/search/es_search/types.ts
index 3184fbe3417055..89faa5b7119c86 100644
--- a/src/plugins/data/common/search/es_search/types.ts
+++ b/src/plugins/data/common/search/es_search/types.ts
@@ -22,6 +22,17 @@ import { IKibanaSearchRequest, IKibanaSearchResponse } from '../types';
 
 export const ES_SEARCH_STRATEGY = 'es';
 
+export interface ISearchOptions {
+  /**
+   * An `AbortSignal` that allows the caller of `search` to abort a search request.
+   */
+  abortSignal?: AbortSignal;
+  /**
+   * Use this option to force using a specific server side search strategy. Leave empty to use the default strategy.
+   */
+  strategy?: string;
+}
+
 export type ISearchRequestParams<T = Record<string, any>> = {
   trackTotalHits?: boolean;
 } & Search<T>;
diff --git a/src/plugins/data/common/search/index.ts b/src/plugins/data/common/search/index.ts
index d8184551b7f3d9..3bfb0ddb89aa9b 100644
--- a/src/plugins/data/common/search/index.ts
+++ b/src/plugins/data/common/search/index.ts
@@ -28,4 +28,5 @@ export {
   IEsSearchResponse,
   ES_SEARCH_STRATEGY,
   ISearchRequestParams,
+  ISearchOptions,
 } from './es_search';
diff --git a/src/plugins/data/public/actions/filters/create_filters_from_value_click.test.ts b/src/plugins/data/public/actions/filters/create_filters_from_value_click.test.ts
index a3b9b0b3448235..2ad20c3807819c 100644
--- a/src/plugins/data/public/actions/filters/create_filters_from_value_click.test.ts
+++ b/src/plugins/data/public/actions/filters/create_filters_from_value_click.test.ts
@@ -30,11 +30,7 @@ import { ValueClickContext } from '../../../../embeddable/public';
 
 const mockField = {
   name: 'bytes',
-  indexPattern: {
-    id: 'logstash-*',
-  },
   filterable: true,
-  format: new fieldFormats.BytesFormat({}, (() => {}) as FieldFormatsGetConfigFn),
 };
 
 describe('createFiltersFromValueClick', () => {
@@ -81,6 +77,8 @@ describe('createFiltersFromValueClick', () => {
           getByName: () => mockField,
           filter: () => [mockField],
         },
+        getFormatterForField: () =>
+          new fieldFormats.BytesFormat({}, (() => {}) as FieldFormatsGetConfigFn),
       }),
     } as unknown) as IndexPatternsContract);
   });
diff --git a/src/plugins/data/public/field_formats/field_formats_registry.stub.ts b/src/plugins/data/public/field_formats/field_formats_registry.stub.ts
new file mode 100644
index 00000000000000..e8741ca41036ba
--- /dev/null
+++ b/src/plugins/data/public/field_formats/field_formats_registry.stub.ts
@@ -0,0 +1,36 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { CoreSetup } from 'src/core/public';
+import { deserializeFieldFormat } from './utils/deserialize';
+import { baseFormattersPublic } from './constants';
+import { DataPublicPluginStart, fieldFormats } from '..';
+
+export const getFieldFormatsRegistry = (core: CoreSetup) => {
+  const fieldFormatsRegistry = new fieldFormats.FieldFormatsRegistry();
+  const getConfig = core.uiSettings.get.bind(core.uiSettings);
+
+  fieldFormatsRegistry.init(getConfig, {}, baseFormattersPublic);
+
+  fieldFormatsRegistry.deserialize = deserializeFieldFormat.bind(
+    fieldFormatsRegistry as DataPublicPluginStart['fieldFormats']
+  );
+
+  return fieldFormatsRegistry;
+};
diff --git a/src/plugins/data/public/index.ts b/src/plugins/data/public/index.ts
index 27b16c57ffecf2..f7b4111df51726 100644
--- a/src/plugins/data/public/index.ts
+++ b/src/plugins/data/public/index.ts
@@ -262,7 +262,7 @@ export {
   UI_SETTINGS,
   TypeMeta as IndexPatternTypeMeta,
   AggregationRestrictions as IndexPatternAggRestrictions,
-  FieldList,
+  fieldList,
 } from '../common';
 
 /*
@@ -342,7 +342,6 @@ export {
   ES_SEARCH_STRATEGY,
   EsQuerySortValue,
   extractSearchSourceReferences,
-  FetchOptions,
   getEsPreference,
   getSearchParamsFromRequest,
   IEsSearchRequest,
@@ -352,7 +351,6 @@ export {
   injectSearchSourceReferences,
   ISearch,
   ISearchGeneric,
-  ISearchOptions,
   ISearchSource,
   parseSearchSourceJSON,
   RequestTimeoutError,
@@ -367,6 +365,8 @@ export {
   EsRawResponseExpressionTypeDefinition,
 } from './search';
 
+export { ISearchOptions } from '../common';
+
 // Search namespace
 export const search = {
   aggs: {
diff --git a/src/plugins/data/public/index_patterns/index_patterns/index_patterns_api_client.test.mock.ts b/src/plugins/data/public/index_patterns/index_patterns/index_patterns_api_client.test.mock.ts
index 51f4fc7ce94b90..f1f5f8737b389b 100644
--- a/src/plugins/data/public/index_patterns/index_patterns/index_patterns_api_client.test.mock.ts
+++ b/src/plugins/data/public/index_patterns/index_patterns/index_patterns_api_client.test.mock.ts
@@ -17,10 +17,8 @@
  * under the License.
  */
 
-import { setup } from 'test_utils/http_test_setup';
+import { setup } from '../../../../../core/test_helpers/http_test_setup';
 
 export const { http } = setup((injectedMetadata) => {
   injectedMetadata.getBasePath.mockReturnValue('/hola/daro/');
 });
-
-jest.doMock('ui/new_platform', () => ({ npSetup: { core: { http } } }));
diff --git a/src/plugins/data/public/plugin.ts b/src/plugins/data/public/plugin.ts
index 3bc19a578a4170..3b18e0fbed5374 100644
--- a/src/plugins/data/public/plugin.ts
+++ b/src/plugins/data/public/plugin.ts
@@ -19,13 +19,7 @@
 
 import './index.scss';
 
-import {
-  PluginInitializerContext,
-  CoreSetup,
-  CoreStart,
-  Plugin,
-  PackageInfo,
-} from 'src/core/public';
+import { PluginInitializerContext, CoreSetup, CoreStart, Plugin } from 'src/core/public';
 import { ConfigSchema } from '../config';
 import { Storage, IStorageWrapper, createStartServicesGetter } from '../../kibana_utils/public';
 import {
@@ -100,7 +94,6 @@ export class DataPublicPlugin
   private readonly fieldFormatsService: FieldFormatsService;
   private readonly queryService: QueryService;
   private readonly storage: IStorageWrapper;
-  private readonly packageInfo: PackageInfo;
 
   constructor(initializerContext: PluginInitializerContext<ConfigSchema>) {
     this.searchService = new SearchService();
@@ -108,7 +101,6 @@ export class DataPublicPlugin
     this.fieldFormatsService = new FieldFormatsService();
     this.autocomplete = new AutocompleteService(initializerContext);
     this.storage = new Storage(window.localStorage);
-    this.packageInfo = initializerContext.env.packageInfo;
   }
 
   public setup(
@@ -145,7 +137,6 @@ export class DataPublicPlugin
 
     const searchService = this.searchService.setup(core, {
       usageCollection,
-      packageInfo: this.packageInfo,
       expressions,
     });
 
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index ba40dece25df9b..c2cc2fdc3c1341 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -26,11 +26,12 @@ import { EuiGlobalToastListToast } from '@elastic/eui';
 import { ExclusiveUnion } from '@elastic/eui';
 import { ExpressionAstFunction } from 'src/plugins/expressions/common';
 import { ExpressionsSetup } from 'src/plugins/expressions/public';
-import { FetchOptions as FetchOptions_2 } from 'src/plugins/data/public';
 import { History } from 'history';
 import { Href } from 'history';
+import { HttpStart } from 'src/core/public';
 import { IconType } from '@elastic/eui';
 import { InjectedIntl } from '@kbn/i18n/react';
+import { ISearchOptions as ISearchOptions_2 } from 'src/plugins/data/public';
 import { ISearchSource as ISearchSource_2 } from 'src/plugins/data/public';
 import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
 import { IUiSettingsClient } from 'src/core/public';
@@ -486,16 +487,6 @@ export const extractSearchSourceReferences: (state: SearchSourceFields) => [Sear
     indexRefName?: string;
 }, SavedObjectReference[]];
 
-// Warning: (ae-missing-release-tag) "FetchOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface FetchOptions {
-    // (undocumented)
-    abortSignal?: AbortSignal;
-    // (undocumented)
-    searchStrategyId?: string;
-}
-
 // Warning: (ae-missing-release-tag) "FieldFormat" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -604,46 +595,11 @@ export type FieldFormatsContentType = 'html' | 'text';
 // @public (undocumented)
 export type FieldFormatsGetConfigFn = GetConfigFn;
 
-// Warning: (ae-missing-release-tag) "FieldList" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+// Warning: (ae-forgotten-export) The symbol "FieldSpec" needs to be exported by the entry point index.d.ts
+// Warning: (ae-missing-release-tag) "fieldList" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
-export class FieldList extends Array<IndexPatternField> implements IIndexPatternFieldList {
-    // Warning: (ae-forgotten-export) The symbol "FieldSpec" needs to be exported by the entry point index.d.ts
-    // Warning: (ae-forgotten-export) The symbol "OnNotification" needs to be exported by the entry point index.d.ts
-    constructor(indexPattern: IndexPattern, specs?: FieldSpec[], shortDotsEnable?: boolean, onNotification?: OnNotification);
-    // (undocumented)
-    readonly add: (field: FieldSpec) => void;
-    // (undocumented)
-    readonly getAll: () => IndexPatternField[];
-    // (undocumented)
-    readonly getByName: (name: IndexPatternField['name']) => IndexPatternField | undefined;
-    // (undocumented)
-    readonly getByType: (type: IndexPatternField['type']) => any[];
-    // (undocumented)
-    readonly remove: (field: IFieldType) => void;
-    // (undocumented)
-    readonly removeAll: () => void;
-    // (undocumented)
-    readonly replaceAll: (specs: FieldSpec[]) => void;
-    // (undocumented)
-    readonly toSpec: () => {
-        count: number;
-        script: string | undefined;
-        lang: string | undefined;
-        conflictDescriptions: Record<string, string[]> | undefined;
-        name: string;
-        type: string;
-        esTypes: string[] | undefined;
-        scripted: boolean;
-        searchable: boolean;
-        aggregatable: boolean;
-        readFromDocValues: boolean;
-        subType: import("../types").IFieldSubType | undefined;
-        format: any;
-    }[];
-    // (undocumented)
-    readonly update: (field: FieldSpec) => void;
-}
+export const fieldList: (specs?: FieldSpec[], shortDotsEnable?: boolean) => IIndexPatternFieldList;
 
 // @public (undocumented)
 export interface FieldMappingSpec {
@@ -868,7 +824,9 @@ export interface IFieldType {
     // (undocumented)
     subType?: IFieldSubType;
     // (undocumented)
-    toSpec?: () => FieldSpec;
+    toSpec?: (options?: {
+        getFormatterForField?: IndexPattern['getFormatterForField'];
+    }) => FieldSpec;
     // (undocumented)
     type: string;
     // (undocumented)
@@ -919,6 +877,10 @@ export interface IIndexPatternFieldList extends Array<IndexPatternField> {
     // (undocumented)
     replaceAll(specs: FieldSpec[]): void;
     // (undocumented)
+    toSpec(options?: {
+        getFormatterForField?: IndexPattern['getFormatterForField'];
+    }): FieldSpec[];
+    // (undocumented)
     update(field: FieldSpec): void;
 }
 
@@ -1051,12 +1013,8 @@ export class IndexPattern implements IIndexPattern {
     // (undocumented)
     title: string;
     // (undocumented)
-    toJSON(): string | undefined;
-    // (undocumented)
     toSpec(): IndexPatternSpec;
     // (undocumented)
-    toString(): string;
-    // (undocumented)
     type: string | undefined;
     // (undocumented)
     typeMeta?: IndexPatternTypeMeta;
@@ -1100,7 +1058,7 @@ export interface IndexPatternAttributes {
 //
 // @public (undocumented)
 export class IndexPatternField implements IFieldType {
-    constructor(indexPattern: IndexPattern, spec: FieldSpec, displayName: string, onNotification: OnNotification);
+    constructor(spec: FieldSpec, displayName: string);
     // (undocumented)
     get aggregatable(): boolean;
     // (undocumented)
@@ -1116,10 +1074,6 @@ export class IndexPatternField implements IFieldType {
     // (undocumented)
     get filterable(): boolean;
     // (undocumented)
-    get format(): FieldFormat;
-    // (undocumented)
-    readonly indexPattern: IndexPattern;
-    // (undocumented)
     get lang(): string | undefined;
     set lang(lang: string | undefined);
     // (undocumented)
@@ -1155,7 +1109,9 @@ export class IndexPatternField implements IFieldType {
         subType: import("../types").IFieldSubType | undefined;
     };
     // (undocumented)
-    toSpec(): {
+    toSpec({ getFormatterForField, }?: {
+        getFormatterForField?: IndexPattern['getFormatterForField'];
+    }): {
         count: number;
         script: string | undefined;
         lang: string | undefined;
@@ -1168,7 +1124,10 @@ export class IndexPatternField implements IFieldType {
         aggregatable: boolean;
         readFromDocValues: boolean;
         subType: import("../types").IFieldSubType | undefined;
-        format: any;
+        format: {
+            id: any;
+            params: any;
+        } | undefined;
     };
     // (undocumented)
     get type(): string;
@@ -1265,9 +1224,7 @@ export type ISearchGeneric = <SearchStrategyRequest extends IEsSearchRequest = I
 //
 // @public (undocumented)
 export interface ISearchOptions {
-    // (undocumented)
-    signal?: AbortSignal;
-    // (undocumented)
+    abortSignal?: AbortSignal;
     strategy?: string;
 }
 
@@ -1508,7 +1465,7 @@ export interface QueryState {
 // Warning: (ae-missing-release-tag) "QueryStringInput" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
-export const QueryStringInput: React.FC<Pick<Props_3, "query" | "prepend" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>;
+export const QueryStringInput: React.FC<Pick<Props_3, "query" | "prepend" | "size" | "className" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>;
 
 // @public (undocumented)
 export type QuerySuggestion = QuerySuggestionBasic | QuerySuggestionField;
diff --git a/src/plugins/data/public/search/expressions/create_filter.test.ts b/src/plugins/data/public/search/expressions/create_filter.test.ts
index 7968c806285318..7cc336a1c20e96 100644
--- a/src/plugins/data/public/search/expressions/create_filter.test.ts
+++ b/src/plugins/data/public/search/expressions/create_filter.test.ts
@@ -52,6 +52,7 @@ describe('createFilter', () => {
         getByName: () => field,
         filter: () => [field],
       },
+      getFormatterForField: () => new BytesFormat({}, (() => {}) as FieldFormatsGetConfigFn),
     } as any;
 
     return new AggConfigs(
diff --git a/src/plugins/data/public/search/expressions/esdsl.ts b/src/plugins/data/public/search/expressions/esdsl.ts
index d7b897ace29b49..2efb21671b5b7e 100644
--- a/src/plugins/data/public/search/expressions/esdsl.ts
+++ b/src/plugins/data/public/search/expressions/esdsl.ts
@@ -140,7 +140,7 @@ export const esdsl = (): EsdslExpressionFunctionDefinition => ({
               body: dsl,
             },
           },
-          { signal: abortSignal }
+          { abortSignal }
         )
         .toPromise();
 
diff --git a/src/plugins/data/public/search/fetch/types.ts b/src/plugins/data/public/search/fetch/types.ts
index 670c4f731971ac..224a597766909b 100644
--- a/src/plugins/data/public/search/fetch/types.ts
+++ b/src/plugins/data/public/search/fetch/types.ts
@@ -17,8 +17,9 @@
  * under the License.
  */
 
+import { HttpStart } from 'src/core/public';
+import { BehaviorSubject } from 'rxjs';
 import { GetConfigFn } from '../../../common';
-import { ISearchStartLegacy } from '../types';
 
 /**
  * @internal
@@ -29,15 +30,10 @@ import { ISearchStartLegacy } from '../types';
  */
 export type SearchRequest = Record<string, any>;
 
-export interface FetchOptions {
-  abortSignal?: AbortSignal;
-  searchStrategyId?: string;
-}
-
 export interface FetchHandlers {
-  legacySearchService: ISearchStartLegacy;
   config: { get: GetConfigFn };
-  esShardTimeout: number;
+  http: HttpStart;
+  loadingCount$: BehaviorSubject<number>;
 }
 
 export interface SearchError {
diff --git a/src/plugins/data/public/search/index.ts b/src/plugins/data/public/search/index.ts
index 14eff13b378ee1..a6a1736ac91daa 100644
--- a/src/plugins/data/public/search/index.ts
+++ b/src/plugins/data/public/search/index.ts
@@ -19,14 +19,7 @@
 
 export * from './expressions';
 
-export {
-  ISearch,
-  ISearchOptions,
-  ISearchGeneric,
-  ISearchSetup,
-  ISearchStart,
-  SearchEnhancements,
-} from './types';
+export { ISearch, ISearchGeneric, ISearchSetup, ISearchStart, SearchEnhancements } from './types';
 
 export { IEsSearchResponse, IEsSearchRequest, ES_SEARCH_STRATEGY } from '../../common/search';
 
@@ -34,7 +27,7 @@ export { getEsPreference } from './es_search';
 
 export { IKibanaSearchResponse, IKibanaSearchRequest } from '../../common/search';
 
-export { SearchError, FetchOptions, getSearchParamsFromRequest, SearchRequest } from './fetch';
+export { SearchError, getSearchParamsFromRequest, SearchRequest } from './fetch';
 
 export {
   ISearchSource,
diff --git a/src/plugins/data/public/search/legacy/call_client.test.ts b/src/plugins/data/public/search/legacy/call_client.test.ts
index a3c4e720b4cab8..38f3ab200da904 100644
--- a/src/plugins/data/public/search/legacy/call_client.test.ts
+++ b/src/plugins/data/public/search/legacy/call_client.test.ts
@@ -17,11 +17,13 @@
  * under the License.
  */
 
+import { coreMock } from '../../../../../core/public/mocks';
 import { callClient } from './call_client';
 import { SearchStrategySearchParams } from './types';
 import { defaultSearchStrategy } from './default_search_strategy';
 import { FetchHandlers } from '../fetch';
 import { handleResponse } from '../fetch/handle_response';
+import { BehaviorSubject } from 'rxjs';
 
 const mockAbortFn = jest.fn();
 jest.mock('../fetch/handle_response', () => ({
@@ -54,7 +56,13 @@ describe('callClient', () => {
 
   test('Passes the additional arguments it is given to the search strategy', () => {
     const searchRequests = [{ _searchStrategyId: 0 }];
-    const args = { legacySearchService: {}, config: {}, esShardTimeout: 0 } as FetchHandlers;
+    const args = {
+      http: coreMock.createStart().http,
+      legacySearchService: {},
+      config: { get: jest.fn() },
+      esShardTimeout: 0,
+      loadingCount$: new BehaviorSubject(0),
+    } as FetchHandlers;
 
     callClient(searchRequests, [], args);
 
diff --git a/src/plugins/data/public/search/legacy/call_client.ts b/src/plugins/data/public/search/legacy/call_client.ts
index 3dcf11f72a7424..d66796b9427a14 100644
--- a/src/plugins/data/public/search/legacy/call_client.ts
+++ b/src/plugins/data/public/search/legacy/call_client.ts
@@ -18,21 +18,22 @@
  */
 
 import { SearchResponse } from 'elasticsearch';
-import { FetchOptions, FetchHandlers, handleResponse } from '../fetch';
+import { ISearchOptions } from 'src/plugins/data/common';
+import { FetchHandlers, handleResponse } from '../fetch';
 import { defaultSearchStrategy } from './default_search_strategy';
 import { SearchRequest } from '../index';
 
 export function callClient(
   searchRequests: SearchRequest[],
-  requestsOptions: FetchOptions[] = [],
+  requestsOptions: ISearchOptions[] = [],
   fetchHandlers: FetchHandlers
 ) {
   // Correlate the options with the request that they're associated with
   const requestOptionEntries: Array<[
     SearchRequest,
-    FetchOptions
+    ISearchOptions
   ]> = searchRequests.map((request, i) => [request, requestsOptions[i]]);
-  const requestOptionsMap = new Map<SearchRequest, FetchOptions>(requestOptionEntries);
+  const requestOptionsMap = new Map<SearchRequest, ISearchOptions>(requestOptionEntries);
   const requestResponseMap = new Map<SearchRequest, Promise<SearchResponse<any>>>();
 
   const { searching, abort } = defaultSearchStrategy.search({
diff --git a/src/plugins/data/public/search/legacy/default_search_strategy.test.ts b/src/plugins/data/public/search/legacy/default_search_strategy.test.ts
index 4148055c1eb583..e74ab49131430b 100644
--- a/src/plugins/data/public/search/legacy/default_search_strategy.test.ts
+++ b/src/plugins/data/public/search/legacy/default_search_strategy.test.ts
@@ -17,44 +17,26 @@
  * under the License.
  */
 
-import { IUiSettingsClient } from 'kibana/public';
+import { HttpStart } from 'src/core/public';
+import { coreMock } from '../../../../../core/public/mocks';
 import { defaultSearchStrategy } from './default_search_strategy';
-import { searchServiceMock } from '../mocks';
 import { SearchStrategySearchParams } from './types';
-import { UI_SETTINGS } from '../../../common';
+import { BehaviorSubject } from 'rxjs';
 
 const { search } = defaultSearchStrategy;
 
-function getConfigStub(config: any = {}) {
-  return {
-    get: (key) => config[key],
-  } as IUiSettingsClient;
-}
-
-const msearchMockResponse: any = Promise.resolve([]);
-msearchMockResponse.abort = jest.fn();
-const msearchMock = jest.fn().mockReturnValue(msearchMockResponse);
-
-const searchMockResponse: any = Promise.resolve([]);
-searchMockResponse.abort = jest.fn();
-const searchMock = jest.fn().mockReturnValue(searchMockResponse);
+const msearchMock = jest.fn().mockResolvedValue({ body: { responses: [] } });
 
 describe('defaultSearchStrategy', function () {
   describe('search', function () {
-    let searchArgs: MockedKeys<Omit<SearchStrategySearchParams, 'config'>>;
-    let es: any;
+    let searchArgs: MockedKeys<SearchStrategySearchParams>;
+    let http: jest.Mocked<HttpStart>;
 
     beforeEach(() => {
-      msearchMockResponse.abort.mockClear();
       msearchMock.mockClear();
 
-      searchMockResponse.abort.mockClear();
-      searchMock.mockClear();
-
-      const searchService = searchServiceMock.createStartContract();
-      searchService.aggs.calculateAutoTimeExpression = jest.fn().mockReturnValue('1d');
-      searchService.__LEGACY.esClient.search = searchMock;
-      searchService.__LEGACY.esClient.msearch = msearchMock;
+      http = coreMock.createStart().http;
+      http.post.mockResolvedValue(msearchMock);
 
       searchArgs = {
         searchRequests: [
@@ -62,49 +44,27 @@ describe('defaultSearchStrategy', function () {
             index: { title: 'foo' },
           },
         ],
-        esShardTimeout: 0,
-        legacySearchService: searchService.__LEGACY,
+        http,
+        config: {
+          get: jest.fn(),
+        },
+        loadingCount$: new BehaviorSubject(0) as any,
       };
-
-      es = searchArgs.legacySearchService.esClient;
-    });
-
-    test('does not send max_concurrent_shard_requests by default', async () => {
-      const config = getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true });
-      await search({ ...searchArgs, config });
-      expect(es.msearch.mock.calls[0][0].max_concurrent_shard_requests).toBe(undefined);
-    });
-
-    test('allows configuration of max_concurrent_shard_requests', async () => {
-      const config = getConfigStub({
-        [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true,
-        [UI_SETTINGS.COURIER_MAX_CONCURRENT_SHARD_REQUESTS]: 42,
-      });
-      await search({ ...searchArgs, config });
-      expect(es.msearch.mock.calls[0][0].max_concurrent_shard_requests).toBe(42);
-    });
-
-    test('should set rest_total_hits_as_int to true on a request', async () => {
-      const config = getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true });
-      await search({ ...searchArgs, config });
-      expect(es.msearch.mock.calls[0][0]).toHaveProperty('rest_total_hits_as_int', true);
-    });
-
-    test('should set ignore_throttled=false when including frozen indices', async () => {
-      const config = getConfigStub({
-        [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true,
-        [UI_SETTINGS.SEARCH_INCLUDE_FROZEN]: true,
-      });
-      await search({ ...searchArgs, config });
-      expect(es.msearch.mock.calls[0][0]).toHaveProperty('ignore_throttled', false);
     });
 
-    test('should properly call abort with msearch', () => {
-      const config = getConfigStub({
-        [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true,
-      });
-      search({ ...searchArgs, config }).abort();
-      expect(msearchMockResponse.abort).toHaveBeenCalled();
+    test('calls http.post with the correct arguments', async () => {
+      await search({ ...searchArgs });
+      expect(http.post.mock.calls).toMatchInlineSnapshot(`
+        Array [
+          Array [
+            "/internal/_msearch",
+            Object {
+              "body": "{\\"searches\\":[{\\"header\\":{\\"index\\":\\"foo\\"}}]}",
+              "signal": AbortSignal {},
+            },
+          ],
+        ]
+      `);
     });
   });
 });
diff --git a/src/plugins/data/public/search/legacy/default_search_strategy.ts b/src/plugins/data/public/search/legacy/default_search_strategy.ts
index 6ccb0a01cf898b..cbcd0da20207f3 100644
--- a/src/plugins/data/public/search/legacy/default_search_strategy.ts
+++ b/src/plugins/data/public/search/legacy/default_search_strategy.ts
@@ -17,8 +17,7 @@
  * under the License.
  */
 
-import { getPreference, getTimeout } from '../fetch';
-import { getMSearchParams } from './get_msearch_params';
+import { getPreference } from '../fetch';
 import { SearchStrategyProvider, SearchStrategySearchParams } from './types';
 
 // @deprecated
@@ -30,34 +29,45 @@ export const defaultSearchStrategy: SearchStrategyProvider = {
   },
 };
 
-function msearch({
-  searchRequests,
-  legacySearchService,
-  config,
-  esShardTimeout,
-}: SearchStrategySearchParams) {
-  const es = legacySearchService.esClient;
-  const inlineRequests = searchRequests.map(({ index, body, search_type: searchType }) => {
-    const inlineHeader = {
-      index: index.title || index,
-      search_type: searchType,
-      ignore_unavailable: true,
-      preference: getPreference(config.get),
+function msearch({ searchRequests, config, http, loadingCount$ }: SearchStrategySearchParams) {
+  const requests = searchRequests.map(({ index, body }) => {
+    return {
+      header: {
+        index: index.title || index,
+        preference: getPreference(config.get),
+      },
+      body,
     };
-    const inlineBody = {
-      ...body,
-      timeout: getTimeout(esShardTimeout),
-    };
-    return `${JSON.stringify(inlineHeader)}\n${JSON.stringify(inlineBody)}`;
   });
 
-  const searching = es.msearch({
-    ...getMSearchParams(config.get),
-    body: `${inlineRequests.join('\n')}\n`,
-  });
+  const abortController = new AbortController();
+  let resolved = false;
+
+  // Start LoadingIndicator
+  loadingCount$.next(loadingCount$.getValue() + 1);
+
+  const cleanup = () => {
+    if (!resolved) {
+      resolved = true;
+      // Decrement loading counter & cleanup BehaviorSubject
+      loadingCount$.next(loadingCount$.getValue() - 1);
+      loadingCount$.complete();
+    }
+  };
+
+  const searching = http
+    .post('/internal/_msearch', {
+      body: JSON.stringify({ searches: requests }),
+      signal: abortController.signal,
+    })
+    .then(({ body }) => body?.responses)
+    .finally(() => cleanup());
 
   return {
-    searching: searching.then(({ responses }: any) => responses),
-    abort: searching.abort,
+    abort: () => {
+      abortController.abort();
+      cleanup();
+    },
+    searching,
   };
 }
diff --git a/src/plugins/data/public/search/legacy/es_client/get_es_client.ts b/src/plugins/data/public/search/legacy/es_client/get_es_client.ts
deleted file mode 100644
index 4367544ad9ff40..00000000000000
--- a/src/plugins/data/public/search/legacy/es_client/get_es_client.ts
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-// @ts-ignore
-import { default as es } from 'elasticsearch-browser/elasticsearch';
-import { CoreStart, PackageInfo } from 'kibana/public';
-import { BehaviorSubject } from 'rxjs';
-
-export function getEsClient({
-  esRequestTimeout,
-  esApiVersion,
-  http,
-  packageVersion,
-}: {
-  esRequestTimeout: number;
-  esApiVersion: string;
-  http: CoreStart['http'];
-  packageVersion: PackageInfo['version'];
-}) {
-  // Use legacy es client for msearch.
-  const client = es.Client({
-    host: getEsUrl(http, packageVersion),
-    log: 'info',
-    requestTimeout: esRequestTimeout,
-    apiVersion: esApiVersion,
-  });
-
-  const loadingCount$ = new BehaviorSubject(0);
-  http.addLoadingCountSource(loadingCount$);
-
-  return {
-    search: wrapEsClientMethod(client, 'search', loadingCount$),
-    msearch: wrapEsClientMethod(client, 'msearch', loadingCount$),
-    create: wrapEsClientMethod(client, 'create', loadingCount$),
-  };
-}
-
-function wrapEsClientMethod(esClient: any, method: string, loadingCount$: BehaviorSubject<number>) {
-  return (args: any) => {
-    // esClient returns a promise, with an additional abort handler
-    // To tap into the abort handling, we have to override that abort handler.
-    const customPromiseThingy = esClient[method](args);
-    const { abort } = customPromiseThingy;
-    let resolved = false;
-
-    // Start LoadingIndicator
-    loadingCount$.next(loadingCount$.getValue() + 1);
-
-    // Stop LoadingIndicator when user aborts
-    customPromiseThingy.abort = () => {
-      abort();
-      if (!resolved) {
-        resolved = true;
-        loadingCount$.next(loadingCount$.getValue() - 1);
-      }
-    };
-
-    // Stop LoadingIndicator when promise finishes
-    customPromiseThingy.finally(() => {
-      resolved = true;
-      loadingCount$.next(loadingCount$.getValue() - 1);
-    });
-
-    return customPromiseThingy;
-  };
-}
-
-function getEsUrl(http: CoreStart['http'], packageVersion: PackageInfo['version']) {
-  const a = document.createElement('a');
-  a.href = http.basePath.prepend('/elasticsearch');
-  const protocolPort = /https/.test(a.protocol) ? 443 : 80;
-  const port = a.port || protocolPort;
-  return {
-    host: a.hostname,
-    port,
-    protocol: a.protocol,
-    pathname: a.pathname,
-    headers: {
-      'kbn-version': packageVersion,
-    },
-  };
-}
diff --git a/src/plugins/data/public/search/legacy/es_client/index.ts b/src/plugins/data/public/search/legacy/es_client/index.ts
deleted file mode 100644
index 78ac83af642d83..00000000000000
--- a/src/plugins/data/public/search/legacy/es_client/index.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export { getEsClient } from './get_es_client';
-export { LegacyApiCaller } from './types';
diff --git a/src/plugins/data/public/search/legacy/es_client/types.ts b/src/plugins/data/public/search/legacy/es_client/types.ts
deleted file mode 100644
index 2d35188322a4e9..00000000000000
--- a/src/plugins/data/public/search/legacy/es_client/types.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { SearchResponse } from 'elasticsearch';
-import { SearchRequest } from '../../fetch';
-
-export interface LegacyApiCaller {
-  search: (searchRequest: SearchRequest) => LegacyApiCallerResponse;
-  msearch: (searchRequest: SearchRequest) => LegacyApiCallerResponse;
-}
-
-interface LegacyApiCallerResponse extends Promise<SearchResponse<any>> {
-  abort: () => void;
-}
diff --git a/src/plugins/data/public/search/legacy/fetch_soon.test.ts b/src/plugins/data/public/search/legacy/fetch_soon.test.ts
index d7a85e65b475de..d38a41cf5ffbc0 100644
--- a/src/plugins/data/public/search/legacy/fetch_soon.test.ts
+++ b/src/plugins/data/public/search/legacy/fetch_soon.test.ts
@@ -19,10 +19,10 @@
 
 import { fetchSoon } from './fetch_soon';
 import { callClient } from './call_client';
-import { FetchHandlers, FetchOptions } from '../fetch/types';
+import { FetchHandlers } from '../fetch/types';
 import { SearchRequest } from '../index';
 import { SearchResponse } from 'elasticsearch';
-import { GetConfigFn, UI_SETTINGS } from '../../../common';
+import { GetConfigFn, UI_SETTINGS, ISearchOptions } from '../../../common';
 
 function getConfigStub(config: any = {}): GetConfigFn {
   return (key) => config[key];
@@ -102,7 +102,7 @@ describe('fetchSoon', () => {
     const options = [{ bar: 1 }, { bar: 2 }];
 
     requests.forEach((request, i) => {
-      fetchSoon(request, options[i] as FetchOptions, { config } as FetchHandlers);
+      fetchSoon(request, options[i] as ISearchOptions, { config } as FetchHandlers);
     });
 
     jest.advanceTimersByTime(50);
diff --git a/src/plugins/data/public/search/legacy/fetch_soon.ts b/src/plugins/data/public/search/legacy/fetch_soon.ts
index 16920a8a4dd979..37c3827bb7bba5 100644
--- a/src/plugins/data/public/search/legacy/fetch_soon.ts
+++ b/src/plugins/data/public/search/legacy/fetch_soon.ts
@@ -19,9 +19,9 @@
 
 import { SearchResponse } from 'elasticsearch';
 import { callClient } from './call_client';
-import { FetchHandlers, FetchOptions } from '../fetch/types';
+import { FetchHandlers } from '../fetch/types';
 import { SearchRequest } from '../index';
-import { UI_SETTINGS } from '../../../common';
+import { UI_SETTINGS, ISearchOptions } from '../../../common';
 
 /**
  * This function introduces a slight delay in the request process to allow multiple requests to queue
@@ -29,7 +29,7 @@ import { UI_SETTINGS } from '../../../common';
  */
 export async function fetchSoon(
   request: SearchRequest,
-  options: FetchOptions,
+  options: ISearchOptions,
   fetchHandlers: FetchHandlers
 ) {
   const msToDelay = fetchHandlers.config.get(UI_SETTINGS.COURIER_BATCH_SEARCHES) ? 50 : 0;
@@ -51,7 +51,7 @@ function delay<T>(fn: (...args: any) => T, ms: number): Promise<T> {
 
 // The current batch/queue of requests to fetch
 let requestsToFetch: SearchRequest[] = [];
-let requestOptions: FetchOptions[] = [];
+let requestOptions: ISearchOptions[] = [];
 
 // The in-progress fetch (if there is one)
 let fetchInProgress: any = null;
@@ -65,7 +65,7 @@ let fetchInProgress: any = null;
  */
 async function delayedFetch(
   request: SearchRequest,
-  options: FetchOptions,
+  options: ISearchOptions,
   fetchHandlers: FetchHandlers,
   ms: number
 ): Promise<SearchResponse<any>> {
diff --git a/src/plugins/data/public/search/legacy/get_msearch_params.test.ts b/src/plugins/data/public/search/legacy/get_msearch_params.test.ts
deleted file mode 100644
index d3206950174c89..00000000000000
--- a/src/plugins/data/public/search/legacy/get_msearch_params.test.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { getMSearchParams } from './get_msearch_params';
-import { GetConfigFn, UI_SETTINGS } from '../../../common';
-
-function getConfigStub(config: any = {}): GetConfigFn {
-  return (key) => config[key];
-}
-
-describe('getMSearchParams', () => {
-  test('includes rest_total_hits_as_int', () => {
-    const config = getConfigStub();
-    const msearchParams = getMSearchParams(config);
-    expect(msearchParams.rest_total_hits_as_int).toBe(true);
-  });
-
-  test('includes ignore_throttled according to search:includeFrozen', () => {
-    let config = getConfigStub({ [UI_SETTINGS.SEARCH_INCLUDE_FROZEN]: true });
-    let msearchParams = getMSearchParams(config);
-    expect(msearchParams.ignore_throttled).toBe(false);
-
-    config = getConfigStub({ [UI_SETTINGS.SEARCH_INCLUDE_FROZEN]: false });
-    msearchParams = getMSearchParams(config);
-    expect(msearchParams.ignore_throttled).toBe(true);
-  });
-
-  test('includes max_concurrent_shard_requests according to courier:maxConcurrentShardRequests if greater than 0', () => {
-    let config = getConfigStub({ [UI_SETTINGS.COURIER_MAX_CONCURRENT_SHARD_REQUESTS]: 0 });
-    let msearchParams = getMSearchParams(config);
-    expect(msearchParams.max_concurrent_shard_requests).toBe(undefined);
-
-    config = getConfigStub({ [UI_SETTINGS.COURIER_MAX_CONCURRENT_SHARD_REQUESTS]: 5 });
-    msearchParams = getMSearchParams(config);
-    expect(msearchParams.max_concurrent_shard_requests).toBe(5);
-  });
-
-  test('does not include other search params that are included in the msearch header or body', () => {
-    const config = getConfigStub({
-      [UI_SETTINGS.SEARCH_INCLUDE_FROZEN]: false,
-      [UI_SETTINGS.COURIER_MAX_CONCURRENT_SHARD_REQUESTS]: 5,
-    });
-    const msearchParams = getMSearchParams(config);
-    expect(msearchParams.hasOwnProperty('ignore_unavailable')).toBe(false);
-    expect(msearchParams.hasOwnProperty('preference')).toBe(false);
-    expect(msearchParams.hasOwnProperty('timeout')).toBe(false);
-  });
-});
diff --git a/src/plugins/data/public/search/legacy/get_msearch_params.ts b/src/plugins/data/public/search/legacy/get_msearch_params.ts
deleted file mode 100644
index c4f77b25078cd0..00000000000000
--- a/src/plugins/data/public/search/legacy/get_msearch_params.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { GetConfigFn } from '../../../common';
-import { getIgnoreThrottled, getMaxConcurrentShardRequests } from '../fetch';
-
-export function getMSearchParams(getConfig: GetConfigFn) {
-  return {
-    rest_total_hits_as_int: true,
-    ignore_throttled: getIgnoreThrottled(getConfig),
-    max_concurrent_shard_requests: getMaxConcurrentShardRequests(getConfig),
-  };
-}
diff --git a/src/plugins/data/public/search/legacy/index.ts b/src/plugins/data/public/search/legacy/index.ts
index e2ae72824f3f49..74e516f407e8cc 100644
--- a/src/plugins/data/public/search/legacy/index.ts
+++ b/src/plugins/data/public/search/legacy/index.ts
@@ -18,4 +18,3 @@
  */
 
 export { fetchSoon } from './fetch_soon';
-export { getEsClient, LegacyApiCaller } from './es_client';
diff --git a/src/plugins/data/public/search/mocks.ts b/src/plugins/data/public/search/mocks.ts
index 8ccf46fe7c97d2..f4ed7d8b122b90 100644
--- a/src/plugins/data/public/search/mocks.ts
+++ b/src/plugins/data/public/search/mocks.ts
@@ -35,12 +35,6 @@ function createStartContract(): jest.Mocked<ISearchStart> {
     aggs: searchAggsStartMock(),
     search: jest.fn(),
     searchSource: searchSourceMock,
-    __LEGACY: {
-      esClient: {
-        search: jest.fn(),
-        msearch: jest.fn(),
-      },
-    },
   };
 }
 
diff --git a/src/plugins/data/public/search/search_interceptor.test.ts b/src/plugins/data/public/search/search_interceptor.test.ts
index 2eded17bda88c8..da60f39b522ac9 100644
--- a/src/plugins/data/public/search/search_interceptor.test.ts
+++ b/src/plugins/data/public/search/search_interceptor.test.ts
@@ -112,7 +112,9 @@ describe('SearchInterceptor', () => {
       const mockRequest: IEsSearchRequest = {
         params: {},
       };
-      const response = searchInterceptor.search(mockRequest, { signal: abortController.signal });
+      const response = searchInterceptor.search(mockRequest, {
+        abortSignal: abortController.signal,
+      });
 
       const next = jest.fn();
       const error = (e: any) => {
@@ -131,7 +133,7 @@ describe('SearchInterceptor', () => {
       const mockRequest: IEsSearchRequest = {
         params: {},
       };
-      const response = searchInterceptor.search(mockRequest, { signal: abort.signal });
+      const response = searchInterceptor.search(mockRequest, { abortSignal: abort.signal });
       abort.abort();
 
       const error = (e: any) => {
diff --git a/src/plugins/data/public/search/search_interceptor.ts b/src/plugins/data/public/search/search_interceptor.ts
index 30e509edd4987d..c6c03267163c9c 100644
--- a/src/plugins/data/public/search/search_interceptor.ts
+++ b/src/plugins/data/public/search/search_interceptor.ts
@@ -22,8 +22,12 @@ import { BehaviorSubject, throwError, timer, Subscription, defer, from, Observab
 import { finalize, filter } from 'rxjs/operators';
 import { Toast, CoreStart, ToastsSetup, CoreSetup } from 'kibana/public';
 import { getCombinedSignal, AbortError } from '../../common/utils';
-import { IEsSearchRequest, IEsSearchResponse, ES_SEARCH_STRATEGY } from '../../common/search';
-import { ISearchOptions } from './types';
+import {
+  IEsSearchRequest,
+  IEsSearchResponse,
+  ISearchOptions,
+  ES_SEARCH_STRATEGY,
+} from '../../common/search';
 import { getLongQueryNotification } from './long_query_notification';
 import { SearchUsageCollector } from './collectors';
 
@@ -128,7 +132,7 @@ export class SearchInterceptor {
   ): Observable<IEsSearchResponse> {
     // Defer the following logic until `subscribe` is actually called
     return defer(() => {
-      if (options?.signal?.aborted) {
+      if (options?.abortSignal?.aborted) {
         return throwError(new AbortError());
       }
 
@@ -164,7 +168,7 @@ export class SearchInterceptor {
     const signals = [
       this.abortController.signal,
       timeoutSignal,
-      ...(options?.signal ? [options.signal] : []),
+      ...(options?.abortSignal ? [options.abortSignal] : []),
     ];
 
     const combinedSignal = getCombinedSignal(signals);
diff --git a/src/plugins/data/public/search/search_service.ts b/src/plugins/data/public/search/search_service.ts
index 9a30a15936fe53..a49d2ef0956ffc 100644
--- a/src/plugins/data/public/search/search_service.ts
+++ b/src/plugins/data/public/search/search_service.ts
@@ -17,11 +17,11 @@
  * under the License.
  */
 
-import { Plugin, CoreSetup, CoreStart, PackageInfo } from 'src/core/public';
+import { Plugin, CoreSetup, CoreStart } from 'src/core/public';
+import { BehaviorSubject } from 'rxjs';
 import { ISearchSetup, ISearchStart, SearchEnhancements } from './types';
 
 import { createSearchSource, SearchSource, SearchSourceDependencies } from './search_source';
-import { getEsClient, LegacyApiCaller } from './legacy';
 import { AggsService, AggsStartDependencies } from './aggs';
 import { IndexPatternsContract } from '../index_patterns/index_patterns';
 import { ISearchInterceptor, SearchInterceptor } from './search_interceptor';
@@ -33,9 +33,8 @@ import { ExpressionsSetup } from '../../../expressions/public';
 
 /** @internal */
 export interface SearchServiceSetupDependencies {
-  packageInfo: PackageInfo;
-  usageCollection?: UsageCollectionSetup;
   expressions: ExpressionsSetup;
+  usageCollection?: UsageCollectionSetup;
 }
 
 /** @internal */
@@ -45,28 +44,18 @@ export interface SearchServiceStartDependencies {
 }
 
 export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
-  private esClient?: LegacyApiCaller;
   private readonly aggsService = new AggsService();
   private searchInterceptor!: ISearchInterceptor;
   private usageCollector?: SearchUsageCollector;
 
   public setup(
     { http, getStartServices, injectedMetadata, notifications, uiSettings }: CoreSetup,
-    { expressions, packageInfo, usageCollection }: SearchServiceSetupDependencies
+    { expressions, usageCollection }: SearchServiceSetupDependencies
   ): ISearchSetup {
-    const esApiVersion = injectedMetadata.getInjectedVar('esApiVersion') as string;
     const esRequestTimeout = injectedMetadata.getInjectedVar('esRequestTimeout') as number;
-    const packageVersion = packageInfo.version;
 
     this.usageCollector = createUsageCollector(getStartServices, usageCollection);
 
-    this.esClient = getEsClient({
-      esRequestTimeout,
-      esApiVersion,
-      http,
-      packageVersion,
-    });
-
     /**
      * A global object that intercepts all searches and provides convenience methods for cancelling
      * all pending search requests, as well as getting the number of pending search requests.
@@ -107,15 +96,16 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
       return this.searchInterceptor.search(request, options);
     }) as ISearchGeneric;
 
-    const legacySearch = {
-      esClient: this.esClient!,
-    };
+    const loadingCount$ = new BehaviorSubject(0);
+    http.addLoadingCountSource(loadingCount$);
 
     const searchSourceDependencies: SearchSourceDependencies = {
       getConfig: uiSettings.get.bind(uiSettings),
+      // TODO: we don't need this, apply on the server
       esShardTimeout: injectedMetadata.getInjectedVar('esShardTimeout') as number,
       search,
-      legacySearch,
+      http,
+      loadingCount$,
     };
 
     return {
@@ -127,7 +117,6 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
           return new SearchSource({}, searchSourceDependencies);
         },
       },
-      __LEGACY: legacySearch,
     };
   }
 
diff --git a/src/plugins/data/public/search/search_source/create_search_source.test.ts b/src/plugins/data/public/search/search_source/create_search_source.test.ts
index 56f6ca6c56270e..2820aab67ea3ab 100644
--- a/src/plugins/data/public/search/search_source/create_search_source.test.ts
+++ b/src/plugins/data/public/search/search_source/create_search_source.test.ts
@@ -22,7 +22,8 @@ import { SearchSourceDependencies } from './search_source';
 import { IIndexPattern } from '../../../common/index_patterns';
 import { IndexPatternsContract } from '../../index_patterns/index_patterns';
 import { Filter } from '../../../common/es_query/filters';
-import { dataPluginMock } from '../../mocks';
+import { coreMock } from '../../../../../core/public/mocks';
+import { BehaviorSubject } from 'rxjs';
 
 describe('createSearchSource', () => {
   const indexPatternMock: IIndexPattern = {} as IIndexPattern;
@@ -31,13 +32,12 @@ describe('createSearchSource', () => {
   let createSearchSource: ReturnType<typeof createSearchSourceFactory>;
 
   beforeEach(() => {
-    const data = dataPluginMock.createStartContract();
-
     dependencies = {
       getConfig: jest.fn(),
       search: jest.fn(),
-      legacySearch: data.search.__LEGACY,
       esShardTimeout: 30000,
+      http: coreMock.createStart().http,
+      loadingCount$: new BehaviorSubject(0),
     };
 
     indexPatternContractMock = ({
diff --git a/src/plugins/data/public/search/search_source/mocks.ts b/src/plugins/data/public/search/search_source/mocks.ts
index 4e1c35557ffa6c..bc3e287d9fe803 100644
--- a/src/plugins/data/public/search/search_source/mocks.ts
+++ b/src/plugins/data/public/search/search_source/mocks.ts
@@ -17,7 +17,8 @@
  * under the License.
  */
 
-import { uiSettingsServiceMock } from '../../../../../core/public/mocks';
+import { BehaviorSubject } from 'rxjs';
+import { httpServiceMock, uiSettingsServiceMock } from '../../../../../core/public/mocks';
 
 import { ISearchSource, SearchSource } from './search_source';
 import { SearchSourceFields } from './types';
@@ -54,10 +55,6 @@ export const createSearchSourceMock = (fields?: SearchSourceFields) =>
     getConfig: uiSettingsServiceMock.createStartContract().get,
     esShardTimeout: 30000,
     search: jest.fn(),
-    legacySearch: {
-      esClient: {
-        search: jest.fn(),
-        msearch: jest.fn(),
-      },
-    },
+    http: httpServiceMock.createStartContract(),
+    loadingCount$: new BehaviorSubject(0),
   });
diff --git a/src/plugins/data/public/search/search_source/search_source.test.ts b/src/plugins/data/public/search/search_source/search_source.test.ts
index 2f0fa0765e25a5..a8baed9faa84d2 100644
--- a/src/plugins/data/public/search/search_source/search_source.test.ts
+++ b/src/plugins/data/public/search/search_source/search_source.test.ts
@@ -17,12 +17,12 @@
  * under the License.
  */
 
-import { Observable } from 'rxjs';
+import { Observable, BehaviorSubject } from 'rxjs';
 import { GetConfigFn } from 'src/plugins/data/common';
 import { SearchSource, SearchSourceDependencies } from './search_source';
 import { IndexPattern, SortDirection } from '../..';
 import { fetchSoon } from '../legacy';
-import { dataPluginMock } from '../../../../data/public/mocks';
+import { coreMock } from '../../../../../core/public/mocks';
 
 jest.mock('../legacy', () => ({
   fetchSoon: jest.fn().mockResolvedValue({}),
@@ -54,8 +54,6 @@ describe('SearchSource', () => {
   let searchSourceDependencies: SearchSourceDependencies;
 
   beforeEach(() => {
-    const data = dataPluginMock.createStartContract();
-
     mockSearchMethod = jest.fn(() => {
       return new Observable((subscriber) => {
         setTimeout(() => {
@@ -70,8 +68,9 @@ describe('SearchSource', () => {
     searchSourceDependencies = {
       getConfig: jest.fn(),
       search: mockSearchMethod,
-      legacySearch: data.search.__LEGACY,
       esShardTimeout: 30000,
+      http: coreMock.createStart().http,
+      loadingCount$: new BehaviorSubject(0),
     };
   });
 
diff --git a/src/plugins/data/public/search/search_source/search_source.ts b/src/plugins/data/public/search/search_source/search_source.ts
index d2e33707620590..eec2d9b50eafe2 100644
--- a/src/plugins/data/public/search/search_source/search_source.ts
+++ b/src/plugins/data/public/search/search_source/search_source.ts
@@ -72,25 +72,31 @@
 import { setWith } from '@elastic/safer-lodash-set';
 import { uniqueId, uniq, extend, pick, difference, omit, isObject, keys, isFunction } from 'lodash';
 import { map } from 'rxjs/operators';
+import { HttpStart } from 'src/core/public';
+import { BehaviorSubject } from 'rxjs';
 import { normalizeSortRequest } from './normalize_sort_request';
 import { filterDocvalueFields } from './filter_docvalue_fields';
 import { fieldWildcardFilter } from '../../../../kibana_utils/common';
 import { IIndexPattern, ISearchGeneric } from '../..';
 import { SearchSourceOptions, SearchSourceFields } from './types';
 import {
-  FetchOptions,
   RequestFailure,
   handleResponse,
   getSearchParamsFromRequest,
   SearchRequest,
 } from '../fetch';
 
-import { getEsQueryConfig, buildEsQuery, Filter, UI_SETTINGS } from '../../../common';
+import {
+  getEsQueryConfig,
+  buildEsQuery,
+  Filter,
+  UI_SETTINGS,
+  ISearchOptions,
+} from '../../../common';
 import { getHighlightRequest } from '../../../common/field_formats';
 import { GetConfigFn } from '../../../common/types';
 import { fetchSoon } from '../legacy';
 import { extractReferences } from './extract_references';
-import { ISearchStartLegacy } from '../types';
 
 /** @internal */
 export const searchSourceRequiredUiSettings = [
@@ -111,8 +117,9 @@ export const searchSourceRequiredUiSettings = [
 export interface SearchSourceDependencies {
   getConfig: GetConfigFn;
   search: ISearchGeneric;
-  legacySearch: ISearchStartLegacy;
+  http: HttpStart;
   esShardTimeout: number;
+  loadingCount$: BehaviorSubject<number>;
 }
 
 /** @public **/
@@ -121,7 +128,7 @@ export class SearchSource {
   private searchStrategyId?: string;
   private parent?: SearchSource;
   private requestStartHandlers: Array<
-    (searchSource: SearchSource, options?: FetchOptions) => Promise<unknown>
+    (searchSource: SearchSource, options?: ISearchOptions) => Promise<unknown>
   > = [];
   private inheritOptions: SearchSourceOptions = {};
   public history: SearchRequest[] = [];
@@ -225,7 +232,7 @@ export class SearchSource {
    * Run a search using the search service
    * @return {Observable<SearchResponse<unknown>>}
    */
-  private fetch$(searchRequest: SearchRequest, signal?: AbortSignal) {
+  private fetch$(searchRequest: SearchRequest, options: ISearchOptions) {
     const { search, esShardTimeout, getConfig } = this.dependencies;
 
     const params = getSearchParamsFromRequest(searchRequest, {
@@ -233,7 +240,7 @@ export class SearchSource {
       getConfig,
     });
 
-    return search({ params, indexType: searchRequest.indexType }, { signal }).pipe(
+    return search({ params, indexType: searchRequest.indexType }, options).pipe(
       map(({ rawResponse }) => handleResponse(searchRequest, rawResponse))
     );
   }
@@ -242,8 +249,8 @@ export class SearchSource {
    * Run a search using the search service
    * @return {Promise<SearchResponse<unknown>>}
    */
-  private async legacyFetch(searchRequest: SearchRequest, options: FetchOptions) {
-    const { esShardTimeout, legacySearch, getConfig } = this.dependencies;
+  private async legacyFetch(searchRequest: SearchRequest, options: ISearchOptions) {
+    const { http, getConfig, loadingCount$ } = this.dependencies;
 
     return await fetchSoon(
       searchRequest,
@@ -252,9 +259,9 @@ export class SearchSource {
         ...options,
       },
       {
-        legacySearchService: legacySearch,
+        http,
         config: { get: getConfig },
-        esShardTimeout,
+        loadingCount$,
       }
     );
   }
@@ -263,7 +270,7 @@ export class SearchSource {
    *
    * @async
    */
-  async fetch(options: FetchOptions = {}) {
+  async fetch(options: ISearchOptions = {}) {
     const { getConfig } = this.dependencies;
     await this.requestIsStarting(options);
 
@@ -274,7 +281,7 @@ export class SearchSource {
     if (getConfig(UI_SETTINGS.COURIER_BATCH_SEARCHES)) {
       response = await this.legacyFetch(searchRequest, options);
     } else {
-      response = await this.fetch$(searchRequest, options.abortSignal).toPromise();
+      response = await this.fetch$(searchRequest, options).toPromise();
     }
 
     // TODO: Remove casting when https://github.com/elastic/elasticsearch-js/issues/1287 is resolved
@@ -291,7 +298,7 @@ export class SearchSource {
    *  @return {undefined}
    */
   onRequestStart(
-    handler: (searchSource: SearchSource, options?: FetchOptions) => Promise<unknown>
+    handler: (searchSource: SearchSource, options?: ISearchOptions) => Promise<unknown>
   ) {
     this.requestStartHandlers.push(handler);
   }
@@ -318,7 +325,7 @@ export class SearchSource {
    *  @param options
    *  @return {Promise<undefined>}
    */
-  private requestIsStarting(options: FetchOptions = {}) {
+  private requestIsStarting(options: ISearchOptions = {}) {
     const handlers = [...this.requestStartHandlers];
     // If callParentStartHandlers has been set to true, we also call all
     // handlers of parent search sources.
diff --git a/src/plugins/data/public/search/types.ts b/src/plugins/data/public/search/types.ts
index 55726e40f5a775..cec5c63294e967 100644
--- a/src/plugins/data/public/search/types.ts
+++ b/src/plugins/data/public/search/types.ts
@@ -19,7 +19,6 @@
 
 import { Observable } from 'rxjs';
 import { PackageInfo } from 'kibana/server';
-import { LegacyApiCaller } from './legacy/es_client';
 import { ISearchInterceptor } from './search_interceptor';
 import { ISearchSource, SearchSourceFields } from './search_source';
 import { SearchUsageCollector } from './collectors';
@@ -29,15 +28,11 @@ import {
   IKibanaSearchResponse,
   IEsSearchRequest,
   IEsSearchResponse,
+  ISearchOptions,
 } from '../../common/search';
 import { IndexPatternsContract } from '../../common/index_patterns/index_patterns';
 import { UsageCollectionSetup } from '../../../usage_collection/public';
 
-export interface ISearchOptions {
-  signal?: AbortSignal;
-  strategy?: string;
-}
-
 export type ISearch = (
   request: IKibanaSearchRequest,
   options?: ISearchOptions
@@ -51,10 +46,6 @@ export type ISearchGeneric = <
   options?: ISearchOptions
 ) => Observable<SearchStrategyResponse>;
 
-export interface ISearchStartLegacy {
-  esClient: LegacyApiCaller;
-}
-
 export interface SearchEnhancements {
   searchInterceptor: ISearchInterceptor;
 }
@@ -78,11 +69,6 @@ export interface ISearchStart {
     create: (fields?: SearchSourceFields) => Promise<ISearchSource>;
     createEmpty: () => ISearchSource;
   };
-  /**
-   * @deprecated
-   * @internal
-   */
-  __LEGACY: ISearchStartLegacy;
 }
 
 export { SEARCH_EVENT_TYPE } from './collectors';
diff --git a/src/plugins/data/public/test_utils.ts b/src/plugins/data/public/test_utils.ts
new file mode 100644
index 00000000000000..f04b20e96fa1da
--- /dev/null
+++ b/src/plugins/data/public/test_utils.ts
@@ -0,0 +1,20 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { getFieldFormatsRegistry } from './field_formats/field_formats_registry.stub';
diff --git a/src/plugins/data/public/ui/query_string_input/query_string_input.tsx b/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
index 86ee98b7af9d84..0bfac2a07a7eb3 100644
--- a/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
+++ b/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
@@ -17,10 +17,9 @@
  * under the License.
  */
 
-import { Component } from 'react';
-import React from 'react';
+import React, { Component, RefObject, createRef } from 'react';
 import { i18n } from '@kbn/i18n';
-
+import classNames from 'classnames';
 import {
   EuiTextArea,
   EuiOutsideClickDetector,
@@ -30,6 +29,7 @@ import {
   EuiButton,
   EuiLink,
   htmlIdGenerator,
+  EuiPortal,
 } from '@elastic/eui';
 
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -42,6 +42,7 @@ import { withKibana, KibanaReactContextValue, toMountPoint } from '../../../../k
 import { fetchIndexPatterns } from './fetch_index_patterns';
 import { QueryLanguageSwitcher } from './language_switcher';
 import { PersistedLog, getQueryLog, matchPairs, toUser, fromUser } from '../../query';
+import { SuggestionsListSize } from '../typeahead/suggestions_component';
 import { SuggestionsComponent } from '..';
 
 interface Props {
@@ -60,6 +61,8 @@ interface Props {
   onChangeQueryInputFocus?: (isFocused: boolean) => void;
   onSubmit?: (query: Query) => void;
   dataTestSubj?: string;
+  size?: SuggestionsListSize;
+  className?: string;
 }
 
 interface State {
@@ -70,6 +73,7 @@ interface State {
   selectionStart: number | null;
   selectionEnd: number | null;
   indexPatterns: IIndexPattern[];
+  queryBarRect: DOMRect | undefined;
 }
 
 const KEY_CODES = {
@@ -93,6 +97,7 @@ export class QueryStringInputUI extends Component<Props, State> {
     selectionStart: null,
     selectionEnd: null,
     indexPatterns: [],
+    queryBarRect: undefined,
   };
 
   public inputRef: HTMLTextAreaElement | null = null;
@@ -101,6 +106,7 @@ export class QueryStringInputUI extends Component<Props, State> {
   private abortController?: AbortController;
   private services = this.props.kibana.services;
   private componentIsUnmounting = false;
+  private queryBarInputDivRefInstance: RefObject<HTMLDivElement> = createRef();
 
   private getQueryString = () => {
     return toUser(this.props.query.query);
@@ -494,8 +500,13 @@ export class QueryStringInputUI extends Component<Props, State> {
 
     this.initPersistedLog();
     this.fetchIndexPatterns().then(this.updateSuggestions);
+    this.handleListUpdate();
 
     window.addEventListener('resize', this.handleAutoHeight);
+    window.addEventListener('scroll', this.handleListUpdate, {
+      passive: true, // for better performance as we won't call preventDefault
+      capture: true, // scroll events don't bubble, they must be captured instead
+    });
   }
 
   public componentDidUpdate(prevProps: Props) {
@@ -533,12 +544,19 @@ export class QueryStringInputUI extends Component<Props, State> {
     this.updateSuggestions.cancel();
     this.componentIsUnmounting = true;
     window.removeEventListener('resize', this.handleAutoHeight);
+    window.removeEventListener('scroll', this.handleListUpdate);
   }
 
+  handleListUpdate = () =>
+    this.setState({
+      queryBarRect: this.queryBarInputDivRefInstance.current?.getBoundingClientRect(),
+    });
+
   handleAutoHeight = () => {
     if (this.inputRef !== null && document.activeElement === this.inputRef) {
       this.inputRef.style.setProperty('height', `${this.inputRef.scrollHeight}px`, 'important');
     }
+    this.handleListUpdate();
   };
 
   handleRemoveHeight = () => {
@@ -569,9 +587,12 @@ export class QueryStringInputUI extends Component<Props, State> {
       'aria-owns': 'kbnTypeahead__items',
     };
     const ariaCombobox = { ...isSuggestionsVisible, role: 'combobox' };
-
+    const className = classNames(
+      'euiFormControlLayout euiFormControlLayout--group kbnQueryBar__wrap',
+      this.props.className
+    );
     return (
-      <div className="euiFormControlLayout euiFormControlLayout--group kbnQueryBar__wrap">
+      <div className={className}>
         {this.props.prepend}
         <EuiOutsideClickDetector onOutsideClick={this.onOutsideClick}>
           <div
@@ -587,6 +608,7 @@ export class QueryStringInputUI extends Component<Props, State> {
             <div
               role="search"
               className="euiFormControlLayout__childrenWrapper kuiLocalSearchAssistedInput"
+              ref={this.queryBarInputDivRefInstance}
             >
               <EuiTextArea
                 placeholder={
@@ -633,15 +655,18 @@ export class QueryStringInputUI extends Component<Props, State> {
                 {this.getQueryString()}
               </EuiTextArea>
             </div>
-
-            <SuggestionsComponent
-              show={this.state.isSuggestionsVisible}
-              suggestions={this.state.suggestions.slice(0, this.state.suggestionLimit)}
-              index={this.state.index}
-              onClick={this.onClickSuggestion}
-              onMouseEnter={this.onMouseEnterSuggestion}
-              loadMore={this.increaseLimit}
-            />
+            <EuiPortal>
+              <SuggestionsComponent
+                show={this.state.isSuggestionsVisible}
+                suggestions={this.state.suggestions.slice(0, this.state.suggestionLimit)}
+                index={this.state.index}
+                onClick={this.onClickSuggestion}
+                onMouseEnter={this.onMouseEnterSuggestion}
+                loadMore={this.increaseLimit}
+                queryBarRect={this.state.queryBarRect}
+                size={this.props.size}
+              />
+            </EuiPortal>
           </div>
         </EuiOutsideClickDetector>
 
diff --git a/src/plugins/data/public/ui/typeahead/__snapshots__/suggestions_component.test.tsx.snap b/src/plugins/data/public/ui/typeahead/__snapshots__/suggestions_component.test.tsx.snap
index 3b51c1db50d00c..2fa7834872f6b1 100644
--- a/src/plugins/data/public/ui/typeahead/__snapshots__/suggestions_component.test.tsx.snap
+++ b/src/plugins/data/public/ui/typeahead/__snapshots__/suggestions_component.test.tsx.snap
@@ -1,17 +1,21 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`SuggestionsComponent Passing the index should control which suggestion is selected 1`] = `
-<div
-  className="reactSuggestionTypeahead"
+<styled.div
+  queryBarRect={
+    Object {
+      "top": 0,
+    }
+  }
+  verticalListPosition="bottom: 768px;"
 >
   <div
     className="kbnTypeahead"
   >
     <div
-      className="kbnTypeahead__popover"
+      className="kbnTypeahead__popover kbnTypeahead__popover--top"
     >
       <div
-        className="kbnTypeahead__items"
         id="kbnTypeahead__items"
         onScroll={[Function]}
         role="listbox"
@@ -23,6 +27,7 @@ exports[`SuggestionsComponent Passing the index should control which suggestion
           onClick={[Function]}
           onMouseEnter={[Function]}
           selected={false}
+          shouldDisplayDescription={false}
           suggestion={
             Object {
               "description": "This is not a helpful suggestion",
@@ -40,6 +45,7 @@ exports[`SuggestionsComponent Passing the index should control which suggestion
           onClick={[Function]}
           onMouseEnter={[Function]}
           selected={true}
+          shouldDisplayDescription={false}
           suggestion={
             Object {
               "description": "This is another unhelpful suggestion",
@@ -53,21 +59,25 @@ exports[`SuggestionsComponent Passing the index should control which suggestion
       </div>
     </div>
   </div>
-</div>
+</styled.div>
 `;
 
 exports[`SuggestionsComponent Should display given suggestions if the show prop is true 1`] = `
-<div
-  className="reactSuggestionTypeahead"
+<styled.div
+  queryBarRect={
+    Object {
+      "top": 0,
+    }
+  }
+  verticalListPosition="bottom: 768px;"
 >
   <div
     className="kbnTypeahead"
   >
     <div
-      className="kbnTypeahead__popover"
+      className="kbnTypeahead__popover kbnTypeahead__popover--top"
     >
       <div
-        className="kbnTypeahead__items"
         id="kbnTypeahead__items"
         onScroll={[Function]}
         role="listbox"
@@ -79,6 +89,7 @@ exports[`SuggestionsComponent Should display given suggestions if the show prop
           onClick={[Function]}
           onMouseEnter={[Function]}
           selected={true}
+          shouldDisplayDescription={false}
           suggestion={
             Object {
               "description": "This is not a helpful suggestion",
@@ -96,6 +107,7 @@ exports[`SuggestionsComponent Should display given suggestions if the show prop
           onClick={[Function]}
           onMouseEnter={[Function]}
           selected={false}
+          shouldDisplayDescription={false}
           suggestion={
             Object {
               "description": "This is another unhelpful suggestion",
@@ -109,5 +121,5 @@ exports[`SuggestionsComponent Should display given suggestions if the show prop
       </div>
     </div>
   </div>
-</div>
+</styled.div>
 `;
diff --git a/src/plugins/data/public/ui/typeahead/_suggestion.scss b/src/plugins/data/public/ui/typeahead/_suggestion.scss
index 81c05f1a8a78c7..67ff17d017053e 100644
--- a/src/plugins/data/public/ui/typeahead/_suggestion.scss
+++ b/src/plugins/data/public/ui/typeahead/_suggestion.scss
@@ -6,28 +6,36 @@ $kbnTypeaheadTypes: (
   conjunction: $euiColorVis3,
 );
 
+.kbnTypeahead.kbnTypeahead--small {
+  max-height: 20vh;
+}
+
+.kbnTypeahead__popover--top {
+  @include euiBottomShadowFlat;
+  border-top-left-radius: $euiBorderRadius;
+  border-top-right-radius: $euiBorderRadius;
+}
+
+.kbnTypeahead__popover--bottom {
+  @include euiBottomShadow($adjustBorders: true);
+  border-bottom-left-radius: $euiBorderRadius;
+  border-bottom-right-radius: $euiBorderRadius;
+}
+
 .kbnTypeahead {
-  position: relative;
+  max-height: 60vh;
 
   .kbnTypeahead__popover {
-    @include euiBottomShadow($adjustBorders: true);
+    max-height: inherit;
+    @include euiScrollBar;
     border: 1px solid;
     border-color: $euiBorderColor;
     color: $euiTextColor;
     background-color: $euiColorEmptyShade;
-    position: absolute;
-    top: -2px;
+    position: relative;
     z-index: $euiZContentMenu;
     width: 100%;
-    border-bottom-left-radius: $euiBorderRadius;
-    border-bottom-right-radius: $euiBorderRadius;
-
-    .kbnTypeahead__items {
-      @include euiScrollBar;
-
-      max-height: 60vh;
-      overflow-y: auto;
-    }
+    overflow-y: auto;
 
     .kbnTypeahead__item {
       height: $euiSizeXL;
diff --git a/src/plugins/data/public/ui/typeahead/constants.ts b/src/plugins/data/public/ui/typeahead/constants.ts
new file mode 100644
index 00000000000000..08f9bd23e16f35
--- /dev/null
+++ b/src/plugins/data/public/ui/typeahead/constants.ts
@@ -0,0 +1,36 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Minimum width in px to display suggestion description correctly
+ * @public
+ */
+export const SUGGESTIONS_LIST_REQUIRED_WIDTH = 600;
+
+/**
+ * Minimum bottom distance in px to display list of suggestions
+ * @public
+ */
+export const SUGGESTIONS_LIST_REQUIRED_BOTTOM_SPACE = 250;
+
+/**
+ * A distance in px to display suggestions list right under the query input without a gap
+ * @public
+ */
+export const SUGGESTIONS_LIST_REQUIRED_TOP_OFFSET = 2;
diff --git a/src/plugins/data/public/ui/typeahead/suggestion_component.test.tsx b/src/plugins/data/public/ui/typeahead/suggestion_component.test.tsx
index 9fe33b003527e9..ba78bdd802601d 100644
--- a/src/plugins/data/public/ui/typeahead/suggestion_component.test.tsx
+++ b/src/plugins/data/public/ui/typeahead/suggestion_component.test.tsx
@@ -44,6 +44,7 @@ describe('SuggestionComponent', () => {
         suggestion={mockSuggestion}
         innerRef={noop}
         ariaId={'suggestion-1'}
+        shouldDisplayDescription={true}
       />
     );
 
@@ -59,6 +60,7 @@ describe('SuggestionComponent', () => {
         suggestion={mockSuggestion}
         innerRef={noop}
         ariaId={'suggestion-1'}
+        shouldDisplayDescription={true}
       />
     );
 
@@ -79,6 +81,7 @@ describe('SuggestionComponent', () => {
         suggestion={mockSuggestion}
         innerRef={innerRefCallback}
         ariaId={'suggestion-1'}
+        shouldDisplayDescription={true}
       />
     );
   });
@@ -94,6 +97,7 @@ describe('SuggestionComponent', () => {
         suggestion={mockSuggestion}
         innerRef={noop}
         ariaId={'suggestion-1'}
+        shouldDisplayDescription={true}
       />
     );
 
@@ -113,6 +117,7 @@ describe('SuggestionComponent', () => {
         suggestion={mockSuggestion}
         innerRef={noop}
         ariaId={'suggestion-1'}
+        shouldDisplayDescription={true}
       />
     );
 
diff --git a/src/plugins/data/public/ui/typeahead/suggestion_component.tsx b/src/plugins/data/public/ui/typeahead/suggestion_component.tsx
index b859428e6ed7ea..724287b874bf70 100644
--- a/src/plugins/data/public/ui/typeahead/suggestion_component.tsx
+++ b/src/plugins/data/public/ui/typeahead/suggestion_component.tsx
@@ -46,6 +46,7 @@ interface Props {
   suggestion: QuerySuggestion;
   innerRef: (node: HTMLDivElement) => void;
   ariaId: string;
+  shouldDisplayDescription: boolean;
 }
 
 export function SuggestionComponent(props: Props) {
@@ -72,7 +73,9 @@ export function SuggestionComponent(props: Props) {
           <EuiIcon type={getEuiIconType(props.suggestion.type)} />
         </div>
         <div className="kbnSuggestionItem__text">{props.suggestion.text}</div>
-        <div className="kbnSuggestionItem__description">{props.suggestion.description}</div>
+        {props.shouldDisplayDescription && (
+          <div className="kbnSuggestionItem__description">{props.suggestion.description}</div>
+        )}
       </div>
     </div>
   );
diff --git a/src/plugins/data/public/ui/typeahead/suggestions_component.test.tsx b/src/plugins/data/public/ui/typeahead/suggestions_component.test.tsx
index 011a729c6a6169..583940015c152a 100644
--- a/src/plugins/data/public/ui/typeahead/suggestions_component.test.tsx
+++ b/src/plugins/data/public/ui/typeahead/suggestions_component.test.tsx
@@ -54,6 +54,7 @@ describe('SuggestionsComponent', () => {
         show={false}
         suggestions={mockSuggestions}
         loadMore={noop}
+        queryBarRect={{ top: 0 } as DOMRect}
       />
     );
 
@@ -69,6 +70,7 @@ describe('SuggestionsComponent', () => {
         show={true}
         suggestions={[]}
         loadMore={noop}
+        queryBarRect={{ top: 0 } as DOMRect}
       />
     );
 
@@ -84,6 +86,7 @@ describe('SuggestionsComponent', () => {
         show={true}
         suggestions={mockSuggestions}
         loadMore={noop}
+        queryBarRect={{ top: 0 } as DOMRect}
       />
     );
 
@@ -100,6 +103,7 @@ describe('SuggestionsComponent', () => {
         show={true}
         suggestions={mockSuggestions}
         loadMore={noop}
+        queryBarRect={{ top: 0 } as DOMRect}
       />
     );
 
@@ -116,6 +120,7 @@ describe('SuggestionsComponent', () => {
         show={true}
         suggestions={mockSuggestions}
         loadMore={noop}
+        queryBarRect={{ top: 0 } as DOMRect}
       />
     );
 
@@ -134,6 +139,7 @@ describe('SuggestionsComponent', () => {
         show={true}
         suggestions={mockSuggestions}
         loadMore={noop}
+        queryBarRect={{ top: 0 } as DOMRect}
       />
     );
 
diff --git a/src/plugins/data/public/ui/typeahead/suggestions_component.tsx b/src/plugins/data/public/ui/typeahead/suggestions_component.tsx
index 77dd7dcec01ee6..dc7c55374f1d5f 100644
--- a/src/plugins/data/public/ui/typeahead/suggestions_component.tsx
+++ b/src/plugins/data/public/ui/typeahead/suggestions_component.tsx
@@ -19,8 +19,15 @@
 
 import { isEmpty } from 'lodash';
 import React, { Component } from 'react';
+import classNames from 'classnames';
+import styled from 'styled-components';
 import { QuerySuggestion } from '../../autocomplete';
 import { SuggestionComponent } from './suggestion_component';
+import {
+  SUGGESTIONS_LIST_REQUIRED_BOTTOM_SPACE,
+  SUGGESTIONS_LIST_REQUIRED_TOP_OFFSET,
+  SUGGESTIONS_LIST_REQUIRED_WIDTH,
+} from './constants';
 
 interface Props {
   index: number | null;
@@ -29,18 +36,24 @@ interface Props {
   show: boolean;
   suggestions: QuerySuggestion[];
   loadMore: () => void;
+  queryBarRect?: DOMRect;
+  size?: SuggestionsListSize;
 }
 
+export type SuggestionsListSize = 's' | 'l';
+
 export class SuggestionsComponent extends Component<Props> {
   private childNodes: HTMLDivElement[] = [];
   private parentNode: HTMLDivElement | null = null;
 
   public render() {
-    if (!this.props.show || isEmpty(this.props.suggestions)) {
+    if (!this.props.queryBarRect || !this.props.show || isEmpty(this.props.suggestions)) {
       return null;
     }
 
     const suggestions = this.props.suggestions.map((suggestion, index) => {
+      const isDescriptionFittable =
+        this.props.queryBarRect!.width >= SUGGESTIONS_LIST_REQUIRED_WIDTH;
       return (
         <SuggestionComponent
           innerRef={(node) => (this.childNodes[index] = node)}
@@ -50,17 +63,38 @@ export class SuggestionsComponent extends Component<Props> {
           onMouseEnter={() => this.props.onMouseEnter(index)}
           ariaId={'suggestion-' + index}
           key={`${suggestion.type} - ${suggestion.text}`}
+          shouldDisplayDescription={isDescriptionFittable}
         />
       );
     });
 
+    const documentHeight = document.documentElement.clientHeight || window.innerHeight;
+    const { queryBarRect } = this.props;
+
+    // reflects if the suggestions list has enough space below to be opened down
+    const isSuggestionsListFittable =
+      documentHeight - (queryBarRect.top + queryBarRect.height) >
+      SUGGESTIONS_LIST_REQUIRED_BOTTOM_SPACE;
+    const verticalListPosition = isSuggestionsListFittable
+      ? `top: ${window.scrollY + queryBarRect.bottom - SUGGESTIONS_LIST_REQUIRED_TOP_OFFSET}px;`
+      : `bottom: ${documentHeight - (window.scrollY + queryBarRect.top)}px;`;
+
     return (
-      <div className="reactSuggestionTypeahead">
-        <div className="kbnTypeahead">
-          <div className="kbnTypeahead__popover">
+      <StyledSuggestionsListDiv
+        queryBarRect={queryBarRect}
+        verticalListPosition={verticalListPosition}
+      >
+        <div
+          className={classNames('kbnTypeahead', { 'kbnTypeahead--small': this.props.size === 's' })}
+        >
+          <div
+            className={classNames('kbnTypeahead__popover', {
+              ['kbnTypeahead__popover--bottom']: isSuggestionsListFittable,
+              ['kbnTypeahead__popover--top']: !isSuggestionsListFittable,
+            })}
+          >
             <div
               id="kbnTypeahead__items"
-              className="kbnTypeahead__items"
               role="listbox"
               ref={(node) => (this.parentNode = node)}
               onScroll={this.handleScroll}
@@ -69,7 +103,7 @@ export class SuggestionsComponent extends Component<Props> {
             </div>
           </div>
         </div>
-      </div>
+      </StyledSuggestionsListDiv>
     );
   }
 
@@ -116,3 +150,11 @@ export class SuggestionsComponent extends Component<Props> {
     }
   };
 }
+
+const StyledSuggestionsListDiv = styled.div`
+  ${(props: { queryBarRect: DOMRect; verticalListPosition: string }) => `
+      position: absolute;
+      left: ${props.queryBarRect.left}px;
+      width: ${props.queryBarRect.width}px;
+      ${props.verticalListPosition}`}
+`;
diff --git a/src/plugins/data/server/index.ts b/src/plugins/data/server/index.ts
index c3b06992dba0e2..71ed83290e6975 100644
--- a/src/plugins/data/server/index.ts
+++ b/src/plugins/data/server/index.ts
@@ -198,8 +198,10 @@ export {
   OptionedValueProp,
   ParsedInterval,
   // search
+  ISearchOptions,
   IEsSearchRequest,
   IEsSearchResponse,
+  ES_SEARCH_STRATEGY,
   // tabify
   TabbedAggColumn,
   TabbedAggRow,
@@ -208,7 +210,6 @@ export {
 
 export {
   ISearchStrategy,
-  ISearchOptions,
   ISearchSetup,
   ISearchStart,
   getDefaultSearchParams,
diff --git a/src/plugins/data/server/search/index.ts b/src/plugins/data/server/search/index.ts
index 02c21c32546457..8a74c51f52f510 100644
--- a/src/plugins/data/server/search/index.ts
+++ b/src/plugins/data/server/search/index.ts
@@ -17,13 +17,7 @@
  * under the License.
  */
 
-export {
-  ISearchStrategy,
-  ISearchOptions,
-  ISearchSetup,
-  ISearchStart,
-  SearchEnhancements,
-} from './types';
+export { ISearchStrategy, ISearchSetup, ISearchStart, SearchEnhancements } from './types';
 
 export { getDefaultSearchParams, getTotalLoaded } from './es_search';
 
diff --git a/src/plugins/data/server/search/routes.test.ts b/src/plugins/data/server/search/routes.test.ts
deleted file mode 100644
index d91aeee1fe8186..00000000000000
--- a/src/plugins/data/server/search/routes.test.ts
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { CoreSetup, RequestHandlerContext } from '../../../../../src/core/server';
-import { coreMock, httpServerMock } from '../../../../../src/core/server/mocks';
-import { registerSearchRoute } from './routes';
-import { DataPluginStart } from '../plugin';
-import { dataPluginMock } from '../mocks';
-
-describe('Search service', () => {
-  let mockDataStart: MockedKeys<DataPluginStart>;
-  let mockCoreSetup: MockedKeys<CoreSetup<object, DataPluginStart>>;
-
-  beforeEach(() => {
-    mockDataStart = dataPluginMock.createStartContract();
-    mockCoreSetup = coreMock.createSetup({ pluginStartContract: mockDataStart });
-  });
-
-  it('handler calls context.search.search with the given request and strategy', async () => {
-    const response = { id: 'yay' };
-    mockDataStart.search.search.mockResolvedValue(response);
-    const mockContext = {};
-    const mockBody = { id: undefined, params: {} };
-    const mockParams = { strategy: 'foo' };
-    const mockRequest = httpServerMock.createKibanaRequest({
-      body: mockBody,
-      params: mockParams,
-    });
-    const mockResponse = httpServerMock.createResponseFactory();
-
-    registerSearchRoute(mockCoreSetup);
-
-    const mockRouter = mockCoreSetup.http.createRouter.mock.results[0].value;
-    const handler = mockRouter.post.mock.calls[0][1];
-    await handler((mockContext as unknown) as RequestHandlerContext, mockRequest, mockResponse);
-
-    expect(mockDataStart.search.search).toBeCalled();
-    expect(mockDataStart.search.search.mock.calls[0][1]).toStrictEqual(mockBody);
-    expect(mockResponse.ok).toBeCalled();
-    expect(mockResponse.ok.mock.calls[0][0]).toEqual({
-      body: response,
-    });
-  });
-
-  it('handler throws an error if the search throws an error', async () => {
-    mockDataStart.search.search.mockRejectedValue({
-      message: 'oh no',
-      body: {
-        error: 'oops',
-      },
-    });
-
-    const mockContext = {};
-    const mockBody = { id: undefined, params: {} };
-    const mockParams = { strategy: 'foo' };
-    const mockRequest = httpServerMock.createKibanaRequest({
-      body: mockBody,
-      params: mockParams,
-    });
-    const mockResponse = httpServerMock.createResponseFactory();
-
-    registerSearchRoute(mockCoreSetup);
-
-    const mockRouter = mockCoreSetup.http.createRouter.mock.results[0].value;
-    const handler = mockRouter.post.mock.calls[0][1];
-    await handler((mockContext as unknown) as RequestHandlerContext, mockRequest, mockResponse);
-
-    expect(mockDataStart.search.search).toBeCalled();
-    expect(mockDataStart.search.search.mock.calls[0][1]).toStrictEqual(mockBody);
-    expect(mockResponse.customError).toBeCalled();
-    const error: any = mockResponse.customError.mock.calls[0][0];
-    expect(error.body.message).toBe('oh no');
-    expect(error.body.attributes.error).toBe('oops');
-  });
-});
diff --git a/src/plugins/data/server/search/routes.ts b/src/plugins/data/server/search/routes.ts
deleted file mode 100644
index 3d813f745305f2..00000000000000
--- a/src/plugins/data/server/search/routes.ts
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { schema } from '@kbn/config-schema';
-import { CoreSetup } from '../../../../core/server';
-import { getRequestAbortedSignal } from '../lib';
-import { DataPluginStart } from '../plugin';
-
-export function registerSearchRoute(core: CoreSetup<object, DataPluginStart>): void {
-  const router = core.http.createRouter();
-
-  router.post(
-    {
-      path: '/internal/search/{strategy}/{id?}',
-      validate: {
-        params: schema.object({
-          strategy: schema.string(),
-          id: schema.maybe(schema.string()),
-        }),
-
-        query: schema.object({}, { unknowns: 'allow' }),
-
-        body: schema.object({}, { unknowns: 'allow' }),
-      },
-    },
-    async (context, request, res) => {
-      const searchRequest = request.body;
-      const { strategy, id } = request.params;
-      const signal = getRequestAbortedSignal(request.events.aborted$);
-
-      const [, , selfStart] = await core.getStartServices();
-
-      try {
-        const response = await selfStart.search.search(
-          context,
-          { ...searchRequest, id },
-          {
-            signal,
-            strategy,
-          }
-        );
-        return res.ok({ body: response });
-      } catch (err) {
-        return res.customError({
-          statusCode: err.statusCode || 500,
-          body: {
-            message: err.message,
-            attributes: {
-              error: err.body?.error || err.message,
-            },
-          },
-        });
-      }
-    }
-  );
-
-  router.delete(
-    {
-      path: '/internal/search/{strategy}/{id}',
-      validate: {
-        params: schema.object({
-          strategy: schema.string(),
-          id: schema.string(),
-        }),
-
-        query: schema.object({}, { unknowns: 'allow' }),
-      },
-    },
-    async (context, request, res) => {
-      const { strategy, id } = request.params;
-
-      const [, , selfStart] = await core.getStartServices();
-      const searchStrategy = selfStart.search.getSearchStrategy(strategy);
-      if (!searchStrategy.cancel) return res.ok();
-
-      try {
-        await searchStrategy.cancel(context, id);
-        return res.ok();
-      } catch (err) {
-        return res.customError({
-          statusCode: err.statusCode,
-          body: {
-            message: err.message,
-            attributes: {
-              error: err.body.error,
-            },
-          },
-        });
-      }
-    }
-  );
-}
diff --git a/src/plugins/data/server/search/routes/index.ts b/src/plugins/data/server/search/routes/index.ts
new file mode 100644
index 00000000000000..2217890ff778e7
--- /dev/null
+++ b/src/plugins/data/server/search/routes/index.ts
@@ -0,0 +1,21 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export * from './msearch';
+export * from './search';
diff --git a/src/plugins/data/server/search/routes/msearch.test.ts b/src/plugins/data/server/search/routes/msearch.test.ts
new file mode 100644
index 00000000000000..0a52cf23c54728
--- /dev/null
+++ b/src/plugins/data/server/search/routes/msearch.test.ts
@@ -0,0 +1,150 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Observable } from 'rxjs';
+
+import {
+  CoreSetup,
+  RequestHandlerContext,
+  SharedGlobalConfig,
+  StartServicesAccessor,
+} from 'src/core/server';
+import {
+  coreMock,
+  httpServerMock,
+  pluginInitializerContextConfigMock,
+} from '../../../../../../src/core/server/mocks';
+import { registerMsearchRoute, convertRequestBody } from './msearch';
+import { DataPluginStart } from '../../plugin';
+import { dataPluginMock } from '../../mocks';
+
+describe('msearch route', () => {
+  let mockDataStart: MockedKeys<DataPluginStart>;
+  let mockCoreSetup: MockedKeys<CoreSetup<{}, DataPluginStart>>;
+  let getStartServices: jest.Mocked<StartServicesAccessor<{}, DataPluginStart>>;
+  let globalConfig$: Observable<SharedGlobalConfig>;
+
+  beforeEach(() => {
+    mockDataStart = dataPluginMock.createStartContract();
+    mockCoreSetup = coreMock.createSetup({ pluginStartContract: mockDataStart });
+    getStartServices = mockCoreSetup.getStartServices;
+    globalConfig$ = pluginInitializerContextConfigMock({}).legacy.globalConfig$;
+  });
+
+  it('handler calls /_msearch with the given request', async () => {
+    const response = { id: 'yay' };
+    const mockClient = { transport: { request: jest.fn().mockResolvedValue(response) } };
+    const mockContext = {
+      core: {
+        elasticsearch: { client: { asCurrentUser: mockClient } },
+        uiSettings: { client: { get: jest.fn() } },
+      },
+    };
+    const mockBody = { searches: [{ header: {}, body: {} }] };
+    const mockQuery = {};
+    const mockRequest = httpServerMock.createKibanaRequest({
+      body: mockBody,
+      query: mockQuery,
+    });
+    const mockResponse = httpServerMock.createResponseFactory();
+
+    registerMsearchRoute(mockCoreSetup.http.createRouter(), { getStartServices, globalConfig$ });
+
+    const mockRouter = mockCoreSetup.http.createRouter.mock.results[0].value;
+    const handler = mockRouter.post.mock.calls[0][1];
+    await handler((mockContext as unknown) as RequestHandlerContext, mockRequest, mockResponse);
+
+    expect(mockClient.transport.request.mock.calls[0][0].method).toBe('GET');
+    expect(mockClient.transport.request.mock.calls[0][0].path).toBe('/_msearch');
+    expect(mockClient.transport.request.mock.calls[0][0].body).toEqual(
+      convertRequestBody(mockBody as any, { timeout: '0ms' })
+    );
+    expect(mockResponse.ok).toBeCalled();
+    expect(mockResponse.ok.mock.calls[0][0]).toEqual({
+      body: response,
+    });
+  });
+
+  it('handler throws an error if the search throws an error', async () => {
+    const response = {
+      message: 'oh no',
+      body: {
+        error: 'oops',
+      },
+    };
+    const mockClient = {
+      transport: { request: jest.fn().mockReturnValue(Promise.reject(response)) },
+    };
+    const mockContext = {
+      core: {
+        elasticsearch: { client: { asCurrentUser: mockClient } },
+        uiSettings: { client: { get: jest.fn() } },
+      },
+    };
+    const mockBody = { searches: [{ header: {}, body: {} }] };
+    const mockQuery = {};
+    const mockRequest = httpServerMock.createKibanaRequest({
+      body: mockBody,
+      query: mockQuery,
+    });
+    const mockResponse = httpServerMock.createResponseFactory();
+
+    registerMsearchRoute(mockCoreSetup.http.createRouter(), { getStartServices, globalConfig$ });
+
+    const mockRouter = mockCoreSetup.http.createRouter.mock.results[0].value;
+    const handler = mockRouter.post.mock.calls[0][1];
+    await handler((mockContext as unknown) as RequestHandlerContext, mockRequest, mockResponse);
+
+    expect(mockClient.transport.request).toBeCalled();
+    expect(mockResponse.customError).toBeCalled();
+
+    const error: any = mockResponse.customError.mock.calls[0][0];
+    expect(error.body.message).toBe('oh no');
+    expect(error.body.attributes.error).toBe('oops');
+  });
+
+  describe('convertRequestBody', () => {
+    it('combines header & body into proper msearch request', () => {
+      const request = {
+        searches: [{ header: { index: 'foo', preference: 0 }, body: { test: true } }],
+      };
+      expect(convertRequestBody(request, { timeout: '30000ms' })).toMatchInlineSnapshot(`
+        "{\\"ignore_unavailable\\":true,\\"index\\":\\"foo\\",\\"preference\\":0}
+        {\\"timeout\\":\\"30000ms\\",\\"test\\":true}
+        "
+      `);
+    });
+
+    it('handles multiple searches', () => {
+      const request = {
+        searches: [
+          { header: { index: 'foo', preference: 0 }, body: { test: true } },
+          { header: { index: 'bar', preference: 1 }, body: { hello: 'world' } },
+        ],
+      };
+      expect(convertRequestBody(request, { timeout: '30000ms' })).toMatchInlineSnapshot(`
+        "{\\"ignore_unavailable\\":true,\\"index\\":\\"foo\\",\\"preference\\":0}
+        {\\"timeout\\":\\"30000ms\\",\\"test\\":true}
+        {\\"ignore_unavailable\\":true,\\"index\\":\\"bar\\",\\"preference\\":1}
+        {\\"timeout\\":\\"30000ms\\",\\"hello\\":\\"world\\"}
+        "
+      `);
+    });
+  });
+});
diff --git a/src/plugins/data/server/search/routes/msearch.ts b/src/plugins/data/server/search/routes/msearch.ts
new file mode 100644
index 00000000000000..efb40edd90d583
--- /dev/null
+++ b/src/plugins/data/server/search/routes/msearch.ts
@@ -0,0 +1,136 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { first } from 'rxjs/operators';
+import { schema } from '@kbn/config-schema';
+
+import { IRouter } from 'src/core/server';
+import { UI_SETTINGS } from '../../../common';
+import { SearchRouteDependencies } from '../search_service';
+import { getDefaultSearchParams } from '..';
+
+interface MsearchHeaders {
+  index: string;
+  preference?: number | string;
+}
+
+interface MsearchRequest {
+  header: MsearchHeaders;
+  body: any;
+}
+
+interface RequestBody {
+  searches: MsearchRequest[];
+}
+
+/** @internal */
+export function convertRequestBody(
+  requestBody: RequestBody,
+  { timeout }: { timeout?: string }
+): string {
+  return requestBody.searches.reduce((req, curr) => {
+    const header = JSON.stringify({
+      ignore_unavailable: true,
+      ...curr.header,
+    });
+    const body = JSON.stringify({
+      timeout,
+      ...curr.body,
+    });
+    return `${req}${header}\n${body}\n`;
+  }, '');
+}
+
+/**
+ * The msearch route takes in an array of searches, each consisting of header
+ * and body json, and reformts them into a single request for the _msearch API.
+ *
+ * The reason for taking requests in a different format is so that we can
+ * inject values into each request without needing to manually parse each one.
+ *
+ * This route is internal and _should not be used_ in any new areas of code.
+ * It only exists as a means of removing remaining dependencies on the
+ * legacy ES client.
+ *
+ * @deprecated
+ */
+export function registerMsearchRoute(router: IRouter, deps: SearchRouteDependencies): void {
+  router.post(
+    {
+      path: '/internal/_msearch',
+      validate: {
+        body: schema.object({
+          searches: schema.arrayOf(
+            schema.object({
+              header: schema.object(
+                {
+                  index: schema.string(),
+                  preference: schema.maybe(schema.oneOf([schema.number(), schema.string()])),
+                },
+                { unknowns: 'allow' }
+              ),
+              body: schema.object({}, { unknowns: 'allow' }),
+            })
+          ),
+        }),
+      },
+    },
+    async (context, request, res) => {
+      const client = context.core.elasticsearch.client.asCurrentUser;
+
+      // get shardTimeout
+      const config = await deps.globalConfig$.pipe(first()).toPromise();
+      const { timeout } = getDefaultSearchParams(config);
+
+      const body = convertRequestBody(request.body, { timeout });
+
+      try {
+        const ignoreThrottled = !(await context.core.uiSettings.client.get(
+          UI_SETTINGS.SEARCH_INCLUDE_FROZEN
+        ));
+        const maxConcurrentShardRequests = await context.core.uiSettings.client.get(
+          UI_SETTINGS.COURIER_MAX_CONCURRENT_SHARD_REQUESTS
+        );
+        const response = await client.transport.request({
+          method: 'GET',
+          path: '/_msearch',
+          body,
+          querystring: {
+            rest_total_hits_as_int: true,
+            ignore_throttled: ignoreThrottled,
+            max_concurrent_shard_requests:
+              maxConcurrentShardRequests > 0 ? maxConcurrentShardRequests : undefined,
+          },
+        });
+
+        return res.ok({ body: response });
+      } catch (err) {
+        return res.customError({
+          statusCode: err.statusCode || 500,
+          body: {
+            message: err.message,
+            attributes: {
+              error: err.body?.error || err.message,
+            },
+          },
+        });
+      }
+    }
+  );
+}
diff --git a/src/plugins/data/server/search/routes/search.test.ts b/src/plugins/data/server/search/routes/search.test.ts
new file mode 100644
index 00000000000000..d4404c318ab47a
--- /dev/null
+++ b/src/plugins/data/server/search/routes/search.test.ts
@@ -0,0 +1,123 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Observable } from 'rxjs';
+
+import {
+  CoreSetup,
+  RequestHandlerContext,
+  SharedGlobalConfig,
+  StartServicesAccessor,
+} from 'src/core/server';
+import {
+  coreMock,
+  httpServerMock,
+  pluginInitializerContextConfigMock,
+} from '../../../../../../src/core/server/mocks';
+import { registerSearchRoute } from './search';
+import { DataPluginStart } from '../../plugin';
+import { dataPluginMock } from '../../mocks';
+
+describe('Search service', () => {
+  let mockDataStart: MockedKeys<DataPluginStart>;
+  let mockCoreSetup: MockedKeys<CoreSetup<{}, DataPluginStart>>;
+  let getStartServices: jest.Mocked<StartServicesAccessor<{}, DataPluginStart>>;
+  let globalConfig$: Observable<SharedGlobalConfig>;
+
+  beforeEach(() => {
+    mockDataStart = dataPluginMock.createStartContract();
+    mockCoreSetup = coreMock.createSetup({ pluginStartContract: mockDataStart });
+    getStartServices = mockCoreSetup.getStartServices;
+    globalConfig$ = pluginInitializerContextConfigMock({}).legacy.globalConfig$;
+  });
+
+  it('handler calls context.search.search with the given request and strategy', async () => {
+    const response = {
+      id: 'yay',
+      rawResponse: {
+        took: 100,
+        timed_out: true,
+        _shards: {
+          total: 0,
+          successful: 0,
+          failed: 0,
+          skipped: 0,
+        },
+        hits: {
+          total: 0,
+          max_score: 0,
+          hits: [],
+        },
+      },
+    };
+    mockDataStart.search.search.mockResolvedValue(response);
+    const mockContext = {};
+    const mockBody = { id: undefined, params: {} };
+    const mockParams = { strategy: 'foo' };
+    const mockRequest = httpServerMock.createKibanaRequest({
+      body: mockBody,
+      params: mockParams,
+    });
+    const mockResponse = httpServerMock.createResponseFactory();
+
+    registerSearchRoute(mockCoreSetup.http.createRouter(), { getStartServices, globalConfig$ });
+
+    const mockRouter = mockCoreSetup.http.createRouter.mock.results[0].value;
+    const handler = mockRouter.post.mock.calls[0][1];
+    await handler((mockContext as unknown) as RequestHandlerContext, mockRequest, mockResponse);
+
+    expect(mockDataStart.search.search).toBeCalled();
+    expect(mockDataStart.search.search.mock.calls[0][1]).toStrictEqual(mockBody);
+    expect(mockResponse.ok).toBeCalled();
+    expect(mockResponse.ok.mock.calls[0][0]).toEqual({
+      body: response,
+    });
+  });
+
+  it('handler throws an error if the search throws an error', async () => {
+    mockDataStart.search.search.mockRejectedValue({
+      message: 'oh no',
+      body: {
+        error: 'oops',
+      },
+    });
+
+    const mockContext = {};
+    const mockBody = { id: undefined, params: {} };
+    const mockParams = { strategy: 'foo' };
+    const mockRequest = httpServerMock.createKibanaRequest({
+      body: mockBody,
+      params: mockParams,
+    });
+    const mockResponse = httpServerMock.createResponseFactory();
+
+    registerSearchRoute(mockCoreSetup.http.createRouter(), { getStartServices, globalConfig$ });
+
+    const mockRouter = mockCoreSetup.http.createRouter.mock.results[0].value;
+    const handler = mockRouter.post.mock.calls[0][1];
+    await handler((mockContext as unknown) as RequestHandlerContext, mockRequest, mockResponse);
+
+    expect(mockDataStart.search.search).toBeCalled();
+    expect(mockDataStart.search.search.mock.calls[0][1]).toStrictEqual(mockBody);
+    expect(mockResponse.customError).toBeCalled();
+    const error: any = mockResponse.customError.mock.calls[0][0];
+    expect(error.body.message).toBe('oh no');
+    expect(error.body.attributes.error).toBe('oops');
+  });
+});
diff --git a/src/plugins/data/server/search/routes/search.ts b/src/plugins/data/server/search/routes/search.ts
new file mode 100644
index 00000000000000..4340285583489b
--- /dev/null
+++ b/src/plugins/data/server/search/routes/search.ts
@@ -0,0 +1,109 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { IRouter } from 'src/core/server';
+import { getRequestAbortedSignal } from '../../lib';
+import { SearchRouteDependencies } from '../search_service';
+
+export function registerSearchRoute(
+  router: IRouter,
+  { getStartServices }: SearchRouteDependencies
+): void {
+  router.post(
+    {
+      path: '/internal/search/{strategy}/{id?}',
+      validate: {
+        params: schema.object({
+          strategy: schema.string(),
+          id: schema.maybe(schema.string()),
+        }),
+
+        query: schema.object({}, { unknowns: 'allow' }),
+
+        body: schema.object({}, { unknowns: 'allow' }),
+      },
+    },
+    async (context, request, res) => {
+      const searchRequest = request.body;
+      const { strategy, id } = request.params;
+      const abortSignal = getRequestAbortedSignal(request.events.aborted$);
+
+      const [, , selfStart] = await getStartServices();
+
+      try {
+        const response = await selfStart.search.search(
+          context,
+          { ...searchRequest, id },
+          {
+            abortSignal,
+            strategy,
+          }
+        );
+        return res.ok({ body: response });
+      } catch (err) {
+        return res.customError({
+          statusCode: err.statusCode || 500,
+          body: {
+            message: err.message,
+            attributes: {
+              error: err.body?.error || err.message,
+            },
+          },
+        });
+      }
+    }
+  );
+
+  router.delete(
+    {
+      path: '/internal/search/{strategy}/{id}',
+      validate: {
+        params: schema.object({
+          strategy: schema.string(),
+          id: schema.string(),
+        }),
+
+        query: schema.object({}, { unknowns: 'allow' }),
+      },
+    },
+    async (context, request, res) => {
+      const { strategy, id } = request.params;
+
+      const [, , selfStart] = await getStartServices();
+      const searchStrategy = selfStart.search.getSearchStrategy(strategy);
+      if (!searchStrategy.cancel) return res.ok();
+
+      try {
+        await searchStrategy.cancel(context, id);
+        return res.ok();
+      } catch (err) {
+        return res.customError({
+          statusCode: err.statusCode,
+          body: {
+            message: err.message,
+            attributes: {
+              error: err.body.error,
+            },
+          },
+        });
+      }
+    }
+  );
+}
diff --git a/src/plugins/data/server/search/search_service.ts b/src/plugins/data/server/search/search_service.ts
index edc94961c79d87..e19d3dd8a5451c 100644
--- a/src/plugins/data/server/search/search_service.ts
+++ b/src/plugins/data/server/search/search_service.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { Observable } from 'rxjs';
 import {
   CoreSetup,
   CoreStart,
@@ -24,20 +25,22 @@ import {
   Plugin,
   PluginInitializerContext,
   RequestHandlerContext,
-} from '../../../../core/server';
+  SharedGlobalConfig,
+  StartServicesAccessor,
+} from 'src/core/server';
 import { ISearchSetup, ISearchStart, ISearchStrategy, SearchEnhancements } from './types';
 
 import { AggsService, AggsSetupDependencies } from './aggs';
 
 import { FieldFormatsStart } from '../field_formats';
-import { registerSearchRoute } from './routes';
+import { registerMsearchRoute, registerSearchRoute } from './routes';
 import { ES_SEARCH_STRATEGY, esSearchStrategyProvider } from './es_search';
 import { DataPluginStart } from '../plugin';
 import { UsageCollectionSetup } from '../../../usage_collection/server';
 import { registerUsageCollector } from './collectors/register';
 import { usageProvider } from './collectors/usage';
 import { searchTelemetry } from '../saved_objects';
-import { IEsSearchRequest, IEsSearchResponse } from '../../common';
+import { IEsSearchRequest, IEsSearchResponse, ISearchOptions } from '../../common';
 
 type StrategyMap<
   SearchStrategyRequest extends IEsSearchRequest = IEsSearchRequest,
@@ -55,6 +58,12 @@ export interface SearchServiceStartDependencies {
   fieldFormats: FieldFormatsStart;
 }
 
+/** @internal */
+export interface SearchRouteDependencies {
+  getStartServices: StartServicesAccessor<{}, DataPluginStart>;
+  globalConfig$: Observable<SharedGlobalConfig>;
+}
+
 export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
   private readonly aggsService = new AggsService();
   private defaultSearchStrategyName: string = ES_SEARCH_STRATEGY;
@@ -66,11 +75,19 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
   ) {}
 
   public setup(
-    core: CoreSetup<object, DataPluginStart>,
+    core: CoreSetup<{}, DataPluginStart>,
     { registerFunction, usageCollection }: SearchServiceSetupDependencies
   ): ISearchSetup {
     const usage = usageCollection ? usageProvider(core) : undefined;
 
+    const router = core.http.createRouter();
+    const routeDependencies = {
+      getStartServices: core.getStartServices,
+      globalConfig$: this.initializerContext.config.legacy.globalConfig$,
+    };
+    registerSearchRoute(router, routeDependencies);
+    registerMsearchRoute(router, routeDependencies);
+
     this.registerSearchStrategy(
       ES_SEARCH_STRATEGY,
       esSearchStrategyProvider(
@@ -85,8 +102,6 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
       registerUsageCollector(usageCollection, this.initializerContext);
     }
 
-    registerSearchRoute(core);
-
     return {
       __enhance: (enhancements: SearchEnhancements) => {
         if (this.searchStrategies.hasOwnProperty(enhancements.defaultStrategy)) {
@@ -102,11 +117,13 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
   private search(
     context: RequestHandlerContext,
     searchRequest: IEsSearchRequest,
-    options: Record<string, any>
+    options: ISearchOptions
   ) {
-    return this.getSearchStrategy(
-      options.strategy || this.defaultSearchStrategyName
-    ).search(context, searchRequest, { signal: options.signal });
+    return this.getSearchStrategy(options.strategy || this.defaultSearchStrategyName).search(
+      context,
+      searchRequest,
+      options
+    );
   }
 
   public start(
diff --git a/src/plugins/data/server/search/types.ts b/src/plugins/data/server/search/types.ts
index 5ce1bb3e6b9f80..b2b958454de48b 100644
--- a/src/plugins/data/server/search/types.ts
+++ b/src/plugins/data/server/search/types.ts
@@ -18,7 +18,7 @@
  */
 
 import { RequestHandlerContext } from '../../../../core/server';
-import { IKibanaSearchResponse, IKibanaSearchRequest } from '../../common/search';
+import { ISearchOptions } from '../../common/search';
 import { AggsSetup, AggsStart } from './aggs';
 import { SearchUsage } from './collectors/usage';
 import { IEsSearchRequest, IEsSearchResponse } from './es_search';
@@ -27,14 +27,6 @@ export interface SearchEnhancements {
   defaultStrategy: string;
 }
 
-export interface ISearchOptions {
-  /**
-   * An `AbortSignal` that allows the caller of `search` to abort a search request.
-   */
-  signal?: AbortSignal;
-  strategy?: string;
-}
-
 export interface ISearchSetup {
   aggs: AggsSetup;
   /**
@@ -74,9 +66,9 @@ export interface ISearchStart<
   ) => ISearchStrategy<SearchStrategyRequest, SearchStrategyResponse>;
   search: (
     context: RequestHandlerContext,
-    request: IKibanaSearchRequest,
+    request: IEsSearchRequest,
     options: ISearchOptions
-  ) => Promise<IKibanaSearchResponse>;
+  ) => Promise<IEsSearchResponse>;
 }
 
 /**
diff --git a/src/plugins/data/server/server.api.md b/src/plugins/data/server/server.api.md
index 9f114f21320098..a4f5f590e17744 100644
--- a/src/plugins/data/server/server.api.md
+++ b/src/plugins/data/server/server.api.md
@@ -48,7 +48,6 @@ import { ExistsParams } from 'elasticsearch';
 import { ExplainParams } from 'elasticsearch';
 import { ExpressionAstFunction } from 'src/plugins/expressions/common';
 import { ExpressionsServerSetup } from 'src/plugins/expressions/server';
-import { FetchOptions } from 'src/plugins/data/public';
 import { FieldStatsParams } from 'elasticsearch';
 import { GenericParams } from 'elasticsearch';
 import { GetParams } from 'elasticsearch';
@@ -99,6 +98,7 @@ import { IngestDeletePipelineParams } from 'elasticsearch';
 import { IngestGetPipelineParams } from 'elasticsearch';
 import { IngestPutPipelineParams } from 'elasticsearch';
 import { IngestSimulateParams } from 'elasticsearch';
+import { ISearchOptions as ISearchOptions_2 } from 'src/plugins/data/public';
 import { ISearchSource } from 'src/plugins/data/public';
 import { KibanaClient } from '@elastic/elasticsearch/api/kibana';
 import { KibanaConfigType as KibanaConfigType_2 } from 'src/core/server/kibana_config';
@@ -323,6 +323,11 @@ export enum ES_FIELD_TYPES {
     _TYPE = "_type"
 }
 
+// Warning: (ae-missing-release-tag) "ES_SEARCH_STRATEGY" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export const ES_SEARCH_STRATEGY = "es";
+
 // Warning: (ae-forgotten-export) The symbol "ExpressionFunctionDefinition" needs to be exported by the entry point index.d.ts
 // Warning: (ae-forgotten-export) The symbol "Input" needs to be exported by the entry point index.d.ts
 // Warning: (ae-forgotten-export) The symbol "Arguments" needs to be exported by the entry point index.d.ts
@@ -565,7 +570,9 @@ export interface IFieldType {
     // Warning: (ae-forgotten-export) The symbol "FieldSpec" needs to be exported by the entry point index.d.ts
     //
     // (undocumented)
-    toSpec?: () => FieldSpec;
+    toSpec?: (options?: {
+        getFormatterForField?: IndexPattern['getFormatterForField'];
+    }) => FieldSpec;
     // (undocumented)
     type: string;
     // (undocumented)
@@ -676,8 +683,7 @@ export class IndexPatternsFetcher {
 //
 // @public (undocumented)
 export interface ISearchOptions {
-    signal?: AbortSignal;
-    // (undocumented)
+    abortSignal?: AbortSignal;
     strategy?: string;
 }
 
@@ -709,7 +715,7 @@ export interface ISearchStart<SearchStrategyRequest extends IEsSearchRequest = I
     // Warning: (ae-forgotten-export) The symbol "RequestHandlerContext" needs to be exported by the entry point index.d.ts
     //
     // (undocumented)
-    search: (context: RequestHandlerContext, request: IKibanaSearchRequest, options: ISearchOptions) => Promise<IKibanaSearchResponse>;
+    search: (context: RequestHandlerContext, request: IEsSearchRequest, options: ISearchOptions) => Promise<IEsSearchResponse>;
 }
 
 // Warning: (ae-missing-release-tag) "ISearchStrategy" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -1063,6 +1069,7 @@ export function usageProvider(core: CoreSetup_2): SearchUsage;
 
 // Warnings were encountered during analysis:
 //
+// src/plugins/data/common/index_patterns/fields/types.ts:41:25 - (ae-forgotten-export) The symbol "IndexPattern" needs to be exported by the entry point index.d.ts
 // src/plugins/data/server/index.ts:40:23 - (ae-forgotten-export) The symbol "buildCustomFilter" needs to be exported by the entry point index.d.ts
 // src/plugins/data/server/index.ts:40:23 - (ae-forgotten-export) The symbol "buildFilter" needs to be exported by the entry point index.d.ts
 // src/plugins/data/server/index.ts:71:21 - (ae-forgotten-export) The symbol "getEsQueryConfig" needs to be exported by the entry point index.d.ts
@@ -1084,19 +1091,19 @@ export function usageProvider(core: CoreSetup_2): SearchUsage;
 // src/plugins/data/server/index.ts:101:26 - (ae-forgotten-export) The symbol "TruncateFormat" needs to be exported by the entry point index.d.ts
 // src/plugins/data/server/index.ts:127:27 - (ae-forgotten-export) The symbol "isFilterable" needs to be exported by the entry point index.d.ts
 // src/plugins/data/server/index.ts:127:27 - (ae-forgotten-export) The symbol "isNestedField" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:221:20 - (ae-forgotten-export) The symbol "getRequestInspectorStats" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:221:20 - (ae-forgotten-export) The symbol "getResponseInspectorStats" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:221:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:221:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:223:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:224:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:233:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:234:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:235:1 - (ae-forgotten-export) The symbol "Ipv4Address" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:239:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:240:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:244:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:247:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:222:20 - (ae-forgotten-export) The symbol "getRequestInspectorStats" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:222:20 - (ae-forgotten-export) The symbol "getResponseInspectorStats" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:222:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:222:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:224:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:225:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:234:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:235:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:236:1 - (ae-forgotten-export) The symbol "Ipv4Address" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:240:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:241:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:245:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:248:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
 // src/plugins/data/server/plugin.ts:88:66 - (ae-forgotten-export) The symbol "DataEnhancements" needs to be exported by the entry point index.d.ts
 
 // (No @packageDocumentation comment for this package)
diff --git a/src/plugins/dev_tools/public/application.tsx b/src/plugins/dev_tools/public/application.tsx
index 46f09a8ebb8796..d3a54627b02407 100644
--- a/src/plugins/dev_tools/public/application.tsx
+++ b/src/plugins/dev_tools/public/application.tsx
@@ -90,6 +90,7 @@ function DevToolsWrapper({ devTools, activeDevTool, updateRoute }: DevToolsWrapp
               element,
               appBasePath: '',
               onAppLeave: () => undefined,
+              setHeaderActionMenu: () => undefined,
               // TODO: adapt to use Core's ScopedHistory
               history: {} as any,
             };
diff --git a/src/plugins/discover/public/application/angular/discover.html b/src/plugins/discover/public/application/angular/discover.html
index d3d4f524873d88..94f13e1cd81325 100644
--- a/src/plugins/discover/public/application/angular/discover.html
+++ b/src/plugins/discover/public/application/angular/discover.html
@@ -31,7 +31,6 @@ <h1 class="euiScreenReaderOnly">{{screenTitle}}</h1>
             on-remove-field="removeColumn"
             selected-index-pattern="searchSource.getField('index')"
             set-index-pattern="setIndexPattern"
-            state="state"
           >
           </discover-sidebar>
         </div>
@@ -78,11 +77,11 @@ <h1 class="euiScreenReaderOnly">{{screenTitle}}</h1>
               class="dscTimechart"
               ng-if="opts.timefield"
             >
-              <timechart-header 
+              <timechart-header
                 from="toMoment(timeRange.from)"
-                to="toMoment(timeRange.to)" 
-                options="intervalOptions" 
-                on-change-interval="changeInterval" 
+                to="toMoment(timeRange.to)"
+                options="intervalOptions"
+                on-change-interval="changeInterval"
                 state-interval="state.interval"
                 show-scaled-info="bucketInterval.scaled"
                 bucket-interval-description="bucketInterval.description"
diff --git a/src/plugins/discover/public/application/components/field_name/field_name.test.tsx b/src/plugins/discover/public/application/components/field_name/field_name.test.tsx
index 46be1044c0d4d1..e6cf8a57686f14 100644
--- a/src/plugins/discover/public/application/components/field_name/field_name.test.tsx
+++ b/src/plugins/discover/public/application/components/field_name/field_name.test.tsx
@@ -20,8 +20,6 @@ import React from 'react';
 import { render } from 'enzyme';
 import { FieldName } from './field_name';
 
-jest.mock('ui/new_platform');
-
 // Note that it currently provides just 2 basic tests, there should be more, but
 // the components involved will soon change
 test('FieldName renders a string field by providing fieldType and fieldName', () => {
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_field.test.tsx b/src/plugins/discover/public/application/components/sidebar/discover_field.test.tsx
index a0d9e3c541e47e..b03b37da40908d 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_field.test.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_field.test.tsx
@@ -62,7 +62,6 @@ function getComponent(selected = false, showDetails = false, useShortDots = fals
   );
 
   const field = new IndexPatternField(
-    indexPattern,
     {
       name: 'bytes',
       type: 'number',
@@ -73,18 +72,16 @@ function getComponent(selected = false, showDetails = false, useShortDots = fals
       aggregatable: true,
       readFromDocValues: true,
     },
-    'bytes',
-    () => {}
+    'bytes'
   );
 
   const props = {
     indexPattern,
     field,
-    getDetails: jest.fn(),
+    getDetails: jest.fn(() => ({ buckets: [], error: '', exists: 1, total: true, columns: [] })),
     onAddFilter: jest.fn(),
     onAddField: jest.fn(),
     onRemoveField: jest.fn(),
-    onShowDetails: jest.fn(),
     showDetails,
     selected,
     useShortDots,
@@ -104,4 +101,9 @@ describe('discover sidebar field', function () {
     findTestSubject(comp, 'fieldToggle-bytes').simulate('click');
     expect(props.onRemoveField).toHaveBeenCalledWith('bytes');
   });
+  it('should trigger getDetails', function () {
+    const { comp, props } = getComponent(true);
+    findTestSubject(comp, 'field-bytes-showDetails').simulate('click');
+    expect(props.getDetails).toHaveBeenCalledWith(props.field);
+  });
 });
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_field.tsx b/src/plugins/discover/public/application/components/sidebar/discover_field.tsx
index 639dbfe09277cd..bb330cba68e2e6 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_field.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_field.tsx
@@ -133,6 +133,9 @@ export function DiscoverField({
           iconType="plusInCircleFilled"
           className="dscSidebarItem__action"
           onClick={(ev: React.MouseEvent<HTMLButtonElement>) => {
+            if (ev.type === 'click') {
+              ev.currentTarget.focus();
+            }
             ev.preventDefault();
             ev.stopPropagation();
             toggleDisplay(field);
@@ -155,6 +158,9 @@ export function DiscoverField({
           iconType="cross"
           className="dscSidebarItem__action"
           onClick={(ev: React.MouseEvent<HTMLButtonElement>) => {
+            if (ev.type === 'click') {
+              ev.currentTarget.focus();
+            }
             ev.preventDefault();
             ev.stopPropagation();
             toggleDisplay(field);
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
index 1f27766a1756d3..850624888b24a3 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
@@ -30,7 +30,6 @@ import { SavedObject } from '../../../../../../core/types';
 import { FIELDS_LIMIT_SETTING } from '../../../../common';
 import { groupFields } from './lib/group_fields';
 import { IndexPatternField, IndexPattern, UI_SETTINGS } from '../../../../../data/public';
-import { AppState } from '../../angular/discover_state';
 import { getDetails } from './lib/get_details';
 import { getDefaultFieldFilter, setFieldFilterProp } from './lib/field_filter';
 import { getIndexPatternFieldList } from './lib/get_index_pattern_field_list';
@@ -74,10 +73,6 @@ export interface DiscoverSidebarProps {
    * Callback function to select another index pattern
    */
   setIndexPattern: (id: string) => void;
-  /**
-   * Current app state, used for generating a link to visualize
-   */
-  state: AppState;
 }
 
 export function DiscoverSidebar({
@@ -90,7 +85,6 @@ export function DiscoverSidebar({
   onRemoveField,
   selectedIndexPattern,
   setIndexPattern,
-  state,
 }: DiscoverSidebarProps) {
   const [showFields, setShowFields] = useState(false);
   const [fields, setFields] = useState<IndexPatternField[] | null>(null);
@@ -111,8 +105,8 @@ export function DiscoverSidebar({
   );
 
   const getDetailsByField = useCallback(
-    (ipField: IndexPatternField) => getDetails(ipField, hits, columns),
-    [hits, columns]
+    (ipField: IndexPatternField) => getDetails(ipField, hits, columns, selectedIndexPattern),
+    [hits, columns, selectedIndexPattern]
   );
 
   const popularLimit = services.uiSettings.get(FIELDS_LIMIT_SETTING);
@@ -185,10 +179,10 @@ export function DiscoverSidebar({
                 aria-labelledby="selected_fields"
                 data-test-subj={`fieldList-selected`}
               >
-                {selectedFields.map((field: IndexPatternField, idx: number) => {
+                {selectedFields.map((field: IndexPatternField) => {
                   return (
                     <li
-                      key={`field${idx}`}
+                      key={`field${field.name}`}
                       data-attr-field={field.name}
                       className="dscSidebar__item"
                     >
@@ -260,10 +254,10 @@ export function DiscoverSidebar({
                 aria-labelledby="available_fields available_fields_popular"
                 data-test-subj={`fieldList-popular`}
               >
-                {popularFields.map((field: IndexPatternField, idx: number) => {
+                {popularFields.map((field: IndexPatternField) => {
                   return (
                     <li
-                      key={`field${idx}`}
+                      key={`field${field.name}`}
                       data-attr-field={field.name}
                       className="dscSidebar__item"
                     >
@@ -290,9 +284,13 @@ export function DiscoverSidebar({
             aria-labelledby="available_fields"
             data-test-subj={`fieldList-unpopular`}
           >
-            {unpopularFields.map((field: IndexPatternField, idx: number) => {
+            {unpopularFields.map((field: IndexPatternField) => {
               return (
-                <li key={`field${idx}`} data-attr-field={field.name} className="dscSidebar__item">
+                <li
+                  key={`field${field.name}`}
+                  data-attr-field={field.name}
+                  className="dscSidebar__item"
+                >
                   <DiscoverField
                     field={field}
                     indexPattern={selectedIndexPattern}
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_sidebar_directive.ts b/src/plugins/discover/public/application/components/sidebar/discover_sidebar_directive.ts
index 624ec0f7578947..b271c920e5e010 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_sidebar_directive.ts
+++ b/src/plugins/discover/public/application/components/sidebar/discover_sidebar_directive.ts
@@ -29,6 +29,5 @@ export function createDiscoverSidebarDirective(reactDirective: any) {
     ['onRemoveField', { watchDepth: 'reference' }],
     ['selectedIndexPattern', { watchDepth: 'reference' }],
     ['setIndexPattern', { watchDepth: 'reference' }],
-    ['state', { watchDepth: 'reference' }],
   ]);
 }
diff --git a/src/plugins/discover/public/application/components/sidebar/lib/field_calculator.js b/src/plugins/discover/public/application/components/sidebar/lib/field_calculator.js
index e055d644e1f915..0ee279ac5b7272 100644
--- a/src/plugins/discover/public/application/components/sidebar/lib/field_calculator.js
+++ b/src/plugins/discover/public/application/components/sidebar/lib/field_calculator.js
@@ -20,9 +20,9 @@
 import _ from 'lodash';
 import { i18n } from '@kbn/i18n';
 
-function getFieldValues(hits, field) {
+function getFieldValues(hits, field, indexPattern) {
   const name = field.name;
-  const flattenHit = field.indexPattern.flattenHit;
+  const flattenHit = indexPattern.flattenHit;
   return _.map(hits, function (hit) {
     return flattenHit(hit)[name];
   });
@@ -49,7 +49,7 @@ function getFieldValueCounts(params) {
     };
   }
 
-  const allValues = getFieldValues(params.hits, params.field);
+  const allValues = getFieldValues(params.hits, params.field, params.indexPattern);
   let counts;
   const missing = _countMissing(allValues);
 
diff --git a/src/plugins/discover/public/application/components/sidebar/lib/field_calculator.test.ts b/src/plugins/discover/public/application/components/sidebar/lib/field_calculator.test.ts
index 87401818c49073..8746883a5d9680 100644
--- a/src/plugins/discover/public/application/components/sidebar/lib/field_calculator.test.ts
+++ b/src/plugins/discover/public/application/components/sidebar/lib/field_calculator.test.ts
@@ -148,7 +148,8 @@ describe('fieldCalculator', function () {
     it('Should return an array of values for _source fields', function () {
       const extensions = fieldCalculator.getFieldValues(
         hits,
-        indexPattern.fields.getByName('extension')
+        indexPattern.fields.getByName('extension'),
+        indexPattern
       );
       expect(extensions).toBeInstanceOf(Array);
       expect(
@@ -160,7 +161,11 @@ describe('fieldCalculator', function () {
     });
 
     it('Should return an array of values for core meta fields', function () {
-      const types = fieldCalculator.getFieldValues(hits, indexPattern.fields.getByName('_type'));
+      const types = fieldCalculator.getFieldValues(
+        hits,
+        indexPattern.fields.getByName('_type'),
+        indexPattern
+      );
       expect(types).toBeInstanceOf(Array);
       expect(
         _.filter(types, function (v) {
@@ -172,12 +177,13 @@ describe('fieldCalculator', function () {
   });
 
   describe('getFieldValueCounts', function () {
-    let params: { hits: any; field: any; count: number };
+    let params: { hits: any; field: any; count: number; indexPattern: IndexPattern };
     beforeEach(function () {
       params = {
         hits: _.cloneDeep(realHits),
         field: indexPattern.fields.getByName('extension'),
         count: 3,
+        indexPattern,
       };
     });
 
diff --git a/src/plugins/discover/public/application/components/sidebar/lib/get_details.ts b/src/plugins/discover/public/application/components/sidebar/lib/get_details.ts
index 41d3393672474b..13051f88c9591a 100644
--- a/src/plugins/discover/public/application/components/sidebar/lib/get_details.ts
+++ b/src/plugins/discover/public/application/components/sidebar/lib/get_details.ts
@@ -19,17 +19,19 @@
 
 // @ts-ignore
 import { fieldCalculator } from './field_calculator';
-import { IndexPatternField } from '../../../../../../data/public';
+import { IndexPattern, IndexPatternField } from '../../../../../../data/public';
 
 export function getDetails(
   field: IndexPatternField,
   hits: Array<Record<string, unknown>>,
-  columns: string[]
+  columns: string[],
+  indexPattern: IndexPattern
 ) {
   const details = {
     ...fieldCalculator.getFieldValueCounts({
       hits,
       field,
+      indexPattern,
       count: 5,
       grouped: false,
     }),
@@ -37,7 +39,7 @@ export function getDetails(
   };
   if (details.buckets) {
     for (const bucket of details.buckets) {
-      bucket.display = field.format.convert(bucket.value);
+      bucket.display = indexPattern.getFormatterForField(field).convert(bucket.value);
     }
   }
   return details;
diff --git a/src/plugins/discover/public/application/components/sidebar/lib/get_index_pattern_field_list.ts b/src/plugins/discover/public/application/components/sidebar/lib/get_index_pattern_field_list.ts
index 00e00aa8e29913..c96a8f5ce17b98 100644
--- a/src/plugins/discover/public/application/components/sidebar/lib/get_index_pattern_field_list.ts
+++ b/src/plugins/discover/public/application/components/sidebar/lib/get_index_pattern_field_list.ts
@@ -31,6 +31,7 @@ export function getIndexPatternFieldList(
 
   difference(fieldNamesInDocs, fieldNamesInIndexPattern).forEach((unknownFieldName) => {
     unknownTypes.push({
+      displayName: String(unknownFieldName),
       name: String(unknownFieldName),
       type: 'unknown',
     } as IndexPatternField);
diff --git a/src/plugins/discover/public/saved_searches/saved_searches.ts b/src/plugins/discover/public/saved_searches/saved_searches.ts
index 09be10b1374943..0bc332ed8ec744 100644
--- a/src/plugins/discover/public/saved_searches/saved_searches.ts
+++ b/src/plugins/discover/public/saved_searches/saved_searches.ts
@@ -22,11 +22,7 @@ import { createSavedSearchClass } from './_saved_search';
 
 export function createSavedSearchesLoader(services: SavedObjectKibanaServices) {
   const SavedSearchClass = createSavedSearchClass(services);
-  const savedSearchLoader = new SavedObjectLoader(
-    SavedSearchClass,
-    services.savedObjectsClient,
-    services.chrome
-  );
+  const savedSearchLoader = new SavedObjectLoader(SavedSearchClass, services.savedObjectsClient);
   // Customize loader properties since adding an 's' on type doesn't work for type 'search' .
   savedSearchLoader.loaderProperties = {
     name: 'searches',
diff --git a/src/plugins/embeddable/public/lib/panel/panel_header/panel_header.tsx b/src/plugins/embeddable/public/lib/panel/panel_header/panel_header.tsx
index 5d7daaa7217ed7..f3c4cae720193c 100644
--- a/src/plugins/embeddable/public/lib/panel/panel_header/panel_header.tsx
+++ b/src/plugins/embeddable/public/lib/panel/panel_header/panel_header.tsx
@@ -31,6 +31,7 @@ import { Action } from 'src/plugins/ui_actions/public';
 import { PanelOptionsMenu } from './panel_options_menu';
 import { IEmbeddable } from '../../embeddables';
 import { EmbeddableContext, panelBadgeTrigger, panelNotificationTrigger } from '../../triggers';
+import { uiToReactComponent } from '../../../../../kibana_react/public';
 
 export interface PanelHeaderProps {
   title?: string;
@@ -65,7 +66,9 @@ function renderNotifications(
   return notifications.map((notification) => {
     const context = { embeddable };
 
-    let badge = (
+    let badge = notification.MenuItem ? (
+      React.createElement(uiToReactComponent(notification.MenuItem))
+    ) : (
       <EuiNotificationBadge
         data-test-subj={`embeddablePanelNotification-${notification.id}`}
         key={notification.id}
diff --git a/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.ts b/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.ts
index 780cff9f4be7e3..184178ba80e846 100644
--- a/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.ts
+++ b/src/plugins/embeddable/public/lib/state_transfer/embeddable_state_transfer.ts
@@ -18,12 +18,7 @@
  */
 
 import { cloneDeep } from 'lodash';
-import {
-  ScopedHistory,
-  ApplicationStart,
-  PublicLegacyAppInfo,
-  PublicAppInfo,
-} from '../../../../../core/public';
+import { ScopedHistory, ApplicationStart, PublicAppInfo } from '../../../../../core/public';
 import {
   EmbeddableEditorState,
   isEmbeddableEditorState,
@@ -41,7 +36,7 @@ export class EmbeddableStateTransfer {
   constructor(
     private navigateToApp: ApplicationStart['navigateToApp'],
     private scopedHistory?: ScopedHistory,
-    private appList?: ReadonlyMap<string, PublicAppInfo | PublicLegacyAppInfo> | undefined
+    private appList?: ReadonlyMap<string, PublicAppInfo> | undefined
   ) {}
 
   /**
diff --git a/src/plugins/embeddable/public/plugin.tsx b/src/plugins/embeddable/public/plugin.tsx
index fb09729ab71c32..2ca31994b722d8 100644
--- a/src/plugins/embeddable/public/plugin.tsx
+++ b/src/plugins/embeddable/public/plugin.tsx
@@ -29,7 +29,6 @@ import {
   Plugin,
   ScopedHistory,
   PublicAppInfo,
-  PublicLegacyAppInfo,
 } from '../../../core/public';
 import { EmbeddableFactoryRegistry, EmbeddableFactoryProvider } from './types';
 import { bootstrap } from './bootstrap';
@@ -92,7 +91,7 @@ export class EmbeddablePublicPlugin implements Plugin<EmbeddableSetup, Embeddabl
   private customEmbeddableFactoryProvider?: EmbeddableFactoryProvider;
   private outgoingOnlyStateTransfer: EmbeddableStateTransfer = {} as EmbeddableStateTransfer;
   private isRegistryReady = false;
-  private appList?: ReadonlyMap<string, PublicAppInfo | PublicLegacyAppInfo>;
+  private appList?: ReadonlyMap<string, PublicAppInfo>;
   private appListSubscription?: Subscription;
 
   constructor(initializerContext: PluginInitializerContext) {}
diff --git a/src/plugins/es_ui_shared/__packages_do_not_import__/global_flyout/global_flyout.tsx b/src/plugins/es_ui_shared/__packages_do_not_import__/global_flyout/global_flyout.tsx
index aa575cd64944cd..4dd9cfcaff16bf 100644
--- a/src/plugins/es_ui_shared/__packages_do_not_import__/global_flyout/global_flyout.tsx
+++ b/src/plugins/es_ui_shared/__packages_do_not_import__/global_flyout/global_flyout.tsx
@@ -160,7 +160,7 @@ export const useGlobalFlyout = () => {
         Array.from(getContents()).forEach(removeContent);
       }
     };
-  }, [removeContent]);
+  }, [removeContent, getContents]);
 
   return { ...ctx, addContent };
 };
diff --git a/src/plugins/es_ui_shared/public/components/json_editor/index.ts b/src/plugins/es_ui_shared/public/components/json_editor/index.ts
index 81476a65f42158..63319baa38f5c2 100644
--- a/src/plugins/es_ui_shared/public/components/json_editor/index.ts
+++ b/src/plugins/es_ui_shared/public/components/json_editor/index.ts
@@ -19,4 +19,4 @@
 
 export * from './json_editor';
 
-export { OnJsonEditorUpdateHandler } from './use_json';
+export { OnJsonEditorUpdateHandler, JsonEditorState } from './use_json';
diff --git a/src/plugins/es_ui_shared/public/components/json_editor/json_editor.tsx b/src/plugins/es_ui_shared/public/components/json_editor/json_editor.tsx
index 8c63cc8494a8b6..206db5a2856205 100644
--- a/src/plugins/es_ui_shared/public/components/json_editor/json_editor.tsx
+++ b/src/plugins/es_ui_shared/public/components/json_editor/json_editor.tsx
@@ -17,95 +17,97 @@
  * under the License.
  */
 
-import React, { useCallback } from 'react';
+import React, { useCallback, useMemo } from 'react';
 import { EuiFormRow, EuiCodeEditor } from '@elastic/eui';
 import { debounce } from 'lodash';
 
-import { isJSON } from '../../../static/validators/string';
 import { useJson, OnJsonEditorUpdateHandler } from './use_json';
 
-interface Props {
-  onUpdate: OnJsonEditorUpdateHandler;
+interface Props<T extends object = { [key: string]: any }> {
+  onUpdate: OnJsonEditorUpdateHandler<T>;
   label?: string;
   helpText?: React.ReactNode;
   value?: string;
-  defaultValue?: { [key: string]: any };
+  defaultValue?: T;
   euiCodeEditorProps?: { [key: string]: any };
   error?: string | null;
 }
 
-export const JsonEditor = React.memo(
-  ({
-    label,
-    helpText,
+function JsonEditorComp<T extends object = { [key: string]: any }>({
+  label,
+  helpText,
+  onUpdate,
+  value,
+  defaultValue,
+  euiCodeEditorProps,
+  error: propsError,
+}: Props<T>) {
+  const { content, setContent, error: internalError, isControlled } = useJson<T>({
+    defaultValue,
     onUpdate,
     value,
-    defaultValue,
-    euiCodeEditorProps,
-    error: propsError,
-  }: Props) => {
-    const isControlled = value !== undefined;
+  });
 
-    const { content, setContent, error: internalError } = useJson({
-      defaultValue,
-      onUpdate,
-      isControlled,
-    });
+  const debouncedSetContent = useMemo(() => {
+    return debounce(setContent, 300);
+  }, [setContent]);
 
-    const debouncedSetContent = useCallback(debounce(setContent, 300), [setContent]);
+  // We let the consumer control the validation and the error message.
+  const error = isControlled ? propsError : internalError;
 
-    // We let the consumer control the validation and the error message.
-    const error = isControlled ? propsError : internalError;
+  const onEuiCodeEditorChange = useCallback(
+    (updated: string) => {
+      if (isControlled) {
+        onUpdate({
+          data: {
+            raw: updated,
+            format: () => JSON.parse(updated),
+          },
+          validate: () => {
+            try {
+              JSON.parse(updated);
+              return true;
+            } catch (e) {
+              return false;
+            }
+          },
+          isValid: undefined,
+        });
+      } else {
+        debouncedSetContent(updated);
+      }
+    },
+    [isControlled, debouncedSetContent, onUpdate]
+  );
 
-    const onEuiCodeEditorChange = useCallback(
-      (updated: string) => {
-        if (isControlled) {
-          onUpdate({
-            data: {
-              raw: updated,
-              format() {
-                return JSON.parse(updated);
-              },
-            },
-            validate() {
-              return isJSON(updated);
-            },
-            isValid: undefined,
-          });
-        } else {
-          debouncedSetContent(updated);
-        }
-      },
-      [isControlled]
-    );
+  return (
+    <EuiFormRow
+      label={label}
+      helpText={helpText}
+      isInvalid={typeof error === 'string'}
+      error={error}
+      fullWidth
+    >
+      <EuiCodeEditor
+        mode="json"
+        theme="textmate"
+        width="100%"
+        height="500px"
+        setOptions={{
+          showLineNumbers: false,
+          tabSize: 2,
+        }}
+        editorProps={{
+          $blockScrolling: Infinity,
+        }}
+        showGutter={false}
+        minLines={6}
+        value={isControlled ? value : content}
+        onChange={onEuiCodeEditorChange}
+        {...euiCodeEditorProps}
+      />
+    </EuiFormRow>
+  );
+}
 
-    return (
-      <EuiFormRow
-        label={label}
-        helpText={helpText}
-        isInvalid={typeof error === 'string'}
-        error={error}
-        fullWidth
-      >
-        <EuiCodeEditor
-          mode="json"
-          theme="textmate"
-          width="100%"
-          height="500px"
-          setOptions={{
-            showLineNumbers: false,
-            tabSize: 2,
-          }}
-          editorProps={{
-            $blockScrolling: Infinity,
-          }}
-          showGutter={false}
-          minLines={6}
-          value={isControlled ? value : content}
-          onChange={onEuiCodeEditorChange}
-          {...euiCodeEditorProps}
-        />
-      </EuiFormRow>
-    );
-  }
-);
+export const JsonEditor = React.memo(JsonEditorComp) as typeof JsonEditorComp;
diff --git a/src/plugins/es_ui_shared/public/components/json_editor/use_json.ts b/src/plugins/es_ui_shared/public/components/json_editor/use_json.ts
index 1b5ca5d7f43849..47d518e6814a48 100644
--- a/src/plugins/es_ui_shared/public/components/json_editor/use_json.ts
+++ b/src/plugins/es_ui_shared/public/components/json_editor/use_json.ts
@@ -17,24 +17,28 @@
  * under the License.
  */
 
-import { useEffect, useState, useRef } from 'react';
+import { useEffect, useState, useRef, useCallback } from 'react';
 import { i18n } from '@kbn/i18n';
 
 import { isJSON } from '../../../static/validators/string';
 
-export type OnJsonEditorUpdateHandler<T = { [key: string]: any }> = (arg: {
+export interface JsonEditorState<T = { [key: string]: any }> {
   data: {
     raw: string;
     format(): T;
   };
   validate(): boolean;
   isValid: boolean | undefined;
-}) => void;
+}
+
+export type OnJsonEditorUpdateHandler<T = { [key: string]: any }> = (
+  arg: JsonEditorState<T>
+) => void;
 
 interface Parameters<T extends object> {
   onUpdate: OnJsonEditorUpdateHandler<T>;
   defaultValue?: T;
-  isControlled?: boolean;
+  value?: string;
 }
 
 const stringifyJson = (json: { [key: string]: any }) =>
@@ -43,13 +47,16 @@ const stringifyJson = (json: { [key: string]: any }) =>
 export const useJson = <T extends object = { [key: string]: any }>({
   defaultValue = {} as T,
   onUpdate,
-  isControlled = false,
+  value,
 }: Parameters<T>) => {
-  const didMount = useRef(false);
-  const [content, setContent] = useState<string>(stringifyJson(defaultValue));
+  const isControlled = value !== undefined;
+  const isMounted = useRef(false);
+  const [content, setContent] = useState<string>(
+    isControlled ? value! : stringifyJson(defaultValue)
+  );
   const [error, setError] = useState<string | null>(null);
 
-  const validate = () => {
+  const validate = useCallback(() => {
     // We allow empty string as it will be converted to "{}""
     const isValid = content.trim() === '' ? true : isJSON(content);
     if (!isValid) {
@@ -62,33 +69,43 @@ export const useJson = <T extends object = { [key: string]: any }>({
       setError(null);
     }
     return isValid;
-  };
+  }, [content]);
 
-  const formatContent = () => {
+  const formatContent = useCallback(() => {
     const isValid = validate();
     const data = isValid && content.trim() !== '' ? JSON.parse(content) : {};
     return data as T;
-  };
+  }, [validate, content]);
 
   useEffect(() => {
-    if (didMount.current) {
-      const isValid = isControlled ? undefined : validate();
-      onUpdate({
-        data: {
-          raw: content,
-          format: formatContent,
-        },
-        validate,
-        isValid,
-      });
-    } else {
-      didMount.current = true;
+    if (!isMounted.current || isControlled) {
+      return;
     }
-  }, [content]);
+
+    const isValid = validate();
+
+    onUpdate({
+      data: {
+        raw: content,
+        format: formatContent,
+      },
+      validate,
+      isValid,
+    });
+  }, [onUpdate, content, formatContent, validate, isControlled]);
+
+  useEffect(() => {
+    isMounted.current = true;
+
+    return () => {
+      isMounted.current = false;
+    };
+  }, []);
 
   return {
     content,
     setContent,
     error,
+    isControlled,
   };
 };
diff --git a/src/plugins/es_ui_shared/public/index.ts b/src/plugins/es_ui_shared/public/index.ts
index bdea5ccf5fe26f..5a1c13658604a4 100644
--- a/src/plugins/es_ui_shared/public/index.ts
+++ b/src/plugins/es_ui_shared/public/index.ts
@@ -26,7 +26,7 @@ import * as Monaco from './monaco';
 import * as ace from './ace';
 import * as GlobalFlyout from './global_flyout';
 
-export { JsonEditor, OnJsonEditorUpdateHandler } from './components/json_editor';
+export { JsonEditor, OnJsonEditorUpdateHandler, JsonEditorState } from './components/json_editor';
 
 export { SectionLoading } from './components/section_loading';
 
@@ -39,7 +39,7 @@ export {
   UseRequestResponse,
   sendRequest,
   useRequest,
-} from './request/np_ready_request';
+} from './request';
 
 export { indices } from './indices';
 
diff --git a/src/plugins/es_ui_shared/public/indices/validate/validate_index.test.ts b/src/plugins/es_ui_shared/public/indices/validate/validate_index.test.ts
index a6792543cd7267..b28cac1cb76f5f 100644
--- a/src/plugins/es_ui_shared/public/indices/validate/validate_index.test.ts
+++ b/src/plugins/es_ui_shared/public/indices/validate/validate_index.test.ts
@@ -17,8 +17,6 @@
  * under the License.
  */
 
-jest.mock('ui/new_platform');
-
 import { INDEX_ILLEGAL_CHARACTERS_VISIBLE } from '../constants';
 
 import {
diff --git a/src/plugins/es_ui_shared/public/request/index.ts b/src/plugins/es_ui_shared/public/request/index.ts
index f942a9cc3932bb..9e38bfe5ee16b3 100644
--- a/src/plugins/es_ui_shared/public/request/index.ts
+++ b/src/plugins/es_ui_shared/public/request/index.ts
@@ -17,11 +17,5 @@
  * under the License.
  */
 
-export {
-  SendRequestConfig,
-  SendRequestResponse,
-  UseRequestConfig,
-  UseRequestResponse,
-  sendRequest,
-  useRequest,
-} from './request';
+export { SendRequestConfig, SendRequestResponse, sendRequest } from './send_request';
+export { UseRequestConfig, UseRequestResponse, useRequest } from './use_request';
diff --git a/src/plugins/es_ui_shared/public/request/np_ready_request.ts b/src/plugins/es_ui_shared/public/request/np_ready_request.ts
deleted file mode 100644
index 06af698f2ce023..00000000000000
--- a/src/plugins/es_ui_shared/public/request/np_ready_request.ts
+++ /dev/null
@@ -1,184 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { useEffect, useState, useRef, useMemo } from 'react';
-
-import { HttpSetup, HttpFetchQuery } from '../../../../../src/core/public';
-
-export interface SendRequestConfig {
-  path: string;
-  method: 'get' | 'post' | 'put' | 'delete' | 'patch' | 'head';
-  query?: HttpFetchQuery;
-  body?: any;
-}
-
-export interface SendRequestResponse<D = any, E = Error> {
-  data: D | null;
-  error: E | null;
-}
-
-export interface UseRequestConfig extends SendRequestConfig {
-  pollIntervalMs?: number;
-  initialData?: any;
-  deserializer?: (data: any) => any;
-}
-
-export interface UseRequestResponse<D = any, E = Error> {
-  isInitialRequest: boolean;
-  isLoading: boolean;
-  error: E | null;
-  data?: D | null;
-  sendRequest: (...args: any[]) => Promise<SendRequestResponse<D, E>>;
-}
-
-export const sendRequest = async <D = any, E = Error>(
-  httpClient: HttpSetup,
-  { path, method, body, query }: SendRequestConfig
-): Promise<SendRequestResponse<D, E>> => {
-  try {
-    const stringifiedBody = typeof body === 'string' ? body : JSON.stringify(body);
-    const response = await httpClient[method](path, { body: stringifiedBody, query });
-
-    return {
-      data: response.data ? response.data : response,
-      error: null,
-    };
-  } catch (e) {
-    return {
-      data: null,
-      error: e.response && e.response.data ? e.response.data : e.body,
-    };
-  }
-};
-
-export const useRequest = <D = any, E = Error>(
-  httpClient: HttpSetup,
-  {
-    path,
-    method,
-    query,
-    body,
-    pollIntervalMs,
-    initialData,
-    deserializer = (data: any): any => data,
-  }: UseRequestConfig
-): UseRequestResponse<D, E> => {
-  const sendRequestRef = useRef<() => Promise<SendRequestResponse<D, E>>>();
-  // Main states for tracking request status and data
-  const [error, setError] = useState<null | any>(null);
-  const [isLoading, setIsLoading] = useState<boolean>(true);
-  const [data, setData] = useState<any>(initialData);
-
-  // Consumers can use isInitialRequest to implement a polling UX.
-  const [isInitialRequest, setIsInitialRequest] = useState<boolean>(true);
-  const pollInterval = useRef<any>(null);
-  const pollIntervalId = useRef<any>(null);
-
-  // We always want to use the most recently-set interval in scheduleRequest.
-  pollInterval.current = pollIntervalMs;
-
-  // Tied to every render and bound to each request.
-  let isOutdatedRequest = false;
-
-  const scheduleRequest = () => {
-    // Clear current interval
-    if (pollIntervalId.current) {
-      clearTimeout(pollIntervalId.current);
-    }
-
-    // Set new interval
-    if (pollInterval.current) {
-      pollIntervalId.current = setTimeout(
-        () => (sendRequestRef.current ?? _sendRequest)(),
-        pollInterval.current
-      );
-    }
-  };
-
-  const _sendRequest = async () => {
-    // We don't clear error or data, so it's up to the consumer to decide whether to display the
-    // "old" error/data or loading state when a new request is in-flight.
-    setIsLoading(true);
-
-    const requestBody = {
-      path,
-      method,
-      query,
-      body,
-    };
-
-    const response = await sendRequest<D, E>(httpClient, requestBody);
-    const { data: serializedResponseData, error: responseError } = response;
-
-    // If an outdated request has resolved, DON'T update state, but DO allow the processData handler
-    // to execute side effects like update telemetry.
-    if (isOutdatedRequest) {
-      return { data: null, error: null };
-    }
-
-    setError(responseError);
-
-    if (!responseError) {
-      const responseData = deserializer(serializedResponseData);
-      setData(responseData);
-    }
-
-    setIsLoading(false);
-    setIsInitialRequest(false);
-
-    // If we're on an interval, we need to schedule the next request. This also allows us to reset
-    // the interval if the user has manually requested the data, to avoid doubled-up requests.
-    scheduleRequest();
-
-    return { data: serializedResponseData, error: responseError };
-  };
-
-  useEffect(() => {
-    sendRequestRef.current = _sendRequest;
-  }, [_sendRequest]);
-
-  const stringifiedQuery = useMemo(() => JSON.stringify(query), [query]);
-
-  useEffect(() => {
-    (sendRequestRef.current ?? _sendRequest)();
-    // To be functionally correct we'd send a new request if the method, path, query or body changes.
-    // But it doesn't seem likely that the method will change and body is likely to be a new
-    // object even if its shape hasn't changed, so for now we're just watching the path and the query.
-  }, [path, stringifiedQuery]);
-
-  useEffect(() => {
-    scheduleRequest();
-
-    // Clean up intervals and inflight requests and corresponding state changes
-    return () => {
-      isOutdatedRequest = true;
-      if (pollIntervalId.current) {
-        clearTimeout(pollIntervalId.current);
-      }
-    };
-  }, [pollIntervalMs]);
-
-  return {
-    isInitialRequest,
-    isLoading,
-    error,
-    data,
-    sendRequest: sendRequestRef.current ?? _sendRequest, // Gives the user the ability to manually request data
-  };
-};
diff --git a/src/plugins/es_ui_shared/public/request/request.test.js b/src/plugins/es_ui_shared/public/request/request.test.js
deleted file mode 100644
index 190c32517eefed..00000000000000
--- a/src/plugins/es_ui_shared/public/request/request.test.js
+++ /dev/null
@@ -1,262 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import sinon from 'sinon';
-// import { sendRequest as sendRequestUnbound, useRequest as useRequestUnbound } from './request';
-
-import React from 'react';
-import { act } from 'react-dom/test-utils';
-import { mount } from 'enzyme';
-
-const TestHook = ({ callback }) => {
-  callback();
-  return null;
-};
-
-let element;
-
-const testHook = (callback) => {
-  element = mount(<TestHook callback={callback} />);
-};
-
-const wait = async (wait) => new Promise((resolve) => setTimeout(resolve, wait || 1));
-
-// FLAKY:
-// - https://github.com/elastic/kibana/issues/42561
-// - https://github.com/elastic/kibana/issues/42562
-// - https://github.com/elastic/kibana/issues/42563
-// - https://github.com/elastic/kibana/issues/42225
-describe.skip('request lib', () => {
-  const successRequest = { path: '/success', method: 'post', body: {} };
-  const errorRequest = { path: '/error', method: 'post', body: {} };
-  const successResponse = { statusCode: 200, data: { message: 'Success message' } };
-  const errorResponse = { statusCode: 400, statusText: 'Error message' };
-
-  let sendPost;
-  let sendRequest;
-  let useRequest;
-
-  /**
-   *
-   * commented out due to hooks being called regardless of skip
-   * https://github.com/facebook/jest/issues/8379
-
-  beforeEach(() => {
-    sendPost = sinon.stub();
-    sendPost.withArgs(successRequest.path, successRequest.body).returns(successResponse);
-    sendPost.withArgs(errorRequest.path, errorRequest.body).throws(errorResponse);
-
-    const httpClient = {
-      post: (...args) => {
-        return sendPost(...args);
-      },
-    };
-
-    sendRequest = sendRequestUnbound.bind(null, httpClient);
-    useRequest = useRequestUnbound.bind(null, httpClient);
-  });
-
-  */
-
-  describe('sendRequest function', () => {
-    it('uses the provided path, method, and body to send the request', async () => {
-      const response = await sendRequest({ ...successRequest });
-      sinon.assert.calledOnce(sendPost);
-      expect(response).toEqual({ data: successResponse.data, error: null });
-    });
-
-    it('surfaces errors', async () => {
-      try {
-        await sendRequest({ ...errorRequest });
-      } catch (e) {
-        sinon.assert.calledOnce(sendPost);
-        expect(e).toBe(errorResponse.error);
-      }
-    });
-  });
-
-  describe('useRequest hook', () => {
-    let hook;
-
-    function initUseRequest(config) {
-      act(() => {
-        testHook(() => {
-          hook = useRequest(config);
-        });
-      });
-    }
-
-    describe('parameters', () => {
-      describe('path, method, body', () => {
-        it('is used to send the request', async () => {
-          initUseRequest({ ...successRequest });
-          await wait(50);
-          expect(hook.data).toBe(successResponse.data);
-        });
-      });
-
-      describe('pollIntervalMs', () => {
-        it('sends another request after the specified time has elapsed', async () => {
-          initUseRequest({ ...successRequest, pollIntervalMs: 10 });
-          await wait(50);
-          // We just care that multiple requests have been sent out. We don't check the specific
-          // timing because that risks introducing flakiness into the tests, and it's unlikely
-          // we could break the implementation by getting the exact timing wrong.
-          expect(sendPost.callCount).toBeGreaterThan(1);
-
-          // We have to manually clean up or else the interval will continue to fire requests,
-          // interfering with other tests.
-          element.unmount();
-        });
-      });
-
-      describe('initialData', () => {
-        it('sets the initial data value', () => {
-          initUseRequest({ ...successRequest, initialData: 'initialData' });
-          expect(hook.data).toBe('initialData');
-        });
-      });
-
-      describe('deserializer', () => {
-        it('is called once the request resolves', async () => {
-          const deserializer = sinon.stub();
-          initUseRequest({ ...successRequest, deserializer });
-          sinon.assert.notCalled(deserializer);
-
-          await wait(50);
-          sinon.assert.calledOnce(deserializer);
-          sinon.assert.calledWith(deserializer, successResponse.data);
-        });
-
-        it('processes data', async () => {
-          initUseRequest({ ...successRequest, deserializer: () => 'intercepted' });
-          await wait(50);
-          expect(hook.data).toBe('intercepted');
-        });
-      });
-    });
-
-    describe('state', () => {
-      describe('isInitialRequest', () => {
-        it('is true for the first request and false for subsequent requests', async () => {
-          initUseRequest({ ...successRequest });
-          expect(hook.isInitialRequest).toBe(true);
-
-          hook.sendRequest();
-          await wait(50);
-          expect(hook.isInitialRequest).toBe(false);
-        });
-      });
-
-      describe('isLoading', () => {
-        it('represents in-flight request status', async () => {
-          initUseRequest({ ...successRequest });
-          expect(hook.isLoading).toBe(true);
-
-          await wait(50);
-          expect(hook.isLoading).toBe(false);
-        });
-      });
-
-      describe('error', () => {
-        it('surfaces errors from requests', async () => {
-          initUseRequest({ ...errorRequest });
-          await wait(50);
-          expect(hook.error).toBe(errorResponse);
-        });
-
-        it('persists while a request is in-flight', async () => {
-          initUseRequest({ ...errorRequest });
-          await wait(50);
-          hook.sendRequest();
-          expect(hook.isLoading).toBe(true);
-          expect(hook.error).toBe(errorResponse);
-        });
-
-        it('is null when the request is successful', async () => {
-          initUseRequest({ ...successRequest });
-          await wait(50);
-          expect(hook.isLoading).toBe(false);
-          expect(hook.error).toBeNull();
-        });
-      });
-
-      describe('data', () => {
-        it('surfaces payloads from requests', async () => {
-          initUseRequest({ ...successRequest });
-          await wait(50);
-          expect(hook.data).toBe(successResponse.data);
-        });
-
-        it('persists while a request is in-flight', async () => {
-          initUseRequest({ ...successRequest });
-          await wait(50);
-          hook.sendRequest();
-          expect(hook.isLoading).toBe(true);
-          expect(hook.data).toBe(successResponse.data);
-        });
-
-        it('is null when the request fails', async () => {
-          initUseRequest({ ...errorRequest });
-          await wait(50);
-          expect(hook.isLoading).toBe(false);
-          expect(hook.data).toBeNull();
-        });
-      });
-    });
-
-    describe('callbacks', () => {
-      describe('sendRequest', () => {
-        it('sends the request', () => {
-          initUseRequest({ ...successRequest });
-          sinon.assert.calledOnce(sendPost);
-          hook.sendRequest();
-          sinon.assert.calledTwice(sendPost);
-        });
-
-        it('resets the pollIntervalMs', async () => {
-          initUseRequest({ ...successRequest, pollIntervalMs: 800 });
-          await wait(200); // 200ms
-          hook.sendRequest();
-          expect(sendPost.callCount).toBe(2);
-
-          await wait(200); // 400ms
-          hook.sendRequest();
-
-          await wait(200); // 600ms
-          hook.sendRequest();
-
-          await wait(200); // 800ms
-          hook.sendRequest();
-
-          await wait(200); // 1000ms
-          hook.sendRequest();
-
-          // If sendRequest didn't reset the interval, the interval would have triggered another
-          // request by now, and the callCount would be 7.
-          expect(sendPost.callCount).toBe(6);
-
-          // We have to manually clean up or else the interval will continue to fire requests,
-          // interfering with other tests.
-          element.unmount();
-        });
-      });
-    });
-  });
-});
diff --git a/src/plugins/es_ui_shared/public/request/request.ts b/src/plugins/es_ui_shared/public/request/request.ts
deleted file mode 100644
index fd6980367136eb..00000000000000
--- a/src/plugins/es_ui_shared/public/request/request.ts
+++ /dev/null
@@ -1,165 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { useEffect, useState, useRef } from 'react';
-
-export interface SendRequestConfig {
-  path: string;
-  method: 'get' | 'post' | 'put' | 'delete' | 'patch' | 'head';
-  body?: any;
-}
-
-export interface SendRequestResponse {
-  data: any;
-  error: Error | null;
-}
-
-export interface UseRequestConfig extends SendRequestConfig {
-  pollIntervalMs?: number;
-  initialData?: any;
-  deserializer?: (data: any) => any;
-}
-
-export interface UseRequestResponse {
-  isInitialRequest: boolean;
-  isLoading: boolean;
-  error: null | unknown;
-  data: any;
-  sendRequest: (...args: any[]) => Promise<SendRequestResponse>;
-}
-
-export const sendRequest = async (
-  httpClient: ng.IHttpService,
-  { path, method, body }: SendRequestConfig
-): Promise<SendRequestResponse> => {
-  try {
-    const response = await (httpClient as any)[method](path, body);
-
-    if (typeof response.data === 'undefined') {
-      throw new Error(response.statusText);
-    }
-
-    return { data: response.data, error: null };
-  } catch (e) {
-    return {
-      data: null,
-      error: e.response ? e.response : e,
-    };
-  }
-};
-
-export const useRequest = (
-  httpClient: ng.IHttpService,
-  {
-    path,
-    method,
-    body,
-    pollIntervalMs,
-    initialData,
-    deserializer = (data: any): any => data,
-  }: UseRequestConfig
-): UseRequestResponse => {
-  // Main states for tracking request status and data
-  const [error, setError] = useState<null | any>(null);
-  const [isLoading, setIsLoading] = useState<boolean>(true);
-  const [data, setData] = useState<any>(initialData);
-
-  // Consumers can use isInitialRequest to implement a polling UX.
-  const [isInitialRequest, setIsInitialRequest] = useState<boolean>(true);
-  const pollInterval = useRef<any>(null);
-  const pollIntervalId = useRef<any>(null);
-
-  // We always want to use the most recently-set interval in scheduleRequest.
-  pollInterval.current = pollIntervalMs;
-
-  // Tied to every render and bound to each request.
-  let isOutdatedRequest = false;
-
-  const scheduleRequest = () => {
-    // Clear current interval
-    if (pollIntervalId.current) {
-      clearTimeout(pollIntervalId.current);
-    }
-
-    // Set new interval
-    if (pollInterval.current) {
-      pollIntervalId.current = setTimeout(_sendRequest, pollInterval.current);
-    }
-  };
-
-  const _sendRequest = async () => {
-    // We don't clear error or data, so it's up to the consumer to decide whether to display the
-    // "old" error/data or loading state when a new request is in-flight.
-    setIsLoading(true);
-
-    const requestBody = {
-      path,
-      method,
-      body,
-    };
-
-    const response = await sendRequest(httpClient, requestBody);
-    const { data: serializedResponseData, error: responseError } = response;
-    const responseData = deserializer(serializedResponseData);
-
-    // If an outdated request has resolved, DON'T update state, but DO allow the processData handler
-    // to execute side effects like update telemetry.
-    if (isOutdatedRequest) {
-      return { data: null, error: null };
-    }
-
-    setError(responseError);
-    setData(responseData);
-    setIsLoading(false);
-    setIsInitialRequest(false);
-
-    // If we're on an interval, we need to schedule the next request. This also allows us to reset
-    // the interval if the user has manually requested the data, to avoid doubled-up requests.
-    scheduleRequest();
-
-    return { data: serializedResponseData, error: responseError };
-  };
-
-  useEffect(() => {
-    _sendRequest();
-    // To be functionally correct we'd send a new request if the method, path, or body changes.
-    // But it doesn't seem likely that the method will change and body is likely to be a new
-    // object even if its shape hasn't changed, so for now we're just watching the path.
-  }, [path]);
-
-  useEffect(() => {
-    scheduleRequest();
-
-    // Clean up intervals and inflight requests and corresponding state changes
-    return () => {
-      isOutdatedRequest = true;
-      if (pollIntervalId.current) {
-        clearTimeout(pollIntervalId.current);
-      }
-    };
-  }, [pollIntervalMs]);
-
-  return {
-    isInitialRequest,
-    isLoading,
-    error,
-    data,
-    sendRequest: _sendRequest, // Gives the user the ability to manually request data
-  };
-};
diff --git a/src/plugins/es_ui_shared/public/request/send_request.test.helpers.ts b/src/plugins/es_ui_shared/public/request/send_request.test.helpers.ts
new file mode 100644
index 00000000000000..4312780e74c0f3
--- /dev/null
+++ b/src/plugins/es_ui_shared/public/request/send_request.test.helpers.ts
@@ -0,0 +1,83 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import sinon from 'sinon';
+
+import { HttpSetup, HttpFetchOptions } from '../../../../../src/core/public';
+import {
+  SendRequestConfig,
+  SendRequestResponse,
+  sendRequest as originalSendRequest,
+} from './send_request';
+
+export interface SendRequestHelpers {
+  getSendRequestSpy: () => sinon.SinonStub;
+  sendSuccessRequest: () => Promise<SendRequestResponse>;
+  getSuccessResponse: () => SendRequestResponse;
+  sendErrorRequest: () => Promise<SendRequestResponse>;
+  getErrorResponse: () => SendRequestResponse;
+}
+
+const successRequest: SendRequestConfig = { method: 'post', path: '/success', body: {} };
+const successResponse = { statusCode: 200, data: { message: 'Success message' } };
+
+const errorValue = { statusCode: 400, statusText: 'Error message' };
+const errorRequest: SendRequestConfig = { method: 'post', path: '/error', body: {} };
+const errorResponse = { response: { data: errorValue } };
+
+export const createSendRequestHelpers = (): SendRequestHelpers => {
+  const sendRequestSpy = sinon.stub();
+  const httpClient = {
+    post: (path: string, options: HttpFetchOptions) => sendRequestSpy(path, options),
+  };
+  const sendRequest = originalSendRequest.bind(null, httpClient as HttpSetup) as <D = any, E = any>(
+    config: SendRequestConfig
+  ) => Promise<SendRequestResponse<D, E>>;
+
+  // Set up successful request helpers.
+  sendRequestSpy
+    .withArgs(successRequest.path, {
+      body: JSON.stringify(successRequest.body),
+      query: undefined,
+    })
+    .resolves(successResponse);
+  const sendSuccessRequest = () => sendRequest({ ...successRequest });
+  const getSuccessResponse = () => ({ data: successResponse.data, error: null });
+
+  // Set up failed request helpers.
+  sendRequestSpy
+    .withArgs(errorRequest.path, {
+      body: JSON.stringify(errorRequest.body),
+      query: undefined,
+    })
+    .rejects(errorResponse);
+  const sendErrorRequest = () => sendRequest({ ...errorRequest });
+  const getErrorResponse = () => ({
+    data: null,
+    error: errorResponse.response.data,
+  });
+
+  return {
+    getSendRequestSpy: () => sendRequestSpy,
+    sendSuccessRequest,
+    getSuccessResponse,
+    sendErrorRequest,
+    getErrorResponse,
+  };
+};
diff --git a/src/plugins/es_ui_shared/public/request/send_request.test.ts b/src/plugins/es_ui_shared/public/request/send_request.test.ts
new file mode 100644
index 00000000000000..e4deaeaba817e7
--- /dev/null
+++ b/src/plugins/es_ui_shared/public/request/send_request.test.ts
@@ -0,0 +1,47 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import sinon from 'sinon';
+
+import { SendRequestHelpers, createSendRequestHelpers } from './send_request.test.helpers';
+
+describe('sendRequest function', () => {
+  let helpers: SendRequestHelpers;
+
+  beforeEach(() => {
+    helpers = createSendRequestHelpers();
+  });
+
+  it('uses the provided path, method, and body to send the request', async () => {
+    const { sendSuccessRequest, getSendRequestSpy, getSuccessResponse } = helpers;
+
+    const response = await sendSuccessRequest();
+    sinon.assert.calledOnce(getSendRequestSpy());
+    expect(response).toEqual(getSuccessResponse());
+  });
+
+  it('surfaces errors', async () => {
+    const { sendErrorRequest, getSendRequestSpy, getErrorResponse } = helpers;
+
+    // For some reason sinon isn't throwing an error on rejection, as an awaited Promise normally would.
+    const error = await sendErrorRequest();
+    sinon.assert.calledOnce(getSendRequestSpy());
+    expect(error).toEqual(getErrorResponse());
+  });
+});
diff --git a/src/plugins/es_ui_shared/public/request/send_request.ts b/src/plugins/es_ui_shared/public/request/send_request.ts
new file mode 100644
index 00000000000000..453e91570cd856
--- /dev/null
+++ b/src/plugins/es_ui_shared/public/request/send_request.ts
@@ -0,0 +1,52 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { HttpSetup, HttpFetchQuery } from '../../../../../src/core/public';
+
+export interface SendRequestConfig {
+  path: string;
+  method: 'get' | 'post' | 'put' | 'delete' | 'patch' | 'head';
+  query?: HttpFetchQuery;
+  body?: any;
+}
+
+export interface SendRequestResponse<D = any, E = any> {
+  data: D | null;
+  error: E | null;
+}
+
+export const sendRequest = async <D = any, E = any>(
+  httpClient: HttpSetup,
+  { path, method, body, query }: SendRequestConfig
+): Promise<SendRequestResponse<D, E>> => {
+  try {
+    const stringifiedBody = typeof body === 'string' ? body : JSON.stringify(body);
+    const response = await httpClient[method](path, { body: stringifiedBody, query });
+
+    return {
+      data: response.data ? response.data : response,
+      error: null,
+    };
+  } catch (e) {
+    return {
+      data: null,
+      error: e.response?.data ?? e.body,
+    };
+  }
+};
diff --git a/src/plugins/es_ui_shared/public/request/use_request.test.helpers.tsx b/src/plugins/es_ui_shared/public/request/use_request.test.helpers.tsx
new file mode 100644
index 00000000000000..0d6fd122ad22ce
--- /dev/null
+++ b/src/plugins/es_ui_shared/public/request/use_request.test.helpers.tsx
@@ -0,0 +1,184 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React from 'react';
+import { act } from 'react-dom/test-utils';
+import { mount, ReactWrapper } from 'enzyme';
+import sinon from 'sinon';
+
+import { HttpSetup, HttpFetchOptions } from '../../../../../src/core/public';
+import { SendRequestConfig, SendRequestResponse } from './send_request';
+import { useRequest, UseRequestResponse, UseRequestConfig } from './use_request';
+
+export interface UseRequestHelpers {
+  advanceTime: (ms: number) => Promise<void>;
+  completeRequest: () => Promise<void>;
+  hookResult: UseRequestResponse;
+  getSendRequestSpy: () => sinon.SinonStub;
+  setupSuccessRequest: (overrides?: {}, requestTimings?: number[]) => void;
+  getSuccessResponse: () => SendRequestResponse;
+  setupErrorRequest: (overrides?: {}, requestTimings?: number[]) => void;
+  getErrorResponse: () => SendRequestResponse;
+  setErrorResponse: (overrides?: {}) => void;
+  setupErrorWithBodyRequest: (overrides?: {}) => void;
+  getErrorWithBodyResponse: () => SendRequestResponse;
+}
+
+// Each request will take 1s to resolve.
+export const REQUEST_TIME = 1000;
+
+const successRequest: SendRequestConfig = { method: 'post', path: '/success', body: {} };
+const successResponse = { statusCode: 200, data: { message: 'Success message' } };
+
+const errorValue = { statusCode: 400, statusText: 'Error message' };
+const errorRequest: SendRequestConfig = { method: 'post', path: '/error', body: {} };
+const errorResponse = { response: { data: errorValue } };
+
+const errorWithBodyRequest: SendRequestConfig = {
+  method: 'post',
+  path: '/errorWithBody',
+  body: {},
+};
+const errorWithBodyResponse = { body: errorValue };
+
+export const createUseRequestHelpers = (): UseRequestHelpers => {
+  // The behavior we're testing involves state changes over time, so we need finer control over
+  // timing.
+  jest.useFakeTimers();
+
+  const flushPromiseJobQueue = async () => {
+    // See https://stackoverflow.com/questions/52177631/jest-timer-and-promise-dont-work-well-settimeout-and-async-function
+    await Promise.resolve();
+  };
+
+  const completeRequest = async () => {
+    await act(async () => {
+      jest.runAllTimers();
+      await flushPromiseJobQueue();
+    });
+  };
+
+  const advanceTime = async (ms: number) => {
+    await act(async () => {
+      jest.advanceTimersByTime(ms);
+      await flushPromiseJobQueue();
+    });
+  };
+
+  let element: ReactWrapper;
+  // We'll use this object to observe the state of the hook and access its callback(s).
+  const hookResult = {} as UseRequestResponse;
+  const sendRequestSpy = sinon.stub();
+
+  const setupUseRequest = (config: UseRequestConfig, requestTimings?: number[]) => {
+    let requestCount = 0;
+
+    const httpClient = {
+      post: (path: string, options: HttpFetchOptions) => {
+        return new Promise((resolve, reject) => {
+          // Increase the time it takes to resolve a request so we have time to inspect the hook
+          // as it goes through various states.
+          setTimeout(() => {
+            try {
+              resolve(sendRequestSpy(path, options));
+            } catch (e) {
+              reject(e);
+            }
+          }, (requestTimings && requestTimings[requestCount++]) || REQUEST_TIME);
+        });
+      },
+    };
+
+    const TestComponent = ({ requestConfig }: { requestConfig: UseRequestConfig }) => {
+      const { isInitialRequest, isLoading, error, data, sendRequest } = useRequest(
+        httpClient as HttpSetup,
+        requestConfig
+      );
+
+      hookResult.isInitialRequest = isInitialRequest;
+      hookResult.isLoading = isLoading;
+      hookResult.error = error;
+      hookResult.data = data;
+      hookResult.sendRequest = sendRequest;
+
+      return null;
+    };
+
+    act(() => {
+      element = mount(<TestComponent requestConfig={config} />);
+    });
+  };
+
+  // Set up successful request helpers.
+  sendRequestSpy
+    .withArgs(successRequest.path, {
+      body: JSON.stringify(successRequest.body),
+      query: undefined,
+    })
+    .resolves(successResponse);
+  const setupSuccessRequest = (overrides = {}, requestTimings?: number[]) =>
+    setupUseRequest({ ...successRequest, ...overrides }, requestTimings);
+  const getSuccessResponse = () => ({ data: successResponse.data, error: null });
+
+  // Set up failed request helpers.
+  sendRequestSpy
+    .withArgs(errorRequest.path, {
+      body: JSON.stringify(errorRequest.body),
+      query: undefined,
+    })
+    .rejects(errorResponse);
+  const setupErrorRequest = (overrides = {}, requestTimings?: number[]) =>
+    setupUseRequest({ ...errorRequest, ...overrides }, requestTimings);
+  const getErrorResponse = () => ({
+    data: null,
+    error: errorResponse.response.data,
+  });
+  // We'll use this to change a success response to an error response, to test how the state changes.
+  const setErrorResponse = (overrides = {}) => {
+    element.setProps({ requestConfig: { ...errorRequest, ...overrides } });
+  };
+
+  // Set up failed request helpers with the alternative error shape.
+  sendRequestSpy
+    .withArgs(errorWithBodyRequest.path, {
+      body: JSON.stringify(errorWithBodyRequest.body),
+      query: undefined,
+    })
+    .rejects(errorWithBodyResponse);
+  const setupErrorWithBodyRequest = (overrides = {}) =>
+    setupUseRequest({ ...errorWithBodyRequest, ...overrides });
+  const getErrorWithBodyResponse = () => ({
+    data: null,
+    error: errorWithBodyResponse.body,
+  });
+
+  return {
+    advanceTime,
+    completeRequest,
+    hookResult,
+    getSendRequestSpy: () => sendRequestSpy,
+    setupSuccessRequest,
+    getSuccessResponse,
+    setupErrorRequest,
+    getErrorResponse,
+    setErrorResponse,
+    setupErrorWithBodyRequest,
+    getErrorWithBodyResponse,
+  };
+};
diff --git a/src/plugins/es_ui_shared/public/request/use_request.test.ts b/src/plugins/es_ui_shared/public/request/use_request.test.ts
new file mode 100644
index 00000000000000..f7902218d93140
--- /dev/null
+++ b/src/plugins/es_ui_shared/public/request/use_request.test.ts
@@ -0,0 +1,353 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { act } from 'react-dom/test-utils';
+import sinon from 'sinon';
+
+import {
+  UseRequestHelpers,
+  REQUEST_TIME,
+  createUseRequestHelpers,
+} from './use_request.test.helpers';
+
+describe('useRequest hook', () => {
+  let helpers: UseRequestHelpers;
+
+  beforeEach(() => {
+    helpers = createUseRequestHelpers();
+  });
+
+  describe('parameters', () => {
+    describe('path, method, body', () => {
+      it('is used to send the request', async () => {
+        const { setupSuccessRequest, completeRequest, hookResult, getSuccessResponse } = helpers;
+        setupSuccessRequest();
+        await completeRequest();
+        expect(hookResult.data).toBe(getSuccessResponse().data);
+      });
+    });
+
+    describe('pollIntervalMs', () => {
+      it('sends another request after the specified time has elapsed', async () => {
+        const { setupSuccessRequest, advanceTime, getSendRequestSpy } = helpers;
+        setupSuccessRequest({ pollIntervalMs: REQUEST_TIME });
+
+        await advanceTime(REQUEST_TIME);
+        expect(getSendRequestSpy().callCount).toBe(1);
+
+        // We need to advance (1) the pollIntervalMs and (2) the request time.
+        await advanceTime(REQUEST_TIME * 2);
+        expect(getSendRequestSpy().callCount).toBe(2);
+
+        // We need to advance (1) the pollIntervalMs and (2) the request time.
+        await advanceTime(REQUEST_TIME * 2);
+        expect(getSendRequestSpy().callCount).toBe(3);
+      });
+    });
+
+    describe('initialData', () => {
+      it('sets the initial data value', async () => {
+        const { setupSuccessRequest, completeRequest, hookResult, getSuccessResponse } = helpers;
+        setupSuccessRequest({ initialData: 'initialData' });
+        expect(hookResult.data).toBe('initialData');
+
+        // The initial data value will be overwritten once the request resolves.
+        await completeRequest();
+        expect(hookResult.data).toBe(getSuccessResponse().data);
+      });
+    });
+
+    describe('deserializer', () => {
+      it('is called with the response once the request resolves', async () => {
+        const { setupSuccessRequest, completeRequest, getSuccessResponse } = helpers;
+
+        const deserializer = sinon.stub();
+        setupSuccessRequest({ deserializer });
+        sinon.assert.notCalled(deserializer);
+        await completeRequest();
+
+        sinon.assert.calledOnce(deserializer);
+        sinon.assert.calledWith(deserializer, getSuccessResponse().data);
+      });
+
+      it('provides the data return value', async () => {
+        const { setupSuccessRequest, completeRequest, hookResult } = helpers;
+        setupSuccessRequest({ deserializer: () => 'intercepted' });
+        await completeRequest();
+        expect(hookResult.data).toBe('intercepted');
+      });
+    });
+  });
+
+  describe('state', () => {
+    describe('isInitialRequest', () => {
+      it('is true for the first request and false for subsequent requests', async () => {
+        const { setupSuccessRequest, completeRequest, hookResult } = helpers;
+        setupSuccessRequest();
+        expect(hookResult.isInitialRequest).toBe(true);
+
+        hookResult.sendRequest();
+        await completeRequest();
+        expect(hookResult.isInitialRequest).toBe(false);
+      });
+    });
+
+    describe('isLoading', () => {
+      it('represents in-flight request status', async () => {
+        const { setupSuccessRequest, completeRequest, hookResult } = helpers;
+        setupSuccessRequest();
+        expect(hookResult.isLoading).toBe(true);
+
+        await completeRequest();
+        expect(hookResult.isLoading).toBe(false);
+      });
+    });
+
+    describe('error', () => {
+      it('surfaces errors from requests', async () => {
+        const { setupErrorRequest, completeRequest, hookResult, getErrorResponse } = helpers;
+        setupErrorRequest();
+        await completeRequest();
+        expect(hookResult.error).toBe(getErrorResponse().error);
+      });
+
+      it('surfaces body-shaped errors from requests', async () => {
+        const {
+          setupErrorWithBodyRequest,
+          completeRequest,
+          hookResult,
+          getErrorWithBodyResponse,
+        } = helpers;
+
+        setupErrorWithBodyRequest();
+        await completeRequest();
+        expect(hookResult.error).toBe(getErrorWithBodyResponse().error);
+      });
+
+      it('persists while a request is in-flight', async () => {
+        const { setupErrorRequest, completeRequest, hookResult, getErrorResponse } = helpers;
+        setupErrorRequest();
+        await completeRequest();
+        expect(hookResult.isLoading).toBe(false);
+        expect(hookResult.error).toBe(getErrorResponse().error);
+
+        act(() => {
+          hookResult.sendRequest();
+        });
+        expect(hookResult.isLoading).toBe(true);
+        expect(hookResult.error).toBe(getErrorResponse().error);
+      });
+
+      it('is null when the request is successful', async () => {
+        const { setupSuccessRequest, completeRequest, hookResult } = helpers;
+        setupSuccessRequest();
+        expect(hookResult.error).toBeNull();
+
+        await completeRequest();
+        expect(hookResult.isLoading).toBe(false);
+        expect(hookResult.error).toBeNull();
+      });
+    });
+
+    describe('data', () => {
+      it('surfaces payloads from requests', async () => {
+        const { setupSuccessRequest, completeRequest, hookResult, getSuccessResponse } = helpers;
+        setupSuccessRequest();
+        expect(hookResult.data).toBeUndefined();
+
+        await completeRequest();
+        expect(hookResult.data).toBe(getSuccessResponse().data);
+      });
+
+      it('persists while a request is in-flight', async () => {
+        const { setupSuccessRequest, completeRequest, hookResult, getSuccessResponse } = helpers;
+        setupSuccessRequest();
+        await completeRequest();
+        expect(hookResult.isLoading).toBe(false);
+        expect(hookResult.data).toBe(getSuccessResponse().data);
+
+        act(() => {
+          hookResult.sendRequest();
+        });
+        expect(hookResult.isLoading).toBe(true);
+        expect(hookResult.data).toBe(getSuccessResponse().data);
+      });
+
+      it('persists from last successful request when the next request fails', async () => {
+        const {
+          setupSuccessRequest,
+          completeRequest,
+          hookResult,
+          getErrorResponse,
+          setErrorResponse,
+          getSuccessResponse,
+        } = helpers;
+
+        setupSuccessRequest();
+        await completeRequest();
+        expect(hookResult.isLoading).toBe(false);
+        expect(hookResult.error).toBeNull();
+        expect(hookResult.data).toBe(getSuccessResponse().data);
+
+        setErrorResponse();
+        await completeRequest();
+        expect(hookResult.isLoading).toBe(false);
+        expect(hookResult.error).toBe(getErrorResponse().error);
+        expect(hookResult.data).toBe(getSuccessResponse().data);
+      });
+    });
+  });
+
+  describe('callbacks', () => {
+    describe('sendRequest', () => {
+      it('sends the request', async () => {
+        const { setupSuccessRequest, completeRequest, hookResult, getSendRequestSpy } = helpers;
+        setupSuccessRequest();
+
+        await completeRequest();
+        expect(getSendRequestSpy().callCount).toBe(1);
+
+        await act(async () => {
+          hookResult.sendRequest();
+          await completeRequest();
+        });
+        expect(getSendRequestSpy().callCount).toBe(2);
+      });
+
+      it('resets the pollIntervalMs', async () => {
+        const { setupSuccessRequest, advanceTime, hookResult, getSendRequestSpy } = helpers;
+        const DOUBLE_REQUEST_TIME = REQUEST_TIME * 2;
+        setupSuccessRequest({ pollIntervalMs: DOUBLE_REQUEST_TIME });
+
+        // The initial request resolves, and then we'll immediately send a new one manually...
+        await advanceTime(REQUEST_TIME);
+        expect(getSendRequestSpy().callCount).toBe(1);
+        act(() => {
+          hookResult.sendRequest();
+        });
+
+        // The manual request resolves, and we'll send yet another one...
+        await advanceTime(REQUEST_TIME);
+        expect(getSendRequestSpy().callCount).toBe(2);
+        act(() => {
+          hookResult.sendRequest();
+        });
+
+        // At this point, we've moved forward 3s. The poll is set at 2s. If sendRequest didn't
+        // reset the poll, the request call count would be 4, not 3.
+        await advanceTime(REQUEST_TIME);
+        expect(getSendRequestSpy().callCount).toBe(3);
+      });
+    });
+  });
+
+  describe('request behavior', () => {
+    it('outdated responses are ignored by poll requests', async () => {
+      const {
+        setupSuccessRequest,
+        setErrorResponse,
+        completeRequest,
+        hookResult,
+        getErrorResponse,
+        getSendRequestSpy,
+      } = helpers;
+      const DOUBLE_REQUEST_TIME = REQUEST_TIME * 2;
+      // Send initial request, which will have a longer round-trip time.
+      setupSuccessRequest({}, [DOUBLE_REQUEST_TIME]);
+
+      // Send a new request, which will have a shorter round-trip time.
+      setErrorResponse();
+
+      // Complete both requests.
+      await completeRequest();
+
+      // Two requests were sent...
+      expect(getSendRequestSpy().callCount).toBe(2);
+      // ...but the error response is the one that takes precedence because it was *sent* more
+      // recently, despite the success response *returning* more recently.
+      expect(hookResult.error).toBe(getErrorResponse().error);
+      expect(hookResult.data).toBeUndefined();
+    });
+
+    it(`outdated responses are ignored if there's a more recently-sent manual request`, async () => {
+      const { setupSuccessRequest, advanceTime, hookResult, getSendRequestSpy } = helpers;
+
+      const HALF_REQUEST_TIME = REQUEST_TIME * 0.5;
+      setupSuccessRequest({ pollIntervalMs: REQUEST_TIME });
+
+      // Before the original request resolves, we make a manual sendRequest call.
+      await advanceTime(HALF_REQUEST_TIME);
+      expect(getSendRequestSpy().callCount).toBe(0);
+      act(() => {
+        hookResult.sendRequest();
+      });
+
+      // The original quest resolves but it's been marked as outdated by the the manual sendRequest
+      // call "interrupts", so data is left undefined.
+      await advanceTime(HALF_REQUEST_TIME);
+      expect(getSendRequestSpy().callCount).toBe(1);
+      expect(hookResult.data).toBeUndefined();
+    });
+
+    it(`changing pollIntervalMs doesn't trigger a new request`, async () => {
+      const { setupErrorRequest, setErrorResponse, completeRequest, getSendRequestSpy } = helpers;
+      const DOUBLE_REQUEST_TIME = REQUEST_TIME * 2;
+      // Send initial request.
+      setupErrorRequest({ pollIntervalMs: REQUEST_TIME });
+
+      // Setting a new poll will schedule a second request, but not send one immediately.
+      setErrorResponse({ pollIntervalMs: DOUBLE_REQUEST_TIME });
+
+      // Complete initial request.
+      await completeRequest();
+
+      // Complete scheduled poll request.
+      await completeRequest();
+      expect(getSendRequestSpy().callCount).toBe(2);
+    });
+
+    it('when the path changes after a request is scheduled, the scheduled request is sent with that path', async () => {
+      const {
+        setupSuccessRequest,
+        completeRequest,
+        hookResult,
+        getErrorResponse,
+        setErrorResponse,
+        getSendRequestSpy,
+      } = helpers;
+      const DOUBLE_REQUEST_TIME = REQUEST_TIME * 2;
+
+      // Sned first request and schedule a request, both with the success path.
+      setupSuccessRequest({ pollIntervalMs: DOUBLE_REQUEST_TIME });
+
+      // Change the path to the error path, sending a second request. pollIntervalMs is the same
+      // so the originally scheduled poll remains cheduled.
+      setErrorResponse({ pollIntervalMs: DOUBLE_REQUEST_TIME });
+
+      // Complete the initial request, the requests by the path change, and the scheduled poll request.
+      await completeRequest();
+      await completeRequest();
+
+      // If the scheduled poll request was sent to the success path, we wouldn't have an error result.
+      // But we do, because it was sent to the error path.
+      expect(getSendRequestSpy().callCount).toBe(3);
+      expect(hookResult.error).toBe(getErrorResponse().error);
+    });
+  });
+});
diff --git a/src/plugins/es_ui_shared/public/request/use_request.ts b/src/plugins/es_ui_shared/public/request/use_request.ts
new file mode 100644
index 00000000000000..481843bf40e88c
--- /dev/null
+++ b/src/plugins/es_ui_shared/public/request/use_request.ts
@@ -0,0 +1,161 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { useEffect, useCallback, useState, useRef, useMemo } from 'react';
+
+import { HttpSetup } from '../../../../../src/core/public';
+import {
+  sendRequest as sendStatelessRequest,
+  SendRequestConfig,
+  SendRequestResponse,
+} from './send_request';
+
+export interface UseRequestConfig extends SendRequestConfig {
+  pollIntervalMs?: number;
+  initialData?: any;
+  deserializer?: (data: any) => any;
+}
+
+export interface UseRequestResponse<D = any, E = Error> {
+  isInitialRequest: boolean;
+  isLoading: boolean;
+  error: E | null;
+  data?: D | null;
+  sendRequest: () => Promise<SendRequestResponse<D, E>>;
+}
+
+export const useRequest = <D = any, E = Error>(
+  httpClient: HttpSetup,
+  { path, method, query, body, pollIntervalMs, initialData, deserializer }: UseRequestConfig
+): UseRequestResponse<D, E> => {
+  const isMounted = useRef(false);
+
+  // Main states for tracking request status and data
+  const [error, setError] = useState<null | any>(null);
+  const [isLoading, setIsLoading] = useState<boolean>(true);
+  const [data, setData] = useState<any>(initialData);
+
+  // Consumers can use isInitialRequest to implement a polling UX.
+  const requestCountRef = useRef<number>(0);
+  const isInitialRequest = requestCountRef.current === 0;
+  const pollIntervalIdRef = useRef<any>(null);
+
+  const clearPollInterval = useCallback(() => {
+    if (pollIntervalIdRef.current) {
+      clearTimeout(pollIntervalIdRef.current);
+      pollIntervalIdRef.current = null;
+    }
+  }, []);
+
+  // Convert our object to string to be able to compare them in our useMemo,
+  // allowing the consumer to freely passed new objects to the hook on each
+  // render without requiring them to be memoized.
+  const queryStringified = query ? JSON.stringify(query) : undefined;
+  const bodyStringified = body ? JSON.stringify(body) : undefined;
+
+  const requestBody = useMemo(() => {
+    return {
+      path,
+      method,
+      query: queryStringified ? query : undefined,
+      body: bodyStringified ? body : undefined,
+    };
+    // queryStringified and bodyStringified stand in for query and body as dependencies.
+    /* eslint-disable-next-line react-hooks/exhaustive-deps */
+  }, [path, method, queryStringified, bodyStringified]);
+
+  const sendRequest = useCallback(async () => {
+    // If we're on an interval, this allows us to reset it if the user has manually requested the
+    // data, to avoid doubled-up requests.
+    clearPollInterval();
+
+    const requestId = ++requestCountRef.current;
+
+    // We don't clear error or data, so it's up to the consumer to decide whether to display the
+    // "old" error/data or loading state when a new request is in-flight.
+    setIsLoading(true);
+
+    const response = await sendStatelessRequest<D, E>(httpClient, requestBody);
+    const { data: serializedResponseData, error: responseError } = response;
+
+    const isOutdatedRequest = requestId !== requestCountRef.current;
+    const isUnmounted = isMounted.current === false;
+
+    // Ignore outdated or irrelevant data.
+    if (isOutdatedRequest || isUnmounted) {
+      return { data: null, error: null };
+    }
+
+    setError(responseError);
+    // If there's an error, keep the data from the last request in case it's still useful to the user.
+    if (!responseError) {
+      const responseData = deserializer
+        ? deserializer(serializedResponseData)
+        : serializedResponseData;
+      setData(responseData);
+    }
+    // Setting isLoading to false also acts as a signal for scheduling the next poll request.
+    setIsLoading(false);
+
+    return { data: serializedResponseData, error: responseError };
+  }, [requestBody, httpClient, deserializer, clearPollInterval]);
+
+  const scheduleRequest = useCallback(() => {
+    // If there's a scheduled poll request, this new one will supersede it.
+    clearPollInterval();
+
+    if (pollIntervalMs) {
+      pollIntervalIdRef.current = setTimeout(sendRequest, pollIntervalMs);
+    }
+  }, [pollIntervalMs, sendRequest, clearPollInterval]);
+
+  // Send the request on component mount and whenever the dependencies of sendRequest() change.
+  useEffect(() => {
+    sendRequest();
+  }, [sendRequest]);
+
+  // Schedule the next poll request when the previous one completes.
+  useEffect(() => {
+    // When a request completes, attempt to schedule the next one. Note that we aren't re-scheduling
+    // a request whenever sendRequest's dependencies change. isLoading isn't set to false until the
+    // initial request has completed, so we won't schedule a request on mount.
+    if (!isLoading) {
+      scheduleRequest();
+    }
+  }, [isLoading, scheduleRequest]);
+
+  useEffect(() => {
+    isMounted.current = true;
+
+    return () => {
+      isMounted.current = false;
+
+      // Clean up on unmount.
+      clearPollInterval();
+    };
+  }, [clearPollInterval]);
+
+  return {
+    isInitialRequest,
+    isLoading,
+    error,
+    data,
+    sendRequest, // Gives the user the ability to manually request data
+  };
+};
diff --git a/src/plugins/es_ui_shared/static/forms/components/fields/combobox_field.tsx b/src/plugins/es_ui_shared/static/forms/components/fields/combobox_field.tsx
index 9fb804eb7fafac..b2f1a70341315f 100644
--- a/src/plugins/es_ui_shared/static/forms/components/fields/combobox_field.tsx
+++ b/src/plugins/es_ui_shared/static/forms/components/fields/combobox_field.tsx
@@ -74,7 +74,7 @@ export const ComboBoxField = ({ field, euiFieldProps = {}, ...rest }: Props) =>
   };
 
   const onSearchComboChange = (value: string) => {
-    if (value) {
+    if (value !== undefined) {
       field.clearErrors(VALIDATION_TYPES.ARRAY_ITEM);
     }
   };
diff --git a/src/plugins/es_ui_shared/static/forms/components/fields/range_field.tsx b/src/plugins/es_ui_shared/static/forms/components/fields/range_field.tsx
index e02c9b6c186154..9ffa7adace781a 100644
--- a/src/plugins/es_ui_shared/static/forms/components/fields/range_field.tsx
+++ b/src/plugins/es_ui_shared/static/forms/components/fields/range_field.tsx
@@ -31,15 +31,16 @@ interface Props {
 
 export const RangeField = ({ field, euiFieldProps = {}, ...rest }: Props) => {
   const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
+  const { onChange: onFieldChange } = field;
 
   const onChange = useCallback(
     (e: React.ChangeEvent<HTMLInputElement> | React.MouseEvent<HTMLButtonElement>) => {
       const event = ({ ...e, value: `${e.currentTarget.value}` } as unknown) as React.ChangeEvent<{
         value: string;
       }>;
-      field.onChange(event);
+      onFieldChange(event);
     },
-    [field.onChange]
+    [onFieldChange]
   );
 
   return (
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form.tsx
index b3a15fea8b187e..287ac562434460 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form.tsx
@@ -21,6 +21,7 @@ import React, { ReactNode } from 'react';
 import { EuiForm } from '@elastic/eui';
 
 import { FormProvider } from '../form_context';
+import { FormDataContextProvider } from '../form_data_context';
 import { FormHook } from '../types';
 
 interface Props {
@@ -30,8 +31,14 @@ interface Props {
   [key: string]: any;
 }
 
-export const Form = ({ form, FormWrapper = EuiForm, ...rest }: Props) => (
-  <FormProvider form={form}>
-    <FormWrapper {...rest} />
-  </FormProvider>
-);
+export const Form = ({ form, FormWrapper = EuiForm, ...rest }: Props) => {
+  const { getFormData, __getFormData$ } = form;
+
+  return (
+    <FormDataContextProvider getFormData={getFormData} getFormData$={__getFormData$}>
+      <FormProvider form={form}>
+        <FormWrapper {...rest} />
+      </FormProvider>
+    </FormDataContextProvider>
+  );
+};
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.test.tsx
index 25448dff18e8ac..d9095944eaa335 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.test.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.test.tsx
@@ -75,16 +75,7 @@ describe('<FormDataProvider />', () => {
       setInputValue('lastNameField', 'updated value');
     });
 
-    /**
-     * The children will be rendered three times:
-     * - Twice for each input value that has changed
-     * - once because after updating both fields, the **form** isValid state changes (from "undefined" to "true")
-     *   causing a new "form" object to be returned and thus a re-render.
-     *
-     * When the form object will be memoized (in a future PR), te bellow call count should only be 2 as listening
-     * to form data changes should not receive updates when the "isValid" state of the form changes.
-     */
-    expect(onFormData.mock.calls.length).toBe(3);
+    expect(onFormData).toBeCalledTimes(2);
 
     const [formDataUpdated] = onFormData.mock.calls[onFormData.mock.calls.length - 1] as Parameters<
       OnUpdateHandler
@@ -130,7 +121,7 @@ describe('<FormDataProvider />', () => {
       find,
     } = setup() as TestBed;
 
-    expect(onFormData.mock.calls.length).toBe(0); // Not present in the DOM yet
+    expect(onFormData).toBeCalledTimes(0); // Not present in the DOM yet
 
     // Make some changes to the form fields
     await act(async () => {
@@ -188,7 +179,7 @@ describe('<FormDataProvider />', () => {
       setInputValue('lastNameField', 'updated value');
     });
 
-    expect(onFormData.mock.calls.length).toBe(0);
+    expect(onFormData).toBeCalledTimes(0);
   });
 
   test('props.pathsToWatch (Array<string>): should not re-render the children when the field that changed is not in the watch list', async () => {
@@ -228,14 +219,14 @@ describe('<FormDataProvider />', () => {
     });
 
     // No re-render
-    expect(onFormData.mock.calls.length).toBe(0);
+    expect(onFormData).toBeCalledTimes(0);
 
     // Make some changes to fields in the watch list
     await act(async () => {
       setInputValue('nameField', 'updated value');
     });
 
-    expect(onFormData.mock.calls.length).toBe(1);
+    expect(onFormData).toBeCalledTimes(1);
 
     onFormData.mockReset();
 
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts
index 3630b902f05649..ac141baf8fc719 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts
@@ -17,10 +17,10 @@
  * under the License.
  */
 
-import React, { useState, useEffect, useRef, useCallback } from 'react';
+import React from 'react';
 
 import { FormData } from '../types';
-import { useFormContext } from '../form_context';
+import { useFormData } from '../hooks';
 
 interface Props {
   children: (formData: FormData) => JSX.Element | null;
@@ -28,46 +28,9 @@ interface Props {
 }
 
 export const FormDataProvider = React.memo(({ children, pathsToWatch }: Props) => {
-  const form = useFormContext();
-  const { subscribe } = form;
-  const previousRawData = useRef<FormData>(form.__getFormData$().value);
-  const isMounted = useRef(false);
-  const [formData, setFormData] = useState<FormData>(previousRawData.current);
+  const { 0: formData, 2: isReady } = useFormData({ watch: pathsToWatch });
 
-  const onFormData = useCallback(
-    ({ data: { raw } }) => {
-      // To avoid re-rendering the children for updates on the form data
-      // that we are **not** interested in, we can specify one or multiple path(s)
-      // to watch.
-      if (pathsToWatch) {
-        const valuesToWatchArray = Array.isArray(pathsToWatch)
-          ? (pathsToWatch as string[])
-          : ([pathsToWatch] as string[]);
-
-        if (valuesToWatchArray.some((value) => previousRawData.current[value] !== raw[value])) {
-          previousRawData.current = raw;
-          setFormData(raw);
-        }
-      } else {
-        setFormData(raw);
-      }
-    },
-    [pathsToWatch]
-  );
-
-  useEffect(() => {
-    const subscription = subscribe(onFormData);
-    return subscription.unsubscribe;
-  }, [subscribe, onFormData]);
-
-  useEffect(() => {
-    isMounted.current = true;
-    return () => {
-      isMounted.current = false;
-    };
-  }, []);
-
-  if (!isMounted.current && Object.keys(formData).length === 0) {
+  if (!isReady) {
     // No field has mounted yet, don't render anything
     return null;
   }
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
index a55b2f0a8fa291..c14471991ccd33 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
@@ -64,6 +64,93 @@ describe('<UseField />', () => {
     });
   });
 
+  describe('validation', () => {
+    let formHook: FormHook | null = null;
+
+    beforeEach(() => {
+      formHook = null;
+    });
+
+    const onFormHook = (form: FormHook) => {
+      formHook = form;
+    };
+
+    const getTestComp = (fieldConfig: FieldConfig) => {
+      const TestComp = ({ onForm }: { onForm: (form: FormHook) => void }) => {
+        const { form } = useForm<any>();
+
+        useEffect(() => {
+          onForm(form);
+        }, [onForm, form]);
+
+        return (
+          <Form form={form}>
+            <UseField path="name" config={fieldConfig} data-test-subj="myField" />
+          </Form>
+        );
+      };
+      return TestComp;
+    };
+
+    const setup = (fieldConfig: FieldConfig) => {
+      return registerTestBed(getTestComp(fieldConfig), {
+        memoryRouter: { wrapComponent: false },
+        defaultProps: { onForm: onFormHook },
+      })() as TestBed;
+    };
+
+    test('should update the form validity whenever the field value changes', async () => {
+      const fieldConfig: FieldConfig = {
+        defaultValue: '', // empty string, which is not valid
+        validations: [
+          {
+            validator: ({ value }) => {
+              // Validate that string is not empty
+              if ((value as string).trim() === '') {
+                return { message: 'Error: field is empty.' };
+              }
+            },
+          },
+        ],
+      };
+
+      // Mount our TestComponent
+      const {
+        form: { setInputValue },
+      } = setup(fieldConfig);
+
+      if (formHook === null) {
+        throw new Error('FormHook object has not been set.');
+      }
+
+      let { isValid } = formHook;
+      expect(isValid).toBeUndefined(); // Initially the form validity is undefined...
+
+      await act(async () => {
+        await formHook!.validate(); // ...until we validate the form
+      });
+
+      ({ isValid } = formHook);
+      expect(isValid).toBe(false);
+
+      // Change to a non empty string to pass validation
+      await act(async () => {
+        setInputValue('myField', 'changedValue');
+      });
+
+      ({ isValid } = formHook);
+      expect(isValid).toBe(true);
+
+      // Change back to an empty string to fail validation
+      await act(async () => {
+        setInputValue('myField', '');
+      });
+
+      ({ isValid } = formHook);
+      expect(isValid).toBe(false);
+    });
+  });
+
   describe('serializer(), deserializer(), formatter()', () => {
     interface MyForm {
       name: string;
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/form_data_context.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/form_data_context.tsx
new file mode 100644
index 00000000000000..0e6a75e9c5065a
--- /dev/null
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/form_data_context.tsx
@@ -0,0 +1,50 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React, { createContext, useContext, useMemo } from 'react';
+
+import { FormData, FormHook } from './types';
+import { Subject } from './lib';
+
+export interface Context<T extends FormData = FormData> {
+  getFormData$: () => Subject<FormData>;
+  getFormData: FormHook<T>['getFormData'];
+}
+
+const FormDataContext = createContext<Context<any> | undefined>(undefined);
+
+interface Props extends Context {
+  children: React.ReactNode;
+}
+
+export const FormDataContextProvider = ({ children, getFormData$, getFormData }: Props) => {
+  const value = useMemo<Context>(
+    () => ({
+      getFormData,
+      getFormData$,
+    }),
+    [getFormData, getFormData$]
+  );
+
+  return <FormDataContext.Provider value={value}>{children}</FormDataContext.Provider>;
+};
+
+export function useFormDataContext<T extends FormData = FormData>() {
+  return useContext<Context<T> | undefined>(FormDataContext);
+}
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/index.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/index.ts
index 6a04a592227f95..45c11dd6272e4b 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/index.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/index.ts
@@ -19,3 +19,4 @@
 
 export { useField } from './use_field';
 export { useForm } from './use_form';
+export { useFormData } from './use_form_data';
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
index 9d22e4eb2ee5e5..f01c7226ea4cea 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
@@ -69,11 +69,12 @@ export const useField = <T>(
   const [isChangingValue, setIsChangingValue] = useState(false);
   const [isValidated, setIsValidated] = useState(false);
 
+  const isMounted = useRef<boolean>(false);
   const validateCounter = useRef(0);
   const changeCounter = useRef(0);
+  const hasBeenReset = useRef<boolean>(false);
   const inflightValidation = useRef<Promise<any> | null>(null);
   const debounceTimeout = useRef<NodeJS.Timeout | null>(null);
-  const isMounted = useRef<boolean>(false);
 
   // -- HELPERS
   // ----------------------------------
@@ -142,11 +143,7 @@ export const useField = <T>(
     __updateFormDataAt(path, value);
 
     // Validate field(s) (that will update form.isValid state)
-    // We only validate if the value is different than the initial or default value
-    // to avoid validating after a form.reset() call.
-    if (value !== initialValue && value !== defaultValue) {
-      await __validateFields(fieldsToValidateOnChange ?? [path]);
-    }
+    await __validateFields(fieldsToValidateOnChange ?? [path]);
 
     if (isMounted.current === false) {
       return;
@@ -172,8 +169,6 @@ export const useField = <T>(
   }, [
     path,
     value,
-    defaultValue,
-    initialValue,
     valueChangeListener,
     errorDisplayDelay,
     fieldsToValidateOnChange,
@@ -254,6 +249,8 @@ export const useField = <T>(
 
           validationErrors.push({
             ...validationResult,
+            // See comment below that explains why we add "__isBlocking__".
+            __isBlocking__: validationResult.__isBlocking__ ?? validation.isBlocking,
             validationType: validationType || VALIDATION_TYPES.FIELD,
           });
 
@@ -306,6 +303,11 @@ export const useField = <T>(
 
           validationErrors.push({
             ...(validationResult as ValidationError),
+            // We add an "__isBlocking__" property to know if this error is a blocker or no.
+            // Most validation errors are blockers but in some cases a validation is more a warning than an error
+            // like with the ComboBox items when they are added.
+            __isBlocking__:
+              (validationResult as ValidationError).__isBlocking__ ?? validation.isBlocking,
             validationType: validationType || VALIDATION_TYPES.FIELD,
           });
 
@@ -394,7 +396,13 @@ export const useField = <T>(
   );
 
   const _setErrors: FieldHook<T>['setErrors'] = useCallback((_errors) => {
-    setErrors(_errors.map((error) => ({ validationType: VALIDATION_TYPES.FIELD, ...error })));
+    setErrors(
+      _errors.map((error) => ({
+        validationType: VALIDATION_TYPES.FIELD,
+        __isBlocking__: true,
+        ...error,
+      }))
+    );
   }, []);
 
   /**
@@ -455,6 +463,7 @@ export const useField = <T>(
       setErrors([]);
 
       if (resetValue) {
+        hasBeenReset.current = true;
         const newValue = deserializeValue(updatedDefaultValue ?? defaultValue);
         setValue(newValue);
         return newValue;
@@ -463,7 +472,8 @@ export const useField = <T>(
     [setValue, deserializeValue, defaultValue]
   );
 
-  const isValid = errors.length === 0;
+  // Don't take into account non blocker validation. Some are just warning (like trying to add a wrong ComboBox item)
+  const isValid = errors.filter((e) => e.__isBlocking__ !== false).length === 0;
 
   const field = useMemo<FieldHook<T>>(() => {
     return {
@@ -525,6 +535,13 @@ export const useField = <T>(
   }, [path, __removeField]);
 
   useEffect(() => {
+    // If the field value has been reset, we don't want to call the "onValueChange()"
+    // as it will set the "isPristine" state to true or validate the field, which initially we don't want.
+    if (hasBeenReset.current) {
+      hasBeenReset.current = false;
+      return;
+    }
+
     if (!isMounted.current) {
       return;
     }
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
index 007e492243baca..edcd84daf5d2fe 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
@@ -22,7 +22,13 @@ import { act } from 'react-dom/test-utils';
 import { registerTestBed, getRandomString, TestBed } from '../shared_imports';
 
 import { Form, UseField } from '../components';
-import { FormSubmitHandler, OnUpdateHandler, FormHook, ValidationFunc } from '../types';
+import {
+  FormSubmitHandler,
+  OnUpdateHandler,
+  FormHook,
+  ValidationFunc,
+  FieldConfig,
+} from '../types';
 import { useForm } from './use_form';
 
 interface MyForm {
@@ -39,7 +45,7 @@ const onFormHook = (_form: FormHook<any>) => {
   formHook = _form;
 };
 
-describe('use_form() hook', () => {
+describe('useForm() hook', () => {
   beforeEach(() => {
     formHook = null;
   });
@@ -441,5 +447,57 @@ describe('use_form() hook', () => {
         deeply: { nested: { value: '' } }, // Fallback to empty string as no config was provided
       });
     });
+
+    test('should not validate the fields after resetting its value (form validity should be undefined)', async () => {
+      const fieldConfig: FieldConfig = {
+        defaultValue: '',
+        validations: [
+          {
+            validator: ({ value }) => {
+              if ((value as string).trim() === '') {
+                return { message: 'Error: empty string' };
+              }
+            },
+          },
+        ],
+      };
+
+      const TestResetComp = () => {
+        const { form } = useForm();
+
+        useEffect(() => {
+          formHook = form;
+        }, [form]);
+
+        return (
+          <Form form={form}>
+            <UseField path="username" config={fieldConfig} data-test-subj="myField" />
+          </Form>
+        );
+      };
+
+      const {
+        form: { setInputValue },
+      } = registerTestBed(TestResetComp, {
+        memoryRouter: { wrapComponent: false },
+      })() as TestBed;
+
+      let { isValid } = formHook!;
+      expect(isValid).toBeUndefined();
+
+      await act(async () => {
+        setInputValue('myField', 'changedValue');
+      });
+      ({ isValid } = formHook!);
+      expect(isValid).toBe(true);
+
+      await act(async () => {
+        // When we reset the form, value is back to "", which is invalid for the field
+        formHook!.reset();
+      });
+
+      ({ isValid } = formHook!);
+      expect(isValid).toBeUndefined(); // Make sure it is "undefined" and not "false".
+    });
   });
 });
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
index 35bac5b9a58c65..7b72a9eeacf7b1 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
@@ -240,6 +240,12 @@ export function useForm<T extends FormData = FormData>(
 
       if (!field.isValidated) {
         setIsValid(undefined);
+
+        // When we submit the form (and set "isSubmitted" to "true"), we validate **all fields**.
+        // If a field is added and it is not validated it means that we have swapped fields and added new ones:
+        // --> we have basically have a new form in front of us.
+        // For that reason we make sure that the "isSubmitted" state is false.
+        setIsSubmitted(false);
       }
     },
     [updateFormDataAt]
@@ -389,6 +395,7 @@ export function useForm<T extends FormData = FormData>(
       isValid,
       id,
       submit: submitForm,
+      validate: validateAllFields,
       subscribe,
       setFieldValue,
       setFieldErrors,
@@ -428,6 +435,7 @@ export function useForm<T extends FormData = FormData>(
     addField,
     removeField,
     validateFields,
+    validateAllFields,
   ]);
 
   useEffect(() => {
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data.test.tsx
new file mode 100644
index 00000000000000..0fb65daecf2f4f
--- /dev/null
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data.test.tsx
@@ -0,0 +1,234 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React, { useEffect } from 'react';
+import { act } from 'react-dom/test-utils';
+
+import { registerTestBed, TestBed } from '../shared_imports';
+import { Form, UseField } from '../components';
+import { useForm } from './use_form';
+import { useFormData, HookReturn } from './use_form_data';
+
+interface Props {
+  onChange(data: HookReturn): void;
+  watch?: string | string[];
+}
+
+describe('useFormData() hook', () => {
+  const HookListenerComp = React.memo(({ onChange, watch }: Props) => {
+    const hookValue = useFormData({ watch });
+
+    useEffect(() => {
+      onChange(hookValue);
+    }, [hookValue, onChange]);
+
+    return null;
+  });
+
+  describe('form data updates', () => {
+    let testBed: TestBed;
+    let onChangeSpy: jest.Mock;
+
+    const getLastMockValue = () => {
+      return onChangeSpy.mock.calls[onChangeSpy.mock.calls.length - 1][0] as HookReturn;
+    };
+
+    const TestComp = (props: Props) => {
+      const { form } = useForm();
+
+      return (
+        <Form form={form}>
+          <UseField path="title" defaultValue="titleInitialValue" data-test-subj="titleField" />
+          <HookListenerComp {...props} />
+        </Form>
+      );
+    };
+
+    const setup = registerTestBed(TestComp, {
+      memoryRouter: { wrapComponent: false },
+    });
+
+    beforeEach(() => {
+      onChangeSpy = jest.fn();
+      testBed = setup({ onChange: onChangeSpy }) as TestBed;
+    });
+
+    test('should return the form data', () => {
+      // Called twice:
+      // once when the hook is called and once when the fields have mounted and updated the form data
+      expect(onChangeSpy).toBeCalledTimes(2);
+      const [data] = getLastMockValue();
+      expect(data).toEqual({ title: 'titleInitialValue' });
+    });
+
+    test('should listen to field changes', async () => {
+      const {
+        form: { setInputValue },
+      } = testBed;
+
+      await act(async () => {
+        setInputValue('titleField', 'titleChanged');
+      });
+
+      expect(onChangeSpy).toBeCalledTimes(3);
+      const [data] = getLastMockValue();
+      expect(data).toEqual({ title: 'titleChanged' });
+    });
+  });
+
+  describe('format form data', () => {
+    let onChangeSpy: jest.Mock;
+
+    const getLastMockValue = () => {
+      return onChangeSpy.mock.calls[onChangeSpy.mock.calls.length - 1][0] as HookReturn;
+    };
+
+    const TestComp = (props: Props) => {
+      const { form } = useForm();
+
+      return (
+        <Form form={form}>
+          <UseField path="user.firstName" defaultValue="John" />
+          <UseField path="user.lastName" defaultValue="Snow" />
+          <HookListenerComp {...props} />
+        </Form>
+      );
+    };
+
+    const setup = registerTestBed(TestComp, {
+      memoryRouter: { wrapComponent: false },
+    });
+
+    beforeEach(() => {
+      onChangeSpy = jest.fn();
+      setup({ onChange: onChangeSpy });
+    });
+
+    test('should expose a handler to build the form data', () => {
+      const { 1: format } = getLastMockValue();
+      expect(format()).toEqual({
+        user: {
+          firstName: 'John',
+          lastName: 'Snow',
+        },
+      });
+    });
+  });
+
+  describe('options', () => {
+    describe('watch', () => {
+      let testBed: TestBed;
+      let onChangeSpy: jest.Mock;
+
+      const getLastMockValue = () => {
+        return onChangeSpy.mock.calls[onChangeSpy.mock.calls.length - 1][0] as HookReturn;
+      };
+
+      const TestComp = (props: Props) => {
+        const { form } = useForm();
+
+        return (
+          <Form form={form}>
+            <UseField path="title" defaultValue="titleInitialValue" data-test-subj="titleField" />
+            <HookListenerComp {...props} />
+            <UseField
+              path="subTitle"
+              defaultValue="subTitleInitialValue"
+              data-test-subj="subTitleField"
+            />
+          </Form>
+        );
+      };
+
+      const setup = registerTestBed(TestComp, {
+        memoryRouter: { wrapComponent: false },
+      });
+
+      beforeEach(() => {
+        onChangeSpy = jest.fn();
+        testBed = setup({ watch: 'title', onChange: onChangeSpy }) as TestBed;
+      });
+
+      test('should not listen to changes on fields we are not interested in', async () => {
+        const {
+          form: { setInputValue },
+        } = testBed;
+
+        await act(async () => {
+          // Changing a field we are **not** interested in
+          setInputValue('subTitleField', 'subTitleChanged');
+          // Changing a field we **are** interested in
+          setInputValue('titleField', 'titleChanged');
+        });
+
+        const [data] = getLastMockValue();
+        expect(data).toEqual({ title: 'titleChanged', subTitle: 'subTitleInitialValue' });
+      });
+    });
+
+    describe('form', () => {
+      let testBed: TestBed;
+      let onChangeSpy: jest.Mock;
+
+      const getLastMockValue = () => {
+        return onChangeSpy.mock.calls[onChangeSpy.mock.calls.length - 1][0] as HookReturn;
+      };
+
+      const TestComp = ({ onChange }: Props) => {
+        const { form } = useForm();
+        const hookValue = useFormData({ form });
+
+        useEffect(() => {
+          onChange(hookValue);
+        }, [hookValue, onChange]);
+
+        return (
+          <Form form={form}>
+            <UseField path="title" defaultValue="titleInitialValue" data-test-subj="titleField" />
+          </Form>
+        );
+      };
+
+      const setup = registerTestBed(TestComp, {
+        memoryRouter: { wrapComponent: false },
+      });
+
+      beforeEach(() => {
+        onChangeSpy = jest.fn();
+        testBed = setup({ onChange: onChangeSpy }) as TestBed;
+      });
+
+      test('should allow a form to be provided when the hook is called outside of the FormDataContext', async () => {
+        const {
+          form: { setInputValue },
+        } = testBed;
+
+        const [initialData] = getLastMockValue();
+        expect(initialData).toEqual({ title: 'titleInitialValue' });
+
+        await act(async () => {
+          setInputValue('titleField', 'titleChanged');
+        });
+
+        const [updatedData] = getLastMockValue();
+        expect(updatedData).toEqual({ title: 'titleChanged' });
+      });
+    });
+  });
+});
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data.ts
new file mode 100644
index 00000000000000..fb4a0984438ad4
--- /dev/null
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data.ts
@@ -0,0 +1,91 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { useState, useEffect, useRef, useCallback } from 'react';
+
+import { FormData, FormHook } from '../types';
+import { useFormDataContext, Context } from '../form_data_context';
+
+interface Options {
+  watch?: string | string[];
+  form?: FormHook<any>;
+}
+
+export type HookReturn<T extends object = FormData> = [FormData, () => T, boolean];
+
+export const useFormData = <T extends object = FormData>(options: Options = {}): HookReturn<T> => {
+  const { watch, form } = options;
+  const ctx = useFormDataContext<T>();
+
+  let getFormData: Context<T>['getFormData'];
+  let getFormData$: Context<T>['getFormData$'];
+
+  if (form !== undefined) {
+    getFormData = form.getFormData;
+    getFormData$ = form.__getFormData$;
+  } else if (ctx !== undefined) {
+    ({ getFormData, getFormData$ } = ctx);
+  } else {
+    throw new Error(
+      'useFormData() must be used within a <FormDataContextProvider /> or you need to pass FormHook object in the options.'
+    );
+  }
+
+  const initialValue = getFormData$().value;
+
+  const previousRawData = useRef<FormData>(initialValue);
+  const isMounted = useRef(false);
+  const [formData, setFormData] = useState<FormData>(previousRawData.current);
+
+  const formatFormData = useCallback(() => {
+    return getFormData({ unflatten: true });
+  }, [getFormData]);
+
+  useEffect(() => {
+    const subscription = getFormData$().subscribe((raw) => {
+      if (watch) {
+        const valuesToWatchArray = Array.isArray(watch)
+          ? (watch as string[])
+          : ([watch] as string[]);
+
+        if (valuesToWatchArray.some((value) => previousRawData.current[value] !== raw[value])) {
+          previousRawData.current = raw;
+          // Only update the state if one of the field we watch has changed.
+          setFormData(raw);
+        }
+      } else {
+        setFormData(raw);
+      }
+    });
+    return subscription.unsubscribe;
+  }, [getFormData$, watch]);
+
+  useEffect(() => {
+    isMounted.current = true;
+    return () => {
+      isMounted.current = false;
+    };
+  }, []);
+
+  if (!isMounted.current && Object.keys(formData).length === 0) {
+    // No field has mounted yet
+    return [formData, formatFormData, false];
+  }
+
+  return [formData, formatFormData, true];
+};
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/index.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/index.ts
index 3079814c9ad14b..8d6b57fbeb3155 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/index.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/index.ts
@@ -19,7 +19,7 @@
 
 // Only export the useForm hook. The "useField" hook is for internal use
 // as the consumer of the library must use the <UseField /> component
-export { useForm } from './hooks';
+export { useForm, useFormData } from './hooks';
 export { getFieldValidityAndErrorMessage } from './helpers';
 
 export * from './form_context';
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
index dc495f6eb56b4e..4b343ec5e9f2e1 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
@@ -30,6 +30,7 @@ export interface FormHook<T extends FormData = FormData> {
   readonly isValid: boolean | undefined;
   readonly id: string;
   submit: (e?: FormEvent<HTMLFormElement> | MouseEvent) => Promise<{ data: T; isValid: boolean }>;
+  validate: () => Promise<boolean>;
   subscribe: (handler: OnUpdateHandler<T>) => Subscription;
   setFieldValue: (fieldName: string, value: FieldValue) => void;
   setFieldErrors: (fieldName: string, errors: ValidationError[]) => void;
@@ -147,6 +148,7 @@ export interface ValidationError<T = string> {
   message: string;
   code?: T;
   validationType?: string;
+  __isBlocking__?: boolean;
   [key: string]: any;
 }
 
@@ -185,5 +187,11 @@ type FieldValue = unknown;
 export interface ValidationConfig<T extends FormData = any> {
   validator: ValidationFunc<T>;
   type?: string;
+  /**
+   * By default all validation are blockers, which means that if they fail, the field is invalid.
+   * In some cases, like when trying to add an item to the ComboBox, if the item is not valid we want
+   * to show a validation error. But this validation is **not** blocking. Simply, the item has not been added.
+   */
+  isBlocking?: boolean;
   exitOnFail?: boolean;
 }
diff --git a/src/plugins/home/public/application/application.tsx b/src/plugins/home/public/application/application.tsx
index 5d71bf8651d88a..a4a158bc7dbde5 100644
--- a/src/plugins/home/public/application/application.tsx
+++ b/src/plugins/home/public/application/application.tsx
@@ -47,6 +47,13 @@ export const renderApp = async (
 
   chrome.setBreadcrumbs([{ text: homeTitle }]);
 
+  // dispatch synthetic hash change event to update hash history objects
+  // this is necessary because hash updates triggered by using popState won't trigger this event naturally.
+  // This must be called before the app is mounted to avoid call this after the redirect to default app logic kicks in
+  const unlisten = history.listen((location) => {
+    window.dispatchEvent(new HashChangeEvent('hashchange'));
+  });
+
   render(
     <KibanaContextProvider services={{ ...coreStart }}>
       <HomeApp directories={directories} solutions={solutions} />
@@ -54,12 +61,6 @@ export const renderApp = async (
     element
   );
 
-  // dispatch synthetic hash change event to update hash history objects
-  // this is necessary because hash updates triggered by using popState won't trigger this event naturally.
-  const unlisten = history.listen(() => {
-    window.dispatchEvent(new HashChangeEvent('hashchange'));
-  });
-
   return () => {
     unmountComponentAtNode(element);
     unlisten();
diff --git a/src/plugins/home/public/application/components/tutorial/tutorial.js b/src/plugins/home/public/application/components/tutorial/tutorial.js
index 8139bc6d38ab1d..f55462bdc9e288 100644
--- a/src/plugins/home/public/application/components/tutorial/tutorial.js
+++ b/src/plugins/home/public/application/components/tutorial/tutorial.js
@@ -201,26 +201,18 @@ class TutorialUi extends React.Component {
    * @return {Promise<string>}
    */
   fetchEsHitsStatus = async (esHitsCheckConfig) => {
-    const searchHeader = JSON.stringify({ index: esHitsCheckConfig.index });
-    const searchBody = JSON.stringify({ query: esHitsCheckConfig.query, size: 1 });
-    const response = await fetch(this.props.addBasePath('/elasticsearch/_msearch'), {
-      method: 'post',
-      body: `${searchHeader}\n${searchBody}\n`,
-      headers: {
-        accept: 'application/json',
-        'content-type': 'application/x-ndjson',
-        'kbn-xsrf': 'kibana',
-      },
-      credentials: 'same-origin',
-    });
-
-    if (response.status > 300) {
+    const { http } = getServices();
+    try {
+      const response = await http.post('/api/home/hits_status', {
+        body: JSON.stringify({
+          index: esHitsCheckConfig.index,
+          query: esHitsCheckConfig.query,
+        }),
+      });
+      return response.count > 0 ? StatusCheckStates.HAS_DATA : StatusCheckStates.NO_DATA;
+    } catch (e) {
       return StatusCheckStates.ERROR;
     }
-
-    const results = await response.json();
-    const numHits = _.get(results, 'responses.[0].hits.hits.length', 0);
-    return numHits === 0 ? StatusCheckStates.NO_DATA : StatusCheckStates.HAS_DATA;
   };
 
   renderInstructionSetsToggle = () => {
diff --git a/src/plugins/home/server/plugin.test.ts b/src/plugins/home/server/plugin.test.ts
index 33d907315e5124..58103430b4d7c0 100644
--- a/src/plugins/home/server/plugin.test.ts
+++ b/src/plugins/home/server/plugin.test.ts
@@ -19,10 +19,7 @@
 
 import { registryForTutorialsMock, registryForSampleDataMock } from './plugin.test.mocks';
 import { HomeServerPlugin } from './plugin';
-import { coreMock } from '../../../core/server/mocks';
-import { CoreSetup } from '../../../core/server';
-
-type MockedKeys<T> = { [P in keyof T]: jest.Mocked<T[P]> };
+import { coreMock, httpServiceMock } from '../../../core/server/mocks';
 
 describe('HomeServerPlugin', () => {
   beforeEach(() => {
@@ -33,8 +30,16 @@ describe('HomeServerPlugin', () => {
   });
 
   describe('setup', () => {
-    const mockCoreSetup: MockedKeys<CoreSetup> = coreMock.createSetup();
-    const initContext = coreMock.createPluginInitializerContext();
+    let mockCoreSetup: ReturnType<typeof coreMock.createSetup>;
+    let initContext: ReturnType<typeof coreMock.createPluginInitializerContext>;
+    let routerMock: ReturnType<typeof httpServiceMock.createRouter>;
+
+    beforeEach(() => {
+      mockCoreSetup = coreMock.createSetup();
+      routerMock = httpServiceMock.createRouter();
+      mockCoreSetup.http.createRouter.mockReturnValue(routerMock);
+      initContext = coreMock.createPluginInitializerContext();
+    });
 
     test('wires up tutorials provider service and returns registerTutorial and addScopedTutorialContextFactory', () => {
       const setup = new HomeServerPlugin(initContext).setup(mockCoreSetup, {});
@@ -52,6 +57,18 @@ describe('HomeServerPlugin', () => {
       expect(setup.sampleData).toHaveProperty('addAppLinksToSampleDataset');
       expect(setup.sampleData).toHaveProperty('replacePanelInSampleDatasetDashboard');
     });
+
+    test('registers the `/api/home/hits_status` route', () => {
+      new HomeServerPlugin(initContext).setup(mockCoreSetup, {});
+
+      expect(routerMock.post).toHaveBeenCalledTimes(1);
+      expect(routerMock.post).toHaveBeenCalledWith(
+        expect.objectContaining({
+          path: '/api/home/hits_status',
+        }),
+        expect.any(Function)
+      );
+    });
   });
 
   describe('start', () => {
diff --git a/src/plugins/home/server/plugin.ts b/src/plugins/home/server/plugin.ts
index 1050c19362ae17..a2f8eec686b211 100644
--- a/src/plugins/home/server/plugin.ts
+++ b/src/plugins/home/server/plugin.ts
@@ -28,6 +28,7 @@ import {
 import { UsageCollectionSetup } from '../../usage_collection/server';
 import { capabilitiesProvider } from './capabilities_provider';
 import { sampleDataTelemetry } from './saved_objects';
+import { registerRoutes } from './routes';
 
 interface HomeServerPluginSetupDependencies {
   usageCollection?: UsageCollectionSetup;
@@ -41,6 +42,10 @@ export class HomeServerPlugin implements Plugin<HomeServerPluginSetup, HomeServe
   public setup(core: CoreSetup, plugins: HomeServerPluginSetupDependencies): HomeServerPluginSetup {
     core.capabilities.registerProvider(capabilitiesProvider);
     core.savedObjects.registerType(sampleDataTelemetry);
+
+    const router = core.http.createRouter();
+    registerRoutes(router);
+
     return {
       tutorials: { ...this.tutorialsRegistry.setup(core) },
       sampleData: { ...this.sampleDataRegistry.setup(core, plugins.usageCollection) },
diff --git a/src/plugins/home/server/routes/fetch_es_hits_status.ts b/src/plugins/home/server/routes/fetch_es_hits_status.ts
new file mode 100644
index 00000000000000..5fd0cd334edc62
--- /dev/null
+++ b/src/plugins/home/server/routes/fetch_es_hits_status.ts
@@ -0,0 +1,60 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { IRouter } from 'src/core/server';
+
+export const registerHitsStatusRoute = (router: IRouter) => {
+  router.post(
+    {
+      path: '/api/home/hits_status',
+      validate: {
+        body: schema.object({
+          index: schema.string(),
+          query: schema.recordOf(schema.string(), schema.any()),
+        }),
+      },
+    },
+    router.handleLegacyErrors(async (context, req, res) => {
+      const { index, query } = req.body;
+      const client = context.core.elasticsearch.client;
+
+      try {
+        const { body } = await client.asCurrentUser.search({
+          index,
+          size: 1,
+          body: {
+            query,
+          },
+        });
+        const count = body.hits.hits.length;
+
+        return res.ok({
+          body: {
+            count,
+          },
+        });
+      } catch (e) {
+        return res.badRequest({
+          body: e,
+        });
+      }
+    })
+  );
+};
diff --git a/src/plugins/home/server/routes/index.ts b/src/plugins/home/server/routes/index.ts
new file mode 100644
index 00000000000000..bf492051cdedfa
--- /dev/null
+++ b/src/plugins/home/server/routes/index.ts
@@ -0,0 +1,25 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { IRouter } from 'src/core/server';
+import { registerHitsStatusRoute } from './fetch_es_hits_status';
+
+export const registerRoutes = (router: IRouter) => {
+  registerHitsStatusRoute(router);
+};
diff --git a/src/plugins/home/server/services/sample_data/data_sets/ecommerce/saved_objects.ts b/src/plugins/home/server/services/sample_data/data_sets/ecommerce/saved_objects.ts
index 4c31ccee1243a9..37657912deb95b 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/ecommerce/saved_objects.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/ecommerce/saved_objects.ts
@@ -248,11 +248,11 @@ export const getSavedObjects = (): SavedObject[] => [
     version: '1',
     migrationVersion: {},
     attributes: {
-      title: i18n.translate('home.sampleData.ecommerceSpec.averageSalesPerRegionTitle', {
-        defaultMessage: '[eCommerce] Average Sales Per Region',
+      title: i18n.translate('home.sampleData.ecommerceSpec.salesCountMapTitle', {
+        defaultMessage: '[eCommerce] Sales Count Map',
       }),
       visState:
-        '{"title":"[eCommerce] Average Sales Per Region","type":"region_map","params":{"legendPosition":"bottomright","addTooltip":true,"colorSchema":"Blues","selectedLayer":{"attribution":"<p><a href=\\"http://www.naturalearthdata.com/about/terms-of-use\\">Made with NaturalEarth</a>|<a href=\\"https://www.elastic.co/elastic-maps-service\\">Elastic Maps Service</a></p>&#10;","weight":1,"name":"World Countries","url":"https://vector.maps.elastic.co/blob/5659313586569216?elastic_tile_service_tos=agree&my_app_version=7.0.0-alpha1&license=f6c534b8-91b9-4499-8804-a2e9789ecc95","format":{"type":"geojson"},"fields":[{"name":"iso2","description":"Two letter abbreviation"},{"name":"name","description":"Country name"},{"name":"iso3","description":"Three letter abbreviation"}],"created_at":"2017-04-26T17:12:15.978370","tags":[],"id":5659313586569216,"layerId":"elastic_maps_service.World Countries","isEMS":true},"emsHotLink":"https://maps.elastic.co/v2#file/World Countries","selectedJoinField":{"name":"iso2","description":"Two letter abbreviation"},"isDisplayWarning":true,"wms":{"enabled":false,"options":{"format":"image/png","transparent":true}},"mapZoom":2,"mapCenter":[0,0],"outlineWeight":1,"showAllShapes":true},"aggs":[{"id":"1","enabled":true,"type":"avg","schema":"metric","params":{"field":"taxful_total_price","customLabel":"Average Sale"}},{"id":"2","enabled":true,"type":"terms","schema":"segment","params":{"field":"geoip.country_iso_code","size":100,"order":"desc","orderBy":"1","otherBucket":false,"otherBucketLabel":"Other","missingBucket":false,"missingBucketLabel":"Missing"}}]}',
+        '{"title":"[eCommerce] Sales Count Map","type":"vega","aggs":[],"params":{"spec":"{\\n  $schema: https://vega.github.io/schema/vega/v5.json\\n  config: {\\n    kibana: {type: \\"map\\", latitude: 25, longitude: -40, zoom: 3}\\n  }\\n  data: [\\n    {\\n      name: table\\n      url: {\\n        index: kibana_sample_data_ecommerce\\n        %context%: true\\n        %timefield%: order_date\\n        body: {\\n          size: 0\\n          aggs: {\\n            gridSplit: {\\n              geotile_grid: {field: \\"geoip.location\\", precision: 4, size: 10000}\\n              aggs: {\\n                gridCentroid: {\\n                  geo_centroid: {\\n                    field: \\"geoip.location\\"\\n                  }\\n                }\\n              }\\n            }\\n          }\\n        }\\n      }\\n      format: {property: \\"aggregations.gridSplit.buckets\\"}\\n      transform: [\\n        {\\n          type: geopoint\\n          projection: projection\\n          fields: [\\n            gridCentroid.location.lon\\n            gridCentroid.location.lat\\n          ]\\n        }\\n      ]\\n    }\\n  ]\\n  scales: [\\n    {\\n      name: gridSize\\n      type: linear\\n      domain: {data: \\"table\\", field: \\"doc_count\\"}\\n      range: [\\n        50\\n        1000\\n      ]\\n    }\\n  ]\\n  marks: [\\n    {\\n      name: gridMarker\\n      type: symbol\\n      from: {data: \\"table\\"}\\n      encode: {\\n        update: {\\n          size: {scale: \\"gridSize\\", field: \\"doc_count\\"}\\n          xc: {signal: \\"datum.x\\"}\\n          yc: {signal: \\"datum.y\\"}\\n        }\\n      }\\n    },\\n    {\\n      name: gridLabel\\n      type: text\\n      from: {data: \\"table\\"}\\n      encode: {\\n        enter: {\\n          fill: {value: \\"firebrick\\"}\\n          text: {signal: \\"datum.doc_count\\"}\\n        }\\n        update: {\\n          x: {signal: \\"datum.x\\"}\\n          y: {signal: \\"datum.y\\"}\\n          dx: {value: -6}\\n          dy: {value: 6}\\n          fontSize: {value: 18}\\n          fontWeight: {value: \\"bold\\"}\\n        }\\n      }\\n    }\\n  ]\\n}"}}',
       uiStateJSON: '{}',
       description: '',
       version: 1,
diff --git a/src/plugins/home/server/services/sample_data/data_sets/flights/saved_objects.ts b/src/plugins/home/server/services/sample_data/data_sets/flights/saved_objects.ts
index c1f7fcb75b149c..6f701d75e7d52d 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/flights/saved_objects.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/flights/saved_objects.ts
@@ -281,11 +281,10 @@ export const getSavedObjects = (): SavedObject[] => [
     version: '1',
     migrationVersion: {},
     attributes: {
-      title: i18n.translate('home.sampleData.flightsSpec.originCountryTicketPricesTitle', {
-        defaultMessage: '[Flights] Origin Country Ticket Prices',
+      title: i18n.translate('home.sampleData.flightsSpec.departuresCountMapTitle', {
+        defaultMessage: '[Flights] Departures Count Map',
       }),
-      visState:
-        '{"title":"[Flights] Origin Country Ticket Prices","type":"region_map","params":{"legendPosition":"bottomright","addTooltip":true,"colorSchema":"Blues","selectedLayer":{"attribution":"<p><a href=\\"http://www.naturalearthdata.com/about/terms-of-use\\">Made with NaturalEarth</a> | <a href=\\"https://www.elastic.co/elastic-maps-service\\">Elastic Maps Service</a></p>&#10;","name":"World Countries","weight":1,"format":{"type":"geojson"},"url":"https://vector.maps.elastic.co/blob/5659313586569216?elastic_tile_service_tos=agree&my_app_version=6.3.0&license=686f9ec6-d775-44f0-b334-38caf85da617","fields":[{"name":"iso2","description":"Two letter abbreviation"},{"name":"name","description":"Country name"},{"name":"iso3","description":"Three letter abbreviation"}],"created_at":"2017-04-26T17:12:15.978370","tags":[],"id":5659313586569216,"layerId":"elastic_maps_service.World Countries"},"selectedJoinField":{"name":"iso2","description":"Two letter abbreviation"},"isDisplayWarning":false,"wms":{"enabled":false,"options":{"format":"image/png","transparent":true},"baseLayersAreLoaded":{},"tmsLayers":[{"id":"road_map","url":"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.3.0&license=686f9ec6-d775-44f0-b334-38caf85da617","minZoom":0,"maxZoom":18,"attribution":"<p>&#169; <a href=\\"http://www.openstreetmap.org/copyright\\">OpenStreetMap</a> contributors | <a href=\\"https://www.elastic.co/elastic-maps-service\\">Elastic Maps Service</a></p>&#10;","subdomains":[]}],"selectedTmsLayer":{"id":"road_map","url":"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.3.0&license=686f9ec6-d775-44f0-b334-38caf85da617","minZoom":0,"maxZoom":18,"attribution":"<p>&#169; <a href=\\"http://www.openstreetmap.org/copyright\\">OpenStreetMap</a> contributors | <a href=\\"https://www.elastic.co/elastic-maps-service\\">Elastic Maps Service</a></p>&#10;","subdomains":[]}},"mapZoom":2,"mapCenter":[0,0],"outlineWeight":1,"showAllShapes":true},"aggs":[{"id":"1","enabled":true,"type":"avg","schema":"metric","params":{"field":"AvgTicketPrice"}},{"id":"2","enabled":true,"type":"terms","schema":"segment","params":{"field":"OriginCountry","size":100,"order":"desc","orderBy":"1","otherBucket":false,"otherBucketLabel":"Other","missingBucket":false,"missingBucketLabel":"Missing"}}]}',
+      visState: '{\"title\":\"[Flights] Departure Count Map\",\"type\":\"vega\",\"aggs\":[],\"params\":{\"spec\":\"{\\n  $schema: https://vega.github.io/schema/vega/v5.json\\n  config: {\\n    kibana: {type: \\\"map\\\", latitude: 25, longitude: -40, zoom: 3}\\n  }\\n  data: [\\n    {\\n      name: table\\n      url: {\\n        index: kibana_sample_data_flights\\n        %context%: true\\n        %timefield%: timestamp\\n        body: {\\n          size: 0\\n          aggs: {\\n            gridSplit: {\\n              geotile_grid: {field: \\\"OriginLocation\\\", precision: 4, size: 10000}\\n              aggs: {\\n                gridCentroid: {\\n                  geo_centroid: {\\n                    field: \\\"OriginLocation\\\"\\n                  }\\n                }\\n              }\\n            }\\n          }\\n        }\\n      }\\n      format: {property: \\\"aggregations.gridSplit.buckets\\\"}\\n      transform: [\\n        {\\n          type: geopoint\\n          projection: projection\\n          fields: [\\n            gridCentroid.location.lon\\n            gridCentroid.location.lat\\n          ]\\n        }\\n      ]\\n    }\\n  ]\\n  scales: [\\n    {\\n      name: gridSize\\n      type: linear\\n      domain: {data: \\\"table\\\", field: \\\"doc_count\\\"}\\n      range: [\\n        50\\n        1000\\n      ]\\n    }\\n  ]\\n  marks: [\\n    {\\n      name: gridMarker\\n      type: symbol\\n      from: {data: \\\"table\\\"}\\n      encode: {\\n        update: {\\n          size: {scale: \\\"gridSize\\\", field: \\\"doc_count\\\"}\\n          xc: {signal: \\\"datum.x\\\"}\\n          yc: {signal: \\\"datum.y\\\"}\\n          tooltip: {\\n            signal: \\\"{flights: datum.doc_count}\\\"\\n          }\\n        }\\n      }\\n    }\\n  ]\\n}\"}}',
       uiStateJSON: '{}',
       description: '',
       version: 1,
diff --git a/src/plugins/home/server/services/sample_data/data_sets/logs/saved_objects.ts b/src/plugins/home/server/services/sample_data/data_sets/logs/saved_objects.ts
index 97258c21bc8f07..f8d39e6689fa8b 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/logs/saved_objects.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/logs/saved_objects.ts
@@ -51,11 +51,11 @@ export const getSavedObjects = (): SavedObject[] => [
     version: '1',
     migrationVersion: {},
     attributes: {
-      title: i18n.translate('home.sampleData.logsSpec.uniqueVisitorsByCountryTitle', {
-        defaultMessage: '[Logs] Unique Visitors by Country',
+      title: i18n.translate('home.sampleData.logsSpec.visitorsMapTitle', {
+        defaultMessage: '[Logs] Visitors Map',
       }),
       visState:
-        '{"title":"[Logs] Unique Visitors by Country","type":"region_map","params":{"legendPosition":"bottomright","addTooltip":true,"colorSchema":"Reds","selectedLayer":{"attribution":"<p><a href=\\"http://www.naturalearthdata.com/about/terms-of-use\\">Made with NaturalEarth</a> | <a href=\\"https://www.elastic.co/elastic-maps-service\\">Elastic Maps Service</a></p>&#10;","name":"World Countries","weight":1,"format":{"type":"geojson"},"url":"https://vector.maps.elastic.co/blob/5659313586569216?elastic_tile_service_tos=agree&my_app_version=6.2.3&license=77ab0ecf-a521-499d-bd52-fbd740bb81d0","fields":[{"name":"iso2","description":"Two letter abbreviation"},{"name":"name","description":"Country name"},{"name":"iso3","description":"Three letter abbreviation"}],"created_at":"2017-04-26T17:12:15.978370","tags":[],"id":5659313586569216,"layerId":"elastic_maps_service.World Countries"},"selectedJoinField":{"name":"iso2","description":"Two letter abbreviation"},"isDisplayWarning":false,"wms":{"enabled":false,"options":{"format":"image/png","transparent":true},"baseLayersAreLoaded":{},"tmsLayers":[{"id":"road_map","url":"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.3&license=77ab0ecf-a521-499d-bd52-fbd740bb81d0","minZoom":0,"maxZoom":18,"attribution":"<p>&#169; <a href=\\"http://www.openstreetmap.org/copyright\\">OpenStreetMap</a> contributors | <a href=\\"https://www.elastic.co/elastic-maps-service\\">Elastic Maps Service</a></p>&#10;","subdomains":[]}],"selectedTmsLayer":{"id":"road_map","url":"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.3&license=77ab0ecf-a521-499d-bd52-fbd740bb81d0","minZoom":0,"maxZoom":18,"attribution":"<p>&#169; <a href=\\"http://www.openstreetmap.org/copyright\\">OpenStreetMap</a> contributors | <a href=\\"https://www.elastic.co/elastic-maps-service\\">Elastic Maps Service</a></p>&#10;","subdomains":[]}},"mapZoom":2,"mapCenter":[0,0],"outlineWeight":1,"showAllShapes":true,"emsHotLink":null},"aggs":[{"id":"1","enabled":true,"type":"cardinality","schema":"metric","params":{"field":"clientip","customLabel":"Unique Visitors"}},{"id":"2","enabled":true,"type":"terms","schema":"segment","params":{"field":"geo.src","size":50,"order":"desc","orderBy":"1","otherBucket":false,"otherBucketLabel":"Other","missingBucket":false,"missingBucketLabel":"Missing"}}]}',
+        '{"title":"[Logs] Visitors Map","type":"vega","aggs":[],"params":{"spec":"{\\n  $schema: https://vega.github.io/schema/vega/v5.json\\n  config: {\\n    kibana: {type: \\"map\\", latitude: 30, longitude: -120, zoom: 3}\\n  }\\n  data: [\\n    {\\n      name: table\\n      url: {\\n        index: kibana_sample_data_logs\\n        %context%: true\\n        %timefield%: timestamp\\n        body: {\\n          size: 0\\n          aggs: {\\n            gridSplit: {\\n              geotile_grid: {field: \\"geo.coordinates\\", precision: 5, size: 10000}\\n              aggs: {\\n                gridCentroid: {\\n                  geo_centroid: {\\n                    field: \\"geo.coordinates\\"\\n                  }\\n                }\\n              }\\n            }\\n          }\\n        }\\n      }\\n      format: {property: \\"aggregations.gridSplit.buckets\\"}\\n      transform: [\\n        {\\n          type: geopoint\\n          projection: projection\\n          fields: [\\n            gridCentroid.location.lon\\n            gridCentroid.location.lat\\n          ]\\n        }\\n      ]\\n    }\\n  ]\\n  scales: [\\n    {\\n      name: gridSize\\n      type: linear\\n      domain: {data: \\"table\\", field: \\"doc_count\\"}\\n      range: [\\n        50\\n        1000\\n      ]\\n    }\\n    {\\n      name: bubbleColor\\n      type: linear\\n      domain: {\\n        data: table\\n        field: doc_count\\n      }\\n      range: [\\"rgb(249, 234, 197)\\",\\"rgb(243, 200, 154)\\",\\"rgb(235, 166, 114)\\", \\"rgb(231, 102, 76)\\"]\\n    }\\n  ]\\n  marks: [\\n    {\\n      name: gridMarker\\n      type: symbol\\n      from: {data: \\"table\\"}\\n      encode: {\\n        update: {\\n          fill: {\\n            scale: bubbleColor\\n            field: doc_count\\n          }\\n          size: {scale: \\"gridSize\\", field: \\"doc_count\\"}\\n          xc: {signal: \\"datum.x\\"}\\n          yc: {signal: \\"datum.y\\"}\\n          tooltip: {\\n            signal: \\"{flights: datum.doc_count}\\"\\n          }\\n        }\\n      }\\n    }\\n  ]\\n}"}}',
       uiStateJSON: '{}',
       description: '',
       version: 1,
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/__snapshots__/indexed_fields_table.test.tsx.snap b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/__snapshots__/indexed_fields_table.test.tsx.snap
index 47cabc4df662f0..45253f6ad27c03 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/__snapshots__/indexed_fields_table.test.tsx.snap
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/__snapshots__/indexed_fields_table.test.tsx.snap
@@ -15,13 +15,10 @@ exports[`IndexedFieldsTable should filter based on the query bar 1`] = `
           "displayName": "Elastic",
           "excluded": false,
           "format": undefined,
-          "indexPattern": Object {
-            "getNonScriptedFields": [Function],
-          },
           "info": Array [],
           "name": "Elastic",
           "searchable": true,
-          "type": "name",
+          "type": "string",
         },
       ]
     }
@@ -44,9 +41,6 @@ exports[`IndexedFieldsTable should filter based on the type filter 1`] = `
           "displayName": "timestamp",
           "excluded": false,
           "format": undefined,
-          "indexPattern": Object {
-            "getNonScriptedFields": [Function],
-          },
           "info": Array [],
           "name": "timestamp",
           "type": "date",
@@ -72,21 +66,15 @@ exports[`IndexedFieldsTable should render normally 1`] = `
           "displayName": "Elastic",
           "excluded": false,
           "format": undefined,
-          "indexPattern": Object {
-            "getNonScriptedFields": [Function],
-          },
           "info": Array [],
           "name": "Elastic",
           "searchable": true,
-          "type": "name",
+          "type": "string",
         },
         Object {
           "displayName": "timestamp",
           "excluded": false,
           "format": undefined,
-          "indexPattern": Object {
-            "getNonScriptedFields": [Function],
-          },
           "info": Array [],
           "name": "timestamp",
           "type": "date",
@@ -95,9 +83,6 @@ exports[`IndexedFieldsTable should render normally 1`] = `
           "displayName": "conflictingField",
           "excluded": false,
           "format": undefined,
-          "indexPattern": Object {
-            "getNonScriptedFields": [Function],
-          },
           "info": Array [],
           "name": "conflictingField",
           "type": "conflict",
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx
index 411bbe23e47618..319b9b2b3fce2a 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx
@@ -19,7 +19,7 @@
 
 import React from 'react';
 import { shallow } from 'enzyme';
-import { IndexPatternField, IIndexPattern, IndexPattern } from 'src/plugins/data/public';
+import { IndexPatternField, IIndexPattern } from 'src/plugins/data/public';
 import { IndexedFieldsTable } from './indexed_fields_table';
 
 jest.mock('@elastic/eui', () => ({
@@ -47,10 +47,8 @@ const indexPattern = ({
 
 const mockFieldToIndexPatternField = (spec: Record<string, string | boolean | undefined>) => {
   return new IndexPatternField(
-    indexPattern as IndexPattern,
     (spec as unknown) as IndexPatternField['spec'],
-    spec.displayName as string,
-    () => {}
+    spec.displayName as string
   );
 };
 
@@ -59,7 +57,7 @@ const fields = [
     name: 'Elastic',
     displayName: 'Elastic',
     searchable: true,
-    type: 'name',
+    type: 'string',
   },
   { name: 'timestamp', displayName: 'timestamp', type: 'date' },
   { name: 'conflictingField', displayName: 'conflictingField', type: 'conflict' },
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.tsx
index 90f81a88b3da05..23977aac7fa7a2 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.tsx
@@ -77,7 +77,6 @@ export class IndexedFieldsTable extends Component<
           return {
             ...field.spec,
             displayName: field.displayName,
-            indexPattern: field.indexPattern,
             format: getFieldFormat(indexPattern, field.name),
             excluded: fieldWildcardMatch ? fieldWildcardMatch(field.name) : false,
             info: helpers.getFieldInfo && helpers.getFieldInfo(indexPattern, field),
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/scripted_field_table.test.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/scripted_field_table.test.tsx
index 80132167b7f58f..ed50317aed6a0e 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/scripted_field_table.test.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/scripted_field_table.test.tsx
@@ -46,14 +46,6 @@ jest.mock('./components/table', () => ({
   },
 }));
 
-jest.mock('ui/documentation_links', () => ({
-  documentationLinks: {
-    scriptedFields: {
-      painless: 'painlessDocs',
-    },
-  },
-}));
-
 const helpers = {
   redirectToRoute: () => {},
   getRouteHref: () => '#',
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/tabs.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/tabs.tsx
index 6c9d6db8de130e..3bc9cd34f29841 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/tabs.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/tabs.tsx
@@ -176,7 +176,7 @@ export function Tabs({ indexPattern, fields, history, location }: TabsProps) {
                 indexedFieldTypeFilter={indexedFieldTypeFilter}
                 helpers={{
                   redirectToRoute: (field: IndexPatternField) => {
-                    history.push(getPath(field));
+                    history.push(getPath(field, indexPattern));
                   },
                   getFieldInfo: indexPatternManagementStart.list.getFieldInfo,
                 }}
@@ -195,7 +195,7 @@ export function Tabs({ indexPattern, fields, history, location }: TabsProps) {
                 scriptedFieldLanguageFilter={scriptedFieldLanguageFilter}
                 helpers={{
                   redirectToRoute: (field: IndexPatternField) => {
-                    history.push(getPath(field));
+                    history.push(getPath(field, indexPattern));
                   },
                 }}
                 onRemoveField={refreshFilters}
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/utils.ts b/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/utils.ts
index b422de93de7a97..91c5cc1afdb49e 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/utils.ts
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/utils.ts
@@ -116,8 +116,8 @@ export function getTabs(
   return tabs;
 }
 
-export function getPath(field: IndexPatternField) {
-  return `/patterns/${field.indexPattern?.id}/field/${field.name}`;
+export function getPath(field: IndexPatternField, indexPattern: IndexPattern) {
+  return `/patterns/${indexPattern?.id}/field/${field.name}`;
 }
 
 const allTypesDropDown = i18n.translate(
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/field_editor.test.tsx b/src/plugins/index_pattern_management/public/components/field_editor/field_editor.test.tsx
index 96d3fc549ece01..b0385a61a72ace 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/field_editor.test.tsx
+++ b/src/plugins/index_pattern_management/public/components/field_editor/field_editor.test.tsx
@@ -138,12 +138,12 @@ describe('FieldEditor', () => {
       name: 'test',
       script: 'doc.test.value',
     };
-    fieldList.push(testField as IndexPatternField);
+    fieldList.push((testField as unknown) as IndexPatternField);
     indexPattern.fields.getByName = (name) => {
       const flds = {
         [testField.name]: testField,
       };
-      return flds[name] as IndexPatternField;
+      return (flds[name] as unknown) as IndexPatternField;
     };
 
     const component = createComponentWithContext<FieldEdiorProps>(
@@ -173,7 +173,7 @@ describe('FieldEditor', () => {
       const flds = {
         [testField.name]: testField,
       };
-      return flds[name] as IndexPatternField;
+      return (flds[name] as unknown) as IndexPatternField;
     };
 
     const component = createComponentWithContext<FieldEdiorProps>(
diff --git a/src/plugins/input_control_vis/public/control/control.ts b/src/plugins/input_control_vis/public/control/control.ts
index 91e8f1b26164ba..da2dc7bab7cf7a 100644
--- a/src/plugins/input_control_vis/public/control/control.ts
+++ b/src/plugins/input_control_vis/public/control/control.ts
@@ -81,9 +81,10 @@ export abstract class Control<FilterManager extends BaseFilterManager> {
   abstract destroy(): void;
 
   format = (value: any) => {
+    const indexPattern = this.filterManager.getIndexPattern();
     const field = this.filterManager.getField();
-    if (field?.format?.convert) {
-      return field.format.convert(value);
+    if (field) {
+      return indexPattern.getFormatterForField(field).convert(value);
     }
 
     return value;
diff --git a/src/plugins/kibana_legacy/public/angular/angular_config.tsx b/src/plugins/kibana_legacy/public/angular/angular_config.tsx
index eafcbfda3db003..9dae615bc3848d 100644
--- a/src/plugins/kibana_legacy/public/angular/angular_config.tsx
+++ b/src/plugins/kibana_legacy/public/angular/angular_config.tsx
@@ -27,12 +27,12 @@ import {
 } from 'angular';
 import $ from 'jquery';
 import { set } from '@elastic/safer-lodash-set';
-import { cloneDeep, forOwn, get } from 'lodash';
+import { get } from 'lodash';
 import * as Rx from 'rxjs';
 import { ChromeBreadcrumb, EnvironmentMode, PackageInfo } from 'kibana/public';
 import { History } from 'history';
 
-import { CoreStart, LegacyCoreStart } from 'kibana/public';
+import { CoreStart } from 'kibana/public';
 import { isSystemApiRequest } from '../utils';
 import { formatAngularHttpError, isAngularHttpError } from '../notify/lib';
 
@@ -72,32 +72,18 @@ function isDummyRoute($route: any, isLocalAngular: boolean) {
 
 export const configureAppAngularModule = (
   angularModule: IModule,
-  newPlatform:
-    | LegacyCoreStart
-    | {
-        core: CoreStart;
-        readonly env: {
-          mode: Readonly<EnvironmentMode>;
-          packageInfo: Readonly<PackageInfo>;
-        };
-      },
+  newPlatform: {
+    core: CoreStart;
+    readonly env: {
+      mode: Readonly<EnvironmentMode>;
+      packageInfo: Readonly<PackageInfo>;
+    };
+  },
   isLocalAngular: boolean,
   getHistory?: () => History
 ) => {
   const core = 'core' in newPlatform ? newPlatform.core : newPlatform;
-  const packageInfo =
-    'env' in newPlatform
-      ? newPlatform.env.packageInfo
-      : newPlatform.injectedMetadata.getLegacyMetadata();
-
-  if ('injectedMetadata' in newPlatform) {
-    forOwn(newPlatform.injectedMetadata.getInjectedVars(), (val, name) => {
-      if (name !== undefined) {
-        // The legacy platform modifies some of these values, clone to an unfrozen object.
-        angularModule.value(name, cloneDeep(val));
-      }
-    });
-  }
+  const packageInfo = newPlatform.env.packageInfo;
 
   angularModule
     .value('kbnVersion', packageInfo.version)
@@ -105,13 +91,7 @@ export const configureAppAngularModule = (
     .value('buildSha', packageInfo.buildSha)
     .value('esUrl', getEsUrl(core))
     .value('uiCapabilities', core.application.capabilities)
-    .config(
-      setupCompileProvider(
-        'injectedMetadata' in newPlatform
-          ? newPlatform.injectedMetadata.getLegacyMetadata().devMode
-          : newPlatform.env.mode.dev
-      )
-    )
+    .config(setupCompileProvider(newPlatform.env.mode.dev))
     .config(setupLocationProvider())
     .config($setupXsrfRequestInterceptor(packageInfo.version))
     .run(capture$httpLoadingCount(core))
diff --git a/src/plugins/kibana_react/public/field_button/field_button.tsx b/src/plugins/kibana_react/public/field_button/field_button.tsx
index e5833b261946ae..26e6453e4c48b3 100644
--- a/src/plugins/kibana_react/public/field_button/field_button.tsx
+++ b/src/plugins/kibana_react/public/field_button/field_button.tsx
@@ -100,7 +100,16 @@ export function FieldButton({
 
   return (
     <div className={classes} {...rest}>
-      <button onClick={onClick} {...buttonProps} className={buttonClasses}>
+      <button
+        onClick={(e) => {
+          if (e.type === 'click') {
+            e.currentTarget.focus();
+          }
+          onClick();
+        }}
+        {...buttonProps}
+        className={buttonClasses}
+      >
         {fieldIcon && <span className="kbnFieldButton__fieldIcon">{fieldIcon}</span>}
         {fieldName && <span className="kbnFieldButton__name">{fieldName}</span>}
         {fieldInfoIcon && <div className="kbnFieldButton__infoIcon">{fieldInfoIcon}</div>}
diff --git a/src/plugins/kibana_react/public/index.ts b/src/plugins/kibana_react/public/index.ts
index 34140703fd8aee..9a9486da892e44 100644
--- a/src/plugins/kibana_react/public/index.ts
+++ b/src/plugins/kibana_react/public/index.ts
@@ -32,7 +32,7 @@ export * from './notifications';
 export { Markdown, MarkdownSimple } from './markdown';
 export { reactToUiComponent, uiToReactComponent } from './adapters';
 export { useUrlTracker } from './use_url_tracker';
-export { toMountPoint } from './util';
+export { toMountPoint, MountPointPortal } from './util';
 export { RedirectAppLinks } from './app_links';
 
 /** dummy plugin, we just want kibanaReact to have its own bundle */
diff --git a/src/plugins/kibana_react/public/util/index.ts b/src/plugins/kibana_react/public/util/index.ts
index 71a281dbdaad3c..a6f3f87535f468 100644
--- a/src/plugins/kibana_react/public/util/index.ts
+++ b/src/plugins/kibana_react/public/util/index.ts
@@ -17,4 +17,5 @@
  * under the License.
  */
 
-export * from './react_mount';
+export { toMountPoint } from './to_mount_point';
+export { MountPointPortal } from './mount_point_portal';
diff --git a/src/plugins/kibana_react/public/util/mount_point_portal.test.tsx b/src/plugins/kibana_react/public/util/mount_point_portal.test.tsx
new file mode 100644
index 00000000000000..c13b8eae262213
--- /dev/null
+++ b/src/plugins/kibana_react/public/util/mount_point_portal.test.tsx
@@ -0,0 +1,210 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React, { FC } from 'react';
+import { mount, ReactWrapper } from 'enzyme';
+import { MountPoint, UnmountCallback } from 'kibana/public';
+import { MountPointPortal } from './mount_point_portal';
+import { act } from 'react-dom/test-utils';
+
+describe('MountPointPortal', () => {
+  let portalTarget: HTMLElement;
+  let mountPoint: MountPoint;
+  let setMountPoint: jest.Mock<(mountPoint: MountPoint<HTMLElement>) => void>;
+  let dom: ReactWrapper;
+
+  const refresh = () => {
+    new Promise(async (resolve) => {
+      if (dom) {
+        act(() => {
+          dom.update();
+        });
+      }
+      setImmediate(() => resolve(dom)); // flushes any pending promises
+    });
+  };
+
+  beforeEach(() => {
+    portalTarget = document.createElement('div');
+    document.body.append(portalTarget);
+    setMountPoint = jest.fn().mockImplementation((mp) => (mountPoint = mp));
+  });
+
+  afterEach(() => {
+    if (portalTarget) {
+      portalTarget.remove();
+    }
+  });
+
+  it('calls the provided `setMountPoint` during render', async () => {
+    dom = mount(
+      <MountPointPortal setMountPoint={setMountPoint}>
+        <span>portal content</span>
+      </MountPointPortal>
+    );
+
+    await refresh();
+
+    expect(setMountPoint).toHaveBeenCalledTimes(1);
+  });
+
+  it('renders the portal content when calling the mountPoint ', async () => {
+    dom = mount(
+      <MountPointPortal setMountPoint={setMountPoint}>
+        <span>portal content</span>
+      </MountPointPortal>
+    );
+
+    await refresh();
+
+    expect(mountPoint).toBeDefined();
+
+    act(() => {
+      mountPoint(portalTarget);
+    });
+
+    await refresh();
+
+    expect(portalTarget.innerHTML).toBe('<span>portal content</span>');
+  });
+
+  it('cleanup the portal content when the component is unmounted', async () => {
+    dom = mount(
+      <MountPointPortal setMountPoint={setMountPoint}>
+        <span>portal content</span>
+      </MountPointPortal>
+    );
+
+    act(() => {
+      mountPoint(portalTarget);
+    });
+
+    await refresh();
+
+    expect(portalTarget.innerHTML).toBe('<span>portal content</span>');
+
+    dom.unmount();
+
+    await refresh();
+
+    expect(portalTarget.innerHTML).toBe('');
+  });
+
+  it('cleanup the portal content when unmounting the MountPoint from outside', async () => {
+    dom = mount(
+      <MountPointPortal setMountPoint={setMountPoint}>
+        <span>portal content</span>
+      </MountPointPortal>
+    );
+
+    let unmount: UnmountCallback;
+    act(() => {
+      unmount = mountPoint(portalTarget);
+    });
+
+    await refresh();
+
+    expect(portalTarget.innerHTML).toBe('<span>portal content</span>');
+
+    act(() => {
+      unmount();
+    });
+
+    await refresh();
+
+    expect(portalTarget.innerHTML).toBe('');
+  });
+
+  it('updates the content of the portal element when the content of MountPointPortal changes', async () => {
+    const Wrapper: FC<{
+      setMount: (mountPoint: MountPoint<HTMLElement>) => void;
+      portalContent: string;
+    }> = ({ setMount, portalContent }) => {
+      return (
+        <MountPointPortal setMountPoint={setMount}>
+          <div>{portalContent}</div>
+        </MountPointPortal>
+      );
+    };
+
+    dom = mount(<Wrapper setMount={setMountPoint} portalContent={'before'} />);
+
+    act(() => {
+      mountPoint(portalTarget);
+    });
+
+    await refresh();
+
+    expect(portalTarget.innerHTML).toBe('<div>before</div>');
+
+    dom.setProps({
+      portalContent: 'after',
+    });
+
+    await refresh();
+
+    expect(portalTarget.innerHTML).toBe('<div>after</div>');
+  });
+
+  it('cleanup the previous portal content when setMountPoint changes', async () => {
+    dom = mount(
+      <MountPointPortal setMountPoint={setMountPoint}>
+        <span>portal content</span>
+      </MountPointPortal>
+    );
+
+    act(() => {
+      mountPoint(portalTarget);
+    });
+
+    await refresh();
+
+    expect(portalTarget.innerHTML).toBe('<span>portal content</span>');
+
+    const newSetMountPoint = jest.fn();
+
+    dom.setProps({
+      setMountPoint: newSetMountPoint,
+    });
+
+    await refresh();
+
+    expect(portalTarget.innerHTML).toBe('');
+  });
+
+  it('intercepts errors and display an error message', async () => {
+    const CrashTest = () => {
+      throw new Error('crash');
+    };
+
+    dom = mount(
+      <MountPointPortal setMountPoint={setMountPoint}>
+        <CrashTest />
+      </MountPointPortal>
+    );
+
+    act(() => {
+      mountPoint(portalTarget);
+    });
+
+    await refresh();
+
+    expect(portalTarget.innerHTML).toBe('<p>Error rendering portal content</p>');
+  });
+});
diff --git a/src/plugins/kibana_react/public/util/mount_point_portal.tsx b/src/plugins/kibana_react/public/util/mount_point_portal.tsx
new file mode 100644
index 00000000000000..b762fba88791e8
--- /dev/null
+++ b/src/plugins/kibana_react/public/util/mount_point_portal.tsx
@@ -0,0 +1,88 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import React, { useRef, useEffect, useState, Component } from 'react';
+import ReactDOM from 'react-dom';
+import { MountPoint } from 'kibana/public';
+
+interface MountPointPortalProps {
+  setMountPoint: (mountPoint: MountPoint<HTMLElement>) => void;
+}
+
+/**
+ * Utility component to portal a part of a react application into the provided `MountPoint`.
+ */
+export const MountPointPortal: React.FC<MountPointPortalProps> = ({ children, setMountPoint }) => {
+  // state used to force re-renders when the element changes
+  const [shouldRender, setShouldRender] = useState(false);
+  const el = useRef<HTMLElement>();
+
+  useEffect(() => {
+    setMountPoint((element) => {
+      el.current = element;
+      setShouldRender(true);
+      return () => {
+        setShouldRender(false);
+        el.current = undefined;
+      };
+    });
+
+    return () => {
+      setShouldRender(false);
+      el.current = undefined;
+    };
+  }, [setMountPoint]);
+
+  if (shouldRender && el.current) {
+    return ReactDOM.createPortal(
+      <MountPointPortalErrorBoundary>{children}</MountPointPortalErrorBoundary>,
+      el.current
+    );
+  } else {
+    return null;
+  }
+};
+
+class MountPointPortalErrorBoundary extends Component<{}, { error?: any }> {
+  state = {
+    error: undefined,
+  };
+
+  static getDerivedStateFromError(error: any) {
+    return { error };
+  }
+
+  componentDidCatch() {
+    // nothing, will just rerender to display the error message
+  }
+
+  render() {
+    if (this.state.error) {
+      return (
+        <p>
+          {i18n.translate('kibana-react.mountPointPortal.errorMessage', {
+            defaultMessage: 'Error rendering portal content',
+          })}
+        </p>
+      );
+    }
+    return this.props.children;
+  }
+}
diff --git a/src/plugins/kibana_react/public/util/react_mount.tsx b/src/plugins/kibana_react/public/util/to_mount_point.tsx
similarity index 100%
rename from src/plugins/kibana_react/public/util/react_mount.tsx
rename to src/plugins/kibana_react/public/util/to_mount_point.tsx
diff --git a/src/plugins/kibana_utils/public/state_management/url/kbn_url_tracker.test.ts b/src/plugins/kibana_utils/public/state_management/url/kbn_url_tracker.test.ts
index e3133fd6d31c2a..e50469546417cb 100644
--- a/src/plugins/kibana_utils/public/state_management/url/kbn_url_tracker.test.ts
+++ b/src/plugins/kibana_utils/public/state_management/url/kbn_url_tracker.test.ts
@@ -21,7 +21,7 @@ import { StubBrowserStorage } from 'test_utils/stub_browser_storage';
 import { createMemoryHistory, History } from 'history';
 import { createKbnUrlTracker, KbnUrlTracker } from './kbn_url_tracker';
 import { BehaviorSubject, Subject } from 'rxjs';
-import { AppBase, AppUpdater, ToastsSetup } from 'kibana/public';
+import { App, AppUpdater, ToastsSetup } from 'kibana/public';
 import { coreMock } from '../../../../../core/public/mocks';
 import { unhashUrl } from './hash_unhash_url';
 
@@ -62,7 +62,7 @@ describe('kbnUrlTracker', () => {
   }
 
   function getActiveNavLinkUrl() {
-    return navLinkUpdaterSubject.getValue()({} as AppBase)?.defaultPath;
+    return navLinkUpdaterSubject.getValue()({} as App)?.defaultPath;
   }
 
   beforeEach(() => {
diff --git a/src/plugins/maps_legacy/config.ts b/src/plugins/maps_legacy/config.ts
index 67e46d22705835..46d4a8fb6cb900 100644
--- a/src/plugins/maps_legacy/config.ts
+++ b/src/plugins/maps_legacy/config.ts
@@ -40,4 +40,4 @@ export const configSchema = schema.object({
   }),
 });
 
-export type ConfigSchema = TypeOf<typeof configSchema>;
+export type MapsLegacyConfig = TypeOf<typeof configSchema>;
diff --git a/src/plugins/maps_legacy/public/index.ts b/src/plugins/maps_legacy/public/index.ts
index 14612ab1b2a576..8f14cd1b15e2c2 100644
--- a/src/plugins/maps_legacy/public/index.ts
+++ b/src/plugins/maps_legacy/public/index.ts
@@ -42,18 +42,6 @@ import { mapTooltipProvider } from './tooltip_provider';
 
 import './map/index.scss';
 
-export interface MapsLegacyConfigType {
-  regionmap: any;
-  emsTileLayerId: string;
-  includeElasticMapsService: boolean;
-  proxyElasticMapsServiceInMaps: boolean;
-  tilemap: any;
-  emsFontLibraryUrl: string;
-  emsFileApiUrl: string;
-  emsTileApiUrl: string;
-  emsLandingPageUrl: string;
-}
-
 export function plugin(initializerContext: PluginInitializerContext) {
   return new MapsLegacyPlugin(initializerContext);
 }
diff --git a/src/plugins/maps_legacy/public/plugin.ts b/src/plugins/maps_legacy/public/plugin.ts
index 6b4e06fec9ccc3..8c9f1e9cef1944 100644
--- a/src/plugins/maps_legacy/public/plugin.ts
+++ b/src/plugins/maps_legacy/public/plugin.ts
@@ -27,8 +27,8 @@ import { ServiceSettings } from './map/service_settings';
 import { getPrecision, getZoomPrecision } from './map/precision';
 // @ts-ignore
 import { KibanaMap } from './map/kibana_map';
-import { MapsLegacyConfigType, MapsLegacyPluginSetup, MapsLegacyPluginStart } from './index';
-import { ConfigSchema } from '../config';
+import { MapsLegacyPluginSetup, MapsLegacyPluginStart } from './index';
+import { MapsLegacyConfig } from '../config';
 // @ts-ignore
 import { BaseMapsVisualizationProvider } from './map/base_maps_visualization';
 
@@ -40,7 +40,7 @@ import { BaseMapsVisualizationProvider } from './map/base_maps_visualization';
 
 export const bindSetupCoreAndPlugins = (
   core: CoreSetup,
-  config: MapsLegacyConfigType,
+  config: MapsLegacyConfig,
   kibanaVersion: string
 ) => {
   setToasts(core.notifications.toasts);
@@ -55,14 +55,14 @@ export interface MapsLegacySetupDependencies {}
 export interface MapsLegacyStartDependencies {}
 
 export class MapsLegacyPlugin implements Plugin<MapsLegacyPluginSetup, MapsLegacyPluginStart> {
-  readonly _initializerContext: PluginInitializerContext<ConfigSchema>;
+  readonly _initializerContext: PluginInitializerContext<MapsLegacyConfig>;
 
-  constructor(initializerContext: PluginInitializerContext<ConfigSchema>) {
+  constructor(initializerContext: PluginInitializerContext<MapsLegacyConfig>) {
     this._initializerContext = initializerContext;
   }
 
   public setup(core: CoreSetup, plugins: MapsLegacySetupDependencies) {
-    const config = this._initializerContext.config.get<MapsLegacyConfigType>();
+    const config = this._initializerContext.config.get<MapsLegacyConfig>();
     const kibanaVersion = this._initializerContext.env.packageInfo.version;
 
     bindSetupCoreAndPlugins(core, config, kibanaVersion);
diff --git a/src/plugins/maps_legacy/server/index.ts b/src/plugins/maps_legacy/server/index.ts
index 79ecbb238314a2..665b3b8986ef0e 100644
--- a/src/plugins/maps_legacy/server/index.ts
+++ b/src/plugins/maps_legacy/server/index.ts
@@ -20,10 +20,10 @@
 import { Plugin, PluginConfigDescriptor } from 'kibana/server';
 import { CoreSetup, PluginInitializerContext } from 'src/core/server';
 import { Observable } from 'rxjs';
-import { configSchema, ConfigSchema } from '../config';
+import { configSchema, MapsLegacyConfig } from '../config';
 import { getUiSettings } from './ui_settings';
 
-export const config: PluginConfigDescriptor<ConfigSchema> = {
+export const config: PluginConfigDescriptor<MapsLegacyConfig> = {
   exposeToBrowser: {
     includeElasticMapsService: true,
     proxyElasticMapsServiceInMaps: true,
@@ -40,13 +40,13 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
 };
 
 export interface MapsLegacyPluginSetup {
-  config$: Observable<ConfigSchema>;
+  config$: Observable<MapsLegacyConfig>;
 }
 
 export class MapsLegacyPlugin implements Plugin<MapsLegacyPluginSetup> {
-  readonly _initializerContext: PluginInitializerContext<ConfigSchema>;
+  readonly _initializerContext: PluginInitializerContext<MapsLegacyConfig>;
 
-  constructor(initializerContext: PluginInitializerContext<ConfigSchema>) {
+  constructor(initializerContext: PluginInitializerContext<MapsLegacyConfig>) {
     this._initializerContext = initializerContext;
   }
 
diff --git a/src/plugins/navigation/kibana.json b/src/plugins/navigation/kibana.json
index 000d5acf2635f7..85d2049a34be0b 100644
--- a/src/plugins/navigation/kibana.json
+++ b/src/plugins/navigation/kibana.json
@@ -3,5 +3,6 @@
   "version": "kibana",
   "server": false,
   "ui": true,
-  "requiredPlugins": ["data"]
-}
\ No newline at end of file
+  "requiredPlugins": ["data"],
+  "requiredBundles": ["kibanaReact"]
+}
diff --git a/src/plugins/navigation/public/top_nav_menu/top_nav_menu.test.tsx b/src/plugins/navigation/public/top_nav_menu/top_nav_menu.test.tsx
index 46384fb3f27d5b..f21e5680e8f611 100644
--- a/src/plugins/navigation/public/top_nav_menu/top_nav_menu.test.tsx
+++ b/src/plugins/navigation/public/top_nav_menu/top_nav_menu.test.tsx
@@ -18,9 +18,12 @@
  */
 
 import React from 'react';
+import { ReactWrapper } from 'enzyme';
+import { act } from 'react-dom/test-utils';
+import { MountPoint } from 'kibana/public';
 import { TopNavMenu } from './top_nav_menu';
 import { TopNavMenuData } from './top_nav_menu_data';
-import { shallowWithIntl } from 'test_utils/enzyme_helpers';
+import { shallowWithIntl, mountWithIntl } from 'test_utils/enzyme_helpers';
 
 const dataShim = {
   ui: {
@@ -109,4 +112,59 @@ describe('TopNavMenu', () => {
     expect(component.find('.kbnTopNavMenu').length).toBe(1);
     expect(component.find('.myCoolClass').length).toBeTruthy();
   });
+
+  describe('when setMenuMountPoint is provided', () => {
+    let portalTarget: HTMLElement;
+    let mountPoint: MountPoint;
+    let setMountPoint: jest.Mock<(mountPoint: MountPoint<HTMLElement>) => void>;
+    let dom: ReactWrapper;
+
+    const refresh = () => {
+      new Promise(async (resolve) => {
+        if (dom) {
+          act(() => {
+            dom.update();
+          });
+        }
+        setImmediate(() => resolve(dom)); // flushes any pending promises
+      });
+    };
+
+    beforeEach(() => {
+      portalTarget = document.createElement('div');
+      document.body.append(portalTarget);
+      setMountPoint = jest.fn().mockImplementation((mp) => (mountPoint = mp));
+    });
+
+    afterEach(() => {
+      if (portalTarget) {
+        portalTarget.remove();
+      }
+    });
+
+    it('mounts the menu inside the provided mountPoint', async () => {
+      const component = mountWithIntl(
+        <TopNavMenu
+          appName={'test'}
+          config={menuItems}
+          showSearchBar={true}
+          data={dataShim as any}
+          setMenuMountPoint={setMountPoint}
+        />
+      );
+
+      act(() => {
+        mountPoint(portalTarget);
+      });
+
+      await refresh();
+
+      expect(component.find(WRAPPER_SELECTOR).length).toBe(1);
+      expect(component.find(SEARCH_BAR_SELECTOR).length).toBe(1);
+
+      // menu is rendered outside of the component
+      expect(component.find(TOP_NAV_ITEM_SELECTOR).length).toBe(0);
+      expect(portalTarget.getElementsByTagName('BUTTON').length).toBe(menuItems.length);
+    });
+  });
 });
diff --git a/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx b/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx
index 2cfca332effb0d..a1a40b49cc8f06 100644
--- a/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx
+++ b/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx
@@ -18,13 +18,14 @@
  */
 
 import React, { ReactElement } from 'react';
-
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-
 import classNames from 'classnames';
+
+import { MountPoint } from '../../../../core/public';
+import { MountPointPortal } from '../../../kibana_react/public';
+import { StatefulSearchBarProps, DataPublicPluginStart } from '../../../data/public';
 import { TopNavMenuData } from './top_nav_menu_data';
 import { TopNavMenuItem } from './top_nav_menu_item';
-import { StatefulSearchBarProps, DataPublicPluginStart } from '../../../data/public';
 
 export type TopNavMenuProps = StatefulSearchBarProps & {
   config?: TopNavMenuData[];
@@ -35,6 +36,25 @@ export type TopNavMenuProps = StatefulSearchBarProps & {
   showFilterBar?: boolean;
   data?: DataPublicPluginStart;
   className?: string;
+  /**
+   * If provided, the menu part of the component will be rendered as a portal inside the given mount point.
+   *
+   * This is meant to be used with the `setHeaderActionMenu` core API.
+   *
+   * @example
+   * ```ts
+   * export renderApp = ({ element, history, setHeaderActionMenu }: AppMountParameters) => {
+   *   const topNavConfig = ...; // TopNavMenuProps
+   *   return (
+   *     <Router history=history>
+   *       <TopNavMenu {...topNavConfig} setMenuMountPoint={setHeaderActionMenu}>
+   *       <MyRoutes />
+   *     </Router>
+   *   )
+   * }
+   * ```
+   */
+  setMenuMountPoint?: (menuMount: MountPoint | undefined) => void;
 };
 
 /*
@@ -92,13 +112,26 @@ export function TopNavMenu(props: TopNavMenuProps): ReactElement | null {
   }
 
   function renderLayout() {
-    const className = classNames('kbnTopNavMenu', props.className);
-    return (
-      <span className="kbnTopNavMenu__wrapper">
-        {renderMenu(className)}
-        {renderSearchBar()}
-      </span>
-    );
+    const { setMenuMountPoint } = props;
+    const menuClassName = classNames('kbnTopNavMenu', props.className);
+    const wrapperClassName = 'kbnTopNavMenu__wrapper';
+    if (setMenuMountPoint) {
+      return (
+        <>
+          <MountPointPortal setMountPoint={setMenuMountPoint}>
+            <span className={wrapperClassName}>{renderMenu(menuClassName)}</span>
+          </MountPointPortal>
+          <span className={wrapperClassName}>{renderSearchBar()}</span>
+        </>
+      );
+    } else {
+      return (
+        <span className={wrapperClassName}>
+          {renderMenu(menuClassName)}
+          {renderSearchBar()}
+        </span>
+      );
+    }
   }
 
   return renderLayout();
diff --git a/src/plugins/newsfeed/public/lib/api.test.ts b/src/plugins/newsfeed/public/lib/api.test.ts
index be4274e8bc0541..21331b9d825755 100644
--- a/src/plugins/newsfeed/public/lib/api.test.ts
+++ b/src/plugins/newsfeed/public/lib/api.test.ts
@@ -48,7 +48,7 @@ Object.defineProperty(window, 'sessionStorage', {
 });
 
 describe('NewsfeedApiDriver', () => {
-  const kibanaVersion = 'test_version';
+  const kibanaVersion = '99.999.9-test_version'; // It'll remove the `-test_version` bit
   const userLanguage = 'en';
   const fetchInterval = 2000;
   const getDriver = () => new NewsfeedApiDriver(kibanaVersion, userLanguage, fetchInterval);
@@ -179,7 +179,7 @@ describe('NewsfeedApiDriver', () => {
           "error": null,
           "feedItems": Array [],
           "hasNew": false,
-          "kibanaVersion": "test_version",
+          "kibanaVersion": "99.999.9",
         }
       `);
     });
@@ -227,7 +227,7 @@ describe('NewsfeedApiDriver', () => {
           },
         ],
         hasNew: true,
-        kibanaVersion: 'test_version',
+        kibanaVersion: '99.999.9',
       });
     });
 
@@ -309,7 +309,7 @@ describe('NewsfeedApiDriver', () => {
           },
         ],
         hasNew: true,
-        kibanaVersion: 'test_version',
+        kibanaVersion: '99.999.9',
       });
     });
 
@@ -375,7 +375,7 @@ describe('NewsfeedApiDriver', () => {
           },
         ],
         hasNew: true,
-        kibanaVersion: 'test_version',
+        kibanaVersion: '99.999.9',
       });
     });
 
@@ -405,7 +405,7 @@ describe('NewsfeedApiDriver', () => {
           "error": null,
           "feedItems": Array [],
           "hasNew": false,
-          "kibanaVersion": "test_version",
+          "kibanaVersion": "99.999.9",
         }
       `);
     });
@@ -436,7 +436,7 @@ describe('NewsfeedApiDriver', () => {
           "error": null,
           "feedItems": Array [],
           "hasNew": false,
-          "kibanaVersion": "test_version",
+          "kibanaVersion": "99.999.9",
         }
       `);
     });
diff --git a/src/plugins/newsfeed/public/lib/api.ts b/src/plugins/newsfeed/public/lib/api.ts
index ac38e064d26866..7253c0f3e294ca 100644
--- a/src/plugins/newsfeed/public/lib/api.ts
+++ b/src/plugins/newsfeed/public/lib/api.ts
@@ -32,13 +32,17 @@ import { ApiItem, NewsfeedItem, FetchResult, NewsfeedPluginBrowserConfig } from
 type ApiConfig = NewsfeedPluginBrowserConfig['service'];
 
 export class NewsfeedApiDriver {
+  private readonly kibanaVersion: string;
   private readonly loadedTime = moment().utc(); // the date is compared to time in UTC format coming from the service
 
   constructor(
-    private readonly kibanaVersion: string,
+    kibanaVersion: string,
     private readonly userLanguage: string,
     private readonly fetchInterval: number
-  ) {}
+  ) {
+    // The API only accepts versions in the format `X.Y.Z`, so we need to drop the `-SNAPSHOT` or any other label after it
+    this.kibanaVersion = kibanaVersion.replace(/^(\d+\.\d+\.\d+).*/, '$1');
+  }
 
   shouldFetch(): boolean {
     const lastFetchUtc: string | null = sessionStorage.getItem(NEWSFEED_LAST_FETCH_STORAGE_KEY);
diff --git a/src/plugins/region_map/public/plugin.ts b/src/plugins/region_map/public/plugin.ts
index 04a2ba2f23f4eb..ec9ee943105788 100644
--- a/src/plugins/region_map/public/plugin.ts
+++ b/src/plugins/region_map/public/plugin.ts
@@ -34,7 +34,7 @@ import { IServiceSettings, MapsLegacyPluginSetup } from '../../maps_legacy/publi
 import { setFormatService, setNotifications, setKibanaLegacy } from './kibana_services';
 import { DataPublicPluginStart } from '../../data/public';
 import { RegionMapsConfigType } from './index';
-import { ConfigSchema } from '../../maps_legacy/config';
+import { MapsLegacyConfig } from '../../maps_legacy/config';
 import { KibanaLegacyStart } from '../../kibana_legacy/public';
 
 /** @private */
@@ -73,7 +73,7 @@ export interface RegionMapPluginStart {}
 
 /** @internal */
 export class RegionMapPlugin implements Plugin<RegionMapPluginSetup, RegionMapPluginStart> {
-  readonly _initializerContext: PluginInitializerContext<ConfigSchema>;
+  readonly _initializerContext: PluginInitializerContext<MapsLegacyConfig>;
 
   constructor(initializerContext: PluginInitializerContext) {
     this._initializerContext = initializerContext;
diff --git a/src/plugins/saved_objects/public/saved_object/saved_object_loader.ts b/src/plugins/saved_objects/public/saved_object/saved_object_loader.ts
index 9e7346f3b673cd..6c791f5339def4 100644
--- a/src/plugins/saved_objects/public/saved_object/saved_object_loader.ts
+++ b/src/plugins/saved_objects/public/saved_object/saved_object_loader.ts
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { ChromeStart, SavedObjectsClientContract, SavedObjectsFindOptions } from 'kibana/public';
+import { SavedObjectsClientContract, SavedObjectsFindOptions } from 'kibana/public';
 import { SavedObject } from '../types';
 import { StringUtils } from './helpers/string_utils';
 
@@ -36,8 +36,7 @@ export class SavedObjectLoader {
 
   constructor(
     SavedObjectClass: any,
-    private readonly savedObjectsClient: SavedObjectsClientContract,
-    private readonly chrome: ChromeStart
+    private readonly savedObjectsClient: SavedObjectsClientContract
   ) {
     this.type = SavedObjectClass.type;
     this.Class = SavedObjectClass;
@@ -78,19 +77,6 @@ export class SavedObjectLoader {
       return savedObject.delete();
     });
     await Promise.all(deletions);
-
-    const coreNavLinks = this.chrome.navLinks;
-    /**
-     * Modify last url for deleted saved objects to avoid loading pages with "Could not locate..."
-     */
-    coreNavLinks
-      .getAll()
-      .filter(
-        (link) =>
-          link.linkToLastSubUrl &&
-          idsUsed.find((deletedId) => link.url && link.url.includes(deletedId)) !== undefined
-      )
-      .forEach((link) => coreNavLinks.update(link.id, { url: link.baseUrl }));
   }
 
   /**
diff --git a/src/plugins/saved_objects_management/public/lib/resolve_saved_objects.ts b/src/plugins/saved_objects_management/public/lib/resolve_saved_objects.ts
index 79b8c33b84cfee..679ea5ffc23eea 100644
--- a/src/plugins/saved_objects_management/public/lib/resolve_saved_objects.ts
+++ b/src/plugins/saved_objects_management/public/lib/resolve_saved_objects.ts
@@ -160,10 +160,6 @@ function groupByType(docs: SavedObjectsRawDoc[]): Record<string, SavedObjectsRaw
   }, defaultDocTypes);
 }
 
-async function awaitEachItemInParallel<T, R>(list: T[], op: (item: T) => R) {
-  return await Promise.all(list.map((item) => op(item)));
-}
-
 export async function resolveIndexPatternConflicts(
   resolutions: Array<{ oldId: string; newId: string }>,
   conflictedIndexPatterns: any[],
@@ -175,7 +171,7 @@ export async function resolveIndexPatternConflicts(
 ) {
   let importCount = 0;
 
-  await awaitEachItemInParallel(conflictedIndexPatterns, async ({ obj, doc }) => {
+  for (const { obj, doc } of conflictedIndexPatterns) {
     const serializedSearchSource = JSON.parse(
       doc._source.kibanaSavedObjectMeta?.searchSourceJSON || '{}'
     );
@@ -220,7 +216,7 @@ export async function resolveIndexPatternConflicts(
 
     if (!allResolved) {
       // The user decided to skip this conflict so do nothing
-      return;
+      continue;
     }
     obj.searchSource = await dependencies.search.searchSource.create(
       serializedSearchSourceWithInjectedReferences
@@ -228,17 +224,17 @@ export async function resolveIndexPatternConflicts(
     if (await saveObject(obj, overwriteAll)) {
       importCount++;
     }
-  });
+  }
   return importCount;
 }
 
 export async function saveObjects(objs: SavedObject[], overwriteAll: boolean) {
   let importCount = 0;
-  await awaitEachItemInParallel(objs, async (obj) => {
+  for (const obj of objs) {
     if (await saveObject(obj, overwriteAll)) {
       importCount++;
     }
-  });
+  }
   return importCount;
 }
 
@@ -253,16 +249,16 @@ export async function resolveSavedSearches(
   overwriteAll: boolean
 ) {
   let importCount = 0;
-  await awaitEachItemInParallel(savedSearches, async (searchDoc) => {
+  for (const searchDoc of savedSearches) {
     const obj = await getSavedObject(searchDoc, services);
     if (!obj) {
       // Just ignore?
-      return;
+      continue;
     }
     if (await importDocument(obj, searchDoc, overwriteAll)) {
       importCount++;
     }
-  });
+  }
   return importCount;
 }
 
@@ -280,7 +276,10 @@ export async function resolveSavedObjects(
   let importedObjectCount = 0;
   const failedImports: FailedImport[] = [];
   // Start with the index patterns since everything is dependent on them
-  await awaitEachItemInParallel(docTypes.indexPatterns, async (indexPatternDoc) => {
+  // As the confirmation opens a modal, and as we only allow one modal at a time
+  // (opening a new one close the previous with a rejection)
+  // we can't do that in parallel
+  for (const indexPatternDoc of docTypes.indexPatterns) {
     try {
       const importedIndexPatternId = await importIndexPattern(
         indexPatternDoc,
@@ -294,7 +293,7 @@ export async function resolveSavedObjects(
     } catch (error) {
       failedImports.push({ obj: indexPatternDoc as any, error });
     }
-  });
+  }
 
   // We want to do the same for saved searches, but we want to keep them separate because they need
   // to be applied _first_ because other saved objects can be dependent on those saved searches existing
@@ -311,7 +310,7 @@ export async function resolveSavedObjects(
   // likely that these saved objects will work once resaved so keep them around to resave them.
   const conflictedSavedObjectsLinkedToSavedSearches: any[] = [];
 
-  await awaitEachItemInParallel(docTypes.searches, async (searchDoc) => {
+  for (const searchDoc of docTypes.searches) {
     const obj = await getSavedObject(searchDoc, services);
 
     try {
@@ -329,9 +328,9 @@ export async function resolveSavedObjects(
         failedImports.push({ obj, error });
       }
     }
-  });
+  }
 
-  await awaitEachItemInParallel(docTypes.other, async (otherDoc) => {
+  for (const otherDoc of docTypes.other) {
     const obj = await getSavedObject(otherDoc, services);
 
     try {
@@ -350,7 +349,7 @@ export async function resolveSavedObjects(
         failedImports.push({ obj, error });
       }
     }
-  });
+  }
 
   return {
     conflictedIndexPatterns,
diff --git a/src/plugins/telemetry/README.md b/src/plugins/telemetry/README.md
index 196d596fb784f4..0a05facfbbe0fb 100644
--- a/src/plugins/telemetry/README.md
+++ b/src/plugins/telemetry/README.md
@@ -7,3 +7,61 @@ Telemetry allows Kibana features to have usage tracked in the wild. The general
 3. Viewing usage data in the Kibana instance of the telemetry cluster (Viewing).
 
 This plugin is responsible for sending usage data to the telemetry cluster. For collecting usage data, use the [`usageCollection` plugin](../usage_collection/README.md)
+
+## Telemetry Plugin public API
+
+### Setup
+
+The `setup` function exposes the following interface:
+
+- `getTelemetryUrl: () => Promise<URL>`:
+  An async function that resolves into the telemetry Url used to send telemetry. The url is wrapped with node's [URL constructor](https://nodejs.org/api/url.html). Here is an example on how to grab the url origin:
+  ```
+  const telemetryUrl = await getTelemetryUrl();
+    > telemetryUrl.origin; // 'https://telemetry.elastic.co'
+  ```
+  Note that the telemetry URL is a kibana.yml configuration hence it is recommended to call the `getTelemetryUrl` everytime before using the actual url.
+
+### Start
+
+The `start` function exposes the following interface:
+
+- `async getIsOptedIn(): Promise<boolean>`:
+  An async function that resolves into `true` if the user has opted into send Elastic usage data.
+  Resolves to `false` if the user explicitly opted out of sending usage data to Elastic or did not choose
+  to opt-in or out yet after a minor or major upgrade (only when previously opted out).
+
+### Usage
+
+To use the exposed plugin start and setup contracts:
+
+1. Make sure `telemetry` is in your `optionalPlugins` in the `kibana.json` file:
+
+```json5
+// <plugin>/kibana.json
+{
+"id": "...",
+"optionalPlugins": ["telemetry"]
+}
+```
+
+2. Use the exposed contracts:
+```ts
+// <plugin>/server/plugin.ts
+
+import { TelemetryPluginsStart } from '../telemetry/server`;
+
+interface MyPlyginStartDeps {
+  telemetry?: TelemetryPluginsStart;
+}
+
+class MyPlugin {
+  public async start(
+    core: CoreStart,
+    { telemetry }: MyPlyginStartDeps
+  ) {
+    const isOptedIn = await telemetry?.getIsOptedIn();
+    ...
+  }
+}
+```
diff --git a/src/plugins/telemetry/server/index.ts b/src/plugins/telemetry/server/index.ts
index 42259d2e5187ce..e9887456e2f365 100644
--- a/src/plugins/telemetry/server/index.ts
+++ b/src/plugins/telemetry/server/index.ts
@@ -24,7 +24,7 @@ import { configSchema, TelemetryConfigType } from './config';
 
 export { FetcherTask } from './fetcher';
 export { handleOldSettings } from './handle_old_settings';
-export { TelemetryPluginsSetup } from './plugin';
+export { TelemetryPluginSetup, TelemetryPluginStart } from './plugin';
 
 export const config: PluginConfigDescriptor<TelemetryConfigType> = {
   schema: configSchema,
diff --git a/src/plugins/telemetry/server/mocks.ts b/src/plugins/telemetry/server/mocks.ts
new file mode 100644
index 00000000000000..8952dd619f4267
--- /dev/null
+++ b/src/plugins/telemetry/server/mocks.ts
@@ -0,0 +1,46 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { URL } from 'url';
+import { TelemetryPluginStart, TelemetryPluginSetup } from './plugin';
+
+export type Setup = jest.Mocked<TelemetryPluginSetup>;
+export type Start = jest.Mocked<TelemetryPluginStart>;
+
+export const telemetryPluginMock = {
+  createSetupContract,
+  createStartContract,
+};
+
+function createSetupContract(): Setup {
+  const telemetryUrl = new URL('https://telemetry-staging.elastic.co/xpack/MOCK_URL/send');
+  const setupContract: Setup = {
+    getTelemetryUrl: jest.fn().mockResolvedValue(telemetryUrl),
+  };
+
+  return setupContract;
+}
+
+function createStartContract(): Start {
+  const startContract: Start = {
+    getIsOptedIn: jest.fn(),
+  };
+
+  return startContract;
+}
diff --git a/src/plugins/telemetry/server/plugin.ts b/src/plugins/telemetry/server/plugin.ts
index bd7a2a8c1a8cae..005c5f96d98d03 100644
--- a/src/plugins/telemetry/server/plugin.ts
+++ b/src/plugins/telemetry/server/plugin.ts
@@ -17,12 +17,14 @@
  * under the License.
  */
 
+import { URL } from 'url';
 import { Observable } from 'rxjs';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import {
   TelemetryCollectionManagerPluginSetup,
   TelemetryCollectionManagerPluginStart,
 } from 'src/plugins/telemetry_collection_manager/server';
+import { take } from 'rxjs/operators';
 import {
   CoreSetup,
   PluginInitializerContext,
@@ -42,19 +44,38 @@ import {
 import { TelemetryConfigType } from './config';
 import { FetcherTask } from './fetcher';
 import { handleOldSettings } from './handle_old_settings';
+import { getTelemetrySavedObject } from './telemetry_repository';
+import { getTelemetryOptIn } from '../common/telemetry_config';
 
-export interface TelemetryPluginsSetup {
+interface TelemetryPluginsDepsSetup {
   usageCollection: UsageCollectionSetup;
   telemetryCollectionManager: TelemetryCollectionManagerPluginSetup;
 }
 
-export interface TelemetryPluginsStart {
+interface TelemetryPluginsDepsStart {
   telemetryCollectionManager: TelemetryCollectionManagerPluginStart;
 }
 
+export interface TelemetryPluginSetup {
+  /**
+   * Resolves into the telemetry Url used to send telemetry.
+   * The url is wrapped with node's [URL constructor](https://nodejs.org/api/url.html).
+   */
+  getTelemetryUrl: () => Promise<URL>;
+}
+
+export interface TelemetryPluginStart {
+  /**
+   * Resolves `true` if the user has opted into send Elastic usage data.
+   * Resolves `false` if the user explicitly opted out of sending usage data to Elastic
+   * or did not choose to opt-in or out -yet- after a minor or major upgrade (only when previously opted-out).
+   */
+  getIsOptedIn: () => Promise<boolean>;
+}
+
 type SavedObjectsRegisterType = CoreSetup['savedObjects']['registerType'];
 
-export class TelemetryPlugin implements Plugin {
+export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPluginStart> {
   private readonly logger: Logger;
   private readonly currentKibanaVersion: string;
   private readonly config$: Observable<TelemetryConfigType>;
@@ -76,8 +97,8 @@ export class TelemetryPlugin implements Plugin {
 
   public async setup(
     { elasticsearch, http, savedObjects }: CoreSetup,
-    { usageCollection, telemetryCollectionManager }: TelemetryPluginsSetup
-  ) {
+    { usageCollection, telemetryCollectionManager }: TelemetryPluginsDepsSetup
+  ): Promise<TelemetryPluginSetup> {
     const currentKibanaVersion = this.currentKibanaVersion;
     const config$ = this.config$;
     const isDev = this.isDev;
@@ -96,9 +117,19 @@ export class TelemetryPlugin implements Plugin {
 
     this.registerMappings((opts) => savedObjects.registerType(opts));
     this.registerUsageCollectors(usageCollection);
+
+    return {
+      getTelemetryUrl: async () => {
+        const config = await config$.pipe(take(1)).toPromise();
+        return new URL(config.url);
+      },
+    };
   }
 
-  public async start(core: CoreStart, { telemetryCollectionManager }: TelemetryPluginsStart) {
+  public async start(
+    core: CoreStart,
+    { telemetryCollectionManager }: TelemetryPluginsDepsStart
+  ): Promise<TelemetryPluginStart> {
     const { savedObjects, uiSettings } = core;
     this.savedObjectsClient = savedObjects.createInternalRepository();
     const savedObjectsClient = new SavedObjectsClient(this.savedObjectsClient);
@@ -111,6 +142,25 @@ export class TelemetryPlugin implements Plugin {
     }
 
     this.fetcherTask.start(core, { telemetryCollectionManager });
+
+    return {
+      getIsOptedIn: async () => {
+        const internalRepository = new SavedObjectsClient(savedObjects.createInternalRepository());
+        const telemetrySavedObject = await getTelemetrySavedObject(internalRepository!);
+        const config = await this.config$.pipe(take(1)).toPromise();
+        const allowChangingOptInStatus = config.allowChangingOptInStatus;
+        const configTelemetryOptIn = typeof config.optIn === 'undefined' ? null : config.optIn;
+        const currentKibanaVersion = this.currentKibanaVersion;
+        const isOptedIn = getTelemetryOptIn({
+          currentKibanaVersion,
+          telemetrySavedObject,
+          allowChangingOptInStatus,
+          configTelemetryOptIn,
+        });
+
+        return isOptedIn === true;
+      },
+    };
   }
 
   private registerMappings(registerType: SavedObjectsRegisterType) {
diff --git a/src/plugins/timelion/public/directives/_saved_object_finder.scss b/src/plugins/timelion/public/directives/_saved_object_finder.scss
index b97dace5e9e000..e1a055a5f49e99 100644
--- a/src/plugins/timelion/public/directives/_saved_object_finder.scss
+++ b/src/plugins/timelion/public/directives/_saved_object_finder.scss
@@ -23,3 +23,74 @@
     }
   }
 }
+
+
+saved-object-finder {
+
+  .list-sort-button {
+    border-top-left-radius: 0;
+    border-top-right-radius: 0;
+    border: none;
+    padding: $euiSizeS $euiSize;
+    font-weight: $euiFontWeightRegular;
+    background-color: $euiColorLightestShade;
+  }
+
+  .li-striped {
+    li {
+      border: none;
+    }
+
+    li:nth-child(even) {
+      background-color: $euiColorLightestShade;
+    }
+
+    li:nth-child(odd) {
+      background-color: $euiColorEmptyShade;
+    }
+
+    .paginate-heading {
+      font-weight: $euiFontWeightRegular;
+      color: $euiColorDarkestShade;
+    }
+
+    .list-group-item {
+      padding: $euiSizeS $euiSize;
+
+      ul {
+        padding: 0;
+        display: flex;
+        flex-direction: row;
+
+        .finder-type {
+          margin-right: $euiSizeS;
+        }
+      }
+
+      a {
+        display: block;
+        color: $euiColorPrimary;
+
+        i {
+          color: shade($euiColorPrimary, 10%);
+          margin-right: $euiSizeS;
+        }
+      }
+
+      &:first-child {
+        border-top-left-radius: 0;
+        border-top-right-radius: 0;
+      }
+
+      &.list-group-no-results p {
+        margin-bottom: 0;
+      }
+    }
+  }
+
+  paginate {
+    paginate-controls {
+      margin: $euiSize;
+    }
+  }
+}
diff --git a/src/plugins/timelion/public/services/saved_sheets.ts b/src/plugins/timelion/public/services/saved_sheets.ts
index a3e7f66d9ee475..9ad529cb0134b6 100644
--- a/src/plugins/timelion/public/services/saved_sheets.ts
+++ b/src/plugins/timelion/public/services/saved_sheets.ts
@@ -33,7 +33,7 @@ export function initSavedSheetService(app: angular.IModule, deps: RenderDeps) {
 
   const SavedSheet = createSavedSheetClass(services, deps.core.uiSettings);
 
-  const savedSheetLoader = new SavedObjectLoader(SavedSheet, savedObjectsClient, deps.core.chrome);
+  const savedSheetLoader = new SavedObjectLoader(SavedSheet, savedObjectsClient);
   savedSheetLoader.urlFor = (id) => `#/${encodeURIComponent(id)}`;
   // Customize loader properties since adding an 's' on type doesn't work for type 'timelion-sheet'.
   savedSheetLoader.loaderProperties = {
diff --git a/src/plugins/ui_actions/public/triggers/select_range_trigger.ts b/src/plugins/ui_actions/public/triggers/select_range_trigger.ts
index f6d5547f624814..312e75314bd926 100644
--- a/src/plugins/ui_actions/public/triggers/select_range_trigger.ts
+++ b/src/plugins/ui_actions/public/triggers/select_range_trigger.ts
@@ -27,6 +27,6 @@ export const selectRangeTrigger: Trigger<'SELECT_RANGE_TRIGGER'> = {
     defaultMessage: 'Range selection',
   }),
   description: i18n.translate('uiActions.triggers.selectRangeDescription', {
-    defaultMessage: 'Select a group of values',
+    defaultMessage: 'A range of values on the visualization',
   }),
 };
diff --git a/src/plugins/ui_actions/public/triggers/value_click_trigger.ts b/src/plugins/ui_actions/public/triggers/value_click_trigger.ts
index e1e7b6507d82b8..e63ff28f42d965 100644
--- a/src/plugins/ui_actions/public/triggers/value_click_trigger.ts
+++ b/src/plugins/ui_actions/public/triggers/value_click_trigger.ts
@@ -27,6 +27,6 @@ export const valueClickTrigger: Trigger<'VALUE_CLICK_TRIGGER'> = {
     defaultMessage: 'Single click',
   }),
   description: i18n.translate('uiActions.triggers.valueClickDescription', {
-    defaultMessage: 'A single point clicked on a visualization',
+    defaultMessage: 'A single point on the visualization',
   }),
 };
diff --git a/src/plugins/vis_default_editor/public/components/__snapshots__/agg.test.tsx.snap b/src/plugins/vis_default_editor/public/components/__snapshots__/agg.test.tsx.snap
index 5200fee45d6b34..2a521bc01219cb 100644
--- a/src/plugins/vis_default_editor/public/components/__snapshots__/agg.test.tsx.snap
+++ b/src/plugins/vis_default_editor/public/components/__snapshots__/agg.test.tsx.snap
@@ -33,6 +33,8 @@ exports[`DefaultEditorAgg component should init with the default set of props 1`
   }
   id="visEditorAggAccordion1"
   initialIsOpen={true}
+  isLoading={false}
+  isLoadingMessage={false}
   onToggle={[Function]}
   paddingSize="none"
 >
diff --git a/src/plugins/vis_default_editor/public/components/agg_params_map.ts b/src/plugins/vis_default_editor/public/components/agg_params_map.ts
index 9bc3146b9903bb..e9019e479f92fe 100644
--- a/src/plugins/vis_default_editor/public/components/agg_params_map.ts
+++ b/src/plugins/vis_default_editor/public/components/agg_params_map.ts
@@ -43,6 +43,7 @@ const buckets = {
   },
   [BUCKET_TYPES.HISTOGRAM]: {
     interval: controls.NumberIntervalParamEditor,
+    maxBars: controls.MaxBarsParamEditor,
     min_doc_count: controls.MinDocCountParamEditor,
     has_extended_bounds: controls.HasExtendedBoundsParamEditor,
     extended_bounds: controls.ExtendedBoundsParamEditor,
diff --git a/src/plugins/vis_default_editor/public/components/controls/filter.tsx b/src/plugins/vis_default_editor/public/components/controls/filter.tsx
index 101ca3e8ad457b..c373f9331c9a72 100644
--- a/src/plugins/vis_default_editor/public/components/controls/filter.tsx
+++ b/src/plugins/vis_default_editor/public/components/controls/filter.tsx
@@ -115,6 +115,7 @@ function FilterRow({
           dataTestSubj={dataTestSubj}
           bubbleSubmitEvent={true}
           languageSwitcherPopoverAnchorPosition="leftDown"
+          size="s"
         />
       </EuiFormRow>
       {showCustomLabel ? (
diff --git a/src/plugins/vis_default_editor/public/components/controls/index.ts b/src/plugins/vis_default_editor/public/components/controls/index.ts
index cfb236e5e22e37..26e6609c7711d2 100644
--- a/src/plugins/vis_default_editor/public/components/controls/index.ts
+++ b/src/plugins/vis_default_editor/public/components/controls/index.ts
@@ -52,3 +52,4 @@ export { TopSizeParamEditor } from './top_size';
 export { TopSortFieldParamEditor } from './top_sort_field';
 export { OrderParamEditor } from './order';
 export { UseGeocentroidParamEditor } from './use_geocentroid';
+export { MaxBarsParamEditor } from './max_bars';
diff --git a/src/plugins/vis_default_editor/public/components/controls/max_bars.tsx b/src/plugins/vis_default_editor/public/components/controls/max_bars.tsx
new file mode 100644
index 00000000000000..b0d517e0928dff
--- /dev/null
+++ b/src/plugins/vis_default_editor/public/components/controls/max_bars.tsx
@@ -0,0 +1,108 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React, { useCallback, useEffect } from 'react';
+import { EuiFormRow, EuiFieldNumber, EuiFieldNumberProps, EuiIconTip } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+import { useKibana } from '../../../../kibana_react/public';
+import { AggParamEditorProps } from '../agg_param_props';
+import { UI_SETTINGS } from '../../../../data/public';
+
+export interface SizeParamEditorProps extends AggParamEditorProps<number | ''> {
+  iconTip?: React.ReactNode;
+  disabled?: boolean;
+}
+
+const autoPlaceholder = i18n.translate('visDefaultEditor.controls.maxBars.autoPlaceholder', {
+  defaultMessage: 'Auto',
+});
+
+const label = (
+  <>
+    <FormattedMessage
+      id="visDefaultEditor.controls.maxBars.maxBarsLabel"
+      defaultMessage="Max bars"
+    />{' '}
+    <EuiIconTip
+      position="right"
+      content={
+        <FormattedMessage
+          id="visDefaultEditor.controls.maxBars.maxBarsHelpText"
+          defaultMessage="Intervals will be selected automatically based on the available data. The maximum number of bars can never be greater than the Advanced Setting's {histogramMaxBars}"
+          values={{ histogramMaxBars: UI_SETTINGS.HISTOGRAM_MAX_BARS }}
+        />
+      }
+      type="questionInCircle"
+    />
+  </>
+);
+
+function MaxBarsParamEditor({
+  disabled,
+  iconTip,
+  value,
+  setValue,
+  showValidation,
+  setValidity,
+  setTouched,
+}: SizeParamEditorProps) {
+  const { services } = useKibana();
+  const uiSettingMaxBars = services.uiSettings?.get(UI_SETTINGS.HISTOGRAM_MAX_BARS);
+  const isValid =
+    disabled ||
+    value === undefined ||
+    value === '' ||
+    Number(value) > 0 ||
+    value < uiSettingMaxBars;
+
+  useEffect(() => {
+    setValidity(isValid);
+  }, [isValid, setValidity]);
+
+  const onChange: EuiFieldNumberProps['onChange'] = useCallback(
+    (ev) => setValue(ev.target.value === '' ? '' : parseFloat(ev.target.value)),
+    [setValue]
+  );
+
+  return (
+    <EuiFormRow
+      label={label}
+      fullWidth={true}
+      isInvalid={showValidation ? !isValid : false}
+      compressed
+    >
+      <EuiFieldNumber
+        value={value || ''}
+        placeholder={autoPlaceholder}
+        onChange={onChange}
+        min={1}
+        fullWidth
+        compressed
+        max={uiSettingMaxBars}
+        isInvalid={showValidation ? !isValid : false}
+        onBlur={setTouched}
+        disabled={disabled}
+        data-test-subj="maxBarsParamEditor"
+      />
+    </EuiFormRow>
+  );
+}
+
+export { MaxBarsParamEditor };
diff --git a/src/plugins/vis_default_editor/public/components/controls/number_interval.tsx b/src/plugins/vis_default_editor/public/components/controls/number_interval.tsx
index f6354027ab01b8..8cdc92581cefbf 100644
--- a/src/plugins/vis_default_editor/public/components/controls/number_interval.tsx
+++ b/src/plugins/vis_default_editor/public/components/controls/number_interval.tsx
@@ -20,7 +20,16 @@
 import { get } from 'lodash';
 import React, { useEffect, useCallback } from 'react';
 
-import { EuiFieldNumber, EuiFormRow, EuiIconTip } from '@elastic/eui';
+import {
+  EuiFieldNumber,
+  EuiFormRow,
+  EuiIconTip,
+  EuiSwitch,
+  EuiSwitchProps,
+  EuiFieldNumberProps,
+  EuiFlexGroup,
+  EuiFlexItem,
+} from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { UI_SETTINGS } from '../../../../data/public';
@@ -47,6 +56,25 @@ const label = (
   </>
 );
 
+const autoInterval = 'auto';
+const isAutoInterval = (value: unknown) => value === autoInterval;
+
+const selectIntervalPlaceholder = i18n.translate(
+  'visDefaultEditor.controls.numberInterval.selectIntervalPlaceholder',
+  {
+    defaultMessage: 'Enter an interval',
+  }
+);
+const autoIntervalIsUsedPlaceholder = i18n.translate(
+  'visDefaultEditor.controls.numberInterval.autoInteralIsUsed',
+  {
+    defaultMessage: 'Auto interval is used',
+  }
+);
+const useAutoIntervalLabel = i18n.translate('visDefaultEditor.controls.useAutoInterval', {
+  defaultMessage: 'Use auto interval',
+});
+
 function NumberIntervalParamEditor({
   agg,
   editorConfig,
@@ -55,18 +83,28 @@ function NumberIntervalParamEditor({
   setTouched,
   setValidity,
   setValue,
-}: AggParamEditorProps<number | undefined>) {
+}: AggParamEditorProps<string | undefined>) {
+  const isAutoChecked = isAutoInterval(value);
   const base: number = get(editorConfig, 'interval.base') as number;
   const min = base || 0;
-  const isValid = value !== undefined && value >= min;
+  const isValid =
+    value !== '' && value !== undefined && (isAutoInterval(value) || Number(value) >= min);
 
   useEffect(() => {
     setValidity(isValid);
   }, [isValid, setValidity]);
 
-  const onChange = useCallback(
-    ({ target }: React.ChangeEvent<HTMLInputElement>) =>
-      setValue(isNaN(target.valueAsNumber) ? undefined : target.valueAsNumber),
+  const onChange: EuiFieldNumberProps['onChange'] = useCallback(
+    ({ target }) => setValue(isNaN(target.valueAsNumber) ? '' : target.valueAsNumber),
+    [setValue]
+  );
+
+  const onAutoSwitchChange: EuiSwitchProps['onChange'] = useCallback(
+    (e) => {
+      const isAutoSwitchChecked = e.target.checked;
+
+      setValue(isAutoSwitchChecked ? autoInterval : '');
+    },
     [setValue]
   );
 
@@ -78,23 +116,32 @@ function NumberIntervalParamEditor({
       isInvalid={showValidation && !isValid}
       helpText={get(editorConfig, 'interval.help')}
     >
-      <EuiFieldNumber
-        value={value === undefined ? '' : value}
-        min={min}
-        step={base}
-        data-test-subj={`visEditorInterval${agg.id}`}
-        isInvalid={showValidation && !isValid}
-        onChange={onChange}
-        onBlur={setTouched}
-        fullWidth={true}
-        compressed
-        placeholder={i18n.translate(
-          'visDefaultEditor.controls.numberInterval.selectIntervalPlaceholder',
-          {
-            defaultMessage: 'Enter an interval',
-          }
-        )}
-      />
+      <EuiFlexGroup gutterSize="s" responsive={false} direction={'column'}>
+        <EuiFlexItem>
+          <EuiSwitch
+            label={useAutoIntervalLabel}
+            onChange={onAutoSwitchChange}
+            checked={isAutoChecked}
+            compressed
+            data-test-subj={`visEditorIntervalSwitch${agg.id}`}
+          />
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiFieldNumber
+            value={!isAutoChecked ? value : ''}
+            min={min}
+            step={base || 'any'}
+            data-test-subj={`visEditorInterval${agg.id}`}
+            isInvalid={showValidation && !isValid}
+            onChange={onChange}
+            onBlur={setTouched}
+            disabled={isAutoChecked}
+            fullWidth
+            compressed
+            placeholder={isAutoChecked ? autoIntervalIsUsedPlaceholder : selectIntervalPlaceholder}
+          />
+        </EuiFlexItem>
+      </EuiFlexGroup>
     </EuiFormRow>
   );
 }
diff --git a/src/plugins/vis_type_table/public/agg_table/agg_table.test.js b/src/plugins/vis_type_table/public/agg_table/agg_table.test.js
index 0362bd55963d9b..29a10151a9418b 100644
--- a/src/plugins/vis_type_table/public/agg_table/agg_table.test.js
+++ b/src/plugins/vis_type_table/public/agg_table/agg_table.test.js
@@ -24,7 +24,7 @@ import 'angular-mocks';
 import sinon from 'sinon';
 import { round } from 'lodash';
 
-import { getFieldFormatsRegistry } from '../../../../test_utils/public/stub_field_formats';
+import { getFieldFormatsRegistry } from '../../../data/public/test_utils';
 import { coreMock } from '../../../../core/public/mocks';
 import { initAngularBootstrap } from '../../../kibana_legacy/public';
 import { setUiSettings } from '../../../data/public/services';
diff --git a/src/plugins/vis_type_table/public/agg_table/agg_table_group.test.js b/src/plugins/vis_type_table/public/agg_table/agg_table_group.test.js
index 43913eed32f90a..04cf624331d819 100644
--- a/src/plugins/vis_type_table/public/agg_table/agg_table_group.test.js
+++ b/src/plugins/vis_type_table/public/agg_table/agg_table_group.test.js
@@ -22,7 +22,7 @@ import angular from 'angular';
 import 'angular-mocks';
 import expect from '@kbn/expect';
 
-import { getFieldFormatsRegistry } from '../../../../test_utils/public/stub_field_formats';
+import { getFieldFormatsRegistry } from '../../../data/public/test_utils';
 import { coreMock } from '../../../../core/public/mocks';
 import { initAngularBootstrap } from '../../../kibana_legacy/public';
 import { setUiSettings } from '../../../data/public/services';
diff --git a/src/plugins/vis_type_timelion/server/plugin.ts b/src/plugins/vis_type_timelion/server/plugin.ts
index 5e6557e3056928..52c50b0646299d 100644
--- a/src/plugins/vis_type_timelion/server/plugin.ts
+++ b/src/plugins/vis_type_timelion/server/plugin.ts
@@ -22,6 +22,7 @@ import { first } from 'rxjs/operators';
 import { TypeOf, schema } from '@kbn/config-schema';
 import { RecursiveReadonly } from '@kbn/utility-types';
 
+import { PluginStart } from '../../../../src/plugins/data/server';
 import { CoreSetup, PluginInitializerContext } from '../../../../src/core/server';
 import { deepFreeze } from '../../../../src/core/server';
 import { configSchema } from '../config';
@@ -42,6 +43,10 @@ export interface PluginSetupContract {
   uiEnabled: boolean;
 }
 
+export interface TimelionPluginStartDeps {
+  data: PluginStart;
+}
+
 /**
  * Represents Timelion Plugin instance that will be managed by the Kibana plugin system.
  */
@@ -80,11 +85,12 @@ export class Plugin {
       functions,
       getFunction,
       logger,
+      core,
     };
 
     functionsRoute(router, deps);
     runRoute(router, deps);
-    validateEsRoute(router);
+    validateEsRoute(router, core);
 
     core.uiSettings.register({
       'timelion:es.timefield': {
diff --git a/src/plugins/vis_type_timelion/server/routes/run.ts b/src/plugins/vis_type_timelion/server/routes/run.ts
index b8cefc8a07f286..19bb5238f9de0a 100644
--- a/src/plugins/vis_type_timelion/server/routes/run.ts
+++ b/src/plugins/vis_type_timelion/server/routes/run.ts
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { IRouter, Logger } from 'kibana/server';
+import { IRouter, Logger, CoreSetup } from 'kibana/server';
 import { schema } from '@kbn/config-schema';
 import Bluebird from 'bluebird';
 import _ from 'lodash';
@@ -37,10 +37,12 @@ export function runRoute(
     logger,
     getFunction,
     configManager,
+    core,
   }: {
     logger: Logger;
     getFunction: (name: string) => TimelionFunctionInterface;
     configManager: ConfigManager;
+    core: CoreSetup;
   }
 ) {
   router.post(
@@ -81,13 +83,14 @@ export function runRoute(
         const uiSettings = await context.core.uiSettings.client.getAll();
 
         const tlConfig = getTlConfig({
+          context,
           request,
           settings: _.defaults(uiSettings, timelionDefaults), // Just in case they delete some setting.
           getFunction,
+          getStartServices: core.getStartServices,
           allowedGraphiteUrls: configManager.getGraphiteUrls(),
           esShardTimeout: configManager.getEsShardTimeout(),
           savedObjectsClient: context.core.savedObjects.client,
-          esDataClient: () => context.core.elasticsearch.legacy.client,
         });
         const chainRunner = chainRunnerFn(tlConfig);
         const sheet = await Bluebird.all(chainRunner.processRequest(request.body));
diff --git a/src/plugins/vis_type_timelion/server/routes/validate_es.ts b/src/plugins/vis_type_timelion/server/routes/validate_es.ts
index d5ce80dc151a29..ea08310499a967 100644
--- a/src/plugins/vis_type_timelion/server/routes/validate_es.ts
+++ b/src/plugins/vis_type_timelion/server/routes/validate_es.ts
@@ -18,9 +18,11 @@
  */
 
 import _ from 'lodash';
-import { IRouter } from 'kibana/server';
+import { IRouter, CoreSetup } from 'kibana/server';
+import { ES_SEARCH_STRATEGY } from '../../../data/server';
+import { TimelionPluginStartDeps } from '../plugin';
 
-export function validateEsRoute(router: IRouter) {
+export function validateEsRoute(router: IRouter, core: CoreSetup) {
   router.get(
     {
       path: '/api/timelion/validate/es',
@@ -28,33 +30,37 @@ export function validateEsRoute(router: IRouter) {
     },
     async function (context, request, response) {
       const uiSettings = await context.core.uiSettings.client.getAll();
-
-      const { callAsCurrentUser } = context.core.elasticsearch.legacy.client;
+      const deps = (await core.getStartServices())[1] as TimelionPluginStartDeps;
 
       const timefield = uiSettings['timelion:es.timefield'];
 
       const body = {
-        index: uiSettings['es.default_index'],
-        body: {
-          aggs: {
-            maxAgg: {
-              max: {
-                field: timefield,
+        params: {
+          index: uiSettings['es.default_index'],
+          body: {
+            aggs: {
+              maxAgg: {
+                max: {
+                  field: timefield,
+                },
               },
-            },
-            minAgg: {
-              min: {
-                field: timefield,
+              minAgg: {
+                min: {
+                  field: timefield,
+                },
               },
             },
+            size: 0,
           },
-          size: 0,
         },
       };
 
-      let resp = {};
+      let resp;
       try {
-        resp = await callAsCurrentUser('search', body);
+        resp = await deps.data.search.search(context, body, {
+          strategy: ES_SEARCH_STRATEGY,
+        });
+        resp = resp.rawResponse;
       } catch (errResp) {
         resp = errResp;
       }
diff --git a/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js b/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js
index a624ff72ead699..4b5aab85cfc4e6 100644
--- a/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js
+++ b/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js
@@ -25,7 +25,6 @@ import buildRequest from './lib/build_request';
 import createDateAgg from './lib/create_date_agg';
 import esResponse from '../fixtures/es_response';
 
-import Bluebird from 'bluebird';
 import _ from 'lodash';
 import { expect } from 'chai';
 import sinon from 'sinon';
@@ -34,14 +33,14 @@ import { UI_SETTINGS } from '../../../../data/server';
 
 function stubRequestAndServer(response, indexPatternSavedObjects = []) {
   return {
-    esDataClient: sinon.stub().returns({
-      callAsCurrentUser: function () {
-        return Bluebird.resolve(response);
-      },
-    }),
+    getStartServices: sinon
+      .stub()
+      .returns(
+        Promise.resolve([{}, { data: { search: { search: () => Promise.resolve(response) } } }])
+      ),
     savedObjectsClient: {
       find: function () {
-        return Bluebird.resolve({
+        return Promise.resolve({
           saved_objects: indexPatternSavedObjects,
         });
       },
@@ -55,7 +54,9 @@ describe('es', () => {
   describe('seriesList processor', () => {
     it('throws an error then the index is missing', () => {
       tlConfig = stubRequestAndServer({
-        _shards: { total: 0 },
+        rawResponse: {
+          _shards: { total: 0 },
+        },
       });
       return invoke(es, [5], tlConfig)
         .then(expect.fail)
@@ -65,7 +66,7 @@ describe('es', () => {
     });
 
     it('returns a seriesList', () => {
-      tlConfig = stubRequestAndServer(esResponse);
+      tlConfig = stubRequestAndServer({ rawResponse: esResponse });
       return invoke(es, [5], tlConfig).then((r) => {
         expect(r.output.type).to.eql('seriesList');
       });
@@ -168,22 +169,22 @@ describe('es', () => {
       config.index = 'beer';
       const request = fn(config, tlConfig, emptyScriptedFields);
 
-      expect(request.index).to.equal('beer');
+      expect(request.params.index).to.equal('beer');
     });
 
     it('always sets body.size to 0', () => {
       const request = fn(config, tlConfig, emptyScriptedFields);
 
-      expect(request.body.size).to.equal(0);
+      expect(request.params.body.size).to.equal(0);
     });
 
     it('creates a filters agg that contains each of the queries passed', () => {
       config.q = ['foo', 'bar'];
       const request = fn(config, tlConfig, emptyScriptedFields);
 
-      expect(request.body.aggs.q.meta.type).to.equal('split');
+      expect(request.params.body.aggs.q.meta.type).to.equal('split');
 
-      const filters = request.body.aggs.q.filters.filters;
+      const filters = request.params.body.aggs.q.filters.filters;
       expect(filters.foo.query_string.query).to.eql('foo');
       expect(filters.bar.query_string.query).to.eql('bar');
     });
@@ -193,14 +194,14 @@ describe('es', () => {
         config.index = 'beer';
         const request = fn(config, tlConfig, emptyScriptedFields, 30000);
 
-        expect(request.timeout).to.equal('30000ms');
+        expect(request.params.timeout).to.equal('30000ms');
       });
 
       it('sets no timeout if elasticsearch.shardTimeout is set to 0', () => {
         config.index = 'beer';
         const request = fn(config, tlConfig, emptyScriptedFields, 0);
 
-        expect(request).to.not.have.property('timeout');
+        expect(request.params).to.not.have.property('timeout');
       });
     });
 
@@ -220,7 +221,7 @@ describe('es', () => {
         tlConfig.settings[UI_SETTINGS.SEARCH_INCLUDE_FROZEN] = false;
         const request = fn(config, tlConfig, emptyScriptedFields);
 
-        expect(request.ignore_throttled).to.equal(true);
+        expect(request.params.ignore_throttled).to.equal(true);
       });
 
       it('sets no timeout if elasticsearch.shardTimeout is set to 0', () => {
@@ -228,7 +229,7 @@ describe('es', () => {
         config.index = 'beer';
         const request = fn(config, tlConfig, emptyScriptedFields);
 
-        expect(request.ignore_throttled).to.equal(false);
+        expect(request.params.ignore_throttled).to.equal(false);
       });
     });
 
@@ -262,7 +263,7 @@ describe('es', () => {
       it('adds the contents of body.extended.es.filter to a filter clause of the bool', () => {
         config.kibana = true;
         const request = fn(config, tlConfig, emptyScriptedFields);
-        const filter = request.body.query.bool.filter.bool;
+        const filter = request.params.body.query.bool.filter.bool;
         expect(filter.must.length).to.eql(1);
         expect(filter.must_not.length).to.eql(2);
       });
@@ -270,13 +271,13 @@ describe('es', () => {
       it('does not include filters if config.kibana = false', () => {
         config.kibana = false;
         const request = fn(config, tlConfig, emptyScriptedFields);
-        expect(request.body.query.bool.filter).to.eql(undefined);
+        expect(request.params.body.query.bool.filter).to.eql(undefined);
       });
 
       it('adds a time filter to the bool querys must clause', () => {
         let request = fn(config, tlConfig, emptyScriptedFields);
-        expect(request.body.query.bool.must.length).to.eql(1);
-        expect(request.body.query.bool.must[0]).to.eql({
+        expect(request.params.body.query.bool.must.length).to.eql(1);
+        expect(request.params.body.query.bool.must[0]).to.eql({
           range: {
             '@timestamp': {
               format: 'strict_date_optional_time',
@@ -288,7 +289,7 @@ describe('es', () => {
 
         config.kibana = true;
         request = fn(config, tlConfig, emptyScriptedFields);
-        expect(request.body.query.bool.must.length).to.eql(1);
+        expect(request.params.body.query.bool.must.length).to.eql(1);
       });
     });
 
@@ -297,7 +298,7 @@ describe('es', () => {
         config.split = ['beer:5', 'wine:10'];
         const request = fn(config, tlConfig, emptyScriptedFields);
 
-        const aggs = request.body.aggs.q.aggs;
+        const aggs = request.params.body.aggs.q.aggs;
 
         expect(aggs.beer.meta.type).to.eql('split');
         expect(aggs.beer.terms.field).to.eql('beer');
@@ -324,7 +325,7 @@ describe('es', () => {
         ];
         const request = fn(config, tlConfig, scriptedFields);
 
-        const aggs = request.body.aggs.q.aggs;
+        const aggs = request.params.body.aggs.q.aggs;
 
         expect(aggs.scriptedBeer.meta.type).to.eql('split');
         expect(aggs.scriptedBeer.terms.script).to.eql({
diff --git a/src/plugins/vis_type_timelion/server/series_functions/es/index.js b/src/plugins/vis_type_timelion/server/series_functions/es/index.js
index fd392f599c1d21..bfa8d75900d110 100644
--- a/src/plugins/vis_type_timelion/server/series_functions/es/index.js
+++ b/src/plugins/vis_type_timelion/server/series_functions/es/index.js
@@ -19,6 +19,7 @@
 
 import { i18n } from '@kbn/i18n';
 import _ from 'lodash';
+import { ES_SEARCH_STRATEGY } from '../../../../data/server';
 import Datasource from '../../lib/classes/datasource';
 import buildRequest from './lib/build_request';
 import toSeriesList from './lib/agg_response_to_series_list';
@@ -129,9 +130,13 @@ export default new Datasource('es', {
 
     const body = buildRequest(config, tlConfig, scriptedFields, esShardTimeout);
 
-    const { callAsCurrentUser: callWithRequest } = tlConfig.esDataClient();
-    const resp = await callWithRequest('search', body);
-    if (!resp._shards.total) {
+    const deps = (await tlConfig.getStartServices())[1];
+
+    const resp = await deps.data.search.search(tlConfig.context, body, {
+      strategy: ES_SEARCH_STRATEGY,
+    });
+
+    if (!resp.rawResponse._shards.total) {
       throw new Error(
         i18n.translate('timelion.serverSideErrors.esFunction.indexNotFoundErrorMessage', {
           defaultMessage: 'Elasticsearch index not found: {index}',
@@ -143,7 +148,7 @@ export default new Datasource('es', {
     }
     return {
       type: 'seriesList',
-      list: toSeriesList(resp.aggregations, config),
+      list: toSeriesList(resp.rawResponse.aggregations, config),
     };
   },
 });
diff --git a/src/plugins/vis_type_timelion/server/series_functions/es/lib/build_request.js b/src/plugins/vis_type_timelion/server/series_functions/es/lib/build_request.js
index e407636c41567e..a8a7be6fd86098 100644
--- a/src/plugins/vis_type_timelion/server/series_functions/es/lib/build_request.js
+++ b/src/plugins/vis_type_timelion/server/series_functions/es/lib/build_request.js
@@ -93,5 +93,7 @@ export default function buildRequest(config, tlConfig, scriptedFields, timeout)
     request.timeout = `${timeout}ms`;
   }
 
-  return request;
+  return {
+    params: request,
+  };
 }
diff --git a/src/plugins/vis_type_timelion/server/series_functions/fixtures/tl_config.js b/src/plugins/vis_type_timelion/server/series_functions/fixtures/tl_config.js
index 6107a2845a7cc9..38d70278fbf003 100644
--- a/src/plugins/vis_type_timelion/server/series_functions/fixtures/tl_config.js
+++ b/src/plugins/vis_type_timelion/server/series_functions/fixtures/tl_config.js
@@ -30,11 +30,15 @@ export default function () {
       if (!functions[name]) throw new Error('No such function: ' + name);
       return functions[name];
     },
-    esDataClient: sinon.stub().returns({
-      callAsCurrentUser: function () {
-        return Promise.resolve(esResponse);
-      },
-    }),
+    getStartServices: sinon
+      .stub()
+      .returns(
+        Promise.resolve([
+          {},
+          { data: { search: { search: () => Promise.resolve({ rawResponse: esResponse }) } } },
+        ])
+      ),
+
     esShardTimeout: moment.duration(30000),
     allowedGraphiteUrls: ['https://www.hostedgraphite.com/UID/ACCESS_KEY/graphite'],
   });
diff --git a/src/plugins/vis_type_timeseries/public/application/components/lib/get_axis_label_string.test.js b/src/plugins/vis_type_timeseries/public/application/components/lib/get_axis_label_string.test.js
index cfbd5ecb7bf655..068e3fea8b768a 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/lib/get_axis_label_string.test.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/lib/get_axis_label_string.test.js
@@ -19,8 +19,6 @@
 
 import { getAxisLabelString } from './get_axis_label_string';
 
-jest.mock('ui/new_platform');
-
 describe('getAxisLabelString(interval)', () => {
   test('should return a valid label for 10 seconds', () => {
     expect(getAxisLabelString(10000)).toEqual('per 10 seconds');
diff --git a/src/plugins/vis_type_timeseries/public/application/components/lib/tick_formatter.test.js b/src/plugins/vis_type_timeseries/public/application/components/lib/tick_formatter.test.js
index 308579126eeb1d..7aa7d53554d576 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/lib/tick_formatter.test.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/lib/tick_formatter.test.js
@@ -18,7 +18,7 @@
  */
 
 import { createTickFormatter } from './tick_formatter';
-import { getFieldFormatsRegistry } from '../../../../../../test_utils/public/stub_field_formats';
+import { getFieldFormatsRegistry } from '../../../../../data/public/test_utils';
 import { setFieldFormats } from '../../../services';
 import { UI_SETTINGS } from '../../../../../data/public';
 
diff --git a/src/plugins/vis_type_timeseries/public/application/components/panel_config.js b/src/plugins/vis_type_timeseries/public/application/components/panel_config.js
index c950c39f06a66a..3b081d8eb7db9e 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/panel_config.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/panel_config.js
@@ -67,7 +67,9 @@ export function PanelConfig(props) {
     return (
       <FormValidationContext.Provider value={updateControlValidity}>
         <VisDataContext.Provider value={visData}>
-          <Component {...props} />
+          <div data-test-subj={`tvbPanelConfig__${model.type}`}>
+            <Component {...props} />
+          </div>
         </VisDataContext.Provider>
       </FormValidationContext.Provider>
     );
diff --git a/src/plugins/vis_type_timeseries/public/application/components/panel_config/gauge.js b/src/plugins/vis_type_timeseries/public/application/components/panel_config/gauge.js
index 18380680283ef5..7f26701e38277a 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/panel_config/gauge.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/panel_config/gauge.js
@@ -330,7 +330,7 @@ class GaugePanelConfigUi extends Component {
       );
     }
     return (
-      <div>
+      <>
         <EuiTabs size="s">
           <EuiTab isSelected={selectedTab === 'data'} onClick={() => this.switchTab('data')}>
             <FormattedMessage
@@ -346,7 +346,7 @@ class GaugePanelConfigUi extends Component {
           </EuiTab>
         </EuiTabs>
         {view}
-      </div>
+      </>
     );
   }
 }
diff --git a/src/plugins/vis_type_timeseries/public/application/components/panel_config/markdown.js b/src/plugins/vis_type_timeseries/public/application/components/panel_config/markdown.js
index 03d84d67ea7879..36d0e3a80e227d 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/panel_config/markdown.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/panel_config/markdown.js
@@ -294,7 +294,7 @@ class MarkdownPanelConfigUi extends Component {
       );
     }
     return (
-      <div>
+      <>
         <EuiTabs size="s">
           <EuiTab
             isSelected={selectedTab === 'markdown'}
@@ -325,7 +325,7 @@ class MarkdownPanelConfigUi extends Component {
           </EuiTab>
         </EuiTabs>
         {view}
-      </div>
+      </>
     );
   }
 }
diff --git a/src/plugins/vis_type_timeseries/public/application/components/panel_config/metric.js b/src/plugins/vis_type_timeseries/public/application/components/panel_config/metric.js
index feb809f20995a9..568194c2e09184 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/panel_config/metric.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/panel_config/metric.js
@@ -167,7 +167,7 @@ export class MetricPanelConfig extends Component {
       );
     }
     return (
-      <div>
+      <>
         <EuiTabs size="s">
           <EuiTab isSelected={selectedTab === 'data'} onClick={() => this.switchTab('data')}>
             <FormattedMessage
@@ -187,7 +187,7 @@ export class MetricPanelConfig extends Component {
           </EuiTab>
         </EuiTabs>
         {view}
-      </div>
+      </>
     );
   }
 }
diff --git a/src/plugins/vis_type_timeseries/public/application/components/panel_config/table.js b/src/plugins/vis_type_timeseries/public/application/components/panel_config/table.js
index 2b729e403898e9..bb3f0041abca7f 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/panel_config/table.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/panel_config/table.js
@@ -269,7 +269,7 @@ export class TablePanelConfig extends Component {
       );
     }
     return (
-      <div>
+      <>
         <EuiTabs size="s">
           <EuiTab isSelected={selectedTab === 'data'} onClick={() => this.switchTab('data')}>
             <FormattedMessage
@@ -285,7 +285,7 @@ export class TablePanelConfig extends Component {
           </EuiTab>
         </EuiTabs>
         {view}
-      </div>
+      </>
     );
   }
 }
diff --git a/src/plugins/vis_type_timeseries/public/application/components/panel_config/timeseries.js b/src/plugins/vis_type_timeseries/public/application/components/panel_config/timeseries.js
index 3e5e335a9ea397..03da52b10f08b5 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/panel_config/timeseries.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/panel_config/timeseries.js
@@ -44,6 +44,7 @@ import {
 import { injectI18n, FormattedMessage } from '@kbn/i18n/react';
 import { getDefaultQueryLanguage } from '../lib/get_default_query_language';
 import { QueryBarWrapper } from '../query_bar_wrapper';
+
 class TimeseriesPanelConfigUi extends Component {
   constructor(props) {
     super(props);
@@ -401,7 +402,7 @@ class TimeseriesPanelConfigUi extends Component {
       );
     }
     return (
-      <div>
+      <>
         <EuiTabs size="s">
           <EuiTab isSelected={selectedTab === 'data'} onClick={() => this.switchTab('data')}>
             <FormattedMessage
@@ -430,7 +431,7 @@ class TimeseriesPanelConfigUi extends Component {
           </EuiTab>
         </EuiTabs>
         {view}
-      </div>
+      </>
     );
   }
 }
diff --git a/src/plugins/vis_type_timeseries/public/application/components/panel_config/top_n.js b/src/plugins/vis_type_timeseries/public/application/components/panel_config/top_n.js
index 4752e0ee7de65e..14c4400180280f 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/panel_config/top_n.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/panel_config/top_n.js
@@ -227,7 +227,7 @@ export class TopNPanelConfig extends Component {
       );
     }
     return (
-      <div>
+      <>
         <EuiTabs size="s">
           <EuiTab isSelected={selectedTab === 'data'} onClick={() => this.switchTab('data')}>
             <FormattedMessage
@@ -243,7 +243,7 @@ export class TopNPanelConfig extends Component {
           </EuiTab>
         </EuiTabs>
         {view}
-      </div>
+      </>
     );
   }
 }
diff --git a/src/plugins/vis_type_timeseries/public/application/components/splits/__snapshots__/terms.test.js.snap b/src/plugins/vis_type_timeseries/public/application/components/splits/__snapshots__/terms.test.js.snap
index 3bf8b77621cf5e..daff68e40dbaea 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/splits/__snapshots__/terms.test.js.snap
+++ b/src/plugins/vis_type_timeseries/public/application/components/splits/__snapshots__/terms.test.js.snap
@@ -44,6 +44,7 @@ exports[`src/legacy/core_plugins/metrics/public/components/splits/terms.test.js
         labelType="label"
       >
         <InjectIntl(FieldSelectUi)
+          data-test-subj="groupByField"
           fields={
             Object {
               "kibana_sample_data_flights": Array [
diff --git a/src/plugins/vis_type_timeseries/public/application/components/splits/terms.js b/src/plugins/vis_type_timeseries/public/application/components/splits/terms.js
index b71141f44f52dd..a72c7598509a85 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/splits/terms.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/splits/terms.js
@@ -132,6 +132,7 @@ export const SplitByTermsUI = ({
             }
           >
             <FieldSelect
+              data-test-subj="groupByField"
               indexPattern={indexPattern}
               onChange={handleSelectChange('terms_field')}
               value={model.terms_field}
diff --git a/src/plugins/vis_type_timeseries/public/application/components/vis_editor.js b/src/plugins/vis_type_timeseries/public/application/components/vis_editor.js
index 50585869862eea..47b30f9ab27116 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/vis_editor.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/vis_editor.js
@@ -29,7 +29,6 @@ import { PanelConfig } from './panel_config';
 import { createBrushHandler } from '../lib/create_brush_handler';
 import { fetchFields } from '../lib/fetch_fields';
 import { extractIndexPatterns } from '../../../../../plugins/vis_type_timeseries/common/extract_index_patterns';
-import { esKuery, UI_SETTINGS } from '../../../../../plugins/data/public';
 import { getSavedObjectsClient, getUISettings, getDataStart, getCoreStart } from '../../services';
 
 import { CoreStartContextProvider } from '../contexts/query_input_bar_context';
@@ -86,20 +85,6 @@ export class VisEditor extends Component {
     });
   }, VIS_STATE_DEBOUNCE_DELAY);
 
-  isValidKueryQuery = (filterQuery) => {
-    if (filterQuery && filterQuery.language === 'kuery') {
-      try {
-        const queryOptions = this.coreContext.uiSettings.get(
-          UI_SETTINGS.QUERY_ALLOW_LEADING_WILDCARDS
-        );
-        esKuery.fromKueryExpression(filterQuery.query, { allowLeadingWildcards: queryOptions });
-      } catch (error) {
-        return false;
-      }
-    }
-    return true;
-  };
-
   handleChange = (partialModel) => {
     if (isEmpty(partialModel)) {
       return;
@@ -134,6 +119,14 @@ export class VisEditor extends Component {
     });
   };
 
+  updateModel = () => {
+    const { params } = this.props.vis.clone();
+
+    this.setState({
+      model: params,
+    });
+  };
+
   handleCommit = () => {
     this.updateVisState();
     this.setState({ dirty: false });
@@ -219,6 +212,10 @@ export class VisEditor extends Component {
 
   componentDidMount() {
     this.props.renderComplete();
+
+    if (this.props.isEditorMode && this.props.eventEmitter) {
+      this.props.eventEmitter.on('updateEditor', this.updateModel);
+    }
   }
 
   componentDidUpdate() {
@@ -227,6 +224,10 @@ export class VisEditor extends Component {
 
   componentWillUnmount() {
     this.updateVisState.cancel();
+
+    if (this.props.isEditorMode && this.props.eventEmitter) {
+      this.props.eventEmitter.off('updateEditor', this.updateModel);
+    }
   }
 }
 
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/__snapshots__/area_decorator.test.js.snap b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/__snapshots__/area_decorator.test.js.snap
index 6506b838ff2884..7ded8e2254aa98 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/__snapshots__/area_decorator.test.js.snap
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/__snapshots__/area_decorator.test.js.snap
@@ -42,7 +42,6 @@ exports[`src/legacy/core_plugins/metrics/public/visualizations/views/timeseries/
   histogramModeAlignment="center"
   id="61ca57f1-469d-11e7-af02-69e470af7417:Rome"
   name="Rome"
-  stackAsPercentage={false}
   timeZone="local"
   xAccessor={0}
   xScaleType="time"
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/__snapshots__/bar_decorator.test.js.snap b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/__snapshots__/bar_decorator.test.js.snap
index c337c0dc77a2fe..02c7fd811e583b 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/__snapshots__/bar_decorator.test.js.snap
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/__snapshots__/bar_decorator.test.js.snap
@@ -34,7 +34,6 @@ exports[`src/legacy/core_plugins/metrics/public/visualizations/views/timeseries/
   histogramModeAlignment="center"
   id="61ca57f1-469d-11e7-af02-69e470af7417:Rome"
   name="Rome"
-  stackAsPercentage={false}
   timeZone="local"
   xAccessor={0}
   xScaleType="time"
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/area_decorator.js b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/area_decorator.js
index 0afe773266a61f..300af551e50203 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/area_decorator.js
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/area_decorator.js
@@ -32,7 +32,7 @@ export function AreaSeriesDecorator({
   lines,
   color,
   stackAccessors,
-  stackAsPercentage,
+  stackMode,
   points,
   xScaleType,
   yScaleType,
@@ -60,7 +60,7 @@ export function AreaSeriesDecorator({
     y1AccessorFormat,
     y0AccessorFormat,
     stackAccessors,
-    stackAsPercentage,
+    stackMode,
     xScaleType,
     yScaleType,
     timeZone,
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/area_decorator.test.js b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/area_decorator.test.js
index 80ffcaa66c7a0f..1fa88ff4b991fe 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/area_decorator.test.js
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/area_decorator.test.js
@@ -43,7 +43,7 @@ describe('src/legacy/core_plugins/metrics/public/visualizations/views/timeseries
         [1557003600000, 9],
       ],
       hideInLegend: false,
-      stackAsPercentage: false,
+      stackMode: undefined,
       seriesId: '61ca57f1-469d-11e7-af02-69e470af7417:Rome',
       seriesGroupId: 'yaxis_main_group',
       name: 'Rome',
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/bar_decorator.js b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/bar_decorator.js
index c979920caac6d9..239f1d4f1838e8 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/bar_decorator.js
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/bar_decorator.js
@@ -32,7 +32,7 @@ export function BarSeriesDecorator({
   bars,
   color,
   stackAccessors,
-  stackAsPercentage,
+  stackMode,
   xScaleType,
   yScaleType,
   timeZone,
@@ -59,7 +59,7 @@ export function BarSeriesDecorator({
     y1AccessorFormat,
     y0AccessorFormat,
     stackAccessors,
-    stackAsPercentage,
+    stackMode,
     xScaleType,
     yScaleType,
     timeZone,
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/bar_decorator.test.js b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/bar_decorator.test.js
index ab33524fc5b770..94ec53b887dda9 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/bar_decorator.test.js
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/decorators/bar_decorator.test.js
@@ -33,7 +33,7 @@ describe('src/legacy/core_plugins/metrics/public/visualizations/views/timeseries
         [1557003600000, 9],
       ],
       hideInLegend: false,
-      stackAsPercentage: false,
+      stackMode: undefined,
       seriesId: '61ca57f1-469d-11e7-af02-69e470af7417:Rome',
       seriesGroupId: 'yaxis_main_group',
       name: 'Rome',
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/index.js b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/index.js
index 6b5d84dc569815..5f0cc5188b1fd4 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/index.js
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/index.js
@@ -29,6 +29,7 @@ import {
   AnnotationDomainTypes,
   LineAnnotation,
   TooltipType,
+  StackMode,
 } from '@elastic/charts';
 import { EuiIcon } from '@elastic/eui';
 import { getTimezone } from '../../../lib/get_timezone';
@@ -197,7 +198,7 @@ export const TimeSeries = ({
                 bars={bars}
                 color={finalColor}
                 stackAccessors={stackAccessors}
-                stackAsPercentage={isPercentage}
+                stackMode={isPercentage ? StackMode.Percentage : undefined}
                 xScaleType={xScaleType}
                 yScaleType={yScaleType}
                 timeZone={timeZone}
@@ -222,7 +223,7 @@ export const TimeSeries = ({
                 lines={lines}
                 color={finalColor}
                 stackAccessors={stackAccessors}
-                stackAsPercentage={isPercentage}
+                stackMode={isPercentage ? StackMode.Percentage : undefined}
                 points={points}
                 xScaleType={xScaleType}
                 yScaleType={yScaleType}
@@ -248,8 +249,10 @@ export const TimeSeries = ({
           position={position}
           domain={domain}
           hide={hide}
-          showGridLines={showGrid}
-          gridLineStyle={GRID_LINE_CONFIG}
+          gridLine={{
+            ...GRID_LINE_CONFIG,
+            visible: showGrid,
+          }}
           tickFormat={tickFormatter}
         />
       ))}
@@ -259,8 +262,10 @@ export const TimeSeries = ({
         position={Position.Bottom}
         title={xAxisLabel}
         tickFormat={xAxisFormatter}
-        showGridLines={showGrid}
-        gridLineStyle={GRID_LINE_CONFIG}
+        gridLine={{
+          ...GRID_LINE_CONFIG,
+          visible: showGrid,
+        }}
       />
     </Chart>
   );
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/model/__snapshots__/charts.test.js.snap b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/model/__snapshots__/charts.test.js.snap
index 541265c05057a2..4acb3985320da1 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/model/__snapshots__/charts.test.js.snap
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/model/__snapshots__/charts.test.js.snap
@@ -14,7 +14,7 @@ Object {
     "seriesId": [Function],
     "sortIndex": [Function],
     "stackAccessors": [Function],
-    "stackAsPercentage": [Function],
+    "stackMode": [Function],
     "timeZone": [Function],
     "useDefaultGroupDomain": [Function],
     "xScaleType": [Function],
@@ -31,7 +31,7 @@ Object {
     "seriesId": [Function],
     "sortIndex": [Function],
     "stackAccessors": [Function],
-    "stackAsPercentage": [Function],
+    "stackMode": [Function],
     "timeZone": [Function],
     "useDefaultGroupDomain": [Function],
     "xScaleType": [Function],
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/model/charts.js b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/model/charts.js
index b14b84dcd1fe4c..29b1e9f4f20e3c 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/model/charts.js
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/model/charts.js
@@ -30,7 +30,7 @@ const Chart = {
   data: PropTypes.arrayOf(PropTypes.arrayOf(PropTypes.number)).isRequired,
   hideInLegend: PropTypes.bool.isRequired,
   color: PropTypes.string.isRequired,
-  stackAsPercentage: PropTypes.bool.isRequired,
+  stackMode: PropTypes.oneOf(['percentage', 'wiggle', 'silhouette']),
   stackAccessors: PropTypes.arrayOf(PropTypes.number),
   xScaleType: PropTypes.string,
   yScaleType: PropTypes.string,
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/utils/theme.test.ts b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/utils/theme.test.ts
index d7e6560a8dc971..8e96037b9947dc 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/utils/theme.test.ts
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/utils/theme.test.ts
@@ -33,14 +33,12 @@ describe('TSVB theme', () => {
   });
   it('should return a highcontrast color theme for a different background', () => {
     // red use a near full-black color
-    expect(getBaseTheme(LIGHT_THEME, 'red').axes.axisTitleStyle.fill).toEqual('rgb(23,23,23)');
+    expect(getBaseTheme(LIGHT_THEME, 'red').axes.axisTitle.fill).toEqual('rgb(23,23,23)');
 
     // violet increased the text color to full white for higer contrast
-    expect(getBaseTheme(LIGHT_THEME, '#ba26ff').axes.axisTitleStyle.fill).toEqual(
-      'rgb(255,255,255)'
-    );
+    expect(getBaseTheme(LIGHT_THEME, '#ba26ff').axes.axisTitle.fill).toEqual('rgb(255,255,255)');
 
     // light yellow, prefer the LIGHT_THEME fill color because already with a good contrast
-    expect(getBaseTheme(LIGHT_THEME, '#fff49f').axes.axisTitleStyle.fill).toEqual('#333');
+    expect(getBaseTheme(LIGHT_THEME, '#fff49f').axes.axisTitle.fill).toEqual('#333');
   });
 });
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/utils/theme.ts b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/utils/theme.ts
index 0e13fd7ef68f96..030c54fec888ca 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/utils/theme.ts
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/utils/theme.ts
@@ -109,27 +109,27 @@ export function getBaseTheme(baseTheme: Theme, bgColor?: string | null): Theme {
   const mainTheme = bgLuminosity <= 0.179 ? DARK_THEME : LIGHT_THEME;
   const color = findBestContrastColor(
     bgColor,
-    LIGHT_THEME.axes.axisTitleStyle.fill,
-    DARK_THEME.axes.axisTitleStyle.fill
+    LIGHT_THEME.axes.axisTitle.fill,
+    DARK_THEME.axes.axisTitle.fill
   );
   return {
     ...mainTheme,
     axes: {
       ...mainTheme.axes,
-      axisTitleStyle: {
-        ...mainTheme.axes.axisTitleStyle,
+      axisTitle: {
+        ...mainTheme.axes.axisTitle,
         fill: color,
       },
-      tickLabelStyle: {
-        ...mainTheme.axes.tickLabelStyle,
+      tickLabel: {
+        ...mainTheme.axes.tickLabel,
         fill: color,
       },
-      axisLineStyle: {
-        ...mainTheme.axes.axisLineStyle,
+      axisLine: {
+        ...mainTheme.axes.axisLine,
         stroke: color,
       },
-      tickLineStyle: {
-        ...mainTheme.axes.tickLineStyle,
+      tickLine: {
+        ...mainTheme.axes.tickLine,
         stroke: color,
       },
     },
diff --git a/src/plugins/vis_type_vega/public/data_model/search_api.ts b/src/plugins/vis_type_vega/public/data_model/search_api.ts
index d2ce8c95b9f90f..8a1541ecae0d41 100644
--- a/src/plugins/vis_type_vega/public/data_model/search_api.ts
+++ b/src/plugins/vis_type_vega/public/data_model/search_api.ts
@@ -62,7 +62,7 @@ export class SearchAPI {
           requestResponders[requestId].json(params.body);
         }
 
-        return search({ params }, { signal: this.abortSignal }).pipe(
+        return search({ params }, { abortSignal: this.abortSignal }).pipe(
           tap((data) => this.inspectSearchResult(data, requestResponders[requestId])),
           map((data) => ({
             name: requestId,
diff --git a/src/plugins/vis_type_vega/public/services.ts b/src/plugins/vis_type_vega/public/services.ts
index 7d988d464b52b9..acd02a6dd42f81 100644
--- a/src/plugins/vis_type_vega/public/services.ts
+++ b/src/plugins/vis_type_vega/public/services.ts
@@ -26,7 +26,7 @@ import {
 
 import { DataPublicPluginStart } from '../../data/public';
 import { createGetterSetter } from '../../kibana_utils/public';
-import { MapsLegacyConfigType } from '../../maps_legacy/public';
+import { MapsLegacyConfig } from '../../maps_legacy/config';
 
 export const [getData, setData] = createGetterSetter<DataPublicPluginStart>('Data');
 
@@ -53,7 +53,7 @@ export const [getInjectedVars, setInjectedVars] = createGetterSetter<{
   emsTileLayerId: unknown;
 }>('InjectedVars');
 
-export const [getMapsLegacyConfig, setMapsLegacyConfig] = createGetterSetter<MapsLegacyConfigType>(
+export const [getMapsLegacyConfig, setMapsLegacyConfig] = createGetterSetter<MapsLegacyConfig>(
   'MapsLegacyConfig'
 );
 
diff --git a/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axes_panel.test.tsx.snap b/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axes_panel.test.tsx.snap
index ab3e273f99c052..ed7ae45eed3a57 100644
--- a/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axes_panel.test.tsx.snap
+++ b/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axes_panel.test.tsx.snap
@@ -83,6 +83,8 @@ exports[`ValueAxesPanel component should init with the default set of props 1`]
     }
     id="yAxisAccordionValueAxis-1"
     initialIsOpen={false}
+    isLoading={false}
+    isLoadingMessage={false}
     key="ValueAxis-1"
     paddingSize="none"
   >
@@ -264,6 +266,8 @@ exports[`ValueAxesPanel component should init with the default set of props 1`]
     }
     id="yAxisAccordionValueAxis-2"
     initialIsOpen={false}
+    isLoading={false}
+    isLoadingMessage={false}
     key="ValueAxis-2"
     paddingSize="none"
   >
diff --git a/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axis_options.test.tsx.snap b/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axis_options.test.tsx.snap
index 36f5480e854061..c4142fb487b6a9 100644
--- a/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axis_options.test.tsx.snap
+++ b/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axis_options.test.tsx.snap
@@ -124,6 +124,8 @@ exports[`ValueAxisOptions component should init with the default set of props 1`
     className="visEditorSidebar__section visEditorSidebar__collapsible"
     id="yAxisOptionsAccordionValueAxis-1"
     initialIsOpen={false}
+    isLoading={false}
+    isLoadingMessage={false}
     paddingSize="none"
   >
     <EuiSpacer
diff --git a/src/plugins/visualizations/public/saved_visualizations/saved_visualizations.ts b/src/plugins/visualizations/public/saved_visualizations/saved_visualizations.ts
index 94538b4081aef6..0ec3c0dab2e977 100644
--- a/src/plugins/visualizations/public/saved_visualizations/saved_visualizations.ts
+++ b/src/plugins/visualizations/public/saved_visualizations/saved_visualizations.ts
@@ -76,9 +76,7 @@ export function createSavedVisLoader(services: SavedObjectKibanaServicesWithVisu
     }
   }
   const SavedVis = createSavedVisClass(services);
-  return new SavedObjectLoaderVisualize(
-    SavedVis,
-    savedObjectsClient,
-    services.chrome
-  ) as SavedObjectLoader & { findListItems: (search: string, size: number) => any };
+  return new SavedObjectLoaderVisualize(SavedVis, savedObjectsClient) as SavedObjectLoader & {
+    findListItems: (search: string, size: number) => any;
+  };
 }
diff --git a/src/plugins/visualizations/public/wizard/__snapshots__/new_vis_modal.test.tsx.snap b/src/plugins/visualizations/public/wizard/__snapshots__/new_vis_modal.test.tsx.snap
index 6aed16e9377131..3c4c983efa9faf 100644
--- a/src/plugins/visualizations/public/wizard/__snapshots__/new_vis_modal.test.tsx.snap
+++ b/src/plugins/visualizations/public/wizard/__snapshots__/new_vis_modal.test.tsx.snap
@@ -248,7 +248,7 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
                             <li>
                               <button
                                 aria-describedby="visTypeDescription-visWithAliasUrl"
-                                class="euiKeyPadMenuItem euiKeyPadMenuItem--hasBetaBadge visNewVisDialog__type"
+                                class="euiKeyPadMenuItem visNewVisDialog__type"
                                 data-test-subj="visType-visWithAliasUrl"
                                 data-vis-stage="alias"
                                 role="menuitem"
@@ -257,24 +257,6 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
                                 <div
                                   class="euiKeyPadMenuItem__inner"
                                 >
-                                  <span
-                                    class="euiKeyPadMenuItem__betaBadgeWrapper"
-                                  >
-                                    <span
-                                      class="euiToolTipAnchor"
-                                    >
-                                      <span
-                                        class="euiBetaBadge euiBetaBadge--iconOnly euiKeyPadMenuItem__betaBadge"
-                                        tabindex="0"
-                                      >
-                                        <div
-                                          aria-hidden="true"
-                                          class="euiBetaBadge__icon"
-                                          data-euiicon-type="popout"
-                                        />
-                                      </span>
-                                    </span>
-                                  </span>
                                   <div
                                     class="euiKeyPadMenuItem__icon"
                                   >
@@ -650,9 +632,6 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
                                         >
                                           <EuiKeyPadMenuItem
                                             aria-describedby="visTypeDescription-visWithAliasUrl"
-                                            betaBadgeIconType="popout"
-                                            betaBadgeLabel="Kibana application"
-                                            betaBadgeTooltipContent="Opens a Kibana application that is outside of Visualize."
                                             className="visNewVisDialog__type"
                                             data-test-subj="visType-visWithAliasUrl"
                                             data-vis-stage="alias"
@@ -674,7 +653,7 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
                                           >
                                             <button
                                               aria-describedby="visTypeDescription-visWithAliasUrl"
-                                              className="euiKeyPadMenuItem euiKeyPadMenuItem--hasBetaBadge visNewVisDialog__type"
+                                              className="euiKeyPadMenuItem visNewVisDialog__type"
                                               data-test-subj="visType-visWithAliasUrl"
                                               data-vis-stage="alias"
                                               disabled={false}
@@ -689,51 +668,6 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
                                               <div
                                                 className="euiKeyPadMenuItem__inner"
                                               >
-                                                <span
-                                                  className="euiKeyPadMenuItem__betaBadgeWrapper"
-                                                >
-                                                  <EuiBetaBadge
-                                                    className="euiKeyPadMenuItem__betaBadge"
-                                                    iconType="popout"
-                                                    label="Kibana application"
-                                                    tooltipContent="Opens a Kibana application that is outside of Visualize."
-                                                  >
-                                                    <EuiToolTip
-                                                      content="Opens a Kibana application that is outside of Visualize."
-                                                      delay="regular"
-                                                      position="top"
-                                                      title="Kibana application"
-                                                    >
-                                                      <span
-                                                        className="euiToolTipAnchor"
-                                                        onKeyUp={[Function]}
-                                                        onMouseOut={[Function]}
-                                                        onMouseOver={[Function]}
-                                                      >
-                                                        <span
-                                                          className="euiBetaBadge euiBetaBadge--iconOnly euiKeyPadMenuItem__betaBadge"
-                                                          onBlur={[Function]}
-                                                          onFocus={[Function]}
-                                                          tabIndex={0}
-                                                        >
-                                                          <EuiIcon
-                                                            aria-hidden="true"
-                                                            className="euiBetaBadge__icon"
-                                                            size="m"
-                                                            type="popout"
-                                                          >
-                                                            <div
-                                                              aria-hidden="true"
-                                                              className="euiBetaBadge__icon"
-                                                              data-euiicon-type="popout"
-                                                              size="m"
-                                                            />
-                                                          </EuiIcon>
-                                                        </span>
-                                                      </span>
-                                                    </EuiToolTip>
-                                                  </EuiBetaBadge>
-                                                </span>
                                                 <div
                                                   className="euiKeyPadMenuItem__icon"
                                                 >
@@ -1243,7 +1177,7 @@ exports[`NewVisModal should render as expected 1`] = `
                             <li>
                               <button
                                 aria-describedby="visTypeDescription-visWithAliasUrl"
-                                class="euiKeyPadMenuItem euiKeyPadMenuItem--hasBetaBadge visNewVisDialog__type"
+                                class="euiKeyPadMenuItem visNewVisDialog__type"
                                 data-test-subj="visType-visWithAliasUrl"
                                 data-vis-stage="alias"
                                 role="menuitem"
@@ -1252,24 +1186,6 @@ exports[`NewVisModal should render as expected 1`] = `
                                 <div
                                   class="euiKeyPadMenuItem__inner"
                                 >
-                                  <span
-                                    class="euiKeyPadMenuItem__betaBadgeWrapper"
-                                  >
-                                    <span
-                                      class="euiToolTipAnchor"
-                                    >
-                                      <span
-                                        class="euiBetaBadge euiBetaBadge--iconOnly euiKeyPadMenuItem__betaBadge"
-                                        tabindex="0"
-                                      >
-                                        <div
-                                          aria-hidden="true"
-                                          class="euiBetaBadge__icon"
-                                          data-euiicon-type="popout"
-                                        />
-                                      </span>
-                                    </span>
-                                  </span>
                                   <div
                                     class="euiKeyPadMenuItem__icon"
                                   >
@@ -1632,9 +1548,6 @@ exports[`NewVisModal should render as expected 1`] = `
                                         >
                                           <EuiKeyPadMenuItem
                                             aria-describedby="visTypeDescription-visWithAliasUrl"
-                                            betaBadgeIconType="popout"
-                                            betaBadgeLabel="Kibana application"
-                                            betaBadgeTooltipContent="Opens a Kibana application that is outside of Visualize."
                                             className="visNewVisDialog__type"
                                             data-test-subj="visType-visWithAliasUrl"
                                             data-vis-stage="alias"
@@ -1656,7 +1569,7 @@ exports[`NewVisModal should render as expected 1`] = `
                                           >
                                             <button
                                               aria-describedby="visTypeDescription-visWithAliasUrl"
-                                              className="euiKeyPadMenuItem euiKeyPadMenuItem--hasBetaBadge visNewVisDialog__type"
+                                              className="euiKeyPadMenuItem visNewVisDialog__type"
                                               data-test-subj="visType-visWithAliasUrl"
                                               data-vis-stage="alias"
                                               disabled={false}
@@ -1671,51 +1584,6 @@ exports[`NewVisModal should render as expected 1`] = `
                                               <div
                                                 className="euiKeyPadMenuItem__inner"
                                               >
-                                                <span
-                                                  className="euiKeyPadMenuItem__betaBadgeWrapper"
-                                                >
-                                                  <EuiBetaBadge
-                                                    className="euiKeyPadMenuItem__betaBadge"
-                                                    iconType="popout"
-                                                    label="Kibana application"
-                                                    tooltipContent="Opens a Kibana application that is outside of Visualize."
-                                                  >
-                                                    <EuiToolTip
-                                                      content="Opens a Kibana application that is outside of Visualize."
-                                                      delay="regular"
-                                                      position="top"
-                                                      title="Kibana application"
-                                                    >
-                                                      <span
-                                                        className="euiToolTipAnchor"
-                                                        onKeyUp={[Function]}
-                                                        onMouseOut={[Function]}
-                                                        onMouseOver={[Function]}
-                                                      >
-                                                        <span
-                                                          className="euiBetaBadge euiBetaBadge--iconOnly euiKeyPadMenuItem__betaBadge"
-                                                          onBlur={[Function]}
-                                                          onFocus={[Function]}
-                                                          tabIndex={0}
-                                                        >
-                                                          <EuiIcon
-                                                            aria-hidden="true"
-                                                            className="euiBetaBadge__icon"
-                                                            size="m"
-                                                            type="popout"
-                                                          >
-                                                            <div
-                                                              aria-hidden="true"
-                                                              className="euiBetaBadge__icon"
-                                                              data-euiicon-type="popout"
-                                                              size="m"
-                                                            />
-                                                          </EuiIcon>
-                                                        </span>
-                                                      </span>
-                                                    </EuiToolTip>
-                                                  </EuiBetaBadge>
-                                                </span>
                                                 <div
                                                   className="euiKeyPadMenuItem__icon"
                                                 >
diff --git a/src/plugins/visualizations/public/wizard/type_selection/type_selection.tsx b/src/plugins/visualizations/public/wizard/type_selection/type_selection.tsx
index dc6ac4919a4c42..0555b95648bc10 100644
--- a/src/plugins/visualizations/public/wizard/type_selection/type_selection.tsx
+++ b/src/plugins/visualizations/public/wizard/type_selection/type_selection.tsx
@@ -221,36 +221,18 @@ class TypeSelection extends React.Component<TypeSelectionProps, TypeSelectionSta
         defaultMessage:
           'This visualization is experimental. The design and implementation are less mature than stable visualizations and might be subject to change.',
       });
-    } else if ('aliasPath' in visType) {
-      if (visType.stage === 'beta') {
-        const aliasDescription = i18n.translate('visualizations.newVisWizard.betaDescription', {
-          defaultMessage:
-            'This visualization is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features',
-        });
-        stage = {
-          betaBadgeLabel: i18n.translate('visualizations.newVisWizard.betaTitle', {
-            defaultMessage: 'Beta',
-          }),
-          betaBadgeTooltipContent: aliasDescription,
-          // betaBadgeIconType: 'popout',
-        };
-        highlightMsg = aliasDescription;
-      } else {
-        const aliasDescription = i18n.translate(
-          'visualizations.newVisWizard.visTypeAliasDescription',
-          {
-            defaultMessage: 'Opens a Kibana application that is outside of Visualize.',
-          }
-        );
-        stage = {
-          betaBadgeLabel: i18n.translate('visualizations.newVisWizard.visTypeAliasTitle', {
-            defaultMessage: 'Kibana application',
-          }),
-          betaBadgeTooltipContent: aliasDescription,
-          betaBadgeIconType: 'popout',
-        };
-        highlightMsg = aliasDescription;
-      }
+    } else if ('aliasPath' in visType && visType.stage === 'beta') {
+      const aliasDescription = i18n.translate('visualizations.newVisWizard.betaDescription', {
+        defaultMessage:
+          'This visualization is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features',
+      });
+      stage = {
+        betaBadgeLabel: i18n.translate('visualizations.newVisWizard.betaTitle', {
+          defaultMessage: 'Beta',
+        }),
+        betaBadgeTooltipContent: aliasDescription,
+      };
+      highlightMsg = aliasDescription;
     }
 
     const isDisabled = this.state.query !== '' && !visType.highlighted;
diff --git a/src/plugins/visualizations/server/saved_objects/visualization_migrations.test.ts b/src/plugins/visualizations/server/saved_objects/visualization_migrations.test.ts
index 05f00e12c172e0..dc8bae69ca377e 100644
--- a/src/plugins/visualizations/server/saved_objects/visualization_migrations.test.ts
+++ b/src/plugins/visualizations/server/saved_objects/visualization_migrations.test.ts
@@ -1578,4 +1578,46 @@ describe('migration visualization', () => {
       expect(metric.denominator).toHaveProperty('language');
     });
   });
+
+  describe('7.10.0 remove tsvb search source', () => {
+    const migrate = (doc: any) =>
+      visualizationSavedObjectTypeMigrations['7.10.0'](
+        doc as Parameters<SavedObjectMigrationFn>[0],
+        savedObjectMigrationContext
+      );
+    const generateDoc = (visState: any) => ({
+      attributes: {
+        title: 'My Vis',
+        description: 'This is my super cool vis.',
+        visState: JSON.stringify(visState),
+        uiStateJSON: '{}',
+        version: 1,
+        kibanaSavedObjectMeta: {
+          searchSourceJSON: JSON.stringify({
+            filter: [],
+            query: {
+              query: {
+                query_string: {
+                  query: '*',
+                },
+              },
+              language: 'lucene',
+            },
+          }),
+        },
+      },
+    });
+
+    it('should remove the search source JSON', () => {
+      const timeSeriesDoc = generateDoc({ type: 'metrics' });
+      const migratedtimeSeriesDoc = migrate(timeSeriesDoc);
+      expect(migratedtimeSeriesDoc.attributes.kibanaSavedObjectMeta.searchSourceJSON).toEqual('{}');
+      const { kibanaSavedObjectMeta, ...attributes } = migratedtimeSeriesDoc.attributes;
+      const {
+        kibanaSavedObjectMeta: oldKibanaSavedObjectMeta,
+        ...oldAttributes
+      } = migratedtimeSeriesDoc.attributes;
+      expect(attributes).toEqual(oldAttributes);
+    });
+  });
 });
diff --git a/src/plugins/visualizations/server/saved_objects/visualization_migrations.ts b/src/plugins/visualizations/server/saved_objects/visualization_migrations.ts
index 64491d02aa0a3b..170d7c460b06a6 100644
--- a/src/plugins/visualizations/server/saved_objects/visualization_migrations.ts
+++ b/src/plugins/visualizations/server/saved_objects/visualization_migrations.ts
@@ -721,6 +721,35 @@ const migrateTsvbDefaultColorPalettes: SavedObjectMigrationFn<any, any> = (doc)
   return doc;
 };
 
+// [TSVB] Remove serialized search source as it's not used in TSVB visualizations
+const removeTSVBSearchSource: SavedObjectMigrationFn<any, any> = (doc) => {
+  const visStateJSON = get(doc, 'attributes.visState');
+  let visState;
+
+  const searchSourceJSON = get(doc, 'attributes.kibanaSavedObjectMeta.searchSourceJSON');
+
+  if (visStateJSON) {
+    try {
+      visState = JSON.parse(visStateJSON);
+    } catch (e) {
+      // Let it go, the data is invalid and we'll leave it as is
+    }
+    if (visState && visState.type === 'metrics' && searchSourceJSON !== '{}') {
+      return {
+        ...doc,
+        attributes: {
+          ...doc.attributes,
+          kibanaSavedObjectMeta: {
+            ...get(doc, 'attributes.kibanaSavedObjectMeta'),
+            searchSourceJSON: '{}',
+          },
+        },
+      };
+    }
+  }
+  return doc;
+};
+
 export const visualizationSavedObjectTypeMigrations = {
   /**
    * We need to have this migration twice, once with a version prior to 7.0.0 once with a version
@@ -752,5 +781,5 @@ export const visualizationSavedObjectTypeMigrations = {
   '7.4.2': flow(transformSplitFiltersStringToQueryObject),
   '7.7.0': flow(migrateOperatorKeyTypo, migrateSplitByChartRow),
   '7.8.0': flow(migrateTsvbDefaultColorPalettes),
-  '7.10.0': flow(migrateFilterRatioQuery),
+  '7.10.0': flow(migrateFilterRatioQuery, removeTSVBSearchSource),
 };
diff --git a/src/test_utils/expect_deep_equal.js b/src/test_utils/expect_deep_equal.js
deleted file mode 100644
index e3e24cbdf5dc95..00000000000000
--- a/src/test_utils/expect_deep_equal.js
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { isEqual } from 'lodash';
-import expect from '@kbn/expect';
-
-// expect.js's `eql` method provides nice error messages but sometimes misses things
-// since it only tests loose (==) equality. This function uses lodash's `isEqual` as a
-// second sanity check since it checks for strict equality.
-export function expectDeepEqual(actual, expected) {
-  expect(actual).to.eql(expected);
-  expect(isEqual(actual, expected)).to.be(true);
-}
diff --git a/src/test_utils/public/image_comparator.js b/src/test_utils/public/image_comparator.js
deleted file mode 100644
index f31a3e9cd646db..00000000000000
--- a/src/test_utils/public/image_comparator.js
+++ /dev/null
@@ -1,168 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import pixelmatch from 'pixelmatch';
-
-/**
- * Utility to compare pixels of two images
- * Adds the snapshots and comparison to the corners of the HTML-body to help with human inspection.
- */
-export class ImageComparator {
-  constructor() {
-    this._expectCanvas = document.createElement('canvas');
-    this._expectCanvas.style.position = 'fixed';
-    this._expectCanvas.style.right = 0;
-    this._expectCanvas.style.top = 0;
-    this._expectCanvas.style.border = '1px solid green';
-    document.body.appendChild(this._expectCanvas);
-
-    this._diffCanvas = document.createElement('canvas');
-    this._diffCanvas.style.position = 'fixed';
-    this._diffCanvas.style.right = 0;
-    this._diffCanvas.style.bottom = 0;
-    this._diffCanvas.style.border = '1px solid red';
-    document.body.appendChild(this._diffCanvas);
-
-    this._actualCanvas = document.createElement('canvas');
-    this._actualCanvas.style.position = 'fixed';
-    this._actualCanvas.style.left = 0;
-    this._actualCanvas.style.bottom = 0;
-    this._actualCanvas.style.border = '1px solid yellow';
-    document.body.appendChild(this._actualCanvas);
-  }
-
-  async compareDOMContents(
-    domContentsText,
-    sourceWidth,
-    sourceHeight,
-    expectedImageSourcePng,
-    threshold
-  ) {
-    const sourceCanvas = document.createElement('canvas');
-    sourceCanvas.width = sourceWidth;
-    sourceCanvas.height = sourceHeight;
-    sourceCanvas.style.position = 'fixed';
-    sourceCanvas.style.left = 0;
-    sourceCanvas.style.top = 0;
-    sourceCanvas.style.border = '1px solid blue';
-    const sourceContext2d = sourceCanvas.getContext('2d');
-    document.body.appendChild(sourceCanvas);
-
-    const sourceData = `<svg xmlns="http://www.w3.org/2000/svg" width="${sourceWidth}" height="${sourceHeight}">
-        <foreignObject width="100%" height="100%">
-        ${domContentsText}
-        </foreignObject>
-      </svg>`;
-
-    const sourceImage = new Image();
-    return new Promise((resolve, reject) => {
-      sourceImage.onload = async () => {
-        sourceContext2d.drawImage(sourceImage, 0, 0);
-        const mismatch = await this.compareImage(sourceCanvas, expectedImageSourcePng, threshold);
-        document.body.removeChild(sourceCanvas);
-        resolve(mismatch);
-      };
-      sourceImage.onerror = (e) => {
-        reject(e.message);
-      };
-      sourceImage.src = 'data:image/svg+xml;base64,' + btoa(sourceData);
-    });
-  }
-
-  /**
-   * Do pixel-comparison of two images
-   * @param actualCanvasFromUser HTMl5 canvas
-   * @param expectedImageSourcePng Img to compare to
-   * @param threshold number between 0-1. A lower number indicates a lower tolerance for pixel-differences.
-   * @return number
-   */
-  async compareImage(actualCanvasFromUser, expectedImageSourcePng, threshold) {
-    return new Promise((resolve, reject) => {
-      window.setTimeout(() => {
-        const actualContextFromUser = actualCanvasFromUser.getContext('2d');
-        const actualImageDataFromUser = actualContextFromUser.getImageData(
-          0,
-          0,
-          actualCanvasFromUser.width,
-          actualCanvasFromUser.height
-        );
-        const actualContext = this._actualCanvas.getContext('2d');
-        this._actualCanvas.width = actualCanvasFromUser.width;
-        this._actualCanvas.height = actualCanvasFromUser.height;
-        actualContext.putImageData(actualImageDataFromUser, 0, 0);
-
-        // convert expect PNG into pixel data by drawing in new canvas element
-        this._expectCanvas.width = this._actualCanvas.width;
-        this._expectCanvas.height = this._actualCanvas.height;
-
-        const expectedImage = new Image();
-        expectedImage.onload = () => {
-          const expectCtx = this._expectCanvas.getContext('2d');
-          expectCtx.drawImage(
-            expectedImage,
-            0,
-            0,
-            this._actualCanvas.width,
-            this._actualCanvas.height
-          ); // draw reference image to size of generated image
-
-          const expectImageData = expectCtx.getImageData(
-            0,
-            0,
-            this._actualCanvas.width,
-            this._actualCanvas.height
-          );
-
-          // compare live map vs expected pixel data
-          const diffImage = expectCtx.createImageData(
-            this._actualCanvas.width,
-            this._actualCanvas.height
-          );
-          const mismatchedPixels = pixelmatch(
-            actualImageDataFromUser.data,
-            expectImageData.data,
-            diffImage.data,
-            this._actualCanvas.width,
-            this._actualCanvas.height,
-            { threshold: threshold }
-          );
-
-          const diffContext = this._diffCanvas.getContext('2d');
-          this._diffCanvas.width = this._actualCanvas.width;
-          this._diffCanvas.height = this._actualCanvas.height;
-          diffContext.putImageData(diffImage, 0, 0);
-
-          resolve(mismatchedPixels);
-        };
-
-        expectedImage.onerror = (e) => {
-          reject(e.message);
-        };
-
-        expectedImage.src = expectedImageSourcePng;
-      });
-    });
-  }
-
-  destroy() {
-    document.body.removeChild(this._expectCanvas);
-    document.body.removeChild(this._diffCanvas);
-    document.body.removeChild(this._actualCanvas);
-  }
-}
diff --git a/src/test_utils/public/mocks/intl.js b/src/test_utils/public/mocks/intl.js
deleted file mode 100644
index e75b7d71f5fa63..00000000000000
--- a/src/test_utils/public/mocks/intl.js
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-/* global jest */
-
-export const intl = {
-  formatMessage: jest.fn().mockImplementation(({ defaultMessage }) => defaultMessage),
-  formatDate: jest.fn().mockImplementation((value) => value),
-  formatTime: jest.fn().mockImplementation((value) => value),
-  formatRelative: jest.fn().mockImplementation((value) => value),
-  formatNumber: jest.fn().mockImplementation((value) => value),
-  formatPlural: jest.fn().mockImplementation((value) => value),
-  formatHTMLMessage: jest.fn().mockImplementation(({ defaultMessage }) => defaultMessage),
-  now: jest.fn().mockImplementation(() => new Date(1531834573179)),
-  textComponent: 'span',
-};
diff --git a/src/test_utils/public/ng_mock.js b/src/test_utils/public/ng_mock.js
deleted file mode 100644
index 01bab4ce0a872b..00000000000000
--- a/src/test_utils/public/ng_mock.js
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import angular from 'angular';
-import 'angular-mocks';
-import 'mocha';
-
-if (angular.mocks) {
-  throw new Error(
-    "Don't require angular-mocks directly or the tests " +
-      "can't setup correctly, use the ngMock module instead."
-  );
-}
-
-export default angular.mock;
diff --git a/src/test_utils/public/no_digest_promises.js b/src/test_utils/public/no_digest_promises.js
deleted file mode 100644
index 396d6fb4892f31..00000000000000
--- a/src/test_utils/public/no_digest_promises.js
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import Bluebird from 'bluebird';
-import 'ui/promises';
-import { uiModules } from 'ui/modules';
-
-Bluebird.longStackTraces();
-
-/**
- * replace the Promise service with Bluebird so that tests
- * can use promises without having to call $rootScope.apply()
- *
- * import noDigestPromises from 'test_utils/no_digest_promises';
- *
- * describe('some module that does complex shit with promises', function () {
- *   beforeEach(noDigestPromises.activate);
- *
- * });
- */
-
-let active = false;
-
-uiModules.get('kibana').config(function ($provide) {
-  $provide.decorator('Promise', function ($delegate) {
-    return active ? Bluebird : $delegate;
-  });
-});
-
-function activate() {
-  active = true;
-}
-function deactivate() {
-  active = false;
-}
-
-export default {
-  activate: activate,
-  deactivate: deactivate,
-  activateForSuite: function () {
-    before(activate);
-    after(deactivate);
-  },
-};
diff --git a/src/test_utils/public/simulate_keys.js b/src/test_utils/public/simulate_keys.js
deleted file mode 100644
index 460a75486169a1..00000000000000
--- a/src/test_utils/public/simulate_keys.js
+++ /dev/null
@@ -1,121 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import $ from 'jquery';
-import _ from 'lodash';
-import Bluebird from 'bluebird';
-import { keyMap } from './key_map';
-const reverseKeyMap = _.mapValues(_.invert(keyMap), _.ary(_.parseInt, 1));
-
-/**
- * Simulate keyboard events in an element. This allows testing the way that
- * elements respond to keyboard input.
- *
- * # sequence style
- * keyboard events occur in a sequence, this array of events describe that sequence.
- *
- * ## event
- * an object with a type property, or a string which will be turned into a single press
- *
- * ## event types
- * ### press
- * represents a key press
- *   - `key`: the key for the button pressed
- *   - `events`: optional list of events that occur before this press completes
- *
- * ### wait
- * represents a pause in a sequence
- *   - `ms`: the number of milliseconds that the pause takes
- *
- * ### repeat
- * represents a key being repeated because it is held down. Should only exist as a
- * sub event of `press` events.
- *   - `count`: the number of times the repeat occurs
- *
- * @param  {element} $el - jQuery element where events should occur
- * @param  {[type]} sequence - an array of events
- * @async
- */
-export default function ($el, sequence) {
-  const modifierState = {
-    ctrlKey: false,
-    shiftKey: false,
-    altKey: false,
-    metaKey: false,
-  };
-
-  return doList(_.clone(sequence));
-
-  function setModifier(key, state) {
-    const name = key + 'Key';
-    if (modifierState.hasOwnProperty(name)) {
-      modifierState[name] = !!state;
-    }
-  }
-
-  function doList(list) {
-    return Bluebird.try(function () {
-      if (!list || !list.length) return;
-
-      let event = list[0];
-      if (_.isString(event)) {
-        event = { type: 'press', key: event };
-      }
-
-      switch (event.type) {
-        case 'press':
-          return Bluebird.resolve()
-            .then(_.partial(fire, 'keydown', event.key))
-            .then(_.partial(fire, 'keypress', event.key))
-            .then(_.partial(doList, event.events))
-            .then(_.partial(fire, 'keyup', event.key));
-
-        case 'wait':
-          return Bluebird.delay(event.ms);
-
-        case 'repeat':
-          return (function again(remaining) {
-            if (!remaining) return Bluebird.resolve();
-            remaining = remaining - 1;
-            return Bluebird.resolve()
-              .then(_.partial(fire, 'keydown', event.key, true))
-              .then(_.partial(fire, 'keypress', event.key, true))
-              .then(_.partial(again, remaining));
-          })(event.count);
-
-        default:
-          throw new TypeError('invalid event type "' + event.type + '"');
-      }
-    }).then(function () {
-      if (_.size(list) > 1) return doList(list.slice(1));
-    });
-  }
-
-  function fire(type, key) {
-    const keyCode = reverseKeyMap[key];
-    if (!keyCode) throw new TypeError('invalid key "' + key + '"');
-
-    if (type === 'keydown') setModifier(key, true);
-    if (type === 'keyup') setModifier(key, false);
-
-    const $target = _.isFunction($el) ? $el() : $el;
-    const $event = new $.Event(type, _.defaults({ keyCode: keyCode }, modifierState));
-    $target.trigger($event);
-  }
-}
diff --git a/src/test_utils/public/static_html_id_generator.js b/src/test_utils/public/static_html_id_generator.js
deleted file mode 100644
index 07626f6a496884..00000000000000
--- a/src/test_utils/public/static_html_id_generator.js
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * Import this test utility in your jest test (and only there!) if you want the
- * htmlIdGenerator from EUI to generate static ids. That will be needed if you
- * want to use snapshot tests for a component, that uses the htmlIdGenerator.
- * By default every test run would result in different ids and thus not be comparable.
- * You can solve this by just importing this file. It will mock the htmlIdGenerator
- * for the test file that imported it to produce static, but therefore potentially
- * duplicate ids.
- *
- * import 'test_utils/html_id_generator';
- */
-
-/* global jest */
-jest.mock('@elastic/eui/lib/services/accessibility/html_id_generator', () => ({
-  htmlIdGenerator: (prefix = 'staticGenerator') => {
-    return (suffix = 'staticId') => `${prefix}_${suffix}`;
-  },
-}));
diff --git a/src/test_utils/public/stub_field_formats.ts b/src/test_utils/public/stub_field_formats.ts
deleted file mode 100644
index 589e93fd600c2c..00000000000000
--- a/src/test_utils/public/stub_field_formats.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { CoreSetup } from 'kibana/public';
-import { DataPublicPluginStart, fieldFormats } from '../../plugins/data/public';
-import { deserializeFieldFormat } from '../../plugins/data/public/field_formats/utils/deserialize';
-import { baseFormattersPublic } from '../../plugins/data/public';
-
-export const getFieldFormatsRegistry = (core: CoreSetup) => {
-  const fieldFormatsRegistry = new fieldFormats.FieldFormatsRegistry();
-  const getConfig = core.uiSettings.get.bind(core.uiSettings);
-
-  fieldFormatsRegistry.init(getConfig, {}, baseFormattersPublic);
-
-  fieldFormatsRegistry.deserialize = deserializeFieldFormat.bind(
-    fieldFormatsRegistry as DataPublicPluginStart['fieldFormats']
-  );
-
-  return fieldFormatsRegistry;
-};
diff --git a/src/test_utils/public/stub_get_active_injector.js b/src/test_utils/public/stub_get_active_injector.js
deleted file mode 100644
index fb72cc5dabb7ee..00000000000000
--- a/src/test_utils/public/stub_get_active_injector.js
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * This test file contains stubs for chrome.dangerouslyGetActiveInjector, that you will
- * need to load if any part of the code you are testing relies on that method.
- * You will need to call setupInjectorStub and teardownInjectorStub in specific
- * places inside your test file to setup and teardown the stub.
- * If you can call both of them at the same place you can also use the shortcut
- * setupAndTeardownInjectorStub instead.
- */
-
-import ngMock from 'ng_mock';
-
-import chrome from 'ui/chrome';
-import sinon from 'sinon';
-
-/**
- * This method setups the stub for chrome.dangerouslyGetActiveInjector. You must call it in
- * a place where beforeEach is allowed to be called (read: inside your describe)
- * method. You must call this AFTER you've called `ngMock.module` to setup the modules,
- * but BEFORE you first execute code, that uses chrome.dangerouslyGetActiveInjector.
- */
-export function setupInjectorStub() {
-  beforeEach(
-    ngMock.inject(($injector) => {
-      sinon.stub(chrome, 'dangerouslyGetActiveInjector').returns(Promise.resolve($injector));
-    })
-  );
-}
-
-/**
- * This methods tears down the stub for chrome.dangerouslyGetActiveInjector. You must call it
- * in a place where afterEach is allowed to be called.
- */
-export function teardownInjectorStub() {
-  afterEach(() => {
-    chrome.dangerouslyGetActiveInjector.restore();
-  });
-}
-
-/**
- * This method combines setupInjectorStub and teardownInjectorStub in one method.
- * It can be used if you can call the other two methods directly behind each other.
- */
-export function setupAndTeardownInjectorStub() {
-  setupInjectorStub();
-  teardownInjectorStub();
-}
diff --git a/src/test_utils/public/stub_index_pattern.js b/src/test_utils/public/stub_index_pattern.js
index f7b65930b683d4..6130a7f9f9e877 100644
--- a/src/test_utils/public/stub_index_pattern.js
+++ b/src/test_utils/public/stub_index_pattern.js
@@ -22,7 +22,8 @@ import sinon from 'sinon';
 // because it is one of the few places that we need to access the IndexPattern class itself, rather
 // than just the type. Doing this as a temporary measure; it will be left behind when migrating to NP.
 
-import { IndexPattern, indexPatterns, KBN_FIELD_TYPES, FieldList } from '../../plugins/data/public';
+import { getFieldFormatsRegistry } from '../../plugins/data/public/test_utils';
+import { IndexPattern, indexPatterns, KBN_FIELD_TYPES, fieldList } from '../../plugins/data/public';
 
 import { setFieldFormats } from '../../plugins/data/public/services';
 
@@ -33,8 +34,6 @@ setFieldFormats({
   }),
 });
 
-import { getFieldFormatsRegistry } from './stub_field_formats';
-
 export default function StubIndexPattern(pattern, getConfig, timeField, fields, core) {
   const registeredFieldFormats = getFieldFormatsRegistry(core);
 
@@ -64,7 +63,7 @@ export default function StubIndexPattern(pattern, getConfig, timeField, fields,
   });
 
   this._reindexFields = function () {
-    this.fields = new FieldList(this, this.fields || fields, false);
+    this.fields = fieldList(this.fields || fields, false);
   };
 
   this.stubSetFieldFormat = function (fieldName, id, params) {
diff --git a/src/test_utils/tsconfig.json b/src/test_utils/tsconfig.json
new file mode 100644
index 00000000000000..2fa89e29898914
--- /dev/null
+++ b/src/test_utils/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "./target",
+    "composite": true,
+    "emitDeclarationOnly": true,
+    "declaration": true,
+    "declarationMap": true
+  },
+  "include": [
+    "public/**/*"
+  ],
+  "exclude": [
+    "target"
+  ]
+}
diff --git a/test/api_integration/apis/index.js b/test/api_integration/apis/index.js
index 79815199aa20ce..bfbf873cf06164 100644
--- a/test/api_integration/apis/index.js
+++ b/test/api_integration/apis/index.js
@@ -28,6 +28,7 @@ export default function ({ loadTestFile }) {
     loadTestFile(require.resolve('./saved_objects_management'));
     loadTestFile(require.resolve('./saved_objects'));
     loadTestFile(require.resolve('./scripts'));
+    loadTestFile(require.resolve('./search'));
     loadTestFile(require.resolve('./shorten'));
     loadTestFile(require.resolve('./suggestions'));
     loadTestFile(require.resolve('./status'));
diff --git a/test/api_integration/apis/search/index.ts b/test/api_integration/apis/search/index.ts
new file mode 100644
index 00000000000000..ee3baf23f0f6f7
--- /dev/null
+++ b/test/api_integration/apis/search/index.ts
@@ -0,0 +1,26 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('search', () => {
+    loadTestFile(require.resolve('./search'));
+  });
+}
diff --git a/test/api_integration/apis/search/search.ts b/test/api_integration/apis/search/search.ts
new file mode 100644
index 00000000000000..bcf76bfb4eaa0a
--- /dev/null
+++ b/test/api_integration/apis/search/search.ts
@@ -0,0 +1,88 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+
+  describe('msearch', () => {
+    describe('post', () => {
+      it('should return 200 when correctly formatted searches are provided', async () =>
+        await supertest
+          .post(`/internal/_msearch`)
+          .send({
+            searches: [
+              {
+                header: { index: 'foo' },
+                body: {
+                  query: {
+                    match_all: {},
+                  },
+                },
+              },
+            ],
+          })
+          .expect(200));
+
+      it('should return 400 if you provide malformed content', async () =>
+        await supertest
+          .post(`/internal/_msearch`)
+          .send({
+            foo: false,
+          })
+          .expect(400));
+
+      it('should require you to provide an index for each request', async () =>
+        await supertest
+          .post(`/internal/_msearch`)
+          .send({
+            searches: [
+              { header: { index: 'foo' }, body: {} },
+              { header: {}, body: {} },
+            ],
+          })
+          .expect(400));
+
+      it('should not require optional params', async () =>
+        await supertest
+          .post(`/internal/_msearch`)
+          .send({
+            searches: [{ header: { index: 'foo' }, body: {} }],
+          })
+          .expect(200));
+
+      it('should allow passing preference as a string', async () =>
+        await supertest
+          .post(`/internal/_msearch`)
+          .send({
+            searches: [{ header: { index: 'foo', preference: '_custom' }, body: {} }],
+          })
+          .expect(200));
+
+      it('should allow passing preference as a number', async () =>
+        await supertest
+          .post(`/internal/_msearch`)
+          .send({
+            searches: [{ header: { index: 'foo', preference: 123 }, body: {} }],
+          })
+          .expect(200));
+    });
+  });
+}
diff --git a/test/common/fixtures/plugins/newsfeed/server/plugin.ts b/test/common/fixtures/plugins/newsfeed/server/plugin.ts
index 60044d4e0b2dfd..3d64c7ff58e5d0 100644
--- a/test/common/fixtures/plugins/newsfeed/server/plugin.ts
+++ b/test/common/fixtures/plugins/newsfeed/server/plugin.ts
@@ -25,7 +25,7 @@ export class NewsFeedSimulatorPlugin implements Plugin {
 
   public setup({ http }: CoreSetup) {
     const router = http.createRouter();
-    const version = this.initializerContext.env.packageInfo.version;
+    const version = this.initializerContext.env.packageInfo.version.replace('-SNAPSHOT', '');
 
     router.get(
       {
diff --git a/test/functional/apps/dashboard/embeddable_rendering.js b/test/functional/apps/dashboard/embeddable_rendering.js
index 73c36c7562e8be..b7b795ae11c967 100644
--- a/test/functional/apps/dashboard/embeddable_rendering.js
+++ b/test/functional/apps/dashboard/embeddable_rendering.js
@@ -99,7 +99,8 @@ export default function ({ getService, getPageObjects }) {
     await dashboardExpect.vegaTextsDoNotExist(['5,000']);
   };
 
-  describe('dashboard embeddable rendering', function describeIndexTests() {
+  // Failing: See https://github.com/elastic/kibana/issues/76245
+  describe.skip('dashboard embeddable rendering', function describeIndexTests() {
     before(async () => {
       await security.testUser.setRoles(['kibana_admin', 'animals', 'test_logstash_reader']);
       await esArchiver.load('dashboard/current/kibana');
diff --git a/test/functional/apps/discover/_discover.js b/test/functional/apps/discover/_discover.js
index 94a271987ecdf7..faf272daba097e 100644
--- a/test/functional/apps/discover/_discover.js
+++ b/test/functional/apps/discover/_discover.js
@@ -224,9 +224,7 @@ export default function ({ getService, getPageObjects }) {
         await kibanaServer.uiSettings.replace({ 'dateFormat:tz': 'America/Phoenix' });
         await PageObjects.common.navigateToApp('discover');
         await PageObjects.header.awaitKibanaChrome();
-        await queryBar.setQuery('');
-        // To remove focus of the of the search bar so date/time picker can show
-        await PageObjects.discover.selectIndexPattern(defaultSettings.defaultIndex);
+        await queryBar.clearQuery();
         await PageObjects.timePicker.setDefaultAbsoluteRange();
 
         log.debug(
diff --git a/test/functional/apps/management/_import_objects.js b/test/functional/apps/management/_import_objects.js
index 5fbeb978f9a1c2..3941b117e6efe8 100644
--- a/test/functional/apps/management/_import_objects.js
+++ b/test/functional/apps/management/_import_objects.js
@@ -21,6 +21,8 @@ import expect from '@kbn/expect';
 import path from 'path';
 import { keyBy } from 'lodash';
 
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
 export default function ({ getService, getPageObjects }) {
   const kibanaServer = getService('kibanaServer');
   const esArchiver = getService('esArchiver');
@@ -203,12 +205,12 @@ export default function ({ getService, getPageObjects }) {
         // delete .kibana index and then wait for Kibana to re-create it
         await kibanaServer.uiSettings.replace({});
         await PageObjects.settings.navigateTo();
-        await esArchiver.load('management');
+        await esArchiver.load('saved_objects_imports');
         await PageObjects.settings.clickKibanaSavedObjects();
       });
 
       afterEach(async function () {
-        await esArchiver.unload('management');
+        await esArchiver.unload('saved_objects_imports');
       });
 
       it('should import saved objects', async function () {
@@ -280,6 +282,54 @@ export default function ({ getService, getPageObjects }) {
         expect(isSuccessful).to.be(true);
       });
 
+      it('should allow the user to confirm overriding multiple duplicate saved objects', async function () {
+        // This data has already been loaded by the "visualize" esArchive. We'll load it again
+        // so that we can override the existing visualization.
+        await PageObjects.savedObjects.importFile(
+          path.join(__dirname, 'exports', '_import_objects_multiple_exists.json'),
+          false
+        );
+
+        await PageObjects.savedObjects.checkImportLegacyWarning();
+        await PageObjects.savedObjects.checkImportConflictsWarning();
+
+        await PageObjects.settings.associateIndexPattern('logstash-*', 'logstash-*');
+        await PageObjects.savedObjects.clickConfirmChanges();
+
+        // Override the visualizations.
+        await PageObjects.common.clickConfirmOnModal(false);
+        // as the second confirm can pop instantly, we can't wait for it to be hidden
+        // with is why we call clickConfirmOnModal with ensureHidden: false in previous statement
+        // but as the initial popin can take a few ms before fading, we need to wait a little
+        // to avoid clicking twice on the same modal.
+        await delay(1000);
+        await PageObjects.common.clickConfirmOnModal(false);
+
+        const isSuccessful = await testSubjects.exists('importSavedObjectsSuccess');
+        expect(isSuccessful).to.be(true);
+      });
+
+      it('should allow the user to confirm overriding multiple duplicate index patterns', async function () {
+        // This data has already been loaded by the "visualize" esArchive. We'll load it again
+        // so that we can override the existing visualization.
+        await PageObjects.savedObjects.importFile(
+          path.join(__dirname, 'exports', '_import_index_patterns_multiple_exists.json'),
+          false
+        );
+
+        // Override the index patterns.
+        await PageObjects.common.clickConfirmOnModal(false);
+        // as the second confirm can pop instantly, we can't wait for it to be hidden
+        // with is why we call clickConfirmOnModal with ensureHidden: false in previous statement
+        // but as the initial popin can take a few ms before fading, we need to wait a little
+        // to avoid clicking twice on the same modal.
+        await delay(1000);
+        await PageObjects.common.clickConfirmOnModal(false);
+
+        const isSuccessful = await testSubjects.exists('importSavedObjectsSuccess');
+        expect(isSuccessful).to.be(true);
+      });
+
       it('should import saved objects linked to saved searches', async function () {
         await PageObjects.savedObjects.importFile(
           path.join(__dirname, 'exports', '_import_objects_saved_search.json')
diff --git a/test/functional/apps/management/exports/_import_index_patterns_multiple_exists.json b/test/functional/apps/management/exports/_import_index_patterns_multiple_exists.json
new file mode 100644
index 00000000000000..2eb64b1c7ca9f5
--- /dev/null
+++ b/test/functional/apps/management/exports/_import_index_patterns_multiple_exists.json
@@ -0,0 +1,26 @@
+[
+  {
+    "_id": "f1e4c910-a2e6-11e7-bb30-233be9be6a20",
+    "_type": "index-pattern",
+    "_source": {
+      "title": "index-pattern-test-1",
+      "timeFieldName": "@timestamp",
+      "fields": "[{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"expression script\",\"type\":\"number\",\"count\":0,\"scripted\":true,\"script\":\"doc['bytes'].value\",\"lang\":\"expression\",\"indexed\":true,\"analyzed\":false,\"doc_values\":false}]"
+    },
+    "_meta": {
+      "savedObjectVersion": 1
+    }
+  },
+  {
+    "_id": "f1e4c910-a2e6-11e7-bb30-233be9be6a87",
+    "_type": "index-pattern",
+    "_source": {
+      "title": "index-pattern-test-2",
+      "timeFieldName": "@timestamp",
+      "fields": "[{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"expression script\",\"type\":\"number\",\"count\":0,\"scripted\":true,\"script\":\"doc['bytes'].value\",\"lang\":\"expression\",\"indexed\":true,\"analyzed\":false,\"doc_values\":false}]"
+    },
+    "_meta": {
+      "savedObjectVersion": 1
+    }
+  }
+]
diff --git a/test/functional/apps/management/exports/_import_objects_multiple_exists.json b/test/functional/apps/management/exports/_import_objects_multiple_exists.json
new file mode 100644
index 00000000000000..9e554aecd9f7a3
--- /dev/null
+++ b/test/functional/apps/management/exports/_import_objects_multiple_exists.json
@@ -0,0 +1,36 @@
+[
+  {
+    "_id": "test-1",
+    "_type": "visualization",
+    "_source": {
+      "title": "Visualization test 1",
+      "visState": "{\"title\":\"New Visualization\",\"type\":\"area\",\"params\":{\"shareYAxis\":true,\"addTooltip\":true,\"addLegend\":true,\"smoothLines\":false,\"scale\":\"linear\",\"interpolate\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"yAxis\":{}},\"aggs\":[{\"id\":\"1\",\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}}],\"listeners\":{}}",
+      "uiStateJSON": "{}",
+      "description": "AreaChart",
+      "version": 1,
+      "kibanaSavedObjectMeta": {
+        "searchSourceJSON": "{\"index\":\"logstash-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+      }
+    },
+    "_meta": {
+      "savedObjectVersion": 2
+    }
+  },
+  {
+    "_id": "test-2",
+    "_type": "visualization",
+    "_source": {
+      "title": "Visualization test 2",
+      "visState": "{\"title\":\"New Visualization\",\"type\":\"area\",\"params\":{\"shareYAxis\":true,\"addTooltip\":true,\"addLegend\":true,\"smoothLines\":false,\"scale\":\"linear\",\"interpolate\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"yAxis\":{}},\"aggs\":[{\"id\":\"1\",\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}}],\"listeners\":{}}",
+      "uiStateJSON": "{}",
+      "description": "AreaChart",
+      "version": 1,
+      "kibanaSavedObjectMeta": {
+        "searchSourceJSON": "{\"index\":\"logstash-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+      }
+    },
+    "_meta": {
+      "savedObjectVersion": 2
+    }
+  }
+]
diff --git a/test/functional/apps/visualize/_tsvb_chart.ts b/test/functional/apps/visualize/_tsvb_chart.ts
index 74d5798d127c3e..bfe0da7a5b24f8 100644
--- a/test/functional/apps/visualize/_tsvb_chart.ts
+++ b/test/functional/apps/visualize/_tsvb_chart.ts
@@ -21,6 +21,7 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const browser = getService('browser');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const inspector = getService('inspector');
@@ -47,8 +48,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.visualBuilder.checkVisualBuilderIsPresent();
     });
 
-    // FLAKY: https://github.com/elastic/kibana/issues/75127
-    describe.skip('metric', () => {
+    describe('metric', () => {
       beforeEach(async () => {
         await PageObjects.visualBuilder.resetPage();
         await PageObjects.visualBuilder.clickMetric();
@@ -146,5 +146,79 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         expect(newValue).to.eql('10');
       });
     });
+
+    describe('browser history changes', () => {
+      it('should activate previous/next chart tab and panel config', async () => {
+        await PageObjects.visualBuilder.resetPage();
+
+        log.debug('Click metric chart');
+        await PageObjects.visualBuilder.clickMetric();
+        await PageObjects.visualBuilder.checkMetricTabIsPresent();
+        await PageObjects.visualBuilder.checkTabIsSelected('metric');
+
+        log.debug('Click Top N chart');
+        await PageObjects.visualBuilder.clickTopN();
+        await PageObjects.visualBuilder.checkTopNTabIsPresent();
+        await PageObjects.visualBuilder.checkTabIsSelected('top_n');
+
+        log.debug('Go back in browser history');
+        await browser.goBack();
+
+        log.debug('Check metric chart and panel config is rendered');
+        await PageObjects.visualBuilder.checkMetricTabIsPresent();
+        await PageObjects.visualBuilder.checkTabIsSelected('metric');
+        await PageObjects.visualBuilder.checkPanelConfigIsPresent('metric');
+
+        log.debug('Go back in browser history');
+        await browser.goBack();
+
+        log.debug('Check timeseries chart and panel config is rendered');
+        await PageObjects.visualBuilder.checkTimeSeriesChartIsPresent();
+        await PageObjects.visualBuilder.checkTabIsSelected('timeseries');
+        await PageObjects.visualBuilder.checkPanelConfigIsPresent('timeseries');
+
+        log.debug('Go forward in browser history');
+        await browser.goForward();
+
+        log.debug('Check metric chart and panel config is rendered');
+        await PageObjects.visualBuilder.checkMetricTabIsPresent();
+        await PageObjects.visualBuilder.checkTabIsSelected('metric');
+        await PageObjects.visualBuilder.checkPanelConfigIsPresent('metric');
+      });
+
+      it('should update panel config', async () => {
+        await PageObjects.visualBuilder.resetPage();
+
+        const initialLegendItems = ['Count: 156'];
+        const finalLegendItems = ['jpg: 106', 'css: 22', 'png: 14', 'gif: 8', 'php: 6'];
+
+        log.debug('Group metrics by terms: extension.raw');
+        await PageObjects.visualBuilder.setMetricsGroupByTerms('extension.raw');
+        await PageObjects.visChart.waitForVisualizationRenderingStabilized();
+        const legendItems1 = await PageObjects.visualBuilder.getLegendItemsContent();
+        expect(legendItems1).to.eql(finalLegendItems);
+
+        log.debug('Go back in browser history');
+        await browser.goBack();
+        const isTermsSelected = await PageObjects.visualBuilder.checkSelectedMetricsGroupByValue(
+          'Terms'
+        );
+        expect(isTermsSelected).to.be(true);
+
+        log.debug('Go back in browser history');
+        await browser.goBack();
+        await PageObjects.visualBuilder.checkSelectedMetricsGroupByValue('Everything');
+        await PageObjects.visChart.waitForVisualizationRenderingStabilized();
+        const legendItems2 = await PageObjects.visualBuilder.getLegendItemsContent();
+        expect(legendItems2).to.eql(initialLegendItems);
+
+        log.debug('Go forward twice in browser history');
+        await browser.goForward();
+        await browser.goForward();
+        await PageObjects.visChart.waitForVisualizationRenderingStabilized();
+        const legendItems3 = await PageObjects.visualBuilder.getLegendItemsContent();
+        expect(legendItems3).to.eql(finalLegendItems);
+      });
+    });
   });
 }
diff --git a/test/functional/apps/visualize/_tsvb_markdown.ts b/test/functional/apps/visualize/_tsvb_markdown.ts
index ba60aa83d92daf..4f12a45cf5f6b3 100644
--- a/test/functional/apps/visualize/_tsvb_markdown.ts
+++ b/test/functional/apps/visualize/_tsvb_markdown.ts
@@ -30,10 +30,11 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
     await visualBuilder.markdownSwitchSubTab('markdown');
     const rerenderedTable = await visualBuilder.getMarkdownTableVariables();
     rerenderedTable.forEach((row) => {
-      // eslint-disable-next-line no-unused-expressions
-      variableName === 'label'
-        ? expect(row.key).to.include.string(checkedValue)
-        : expect(row.key).to.not.include.string(checkedValue);
+      if (variableName === 'label') {
+        expect(row.key).to.include.string(checkedValue);
+      } else {
+        expect(row.key).to.not.include.string(checkedValue);
+      }
     });
   }
 
@@ -107,10 +108,11 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
         table.forEach((row, index) => {
           // exception: last index for variable is always: {{count.label}}
-          // eslint-disable-next-line no-unused-expressions
-          index === table.length - 1
-            ? expect(row.key).to.not.include.string(VARIABLE)
-            : expect(row.key).to.include.string(VARIABLE);
+          if (index === table.length - 1) {
+            expect(row.key).to.not.include.string(VARIABLE);
+          } else {
+            expect(row.key).to.include.string(VARIABLE);
+          }
         });
 
         await cleanupMarkdownData(VARIABLE, VARIABLE);
diff --git a/test/functional/apps/visualize/_vega_chart.ts b/test/functional/apps/visualize/_vega_chart.ts
index f599afa3afc32e..b59d9590bb62af 100644
--- a/test/functional/apps/visualize/_vega_chart.ts
+++ b/test/functional/apps/visualize/_vega_chart.ts
@@ -50,8 +50,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const retry = getService('retry');
   const browser = getService('browser');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/75699
-  describe.skip('vega chart in visualize app', () => {
+  describe('vega chart in visualize app', () => {
     before(async () => {
       log.debug('navigateToApp visualize');
       await PageObjects.visualize.navigateToNewVisualization();
diff --git a/test/functional/apps/visualize/input_control_vis/chained_controls.js b/test/functional/apps/visualize/input_control_vis/chained_controls.js
index 035245b50d436a..e1a58e1da34f36 100644
--- a/test/functional/apps/visualize/input_control_vis/chained_controls.js
+++ b/test/functional/apps/visualize/input_control_vis/chained_controls.js
@@ -26,8 +26,7 @@ export default function ({ getService, getPageObjects }) {
   const find = getService('find');
   const comboBox = getService('comboBox');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/68472
-  describe.skip('chained controls', function () {
+  describe('chained controls', function () {
     this.tags('includeFirefox');
 
     before(async () => {
diff --git a/test/functional/fixtures/es_archiver/saved_objects_imports/data.json.gz b/test/functional/fixtures/es_archiver/saved_objects_imports/data.json.gz
new file mode 100644
index 00000000000000..006476f867ae7e
Binary files /dev/null and b/test/functional/fixtures/es_archiver/saved_objects_imports/data.json.gz differ
diff --git a/test/functional/fixtures/es_archiver/saved_objects_imports/mappings.json b/test/functional/fixtures/es_archiver/saved_objects_imports/mappings.json
new file mode 100644
index 00000000000000..a89fe1dfacfc83
--- /dev/null
+++ b/test/functional/fixtures/es_archiver/saved_objects_imports/mappings.json
@@ -0,0 +1,244 @@
+{
+  "type": "index",
+  "value": {
+    "index": ".kibana",
+    "mappings": {
+      "properties": {
+        "config": {
+          "dynamic": "true",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "dashboard": {
+          "dynamic": "strict",
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "optionsJSON": {
+              "type": "text"
+            },
+            "panelsJSON": {
+              "type": "text"
+            },
+            "refreshInterval": {
+              "properties": {
+                "display": {
+                  "type": "keyword"
+                },
+                "pause": {
+                  "type": "boolean"
+                },
+                "section": {
+                  "type": "integer"
+                },
+                "value": {
+                  "type": "integer"
+                }
+              }
+            },
+            "timeFrom": {
+              "type": "keyword"
+            },
+            "timeRestore": {
+              "type": "boolean"
+            },
+            "timeTo": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "index-pattern": {
+          "dynamic": "strict",
+          "properties": {
+            "fieldFormatMap": {
+              "type": "text"
+            },
+            "fields": {
+              "type": "text"
+            },
+            "intervalName": {
+              "type": "keyword"
+            },
+            "notExpandable": {
+              "type": "boolean"
+            },
+            "sourceFilters": {
+              "type": "text"
+            },
+            "timeFieldName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "search": {
+          "dynamic": "strict",
+          "properties": {
+            "columns": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "sort": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "server": {
+          "dynamic": "strict",
+          "properties": {
+            "uuid": {
+              "type": "keyword"
+            }
+          }
+        },
+        "timelion-sheet": {
+          "dynamic": "strict",
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "timelion_chart_height": {
+              "type": "integer"
+            },
+            "timelion_columns": {
+              "type": "integer"
+            },
+            "timelion_interval": {
+              "type": "keyword"
+            },
+            "timelion_other_interval": {
+              "type": "keyword"
+            },
+            "timelion_rows": {
+              "type": "integer"
+            },
+            "timelion_sheet": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "url": {
+          "dynamic": "strict",
+          "properties": {
+            "accessCount": {
+              "type": "long"
+            },
+            "accessDate": {
+              "type": "date"
+            },
+            "createDate": {
+              "type": "date"
+            },
+            "url": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "visualization": {
+          "dynamic": "strict",
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "savedSearchId": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "visState": {
+              "type": "text"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index d6a96eb651d022..31f4e393f019e8 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -332,18 +332,24 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
       });
     }
 
-    async clickConfirmOnModal() {
+    async clickConfirmOnModal(ensureHidden = true) {
       log.debug('Clicking modal confirm');
       // make sure this data-test-subj 'confirmModalTitleText' exists because we're going to wait for it to be gone later
       await testSubjects.exists('confirmModalTitleText');
       await testSubjects.click('confirmModalConfirmButton');
-      await this.ensureModalOverlayHidden();
+      if (ensureHidden) {
+        await this.ensureModalOverlayHidden();
+      }
     }
 
     async pressEnterKey() {
       await browser.pressKeys(browser.keys.ENTER);
     }
 
+    async pressTabKey() {
+      await browser.pressKeys(browser.keys.TAB);
+    }
+
     // Pause the browser at a certain place for debugging
     // Not meant for usage in CI, only for dev-usage
     async pause() {
diff --git a/test/functional/page_objects/settings_page.ts b/test/functional/page_objects/settings_page.ts
index a4285a5f94d51e..43e58a0a2e58dd 100644
--- a/test/functional/page_objects/settings_page.ts
+++ b/test/functional/page_objects/settings_page.ts
@@ -282,11 +282,15 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
       await PageObjects.header.waitUntilLoadingHasFinished();
     }
 
-    async clickIndexPatternLogstash() {
-      const indexLink = await find.byXPath(`//a[descendant::*[text()='logstash-*']]`);
+    async clickIndexPatternByName(name: string) {
+      const indexLink = await find.byXPath(`//a[descendant::*[text()='${name}']]`);
       await indexLink.click();
     }
 
+    async clickIndexPatternLogstash() {
+      await this.clickIndexPatternByName('logstash-*');
+    }
+
     async getIndexPatternList() {
       await testSubjects.existOrFail('indexPatternTable', { timeout: 5000 });
       return await find.allByCssSelector(
diff --git a/test/functional/page_objects/vega_chart_page.ts b/test/functional/page_objects/vega_chart_page.ts
index 6c64f9dda2efdd..557c6bfada01e9 100644
--- a/test/functional/page_objects/vega_chart_page.ts
+++ b/test/functional/page_objects/vega_chart_page.ts
@@ -94,8 +94,9 @@ export function VegaChartPageProvider({
       const aceGutter = await this.getAceGutterContainer();
 
       await aceGutter.doubleClick();
-      await browser.pressKeys(Key.LEFT);
       await browser.pressKeys(Key.RIGHT);
+      await browser.pressKeys(Key.LEFT);
+      await browser.pressKeys(Key.LEFT);
       await browser.pressKeys(text);
     }
 
diff --git a/test/functional/page_objects/visual_builder_page.ts b/test/functional/page_objects/visual_builder_page.ts
index f376c39ff67bbe..a95d535281fa33 100644
--- a/test/functional/page_objects/visual_builder_page.ts
+++ b/test/functional/page_objects/visual_builder_page.ts
@@ -64,6 +64,19 @@ export function VisualBuilderPageProvider({ getService, getPageObjects }: FtrPro
       }
     }
 
+    public async checkTabIsSelected(chartType: string) {
+      const chartTypeBtn = await testSubjects.find(`${chartType}TsvbTypeBtn`);
+      const isSelected = await chartTypeBtn.getAttribute('aria-selected');
+
+      if (isSelected !== 'true') {
+        throw new Error(`TSVB ${chartType} tab is not selected`);
+      }
+    }
+
+    public async checkPanelConfigIsPresent(chartType: string) {
+      await testSubjects.existOrFail(`tvbPanelConfig__${chartType}`);
+    }
+
     public async checkVisualBuilderIsPresent() {
       await this.checkTabIsLoaded('tvbVisEditor', 'Time Series');
     }
@@ -558,9 +571,40 @@ export function VisualBuilderPageProvider({ getService, getPageObjects }: FtrPro
       return await find.allByCssSelector('.echLegendItem');
     }
 
+    public async getLegendItemsContent(): Promise<string[]> {
+      const legendList = await find.byCssSelector('.echLegendList');
+      const $ = await legendList.parseDomContent();
+
+      return $('li')
+        .toArray()
+        .map((li) => {
+          const label = $(li).find('.echLegendItem__label').text();
+          const value = $(li).find('.echLegendItem__extra').text();
+
+          return `${label}: ${value}`;
+        });
+    }
+
     public async getSeries(): Promise<WebElementWrapper[]> {
       return await find.allByCssSelector('.tvbSeriesEditor');
     }
+
+    public async setMetricsGroupByTerms(field: string) {
+      const groupBy = await find.byCssSelector(
+        '.tvbAggRow--split [data-test-subj="comboBoxInput"]'
+      );
+      await comboBox.setElement(groupBy, 'Terms', { clickWithMouse: true });
+      await PageObjects.common.sleep(1000);
+      const byField = await testSubjects.find('groupByField');
+      await comboBox.setElement(byField, field, { clickWithMouse: true });
+    }
+
+    public async checkSelectedMetricsGroupByValue(value: string) {
+      const groupBy = await find.byCssSelector(
+        '.tvbAggRow--split [data-test-subj="comboBoxInput"]'
+      );
+      return await comboBox.isOptionSelected(groupBy, value);
+    }
   }
 
   return new VisualBuilderPage();
diff --git a/test/functional/page_objects/visualize_editor_page.ts b/test/functional/page_objects/visualize_editor_page.ts
index 9fcb38efce0db9..8cac43d97317b3 100644
--- a/test/functional/page_objects/visualize_editor_page.ts
+++ b/test/functional/page_objects/visualize_editor_page.ts
@@ -445,6 +445,15 @@ export function VisualizeEditorPageProvider({ getService, getPageObjects }: FtrP
       } else if (type === 'custom') {
         await comboBox.setCustom('visEditorInterval', newValue);
       } else {
+        if (type === 'numeric') {
+          const autoMode = await testSubjects.getAttribute(
+            `visEditorIntervalSwitch${aggNth}`,
+            'aria-checked'
+          );
+          if (autoMode === 'true') {
+            await testSubjects.click(`visEditorIntervalSwitch${aggNth}`);
+          }
+        }
         if (append) {
           await testSubjects.append(`visEditorInterval${aggNth}`, String(newValue));
         } else {
diff --git a/test/functional/services/query_bar.ts b/test/functional/services/query_bar.ts
index 7c7fd2d81f1703..8cd63fb2f4a510 100644
--- a/test/functional/services/query_bar.ts
+++ b/test/functional/services/query_bar.ts
@@ -54,6 +54,11 @@ export function QueryBarProvider({ getService, getPageObjects }: FtrProviderCont
       });
     }
 
+    public async clearQuery(): Promise<void> {
+      await this.setQuery('');
+      await PageObjects.common.pressTabKey();
+    }
+
     public async submitQuery(): Promise<void> {
       log.debug('QueryBar.submitQuery');
       await testSubjects.click('queryInput');
diff --git a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/package.json b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/package.json
index 37837747a69dde..7f3744c16397ad 100644
--- a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/package.json
+++ b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/package.json
@@ -12,7 +12,7 @@
     "build": "rm -rf './target' && tsc"
   },
   "devDependencies": {
-    "@elastic/eui": "27.4.1",
+    "@elastic/eui": "28.2.0",
     "@kbn/plugin-helpers": "1.0.0",
     "react": "^16.12.0",
     "react-dom": "^16.12.0",
diff --git a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/tsconfig.json b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/tsconfig.json
index 5fcaeafbb0d852..4d979fbf7f15fd 100644
--- a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/tsconfig.json
+++ b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/app_link_test/tsconfig.json b/test/plugin_functional/plugins/app_link_test/tsconfig.json
index 5fcaeafbb0d852..4d979fbf7f15fd 100644
--- a/test/plugin_functional/plugins/app_link_test/tsconfig.json
+++ b/test/plugin_functional/plugins/app_link_test/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/core_app_status/tsconfig.json b/test/plugin_functional/plugins/core_app_status/tsconfig.json
index 5fcaeafbb0d852..4d979fbf7f15fd 100644
--- a/test/plugin_functional/plugins/core_app_status/tsconfig.json
+++ b/test/plugin_functional/plugins/core_app_status/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/core_plugin_a/tsconfig.json b/test/plugin_functional/plugins/core_plugin_a/tsconfig.json
index 1ba21f11b7de2a..ccbffc34bce4a4 100644
--- a/test/plugin_functional/plugins/core_plugin_a/tsconfig.json
+++ b/test/plugin_functional/plugins/core_plugin_a/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/core_plugin_appleave/tsconfig.json b/test/plugin_functional/plugins/core_plugin_appleave/tsconfig.json
index 5fcaeafbb0d852..4d979fbf7f15fd 100644
--- a/test/plugin_functional/plugins/core_plugin_appleave/tsconfig.json
+++ b/test/plugin_functional/plugins/core_plugin_appleave/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/core_plugin_b/tsconfig.json b/test/plugin_functional/plugins/core_plugin_b/tsconfig.json
index 1ba21f11b7de2a..ccbffc34bce4a4 100644
--- a/test/plugin_functional/plugins/core_plugin_b/tsconfig.json
+++ b/test/plugin_functional/plugins/core_plugin_b/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/core_plugin_chromeless/tsconfig.json b/test/plugin_functional/plugins/core_plugin_chromeless/tsconfig.json
index 5fcaeafbb0d852..4d979fbf7f15fd 100644
--- a/test/plugin_functional/plugins/core_plugin_chromeless/tsconfig.json
+++ b/test/plugin_functional/plugins/core_plugin_chromeless/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/core_plugin_route_timeouts/tsconfig.json b/test/plugin_functional/plugins/core_plugin_route_timeouts/tsconfig.json
index d0751f31ecc5ea..0e27246a49980d 100644
--- a/test/plugin_functional/plugins/core_plugin_route_timeouts/tsconfig.json
+++ b/test/plugin_functional/plugins/core_plugin_route_timeouts/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/core_plugin_static_assets/tsconfig.json b/test/plugin_functional/plugins/core_plugin_static_assets/tsconfig.json
index 4a564ee1e5578f..433b041b9af3f6 100644
--- a/test/plugin_functional/plugins/core_plugin_static_assets/tsconfig.json
+++ b/test/plugin_functional/plugins/core_plugin_static_assets/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/core_provider_plugin/tsconfig.json b/test/plugin_functional/plugins/core_provider_plugin/tsconfig.json
index baedb5f2f621bf..0aac2eb570987c 100644
--- a/test/plugin_functional/plugins/core_provider_plugin/tsconfig.json
+++ b/test/plugin_functional/plugins/core_provider_plugin/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/doc_views_plugin/tsconfig.json b/test/plugin_functional/plugins/doc_views_plugin/tsconfig.json
index 4a564ee1e5578f..433b041b9af3f6 100644
--- a/test/plugin_functional/plugins/doc_views_plugin/tsconfig.json
+++ b/test/plugin_functional/plugins/doc_views_plugin/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/elasticsearch_client_plugin/tsconfig.json b/test/plugin_functional/plugins/elasticsearch_client_plugin/tsconfig.json
index d0751f31ecc5ea..0e27246a49980d 100644
--- a/test/plugin_functional/plugins/elasticsearch_client_plugin/tsconfig.json
+++ b/test/plugin_functional/plugins/elasticsearch_client_plugin/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/index_patterns/tsconfig.json b/test/plugin_functional/plugins/index_patterns/tsconfig.json
index 6f0c32ad30601f..d5ccf7adddb2dc 100644
--- a/test/plugin_functional/plugins/index_patterns/tsconfig.json
+++ b/test/plugin_functional/plugins/index_patterns/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/kbn_sample_panel_action/package.json b/test/plugin_functional/plugins/kbn_sample_panel_action/package.json
index 0e1a0b550ca150..acb0cf67ac5c72 100644
--- a/test/plugin_functional/plugins/kbn_sample_panel_action/package.json
+++ b/test/plugin_functional/plugins/kbn_sample_panel_action/package.json
@@ -12,7 +12,7 @@
     "build": "rm -rf './target' && tsc"
   },
   "devDependencies": {
-    "@elastic/eui": "27.4.1",
+    "@elastic/eui": "28.2.0",
     "react": "^16.12.0",
     "typescript": "4.0.2"
   }
diff --git a/test/plugin_functional/plugins/kbn_sample_panel_action/tsconfig.json b/test/plugin_functional/plugins/kbn_sample_panel_action/tsconfig.json
index 5fcaeafbb0d852..4d979fbf7f15fd 100644
--- a/test/plugin_functional/plugins/kbn_sample_panel_action/tsconfig.json
+++ b/test/plugin_functional/plugins/kbn_sample_panel_action/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/kbn_top_nav/tsconfig.json b/test/plugin_functional/plugins/kbn_top_nav/tsconfig.json
index 1ba21f11b7de2a..ccbffc34bce4a4 100644
--- a/test/plugin_functional/plugins/kbn_top_nav/tsconfig.json
+++ b/test/plugin_functional/plugins/kbn_top_nav/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/kbn_tp_custom_visualizations/package.json b/test/plugin_functional/plugins/kbn_tp_custom_visualizations/package.json
index ebf0e046eca4c7..ff84c25400af0c 100644
--- a/test/plugin_functional/plugins/kbn_tp_custom_visualizations/package.json
+++ b/test/plugin_functional/plugins/kbn_tp_custom_visualizations/package.json
@@ -12,7 +12,7 @@
     "build": "rm -rf './target' && tsc"
   },
   "devDependencies": {
-    "@elastic/eui": "27.4.1",
+    "@elastic/eui": "28.2.0",
     "@kbn/plugin-helpers": "1.0.0",
     "react": "^16.12.0",
     "typescript": "4.0.2"
diff --git a/test/plugin_functional/plugins/kbn_tp_custom_visualizations/public/self_changing_vis/self_changing_vis.js b/test/plugin_functional/plugins/kbn_tp_custom_visualizations/public/self_changing_vis/self_changing_vis.js
deleted file mode 100644
index 7aa12ea7a1130b..00000000000000
--- a/test/plugin_functional/plugins/kbn_tp_custom_visualizations/public/self_changing_vis/self_changing_vis.js
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { SelfChangingEditor } from './self_changing_editor';
-import { SelfChangingComponent } from './self_changing_components';
-
-import { npSetup } from '../../../../../../src/legacy/ui/public/new_platform';
-
-npSetup.plugins.visualizations.createReactVisualization({
-  name: 'self_changing_vis',
-  title: 'Self Changing Vis',
-  icon: 'controlsHorizontal',
-  description:
-    'This visualization is able to change its own settings, that you could also set in the editor.',
-  visConfig: {
-    component: SelfChangingComponent,
-    defaults: {
-      counter: 0,
-    },
-  },
-  editorConfig: {
-    optionTabs: [
-      {
-        name: 'options',
-        title: 'Options',
-        editor: SelfChangingEditor,
-      },
-    ],
-  },
-  requestHandler: 'none',
-});
diff --git a/test/plugin_functional/plugins/kbn_tp_custom_visualizations/tsconfig.json b/test/plugin_functional/plugins/kbn_tp_custom_visualizations/tsconfig.json
index d8096d9aab27ab..7e2f7c97eb0586 100644
--- a/test/plugin_functional/plugins/kbn_tp_custom_visualizations/tsconfig.json
+++ b/test/plugin_functional/plugins/kbn_tp_custom_visualizations/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true,
@@ -13,7 +13,7 @@
     "index.ts",
     "public/**/*.ts",
     "public/**/*.tsx",
-    "../../../../typings/**/*",
+    "../../../../typings/**/*"
   ],
   "exclude": []
-}
\ No newline at end of file
+}
diff --git a/test/plugin_functional/plugins/management_test_plugin/tsconfig.json b/test/plugin_functional/plugins/management_test_plugin/tsconfig.json
index 5fcaeafbb0d852..4d979fbf7f15fd 100644
--- a/test/plugin_functional/plugins/management_test_plugin/tsconfig.json
+++ b/test/plugin_functional/plugins/management_test_plugin/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/rendering_plugin/tsconfig.json b/test/plugin_functional/plugins/rendering_plugin/tsconfig.json
index 1ba21f11b7de2a..ccbffc34bce4a4 100644
--- a/test/plugin_functional/plugins/rendering_plugin/tsconfig.json
+++ b/test/plugin_functional/plugins/rendering_plugin/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/plugins/ui_settings_plugin/tsconfig.json b/test/plugin_functional/plugins/ui_settings_plugin/tsconfig.json
index 7c170405bbfc7f..33b2d6c0f64ad8 100644
--- a/test/plugin_functional/plugins/ui_settings_plugin/tsconfig.json
+++ b/test/plugin_functional/plugins/ui_settings_plugin/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
diff --git a/test/plugin_functional/test_suites/core_plugins/applications.ts b/test/plugin_functional/test_suites/core_plugins/applications.ts
index 9ecef65f5f09a1..4c72c091a2bee4 100644
--- a/test/plugin_functional/test_suites/core_plugins/applications.ts
+++ b/test/plugin_functional/test_suites/core_plugins/applications.ts
@@ -145,16 +145,5 @@ export default function ({ getService, getPageObjects }: PluginFunctionalProvide
       const windowHeight = (await browser.getWindowSize()).height;
       expect(wrapperHeight).to.be.below(windowHeight);
     });
-
-    // Not sure if we need this test or not. If yes, we need to find another legacy app
-    it.skip('can navigate from NP apps to legacy apps', async () => {
-      await appsMenu.clickLink('Stack Management');
-      await testSubjects.existOrFail('managementNav');
-    });
-
-    it('can navigate from legacy apps to NP apps', async () => {
-      await appsMenu.clickLink('Foo');
-      await testSubjects.existOrFail('fooAppHome');
-    });
   });
 }
diff --git a/test/plugin_functional/test_suites/core_plugins/rendering.ts b/test/plugin_functional/test_suites/core_plugins/rendering.ts
index 5b83d2d5654111..9931a3fabcd8d3 100644
--- a/test/plugin_functional/test_suites/core_plugins/rendering.ts
+++ b/test/plugin_functional/test_suites/core_plugins/rendering.ts
@@ -51,11 +51,7 @@ export default function ({ getService, getPageObjects }: PluginFunctionalProvide
       window.__RENDERING_SESSION__.push(window.location.pathname);
     });
   };
-  const getLegacyMode = () =>
-    browser.execute(() => {
-      return JSON.parse(document.querySelector('kbn-injected-metadata')!.getAttribute('data')!)
-        .legacyMode;
-    });
+
   const getUserSettings = () =>
     browser.execute(() => {
       return JSON.parse(document.querySelector('kbn-injected-metadata')!.getAttribute('data')!)
@@ -73,13 +69,11 @@ export default function ({ getService, getPageObjects }: PluginFunctionalProvide
     it('renders "core" application', async () => {
       await navigateTo('/render/core');
 
-      const [loadingMessage, legacyMode, userSettings] = await Promise.all([
+      const [loadingMessage, userSettings] = await Promise.all([
         findLoadingMessage(),
-        getLegacyMode(),
         getUserSettings(),
       ]);
 
-      expect(legacyMode).to.be(false);
       expect(userSettings).to.not.be.empty();
 
       await find.waitForElementStale(loadingMessage);
@@ -90,13 +84,11 @@ export default function ({ getService, getPageObjects }: PluginFunctionalProvide
     it('renders "core" application without user settings', async () => {
       await navigateTo('/render/core?includeUserSettings=false');
 
-      const [loadingMessage, legacyMode, userSettings] = await Promise.all([
+      const [loadingMessage, userSettings] = await Promise.all([
         findLoadingMessage(),
-        getLegacyMode(),
         getUserSettings(),
       ]);
 
-      expect(legacyMode).to.be(false);
       expect(userSettings).to.be.empty();
 
       await find.waitForElementStale(loadingMessage);
diff --git a/test/scripts/jenkins_security_solution_cypress.sh b/test/scripts/jenkins_security_solution_cypress.sh
index a5a1a2103801fa..c018b632706b1f 100755
--- a/test/scripts/jenkins_security_solution_cypress.sh
+++ b/test/scripts/jenkins_security_solution_cypress.sh
@@ -5,11 +5,11 @@ source test/scripts/jenkins_test_setup_xpack.sh
 echo " -> Running security solution cypress tests"
 cd "$XPACK_DIR"
 
-checks-reporter-with-killswitch "Security solution Cypress Tests" \
+checks-reporter-with-killswitch "Security Solution Cypress Tests" \
  node scripts/functional_tests \
    --debug --bail \
    --kibana-install-dir "$KIBANA_INSTALL_DIR" \
-   --config test/security_solution_cypress/config.ts
+   --config test/security_solution_cypress/cli_config.ts
 
 echo ""
 echo ""
diff --git a/test/tsconfig.json b/test/tsconfig.json
index 87e79b295315f0..325db489780226 100644
--- a/test/tsconfig.json
+++ b/test/tsconfig.json
@@ -1,19 +1,15 @@
 {
-  "extends": "../tsconfig.json",
+  "extends": "../tsconfig.base.json",
   "compilerOptions": {
+    "tsBuildInfoFile": "../build/tsbuildinfo/test",
     "types": [
       "node",
       "mocha",
       "flot"
-    ],
-    "lib": [
-      "esnext",
-      "dom"
     ]
   },
   "include": [
-    "**/*.ts",
-    "**/*.tsx",
+    "**/*",
     "../typings/elastic__node_crypto.d.ts",
     "typings/**/*"
   ],
diff --git a/tsconfig.base.json b/tsconfig.base.json
new file mode 100644
index 00000000000000..58a6237846a547
--- /dev/null
+++ b/tsconfig.base.json
@@ -0,0 +1,60 @@
+{
+  "compilerOptions": {
+    "baseUrl": ".",
+    "paths": {
+      // Allows for importing from `kibana` package for the exported types.
+      "kibana": ["./kibana"],
+      "kibana/public": ["src/core/public"],
+      "kibana/server": ["src/core/server"],
+      "plugins/*": ["src/legacy/core_plugins/*/public/"],
+      "test_utils/*": [
+        "src/test_utils/public/*"
+      ],
+      "fixtures/*": ["src/fixtures/*"]
+    },
+    // Support .tsx files and transform JSX into calls to React.createElement
+    "jsx": "react",
+    // Enables all strict type checking options.
+    "strict": true,
+    // save information about the project graph on disk
+    "incremental": true,
+    // enables "core language features"
+    "lib": [
+      "esnext",
+      // includes support for browser APIs
+      "dom"
+    ],
+    // Node 8 should support everything output by esnext, we override this
+    // in webpack with loader-level compiler options
+    "target": "esnext",
+    // Use commonjs for node, overridden in webpack to keep import statements
+    // to maintain support for things like `await import()`
+    "module": "commonjs",
+    // Allows default imports from modules with no default export. This does not affect code emit, just type checking.
+    // We have to enable this option explicitly since `esModuleInterop` doesn't enable it automatically when ES2015 or
+    // ESNext module format is used.
+    "allowSyntheticDefaultImports": true,
+    // Emits __importStar and __importDefault helpers for runtime babel ecosystem compatibility.
+    "esModuleInterop": true,
+    // Resolve modules in the same way as Node.js. Aka make `require` works the
+    // same in TypeScript as it does in Node.js.
+    "moduleResolution": "node",
+    // Disallow inconsistently-cased references to the same file.
+    "forceConsistentCasingInFileNames": true,
+    // Forbid unused local variables as the rule was deprecated by ts-lint
+    "noUnusedLocals": true,
+    // Provide full support for iterables in for..of, spread and destructuring when targeting ES5 or ES3.
+    "downlevelIteration": true,
+    // import tslib helpers rather than inlining helpers for iteration or spreading, for instance
+    "importHelpers": true,
+    // adding global typings
+    "types": [
+      "node",
+      "jest",
+      "react",
+      "flot",
+      "jest-styled-components",
+      "@testing-library/jest-dom"
+    ]
+  }
+}
diff --git a/tsconfig.browser.json b/tsconfig.browser.json
index fdfc868157e0d7..b0886bf3e5e289 100644
--- a/tsconfig.browser.json
+++ b/tsconfig.browser.json
@@ -1,5 +1,5 @@
 {
-  "extends": "./tsconfig.json",
+  "extends": "./tsconfig.base.json",
   "compilerOptions": {
     "target": "es5",
     "module": "esnext",
diff --git a/tsconfig.json b/tsconfig.json
index 66906fb18bb80a..21a817213c62f4 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -1,62 +1,7 @@
 {
+  "extends": "./tsconfig.base.json",
   "compilerOptions": {
-    "baseUrl": ".",
-    "paths": {
-      // Allows for importing from `kibana` package for the exported types.
-      "kibana": ["./kibana"],
-      "kibana/public": ["src/core/public"],
-      "kibana/server": ["src/core/server"],
-      "plugins/*": ["src/legacy/core_plugins/*/public/"],
-      "ui/*": [
-        "src/legacy/ui/public/*"
-      ],
-      "test_utils/*": [
-        "src/test_utils/public/*"
-      ],
-      "fixtures/*": ["src/fixtures/*"]
-    },
-    // Support .tsx files and transform JSX into calls to React.createElement
-    "jsx": "react",
-    // Enables all strict type checking options.
-    "strict": true,
-    // enables "core language features"
-    "lib": [
-      "esnext",
-      // includes support for browser APIs
-      "dom"
-    ],
-    // Node 8 should support everything output by esnext, we override this
-    // in webpack with loader-level compiler options
-    "target": "esnext",
-    // Use commonjs for node, overridden in webpack to keep import statements
-    // to maintain support for things like `await import()`
-    "module": "commonjs",
-    // Allows default imports from modules with no default export. This does not affect code emit, just type checking.
-    // We have to enable this option explicitly since `esModuleInterop` doesn't enable it automatically when ES2015 or
-    // ESNext module format is used.
-    "allowSyntheticDefaultImports": true,
-    // Emits __importStar and __importDefault helpers for runtime babel ecosystem compatibility.
-    "esModuleInterop": true,
-    // Resolve modules in the same way as Node.js. Aka make `require` works the
-    // same in TypeScript as it does in Node.js.
-    "moduleResolution": "node",
-    // Disallow inconsistently-cased references to the same file.
-    "forceConsistentCasingInFileNames": true,
-    // Forbid unused local variables as the rule was deprecated by ts-lint
-    "noUnusedLocals": true,
-    // Provide full support for iterables in for..of, spread and destructuring when targeting ES5 or ES3.
-    "downlevelIteration": true,
-    // import tslib helpers rather than inlining helpers for iteration or spreading, for instance
-    "importHelpers": true,
-    // adding global typings
-    "types": [
-      "node",
-      "jest",
-      "react",
-      "flot",
-      "jest-styled-components",
-      "@testing-library/jest-dom"
-    ]
+    "tsBuildInfoFile": "./build/tsbuildinfo/kibana",
   },
   "include": [
     "kibana.d.ts",
@@ -65,11 +10,15 @@
     "test_utils/**/*"
   ],
   "exclude": [
-    "src/**/__fixtures__/**/*"
+    "src/**/__fixtures__/**/*",
+    "src/test_utils/**/*"
     // In the build we actually exclude **/public/**/* from this config so that
     // we can run the TSC on both this and the .browser version of this config
     // file, but if we did it during development IDEs would not be able to find
     // the tsconfig.json file for public files correctly.
     // "src/**/public/**/*"
+  ],
+  "references": [
+    { "path": "./src/test_utils/tsconfig.json" }
   ]
 }
diff --git a/tsconfig.refs.json b/tsconfig.refs.json
new file mode 100644
index 00000000000000..0e4cc1bd32da30
--- /dev/null
+++ b/tsconfig.refs.json
@@ -0,0 +1,6 @@
+{
+  "include": [],
+  "references": [
+    { "path": "./src/test_utils" }
+  ]
+}
diff --git a/tsconfig.types.json b/tsconfig.types.json
index 2f5919e413e514..4b7dfa2d014a31 100644
--- a/tsconfig.types.json
+++ b/tsconfig.types.json
@@ -1,8 +1,9 @@
 {
-  "extends": "./tsconfig",
+  "extends": "./tsconfig.base.json",
   "compilerOptions": {
+    "incremental": false,
     "declaration": true,
-    "declarationDir": "./target/types",
+    "outDir": "./target/types",
     "stripInternal": false,
     "emitDeclarationOnly": true,
     "declarationMap": true
diff --git a/x-pack/dev-tools/jest/create_jest_config.js b/x-pack/dev-tools/jest/create_jest_config.js
index a0574dbdf36da6..a693e008db6ea0 100644
--- a/x-pack/dev-tools/jest/create_jest_config.js
+++ b/x-pack/dev-tools/jest/create_jest_config.js
@@ -13,7 +13,6 @@ export function createJestConfig({ kibanaDirectory, rootDir, xPackKibanaDirector
     moduleNameMapper: {
       '@elastic/eui$': `${kibanaDirectory}/node_modules/@elastic/eui/test-env`,
       '@elastic/eui/lib/(.*)?': `${kibanaDirectory}/node_modules/@elastic/eui/test-env/$1`,
-      '^ui/(.*)': `${kibanaDirectory}/src/legacy/ui/public/$1`,
       '^fixtures/(.*)': `${kibanaDirectory}/src/fixtures/$1`,
       'uiExports/(.*)': fileMockPath,
       '^src/core/(.*)': `${kibanaDirectory}/src/core/$1`,
diff --git a/x-pack/examples/ui_actions_enhanced_examples/public/dashboard_to_url_drilldown/index.tsx b/x-pack/examples/ui_actions_enhanced_examples/public/dashboard_to_url_drilldown/index.tsx
deleted file mode 100644
index 7d915ea23c66f0..00000000000000
--- a/x-pack/examples/ui_actions_enhanced_examples/public/dashboard_to_url_drilldown/index.tsx
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { EuiCallOut, EuiFieldText, EuiFormRow, EuiSpacer, EuiSwitch } from '@elastic/eui';
-import { reactToUiComponent } from '../../../../../src/plugins/kibana_react/public';
-import { UiActionsEnhancedDrilldownDefinition as Drilldown } from '../../../../plugins/ui_actions_enhanced/public';
-import { ChartActionContext } from '../../../../../src/plugins/embeddable/public';
-import { CollectConfigProps as CollectConfigPropsBase } from '../../../../../src/plugins/kibana_utils/public';
-import {
-  SELECT_RANGE_TRIGGER,
-  VALUE_CLICK_TRIGGER,
-} from '../../../../../src/plugins/ui_actions/public';
-import { ActionExecutionContext } from '../../../../../src/plugins/ui_actions/public';
-
-function isValidUrl(url: string) {
-  try {
-    new URL(url);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export type ActionContext = ChartActionContext;
-
-export interface Config {
-  url: string;
-  openInNewTab: boolean;
-}
-
-type UrlTrigger = typeof VALUE_CLICK_TRIGGER | typeof SELECT_RANGE_TRIGGER;
-
-export type CollectConfigProps = CollectConfigPropsBase<Config, { triggers: UrlTrigger[] }>;
-
-const SAMPLE_DASHBOARD_TO_URL_DRILLDOWN = 'SAMPLE_DASHBOARD_TO_URL_DRILLDOWN';
-
-export class DashboardToUrlDrilldown implements Drilldown<Config, UrlTrigger> {
-  public readonly id = SAMPLE_DASHBOARD_TO_URL_DRILLDOWN;
-
-  public readonly order = 8;
-
-  readonly minimalLicense = 'gold'; // example of minimal license support
-
-  public readonly getDisplayName = () => 'Go to URL (example)';
-
-  public readonly euiIcon = 'link';
-
-  supportedTriggers(): UrlTrigger[] {
-    return [VALUE_CLICK_TRIGGER, SELECT_RANGE_TRIGGER];
-  }
-
-  private readonly ReactCollectConfig: React.FC<CollectConfigProps> = ({
-    config,
-    onConfig,
-    context,
-  }) => (
-    <>
-      <EuiCallOut title="Example warning!" color="warning" iconType="help">
-        <p>
-          This is an example drilldown. It is meant as a starting point for developers, so they can
-          grab this code and get started. It does not provide a complete working functionality but
-          serves as a getting started example.
-        </p>
-        <p>
-          Implementation of the actual <em>Go to URL</em> drilldown is tracked in{' '}
-          <a href="https://github.com/elastic/kibana/issues/55324">#55324</a>
-        </p>
-      </EuiCallOut>
-      <EuiSpacer size="xl" />
-      <EuiFormRow label="Enter target URL" fullWidth>
-        <EuiFieldText
-          fullWidth
-          name="url"
-          placeholder="Enter URL"
-          value={config.url}
-          onChange={(event) => onConfig({ ...config, url: event.target.value })}
-          onBlur={() => {
-            if (!config.url) return;
-            if (/https?:\/\//.test(config.url)) return;
-            onConfig({ ...config, url: 'https://' + config.url });
-          }}
-        />
-      </EuiFormRow>
-      <EuiFormRow hasChildLabel={false}>
-        <EuiSwitch
-          name="openInNewTab"
-          label="Open in new tab?"
-          checked={config.openInNewTab}
-          onChange={() => onConfig({ ...config, openInNewTab: !config.openInNewTab })}
-        />
-      </EuiFormRow>
-      <EuiSpacer size="xl" />
-      <EuiCallOut>
-        {/* just demo how can access selected triggers*/}
-        <p>Will be attached to triggers: {JSON.stringify(context.triggers)}</p>
-      </EuiCallOut>
-    </>
-  );
-
-  public readonly CollectConfig = reactToUiComponent(this.ReactCollectConfig);
-
-  public readonly createConfig = () => ({
-    url: '',
-    openInNewTab: false,
-  });
-
-  public readonly isConfigValid = (config: Config): config is Config => {
-    if (!config.url) return false;
-    return isValidUrl(config.url);
-  };
-
-  /**
-   * `getHref` is need to support mouse middle-click and Cmd + Click behavior
-   * to open a link in new tab.
-   */
-  public readonly getHref = async (config: Config, context: ActionContext) => {
-    return config.url;
-  };
-
-  public readonly execute = async (
-    config: Config,
-    context: ActionExecutionContext<ActionContext>
-  ) => {
-    // Just for showcasing:
-    // we can get trigger a which caused this drilldown execution
-    // eslint-disable-next-line no-console
-    console.log(context.trigger?.id);
-
-    const url = await this.getHref(config, context);
-
-    if (config.openInNewTab) {
-      window.open(url, '_blank');
-    } else {
-      window.location.href = url;
-    }
-  };
-}
diff --git a/x-pack/examples/ui_actions_enhanced_examples/public/plugin.ts b/x-pack/examples/ui_actions_enhanced_examples/public/plugin.ts
index 7f2c9a9b3bbc8b..3f0b64a2ac9ed8 100644
--- a/x-pack/examples/ui_actions_enhanced_examples/public/plugin.ts
+++ b/x-pack/examples/ui_actions_enhanced_examples/public/plugin.ts
@@ -11,7 +11,6 @@ import {
   AdvancedUiActionsStart,
 } from '../../../../x-pack/plugins/ui_actions_enhanced/public';
 import { DashboardHelloWorldDrilldown } from './dashboard_hello_world_drilldown';
-import { DashboardToUrlDrilldown } from './dashboard_to_url_drilldown';
 import { DashboardToDiscoverDrilldown } from './dashboard_to_discover_drilldown';
 import { createStartServicesGetter } from '../../../../src/plugins/kibana_utils/public';
 import { DiscoverSetup, DiscoverStart } from '../../../../src/plugins/discover/public';
@@ -39,7 +38,6 @@ export class UiActionsEnhancedExamplesPlugin
 
     uiActions.registerDrilldown(new DashboardHelloWorldDrilldown());
     uiActions.registerDrilldown(new DashboardHelloWorldOnlyRangeSelectDrilldown());
-    uiActions.registerDrilldown(new DashboardToUrlDrilldown());
     uiActions.registerDrilldown(new DashboardToDiscoverDrilldown({ start }));
   }
 
diff --git a/x-pack/examples/ui_actions_enhanced_examples/tsconfig.json b/x-pack/examples/ui_actions_enhanced_examples/tsconfig.json
index d508076b331990..cae75bb81c7232 100644
--- a/x-pack/examples/ui_actions_enhanced_examples/tsconfig.json
+++ b/x-pack/examples/ui_actions_enhanced_examples/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
@@ -9,7 +9,7 @@
     "public/**/*.ts",
     "public/**/*.tsx",
     "server/**/*.ts",
-    "../../typings/**/*",
+    "../../typings/**/*"
   ],
   "exclude": []
 }
diff --git a/x-pack/legacy/plugins/security/index.ts b/x-pack/legacy/plugins/security/index.ts
index 3ab5126e52c5f0..c3596d3745e57e 100644
--- a/x-pack/legacy/plugins/security/index.ts
+++ b/x-pack/legacy/plugins/security/index.ts
@@ -11,7 +11,7 @@ export const security = (kibana: Record<string, any>) =>
   new kibana.Plugin({
     id: 'security',
     publicDir: resolve(__dirname, 'public'),
-    require: ['kibana'],
+    require: ['elasticsearch'],
     configPrefix: 'xpack.security',
     config: (Joi: Root) =>
       Joi.object({ enabled: Joi.boolean().default(true) })
diff --git a/x-pack/legacy/plugins/spaces/index.ts b/x-pack/legacy/plugins/spaces/index.ts
index 40339f198df6d1..725d022879e0d7 100644
--- a/x-pack/legacy/plugins/spaces/index.ts
+++ b/x-pack/legacy/plugins/spaces/index.ts
@@ -16,7 +16,7 @@ export const spaces = (kibana: Record<string, any>) =>
     id: 'spaces',
     configPrefix: 'xpack.spaces',
     publicDir: resolve(__dirname, 'public'),
-    require: ['kibana', 'elasticsearch', 'xpack_main'],
+    require: ['elasticsearch', 'xpack_main'],
     config(Joi: any) {
       return Joi.object({
         enabled: Joi.boolean().default(true),
diff --git a/x-pack/legacy/plugins/xpack_main/index.js b/x-pack/legacy/plugins/xpack_main/index.js
index b83c5a5ff606e3..854fba6624719f 100644
--- a/x-pack/legacy/plugins/xpack_main/index.js
+++ b/x-pack/legacy/plugins/xpack_main/index.js
@@ -6,12 +6,9 @@
 
 import { resolve } from 'path';
 import { mirrorPluginStatus } from '../../server/lib/mirror_plugin_status';
-import { replaceInjectedVars } from './server/lib/replace_injected_vars';
 import { setupXPackMain } from './server/lib/setup_xpack_main';
 import { xpackInfoRoute, settingsRoute } from './server/routes/api/v1';
 
-export { callClusterFactory } from './server/lib/call_cluster_factory';
-
 export const xpackMain = (kibana) => {
   return new kibana.Plugin({
     id: 'xpack_main',
@@ -25,32 +22,7 @@ export const xpackMain = (kibana) => {
       }).default();
     },
 
-    uiCapabilities(server) {
-      const featuresPlugin = server.newPlatform.setup.plugins.features;
-      if (!featuresPlugin) {
-        throw new Error('New Platform XPack Features plugin is not available.');
-      }
-      return featuresPlugin.getFeaturesUICapabilities();
-    },
-
-    uiExports: {
-      replaceInjectedVars,
-      injectDefaultVars(server) {
-        const config = server.config();
-
-        return {
-          activeSpace: null,
-          spacesEnabled: config.get('xpack.spaces.enabled'),
-        };
-      },
-    },
-
     init(server) {
-      const featuresPlugin = server.newPlatform.setup.plugins.features;
-      if (!featuresPlugin) {
-        throw new Error('New Platform XPack Features plugin is not available.');
-      }
-
       mirrorPluginStatus(server.plugins.elasticsearch, this, 'yellow', 'red');
 
       setupXPackMain(server);
diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/call_cluster_factory.js b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/call_cluster_factory.js
deleted file mode 100644
index abe0d327d7b5cb..00000000000000
--- a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/call_cluster_factory.js
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-import { callClusterFactory } from '../call_cluster_factory';
-
-describe('callClusterFactory', () => {
-  let mockServer;
-  let mockCluster;
-
-  beforeEach(() => {
-    mockCluster = {
-      callWithRequest: sinon.stub().returns(Promise.resolve({ hits: { total: 0 } })),
-      callWithInternalUser: sinon.stub().returns(Promise.resolve({ hits: { total: 0 } })),
-    };
-    mockServer = {
-      plugins: {
-        elasticsearch: {
-          getCluster: sinon.stub().withArgs('admin').returns(mockCluster),
-        },
-      },
-      log() {},
-    };
-  });
-
-  it('returns an object with getter methods', () => {
-    const _callClusterFactory = callClusterFactory(mockServer);
-    expect(_callClusterFactory).to.be.an('object');
-    expect(_callClusterFactory.getCallClusterWithReq).to.be.an('function');
-    expect(_callClusterFactory.getCallClusterInternal).to.be.an('function');
-    expect(mockCluster.callWithRequest.called).to.be(false);
-    expect(mockCluster.callWithInternalUser.called).to.be(false);
-  });
-
-  describe('getCallClusterWithReq', () => {
-    it('throws an error if req is not passed', async () => {
-      const runCallCluster = () => callClusterFactory(mockServer).getCallClusterWithReq();
-      expect(runCallCluster).to.throwException();
-    });
-
-    it('returns a method that wraps callWithRequest', async () => {
-      const mockReq = {
-        headers: {
-          authorization: 'Basic dSQzcm5AbTM6cEAkJHcwcmQ=', // u$3rn@m3:p@$$w0rd
-        },
-      };
-      const callCluster = callClusterFactory(mockServer).getCallClusterWithReq(mockReq);
-
-      const result = await callCluster('search', { body: { match: { match_all: {} } } });
-      expect(result).to.eql({ hits: { total: 0 } });
-
-      expect(mockCluster.callWithInternalUser.called).to.be(false);
-      expect(mockCluster.callWithRequest.calledOnce).to.be(true);
-      const [req, method] = mockCluster.callWithRequest.getCall(0).args;
-      expect(req).to.be(mockReq);
-      expect(method).to.be('search');
-    });
-  });
-
-  describe('getCallClusterInternal', () => {
-    it('returns a method that wraps callWithInternalUser', async () => {
-      const callCluster = callClusterFactory(mockServer).getCallClusterInternal();
-
-      const result = await callCluster('search', { body: { match: { match_all: {} } } });
-      expect(result).to.eql({ hits: { total: 0 } });
-
-      expect(mockCluster.callWithRequest.called).to.be(false);
-      expect(mockCluster.callWithInternalUser.calledOnce).to.be(true);
-      const [method] = mockCluster.callWithInternalUser.getCall(0).args;
-      expect(method).to.eql('search');
-    });
-  });
-});
diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/inject_xpack_info_signature.js b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/inject_xpack_info_signature.js
deleted file mode 100644
index 420f3b2d6631cc..00000000000000
--- a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/inject_xpack_info_signature.js
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import { injectXPackInfoSignature } from '../inject_xpack_info_signature';
-
-describe('injectXPackInfoSignature()', () => {
-  class MockErrorResponse extends Error {
-    constructor() {
-      super();
-      this.output = {
-        headers: {},
-      };
-
-      this.headers = {};
-    }
-  }
-
-  const fakeH = { continue: 'blah' };
-
-  let mockXPackInfo;
-  beforeEach(() => {
-    mockXPackInfo = sinon.stub({
-      isAvailable() {},
-      getSignature() {},
-      refreshNow() {},
-    });
-  });
-
-  describe('error response', () => {
-    it('refreshes `xpackInfo` and do not inject signature if it is not available.', async () => {
-      mockXPackInfo.isAvailable.returns(true);
-      mockXPackInfo.getSignature.returns('this-should-never-be-set');
-
-      // We need this to make sure the code waits for `refreshNow` to complete before it tries
-      // to access its properties.
-      mockXPackInfo.refreshNow = () => {
-        return new Promise((resolve) => {
-          mockXPackInfo.isAvailable.returns(false);
-          resolve();
-        });
-      };
-
-      const mockResponse = new MockErrorResponse();
-      const response = await injectXPackInfoSignature(
-        mockXPackInfo,
-        { response: mockResponse },
-        fakeH
-      );
-
-      expect(mockResponse.headers).to.eql({});
-      expect(mockResponse.output.headers).to.eql({});
-      expect(response).to.be(fakeH.continue);
-    });
-
-    it('refreshes `xpackInfo` and injects its updated signature.', async () => {
-      mockXPackInfo.isAvailable.returns(true);
-      mockXPackInfo.getSignature.returns('old-signature');
-
-      // We need this to make sure the code waits for `refreshNow` to complete before it tries
-      // to access its properties.
-      mockXPackInfo.refreshNow = () => {
-        return new Promise((resolve) => {
-          mockXPackInfo.getSignature.returns('new-signature');
-          resolve();
-        });
-      };
-
-      const mockResponse = new MockErrorResponse();
-      const response = await injectXPackInfoSignature(
-        mockXPackInfo,
-        { response: mockResponse },
-        fakeH
-      );
-
-      expect(mockResponse.headers).to.eql({});
-      expect(mockResponse.output.headers).to.eql({
-        'kbn-xpack-sig': 'new-signature',
-      });
-      expect(response).to.be(fakeH.continue);
-    });
-  });
-
-  describe('non-error response', () => {
-    it('do not inject signature if `xpackInfo` is not available.', async () => {
-      mockXPackInfo.isAvailable.returns(false);
-      mockXPackInfo.getSignature.returns('this-should-never-be-set');
-
-      const mockResponse = { headers: {}, output: { headers: {} } };
-      const response = await injectXPackInfoSignature(
-        mockXPackInfo,
-        { response: mockResponse },
-        fakeH
-      );
-
-      expect(mockResponse.headers).to.eql({});
-      expect(mockResponse.output.headers).to.eql({});
-      sinon.assert.notCalled(mockXPackInfo.refreshNow);
-      expect(response).to.be(fakeH.continue);
-    });
-
-    it('injects signature if `xpackInfo` is available.', async () => {
-      mockXPackInfo.isAvailable.returns(true);
-      mockXPackInfo.getSignature.returns('available-signature');
-
-      const mockResponse = { headers: {}, output: { headers: {} } };
-      const response = await injectXPackInfoSignature(
-        mockXPackInfo,
-        { response: mockResponse },
-        fakeH
-      );
-
-      expect(mockResponse.headers).to.eql({
-        'kbn-xpack-sig': 'available-signature',
-      });
-      expect(mockResponse.output.headers).to.eql({});
-      sinon.assert.notCalled(mockXPackInfo.refreshNow);
-      expect(response).to.be(fakeH.continue);
-    });
-  });
-});
diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js
deleted file mode 100644
index ce6e20bd874b29..00000000000000
--- a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/replace_injected_vars.js
+++ /dev/null
@@ -1,225 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-
-import { replaceInjectedVars } from '../replace_injected_vars';
-import { KibanaRequest } from '../../../../../../../src/core/server';
-
-const buildRequest = (path = '/app/kibana') => {
-  const get = sinon.stub();
-
-  return {
-    app: {},
-    path,
-    route: { settings: {} },
-    headers: {},
-    raw: {
-      req: {
-        socket: {},
-      },
-    },
-    getSavedObjectsClient: () => {
-      return {
-        get,
-        create: sinon.stub(),
-
-        errors: {
-          isNotFoundError: (error) => {
-            return error.message === 'not found exception';
-          },
-        },
-      };
-    },
-  };
-};
-
-describe('replaceInjectedVars uiExport', () => {
-  it('sends xpack info if request is authenticated and license is not basic', async () => {
-    const originalInjectedVars = { a: 1 };
-    const request = buildRequest();
-    const server = mockServer();
-
-    const newVars = await replaceInjectedVars(originalInjectedVars, request, server);
-    expect(newVars).to.eql({
-      a: 1,
-      xpackInitialInfo: {
-        b: 1,
-      },
-    });
-
-    sinon.assert.calledOnce(server.newPlatform.setup.plugins.security.authc.isAuthenticated);
-    sinon.assert.calledWithExactly(
-      server.newPlatform.setup.plugins.security.authc.isAuthenticated,
-      sinon.match.instanceOf(KibanaRequest)
-    );
-  });
-
-  it('sends the xpack info if security plugin is disabled', async () => {
-    const originalInjectedVars = { a: 1 };
-    const request = buildRequest();
-    const server = mockServer();
-    delete server.plugins.security;
-    delete server.newPlatform.setup.plugins.security;
-
-    const newVars = await replaceInjectedVars(originalInjectedVars, request, server);
-    expect(newVars).to.eql({
-      a: 1,
-      xpackInitialInfo: {
-        b: 1,
-      },
-    });
-  });
-
-  it('sends the xpack info if xpack license is basic', async () => {
-    const originalInjectedVars = { a: 1 };
-    const request = buildRequest();
-    const server = mockServer();
-    server.plugins.xpack_main.info.license.isOneOf.returns(true);
-
-    const newVars = await replaceInjectedVars(originalInjectedVars, request, server);
-    expect(newVars).to.eql({
-      a: 1,
-      xpackInitialInfo: {
-        b: 1,
-      },
-    });
-  });
-
-  it('respects the telemetry opt-in document when opted-out', async () => {
-    const originalInjectedVars = { a: 1 };
-    const request = buildRequest();
-    const server = mockServer();
-    server.plugins.xpack_main.info.license.isOneOf.returns(true);
-
-    const newVars = await replaceInjectedVars(originalInjectedVars, request, server);
-    expect(newVars).to.eql({
-      a: 1,
-      xpackInitialInfo: {
-        b: 1,
-      },
-    });
-  });
-
-  it('respects the telemetry opt-in document when opted-in', async () => {
-    const originalInjectedVars = { a: 1 };
-    const request = buildRequest();
-    const server = mockServer();
-    server.plugins.xpack_main.info.license.isOneOf.returns(true);
-
-    const newVars = await replaceInjectedVars(originalInjectedVars, request, server);
-    expect(newVars).to.eql({
-      a: 1,
-      xpackInitialInfo: {
-        b: 1,
-      },
-    });
-  });
-
-  it('indicates that telemetry is opted-out when not loading an application', async () => {
-    const originalInjectedVars = { a: 1 };
-    const request = buildRequest(true, '/');
-    const server = mockServer();
-    server.plugins.xpack_main.info.license.isOneOf.returns(true);
-
-    const newVars = await replaceInjectedVars(originalInjectedVars, request, server);
-    expect(newVars).to.eql({
-      a: 1,
-      xpackInitialInfo: {
-        b: 1,
-      },
-    });
-  });
-
-  it('sends the originalInjectedVars if not authenticated', async () => {
-    const originalInjectedVars = { a: 1 };
-    const request = buildRequest();
-    const server = mockServer();
-    server.newPlatform.setup.plugins.security.authc.isAuthenticated.returns(false);
-
-    const newVars = await replaceInjectedVars(originalInjectedVars, request, server);
-    expect(newVars).to.eql(originalInjectedVars);
-  });
-
-  it('sends the originalInjectedVars if xpack info is unavailable', async () => {
-    const originalInjectedVars = { a: 1 };
-    const request = buildRequest();
-    const server = mockServer();
-    server.plugins.xpack_main.info.isAvailable.returns(false);
-
-    const newVars = await replaceInjectedVars(originalInjectedVars, request, server);
-    expect(newVars).to.eql(originalInjectedVars);
-  });
-
-  it('sends the originalInjectedVars (with xpackInitialInfo = undefined) if security is disabled, xpack info is unavailable', async () => {
-    const originalInjectedVars = {
-      a: 1,
-      uiCapabilities: { navLinks: { foo: true }, bar: { baz: true }, catalogue: { cfoo: true } },
-    };
-    const request = buildRequest();
-    const server = mockServer();
-    delete server.plugins.security;
-    server.plugins.xpack_main.info.isAvailable.returns(false);
-
-    const newVars = await replaceInjectedVars(originalInjectedVars, request, server);
-    expect(newVars).to.eql({
-      a: 1,
-      xpackInitialInfo: undefined,
-      uiCapabilities: {
-        navLinks: { foo: true },
-        bar: { baz: true },
-        catalogue: {
-          cfoo: true,
-        },
-      },
-    });
-  });
-});
-
-// creates a mock server object that defaults to being authenticated with a
-// non-basic license
-function mockServer() {
-  const getLicenseCheckResults = sinon.stub().returns({});
-  return {
-    newPlatform: {
-      setup: {
-        plugins: { security: { authc: { isAuthenticated: sinon.stub().returns(true) } } },
-      },
-    },
-    plugins: {
-      security: {},
-      xpack_main: {
-        getFeatures: () => [
-          {
-            id: 'mockFeature',
-            name: 'Mock Feature',
-            privileges: {
-              all: {
-                app: [],
-                savedObject: {
-                  all: [],
-                  read: [],
-                },
-                ui: ['mockFeatureCapability'],
-              },
-            },
-          },
-        ],
-        info: {
-          isAvailable: sinon.stub().returns(true),
-          feature: () => ({
-            getLicenseCheckResults,
-          }),
-          license: {
-            isOneOf: sinon.stub().returns(false),
-          },
-          toJSON: () => ({ b: 1 }),
-        },
-      },
-    },
-  };
-}
diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/setup_xpack_main.js b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/setup_xpack_main.js
index b4a2c090d63092..c34e27642d2ceb 100644
--- a/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/setup_xpack_main.js
+++ b/x-pack/legacy/plugins/xpack_main/server/lib/__tests__/setup_xpack_main.js
@@ -8,7 +8,6 @@ import { BehaviorSubject } from 'rxjs';
 import sinon from 'sinon';
 import { XPackInfo } from '../xpack_info';
 import { setupXPackMain } from '../setup_xpack_main';
-import * as InjectXPackInfoSignatureNS from '../inject_xpack_info_signature';
 
 describe('setupXPackMain()', () => {
   const sandbox = sinon.createSandbox();
@@ -19,7 +18,6 @@ describe('setupXPackMain()', () => {
 
   beforeEach(() => {
     sandbox.useFakeTimers();
-    sandbox.stub(InjectXPackInfoSignatureNS, 'injectXPackInfoSignature');
 
     mockElasticsearchPlugin = {
       getCluster: sinon.stub(),
@@ -63,29 +61,9 @@ describe('setupXPackMain()', () => {
     setupXPackMain(mockServer);
 
     sinon.assert.calledWithExactly(mockServer.expose, 'info', sinon.match.instanceOf(XPackInfo));
-    sinon.assert.calledWithExactly(mockServer.ext, 'onPreResponse', sinon.match.func);
     sinon.assert.calledWithExactly(mockElasticsearchPlugin.status.on, 'change', sinon.match.func);
   });
 
-  it('onPreResponse hook calls `injectXPackInfoSignature` for every request.', () => {
-    setupXPackMain(mockServer);
-
-    const xPackInfo = mockServer.expose.firstCall.args[1];
-    const onPreResponse = mockServer.ext.firstCall.args[1];
-
-    const mockRequest = {};
-    const mockReply = sinon.stub();
-
-    onPreResponse(mockRequest, mockReply);
-
-    sinon.assert.calledWithExactly(
-      InjectXPackInfoSignatureNS.injectXPackInfoSignature,
-      xPackInfo,
-      sinon.match.same(mockRequest),
-      sinon.match.same(mockReply)
-    );
-  });
-
   describe('Elasticsearch plugin state changes cause XPackMain plugin state change.', () => {
     let xPackInfo;
     let onElasticsearchPluginStatusChange;
diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/call_cluster_factory.js b/x-pack/legacy/plugins/xpack_main/server/lib/call_cluster_factory.js
deleted file mode 100644
index f946725e017ffd..00000000000000
--- a/x-pack/legacy/plugins/xpack_main/server/lib/call_cluster_factory.js
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-/*
- * Factory for acquiring a method that can send an authenticated query to Elasticsearch.
- *
- * The method can either:
- * - take authentication from an HTTP request object, which should be used when
- *   the caller is an HTTP API
- * - fabricate authentication using the system username and password from the
- *   Kibana config, which should be used when the caller is an internal process
- *
- * @param {Object} server: the Kibana server object
- * @return {Function}: callCluster function
- */
-export function callClusterFactory(server) {
-  const { callWithRequest, callWithInternalUser } = server.plugins.elasticsearch.getCluster(
-    'admin'
-  );
-
-  return {
-    /*
-     * caller is coming from a request, so use callWithRequest with actual
-     * Authorization header credentials
-     * @param {Object} req: HTTP request object
-     */
-    getCallClusterWithReq(req) {
-      if (req === undefined) {
-        throw new Error('request object is required');
-      }
-      return (...args) => callWithRequest(req, ...args);
-    },
-
-    getCallClusterInternal() {
-      /*
-       * caller is an internal function of the stats collection system, so use
-       * internal system user
-       */
-      return callWithInternalUser;
-    },
-  };
-}
diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/inject_xpack_info_signature.js b/x-pack/legacy/plugins/xpack_main/server/lib/inject_xpack_info_signature.js
deleted file mode 100644
index 166bd2b4755f05..00000000000000
--- a/x-pack/legacy/plugins/xpack_main/server/lib/inject_xpack_info_signature.js
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export async function injectXPackInfoSignature(info, request, h) {
-  // If we're returning an error response, refresh xpack info from
-  // Elasticsearch in case the error is due to a change in license information
-  // in Elasticsearch.
-  const isErrorResponse = request.response instanceof Error;
-  if (isErrorResponse) {
-    await info.refreshNow();
-  }
-
-  if (info.isAvailable()) {
-    // Note: request.response.output is used instead of request.response because
-    // evidently HAPI does not allow headers to be set on the latter in case of
-    // error responses.
-    const response = isErrorResponse ? request.response.output : request.response;
-    response.headers['kbn-xpack-sig'] = info.getSignature();
-  }
-
-  return h.continue;
-}
diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/replace_injected_vars.js b/x-pack/legacy/plugins/xpack_main/server/lib/replace_injected_vars.js
deleted file mode 100644
index f09f97d44bfe8b..00000000000000
--- a/x-pack/legacy/plugins/xpack_main/server/lib/replace_injected_vars.js
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { KibanaRequest } from '../../../../../../src/core/server';
-
-export async function replaceInjectedVars(originalInjectedVars, request, server) {
-  const xpackInfo = server.plugins.xpack_main.info;
-
-  const withXpackInfo = async () => ({
-    ...originalInjectedVars,
-    xpackInitialInfo: xpackInfo.isAvailable() ? xpackInfo.toJSON() : undefined,
-  });
-
-  // security feature is disabled
-  if (!server.plugins.security || !server.newPlatform.setup.plugins.security) {
-    return await withXpackInfo();
-  }
-
-  // not enough license info to make decision one way or another
-  if (!xpackInfo.isAvailable()) {
-    return originalInjectedVars;
-  }
-
-  // request is not authenticated
-  if (
-    !(await server.newPlatform.setup.plugins.security.authc.isAuthenticated(
-      KibanaRequest.from(request)
-    ))
-  ) {
-    return originalInjectedVars;
-  }
-
-  // plugin enabled, license is appropriate, request is authenticated
-  return await withXpackInfo();
-}
diff --git a/x-pack/legacy/plugins/xpack_main/server/lib/setup_xpack_main.js b/x-pack/legacy/plugins/xpack_main/server/lib/setup_xpack_main.js
index 9196b210bba20a..33b551bbe864ff 100644
--- a/x-pack/legacy/plugins/xpack_main/server/lib/setup_xpack_main.js
+++ b/x-pack/legacy/plugins/xpack_main/server/lib/setup_xpack_main.js
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { injectXPackInfoSignature } from './inject_xpack_info_signature';
 import { XPackInfo } from './xpack_info';
 
 /**
@@ -20,11 +19,6 @@ export function setupXPackMain(server) {
 
   server.expose('info', info);
 
-  server.ext('onPreResponse', (request, h) => injectXPackInfoSignature(info, request, h));
-
-  const { getFeatures } = server.newPlatform.setup.plugins.features;
-  server.expose('getFeatures', getFeatures);
-
   const setPluginStatus = () => {
     if (info.isAvailable()) {
       server.plugins.xpack_main.status.green('Ready');
diff --git a/x-pack/legacy/plugins/xpack_main/server/xpack_main.d.ts b/x-pack/legacy/plugins/xpack_main/server/xpack_main.d.ts
index 2a59c2f1366d4a..f4363a8e57b37c 100644
--- a/x-pack/legacy/plugins/xpack_main/server/xpack_main.d.ts
+++ b/x-pack/legacy/plugins/xpack_main/server/xpack_main.d.ts
@@ -11,5 +11,4 @@ export { XPackFeature } from './lib/xpack_info';
 
 export interface XPackMainPlugin {
   info: XPackInfo;
-  getFeatures(): Feature[];
 }
diff --git a/x-pack/package.json b/x-pack/package.json
index d49188b29481be..899eca10959231 100644
--- a/x-pack/package.json
+++ b/x-pack/package.json
@@ -159,7 +159,7 @@
     "copy-to-clipboard": "^3.0.8",
     "copy-webpack-plugin": "^6.0.2",
     "cronstrue": "^1.51.0",
-    "cypress": "4.11.0",
+    "cypress": "5.0.0",
     "cypress-multi-reporters": "^1.2.3",
     "d3": "3.5.17",
     "d3-scale": "1.0.7",
@@ -276,7 +276,7 @@
     "@babel/runtime": "^7.11.2",
     "@elastic/datemath": "5.0.3",
     "@elastic/ems-client": "7.9.3",
-    "@elastic/eui": "27.4.1",
+    "@elastic/eui": "28.2.0",
     "@elastic/filesaver": "1.1.2",
     "@elastic/node-crypto": "1.2.1",
     "@elastic/numeral": "^2.5.0",
@@ -305,6 +305,7 @@
     "concat-stream": "1.6.2",
     "content-disposition": "0.5.3",
     "cytoscape": "^3.10.0",
+    "cytoscape-dagre": "^2.2.2",
     "d3-array": "1.2.4",
     "dedent": "^0.7.0",
     "del": "^5.1.0",
@@ -313,6 +314,7 @@
     "file-type": "^10.9.0",
     "font-awesome": "4.7.0",
     "fp-ts": "^2.3.1",
+    "geojson-vt": "^3.2.1",
     "get-port": "^5.0.0",
     "getos": "^3.1.0",
     "git-url-parse": "11.1.2",
@@ -384,6 +386,7 @@
     "ui-select": "0.19.8",
     "uuid": "3.3.2",
     "vscode-languageserver": "^5.2.1",
+    "vt-pbf": "^3.1.1",
     "webpack": "^4.41.5",
     "wellknown": "^0.5.0",
     "xml2js": "^0.4.22",
diff --git a/x-pack/plugins/actions/server/builtin_action_types/lib/axios_utils.test.ts b/x-pack/plugins/actions/server/builtin_action_types/lib/axios_utils.test.ts
index 844aa6d2de7ed4..7e938e766657c0 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/lib/axios_utils.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/lib/axios_utils.test.ts
@@ -65,7 +65,7 @@ describe('request', () => {
       logger,
       proxySettings: {
         proxyUrl: 'http://localhost:1212',
-        rejectUnauthorizedCertificates: false,
+        proxyRejectUnauthorizedCertificates: false,
       },
     });
 
diff --git a/x-pack/plugins/actions/server/builtin_action_types/lib/get_proxy_agent.test.ts b/x-pack/plugins/actions/server/builtin_action_types/lib/get_proxy_agent.test.ts
index 2468fab8c6ac5b..8623a67e8a68ee 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/lib/get_proxy_agent.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/lib/get_proxy_agent.test.ts
@@ -14,7 +14,7 @@ const logger = loggingSystemMock.create().get() as jest.Mocked<Logger>;
 describe('getProxyAgent', () => {
   test('return HttpsProxyAgent for https proxy url', () => {
     const agent = getProxyAgent(
-      { proxyUrl: 'https://someproxyhost', rejectUnauthorizedCertificates: false },
+      { proxyUrl: 'https://someproxyhost', proxyRejectUnauthorizedCertificates: false },
       logger
     );
     expect(agent instanceof HttpsProxyAgent).toBeTruthy();
@@ -22,7 +22,7 @@ describe('getProxyAgent', () => {
 
   test('return HttpProxyAgent for http proxy url', () => {
     const agent = getProxyAgent(
-      { proxyUrl: 'http://someproxyhost', rejectUnauthorizedCertificates: false },
+      { proxyUrl: 'http://someproxyhost', proxyRejectUnauthorizedCertificates: false },
       logger
     );
     expect(agent instanceof HttpProxyAgent).toBeTruthy();
diff --git a/x-pack/plugins/actions/server/builtin_action_types/lib/get_proxy_agent.ts b/x-pack/plugins/actions/server/builtin_action_types/lib/get_proxy_agent.ts
index bb4dadd3a46987..957d31546b019d 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/lib/get_proxy_agent.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/lib/get_proxy_agent.ts
@@ -23,7 +23,7 @@ export function getProxyAgent(
       protocol: proxyUrl.protocol,
       headers: proxySettings.proxyHeaders,
       // do not fail on invalid certs if value is false
-      rejectUnauthorized: proxySettings.rejectUnauthorizedCertificates,
+      rejectUnauthorized: proxySettings.proxyRejectUnauthorizedCertificates,
     });
   } else {
     return new HttpProxyAgent(proxySettings.proxyUrl);
diff --git a/x-pack/plugins/actions/server/builtin_action_types/lib/send_email.test.ts b/x-pack/plugins/actions/server/builtin_action_types/lib/send_email.test.ts
index f69a2fc1d209c4..b6c4a4ea882e5a 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/lib/send_email.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/lib/send_email.test.ts
@@ -73,7 +73,7 @@ describe('send_email module', () => {
       },
       {
         proxyUrl: 'https://example.com',
-        rejectUnauthorizedCertificates: false,
+        proxyRejectUnauthorizedCertificates: false,
       }
     );
     // @ts-expect-error
@@ -140,6 +140,9 @@ describe('send_email module', () => {
           "host": "example.com",
           "port": 1025,
           "secure": false,
+          "tls": Object {
+            "rejectUnauthorized": undefined,
+          },
         },
       ]
     `);
diff --git a/x-pack/plugins/actions/server/builtin_action_types/lib/send_email.ts b/x-pack/plugins/actions/server/builtin_action_types/lib/send_email.ts
index a4f32f1880cb5d..dead8fee63d4ff 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/lib/send_email.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/lib/send_email.ts
@@ -19,6 +19,7 @@ export interface SendEmailOptions {
   routing: Routing;
   content: Content;
   proxySettings?: ProxySettings;
+  rejectUnauthorized?: boolean;
 }
 
 // config validation ensures either service is set or host/port are set
@@ -45,7 +46,7 @@ export interface Content {
 
 // send an email
 export async function sendEmail(logger: Logger, options: SendEmailOptions): Promise<unknown> {
-  const { transport, routing, content, proxySettings } = options;
+  const { transport, routing, content, proxySettings, rejectUnauthorized } = options;
   const { service, host, port, secure, user, password } = transport;
   const { from, to, cc, bcc } = routing;
   const { subject, message } = content;
@@ -68,15 +69,18 @@ export async function sendEmail(logger: Logger, options: SendEmailOptions): Prom
     transportConfig.host = host;
     transportConfig.port = port;
     transportConfig.secure = !!secure;
-    if (proxySettings && !transportConfig.secure) {
+
+    if (proxySettings) {
       transportConfig.tls = {
         // do not fail on invalid certs if value is false
-        rejectUnauthorized: proxySettings?.rejectUnauthorizedCertificates,
+        rejectUnauthorized: proxySettings?.proxyRejectUnauthorizedCertificates,
       };
-    }
-    if (proxySettings) {
       transportConfig.proxy = proxySettings.proxyUrl;
       transportConfig.headers = proxySettings.proxyHeaders;
+    } else if (!transportConfig.secure) {
+      transportConfig.tls = {
+        rejectUnauthorized,
+      };
     }
   }
 
diff --git a/x-pack/plugins/actions/server/builtin_action_types/slack.test.ts b/x-pack/plugins/actions/server/builtin_action_types/slack.test.ts
index b15d92cecba622..d98a41ed1f3556 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/slack.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/slack.test.ts
@@ -167,7 +167,7 @@ describe('execute()', () => {
       params: { message: 'this invocation should succeed' },
       proxySettings: {
         proxyUrl: 'https://someproxyhost',
-        rejectUnauthorizedCertificates: false,
+        proxyRejectUnauthorizedCertificates: false,
       },
     });
     expect(response).toMatchInlineSnapshot(`
@@ -206,7 +206,7 @@ describe('execute()', () => {
       params: { message: 'this invocation should succeed' },
       proxySettings: {
         proxyUrl: 'https://someproxyhost',
-        rejectUnauthorizedCertificates: false,
+        proxyRejectUnauthorizedCertificates: false,
       },
     });
     expect(mockedLogger.debug).toHaveBeenCalledWith(
diff --git a/x-pack/plugins/actions/server/config.test.ts b/x-pack/plugins/actions/server/config.test.ts
index ac815a425a2b7d..1d7edd5f6b38fa 100644
--- a/x-pack/plugins/actions/server/config.test.ts
+++ b/x-pack/plugins/actions/server/config.test.ts
@@ -18,7 +18,8 @@ describe('config validation', () => {
           "*",
         ],
         "preconfigured": Object {},
-        "rejectUnauthorizedCertificates": true,
+        "proxyRejectUnauthorizedCertificates": true,
+        "rejectUnauthorized": true,
       }
     `);
   });
@@ -34,7 +35,8 @@ describe('config validation', () => {
           },
         },
       },
-      rejectUnauthorizedCertificates: false,
+      proxyRejectUnauthorizedCertificates: false,
+      rejectUnauthorized: false,
     };
     expect(configSchema.validate(config)).toMatchInlineSnapshot(`
       Object {
@@ -55,7 +57,8 @@ describe('config validation', () => {
             "secrets": Object {},
           },
         },
-        "rejectUnauthorizedCertificates": false,
+        "proxyRejectUnauthorizedCertificates": false,
+        "rejectUnauthorized": false,
       }
     `);
   });
diff --git a/x-pack/plugins/actions/server/config.ts b/x-pack/plugins/actions/server/config.ts
index 087a08f572c65e..8823cea9f44525 100644
--- a/x-pack/plugins/actions/server/config.ts
+++ b/x-pack/plugins/actions/server/config.ts
@@ -34,7 +34,8 @@ export const configSchema = schema.object({
   }),
   proxyUrl: schema.maybe(schema.string()),
   proxyHeaders: schema.maybe(schema.recordOf(schema.string(), schema.string())),
-  rejectUnauthorizedCertificates: schema.boolean({ defaultValue: true }),
+  proxyRejectUnauthorizedCertificates: schema.boolean({ defaultValue: true }),
+  rejectUnauthorized: schema.boolean({ defaultValue: true }),
 });
 
 export type ActionsConfig = TypeOf<typeof configSchema>;
diff --git a/x-pack/plugins/actions/server/index.ts b/x-pack/plugins/actions/server/index.ts
index fef70c3a484552..31c4d26d1793e7 100644
--- a/x-pack/plugins/actions/server/index.ts
+++ b/x-pack/plugins/actions/server/index.ts
@@ -4,11 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { PluginInitializerContext } from '../../../../src/core/server';
+import { PluginInitializerContext, PluginConfigDescriptor } from '../../../../src/core/server';
 import { ActionsPlugin } from './plugin';
 import { configSchema } from './config';
 import { ActionsClient as ActionsClientClass } from './actions_client';
 import { ActionsAuthorization as ActionsAuthorizationClass } from './authorization/actions_authorization';
+import { ActionsConfigType } from './types';
 
 export type ActionsClient = PublicMethodsOf<ActionsClientClass>;
 export type ActionsAuthorization = PublicMethodsOf<ActionsAuthorizationClass>;
@@ -24,6 +25,9 @@ export { PluginSetupContract, PluginStartContract } from './plugin';
 
 export const plugin = (initContext: PluginInitializerContext) => new ActionsPlugin(initContext);
 
-export const config = {
+export const config: PluginConfigDescriptor<ActionsConfigType> = {
   schema: configSchema,
+  deprecations: ({ renameFromRoot }) => [
+    renameFromRoot('xpack.actions.whitelistedHosts', 'xpack.actions.allowedHosts'),
+  ],
 };
diff --git a/x-pack/plugins/actions/server/plugin.test.ts b/x-pack/plugins/actions/server/plugin.test.ts
index 4fdf9f25235686..9d545600e61ee0 100644
--- a/x-pack/plugins/actions/server/plugin.test.ts
+++ b/x-pack/plugins/actions/server/plugin.test.ts
@@ -34,7 +34,8 @@ describe('Actions Plugin', () => {
         enabledActionTypes: ['*'],
         allowedHosts: ['*'],
         preconfigured: {},
-        rejectUnauthorizedCertificates: true,
+        proxyRejectUnauthorizedCertificates: true,
+        rejectUnauthorized: true,
       });
       plugin = new ActionsPlugin(context);
       coreSetup = coreMock.createSetup();
@@ -195,7 +196,8 @@ describe('Actions Plugin', () => {
             secrets: {},
           },
         },
-        rejectUnauthorizedCertificates: true,
+        proxyRejectUnauthorizedCertificates: true,
+        rejectUnauthorized: true,
       });
       plugin = new ActionsPlugin(context);
       coreSetup = coreMock.createSetup();
diff --git a/x-pack/plugins/actions/server/plugin.ts b/x-pack/plugins/actions/server/plugin.ts
index 413e6663105b82..a6c58992816582 100644
--- a/x-pack/plugins/actions/server/plugin.ts
+++ b/x-pack/plugins/actions/server/plugin.ts
@@ -323,7 +323,8 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
           ? {
               proxyUrl: this.actionsConfig.proxyUrl,
               proxyHeaders: this.actionsConfig.proxyHeaders,
-              rejectUnauthorizedCertificates: this.actionsConfig.rejectUnauthorizedCertificates,
+              proxyRejectUnauthorizedCertificates: this.actionsConfig
+                .proxyRejectUnauthorizedCertificates,
             }
           : undefined,
     });
diff --git a/x-pack/plugins/actions/server/types.ts b/x-pack/plugins/actions/server/types.ts
index 0a7d6bf01b7ecb..3e92ca331bb93e 100644
--- a/x-pack/plugins/actions/server/types.ts
+++ b/x-pack/plugins/actions/server/types.ts
@@ -145,5 +145,5 @@ export interface ActionTaskExecutorParams {
 export interface ProxySettings {
   proxyUrl: string;
   proxyHeaders?: Record<string, string>;
-  rejectUnauthorizedCertificates: boolean;
+  proxyRejectUnauthorizedCertificates: boolean;
 }
diff --git a/x-pack/plugins/alerts/server/plugin.ts b/x-pack/plugins/alerts/server/plugin.ts
index d5843bd531d848..b16ded9fb5c91a 100644
--- a/x-pack/plugins/alerts/server/plugin.ts
+++ b/x-pack/plugins/alerts/server/plugin.ts
@@ -152,13 +152,14 @@ export class AlertingPlugin {
       );
     }
 
+    this.eventLogger = plugins.eventLog.getLogger({
+      event: { provider: EVENT_LOG_PROVIDER },
+    });
+
     setupSavedObjects(core.savedObjects, plugins.encryptedSavedObjects);
 
     this.eventLogService = plugins.eventLog;
     plugins.eventLog.registerProviderActions(EVENT_LOG_PROVIDER, Object.values(EVENT_LOG_ACTIONS));
-    this.eventLogger = plugins.eventLog.getLogger({
-      event: { provider: EVENT_LOG_PROVIDER },
-    });
 
     const alertTypeRegistry = new AlertTypeRegistry({
       taskManager: plugins.taskManager,
diff --git a/x-pack/plugins/alerts/server/saved_objects/index.ts b/x-pack/plugins/alerts/server/saved_objects/index.ts
index c98d9bcbd9ae55..06ce8d673e6b71 100644
--- a/x-pack/plugins/alerts/server/saved_objects/index.ts
+++ b/x-pack/plugins/alerts/server/saved_objects/index.ts
@@ -6,6 +6,7 @@
 
 import { SavedObjectsServiceSetup } from 'kibana/server';
 import mappings from './mappings.json';
+import { getMigrations } from './migrations';
 import { EncryptedSavedObjectsPluginSetup } from '../../../encrypted_saved_objects/server';
 
 export function setupSavedObjects(
@@ -16,6 +17,7 @@ export function setupSavedObjects(
     name: 'alert',
     hidden: true,
     namespaceType: 'single',
+    migrations: getMigrations(encryptedSavedObjects),
     mappings: mappings.alert,
   });
 
diff --git a/x-pack/plugins/alerts/server/saved_objects/migrations.test.ts b/x-pack/plugins/alerts/server/saved_objects/migrations.test.ts
new file mode 100644
index 00000000000000..46fa2bcd512ff3
--- /dev/null
+++ b/x-pack/plugins/alerts/server/saved_objects/migrations.test.ts
@@ -0,0 +1,135 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import uuid from 'uuid';
+import { getMigrations } from './migrations';
+import { RawAlert } from '../types';
+import { SavedObjectUnsanitizedDoc } from 'kibana/server';
+import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/mocks';
+import { migrationMocks } from 'src/core/server/mocks';
+
+const { log } = migrationMocks.createContext();
+const encryptedSavedObjectsSetup = encryptedSavedObjectsMock.createSetup();
+
+describe('7.10.0', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+    encryptedSavedObjectsSetup.createMigration.mockImplementation(
+      (shouldMigrateWhenPredicate, migration) => migration
+    );
+  });
+
+  test('changes nothing on alerts by other plugins', () => {
+    const migration710 = getMigrations(encryptedSavedObjectsSetup)['7.10.0'];
+    const alert = getMockData({});
+    expect(migration710(alert, { log })).toMatchObject(alert);
+
+    expect(encryptedSavedObjectsSetup.createMigration).toHaveBeenCalledWith(
+      expect.any(Function),
+      expect.any(Function)
+    );
+  });
+
+  test('migrates the consumer for metrics', () => {
+    const migration710 = getMigrations(encryptedSavedObjectsSetup)['7.10.0'];
+    const alert = getMockData({
+      consumer: 'metrics',
+    });
+    expect(migration710(alert, { log })).toMatchObject({
+      ...alert,
+      attributes: {
+        ...alert.attributes,
+        consumer: 'infrastructure',
+      },
+    });
+  });
+
+  test('migrates the consumer for alerting', () => {
+    const migration710 = getMigrations(encryptedSavedObjectsSetup)['7.10.0'];
+    const alert = getMockData({
+      consumer: 'alerting',
+    });
+    expect(migration710(alert, { log })).toMatchObject({
+      ...alert,
+      attributes: {
+        ...alert.attributes,
+        consumer: 'alerts',
+      },
+    });
+  });
+});
+
+describe('7.10.0 migrates with failure', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+    encryptedSavedObjectsSetup.createMigration.mockRejectedValueOnce(
+      new Error(`Can't migrate!`) as never
+    );
+  });
+
+  test('should show the proper exception', () => {
+    const migration710 = getMigrations(encryptedSavedObjectsSetup)['7.10.0'];
+    const alert = getMockData({
+      consumer: 'alerting',
+    });
+    const res = migration710(alert, { log });
+    expect(res).toMatchObject({
+      ...alert,
+      attributes: {
+        ...alert.attributes,
+      },
+    });
+    expect(log.error).toHaveBeenCalledWith(
+      `encryptedSavedObject migration failed for alert ${alert.id} with error: migrationFunc is not a function`,
+      {
+        alertDocument: {
+          ...alert,
+          attributes: {
+            ...alert.attributes,
+          },
+        },
+      }
+    );
+  });
+});
+
+function getMockData(
+  overwrites: Record<string, unknown> = {}
+): SavedObjectUnsanitizedDoc<RawAlert> {
+  return {
+    attributes: {
+      enabled: true,
+      name: 'abc',
+      tags: ['foo'],
+      alertTypeId: '123',
+      consumer: 'bar',
+      apiKey: '',
+      apiKeyOwner: '',
+      schedule: { interval: '10s' },
+      throttle: null,
+      params: {
+        bar: true,
+      },
+      muteAll: false,
+      mutedInstanceIds: [],
+      createdBy: new Date().toISOString(),
+      updatedBy: new Date().toISOString(),
+      createdAt: new Date().toISOString(),
+      actions: [
+        {
+          group: 'default',
+          actionRef: '1',
+          actionTypeId: '1',
+          params: {
+            foo: true,
+          },
+        },
+      ],
+      ...overwrites,
+    },
+    id: uuid.v4(),
+    type: 'alert',
+  };
+}
diff --git a/x-pack/plugins/alerts/server/saved_objects/migrations.ts b/x-pack/plugins/alerts/server/saved_objects/migrations.ts
new file mode 100644
index 00000000000000..30570eeb0a4530
--- /dev/null
+++ b/x-pack/plugins/alerts/server/saved_objects/migrations.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import {
+  SavedObjectMigrationMap,
+  SavedObjectUnsanitizedDoc,
+  SavedObjectMigrationFn,
+  SavedObjectMigrationContext,
+} from '../../../../../src/core/server';
+import { RawAlert } from '../types';
+import { EncryptedSavedObjectsPluginSetup } from '../../../encrypted_saved_objects/server';
+
+export function getMigrations(
+  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup
+): SavedObjectMigrationMap {
+  const alertsMigration = changeAlertingConsumer(encryptedSavedObjects, 'alerting', 'alerts');
+
+  const infrastructureMigration = changeAlertingConsumer(
+    encryptedSavedObjects,
+    'metrics',
+    'infrastructure'
+  );
+
+  return {
+    '7.10.0': (doc: SavedObjectUnsanitizedDoc<RawAlert>, context: SavedObjectMigrationContext) => {
+      if (doc.attributes.consumer === 'alerting') {
+        return executeMigration(doc, context, alertsMigration);
+      } else if (doc.attributes.consumer === 'metrics') {
+        return executeMigration(doc, context, infrastructureMigration);
+      }
+      return doc;
+    },
+  };
+}
+
+function executeMigration(
+  doc: SavedObjectUnsanitizedDoc<RawAlert>,
+  context: SavedObjectMigrationContext,
+  migrationFunc: SavedObjectMigrationFn<RawAlert, RawAlert>
+) {
+  try {
+    return migrationFunc(doc, context);
+  } catch (ex) {
+    context.log.error(
+      `encryptedSavedObject migration failed for alert ${doc.id} with error: ${ex.message}`,
+      { alertDocument: doc }
+    );
+  }
+  return doc;
+}
+
+function changeAlertingConsumer(
+  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup,
+  from: string,
+  to: string
+): SavedObjectMigrationFn<RawAlert, RawAlert> {
+  return encryptedSavedObjects.createMigration<RawAlert, RawAlert>(
+    function shouldBeMigrated(doc): doc is SavedObjectUnsanitizedDoc<RawAlert> {
+      return doc.attributes.consumer === from;
+    },
+    (doc: SavedObjectUnsanitizedDoc<RawAlert>): SavedObjectUnsanitizedDoc<RawAlert> => {
+      const {
+        attributes: { consumer },
+      } = doc;
+      return {
+        ...doc,
+        attributes: {
+          ...doc.attributes,
+          consumer: consumer === from ? to : consumer,
+        },
+      };
+    }
+  );
+}
diff --git a/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap b/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap
index 708758f2c6e585..e9763082a3999f 100644
--- a/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap
+++ b/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap
@@ -536,61 +536,54 @@ exports[`APM telemetry helpers getApmTelemetry generates a JSON object with the
                             },
                             "transaction_count": {
                               "type": "long"
-                            }
-                          }
-                        },
-                        "no_observer_name": {
-                          "properties": {
-                            "expected_metric_document_count": {
-                              "type": "long"
                             },
-                            "transaction_count": {
+                            "ratio": {
                               "type": "long"
                             }
                           }
                         },
-                        "no_rum": {
+                        "no_observer_name": {
                           "properties": {
                             "expected_metric_document_count": {
                               "type": "long"
                             },
                             "transaction_count": {
                               "type": "long"
-                            }
-                          }
-                        },
-                        "no_rum_no_observer_name": {
-                          "properties": {
-                            "expected_metric_document_count": {
-                              "type": "long"
                             },
-                            "transaction_count": {
+                            "ratio": {
                               "type": "long"
                             }
                           }
                         },
-                        "only_rum": {
+                        "with_country": {
                           "properties": {
                             "expected_metric_document_count": {
                               "type": "long"
                             },
                             "transaction_count": {
                               "type": "long"
-                            }
-                          }
-                        },
-                        "only_rum_no_observer_name": {
-                          "properties": {
-                            "expected_metric_document_count": {
-                              "type": "long"
                             },
-                            "transaction_count": {
+                            "ratio": {
                               "type": "long"
                             }
                           }
                         }
                       }
                     },
+                    "environments": {
+                      "properties": {
+                        "services_without_environment": {
+                          "type": "long"
+                        },
+                        "services_with_multiple_environments": {
+                          "type": "long"
+                        },
+                        "top_enviroments": {
+                          "type": "keyword",
+                          "ignore_above": 1024
+                        }
+                      }
+                    },
                     "cloud": {
                       "properties": {
                         "availability_zone": {
@@ -952,6 +945,17 @@ exports[`APM telemetry helpers getApmTelemetry generates a JSON object with the
                             }
                           }
                         },
+                        "environments": {
+                          "properties": {
+                            "took": {
+                              "properties": {
+                                "ms": {
+                                  "type": "long"
+                                }
+                              }
+                            }
+                          }
+                        },
                         "groupings": {
                           "properties": {
                             "took": {
diff --git a/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap b/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
index 7c42fb6f12a54a..6238fbfdaa1ab5 100644
--- a/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
+++ b/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
@@ -34,6 +34,8 @@ exports[`Error ERROR_LOG_MESSAGE 1`] = `undefined`;
 
 exports[`Error ERROR_PAGE_URL 1`] = `undefined`;
 
+exports[`Error EVENT_OUTCOME 1`] = `undefined`;
+
 exports[`Error HOST_NAME 1`] = `"my hostname"`;
 
 exports[`Error HTTP_REQUEST_METHOD 1`] = `undefined`;
@@ -68,9 +70,9 @@ exports[`Error METRIC_SYSTEM_FREE_MEMORY 1`] = `undefined`;
 
 exports[`Error METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
-exports[`Error OBSERVER_LISTENING 1`] = `undefined`;
+exports[`Error OBSERVER_HOSTNAME 1`] = `undefined`;
 
-exports[`Error OBSERVER_NAME 1`] = `"an observer"`;
+exports[`Error OBSERVER_LISTENING 1`] = `undefined`;
 
 exports[`Error OBSERVER_VERSION_MAJOR 1`] = `8`;
 
@@ -120,6 +122,8 @@ exports[`Error TRACE_ID 1`] = `"trace id"`;
 
 exports[`Error TRANSACTION_BREAKDOWN_COUNT 1`] = `undefined`;
 
+exports[`Error TRANSACTION_DOM_INTERACTIVE 1`] = `undefined`;
+
 exports[`Error TRANSACTION_DURATION 1`] = `undefined`;
 
 exports[`Error TRANSACTION_ID 1`] = `"transaction id"`;
@@ -132,6 +136,8 @@ exports[`Error TRANSACTION_RESULT 1`] = `undefined`;
 
 exports[`Error TRANSACTION_SAMPLED 1`] = `undefined`;
 
+exports[`Error TRANSACTION_TIME_TO_FIRST_BYTE 1`] = `undefined`;
+
 exports[`Error TRANSACTION_TYPE 1`] = `"request"`;
 
 exports[`Error TRANSACTION_URL 1`] = `undefined`;
@@ -182,6 +188,8 @@ exports[`Span ERROR_LOG_MESSAGE 1`] = `undefined`;
 
 exports[`Span ERROR_PAGE_URL 1`] = `undefined`;
 
+exports[`Span EVENT_OUTCOME 1`] = `undefined`;
+
 exports[`Span HOST_NAME 1`] = `undefined`;
 
 exports[`Span HTTP_REQUEST_METHOD 1`] = `undefined`;
@@ -216,9 +224,9 @@ exports[`Span METRIC_SYSTEM_FREE_MEMORY 1`] = `undefined`;
 
 exports[`Span METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
-exports[`Span OBSERVER_LISTENING 1`] = `undefined`;
+exports[`Span OBSERVER_HOSTNAME 1`] = `undefined`;
 
-exports[`Span OBSERVER_NAME 1`] = `"an observer"`;
+exports[`Span OBSERVER_LISTENING 1`] = `undefined`;
 
 exports[`Span OBSERVER_VERSION_MAJOR 1`] = `8`;
 
@@ -268,6 +276,8 @@ exports[`Span TRACE_ID 1`] = `"trace id"`;
 
 exports[`Span TRANSACTION_BREAKDOWN_COUNT 1`] = `undefined`;
 
+exports[`Span TRANSACTION_DOM_INTERACTIVE 1`] = `undefined`;
+
 exports[`Span TRANSACTION_DURATION 1`] = `undefined`;
 
 exports[`Span TRANSACTION_ID 1`] = `"transaction id"`;
@@ -280,6 +290,8 @@ exports[`Span TRANSACTION_RESULT 1`] = `undefined`;
 
 exports[`Span TRANSACTION_SAMPLED 1`] = `undefined`;
 
+exports[`Span TRANSACTION_TIME_TO_FIRST_BYTE 1`] = `undefined`;
+
 exports[`Span TRANSACTION_TYPE 1`] = `undefined`;
 
 exports[`Span TRANSACTION_URL 1`] = `undefined`;
@@ -330,6 +342,8 @@ exports[`Transaction ERROR_LOG_MESSAGE 1`] = `undefined`;
 
 exports[`Transaction ERROR_PAGE_URL 1`] = `undefined`;
 
+exports[`Transaction EVENT_OUTCOME 1`] = `undefined`;
+
 exports[`Transaction HOST_NAME 1`] = `"my hostname"`;
 
 exports[`Transaction HTTP_REQUEST_METHOD 1`] = `"GET"`;
@@ -364,9 +378,9 @@ exports[`Transaction METRIC_SYSTEM_FREE_MEMORY 1`] = `undefined`;
 
 exports[`Transaction METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
-exports[`Transaction OBSERVER_LISTENING 1`] = `undefined`;
+exports[`Transaction OBSERVER_HOSTNAME 1`] = `undefined`;
 
-exports[`Transaction OBSERVER_NAME 1`] = `"an observer"`;
+exports[`Transaction OBSERVER_LISTENING 1`] = `undefined`;
 
 exports[`Transaction OBSERVER_VERSION_MAJOR 1`] = `8`;
 
@@ -416,6 +430,8 @@ exports[`Transaction TRACE_ID 1`] = `"trace id"`;
 
 exports[`Transaction TRANSACTION_BREAKDOWN_COUNT 1`] = `undefined`;
 
+exports[`Transaction TRANSACTION_DOM_INTERACTIVE 1`] = `undefined`;
+
 exports[`Transaction TRANSACTION_DURATION 1`] = `1337`;
 
 exports[`Transaction TRANSACTION_ID 1`] = `"transaction id"`;
@@ -428,6 +444,8 @@ exports[`Transaction TRANSACTION_RESULT 1`] = `"transaction result"`;
 
 exports[`Transaction TRANSACTION_SAMPLED 1`] = `true`;
 
+exports[`Transaction TRANSACTION_TIME_TO_FIRST_BYTE 1`] = `undefined`;
+
 exports[`Transaction TRANSACTION_TYPE 1`] = `"transaction type"`;
 
 exports[`Transaction TRANSACTION_URL 1`] = `undefined`;
diff --git a/x-pack/plugins/apm/common/apm_telemetry.ts b/x-pack/plugins/apm/common/apm_telemetry.ts
index 318b956cd3b3e9..3e885f4948c1e4 100644
--- a/x-pack/plugins/apm/common/apm_telemetry.ts
+++ b/x-pack/plugins/apm/common/apm_telemetry.ts
@@ -78,6 +78,7 @@ export function getApmTelemetryMapping() {
     properties: {
       expected_metric_document_count: long,
       transaction_count: long,
+      ratio: long,
     },
   };
 
@@ -102,10 +103,14 @@ export function getApmTelemetryMapping() {
         properties: {
           current_implementation: aggregatedTransactionsProperties,
           no_observer_name: aggregatedTransactionsProperties,
-          no_rum: aggregatedTransactionsProperties,
-          no_rum_no_observer_name: aggregatedTransactionsProperties,
-          only_rum: aggregatedTransactionsProperties,
-          only_rum_no_observer_name: aggregatedTransactionsProperties,
+          with_country: aggregatedTransactionsProperties,
+        },
+      },
+      environments: {
+        properties: {
+          services_without_environment: long,
+          services_with_multiple_environments: long,
+          top_enviroments: keyword,
         },
       },
       cloud: {
@@ -227,6 +232,7 @@ export function getApmTelemetryMapping() {
           agents: tookProperties,
           cardinality: tookProperties,
           cloud: tookProperties,
+          environments: tookProperties,
           groupings: tookProperties,
           indices_stats: tookProperties,
           integrations: tookProperties,
diff --git a/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts b/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
index 610a32e8e9b99b..c13169549a5666 100644
--- a/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
+++ b/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
@@ -31,7 +31,7 @@ export const USER_AGENT_NAME = 'user_agent.name';
 
 export const DESTINATION_ADDRESS = 'destination.address';
 
-export const OBSERVER_NAME = 'observer.name';
+export const OBSERVER_HOSTNAME = 'observer.hostname';
 export const OBSERVER_VERSION_MAJOR = 'observer.version_major';
 export const OBSERVER_LISTENING = 'observer.listening';
 export const PROCESSOR_EVENT = 'processor.event';
@@ -45,6 +45,8 @@ export const TRANSACTION_SAMPLED = 'transaction.sampled';
 export const TRANSACTION_BREAKDOWN_COUNT = 'transaction.breakdown.count';
 export const TRANSACTION_PAGE_URL = 'transaction.page.url';
 
+export const EVENT_OUTCOME = 'event.outcome';
+
 export const TRACE_ID = 'trace.id';
 
 export const SPAN_DURATION = 'span.duration.us';
@@ -99,3 +101,8 @@ export const TRANSACTION_URL = 'transaction.page.url';
 export const CLIENT_GEO = 'client.geo';
 export const USER_AGENT_DEVICE = 'user_agent.device.name';
 export const USER_AGENT_OS = 'user_agent.os.name';
+
+export const TRANSACTION_TIME_TO_FIRST_BYTE =
+  'transaction.marks.agent.timeToFirstByte';
+export const TRANSACTION_DOM_INTERACTIVE =
+  'transaction.marks.agent.domInteractive';
diff --git a/x-pack/plugins/apm/common/event_outcome.ts b/x-pack/plugins/apm/common/event_outcome.ts
new file mode 100644
index 00000000000000..5561b27f0aa3a6
--- /dev/null
+++ b/x-pack/plugins/apm/common/event_outcome.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export enum EventOutcome {
+  success = 'success',
+  failure = 'failure',
+  unknown = 'unknown',
+}
diff --git a/x-pack/plugins/apm/public/utils/formatters/__test__/formatters.test.ts b/x-pack/plugins/apm/common/utils/formatters.test.ts
similarity index 96%
rename from x-pack/plugins/apm/public/utils/formatters/__test__/formatters.test.ts
rename to x-pack/plugins/apm/common/utils/formatters.test.ts
index 66101baf3a7461..ce317c5a6a8271 100644
--- a/x-pack/plugins/apm/public/utils/formatters/__test__/formatters.test.ts
+++ b/x-pack/plugins/apm/common/utils/formatters.test.ts
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { asPercent } from '../formatters';
+import { asPercent } from './formatters';
 
 describe('formatters', () => {
   describe('asPercent', () => {
diff --git a/x-pack/plugins/apm/common/utils/formatters.ts b/x-pack/plugins/apm/common/utils/formatters.ts
new file mode 100644
index 00000000000000..f7c609d949adf7
--- /dev/null
+++ b/x-pack/plugins/apm/common/utils/formatters.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import numeral from '@elastic/numeral';
+
+export function asPercent(
+  numerator: number,
+  denominator: number | undefined,
+  fallbackResult = ''
+) {
+  if (!denominator || isNaN(numerator)) {
+    return fallbackResult;
+  }
+
+  const decimal = numerator / denominator;
+
+  // 33.2 => 33%
+  // 3.32 => 3.3%
+  // 0 => 0%
+  if (Math.abs(decimal) >= 0.1 || decimal === 0) {
+    return numeral(decimal).format('0%');
+  }
+
+  return numeral(decimal).format('0.0%');
+}
diff --git a/x-pack/plugins/apm/e2e/cypress/integration/rum_dashboard.feature.disabled b/x-pack/plugins/apm/e2e/cypress/integration/rum_dashboard.feature.disabled
index be1597c8340ebe..727898773904e1 100644
--- a/x-pack/plugins/apm/e2e/cypress/integration/rum_dashboard.feature.disabled
+++ b/x-pack/plugins/apm/e2e/cypress/integration/rum_dashboard.feature.disabled
@@ -12,20 +12,14 @@ Feature: RUM Dashboard
       | os         |
       | location   |
 
-  Scenario: Page load distribution percentiles
+  Scenario: Display RUM Data components
     When a user browses the APM UI application for RUM Data
     Then should display percentile for page load chart
-
-  Scenario: Page load distribution chart tooltip
-    When a user browses the APM UI application for RUM Data
-    Then should display tooltip on hover
-
-  Scenario: Page load distribution chart legends
-    When a user browses the APM UI application for RUM Data
-    Then should display chart legend
+      And should display tooltip on hover
+      And should display chart legend
 
   Scenario: Breakdown filter
-    Given a user click page load breakdown filter
+    Given a user clicks the page load breakdown filter
     When the user selected the breakdown
     Then breakdown series should appear in chart
 
diff --git a/x-pack/plugins/apm/e2e/cypress/support/index.ts b/x-pack/plugins/apm/e2e/cypress/support/index.ts
index 8a7a9f64cc4616..c7e31b095e5aca 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/index.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/index.ts
@@ -21,7 +21,7 @@
 
 import './commands';
 
-// @ts-ignore
+// @ts-expect-error
 import { register } from '@cypress/snapshot';
 
 register();
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/client_metrics_helper.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/client_metrics_helper.ts
new file mode 100644
index 00000000000000..1cc36059b8ff8e
--- /dev/null
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/client_metrics_helper.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { DEFAULT_TIMEOUT } from './rum_dashboard';
+
+/**
+ * Verifies the behavior of the client metrics component
+ * @param metrics array of three elements
+ * @param checkTitleStatus if it's needed to check title elements
+ */
+export function verifyClientMetrics(
+  metrics: string[],
+  checkTitleStatus: boolean
+) {
+  const clientMetricsSelector = '[data-cy=client-metrics] .euiStat__title';
+
+  // wait for all loading to finish
+  cy.get('kbnLoadingIndicator').should('not.be.visible');
+
+  if (checkTitleStatus) {
+    cy.get('.euiStat__title', { timeout: DEFAULT_TIMEOUT }).should(
+      'be.visible'
+    );
+    cy.get('.euiSelect-isLoading').should('not.be.visible');
+  }
+
+  cy.get('.euiStat__title-isLoading').should('not.be.visible');
+
+  cy.get(clientMetricsSelector).eq(0).should('have.text', metrics[0]);
+
+  cy.get(clientMetricsSelector).eq(1).should('have.text', metrics[1]);
+
+  cy.get(clientMetricsSelector).eq(2).should('have.text', metrics[2]);
+}
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/page_load_dist.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/page_load_dist.ts
index f319f7ef986673..d671bdc0078ebf 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/page_load_dist.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/page_load_dist.ts
@@ -9,7 +9,7 @@ import { Given, When, Then } from 'cypress-cucumber-preprocessor/steps';
 /** The default time in ms to wait for a Cypress command to complete */
 export const DEFAULT_TIMEOUT = 60 * 1000;
 
-Given(`a user click page load breakdown filter`, () => {
+Given(`a user clicks the page load breakdown filter`, () => {
   // wait for all loading to finish
   cy.get('kbnLoadingIndicator').should('not.be.visible');
   cy.get('.euiStat__title-isLoading').should('not.be.visible');
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts
index 8e010d5180f881..804974d8d437d7 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts
@@ -6,6 +6,7 @@
 
 import { Given, Then } from 'cypress-cucumber-preprocessor/steps';
 import { loginAndWaitForPage } from '../../../integration/helpers';
+import { verifyClientMetrics } from './client_metrics_helper';
 
 /** The default time in ms to wait for a Cypress command to complete */
 export const DEFAULT_TIMEOUT = 60 * 1000;
@@ -21,19 +22,9 @@ Given(`a user browses the APM UI application for RUM Data`, () => {
 });
 
 Then(`should have correct client metrics`, () => {
-  const clientMetrics = '[data-cy=client-metrics] .euiStat__title';
+  const metrics = ['0.01 sec', '0.08 sec', '55 '];
 
-  // wait for all loading to finish
-  cy.get('kbnLoadingIndicator').should('not.be.visible');
-  cy.get('.euiStat__title', { timeout: DEFAULT_TIMEOUT }).should('be.visible');
-  cy.get('.euiSelect-isLoading').should('not.be.visible');
-  cy.get('.euiStat__title-isLoading').should('not.be.visible');
-
-  cy.get(clientMetrics).eq(2).should('have.text', '55 ');
-
-  cy.get(clientMetrics).eq(1).should('have.text', '0.08 sec');
-
-  cy.get(clientMetrics).eq(0).should('have.text', '0.01 sec');
+  verifyClientMetrics(metrics, true);
 });
 
 Then(`should display percentile for page load chart`, () => {
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/service_name_filter.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/service_name_filter.ts
index b0694c902085ad..68fc4d528543ac 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/service_name_filter.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/service_name_filter.ts
@@ -6,6 +6,7 @@
 
 import { When, Then } from 'cypress-cucumber-preprocessor/steps';
 import { DEFAULT_TIMEOUT } from '../apm';
+import { verifyClientMetrics } from './client_metrics_helper';
 
 When('a user changes the selected service name', (filterName) => {
   // wait for all loading to finish
@@ -16,15 +17,7 @@ When('a user changes the selected service name', (filterName) => {
 });
 
 Then(`it displays relevant client metrics`, () => {
-  const clientMetrics = '[data-cy=client-metrics] .euiStat__title';
+  const metrics = ['0.01 sec', '0.07 sec', '7 '];
 
-  // wait for all loading to finish
-  cy.get('kbnLoadingIndicator').should('not.be.visible');
-  cy.get('.euiStat__title-isLoading').should('not.be.visible');
-
-  cy.get(clientMetrics).eq(2).should('have.text', '7 ');
-
-  cy.get(clientMetrics).eq(1).should('have.text', '0.07 sec');
-
-  cy.get(clientMetrics).eq(0).should('have.text', '0.01 sec');
+  verifyClientMetrics(metrics, false);
 });
diff --git a/x-pack/plugins/apm/e2e/tsconfig.json b/x-pack/plugins/apm/e2e/tsconfig.json
index a7091a20186b2c..c4587349c7ad77 100644
--- a/x-pack/plugins/apm/e2e/tsconfig.json
+++ b/x-pack/plugins/apm/e2e/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "exclude": ["tmp"],
   "include": ["./**/*"],
   "compilerOptions": {
diff --git a/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx b/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
index ecdd52e31730c8..3b118bcd91ff14 100644
--- a/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
@@ -14,7 +14,7 @@ import { mean } from 'lodash';
 import React from 'react';
 import { asRelativeDateTimeRange } from '../../../../utils/formatters';
 import { getTimezoneOffsetInMs } from '../../../shared/charts/CustomPlot/getTimezoneOffsetInMs';
-// @ts-ignore
+// @ts-expect-error
 import Histogram from '../../../shared/charts/Histogram';
 import { EmptyMessage } from '../../../shared/EmptyMessage';
 
diff --git a/x-pack/plugins/apm/public/components/app/Main/route_config/route_handlers/agent_configuration.tsx b/x-pack/plugins/apm/public/components/app/Main/route_config/route_handlers/agent_configuration.tsx
index d99dc4d5cd37a4..7a00840daa3c51 100644
--- a/x-pack/plugins/apm/public/components/app/Main/route_config/route_handlers/agent_configuration.tsx
+++ b/x-pack/plugins/apm/public/components/app/Main/route_config/route_handlers/agent_configuration.tsx
@@ -17,7 +17,7 @@ export function EditAgentConfigurationRouteHandler() {
 
   // typescript complains because `pageStop` does not exist in `APMQueryParams`
   // Going forward we should move away from globally declared query params and this is a first step
-  // @ts-ignore
+  // @ts-expect-error
   const { name, environment, pageStep } = toQuery(search);
 
   const res = useFetcher(
@@ -45,7 +45,7 @@ export function CreateAgentConfigurationRouteHandler() {
   const { search } = history.location;
 
   // Ignoring here because we specifically DO NOT want to add the query params to the global route handler
-  // @ts-ignore
+  // @ts-expect-error
   const { pageStep } = toQuery(search);
 
   return (
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx
index 7e5e7cdc53c555..12d8efdbd27f31 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx
@@ -5,64 +5,85 @@
  */
 
 import React from 'react';
-import { BreakdownGroup } from './BreakdownGroup';
-import { BreakdownItem } from '../../../../../typings/ui_filters';
+import { EuiSuperSelect } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 import {
   CLIENT_GEO_COUNTRY_ISO_CODE,
   USER_AGENT_DEVICE,
   USER_AGENT_NAME,
   USER_AGENT_OS,
 } from '../../../../../common/elasticsearch_fieldnames';
+import { BreakdownItem } from '../../../../../typings/ui_filters';
 
 interface Props {
-  id: string;
-  selectedBreakdowns: BreakdownItem[];
-  onBreakdownChange: (values: BreakdownItem[]) => void;
+  selectedBreakdown: BreakdownItem | null;
+  onBreakdownChange: (value: BreakdownItem | null) => void;
 }
 
 export function BreakdownFilter({
-  id,
-  selectedBreakdowns,
+  selectedBreakdown,
   onBreakdownChange,
 }: Props) {
-  const categories: BreakdownItem[] = [
+  const NO_BREAKDOWN = 'noBreakdown';
+
+  const items: BreakdownItem[] = [
     {
-      name: 'Browser',
+      name: i18n.translate('xpack.apm.csm.breakDownFilter.noBreakdown', {
+        defaultMessage: 'No breakdown',
+      }),
+      fieldName: NO_BREAKDOWN,
       type: 'category',
-      count: 0,
-      selected: selectedBreakdowns.some(({ name }) => name === 'Browser'),
-      fieldName: USER_AGENT_NAME,
     },
     {
-      name: 'OS',
+      name: i18n.translate('xpack.apm.csm.breakdownFilter.browser', {
+        defaultMessage: 'Browser',
+      }),
+      fieldName: USER_AGENT_NAME,
       type: 'category',
-      count: 0,
-      selected: selectedBreakdowns.some(({ name }) => name === 'OS'),
-      fieldName: USER_AGENT_OS,
     },
     {
-      name: 'Device',
+      name: i18n.translate('xpack.apm.csm.breakdownFilter.os', {
+        defaultMessage: 'OS',
+      }),
+      fieldName: USER_AGENT_OS,
       type: 'category',
-      count: 0,
-      selected: selectedBreakdowns.some(({ name }) => name === 'Device'),
-      fieldName: USER_AGENT_DEVICE,
     },
     {
-      name: 'Location',
+      name: i18n.translate('xpack.apm.csm.breakdownFilter.device', {
+        defaultMessage: 'Device',
+      }),
+      fieldName: USER_AGENT_DEVICE,
       type: 'category',
-      count: 0,
-      selected: selectedBreakdowns.some(({ name }) => name === 'Location'),
+    },
+    {
+      name: i18n.translate('xpack.apm.csm.breakdownFilter.location', {
+        defaultMessage: 'Location',
+      }),
       fieldName: CLIENT_GEO_COUNTRY_ISO_CODE,
+      type: 'category',
     },
   ];
 
+  const options = items.map(({ name, fieldName }) => ({
+    inputDisplay: fieldName === NO_BREAKDOWN ? name : <strong>{name}</strong>,
+    value: fieldName,
+    dropdownDisplay: name,
+  }));
+
+  const onOptionChange = (value: string) => {
+    if (value === NO_BREAKDOWN) {
+      onBreakdownChange(null);
+    }
+    onBreakdownChange(items.find(({ fieldName }) => fieldName === value)!);
+  };
+
   return (
-    <BreakdownGroup
-      id={id}
-      items={categories}
-      onChange={(selValues: BreakdownItem[]) => {
-        onBreakdownChange(selValues);
-      }}
+    <EuiSuperSelect
+      fullWidth
+      compressed
+      options={options}
+      valueOfSelected={selectedBreakdown?.fieldName ?? NO_BREAKDOWN}
+      onChange={(value) => onOptionChange(value)}
     />
   );
 }
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownGroup.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownGroup.tsx
deleted file mode 100644
index d4f80667ce98b2..00000000000000
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownGroup.tsx
+++ /dev/null
@@ -1,100 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  EuiPopover,
-  EuiFilterButton,
-  EuiFilterGroup,
-  EuiPopoverTitle,
-  EuiFilterSelectItem,
-} from '@elastic/eui';
-import React, { MouseEvent, useCallback, useEffect, useState } from 'react';
-import { BreakdownItem } from '../../../../../typings/ui_filters';
-import { I18LABELS } from '../translations';
-
-export interface BreakdownGroupProps {
-  id: string;
-  disabled?: boolean;
-  items: BreakdownItem[];
-  onChange: (values: BreakdownItem[]) => void;
-}
-
-export function BreakdownGroup({
-  id,
-  disabled,
-  onChange,
-  items,
-}: BreakdownGroupProps) {
-  const [isOpen, setIsOpen] = useState<boolean>(false);
-
-  const [activeItems, setActiveItems] = useState<BreakdownItem[]>(items);
-
-  useEffect(() => {
-    setActiveItems(items);
-  }, [items]);
-
-  const getSelItems = () => activeItems.filter((item) => item.selected);
-
-  const onFilterItemClick = useCallback(
-    (name: string) => (_event: MouseEvent<HTMLButtonElement>) => {
-      setActiveItems((prevItems) =>
-        prevItems.map((item) => ({
-          ...item,
-          selected: name === item.name ? !item.selected : item.selected,
-        }))
-      );
-    },
-    []
-  );
-
-  return (
-    <EuiFilterGroup>
-      <EuiPopover
-        button={
-          <EuiFilterButton
-            isDisabled={disabled && getSelItems().length === 0}
-            isSelected={getSelItems().length > 0}
-            numFilters={activeItems.length}
-            numActiveFilters={getSelItems().length}
-            hasActiveFilters={getSelItems().length !== 0}
-            iconType="arrowDown"
-            onClick={() => {
-              setIsOpen(!isOpen);
-            }}
-            size="s"
-          >
-            {I18LABELS.breakdown}
-          </EuiFilterButton>
-        }
-        closePopover={() => {
-          setIsOpen(false);
-          onChange(getSelItems());
-        }}
-        data-cy={`breakdown-popover_${id}`}
-        id={id}
-        isOpen={isOpen}
-        ownFocus={true}
-        withTitle
-        zIndex={10000}
-      >
-        <EuiPopoverTitle>{I18LABELS.selectBreakdown}</EuiPopoverTitle>
-        <div className="euiFilterSelect__items" style={{ minWidth: 200 }}>
-          {activeItems.map(({ name, count, selected }) => (
-            <EuiFilterSelectItem
-              checked={!!selected ? 'on' : undefined}
-              data-cy={`filter-breakdown-item_${name}`}
-              key={name + count}
-              onClick={onFilterItemClick(name)}
-              disabled={!selected && getSelItems().length > 0}
-            >
-              {name}
-            </EuiFilterSelectItem>
-          ))}
-        </div>
-      </EuiPopover>
-    </EuiFilterGroup>
-  );
-}
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageLoadDistChart.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageLoadDistChart.tsx
index b2b5e66d06ac69..c832ec9fcc0d06 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageLoadDistChart.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageLoadDistChart.tsx
@@ -35,7 +35,7 @@ import { BreakdownSeries } from '../PageLoadDistribution/BreakdownSeries';
 
 interface PageLoadData {
   pageLoadDistribution: Array<{ x: number; y: number }>;
-  percentiles: Record<string, number> | undefined;
+  percentiles: Record<string, number | null> | undefined;
   minDuration: number;
   maxDuration: number;
 }
@@ -43,7 +43,7 @@ interface PageLoadData {
 interface Props {
   onPercentileChange: (min: number, max: number) => void;
   data?: PageLoadData | null;
-  breakdowns: BreakdownItem[];
+  breakdown: BreakdownItem | null;
   percentileRange: PercentileRange;
   loading: boolean;
 }
@@ -57,7 +57,7 @@ const PageLoadChart = styled(Chart)`
 export function PageLoadDistChart({
   onPercentileChange,
   data,
-  breakdowns,
+  breakdown,
   loading,
   percentileRange,
 }: Props) {
@@ -122,17 +122,17 @@ export function PageLoadDistChart({
             data={data?.pageLoadDistribution ?? []}
             curve={CurveType.CURVE_CATMULL_ROM}
           />
-          {breakdowns.map(({ name, type }) => (
+          {breakdown && (
             <BreakdownSeries
-              key={`${type}-${name}`}
-              field={type}
-              value={name}
+              key={`${breakdown.type}-${breakdown.name}`}
+              field={breakdown.type}
+              value={breakdown.name}
               percentileRange={percentileRange}
               onLoadingChange={(bLoading) => {
                 setBreakdownLoading(bLoading);
               }}
             />
-          ))}
+          )}
         </PageLoadChart>
       )}
     </ChartWrapper>
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/PercentileAnnotations.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/PercentileAnnotations.tsx
index 407ec42f03ff5a..7e81dc011bdb5b 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/PercentileAnnotations.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/PercentileAnnotations.tsx
@@ -16,11 +16,11 @@ import styled from 'styled-components';
 import { EuiToolTip } from '@elastic/eui';
 
 interface Props {
-  percentiles?: Record<string, number>;
+  percentiles?: Record<string, number | null>;
 }
 
 function generateAnnotationData(
-  values?: Record<string, number>
+  values?: Record<string, number | null>
 ): LineAnnotationDatum[] {
   return Object.entries(values ?? {}).map((value) => ({
     dataValue: value[1],
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
index 53f2d5ae238c57..3e35f152549371 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
@@ -34,7 +34,7 @@ export function PageLoadDistribution() {
     max: null,
   });
 
-  const [breakdowns, setBreakdowns] = useState<BreakdownItem[]>([]);
+  const [breakdown, setBreakdown] = useState<BreakdownItem | null>(null);
 
   const { data, status } = useFetcher(
     (callApmApi) => {
@@ -94,11 +94,10 @@ export function PageLoadDistribution() {
             {I18LABELS.resetZoom}
           </EuiButtonEmpty>
         </EuiFlexItem>
-        <EuiFlexItem grow={false}>
+        <EuiFlexItem grow={false} style={{ width: 170 }}>
           <BreakdownFilter
-            id={'pageLoad'}
-            selectedBreakdowns={breakdowns}
-            onBreakdownChange={setBreakdowns}
+            selectedBreakdown={breakdown}
+            onBreakdownChange={setBreakdown}
           />
         </EuiFlexItem>
       </EuiFlexGroup>
@@ -107,7 +106,7 @@ export function PageLoadDistribution() {
         data={data}
         onPercentileChange={onPercentileChange}
         loading={status !== 'success'}
-        breakdowns={breakdowns}
+        breakdown={breakdown}
         percentileRange={{
           max: percentileRange.max || data?.maxDuration,
           min: percentileRange.min || data?.minDuration,
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
index 0f43c0ddf540da..a67f6dd8e3cb5d 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
@@ -18,7 +18,7 @@ export function PageViewsTrend() {
 
   const { start, end, serviceName } = urlParams;
 
-  const [breakdowns, setBreakdowns] = useState<BreakdownItem[]>([]);
+  const [breakdown, setBreakdown] = useState<BreakdownItem | null>(null);
 
   const { data, status } = useFetcher(
     (callApmApi) => {
@@ -30,9 +30,9 @@ export function PageViewsTrend() {
               start,
               end,
               uiFilters: JSON.stringify(uiFilters),
-              ...(breakdowns.length > 0
+              ...(breakdown
                 ? {
-                    breakdowns: JSON.stringify(breakdowns),
+                    breakdowns: JSON.stringify(breakdown),
                   }
                 : {}),
             },
@@ -41,13 +41,9 @@ export function PageViewsTrend() {
       }
       return Promise.resolve(undefined);
     },
-    [end, start, serviceName, uiFilters, breakdowns]
+    [end, start, serviceName, uiFilters, breakdown]
   );
 
-  const onBreakdownChange = (values: BreakdownItem[]) => {
-    setBreakdowns(values);
-  };
-
   return (
     <div>
       <EuiFlexGroup responsive={false}>
@@ -56,11 +52,10 @@ export function PageViewsTrend() {
             <h3>{I18LABELS.pageViews}</h3>
           </EuiTitle>
         </EuiFlexItem>
-        <EuiFlexItem grow={false}>
+        <EuiFlexItem grow={false} style={{ width: 170 }}>
           <BreakdownFilter
-            id={'pageView'}
-            selectedBreakdowns={breakdowns}
-            onBreakdownChange={onBreakdownChange}
+            selectedBreakdown={breakdown}
+            onBreakdownChange={setBreakdown}
           />
         </EuiFlexItem>
       </EuiFlexGroup>
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/Controls.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/Controls.tsx
index c8f586240471f5..baba592e5886e0 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/Controls.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/Controls.tsx
@@ -45,7 +45,7 @@ function doZoom(
 ) {
   if (cy) {
     const level = cy.zoom() + increment;
-    // @ts-ignore `.position()` _does_ work on a NodeCollection. It returns the position of the first element in the collection.
+    // @ts-expect-error `.position()` _does_ work on a NodeCollection. It returns the position of the first element in the collection.
     const primaryCenter = cy.nodes('.primary').position();
     const { x1, y1, w, h } = cy.nodes().boundingBox({});
     const graphCenter = { x: x1 + w / 2, y: y1 + h / 2 };
@@ -67,7 +67,7 @@ function useDebugDownloadUrl(cy?: cytoscape.Core) {
   // Handle elements changes to update the download URL
   useEffect(() => {
     const elementsHandler: cytoscape.EventHandler = (event) => {
-      // @ts-ignore The `true` argument to `cy.json` is to flatten the elements
+      // @ts-expect-error The `true` argument to `cy.json` is to flatten the elements
       // (instead of having them broken into nodes/edges.) DefinitelyTyped has
       // this wrong.
       const elementsJson = event.cy.json(true)?.elements.map((element) => ({
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx
index 1cde473aae6fa6..0b00c8a8bf0934 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx
@@ -13,6 +13,7 @@ import React, {
   useState,
 } from 'react';
 import cytoscape from 'cytoscape';
+import dagre from 'cytoscape-dagre';
 import { debounce } from 'lodash';
 import { useTheme } from '../../../hooks/useTheme';
 import {
@@ -22,6 +23,8 @@ import {
 } from './cytoscapeOptions';
 import { useUiTracker } from '../../../../../observability/public';
 
+cytoscape.use(dagre);
+
 export const CytoscapeContext = createContext<cytoscape.Core | undefined>(
   undefined
 );
@@ -30,7 +33,6 @@ interface CytoscapeProps {
   children?: ReactNode;
   elements: cytoscape.ElementDefinition[];
   height: number;
-  width: number;
   serviceName?: string;
   style?: CSSProperties;
 }
@@ -57,59 +59,52 @@ function useCytoscape(options: cytoscape.CytoscapeOptions) {
   return [ref, cy] as [React.MutableRefObject<any>, cytoscape.Core | undefined];
 }
 
-function rotatePoint(
-  { x, y }: { x: number; y: number },
-  degreesRotated: number
-) {
-  const radiansPerDegree = Math.PI / 180;
-  const θ = radiansPerDegree * degreesRotated;
-  const cosθ = Math.cos(θ);
-  const sinθ = Math.sin(θ);
-  return {
-    x: x * cosθ - y * sinθ,
-    y: x * sinθ + y * cosθ,
-  };
-}
-
-function getLayoutOptions(
-  selectedRoots: string[],
-  height: number,
-  width: number,
-  nodeHeight: number
-): cytoscape.LayoutOptions {
+function getLayoutOptions(nodeHeight: number): cytoscape.LayoutOptions {
   return {
-    name: 'breadthfirst',
-    // @ts-ignore DefinitelyTyped is incorrect here. Roots can be an Array
-    roots: selectedRoots.length ? selectedRoots : undefined,
+    name: 'dagre',
     fit: true,
     padding: nodeHeight,
     spacingFactor: 1.2,
     // @ts-ignore
-    // Rotate nodes counter-clockwise to transform layout from top→bottom to left→right.
-    // The extra 5° achieves the effect of separating overlapping taxi-styled edges.
-    transform: (node: any, pos: cytoscape.Position) => rotatePoint(pos, -95),
-    // swap width/height of boundingBox to compensate for the rotation
-    boundingBox: { x1: 0, y1: 0, w: height, h: width },
+    nodeSep: nodeHeight,
+    edgeSep: 32,
+    rankSep: 128,
+    rankDir: 'LR',
+    ranker: 'network-simplex',
   };
 }
 
-function selectRoots(cy: cytoscape.Core): string[] {
-  const bfs = cy.elements().bfs({
-    roots: cy.elements().leaves(),
+/*
+ * @notice
+ * This product includes code in the function applyCubicBezierStyles that was
+ * inspired by a public Codepen, which was available under a "MIT" license.
+ *
+ * Copyright (c) 2020 by Guillaume (https://codepen.io/guillaumethomas/pen/xxbbBKO)
+ * MIT License http://www.opensource.org/licenses/mit-license
+ */
+function applyCubicBezierStyles(edges: cytoscape.EdgeCollection) {
+  edges.forEach((edge) => {
+    const { x: x0, y: y0 } = edge.source().position();
+    const { x: x1, y: y1 } = edge.target().position();
+    const x = x1 - x0;
+    const y = y1 - y0;
+    const z = Math.sqrt(x * x + y * y);
+    const costheta = z === 0 ? 0 : x / z;
+    const alpha = 0.25;
+    // Two values for control-point-distances represent a pair symmetric quadratic
+    // bezier curves joined in the middle as a seamless cubic bezier curve:
+    edge.style('control-point-distances', [
+      -alpha * y * costheta,
+      alpha * y * costheta,
+    ]);
+    edge.style('control-point-weights', [alpha, 1 - alpha]);
   });
-  const furthestNodeFromLeaves = bfs.path.last();
-  return cy
-    .elements()
-    .roots()
-    .union(furthestNodeFromLeaves)
-    .map((el) => el.id());
 }
 
 export function Cytoscape({
   children,
   elements,
   height,
-  width,
   serviceName,
   style,
 }: CytoscapeProps) {
@@ -151,13 +146,7 @@ export function Cytoscape({
         } else {
           resetConnectedEdgeStyle();
         }
-
-        const selectedRoots = selectRoots(event.cy);
-        const layout = cy.layout(
-          getLayoutOptions(selectedRoots, height, width, nodeHeight)
-        );
-
-        layout.run();
+        cy.layout(getLayoutOptions(nodeHeight)).run();
       }
     };
     let layoutstopDelayTimeout: NodeJS.Timeout;
@@ -180,6 +169,7 @@ export function Cytoscape({
           event.cy.fit(undefined, nodeHeight);
         }
       }, 0);
+      applyCubicBezierStyles(event.cy.edges());
     };
     // debounce hover tracking so it doesn't spam telemetry with redundant events
     const trackNodeEdgeHover = debounce(
@@ -211,6 +201,9 @@ export function Cytoscape({
         console.debug('cytoscape:', event);
       }
     };
+    const dragHandler: cytoscape.EventHandler = (event) => {
+      applyCubicBezierStyles(event.target.connectedEdges());
+    };
 
     if (cy) {
       cy.on('data layoutstop select unselect', debugHandler);
@@ -220,6 +213,7 @@ export function Cytoscape({
       cy.on('mouseout', 'edge, node', mouseoutHandler);
       cy.on('select', 'node', selectHandler);
       cy.on('unselect', 'node', unselectHandler);
+      cy.on('drag', 'node', dragHandler);
 
       cy.remove(cy.elements());
       cy.add(elements);
@@ -239,19 +233,11 @@ export function Cytoscape({
         cy.removeListener('mouseout', 'edge, node', mouseoutHandler);
         cy.removeListener('select', 'node', selectHandler);
         cy.removeListener('unselect', 'node', unselectHandler);
+        cy.removeListener('drag', 'node', dragHandler);
       }
       clearTimeout(layoutstopDelayTimeout);
     };
-  }, [
-    cy,
-    elements,
-    height,
-    serviceName,
-    trackApmEvent,
-    width,
-    nodeHeight,
-    theme,
-  ]);
+  }, [cy, elements, height, serviceName, trackApmEvent, nodeHeight, theme]);
 
   return (
     <CytoscapeContext.Provider value={cy}>
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/Contents.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/Contents.tsx
index 4911d7f147d7c7..197bc94c62603e 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/Contents.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/Contents.tsx
@@ -31,7 +31,7 @@ interface ContentsProps {
 // This method of detecting IE is from a Stack Overflow answer:
 // https://stackoverflow.com/a/21825207
 //
-// @ts-ignore `documentMode` is not recognized as a valid property of `document`.
+// @ts-expect-error `documentMode` is not recognized as a valid property of `document`.
 const isIE11 = !!window.MSInputMethodContext && !!document.documentMode;
 
 function FlexColumnGroup(props: {
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/ServiceStatsList.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/ServiceStatsList.tsx
index be52018735099a..ba4451c37b3046 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/ServiceStatsList.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/ServiceStatsList.tsx
@@ -8,8 +8,9 @@ import { i18n } from '@kbn/i18n';
 import { isNumber } from 'lodash';
 import React from 'react';
 import styled from 'styled-components';
+import { asPercent } from '../../../../../common/utils/formatters';
 import { ServiceNodeStats } from '../../../../../common/service_map';
-import { asDuration, asPercent, tpmUnit } from '../../../../utils/formatters';
+import { asDuration, tpmUnit } from '../../../../utils/formatters';
 
 export const ItemRow = styled('tr')`
   line-height: 2;
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
index 1658c36e8a92fb..8291d94d91c48f 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
@@ -71,6 +71,7 @@ export function Popover({ focusedServiceName }: PopoverProps) {
       cy.on('select', 'node', selectHandler);
       cy.on('unselect', 'node', deselect);
       cy.on('data viewport', deselect);
+      cy.on('drag', 'node', deselect);
     }
 
     return () => {
@@ -78,6 +79,7 @@ export function Popover({ focusedServiceName }: PopoverProps) {
         cy.removeListener('select', 'node', selectHandler);
         cy.removeListener('unselect', 'node', deselect);
         cy.removeListener('data viewport', undefined, deselect);
+        cy.removeListener('drag', 'node', deselect);
       }
     };
   }, [cy, deselect]);
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/Cytoscape.stories.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/Cytoscape.stories.tsx
index 2a7d11bb57ca5b..5b50eb953d896e 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/Cytoscape.stories.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/Cytoscape.stories.tsx
@@ -49,13 +49,11 @@ storiesOf('app/ServiceMap/Cytoscape', module)
         },
       ];
       const height = 300;
-      const width = 1340;
       const serviceName = 'opbeans-python';
       return (
         <Cytoscape
           elements={elements}
           height={height}
-          width={width}
           serviceName={serviceName}
         />
       );
@@ -330,7 +328,7 @@ storiesOf('app/ServiceMap/Cytoscape', module)
           },
         },
       ];
-      return <Cytoscape elements={elements} height={600} width={1340} />;
+      return <Cytoscape elements={elements} height={600} />;
     },
     {
       info: { propTables: false, source: false },
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/CytoscapeExampleData.stories.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/CytoscapeExampleData.stories.tsx
index 830e3719b11f9d..d8dcc71f5051d9 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/CytoscapeExampleData.stories.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/CytoscapeExampleData.stories.tsx
@@ -35,6 +35,8 @@ function setSessionJson(json: string) {
   window.sessionStorage.setItem(SESSION_STORAGE_KEY, json);
 }
 
+const getCytoscapeHeight = () => window.innerHeight - 300;
+
 storiesOf(STORYBOOK_PATH, module)
   .addDecorator((storyFn) => <EuiThemeProvider>{storyFn()}</EuiThemeProvider>)
   .add(
@@ -43,16 +45,17 @@ storiesOf(STORYBOOK_PATH, module)
       const [size, setSize] = useState<number>(10);
       const [json, setJson] = useState<string>('');
       const [elements, setElements] = useState<any[]>(
-        generateServiceMapElements(size)
+        generateServiceMapElements({ size, hasAnomalies: true })
       );
-
       return (
         <div>
           <EuiFlexGroup>
             <EuiFlexItem>
               <EuiButton
                 onClick={() => {
-                  setElements(generateServiceMapElements(size));
+                  setElements(
+                    generateServiceMapElements({ size, hasAnomalies: true })
+                  );
                   setJson('');
                 }}
               >
@@ -79,7 +82,7 @@ storiesOf(STORYBOOK_PATH, module)
             </EuiFlexItem>
           </EuiFlexGroup>
 
-          <Cytoscape elements={elements} height={600} width={1340} />
+          <Cytoscape elements={elements} height={getCytoscapeHeight()} />
 
           {json && (
             <EuiCodeEditor
@@ -121,7 +124,7 @@ storiesOf(STORYBOOK_PATH, module)
 
       return (
         <div>
-          <Cytoscape elements={elements} height={600} width={1340} />
+          <Cytoscape elements={elements} height={getCytoscapeHeight()} />
           <EuiForm isInvalid={error !== undefined} error={error}>
             <EuiFlexGroup>
               <EuiFlexItem>
@@ -204,8 +207,7 @@ storiesOf(STORYBOOK_PATH, module)
         <div>
           <Cytoscape
             elements={exampleResponseTodo.elements}
-            height={600}
-            width={1340}
+            height={getCytoscapeHeight()}
           />
         </div>
       );
@@ -224,8 +226,7 @@ storiesOf(STORYBOOK_PATH, module)
         <div>
           <Cytoscape
             elements={exampleResponseOpbeansBeats.elements}
-            height={600}
-            width={1340}
+            height={getCytoscapeHeight()}
           />
         </div>
       );
@@ -244,8 +245,7 @@ storiesOf(STORYBOOK_PATH, module)
         <div>
           <Cytoscape
             elements={exampleResponseHipsterStore.elements}
-            height={600}
-            width={1340}
+            height={getCytoscapeHeight()}
           />
         </div>
       );
@@ -264,8 +264,7 @@ storiesOf(STORYBOOK_PATH, module)
         <div>
           <Cytoscape
             elements={exampleResponseOneDomainManyIPs.elements}
-            height={600}
-            width={1340}
+            height={getCytoscapeHeight()}
           />
         </div>
       );
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/generate_service_map_elements.ts b/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/generate_service_map_elements.ts
index 012256db3ab987..57ef2d49291c40 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/generate_service_map_elements.ts
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/__stories__/generate_service_map_elements.ts
@@ -4,9 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getSeverity } from '../Popover/getSeverity';
-
-export function generateServiceMapElements(size: number): any[] {
+export function generateServiceMapElements({
+  size,
+  hasAnomalies,
+}: {
+  size: number;
+  hasAnomalies: boolean;
+}): any[] {
   const services = range(size).map((i) => {
     const name = getName();
     const anomalyScore = randn(101);
@@ -15,11 +19,14 @@ export function generateServiceMapElements(size: number): any[] {
       'service.environment': 'production',
       'service.name': name,
       'agent.name': getAgentName(),
-      anomaly_score: anomalyScore,
-      anomaly_severity: getSeverity(anomalyScore),
-      actual_value: Math.random() * 2000000,
-      typical_value: Math.random() * 1000000,
-      ml_job_id: `${name}-request-high_mean_response_time`,
+      serviceAnomalyStats: hasAnomalies
+        ? {
+            transactionType: 'request',
+            anomalyScore,
+            actualValue: Math.random() * 2000000,
+            jobId: `${name}-request-high_mean_response_time`,
+          }
+        : undefined,
     };
   });
 
@@ -146,7 +153,7 @@ const NAMES = [
   'leech',
   'loki',
   'longshot',
-  'lumpkin,',
+  'lumpkin',
   'madame-web',
   'magician',
   'magneto',
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts b/x-pack/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts
index 4a271019e06db9..9fedcc70bbbcff 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts
@@ -87,14 +87,14 @@ function getBorderWidth(el: cytoscape.NodeSingular) {
 // This method of detecting IE is from a Stack Overflow answer:
 // https://stackoverflow.com/a/21825207
 //
-// @ts-ignore `documentMode` is not recognized as a valid property of `document`.
+// @ts-expect-error `documentMode` is not recognized as a valid property of `document`.
 const isIE11 = !!window.MSInputMethodContext && !!document.documentMode;
 
 export const getAnimationOptions = (
   theme: EuiTheme
 ): cytoscape.AnimationOptions => ({
   duration: parseInt(theme.eui.euiAnimSpeedNormal, 10),
-  // @ts-ignore The cubic-bezier options here are not recognized by the cytoscape types
+  // @ts-expect-error The cubic-bezier options here are not recognized by the cytoscape types
   easing: theme.eui.euiAnimSlightBounce,
 });
 
@@ -119,8 +119,6 @@ const getStyle = (theme: EuiTheme): cytoscape.Stylesheet[] => {
         'background-color': theme.eui.euiColorGhost,
         // The DefinitelyTyped definitions don't specify that a function can be
         // used here.
-        //
-        // @ts-ignore
         'background-image': isIE11
           ? undefined
           : (el: cytoscape.NodeSingular) => iconForNode(el) ?? defaultIcon,
@@ -168,9 +166,7 @@ const getStyle = (theme: EuiTheme): cytoscape.Stylesheet[] => {
     {
       selector: 'edge',
       style: {
-        'curve-style': 'taxi',
-        // @ts-ignore
-        'taxi-direction': 'auto',
+        'curve-style': 'unbundled-bezier',
         'line-color': lineColor,
         'overlay-opacity': 0,
         'target-arrow-color': lineColor,
@@ -178,7 +174,7 @@ const getStyle = (theme: EuiTheme): cytoscape.Stylesheet[] => {
         // The DefinitelyTyped definitions don't specify this property since it's
         // fairly new.
         //
-        // @ts-ignore
+        // @ts-expect-error
         'target-distance-from-node': isIE11
           ? undefined
           : theme.eui.paddingSizes.xs,
@@ -193,7 +189,7 @@ const getStyle = (theme: EuiTheme): cytoscape.Stylesheet[] => {
         'source-arrow-shape': isIE11 ? 'none' : 'triangle',
         'source-arrow-color': lineColor,
         'target-arrow-shape': isIE11 ? 'none' : 'triangle',
-        // @ts-ignore
+        // @ts-expect-error
         'source-distance-from-node': isIE11
           ? undefined
           : parseInt(theme.eui.paddingSizes.xs, 10),
@@ -204,7 +200,7 @@ const getStyle = (theme: EuiTheme): cytoscape.Stylesheet[] => {
     },
     {
       selector: 'edge[isInverseEdge]',
-      // @ts-ignore DefinitelyTyped says visibility is "none" but it's
+      // @ts-expect-error DefinitelyTyped says visibility is "none" but it's
       // actually "hidden"
       style: { visibility: 'hidden' },
     },
@@ -212,7 +208,6 @@ const getStyle = (theme: EuiTheme): cytoscape.Stylesheet[] => {
       selector: 'edge.nodeHover',
       style: {
         width: 4,
-        // @ts-ignore
         'z-index': zIndexEdgeHover,
         'line-color': theme.eui.euiColorDarkShade,
         'source-arrow-color': theme.eui.euiColorDarkShade,
@@ -232,7 +227,6 @@ const getStyle = (theme: EuiTheme): cytoscape.Stylesheet[] => {
         'line-color': theme.eui.euiColorPrimary,
         'source-arrow-color': theme.eui.euiColorPrimary,
         'target-arrow-color': theme.eui.euiColorPrimary,
-        // @ts-ignore
         'z-index': zIndexEdgeHighlight,
       },
     },
@@ -264,7 +258,6 @@ ${theme.eui.euiColorLightShade}`,
 export const getCytoscapeOptions = (
   theme: EuiTheme
 ): cytoscape.CytoscapeOptions => ({
-  autoungrabify: true,
   boxSelectionEnabled: false,
   maxZoom: 3,
   minZoom: 0.2,
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/icons.ts b/x-pack/plugins/apm/public/components/app/ServiceMap/icons.ts
index c211ef3abab1d5..2f4cc0d39d71cf 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/icons.ts
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/icons.ts
@@ -111,7 +111,7 @@ function getSpanIcon(type?: string, subtype?: string) {
 // This method of detecting IE is from a Stack Overflow answer:
 // https://stackoverflow.com/a/21825207
 //
-// @ts-ignore `documentMode` is not recognized as a valid property of `document`.
+// @ts-expect-error `documentMode` is not recognized as a valid property of `document`.
 const isIE11 = !!window.MSInputMethodContext && !!document.documentMode;
 
 export function iconForNode(node: cytoscape.NodeSingular) {
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/index.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/index.tsx
index d4be4da2ae1c54..83fab95bc91c9b 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/index.tsx
@@ -57,7 +57,7 @@ export function ServiceMap({ serviceName }: ServiceMapProps) {
     }
   }, [license, serviceName, urlParams]);
 
-  const { ref, height, width } = useRefDimensions();
+  const { ref, height } = useRefDimensions();
 
   useTrackPageview({ app: 'apm', path: 'service_map' });
   useTrackPageview({ app: 'apm', path: 'service_map', delay: 15000 });
@@ -78,7 +78,6 @@ export function ServiceMap({ serviceName }: ServiceMapProps) {
         height={height}
         serviceName={serviceName}
         style={getCytoscapeDivStyle(theme)}
-        width={width}
       >
         <Controls />
         <BetaBadge />
diff --git a/x-pack/plugins/apm/public/components/app/ServiceNodeOverview/index.tsx b/x-pack/plugins/apm/public/components/app/ServiceNodeOverview/index.tsx
index 3cde48aa483cba..9940a7aabb2190 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceNodeOverview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceNodeOverview/index.tsx
@@ -13,6 +13,7 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import styled from 'styled-components';
+import { asPercent } from '../../../../common/utils/formatters';
 import { UNIDENTIFIED_SERVICE_NODES_LABEL } from '../../../../common/i18n';
 import { SERVICE_NODE_NAME_MISSING } from '../../../../common/service_nodes';
 import { Projection } from '../../../../common/projections';
@@ -20,11 +21,7 @@ import { LocalUIFilters } from '../../shared/LocalUIFilters';
 import { useUrlParams } from '../../../hooks/useUrlParams';
 import { ManagedTable, ITableColumn } from '../../shared/ManagedTable';
 import { useFetcher } from '../../../hooks/useFetcher';
-import {
-  asDynamicBytes,
-  asInteger,
-  asPercent,
-} from '../../../utils/formatters';
+import { asDynamicBytes, asInteger } from '../../../utils/formatters';
 import { ServiceNodeMetricOverviewLink } from '../../shared/Links/apm/ServiceNodeMetricOverviewLink';
 import { truncate, px, unit } from '../../../style/variables';
 
diff --git a/x-pack/plugins/apm/public/components/app/ServiceOverview/__test__/ServiceOverview.test.tsx b/x-pack/plugins/apm/public/components/app/ServiceOverview/__test__/ServiceOverview.test.tsx
index 78d75feb72f1f2..d9c5ff5130df6a 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceOverview/__test__/ServiceOverview.test.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceOverview/__test__/ServiceOverview.test.tsx
@@ -61,7 +61,7 @@ const httpGet = jest.fn();
 
 describe('Service Overview -> View', () => {
   beforeEach(() => {
-    // @ts-ignore
+    // @ts-expect-error
     global.sessionStorage = new SessionStorageMock();
 
     // mock urlParams
diff --git a/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/index.tsx b/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/index.tsx
index 9b4f2175731dca..069c4468d206b5 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionDetails/Distribution/index.tsx
@@ -16,7 +16,7 @@ import { TransactionDistributionAPIResponse } from '../../../../../server/lib/tr
 import { IBucket } from '../../../../../server/lib/transactions/distribution/get_buckets/transform';
 import { IUrlParams } from '../../../../context/UrlParamsContext/types';
 import { getDurationFormatter } from '../../../../utils/formatters';
-// @ts-ignore
+// @ts-expect-error
 import Histogram from '../../../shared/charts/Histogram';
 import { EmptyMessage } from '../../../shared/EmptyMessage';
 import { fromQuery, toQuery } from '../../../shared/Links/url_helpers';
diff --git a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/PercentOfParent.tsx b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/PercentOfParent.tsx
index 1725a13f4da66c..41c958838803e2 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/PercentOfParent.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/PercentOfParent.tsx
@@ -7,7 +7,7 @@
 import React from 'react';
 import { i18n } from '@kbn/i18n';
 import { EuiToolTip } from '@elastic/eui';
-import { asPercent } from '../../../../utils/formatters';
+import { asPercent } from '../../../../../common/utils/formatters';
 
 interface PercentOfParentProps {
   duration: number;
diff --git a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Marks/get_error_marks.ts b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Marks/get_error_marks.ts
index 5d8c5bc9ec6cf5..b85171308d745e 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Marks/get_error_marks.ts
+++ b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Marks/get_error_marks.ts
@@ -27,7 +27,7 @@ export const getErrorMarks = (
 
   return errorItems.map((error) => ({
     type: 'errorMark',
-    offset: error.offset + error.skew,
+    offset: Math.max(error.offset + error.skew, 0),
     verticalLine: false,
     id: error.doc.error.id,
     error: error.doc,
diff --git a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/ServiceLegends.tsx b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/ServiceLegends.tsx
index 519d0b476d7694..19d8063846a068 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/ServiceLegends.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/ServiceLegends.tsx
@@ -9,7 +9,6 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 import styled from 'styled-components';
 import { px, unit } from '../../../../../style/variables';
-// @ts-ignore
 import { Legend } from '../../../../shared/charts/Legend';
 import { IServiceColors } from './Waterfall/waterfall_helpers/waterfall_helpers';
 
diff --git a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/SpanFlyout/DatabaseContext.tsx b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/SpanFlyout/DatabaseContext.tsx
index 7bceeb9ac1652b..b1228646595f3a 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/SpanFlyout/DatabaseContext.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/SpanFlyout/DatabaseContext.tsx
@@ -8,13 +8,13 @@ import { EuiSpacer, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { tint } from 'polished';
 import React, { Fragment } from 'react';
-// @ts-ignore
+// @ts-expect-error
 import sql from 'react-syntax-highlighter/dist/languages/sql';
 import SyntaxHighlighter, {
   registerLanguage,
-  // @ts-ignore
+  // @ts-expect-error
 } from 'react-syntax-highlighter/dist/light';
-// @ts-ignore
+// @ts-expect-error
 import { xcode } from 'react-syntax-highlighter/dist/styles';
 import styled from 'styled-components';
 import { Span } from '../../../../../../../../typings/es_schemas/ui/span';
diff --git a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/index.tsx b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/index.tsx
index b2301298cbdfec..0958f99b5bd98f 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionDetails/WaterfallWithSummmary/WaterfallContainer/Waterfall/index.tsx
@@ -9,7 +9,6 @@ import { i18n } from '@kbn/i18n';
 import { History, Location } from 'history';
 import React, { useState } from 'react';
 import { useHistory } from 'react-router-dom';
-// @ts-ignore
 import { StickyContainer } from 'react-sticky';
 import styled from 'styled-components';
 import { px } from '../../../../../../style/variables';
diff --git a/x-pack/plugins/apm/public/components/app/TransactionDetails/index.tsx b/x-pack/plugins/apm/public/components/app/TransactionDetails/index.tsx
index 0dc2f607b1ef27..515fcbc88c9014 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionDetails/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionDetails/index.tsx
@@ -5,32 +5,29 @@
  */
 
 import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiHorizontalRule,
   EuiPanel,
   EuiSpacer,
   EuiTitle,
-  EuiHorizontalRule,
-  EuiFlexGroup,
-  EuiFlexItem,
 } from '@elastic/eui';
 import React, { useMemo } from 'react';
-import { EuiFlexGrid } from '@elastic/eui';
+import { useTrackPageview } from '../../../../../observability/public';
+import { Projection } from '../../../../common/projections';
+import { ChartsSyncContextProvider } from '../../../context/ChartsSyncContext';
+import { FETCH_STATUS } from '../../../hooks/useFetcher';
+import { useLocation } from '../../../hooks/useLocation';
 import { useTransactionCharts } from '../../../hooks/useTransactionCharts';
 import { useTransactionDistribution } from '../../../hooks/useTransactionDistribution';
+import { useUrlParams } from '../../../hooks/useUrlParams';
 import { useWaterfall } from '../../../hooks/useWaterfall';
-import { TransactionCharts } from '../../shared/charts/TransactionCharts';
 import { ApmHeader } from '../../shared/ApmHeader';
+import { TransactionCharts } from '../../shared/charts/TransactionCharts';
+import { HeightRetainer } from '../../shared/HeightRetainer';
+import { LocalUIFilters } from '../../shared/LocalUIFilters';
 import { TransactionDistribution } from './Distribution';
 import { WaterfallWithSummmary } from './WaterfallWithSummmary';
-import { useLocation } from '../../../hooks/useLocation';
-import { useUrlParams } from '../../../hooks/useUrlParams';
-import { FETCH_STATUS } from '../../../hooks/useFetcher';
-import { TransactionBreakdown } from '../../shared/TransactionBreakdown';
-import { ChartsSyncContextProvider } from '../../../context/ChartsSyncContext';
-import { useTrackPageview } from '../../../../../observability/public';
-import { Projection } from '../../../../common/projections';
-import { LocalUIFilters } from '../../shared/LocalUIFilters';
-import { HeightRetainer } from '../../shared/HeightRetainer';
-import { ErroneousTransactionsRateChart } from '../../shared/charts/ErroneousTransactionsRateChart';
 
 export function TransactionDetails() {
   const location = useLocation();
@@ -86,21 +83,9 @@ export function TransactionDetails() {
         </EuiFlexItem>
         <EuiFlexItem grow={7}>
           <ChartsSyncContextProvider>
-            <EuiFlexGrid columns={2} gutterSize="s">
-              <EuiFlexItem>
-                <TransactionBreakdown />
-              </EuiFlexItem>
-              <EuiFlexItem>
-                <ErroneousTransactionsRateChart />
-              </EuiFlexItem>
-            </EuiFlexGrid>
-
-            <EuiSpacer size="s" />
-
             <TransactionCharts
               charts={transactionChartsData}
               urlParams={urlParams}
-              location={location}
             />
           </ChartsSyncContextProvider>
 
diff --git a/x-pack/plugins/apm/public/components/app/TransactionOverview/List/index.tsx b/x-pack/plugins/apm/public/components/app/TransactionOverview/List/index.tsx
deleted file mode 100644
index 2b1c1b8e8c11c8..00000000000000
--- a/x-pack/plugins/apm/public/components/app/TransactionOverview/List/index.tsx
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { EuiToolTip, EuiIconTip } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import React, { useMemo } from 'react';
-import styled from 'styled-components';
-import { NOT_AVAILABLE_LABEL } from '../../../../../common/i18n';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { TransactionGroup } from '../../../../../server/lib/transaction_groups/fetcher';
-import { fontFamilyCode, truncate } from '../../../../style/variables';
-import { asDecimal, asMillisecondDuration } from '../../../../utils/formatters';
-import { ImpactBar } from '../../../shared/ImpactBar';
-import { ITableColumn, ManagedTable } from '../../../shared/ManagedTable';
-import { LoadingStatePrompt } from '../../../shared/LoadingStatePrompt';
-import { EmptyMessage } from '../../../shared/EmptyMessage';
-import { TransactionDetailLink } from '../../../shared/Links/apm/TransactionDetailLink';
-
-const TransactionNameLink = styled(TransactionDetailLink)`
-  ${truncate('100%')};
-  font-family: ${fontFamilyCode};
-`;
-
-interface Props {
-  items: TransactionGroup[];
-  isLoading: boolean;
-}
-
-export function TransactionList({ items, isLoading }: Props) {
-  const columns: Array<ITableColumn<TransactionGroup>> = useMemo(
-    () => [
-      {
-        field: 'name',
-        name: i18n.translate('xpack.apm.transactionsTable.nameColumnLabel', {
-          defaultMessage: 'Name',
-        }),
-        width: '50%',
-        sortable: true,
-        render: (_, { sample }: TransactionGroup) => {
-          return (
-            <EuiToolTip
-              id="transaction-name-link-tooltip"
-              content={sample.transaction.name || NOT_AVAILABLE_LABEL}
-            >
-              <TransactionNameLink
-                serviceName={sample.service.name}
-                transactionId={sample.transaction.id}
-                traceId={sample.trace.id}
-                transactionName={sample.transaction.name}
-                transactionType={sample.transaction.type}
-              >
-                {sample.transaction.name || NOT_AVAILABLE_LABEL}
-              </TransactionNameLink>
-            </EuiToolTip>
-          );
-        },
-      },
-      {
-        field: 'averageResponseTime',
-        name: i18n.translate(
-          'xpack.apm.transactionsTable.avgDurationColumnLabel',
-          {
-            defaultMessage: 'Avg. duration',
-          }
-        ),
-        sortable: true,
-        dataType: 'number',
-        render: (time: number) => asMillisecondDuration(time),
-      },
-      {
-        field: 'p95',
-        name: i18n.translate(
-          'xpack.apm.transactionsTable.95thPercentileColumnLabel',
-          {
-            defaultMessage: '95th percentile',
-          }
-        ),
-        sortable: true,
-        dataType: 'number',
-        render: (time: number) => asMillisecondDuration(time),
-      },
-      {
-        field: 'transactionsPerMinute',
-        name: i18n.translate(
-          'xpack.apm.transactionsTable.transactionsPerMinuteColumnLabel',
-          {
-            defaultMessage: 'Trans. per minute',
-          }
-        ),
-        sortable: true,
-        dataType: 'number',
-        render: (value: number) =>
-          `${asDecimal(value)} ${i18n.translate(
-            'xpack.apm.transactionsTable.transactionsPerMinuteUnitLabel',
-            {
-              defaultMessage: 'tpm',
-            }
-          )}`,
-      },
-      {
-        field: 'impact',
-        name: (
-          <>
-            {i18n.translate('xpack.apm.transactionsTable.impactColumnLabel', {
-              defaultMessage: 'Impact',
-            })}{' '}
-            <EuiIconTip
-              size="s"
-              type="questionInCircle"
-              color="subdued"
-              iconProps={{
-                className: 'eui-alignTop',
-              }}
-              content={i18n.translate(
-                'xpack.apm.transactionsTable.impactColumnDescription',
-                {
-                  defaultMessage:
-                    "The most used and slowest endpoints in your service. It's calculated by taking the relative average duration times the number of transactions per minute.",
-                }
-              )}
-            />
-          </>
-        ),
-        sortable: true,
-        dataType: 'number',
-        render: (value: number) => <ImpactBar value={value} />,
-      },
-    ],
-    []
-  );
-
-  const noItemsMessage = (
-    <EmptyMessage
-      heading={i18n.translate('xpack.apm.transactionsTable.notFoundLabel', {
-        defaultMessage: 'No transactions were found.',
-      })}
-    />
-  );
-
-  return (
-    <ManagedTable
-      noItemsMessage={isLoading ? <LoadingStatePrompt /> : noItemsMessage}
-      columns={columns}
-      items={items}
-      initialSortField="impact"
-      initialSortDirection="desc"
-      initialPageSize={25}
-    />
-  );
-}
diff --git a/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/TransactionList.stories.tsx b/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/TransactionList.stories.tsx
new file mode 100644
index 00000000000000..bc9df71c534ef5
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/TransactionList.stories.tsx
@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { storiesOf } from '@storybook/react';
+import React from 'react';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { TransactionGroup } from '../../../../../server/lib/transaction_groups/fetcher';
+import { TransactionList } from './';
+
+storiesOf('app/TransactionOverview/TransactionList', module).add(
+  'Single Row',
+  () => {
+    const items: TransactionGroup[] = [
+      {
+        name:
+          'GET /api/v1/regions/azure-eastus2/clusters/elasticsearch/xc18de071deb4262be54baebf5f6a1ce/proxy/_snapshot/found-snapshots/_all',
+        sample: {
+          container: {
+            id:
+              'xa802046074071c9c828e8db3b7ef92ea0484d9fe783b9c518f65a7b45dfdd2c',
+          },
+          agent: {
+            name: 'java',
+            ephemeral_id: 'x787d6b7-3241-4b55-ba49-0c96bc9857d1',
+            version: '1.17.0',
+          },
+          process: {
+            pid: 28,
+            title: '/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java',
+          },
+          processor: {
+            name: 'transaction',
+            event: 'transaction',
+          },
+          labels: {
+            path:
+              '/api/v1/regions/azure-eastus2/clusters/elasticsearch/xc18de071deb4262be54baebf5f6a1ce/proxy/_snapshot/found-snapshots/_all',
+            status_code: '200',
+            request_method: 'GET',
+            request_id: 'x273dc2477e021979125e0ec67e8d778',
+          },
+          observer: {
+            hostname: 'x840922c967b',
+            name: 'instance-000000000x',
+            id: 'xb384baf-c16a-415a-928a-a10635a04b81',
+            ephemeral_id: 'x9227f0e-848d-423e-a65a-5fdee321f4a9',
+            type: 'apm-server',
+            version: '7.8.1',
+            version_major: 7,
+          },
+          trace: {
+            id: 'x998d7e5db84aa8341b358a264a78984',
+          },
+          '@timestamp': '2020-08-26T14:40:31.472Z',
+          ecs: {
+            version: '1.5.0',
+          },
+          service: {
+            node: {
+              name:
+                'xa802046074071c9c828e8db3b7ef92ea0484d9fe783b9c518f65a7b45dfdd2c',
+            },
+            environment: 'qa',
+            framework: {
+              name: 'API',
+            },
+            name: 'adminconsole',
+            runtime: {
+              name: 'Java',
+              version: '1.8.0_265',
+            },
+            language: {
+              name: 'Java',
+              version: '1.8.0_265',
+            },
+            version: 'ms-44.1-BC_1',
+          },
+          host: {
+            hostname: 'xa8020460740',
+            os: {
+              platform: 'Linux',
+            },
+            ip: '3.83.239.24',
+            name: 'xa8020460740',
+            architecture: 'amd64',
+          },
+          transaction: {
+            duration: {
+              us: 8260617,
+            },
+            result: 'HTTP 2xx',
+            name:
+              'GET /api/v1/regions/azure-eastus2/clusters/elasticsearch/xc18de071deb4262be54baebf5f6a1ce/proxy/_snapshot/found-snapshots/_all',
+            span_count: {
+              dropped: 0,
+              started: 8,
+            },
+            id: 'xaa3cae6fd4f7023',
+            type: 'request',
+            sampled: true,
+          },
+          timestamp: {
+            us: 1598452831472001,
+          },
+        },
+        p95: 11974156,
+        averageResponseTime: 8087434.558974359,
+        transactionsPerMinute: 0.40625,
+        impact: 100,
+        impactRelative: 100,
+      },
+    ];
+
+    return <TransactionList isLoading={false} items={items} />;
+  }
+);
diff --git a/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/index.tsx b/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/index.tsx
new file mode 100644
index 00000000000000..d8c6d7d28fa9f0
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/TransactionOverview/TransactionList/index.tsx
@@ -0,0 +1,160 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiToolTip, EuiIconTip } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React, { useMemo } from 'react';
+import styled from 'styled-components';
+import { NOT_AVAILABLE_LABEL } from '../../../../../common/i18n';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { TransactionGroup } from '../../../../../server/lib/transaction_groups/fetcher';
+import { fontFamilyCode, truncate } from '../../../../style/variables';
+import { asDecimal, asMillisecondDuration } from '../../../../utils/formatters';
+import { ImpactBar } from '../../../shared/ImpactBar';
+import { ITableColumn, ManagedTable } from '../../../shared/ManagedTable';
+import { LoadingStatePrompt } from '../../../shared/LoadingStatePrompt';
+import { EmptyMessage } from '../../../shared/EmptyMessage';
+import { TransactionDetailLink } from '../../../shared/Links/apm/TransactionDetailLink';
+
+// Truncate both the link and the child span (the tooltip anchor.) The link so
+// it doesn't overflow, and the anchor so we get the ellipsis.
+const TransactionNameLink = styled(TransactionDetailLink)`
+  font-family: ${fontFamilyCode};
+  white-space: nowrap;
+  ${truncate('100%')};
+
+  > span {
+    ${truncate('100%')};
+  }
+`;
+
+interface Props {
+  items: TransactionGroup[];
+  isLoading: boolean;
+}
+
+export function TransactionList({ items, isLoading }: Props) {
+  const columns: Array<ITableColumn<TransactionGroup>> = useMemo(
+    () => [
+      {
+        field: 'name',
+        name: i18n.translate('xpack.apm.transactionsTable.nameColumnLabel', {
+          defaultMessage: 'Name',
+        }),
+        width: '50%',
+        sortable: true,
+        render: (_, { sample }: TransactionGroup) => {
+          return (
+            <TransactionNameLink
+              serviceName={sample.service.name}
+              transactionId={sample.transaction.id}
+              traceId={sample.trace.id}
+              transactionName={sample.transaction.name}
+              transactionType={sample.transaction.type}
+            >
+              <EuiToolTip
+                id="transaction-name-link-tooltip"
+                content={sample.transaction.name || NOT_AVAILABLE_LABEL}
+              >
+                <>{sample.transaction.name || NOT_AVAILABLE_LABEL}</>
+              </EuiToolTip>
+            </TransactionNameLink>
+          );
+        },
+      },
+      {
+        field: 'averageResponseTime',
+        name: i18n.translate(
+          'xpack.apm.transactionsTable.avgDurationColumnLabel',
+          {
+            defaultMessage: 'Avg. duration',
+          }
+        ),
+        sortable: true,
+        dataType: 'number',
+        render: (time: number) => asMillisecondDuration(time),
+      },
+      {
+        field: 'p95',
+        name: i18n.translate(
+          'xpack.apm.transactionsTable.95thPercentileColumnLabel',
+          {
+            defaultMessage: '95th percentile',
+          }
+        ),
+        sortable: true,
+        dataType: 'number',
+        render: (time: number) => asMillisecondDuration(time),
+      },
+      {
+        field: 'transactionsPerMinute',
+        name: i18n.translate(
+          'xpack.apm.transactionsTable.transactionsPerMinuteColumnLabel',
+          {
+            defaultMessage: 'Trans. per minute',
+          }
+        ),
+        sortable: true,
+        dataType: 'number',
+        render: (value: number) =>
+          `${asDecimal(value)} ${i18n.translate(
+            'xpack.apm.transactionsTable.transactionsPerMinuteUnitLabel',
+            {
+              defaultMessage: 'tpm',
+            }
+          )}`,
+      },
+      {
+        field: 'impact',
+        name: (
+          <>
+            {i18n.translate('xpack.apm.transactionsTable.impactColumnLabel', {
+              defaultMessage: 'Impact',
+            })}{' '}
+            <EuiIconTip
+              size="s"
+              type="questionInCircle"
+              color="subdued"
+              iconProps={{
+                className: 'eui-alignTop',
+              }}
+              content={i18n.translate(
+                'xpack.apm.transactionsTable.impactColumnDescription',
+                {
+                  defaultMessage:
+                    "The most used and slowest endpoints in your service. It's calculated by taking the relative average duration times the number of transactions per minute.",
+                }
+              )}
+            />
+          </>
+        ),
+        sortable: true,
+        dataType: 'number',
+        render: (value: number) => <ImpactBar value={value} />,
+      },
+    ],
+    []
+  );
+
+  const noItemsMessage = (
+    <EmptyMessage
+      heading={i18n.translate('xpack.apm.transactionsTable.notFoundLabel', {
+        defaultMessage: 'No transactions were found.',
+      })}
+    />
+  );
+
+  return (
+    <ManagedTable
+      noItemsMessage={isLoading ? <LoadingStatePrompt /> : noItemsMessage}
+      columns={columns}
+      items={items}
+      initialSortField="impact"
+      initialSortDirection="desc"
+      initialPageSize={25}
+    />
+  );
+}
diff --git a/x-pack/plugins/apm/public/components/app/TransactionOverview/index.tsx b/x-pack/plugins/apm/public/components/app/TransactionOverview/index.tsx
index 0757ae572152c9..5999988abe848f 100644
--- a/x-pack/plugins/apm/public/components/app/TransactionOverview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/TransactionOverview/index.tsx
@@ -7,7 +7,6 @@
 import {
   EuiCallOut,
   EuiCode,
-  EuiFlexGrid,
   EuiFlexGroup,
   EuiFlexItem,
   EuiHorizontalRule,
@@ -29,14 +28,12 @@ import { useServiceTransactionTypes } from '../../../hooks/useServiceTransaction
 import { useTransactionCharts } from '../../../hooks/useTransactionCharts';
 import { useTransactionList } from '../../../hooks/useTransactionList';
 import { useUrlParams } from '../../../hooks/useUrlParams';
-import { ErroneousTransactionsRateChart } from '../../shared/charts/ErroneousTransactionsRateChart';
 import { TransactionCharts } from '../../shared/charts/TransactionCharts';
 import { ElasticDocsLink } from '../../shared/Links/ElasticDocsLink';
 import { fromQuery, toQuery } from '../../shared/Links/url_helpers';
 import { LocalUIFilters } from '../../shared/LocalUIFilters';
 import { TransactionTypeFilter } from '../../shared/LocalUIFilters/TransactionTypeFilter';
-import { TransactionBreakdown } from '../../shared/TransactionBreakdown';
-import { TransactionList } from './List';
+import { TransactionList } from './TransactionList';
 import { useRedirect } from './useRedirect';
 
 function getRedirectLocation({
@@ -65,6 +62,7 @@ function getRedirectLocation({
 export function TransactionOverview() {
   const location = useLocation();
   const { urlParams } = useUrlParams();
+
   const { serviceName, transactionType } = urlParams;
 
   // TODO: fetching of transaction types should perhaps be lifted since it is needed in several places. Context?
@@ -125,20 +123,8 @@ export function TransactionOverview() {
         </EuiFlexItem>
         <EuiFlexItem grow={7}>
           <ChartsSyncContextProvider>
-            <EuiFlexGrid columns={2} gutterSize="s">
-              <EuiFlexItem>
-                <TransactionBreakdown />
-              </EuiFlexItem>
-              <EuiFlexItem>
-                <ErroneousTransactionsRateChart />
-              </EuiFlexItem>
-            </EuiFlexGrid>
-
-            <EuiSpacer size="s" />
-
             <TransactionCharts
               charts={transactionCharts}
-              location={location}
               urlParams={urlParams}
             />
           </ChartsSyncContextProvider>
diff --git a/x-pack/plugins/apm/public/components/shared/ApmHeader/ApmHeader.stories.tsx b/x-pack/plugins/apm/public/components/shared/ApmHeader/ApmHeader.stories.tsx
new file mode 100644
index 00000000000000..c9b7c774098404
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/shared/ApmHeader/ApmHeader.stories.tsx
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiTitle } from '@elastic/eui';
+import { storiesOf } from '@storybook/react';
+import React from 'react';
+import { MockApmPluginContextWrapper } from '../../../context/ApmPluginContext/MockApmPluginContext';
+import { ApmHeader } from './';
+
+storiesOf('shared/ApmHeader', module)
+  .addDecorator((storyFn) => {
+    return (
+      <MockApmPluginContextWrapper>{storyFn()}</MockApmPluginContextWrapper>
+    );
+  })
+  .add('Example', () => {
+    return (
+      <ApmHeader>
+        <EuiTitle size="l">
+          <h1>
+            GET
+            /api/v1/regions/azure-eastus2/clusters/elasticsearch/xc18de071deb4262be54baebf5f6a1ce/proxy/_snapshot/found-snapshots/_all
+          </h1>
+        </EuiTitle>
+      </ApmHeader>
+    );
+  });
diff --git a/x-pack/plugins/apm/public/components/shared/ApmHeader/index.tsx b/x-pack/plugins/apm/public/components/shared/ApmHeader/index.tsx
index 4ffd4228018163..9f67ba99103ec4 100644
--- a/x-pack/plugins/apm/public/components/shared/ApmHeader/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/ApmHeader/index.tsx
@@ -6,15 +6,25 @@
 
 import { EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
 import React, { ReactNode } from 'react';
-import { KueryBar } from '../KueryBar';
+import styled from 'styled-components';
 import { DatePicker } from '../DatePicker';
 import { EnvironmentFilter } from '../EnvironmentFilter';
+import { KueryBar } from '../KueryBar';
+
+// Header titles with long, unbroken words, like you would see for a long URL in
+// a transaction name, with the default `work-break`, don't break, and that ends
+// up pushing the date picker off of the screen. Setting `break-all` here lets
+// it wrap even if it has a long, unbroken work. The wrapped result is not great
+// looking, since it wraps, but it doesn't push any controls off of the screen.
+const ChildrenContainerFlexItem = styled(EuiFlexItem)`
+  word-break: break-all;
+`;
 
 export function ApmHeader({ children }: { children: ReactNode }) {
   return (
     <>
       <EuiFlexGroup alignItems="center" gutterSize="s">
-        <EuiFlexItem>{children}</EuiFlexItem>
+        <ChildrenContainerFlexItem>{children}</ChildrenContainerFlexItem>
         <EuiFlexItem grow={false}>
           <DatePicker />
         </EuiFlexItem>
diff --git a/x-pack/plugins/apm/public/components/shared/Links/DiscoverLinks/__test__/DiscoverTransactionLink.test.tsx b/x-pack/plugins/apm/public/components/shared/Links/DiscoverLinks/__test__/DiscoverTransactionLink.test.tsx
index 1fa9a0baa72653..48d8bb2b416442 100644
--- a/x-pack/plugins/apm/public/components/shared/Links/DiscoverLinks/__test__/DiscoverTransactionLink.test.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Links/DiscoverLinks/__test__/DiscoverTransactionLink.test.tsx
@@ -5,7 +5,7 @@
  */
 
 import { Transaction } from '../../../../../../typings/es_schemas/ui/transaction';
-// @ts-ignore
+// @ts-expect-error
 import configureStore from '../../../../../store/config/configureStore';
 import { getDiscoverQuery } from '../DiscoverTransactionLink';
 
diff --git a/x-pack/plugins/apm/public/components/shared/Stacktrace/CauseStacktrace.tsx b/x-pack/plugins/apm/public/components/shared/Stacktrace/CauseStacktrace.tsx
index 977bf2dd09cc09..50f87184f8ee7f 100644
--- a/x-pack/plugins/apm/public/components/shared/Stacktrace/CauseStacktrace.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Stacktrace/CauseStacktrace.tsx
@@ -8,13 +8,13 @@ import React from 'react';
 import styled from 'styled-components';
 import { i18n } from '@kbn/i18n';
 import { EuiAccordion, EuiTitle } from '@elastic/eui';
-import { px, unit } from '../../../style/variables';
+import { px, unit, units } from '../../../style/variables';
 import { Stacktrace } from '.';
 import { Stackframe } from '../../../../typings/es_schemas/raw/fields/stackframe';
 
-// @ts-ignore Styled Components has trouble inferring the types of the default props here.
 const Accordion = styled(EuiAccordion)`
   border-top: ${({ theme }) => theme.eui.euiBorderThin};
+  margin-top: ${px(units.half)};
 `;
 
 const CausedByContainer = styled('h5')`
diff --git a/x-pack/plugins/apm/public/components/shared/Stacktrace/Context.tsx b/x-pack/plugins/apm/public/components/shared/Stacktrace/Context.tsx
index 72fdc93de95452..020137fc316725 100644
--- a/x-pack/plugins/apm/public/components/shared/Stacktrace/Context.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Stacktrace/Context.tsx
@@ -8,17 +8,17 @@ import { size } from 'lodash';
 import { tint } from 'polished';
 import React from 'react';
 // TODO add dependency for @types/react-syntax-highlighter
-// @ts-ignore
+// @ts-expect-error
 import javascript from 'react-syntax-highlighter/dist/languages/javascript';
-// @ts-ignore
+// @ts-expect-error
 import python from 'react-syntax-highlighter/dist/languages/python';
-// @ts-ignore
+// @ts-expect-error
 import ruby from 'react-syntax-highlighter/dist/languages/ruby';
-// @ts-ignore
+// @ts-expect-error
 import SyntaxHighlighter from 'react-syntax-highlighter/dist/light';
-// @ts-ignore
+// @ts-expect-error
 import { registerLanguage } from 'react-syntax-highlighter/dist/light';
-// @ts-ignore
+// @ts-expect-error
 import { xcode } from 'react-syntax-highlighter/dist/styles';
 import styled from 'styled-components';
 import { StackframeWithLineContext } from '../../../../typings/es_schemas/raw/fields/stackframe';
diff --git a/x-pack/plugins/apm/public/components/shared/Stacktrace/Stackframe.tsx b/x-pack/plugins/apm/public/components/shared/Stacktrace/Stackframe.tsx
index a552491297d550..f72eb209f23299 100644
--- a/x-pack/plugins/apm/public/components/shared/Stacktrace/Stackframe.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Stacktrace/Stackframe.tsx
@@ -35,7 +35,7 @@ const ContextContainer = styled.div<{ isLibraryFrame: boolean }>`
 
 // Indent the non-context frames the same amount as the accordion control
 const NoContextFrameHeadingWrapper = styled.div`
-  margin-left: ${px(units.unit + units.half + units.eighth)};
+  margin-left: ${px(units.unit + units.half + units.quarter)};
 `;
 
 interface Props {
diff --git a/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/__snapshots__/Stackframe.test.tsx.snap b/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/__snapshots__/Stackframe.test.tsx.snap
index 1bfeb020a2ab5b..f87cc62d7809d0 100644
--- a/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/__snapshots__/Stackframe.test.tsx.snap
+++ b/x-pack/plugins/apm/public/components/shared/Stacktrace/__test__/__snapshots__/Stackframe.test.tsx.snap
@@ -163,6 +163,8 @@ exports[`Stackframe when stackframe has source lines should render correctly 1`]
     }
     id="test"
     initialIsOpen={false}
+    isLoading={false}
+    isLoadingMessage={false}
     paddingSize="none"
   >
     <div
diff --git a/x-pack/plugins/apm/public/components/shared/TransactionBreakdown/TransactionBreakdownGraph/index.tsx b/x-pack/plugins/apm/public/components/shared/TransactionBreakdown/TransactionBreakdownGraph/index.tsx
index 209657971620bb..b908eb8da4d03e 100644
--- a/x-pack/plugins/apm/public/components/shared/TransactionBreakdown/TransactionBreakdownGraph/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/TransactionBreakdown/TransactionBreakdownGraph/index.tsx
@@ -4,19 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useMemo } from 'react';
 import { throttle } from 'lodash';
+import React, { useMemo } from 'react';
+import { asPercent } from '../../../../../common/utils/formatters';
+import { useUiTracker } from '../../../../../../observability/public';
 import { NOT_AVAILABLE_LABEL } from '../../../../../common/i18n';
-import { Coordinate, TimeSeries } from '../../../../../typings/timeseries';
 import { Maybe } from '../../../../../typings/common';
-import { TransactionLineChart } from '../../charts/TransactionCharts/TransactionLineChart';
-import { asPercent } from '../../../../utils/formatters';
-import { unit } from '../../../../style/variables';
+import { Coordinate, TimeSeries } from '../../../../../typings/timeseries';
+import { useUrlParams } from '../../../../hooks/useUrlParams';
 import { isValidCoordinateValue } from '../../../../utils/isValidCoordinateValue';
-import { useUiTracker } from '../../../../../../observability/public';
+import { getEmptySeries } from '../../charts/CustomPlot/getEmptySeries';
+import { TransactionLineChart } from '../../charts/TransactionCharts/TransactionLineChart';
 
 interface Props {
   timeseries: TimeSeries[];
+  noHits: boolean;
 }
 
 const tickFormatY = (y: Maybe<number>) => {
@@ -29,8 +31,9 @@ const formatTooltipValue = (coordinate: Coordinate) => {
     : NOT_AVAILABLE_LABEL;
 };
 
-function TransactionBreakdownGraph(props: Props) {
-  const { timeseries } = props;
+function TransactionBreakdownGraph({ timeseries, noHits }: Props) {
+  const { urlParams } = useUrlParams();
+  const { rangeFrom, rangeTo } = urlParams;
   const trackApmEvent = useUiTracker({ app: 'apm' });
   const handleHover = useMemo(
     () =>
@@ -38,15 +41,23 @@ function TransactionBreakdownGraph(props: Props) {
     [trackApmEvent]
   );
 
+  const emptySeries =
+    rangeFrom && rangeTo
+      ? getEmptySeries(
+          new Date(rangeFrom).getTime(),
+          new Date(rangeTo).getTime()
+        )
+      : [];
+
   return (
     <TransactionLineChart
-      series={timeseries}
+      series={noHits ? emptySeries : timeseries}
       tickFormatY={tickFormatY}
       formatTooltipValue={formatTooltipValue}
       yMax={1}
-      height={unit * 12}
       stacked={true}
       onHover={handleHover}
+      visibleLegendCount={10}
     />
   );
 }
diff --git a/x-pack/plugins/apm/public/components/shared/TransactionBreakdown/TransactionBreakdownKpiList.tsx b/x-pack/plugins/apm/public/components/shared/TransactionBreakdown/TransactionBreakdownKpiList.tsx
deleted file mode 100644
index d3761cf0fe38e3..00000000000000
--- a/x-pack/plugins/apm/public/components/shared/TransactionBreakdown/TransactionBreakdownKpiList.tsx
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import React from 'react';
-import {
-  EuiFlexGrid,
-  EuiFlexItem,
-  EuiFlexGroup,
-  EuiText,
-  EuiTitle,
-  EuiIcon,
-} from '@elastic/eui';
-import styled from 'styled-components';
-import { asPercent } from '../../../utils/formatters';
-
-interface TransactionBreakdownKpi {
-  name: string;
-  percentage: number;
-  color: string;
-}
-
-interface Props {
-  kpis: TransactionBreakdownKpi[];
-}
-
-const Description = styled.span`
-   {
-    white-space: nowrap;
-  }
-`;
-
-function KpiDescription({ name, color }: { name: string; color: string }) {
-  return (
-    <EuiFlexGroup
-      alignItems="center"
-      gutterSize="s"
-      direction="row"
-      wrap={false}
-    >
-      <EuiFlexItem grow={false}>
-        <EuiIcon type="dot" color={color} />
-      </EuiFlexItem>
-      <EuiFlexItem grow={false}>
-        <EuiText color="subdued" size="xs">
-          <Description>{name}</Description>
-        </EuiText>
-      </EuiFlexItem>
-    </EuiFlexGroup>
-  );
-}
-
-function TransactionBreakdownKpiList({ kpis }: Props) {
-  return (
-    <EuiFlexGrid>
-      {kpis.map((kpi) => (
-        <EuiFlexItem key={kpi.name} grow={false}>
-          <EuiFlexGroup direction="column" gutterSize="s">
-            <EuiFlexItem grow={false}>
-              <KpiDescription name={kpi.name} color={kpi.color} />
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <EuiTitle size="s">
-                <span>{asPercent(kpi.percentage, 1)}</span>
-              </EuiTitle>
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </EuiFlexItem>
-      ))}
-    </EuiFlexGrid>
-  );
-}
-
-export { TransactionBreakdownKpiList };
diff --git a/x-pack/plugins/apm/public/components/shared/TransactionBreakdown/index.tsx b/x-pack/plugins/apm/public/components/shared/TransactionBreakdown/index.tsx
index 80ed9163ec08d4..55826497ca3858 100644
--- a/x-pack/plugins/apm/public/components/shared/TransactionBreakdown/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/TransactionBreakdown/index.tsx
@@ -3,28 +3,18 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiPanel,
-  EuiText,
-  EuiTitle,
-} from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiPanel, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
+import { isEmpty } from 'lodash';
 import React from 'react';
 import { FETCH_STATUS } from '../../../hooks/useFetcher';
 import { useTransactionBreakdown } from '../../../hooks/useTransactionBreakdown';
 import { TransactionBreakdownGraph } from './TransactionBreakdownGraph';
-import { TransactionBreakdownKpiList } from './TransactionBreakdownKpiList';
-
-const emptyMessage = i18n.translate('xpack.apm.transactionBreakdown.noData', {
-  defaultMessage: 'No data within this time range.',
-});
 
 function TransactionBreakdown() {
   const { data, status } = useTransactionBreakdown();
-  const { kpis, timeseries } = data;
-  const noHits = data.kpis.length === 0 && status === FETCH_STATUS.SUCCESS;
+  const { timeseries } = data;
+  const noHits = isEmpty(timeseries) && status === FETCH_STATUS.SUCCESS;
 
   return (
     <EuiPanel>
@@ -39,14 +29,7 @@ function TransactionBreakdown() {
           </EuiTitle>
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
-          {noHits ? (
-            <EuiText>{emptyMessage}</EuiText>
-          ) : (
-            <TransactionBreakdownKpiList kpis={kpis} />
-          )}
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <TransactionBreakdownGraph timeseries={timeseries} />
+          <TransactionBreakdownGraph timeseries={timeseries} noHits={noHits} />
         </EuiFlexItem>
       </EuiFlexGroup>
     </EuiPanel>
diff --git a/x-pack/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.stories.tsx b/x-pack/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.stories.tsx
index da9adbb8dfeade..08165418653621 100644
--- a/x-pack/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.stories.tsx
+++ b/x-pack/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.stories.tsx
@@ -19,7 +19,7 @@ import { MockUrlParamsContextProvider } from '../../../context/UrlParamsContext/
 // our current storybook setup has core-js-related problems when trying to import
 // it.
 // storiesOf('app/TransactionDurationAlertTrigger', module).add('example',
-// eslint-disable-next-line no-unused-expressions
+// eslint-disable-next-line @typescript-eslint/no-unused-expressions
 () => {
   const params = {
     threshold: 1500,
diff --git a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/CustomPlot.stories.tsx b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/CustomPlot.stories.tsx
index 48e83763cb9df6..e70c53108cb0e5 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/CustomPlot.stories.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/CustomPlot.stories.tsx
@@ -5,7 +5,7 @@
  */
 import { storiesOf } from '@storybook/react';
 import React from 'react';
-// @ts-ignore
+// @ts-expect-error
 import CustomPlot from './';
 
 storiesOf('shared/charts/CustomPlot', module).add(
diff --git a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/getTimezoneOffsetInMs.test.ts b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/getTimezoneOffsetInMs.test.ts
index 7081286ecf3f2d..935895022931c9 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/getTimezoneOffsetInMs.test.ts
+++ b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/getTimezoneOffsetInMs.test.ts
@@ -12,7 +12,7 @@ describe('getTimezoneOffsetInMs', () => {
   let originalTimezone: moment.MomentZone | null;
 
   beforeAll(() => {
-    // @ts-ignore moment types do not define defaultZone but it's there
+    // @ts-expect-error moment types do not define defaultZone but it's there
     originalTimezone = moment.defaultZone;
   });
 
diff --git a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/getTimezoneOffsetInMs.ts b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/getTimezoneOffsetInMs.ts
index 178707bfd3c488..a442450a192ab6 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/getTimezoneOffsetInMs.ts
+++ b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/getTimezoneOffsetInMs.ts
@@ -6,9 +6,9 @@
 import moment from 'moment-timezone';
 
 export function getTimezoneOffsetInMs(time: number) {
-  // @ts-ignore moment types don't define defaultZone but it's there
+  // @ts-expect-error moment types don't define defaultZone but it's there
   const zone = moment.defaultZone ? moment.defaultZone.name : moment.tz.guess();
 
-  // @ts-ignore
+  // @ts-expect-error
   return moment.tz.zone(zone).parse(time) * 60000;
 }
diff --git a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/index.js b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/index.js
index 41925d651e3617..501d30b5e2ba12 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/index.js
+++ b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/index.js
@@ -67,7 +67,7 @@ export class InnerCustomPlot extends PureComponent {
     (series) => {
       return series.slice(
         0,
-        VISIBLE_LEGEND_COUNT + getHiddenLegendCount(series)
+        this.props.visibleLegendCount + getHiddenLegendCount(series)
       );
     }
   );
@@ -128,14 +128,20 @@ export class InnerCustomPlot extends PureComponent {
   }
 
   render() {
-    const { series, truncateLegends, width, annotations } = this.props;
+    const {
+      series,
+      truncateLegends,
+      width,
+      annotations,
+      visibleLegendCount,
+    } = this.props;
 
     if (!width) {
       return null;
     }
 
     const hiddenSeriesCount = Math.max(
-      series.length - VISIBLE_LEGEND_COUNT - getHiddenLegendCount(series),
+      series.length - visibleLegendCount - getHiddenLegendCount(series),
       0
     );
     const visibleSeries = this.getVisibleSeries({ series });
@@ -239,6 +245,7 @@ InnerCustomPlot.propTypes = {
     })
   ),
   noHits: PropTypes.bool,
+  visibleLegendCount: PropTypes.number,
   onToggleLegend: PropTypes.func,
 };
 
@@ -249,6 +256,7 @@ InnerCustomPlot.defaultProps = {
   truncateLegends: false,
   xAxisTickSizeOuter: 0,
   noHits: false,
+  visibleLegendCount: VISIBLE_LEGEND_COUNT,
 };
 
 export default makeWidthFlexible(InnerCustomPlot);
diff --git a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/plotUtils.test.ts b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/plotUtils.test.ts
index 048a7306348f30..117ec26446de8c 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/plotUtils.test.ts
+++ b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/plotUtils.test.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-// @ts-ignore
 import * as plotUtils from './plotUtils';
 import { TimeSeries, Coordinate } from '../../../../../typings/timeseries';
 
diff --git a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/plotUtils.tsx b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/plotUtils.tsx
index 7721375a404c40..67b7fd31b05bc3 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/plotUtils.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/plotUtils.tsx
@@ -19,7 +19,7 @@ const XY_HEIGHT = unit * 16;
 const XY_MARGIN = {
   top: unit,
   left: unit * 5,
-  right: 0,
+  right: unit,
   bottom: unit * 2,
 };
 
diff --git a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/test/__snapshots__/CustomPlot.test.js.snap b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/test/__snapshots__/CustomPlot.test.js.snap
index f413610ebd9844..20636fa1444797 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/test/__snapshots__/CustomPlot.test.js.snap
+++ b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/test/__snapshots__/CustomPlot.test.js.snap
@@ -82,7 +82,7 @@ Array [
               className="rv-xy-plot__axis__line"
               style={Object {}}
               x1={0}
-              x2={720}
+              x2={704}
               y1={0}
               y2={0}
             />
@@ -93,7 +93,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(72, 0)"
+                transform="translate(70.4, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -116,7 +116,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(192, 0)"
+                transform="translate(187.73333333333332, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -139,7 +139,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(312, 0)"
+                transform="translate(305.06666666666666, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -162,7 +162,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(432, 0)"
+                transform="translate(422.4, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -185,7 +185,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(552, 0)"
+                transform="translate(539.7333333333333, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -208,7 +208,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(672, 0)"
+                transform="translate(657.0666666666667, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -237,21 +237,21 @@ Array [
             <line
               className="rv-xy-plot__grid-lines__line"
               x1={0}
-              x2={720}
+              x2={704}
               y1={208}
               y2={208}
             />
             <line
               className="rv-xy-plot__grid-lines__line"
               x1={0}
-              x2={720}
+              x2={704}
               y1={104}
               y2={104}
             />
             <line
               className="rv-xy-plot__grid-lines__line"
               x1={0}
-              x2={720}
+              x2={704}
               y1={0}
               y2={0}
             />
@@ -434,7 +434,7 @@ Array [
           >
             <path
               className="rv-xy-plot__series rv-xy-plot__series--line "
-              d="M0,208C8,177.67069216000004,16,147.3413843200001,24,145.82854374400006C32,144.31570316800003,40,143.55928288,48,143.55928288C56,143.55928288,64,143.69173256533335,72,143.95663193600006C80,144.22153130666678,88,150.087546752,96,150.087546752C104,150.087546752,112,143.61986468266673,120,141.36762432000006C128,139.1153839573334,136,138.10678017066667,144,136.574104576C152,135.04142898133333,160,134.60761100800002,168,132.171570752C176,129.735530496,184,122.7740017919999,192,121.95786303999996C200,121.14172428800003,208,120.73365491200006,216,120.73365491200006C224,120.73365491200006,232,150.33875334399997,240,150.33875334399997C248,150.33875334399997,256,145.21265574400005,264,145.21265574400005C272,145.21265574400005,280,159.49950515199998,288,159.49950515199998C296,159.49950515199998,304,159.25604087466667,312,158.76911232C320,158.28218376533334,328,153.13340861866664,336,148.71727519999996C344,144.30114178133329,352,136.23707191466664,360,132.27231180799998C368,128.30755170133332,376,127.558024672,384,124.92871456C392,122.299404448,400,116.49645113600002,408,116.49645113600002C416,116.49645113600002,424,142.8818553066667,432,147.94231920000001C440,153.00278309333333,448,155.53301504,456,155.53301504C464,155.53301504,472,147.54844651733333,480,141.915090304C488,136.28173409066667,495.99999999999994,121.73287776000008,503.99999999999994,121.73287776000008C511.99999999999994,121.73287776000008,520,147.90280169599995,528,152.63684758399998C536,157.370893472,544,159.73791641600002,552,159.73791641600002C560,159.73791641600002,568,140.4438672,576,140.4438672C584,140.4438672,592,150.146582976,600,150.146582976C608,150.146582976,616,121.98686448,624,121.98686448C632,121.98686448,640,208,648,208C656,208,664,133.83377571200015,672,102.0323582720003C680,70.23094083200043,688,17.191495360000836,696,17.191495360000836C704,17.191495360000836,712,112.59574768000043,720,208"
+              d="M0,208C7.822222222222222,177.67069216000004,15.644444444444442,147.3413843200001,23.466666666666665,145.82854374400006C31.288888888888888,144.31570316800003,39.11111111111111,143.55928288,46.93333333333333,143.55928288C54.75555555555555,143.55928288,62.57777777777778,143.69173256533335,70.4,143.95663193600006C78.22222222222223,144.22153130666678,86.04444444444444,150.087546752,93.86666666666666,150.087546752C101.68888888888888,150.087546752,109.5111111111111,143.61986468266673,117.33333333333333,141.36762432000006C125.15555555555555,139.1153839573334,132.9777777777778,138.10678017066667,140.8,136.574104576C148.62222222222223,135.04142898133333,156.44444444444446,134.60761100800002,164.26666666666668,132.171570752C172.0888888888889,129.735530496,179.9111111111111,122.7740017919999,187.73333333333332,121.95786303999996C195.55555555555554,121.14172428800003,203.37777777777777,120.73365491200006,211.2,120.73365491200006C219.0222222222222,120.73365491200006,226.84444444444443,150.33875334399997,234.66666666666666,150.33875334399997C242.48888888888888,150.33875334399997,250.3111111111111,145.21265574400005,258.1333333333333,145.21265574400005C265.9555555555556,145.21265574400005,273.77777777777777,159.49950515199998,281.6,159.49950515199998C289.4222222222222,159.49950515199998,297.24444444444447,159.25604087466667,305.06666666666666,158.76911232C312.8888888888889,158.28218376533334,320.7111111111111,153.13340861866664,328.53333333333336,148.71727519999996C336.35555555555555,144.30114178133329,344.1777777777778,136.23707191466664,352,132.27231180799998C359.8222222222222,128.30755170133332,367.64444444444445,127.55802467199999,375.46666666666664,124.92871456C383.2888888888889,122.299404448,391.1111111111111,116.49645113600002,398.93333333333334,116.49645113600002C406.75555555555553,116.49645113600002,414.5777777777778,142.8818553066667,422.4,147.94231920000001C430.22222222222223,153.00278309333333,438.0444444444444,155.53301504,445.8666666666667,155.53301504C453.68888888888887,155.53301504,461.5111111111111,147.5484465173333,469.3333333333333,141.915090304C477.1555555555555,136.28173409066667,484.97777777777776,121.73287776000008,492.79999999999995,121.73287776000008C500.6222222222222,121.73287776000008,508.4444444444444,147.90280169599995,516.2666666666667,152.63684758399998C524.0888888888888,157.370893472,531.9111111111112,159.73791641600002,539.7333333333333,159.73791641600002C547.5555555555555,159.73791641600002,555.3777777777779,140.4438672,563.2,140.4438672C571.0222222222222,140.4438672,578.8444444444445,150.146582976,586.6666666666667,150.146582976C594.4888888888889,150.146582976,602.3111111111111,121.98686448,610.1333333333333,121.98686448C617.9555555555555,121.98686448,625.7777777777778,208,633.6,208C641.4222222222222,208,649.2444444444445,133.8337757120002,657.0666666666667,102.0323582720003C664.8888888888889,70.23094083200053,672.7111111111111,17.191495360000836,680.5333333333333,17.191495360000836C688.3555555555555,17.191495360000836,696.1777777777778,112.59574768000043,704,208"
               onClick={[Function]}
               onContextMenu={[Function]}
               onMouseOut={[Function]}
@@ -471,7 +471,7 @@ Array [
                 }
               />
               <circle
-                cx={24}
+                cx={23.466666666666665}
                 cy={145.82854374400006}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -488,7 +488,7 @@ Array [
                 }
               />
               <circle
-                cx={48}
+                cx={46.93333333333333}
                 cy={143.55928288}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -505,7 +505,7 @@ Array [
                 }
               />
               <circle
-                cx={72}
+                cx={70.4}
                 cy={143.95663193600006}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -522,7 +522,7 @@ Array [
                 }
               />
               <circle
-                cx={96}
+                cx={93.86666666666666}
                 cy={150.087546752}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -539,7 +539,7 @@ Array [
                 }
               />
               <circle
-                cx={120}
+                cx={117.33333333333333}
                 cy={141.36762432000006}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -556,7 +556,7 @@ Array [
                 }
               />
               <circle
-                cx={144}
+                cx={140.8}
                 cy={136.574104576}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -573,7 +573,7 @@ Array [
                 }
               />
               <circle
-                cx={168}
+                cx={164.26666666666668}
                 cy={132.171570752}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -590,7 +590,7 @@ Array [
                 }
               />
               <circle
-                cx={192}
+                cx={187.73333333333332}
                 cy={121.95786303999996}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -607,7 +607,7 @@ Array [
                 }
               />
               <circle
-                cx={216}
+                cx={211.2}
                 cy={120.73365491200006}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -624,7 +624,7 @@ Array [
                 }
               />
               <circle
-                cx={240}
+                cx={234.66666666666666}
                 cy={150.33875334399997}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -641,7 +641,7 @@ Array [
                 }
               />
               <circle
-                cx={264}
+                cx={258.1333333333333}
                 cy={145.21265574400005}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -658,7 +658,7 @@ Array [
                 }
               />
               <circle
-                cx={288}
+                cx={281.6}
                 cy={159.49950515199998}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -675,7 +675,7 @@ Array [
                 }
               />
               <circle
-                cx={312}
+                cx={305.06666666666666}
                 cy={158.76911232}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -692,7 +692,7 @@ Array [
                 }
               />
               <circle
-                cx={336}
+                cx={328.53333333333336}
                 cy={148.71727519999996}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -709,7 +709,7 @@ Array [
                 }
               />
               <circle
-                cx={360}
+                cx={352}
                 cy={132.27231180799998}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -726,7 +726,7 @@ Array [
                 }
               />
               <circle
-                cx={384}
+                cx={375.46666666666664}
                 cy={124.92871456}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -743,7 +743,7 @@ Array [
                 }
               />
               <circle
-                cx={408}
+                cx={398.93333333333334}
                 cy={116.49645113600002}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -760,7 +760,7 @@ Array [
                 }
               />
               <circle
-                cx={432}
+                cx={422.4}
                 cy={147.94231920000001}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -777,7 +777,7 @@ Array [
                 }
               />
               <circle
-                cx={456}
+                cx={445.8666666666667}
                 cy={155.53301504}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -794,7 +794,7 @@ Array [
                 }
               />
               <circle
-                cx={480}
+                cx={469.3333333333333}
                 cy={141.915090304}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -811,7 +811,7 @@ Array [
                 }
               />
               <circle
-                cx={503.99999999999994}
+                cx={492.79999999999995}
                 cy={121.73287776000008}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -828,7 +828,7 @@ Array [
                 }
               />
               <circle
-                cx={528}
+                cx={516.2666666666667}
                 cy={152.63684758399998}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -845,7 +845,7 @@ Array [
                 }
               />
               <circle
-                cx={552}
+                cx={539.7333333333333}
                 cy={159.73791641600002}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -862,7 +862,7 @@ Array [
                 }
               />
               <circle
-                cx={576}
+                cx={563.2}
                 cy={140.4438672}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -879,7 +879,7 @@ Array [
                 }
               />
               <circle
-                cx={600}
+                cx={586.6666666666667}
                 cy={150.146582976}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -896,7 +896,7 @@ Array [
                 }
               />
               <circle
-                cx={624}
+                cx={610.1333333333333}
                 cy={121.98686448}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -913,7 +913,7 @@ Array [
                 }
               />
               <circle
-                cx={648}
+                cx={633.6}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -930,7 +930,7 @@ Array [
                 }
               />
               <circle
-                cx={672}
+                cx={657.0666666666667}
                 cy={102.0323582720003}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -947,7 +947,7 @@ Array [
                 }
               />
               <circle
-                cx={696}
+                cx={680.5333333333333}
                 cy={17.191495360000836}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -964,7 +964,7 @@ Array [
                 }
               />
               <circle
-                cx={720}
+                cx={704}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -987,7 +987,7 @@ Array [
           >
             <path
               className="rv-xy-plot__series rv-xy-plot__series--line "
-              d="M0,208C8,183.10434549333334,16,158.20869098666665,24,157.4191424C32,156.62959381333334,40,156.23481952,48,156.23481952C56,156.23481952,64,160.81596682666668,72,161.56425792000002C80,162.31254901333335,88,162.68669456,96,162.68669456C104,162.68669456,112,158.86059904000004,120,158.86059904000004C128,158.86059904000004,136,163.62246992000001,144,163.62246992000001C152,163.62246992000001,160,142.73391392000002,168,142.73391392000002C176,142.73391392000002,184,165.8699744,192,165.8699744C200,165.8699744,208,163.6534529066668,216,163.52439168000006C224,163.39533045333334,232,163.45986106666672,240,163.33079984C248,163.20173861333328,256,161.4781168,264,161.4781168C272,161.4781168,280,161.87593552,288,162.16472064C296,162.45350576,304,162.51342293333335,312,163.21082752C320,163.90823210666667,328,166.81319824,336,166.81319824C344,166.81319824,352,143.21282560000003,360,143.21282560000003C368,143.21282560000003,376,164.71169104,384,164.71169104C392,164.71169104,400,135.88840304000001,408,135.88840304000001C416,135.88840304000001,424,152.6074260533333,432,157.5681224C440,162.52881874666667,448,165.65258112,456,165.65258112C464,165.65258112,472,165.61368234666668,480,165.53588480000002C488,165.45808725333336,495.99999999999994,147.713644,503.99999999999994,147.713644C511.99999999999994,147.713644,520,163.65928869333334,528,164.06490256C536,164.47051642666668,544,164.27093592,552,164.67332336C560,165.07571080000002,568,166.4792272,576,166.4792272C584,166.4792272,592,152.7591936,600,152.7591936C608,152.7591936,616,156.23893584,624,163.19842032C632,170.15790479999998,640,208,648,208C656,208,664,177.47751424,672,161.37461184C680,145.27170944,688,111.3825856,696,111.3825856C704,111.3825856,712,159.6912928,720,208"
+              d="M0,208C7.822222222222222,183.10434549333334,15.644444444444442,158.20869098666665,23.466666666666665,157.4191424C31.288888888888888,156.62959381333334,39.11111111111111,156.23481952,46.93333333333333,156.23481952C54.75555555555555,156.23481952,62.57777777777778,160.81596682666668,70.4,161.56425792000002C78.22222222222223,162.31254901333335,86.04444444444444,162.68669456,93.86666666666666,162.68669456C101.68888888888888,162.68669456,109.5111111111111,158.86059904000004,117.33333333333333,158.86059904000004C125.15555555555555,158.86059904000004,132.9777777777778,163.62246992000001,140.8,163.62246992000001C148.62222222222223,163.62246992000001,156.44444444444446,142.73391392000002,164.26666666666668,142.73391392000002C172.0888888888889,142.73391392000002,179.9111111111111,165.8699744,187.73333333333332,165.8699744C195.55555555555554,165.8699744,203.37777777777777,163.6534529066668,211.2,163.52439168000006C219.0222222222222,163.39533045333334,226.84444444444443,163.45986106666672,234.66666666666666,163.33079984C242.48888888888888,163.20173861333328,250.3111111111111,161.4781168,258.1333333333333,161.4781168C265.9555555555556,161.4781168,273.77777777777777,161.87593552,281.6,162.16472064C289.4222222222222,162.45350576,297.24444444444447,162.51342293333335,305.06666666666666,163.21082752C312.8888888888889,163.90823210666667,320.7111111111111,166.81319824,328.53333333333336,166.81319824C336.35555555555555,166.81319824,344.1777777777778,143.21282560000003,352,143.21282560000003C359.8222222222222,143.21282560000003,367.64444444444445,164.71169104,375.46666666666664,164.71169104C383.2888888888889,164.71169104,391.1111111111111,135.88840304000001,398.93333333333334,135.88840304000001C406.75555555555553,135.88840304000001,414.5777777777778,152.6074260533333,422.4,157.5681224C430.22222222222223,162.52881874666667,438.0444444444444,165.65258112,445.8666666666667,165.65258112C453.68888888888887,165.65258112,461.5111111111111,165.61368234666668,469.3333333333333,165.53588480000002C477.1555555555555,165.45808725333336,484.97777777777776,147.713644,492.79999999999995,147.713644C500.6222222222222,147.713644,508.4444444444444,163.65928869333334,516.2666666666667,164.06490256C524.0888888888888,164.47051642666668,531.9111111111112,164.27093592,539.7333333333333,164.67332336C547.5555555555555,165.07571080000002,555.3777777777779,166.4792272,563.2,166.4792272C571.0222222222222,166.4792272,578.8444444444445,152.7591936,586.6666666666667,152.7591936C594.4888888888889,152.7591936,602.3111111111111,156.23893584,610.1333333333333,163.19842032C617.9555555555555,170.15790480000004,625.7777777777778,208,633.6,208C641.4222222222222,208,649.2444444444445,177.47751424000003,657.0666666666667,161.37461184C664.8888888888889,145.27170944000005,672.7111111111111,111.3825856,680.5333333333333,111.3825856C688.3555555555555,111.3825856,696.1777777777778,159.69129279999999,704,208"
               onClick={[Function]}
               onContextMenu={[Function]}
               onMouseOut={[Function]}
@@ -1024,7 +1024,7 @@ Array [
                 }
               />
               <circle
-                cx={24}
+                cx={23.466666666666665}
                 cy={157.4191424}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1041,7 +1041,7 @@ Array [
                 }
               />
               <circle
-                cx={48}
+                cx={46.93333333333333}
                 cy={156.23481952}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1058,7 +1058,7 @@ Array [
                 }
               />
               <circle
-                cx={72}
+                cx={70.4}
                 cy={161.56425792000002}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1075,7 +1075,7 @@ Array [
                 }
               />
               <circle
-                cx={96}
+                cx={93.86666666666666}
                 cy={162.68669456}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1092,7 +1092,7 @@ Array [
                 }
               />
               <circle
-                cx={120}
+                cx={117.33333333333333}
                 cy={158.86059904000004}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1109,7 +1109,7 @@ Array [
                 }
               />
               <circle
-                cx={144}
+                cx={140.8}
                 cy={163.62246992000001}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1126,7 +1126,7 @@ Array [
                 }
               />
               <circle
-                cx={168}
+                cx={164.26666666666668}
                 cy={142.73391392000002}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1143,7 +1143,7 @@ Array [
                 }
               />
               <circle
-                cx={192}
+                cx={187.73333333333332}
                 cy={165.8699744}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1160,7 +1160,7 @@ Array [
                 }
               />
               <circle
-                cx={216}
+                cx={211.2}
                 cy={163.52439168000006}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1177,7 +1177,7 @@ Array [
                 }
               />
               <circle
-                cx={240}
+                cx={234.66666666666666}
                 cy={163.33079984}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1194,7 +1194,7 @@ Array [
                 }
               />
               <circle
-                cx={264}
+                cx={258.1333333333333}
                 cy={161.4781168}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1211,7 +1211,7 @@ Array [
                 }
               />
               <circle
-                cx={288}
+                cx={281.6}
                 cy={162.16472064}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1228,7 +1228,7 @@ Array [
                 }
               />
               <circle
-                cx={312}
+                cx={305.06666666666666}
                 cy={163.21082752}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1245,7 +1245,7 @@ Array [
                 }
               />
               <circle
-                cx={336}
+                cx={328.53333333333336}
                 cy={166.81319824}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1262,7 +1262,7 @@ Array [
                 }
               />
               <circle
-                cx={360}
+                cx={352}
                 cy={143.21282560000003}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1279,7 +1279,7 @@ Array [
                 }
               />
               <circle
-                cx={384}
+                cx={375.46666666666664}
                 cy={164.71169104}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1296,7 +1296,7 @@ Array [
                 }
               />
               <circle
-                cx={408}
+                cx={398.93333333333334}
                 cy={135.88840304000001}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1313,7 +1313,7 @@ Array [
                 }
               />
               <circle
-                cx={432}
+                cx={422.4}
                 cy={157.5681224}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1330,7 +1330,7 @@ Array [
                 }
               />
               <circle
-                cx={456}
+                cx={445.8666666666667}
                 cy={165.65258112}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1347,7 +1347,7 @@ Array [
                 }
               />
               <circle
-                cx={480}
+                cx={469.3333333333333}
                 cy={165.53588480000002}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1364,7 +1364,7 @@ Array [
                 }
               />
               <circle
-                cx={503.99999999999994}
+                cx={492.79999999999995}
                 cy={147.713644}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1381,7 +1381,7 @@ Array [
                 }
               />
               <circle
-                cx={528}
+                cx={516.2666666666667}
                 cy={164.06490256}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1398,7 +1398,7 @@ Array [
                 }
               />
               <circle
-                cx={552}
+                cx={539.7333333333333}
                 cy={164.67332336}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1415,7 +1415,7 @@ Array [
                 }
               />
               <circle
-                cx={576}
+                cx={563.2}
                 cy={166.4792272}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1432,7 +1432,7 @@ Array [
                 }
               />
               <circle
-                cx={600}
+                cx={586.6666666666667}
                 cy={152.7591936}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1449,7 +1449,7 @@ Array [
                 }
               />
               <circle
-                cx={624}
+                cx={610.1333333333333}
                 cy={163.19842032}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1466,7 +1466,7 @@ Array [
                 }
               />
               <circle
-                cx={648}
+                cx={633.6}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1483,7 +1483,7 @@ Array [
                 }
               />
               <circle
-                cx={672}
+                cx={657.0666666666667}
                 cy={161.37461184}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1500,7 +1500,7 @@ Array [
                 }
               />
               <circle
-                cx={696}
+                cx={680.5333333333333}
                 cy={111.3825856}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1517,7 +1517,7 @@ Array [
                 }
               />
               <circle
-                cx={720}
+                cx={704}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1540,7 +1540,7 @@ Array [
           >
             <path
               className="rv-xy-plot__series rv-xy-plot__series--line "
-              d="M0,208C8,198.0144506122449,16,188.0289012244898,24,188.0289012244898C32,188.0289012244898,40,190.93245866666666,48,190.93245866666666C56,190.93245866666666,64,190.28154649962812,72,189.81180675918367C80,189.34206701873921,88,188.114020224,96,188.114020224C104,188.114020224,112,188.75217580408165,120,188.75217580408165C128,188.75217580408165,136,187.7737856411058,144,186.9231112C152,186.07243675889418,160,183.64812915744682,168,183.64812915744682C176,183.64812915744682,184,187.40215166647675,192,188.65222657560977C200,189.9023014847428,208,191.1485786122449,216,191.1485786122449C224,191.1485786122449,232,187.99938938181816,240,187.99938938181816C248,187.99938938181816,256,192.51163795348836,264,192.51163795348836C272,192.51163795348836,280,186.99252785777776,288,186.99252785777776C296,186.99252785777776,304,191.5321727255814,312,191.5321727255814C320,191.5321727255814,328,188.75657926666668,336,188.75657926666668C344,188.75657926666668,352,189.74989696,360,189.74989696C368,189.74989696,376,189.71163744,384,189.6351184C392,189.55859936000002,400,184.25858141935484,408,184.25858141935484C416,184.25858141935484,424,190.2827607652174,432,190.2827607652174C440,190.2827607652174,448,189.76271776603772,456,189.76271776603772C464,189.76271776603772,472,191.83746261333334,480,191.83746261333334C488,191.83746261333334,495.99999999999994,187.9456040347826,503.99999999999994,187.9456040347826C511.99999999999994,187.9456040347826,520,188.09594339288537,528,188.3966221090909C536,188.69730082529645,544,191.762533248,552,191.762533248C560,191.762533248,568,191.6625795195817,576,191.4626720627451C584,191.2627646059085,592,189.4011021381818,600,189.4011021381818C608,189.4011021381818,616,189.79567013943304,624,190.58480614193547C632,191.3739421444379,640,208,648,208C656,208,664,194.91739193977511,672,189.69166496603773C680,184.46593799230035,688,176.64563815757575,696,176.64563815757575C704,176.64563815757575,712,192.32281907878786,720,208"
+              d="M0,208C7.822222222222222,198.0144506122449,15.644444444444442,188.0289012244898,23.466666666666665,188.0289012244898C31.288888888888888,188.0289012244898,39.11111111111111,190.93245866666666,46.93333333333333,190.93245866666666C54.75555555555555,190.93245866666666,62.57777777777778,190.28154649962812,70.4,189.81180675918367C78.22222222222223,189.34206701873921,86.04444444444444,188.114020224,93.86666666666666,188.114020224C101.68888888888888,188.114020224,109.5111111111111,188.75217580408165,117.33333333333333,188.75217580408165C125.15555555555555,188.75217580408165,132.9777777777778,187.7737856411058,140.8,186.9231112C148.62222222222223,186.07243675889418,156.44444444444446,183.64812915744682,164.26666666666668,183.64812915744682C172.0888888888889,183.64812915744682,179.9111111111111,187.40215166647675,187.73333333333332,188.65222657560977C195.55555555555554,189.9023014847428,203.37777777777777,191.1485786122449,211.2,191.1485786122449C219.0222222222222,191.1485786122449,226.84444444444443,187.99938938181816,234.66666666666666,187.99938938181816C242.48888888888888,187.99938938181816,250.3111111111111,192.51163795348836,258.1333333333333,192.51163795348836C265.9555555555556,192.51163795348836,273.77777777777777,186.99252785777776,281.6,186.99252785777776C289.4222222222222,186.99252785777776,297.24444444444447,191.5321727255814,305.06666666666666,191.5321727255814C312.8888888888889,191.5321727255814,320.7111111111111,188.75657926666668,328.53333333333336,188.75657926666668C336.35555555555555,188.75657926666668,344.1777777777778,189.74989696,352,189.74989696C359.8222222222222,189.74989696,367.64444444444445,189.71163744,375.46666666666664,189.6351184C383.2888888888889,189.55859936000002,391.1111111111111,184.25858141935484,398.93333333333334,184.25858141935484C406.75555555555553,184.25858141935484,414.5777777777778,190.2827607652174,422.4,190.2827607652174C430.22222222222223,190.2827607652174,438.0444444444444,189.76271776603772,445.8666666666667,189.76271776603772C453.68888888888887,189.76271776603772,461.5111111111111,191.83746261333334,469.3333333333333,191.83746261333334C477.1555555555555,191.83746261333334,484.97777777777776,187.9456040347826,492.79999999999995,187.9456040347826C500.6222222222222,187.9456040347826,508.4444444444444,188.09594339288537,516.2666666666667,188.3966221090909C524.0888888888888,188.69730082529645,531.9111111111112,191.762533248,539.7333333333333,191.762533248C547.5555555555555,191.762533248,555.3777777777779,191.6625795195817,563.2,191.4626720627451C571.0222222222222,191.2627646059085,578.8444444444445,189.4011021381818,586.6666666666667,189.4011021381818C594.4888888888889,189.4011021381818,602.3111111111111,189.79567013943304,610.1333333333333,190.58480614193547C617.9555555555555,191.3739421444379,625.7777777777778,208,633.6,208C641.4222222222222,208,649.2444444444445,194.91739193977511,657.0666666666667,189.69166496603773C664.8888888888889,184.46593799230038,672.7111111111111,176.64563815757575,680.5333333333333,176.64563815757575C688.3555555555555,176.64563815757575,696.1777777777778,192.32281907878786,704,208"
               onClick={[Function]}
               onContextMenu={[Function]}
               onMouseOut={[Function]}
@@ -1577,7 +1577,7 @@ Array [
                 }
               />
               <circle
-                cx={24}
+                cx={23.466666666666665}
                 cy={188.0289012244898}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1594,7 +1594,7 @@ Array [
                 }
               />
               <circle
-                cx={48}
+                cx={46.93333333333333}
                 cy={190.93245866666666}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1611,7 +1611,7 @@ Array [
                 }
               />
               <circle
-                cx={72}
+                cx={70.4}
                 cy={189.81180675918367}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1628,7 +1628,7 @@ Array [
                 }
               />
               <circle
-                cx={96}
+                cx={93.86666666666666}
                 cy={188.114020224}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1645,7 +1645,7 @@ Array [
                 }
               />
               <circle
-                cx={120}
+                cx={117.33333333333333}
                 cy={188.75217580408165}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1662,7 +1662,7 @@ Array [
                 }
               />
               <circle
-                cx={144}
+                cx={140.8}
                 cy={186.9231112}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1679,7 +1679,7 @@ Array [
                 }
               />
               <circle
-                cx={168}
+                cx={164.26666666666668}
                 cy={183.64812915744682}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1696,7 +1696,7 @@ Array [
                 }
               />
               <circle
-                cx={192}
+                cx={187.73333333333332}
                 cy={188.65222657560977}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1713,7 +1713,7 @@ Array [
                 }
               />
               <circle
-                cx={216}
+                cx={211.2}
                 cy={191.1485786122449}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1730,7 +1730,7 @@ Array [
                 }
               />
               <circle
-                cx={240}
+                cx={234.66666666666666}
                 cy={187.99938938181816}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1747,7 +1747,7 @@ Array [
                 }
               />
               <circle
-                cx={264}
+                cx={258.1333333333333}
                 cy={192.51163795348836}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1764,7 +1764,7 @@ Array [
                 }
               />
               <circle
-                cx={288}
+                cx={281.6}
                 cy={186.99252785777776}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1781,7 +1781,7 @@ Array [
                 }
               />
               <circle
-                cx={312}
+                cx={305.06666666666666}
                 cy={191.5321727255814}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1798,7 +1798,7 @@ Array [
                 }
               />
               <circle
-                cx={336}
+                cx={328.53333333333336}
                 cy={188.75657926666668}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1815,7 +1815,7 @@ Array [
                 }
               />
               <circle
-                cx={360}
+                cx={352}
                 cy={189.74989696}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1832,7 +1832,7 @@ Array [
                 }
               />
               <circle
-                cx={384}
+                cx={375.46666666666664}
                 cy={189.6351184}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1849,7 +1849,7 @@ Array [
                 }
               />
               <circle
-                cx={408}
+                cx={398.93333333333334}
                 cy={184.25858141935484}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1866,7 +1866,7 @@ Array [
                 }
               />
               <circle
-                cx={432}
+                cx={422.4}
                 cy={190.2827607652174}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1883,7 +1883,7 @@ Array [
                 }
               />
               <circle
-                cx={456}
+                cx={445.8666666666667}
                 cy={189.76271776603772}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1900,7 +1900,7 @@ Array [
                 }
               />
               <circle
-                cx={480}
+                cx={469.3333333333333}
                 cy={191.83746261333334}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1917,7 +1917,7 @@ Array [
                 }
               />
               <circle
-                cx={503.99999999999994}
+                cx={492.79999999999995}
                 cy={187.9456040347826}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1934,7 +1934,7 @@ Array [
                 }
               />
               <circle
-                cx={528}
+                cx={516.2666666666667}
                 cy={188.3966221090909}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1951,7 +1951,7 @@ Array [
                 }
               />
               <circle
-                cx={552}
+                cx={539.7333333333333}
                 cy={191.762533248}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1968,7 +1968,7 @@ Array [
                 }
               />
               <circle
-                cx={576}
+                cx={563.2}
                 cy={191.4626720627451}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -1985,7 +1985,7 @@ Array [
                 }
               />
               <circle
-                cx={600}
+                cx={586.6666666666667}
                 cy={189.4011021381818}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -2002,7 +2002,7 @@ Array [
                 }
               />
               <circle
-                cx={624}
+                cx={610.1333333333333}
                 cy={190.58480614193547}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -2019,7 +2019,7 @@ Array [
                 }
               />
               <circle
-                cx={648}
+                cx={633.6}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -2036,7 +2036,7 @@ Array [
                 }
               />
               <circle
-                cx={672}
+                cx={657.0666666666667}
                 cy={189.69166496603773}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -2053,7 +2053,7 @@ Array [
                 }
               />
               <circle
-                cx={696}
+                cx={680.5333333333333}
                 cy={176.64563815757575}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -2070,7 +2070,7 @@ Array [
                 }
               />
               <circle
-                cx={720}
+                cx={704}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -2160,7 +2160,7 @@ Array [
           >
             <path
               className="rv-voronoi__cell "
-              d="M92,256L92,16L80,16L80,256Z"
+              d="M91.7333335,256L91.7333335,16L80,16L80,256Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2175,7 +2175,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M92,16L92,256L116,256L116,16Z"
+              d="M91.7333335,16L91.7333335,256L115.19999999999999,256L115.19999999999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2190,7 +2190,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M116,16L116,256L140,256L140,16Z"
+              d="M115.19999999999999,16L115.19999999999999,256L138.6666665,256L138.6666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2205,7 +2205,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M140,16L140,256L164,256L164,16Z"
+              d="M138.6666665,16L138.6666665,256L162.1333335,256L162.1333335,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2220,7 +2220,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M164,16L164,256L188,256L188,16Z"
+              d="M162.1333335,16L162.1333335,256L185.59999999999997,256L185.59999999999997,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2235,7 +2235,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M188,16L188,256L212,256L212,16Z"
+              d="M185.59999999999997,16L185.59999999999997,256L209.0666665,256L209.0666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2250,7 +2250,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M212,16L212,256L236,256L236,16Z"
+              d="M209.0666665,16L209.0666665,256L232.53333349999997,256L232.53333349999997,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2265,7 +2265,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M236,16L236,256L260,256L260,16Z"
+              d="M232.53333349999997,16L232.53333349999997,256L256,256L256,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2280,7 +2280,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M260,16L260,256L284,256L284,16Z"
+              d="M256,16L256,256L279.4666665,256L279.4666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2295,7 +2295,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M284,16L284,256L308,256L308,16Z"
+              d="M279.4666665,16L279.4666665,256L302.9333335,256L302.9333335,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2310,7 +2310,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M308,16L308,256L332,256L332,16Z"
+              d="M302.9333335,16L302.9333335,256L326.4,256L326.4,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2325,7 +2325,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M332,16L332,256L356,256L356,16Z"
+              d="M326.4,16L326.4,256L349.86666649999995,256L349.86666649999995,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2340,7 +2340,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M356,16L356,256L380,256L380,16Z"
+              d="M349.86666649999995,16L349.86666649999995,256L373.3333335,256L373.3333335,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2355,7 +2355,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M380,16L380,256L404,256L404,16Z"
+              d="M373.3333335,16L373.3333335,256L396.79999999999995,256L396.79999999999995,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2370,7 +2370,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M404,16L404,256L428,256L428,16Z"
+              d="M396.79999999999995,16L396.79999999999995,256L420.2666665,256L420.2666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2385,7 +2385,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M428,16L428,256L452,256L452,16Z"
+              d="M420.2666665,16L420.2666665,256L443.73333349999996,256L443.73333349999996,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2400,7 +2400,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M452,16L452,256L476,256L476,16Z"
+              d="M443.73333349999996,16L443.73333349999996,256L467.2,256L467.2,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2415,7 +2415,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M476,16L476,256L500,256L500,16Z"
+              d="M467.2,16L467.2,256L490.6666665,256L490.6666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2430,7 +2430,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M500,16L500,256L524,256L524,16Z"
+              d="M490.6666665,16L490.6666665,256L514.1333334999999,256L514.1333334999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2445,7 +2445,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M524,16L524,256L548,256L548,16Z"
+              d="M514.1333334999999,16L514.1333334999999,256L537.5999999999999,256L537.5999999999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2460,7 +2460,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M548,16L548,256L572,256L572,16Z"
+              d="M537.5999999999999,16L537.5999999999999,256L561.0666664999999,256L561.0666664999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2475,7 +2475,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M572,16L572,256L596,256L596,16Z"
+              d="M561.0666664999999,16L561.0666664999999,256L584.5333335,256L584.5333335,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2490,7 +2490,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M596,16L596,256L620,256L620,16Z"
+              d="M584.5333335,16L584.5333335,256L608,256L608,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2505,7 +2505,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M620,16L620,256L644,256L644,16Z"
+              d="M608,16L608,256L631.4666665,256L631.4666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2520,7 +2520,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M644,16L644,256L668,256L668,16Z"
+              d="M631.4666665,16L631.4666665,256L654.9333334999999,256L654.9333334999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2535,7 +2535,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M668,16L668,256L692,256L692,16Z"
+              d="M654.9333334999999,16L654.9333334999999,256L678.4,256L678.4,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2550,7 +2550,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M692,16L692,256L716,256L716,16Z"
+              d="M678.4,16L678.4,256L701.8666665000001,256L701.8666665000001,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2565,7 +2565,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M716,16L716,256L740,256L740,16Z"
+              d="M701.8666665000001,16L701.8666665000001,256L725.3333335,256L725.3333335,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2580,7 +2580,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M740,16L740,256L764,256L764,16Z"
+              d="M725.3333335,16L725.3333335,256L748.8,256L748.8,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2595,7 +2595,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M764,16L764,256L788,256L788,16Z"
+              d="M748.8,16L748.8,256L772.2666664999999,256L772.2666664999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2610,7 +2610,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M788,16L788,256L800,256L800,16Z"
+              d="M772.2666664999999,16L772.2666664999999,256L800,256L800,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -2840,8 +2840,8 @@ exports[`when response has data when dragging without releasing should display S
   fillOpacity="0.1"
   height={208}
   pointerEvents="none"
-  width={239.9999999999999}
-  x={320}
+  width={234.66666666666663}
+  x={314.66666666666663}
   y={16}
 />
 `;
@@ -3018,7 +3018,7 @@ Array [
               className="rv-xy-plot__axis__line"
               style={Object {}}
               x1={0}
-              x2={720}
+              x2={704}
               y1={0}
               y2={0}
             />
@@ -3029,7 +3029,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(72, 0)"
+                transform="translate(70.4, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -3052,7 +3052,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(192, 0)"
+                transform="translate(187.73333333333332, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -3075,7 +3075,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(312, 0)"
+                transform="translate(305.06666666666666, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -3098,7 +3098,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(432, 0)"
+                transform="translate(422.4, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -3121,7 +3121,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(552, 0)"
+                transform="translate(539.7333333333333, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -3144,7 +3144,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(672, 0)"
+                transform="translate(657.0666666666667, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -3173,21 +3173,21 @@ Array [
             <line
               className="rv-xy-plot__grid-lines__line"
               x1={0}
-              x2={720}
+              x2={704}
               y1={208}
               y2={208}
             />
             <line
               className="rv-xy-plot__grid-lines__line"
               x1={0}
-              x2={720}
+              x2={704}
               y1={104}
               y2={104}
             />
             <line
               className="rv-xy-plot__grid-lines__line"
               x1={0}
-              x2={720}
+              x2={704}
               y1={0}
               y2={0}
             />
@@ -3370,7 +3370,7 @@ Array [
           >
             <path
               className="rv-xy-plot__series rv-xy-plot__series--line "
-              d="M0,208C8,177.67069216000004,16,147.3413843200001,24,145.82854374400006C32,144.31570316800003,40,143.55928288,48,143.55928288C56,143.55928288,64,143.69173256533335,72,143.95663193600006C80,144.22153130666678,88,150.087546752,96,150.087546752C104,150.087546752,112,143.61986468266673,120,141.36762432000006C128,139.1153839573334,136,138.10678017066667,144,136.574104576C152,135.04142898133333,160,134.60761100800002,168,132.171570752C176,129.735530496,184,122.7740017919999,192,121.95786303999996C200,121.14172428800003,208,120.73365491200006,216,120.73365491200006C224,120.73365491200006,232,150.33875334399997,240,150.33875334399997C248,150.33875334399997,256,145.21265574400005,264,145.21265574400005C272,145.21265574400005,280,159.49950515199998,288,159.49950515199998C296,159.49950515199998,304,159.25604087466667,312,158.76911232C320,158.28218376533334,328,153.13340861866664,336,148.71727519999996C344,144.30114178133329,352,136.23707191466664,360,132.27231180799998C368,128.30755170133332,376,127.558024672,384,124.92871456C392,122.299404448,400,116.49645113600002,408,116.49645113600002C416,116.49645113600002,424,142.8818553066667,432,147.94231920000001C440,153.00278309333333,448,155.53301504,456,155.53301504C464,155.53301504,472,147.54844651733333,480,141.915090304C488,136.28173409066667,495.99999999999994,121.73287776000008,503.99999999999994,121.73287776000008C511.99999999999994,121.73287776000008,520,147.90280169599995,528,152.63684758399998C536,157.370893472,544,159.73791641600002,552,159.73791641600002C560,159.73791641600002,568,140.4438672,576,140.4438672C584,140.4438672,592,150.146582976,600,150.146582976C608,150.146582976,616,121.98686448,624,121.98686448C632,121.98686448,640,208,648,208C656,208,664,133.83377571200015,672,102.0323582720003C680,70.23094083200043,688,17.191495360000836,696,17.191495360000836C704,17.191495360000836,712,112.59574768000043,720,208"
+              d="M0,208C7.822222222222222,177.67069216000004,15.644444444444442,147.3413843200001,23.466666666666665,145.82854374400006C31.288888888888888,144.31570316800003,39.11111111111111,143.55928288,46.93333333333333,143.55928288C54.75555555555555,143.55928288,62.57777777777778,143.69173256533335,70.4,143.95663193600006C78.22222222222223,144.22153130666678,86.04444444444444,150.087546752,93.86666666666666,150.087546752C101.68888888888888,150.087546752,109.5111111111111,143.61986468266673,117.33333333333333,141.36762432000006C125.15555555555555,139.1153839573334,132.9777777777778,138.10678017066667,140.8,136.574104576C148.62222222222223,135.04142898133333,156.44444444444446,134.60761100800002,164.26666666666668,132.171570752C172.0888888888889,129.735530496,179.9111111111111,122.7740017919999,187.73333333333332,121.95786303999996C195.55555555555554,121.14172428800003,203.37777777777777,120.73365491200006,211.2,120.73365491200006C219.0222222222222,120.73365491200006,226.84444444444443,150.33875334399997,234.66666666666666,150.33875334399997C242.48888888888888,150.33875334399997,250.3111111111111,145.21265574400005,258.1333333333333,145.21265574400005C265.9555555555556,145.21265574400005,273.77777777777777,159.49950515199998,281.6,159.49950515199998C289.4222222222222,159.49950515199998,297.24444444444447,159.25604087466667,305.06666666666666,158.76911232C312.8888888888889,158.28218376533334,320.7111111111111,153.13340861866664,328.53333333333336,148.71727519999996C336.35555555555555,144.30114178133329,344.1777777777778,136.23707191466664,352,132.27231180799998C359.8222222222222,128.30755170133332,367.64444444444445,127.55802467199999,375.46666666666664,124.92871456C383.2888888888889,122.299404448,391.1111111111111,116.49645113600002,398.93333333333334,116.49645113600002C406.75555555555553,116.49645113600002,414.5777777777778,142.8818553066667,422.4,147.94231920000001C430.22222222222223,153.00278309333333,438.0444444444444,155.53301504,445.8666666666667,155.53301504C453.68888888888887,155.53301504,461.5111111111111,147.5484465173333,469.3333333333333,141.915090304C477.1555555555555,136.28173409066667,484.97777777777776,121.73287776000008,492.79999999999995,121.73287776000008C500.6222222222222,121.73287776000008,508.4444444444444,147.90280169599995,516.2666666666667,152.63684758399998C524.0888888888888,157.370893472,531.9111111111112,159.73791641600002,539.7333333333333,159.73791641600002C547.5555555555555,159.73791641600002,555.3777777777779,140.4438672,563.2,140.4438672C571.0222222222222,140.4438672,578.8444444444445,150.146582976,586.6666666666667,150.146582976C594.4888888888889,150.146582976,602.3111111111111,121.98686448,610.1333333333333,121.98686448C617.9555555555555,121.98686448,625.7777777777778,208,633.6,208C641.4222222222222,208,649.2444444444445,133.8337757120002,657.0666666666667,102.0323582720003C664.8888888888889,70.23094083200053,672.7111111111111,17.191495360000836,680.5333333333333,17.191495360000836C688.3555555555555,17.191495360000836,696.1777777777778,112.59574768000043,704,208"
               onClick={[Function]}
               onContextMenu={[Function]}
               onMouseOut={[Function]}
@@ -3407,7 +3407,7 @@ Array [
                 }
               />
               <circle
-                cx={24}
+                cx={23.466666666666665}
                 cy={145.82854374400006}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3424,7 +3424,7 @@ Array [
                 }
               />
               <circle
-                cx={48}
+                cx={46.93333333333333}
                 cy={143.55928288}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3441,7 +3441,7 @@ Array [
                 }
               />
               <circle
-                cx={72}
+                cx={70.4}
                 cy={143.95663193600006}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3458,7 +3458,7 @@ Array [
                 }
               />
               <circle
-                cx={96}
+                cx={93.86666666666666}
                 cy={150.087546752}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3475,7 +3475,7 @@ Array [
                 }
               />
               <circle
-                cx={120}
+                cx={117.33333333333333}
                 cy={141.36762432000006}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3492,7 +3492,7 @@ Array [
                 }
               />
               <circle
-                cx={144}
+                cx={140.8}
                 cy={136.574104576}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3509,7 +3509,7 @@ Array [
                 }
               />
               <circle
-                cx={168}
+                cx={164.26666666666668}
                 cy={132.171570752}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3526,7 +3526,7 @@ Array [
                 }
               />
               <circle
-                cx={192}
+                cx={187.73333333333332}
                 cy={121.95786303999996}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3543,7 +3543,7 @@ Array [
                 }
               />
               <circle
-                cx={216}
+                cx={211.2}
                 cy={120.73365491200006}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3560,7 +3560,7 @@ Array [
                 }
               />
               <circle
-                cx={240}
+                cx={234.66666666666666}
                 cy={150.33875334399997}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3577,7 +3577,7 @@ Array [
                 }
               />
               <circle
-                cx={264}
+                cx={258.1333333333333}
                 cy={145.21265574400005}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3594,7 +3594,7 @@ Array [
                 }
               />
               <circle
-                cx={288}
+                cx={281.6}
                 cy={159.49950515199998}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3611,7 +3611,7 @@ Array [
                 }
               />
               <circle
-                cx={312}
+                cx={305.06666666666666}
                 cy={158.76911232}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3628,7 +3628,7 @@ Array [
                 }
               />
               <circle
-                cx={336}
+                cx={328.53333333333336}
                 cy={148.71727519999996}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3645,7 +3645,7 @@ Array [
                 }
               />
               <circle
-                cx={360}
+                cx={352}
                 cy={132.27231180799998}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3662,7 +3662,7 @@ Array [
                 }
               />
               <circle
-                cx={384}
+                cx={375.46666666666664}
                 cy={124.92871456}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3679,7 +3679,7 @@ Array [
                 }
               />
               <circle
-                cx={408}
+                cx={398.93333333333334}
                 cy={116.49645113600002}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3696,7 +3696,7 @@ Array [
                 }
               />
               <circle
-                cx={432}
+                cx={422.4}
                 cy={147.94231920000001}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3713,7 +3713,7 @@ Array [
                 }
               />
               <circle
-                cx={456}
+                cx={445.8666666666667}
                 cy={155.53301504}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3730,7 +3730,7 @@ Array [
                 }
               />
               <circle
-                cx={480}
+                cx={469.3333333333333}
                 cy={141.915090304}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3747,7 +3747,7 @@ Array [
                 }
               />
               <circle
-                cx={503.99999999999994}
+                cx={492.79999999999995}
                 cy={121.73287776000008}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3764,7 +3764,7 @@ Array [
                 }
               />
               <circle
-                cx={528}
+                cx={516.2666666666667}
                 cy={152.63684758399998}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3781,7 +3781,7 @@ Array [
                 }
               />
               <circle
-                cx={552}
+                cx={539.7333333333333}
                 cy={159.73791641600002}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3798,7 +3798,7 @@ Array [
                 }
               />
               <circle
-                cx={576}
+                cx={563.2}
                 cy={140.4438672}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3815,7 +3815,7 @@ Array [
                 }
               />
               <circle
-                cx={600}
+                cx={586.6666666666667}
                 cy={150.146582976}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3832,7 +3832,7 @@ Array [
                 }
               />
               <circle
-                cx={624}
+                cx={610.1333333333333}
                 cy={121.98686448}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3849,7 +3849,7 @@ Array [
                 }
               />
               <circle
-                cx={648}
+                cx={633.6}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3866,7 +3866,7 @@ Array [
                 }
               />
               <circle
-                cx={672}
+                cx={657.0666666666667}
                 cy={102.0323582720003}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3883,7 +3883,7 @@ Array [
                 }
               />
               <circle
-                cx={696}
+                cx={680.5333333333333}
                 cy={17.191495360000836}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3900,7 +3900,7 @@ Array [
                 }
               />
               <circle
-                cx={720}
+                cx={704}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3923,7 +3923,7 @@ Array [
           >
             <path
               className="rv-xy-plot__series rv-xy-plot__series--line "
-              d="M0,208C8,183.10434549333334,16,158.20869098666665,24,157.4191424C32,156.62959381333334,40,156.23481952,48,156.23481952C56,156.23481952,64,160.81596682666668,72,161.56425792000002C80,162.31254901333335,88,162.68669456,96,162.68669456C104,162.68669456,112,158.86059904000004,120,158.86059904000004C128,158.86059904000004,136,163.62246992000001,144,163.62246992000001C152,163.62246992000001,160,142.73391392000002,168,142.73391392000002C176,142.73391392000002,184,165.8699744,192,165.8699744C200,165.8699744,208,163.6534529066668,216,163.52439168000006C224,163.39533045333334,232,163.45986106666672,240,163.33079984C248,163.20173861333328,256,161.4781168,264,161.4781168C272,161.4781168,280,161.87593552,288,162.16472064C296,162.45350576,304,162.51342293333335,312,163.21082752C320,163.90823210666667,328,166.81319824,336,166.81319824C344,166.81319824,352,143.21282560000003,360,143.21282560000003C368,143.21282560000003,376,164.71169104,384,164.71169104C392,164.71169104,400,135.88840304000001,408,135.88840304000001C416,135.88840304000001,424,152.6074260533333,432,157.5681224C440,162.52881874666667,448,165.65258112,456,165.65258112C464,165.65258112,472,165.61368234666668,480,165.53588480000002C488,165.45808725333336,495.99999999999994,147.713644,503.99999999999994,147.713644C511.99999999999994,147.713644,520,163.65928869333334,528,164.06490256C536,164.47051642666668,544,164.27093592,552,164.67332336C560,165.07571080000002,568,166.4792272,576,166.4792272C584,166.4792272,592,152.7591936,600,152.7591936C608,152.7591936,616,156.23893584,624,163.19842032C632,170.15790479999998,640,208,648,208C656,208,664,177.47751424,672,161.37461184C680,145.27170944,688,111.3825856,696,111.3825856C704,111.3825856,712,159.6912928,720,208"
+              d="M0,208C7.822222222222222,183.10434549333334,15.644444444444442,158.20869098666665,23.466666666666665,157.4191424C31.288888888888888,156.62959381333334,39.11111111111111,156.23481952,46.93333333333333,156.23481952C54.75555555555555,156.23481952,62.57777777777778,160.81596682666668,70.4,161.56425792000002C78.22222222222223,162.31254901333335,86.04444444444444,162.68669456,93.86666666666666,162.68669456C101.68888888888888,162.68669456,109.5111111111111,158.86059904000004,117.33333333333333,158.86059904000004C125.15555555555555,158.86059904000004,132.9777777777778,163.62246992000001,140.8,163.62246992000001C148.62222222222223,163.62246992000001,156.44444444444446,142.73391392000002,164.26666666666668,142.73391392000002C172.0888888888889,142.73391392000002,179.9111111111111,165.8699744,187.73333333333332,165.8699744C195.55555555555554,165.8699744,203.37777777777777,163.6534529066668,211.2,163.52439168000006C219.0222222222222,163.39533045333334,226.84444444444443,163.45986106666672,234.66666666666666,163.33079984C242.48888888888888,163.20173861333328,250.3111111111111,161.4781168,258.1333333333333,161.4781168C265.9555555555556,161.4781168,273.77777777777777,161.87593552,281.6,162.16472064C289.4222222222222,162.45350576,297.24444444444447,162.51342293333335,305.06666666666666,163.21082752C312.8888888888889,163.90823210666667,320.7111111111111,166.81319824,328.53333333333336,166.81319824C336.35555555555555,166.81319824,344.1777777777778,143.21282560000003,352,143.21282560000003C359.8222222222222,143.21282560000003,367.64444444444445,164.71169104,375.46666666666664,164.71169104C383.2888888888889,164.71169104,391.1111111111111,135.88840304000001,398.93333333333334,135.88840304000001C406.75555555555553,135.88840304000001,414.5777777777778,152.6074260533333,422.4,157.5681224C430.22222222222223,162.52881874666667,438.0444444444444,165.65258112,445.8666666666667,165.65258112C453.68888888888887,165.65258112,461.5111111111111,165.61368234666668,469.3333333333333,165.53588480000002C477.1555555555555,165.45808725333336,484.97777777777776,147.713644,492.79999999999995,147.713644C500.6222222222222,147.713644,508.4444444444444,163.65928869333334,516.2666666666667,164.06490256C524.0888888888888,164.47051642666668,531.9111111111112,164.27093592,539.7333333333333,164.67332336C547.5555555555555,165.07571080000002,555.3777777777779,166.4792272,563.2,166.4792272C571.0222222222222,166.4792272,578.8444444444445,152.7591936,586.6666666666667,152.7591936C594.4888888888889,152.7591936,602.3111111111111,156.23893584,610.1333333333333,163.19842032C617.9555555555555,170.15790480000004,625.7777777777778,208,633.6,208C641.4222222222222,208,649.2444444444445,177.47751424000003,657.0666666666667,161.37461184C664.8888888888889,145.27170944000005,672.7111111111111,111.3825856,680.5333333333333,111.3825856C688.3555555555555,111.3825856,696.1777777777778,159.69129279999999,704,208"
               onClick={[Function]}
               onContextMenu={[Function]}
               onMouseOut={[Function]}
@@ -3960,7 +3960,7 @@ Array [
                 }
               />
               <circle
-                cx={24}
+                cx={23.466666666666665}
                 cy={157.4191424}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3977,7 +3977,7 @@ Array [
                 }
               />
               <circle
-                cx={48}
+                cx={46.93333333333333}
                 cy={156.23481952}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -3994,7 +3994,7 @@ Array [
                 }
               />
               <circle
-                cx={72}
+                cx={70.4}
                 cy={161.56425792000002}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4011,7 +4011,7 @@ Array [
                 }
               />
               <circle
-                cx={96}
+                cx={93.86666666666666}
                 cy={162.68669456}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4028,7 +4028,7 @@ Array [
                 }
               />
               <circle
-                cx={120}
+                cx={117.33333333333333}
                 cy={158.86059904000004}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4045,7 +4045,7 @@ Array [
                 }
               />
               <circle
-                cx={144}
+                cx={140.8}
                 cy={163.62246992000001}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4062,7 +4062,7 @@ Array [
                 }
               />
               <circle
-                cx={168}
+                cx={164.26666666666668}
                 cy={142.73391392000002}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4079,7 +4079,7 @@ Array [
                 }
               />
               <circle
-                cx={192}
+                cx={187.73333333333332}
                 cy={165.8699744}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4096,7 +4096,7 @@ Array [
                 }
               />
               <circle
-                cx={216}
+                cx={211.2}
                 cy={163.52439168000006}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4113,7 +4113,7 @@ Array [
                 }
               />
               <circle
-                cx={240}
+                cx={234.66666666666666}
                 cy={163.33079984}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4130,7 +4130,7 @@ Array [
                 }
               />
               <circle
-                cx={264}
+                cx={258.1333333333333}
                 cy={161.4781168}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4147,7 +4147,7 @@ Array [
                 }
               />
               <circle
-                cx={288}
+                cx={281.6}
                 cy={162.16472064}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4164,7 +4164,7 @@ Array [
                 }
               />
               <circle
-                cx={312}
+                cx={305.06666666666666}
                 cy={163.21082752}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4181,7 +4181,7 @@ Array [
                 }
               />
               <circle
-                cx={336}
+                cx={328.53333333333336}
                 cy={166.81319824}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4198,7 +4198,7 @@ Array [
                 }
               />
               <circle
-                cx={360}
+                cx={352}
                 cy={143.21282560000003}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4215,7 +4215,7 @@ Array [
                 }
               />
               <circle
-                cx={384}
+                cx={375.46666666666664}
                 cy={164.71169104}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4232,7 +4232,7 @@ Array [
                 }
               />
               <circle
-                cx={408}
+                cx={398.93333333333334}
                 cy={135.88840304000001}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4249,7 +4249,7 @@ Array [
                 }
               />
               <circle
-                cx={432}
+                cx={422.4}
                 cy={157.5681224}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4266,7 +4266,7 @@ Array [
                 }
               />
               <circle
-                cx={456}
+                cx={445.8666666666667}
                 cy={165.65258112}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4283,7 +4283,7 @@ Array [
                 }
               />
               <circle
-                cx={480}
+                cx={469.3333333333333}
                 cy={165.53588480000002}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4300,7 +4300,7 @@ Array [
                 }
               />
               <circle
-                cx={503.99999999999994}
+                cx={492.79999999999995}
                 cy={147.713644}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4317,7 +4317,7 @@ Array [
                 }
               />
               <circle
-                cx={528}
+                cx={516.2666666666667}
                 cy={164.06490256}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4334,7 +4334,7 @@ Array [
                 }
               />
               <circle
-                cx={552}
+                cx={539.7333333333333}
                 cy={164.67332336}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4351,7 +4351,7 @@ Array [
                 }
               />
               <circle
-                cx={576}
+                cx={563.2}
                 cy={166.4792272}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4368,7 +4368,7 @@ Array [
                 }
               />
               <circle
-                cx={600}
+                cx={586.6666666666667}
                 cy={152.7591936}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4385,7 +4385,7 @@ Array [
                 }
               />
               <circle
-                cx={624}
+                cx={610.1333333333333}
                 cy={163.19842032}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4402,7 +4402,7 @@ Array [
                 }
               />
               <circle
-                cx={648}
+                cx={633.6}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4419,7 +4419,7 @@ Array [
                 }
               />
               <circle
-                cx={672}
+                cx={657.0666666666667}
                 cy={161.37461184}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4436,7 +4436,7 @@ Array [
                 }
               />
               <circle
-                cx={696}
+                cx={680.5333333333333}
                 cy={111.3825856}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4453,7 +4453,7 @@ Array [
                 }
               />
               <circle
-                cx={720}
+                cx={704}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4476,7 +4476,7 @@ Array [
           >
             <path
               className="rv-xy-plot__series rv-xy-plot__series--line "
-              d="M0,208C8,198.0144506122449,16,188.0289012244898,24,188.0289012244898C32,188.0289012244898,40,190.93245866666666,48,190.93245866666666C56,190.93245866666666,64,190.28154649962812,72,189.81180675918367C80,189.34206701873921,88,188.114020224,96,188.114020224C104,188.114020224,112,188.75217580408165,120,188.75217580408165C128,188.75217580408165,136,187.7737856411058,144,186.9231112C152,186.07243675889418,160,183.64812915744682,168,183.64812915744682C176,183.64812915744682,184,187.40215166647675,192,188.65222657560977C200,189.9023014847428,208,191.1485786122449,216,191.1485786122449C224,191.1485786122449,232,187.99938938181816,240,187.99938938181816C248,187.99938938181816,256,192.51163795348836,264,192.51163795348836C272,192.51163795348836,280,186.99252785777776,288,186.99252785777776C296,186.99252785777776,304,191.5321727255814,312,191.5321727255814C320,191.5321727255814,328,188.75657926666668,336,188.75657926666668C344,188.75657926666668,352,189.74989696,360,189.74989696C368,189.74989696,376,189.71163744,384,189.6351184C392,189.55859936000002,400,184.25858141935484,408,184.25858141935484C416,184.25858141935484,424,190.2827607652174,432,190.2827607652174C440,190.2827607652174,448,189.76271776603772,456,189.76271776603772C464,189.76271776603772,472,191.83746261333334,480,191.83746261333334C488,191.83746261333334,495.99999999999994,187.9456040347826,503.99999999999994,187.9456040347826C511.99999999999994,187.9456040347826,520,188.09594339288537,528,188.3966221090909C536,188.69730082529645,544,191.762533248,552,191.762533248C560,191.762533248,568,191.6625795195817,576,191.4626720627451C584,191.2627646059085,592,189.4011021381818,600,189.4011021381818C608,189.4011021381818,616,189.79567013943304,624,190.58480614193547C632,191.3739421444379,640,208,648,208C656,208,664,194.91739193977511,672,189.69166496603773C680,184.46593799230035,688,176.64563815757575,696,176.64563815757575C704,176.64563815757575,712,192.32281907878786,720,208"
+              d="M0,208C7.822222222222222,198.0144506122449,15.644444444444442,188.0289012244898,23.466666666666665,188.0289012244898C31.288888888888888,188.0289012244898,39.11111111111111,190.93245866666666,46.93333333333333,190.93245866666666C54.75555555555555,190.93245866666666,62.57777777777778,190.28154649962812,70.4,189.81180675918367C78.22222222222223,189.34206701873921,86.04444444444444,188.114020224,93.86666666666666,188.114020224C101.68888888888888,188.114020224,109.5111111111111,188.75217580408165,117.33333333333333,188.75217580408165C125.15555555555555,188.75217580408165,132.9777777777778,187.7737856411058,140.8,186.9231112C148.62222222222223,186.07243675889418,156.44444444444446,183.64812915744682,164.26666666666668,183.64812915744682C172.0888888888889,183.64812915744682,179.9111111111111,187.40215166647675,187.73333333333332,188.65222657560977C195.55555555555554,189.9023014847428,203.37777777777777,191.1485786122449,211.2,191.1485786122449C219.0222222222222,191.1485786122449,226.84444444444443,187.99938938181816,234.66666666666666,187.99938938181816C242.48888888888888,187.99938938181816,250.3111111111111,192.51163795348836,258.1333333333333,192.51163795348836C265.9555555555556,192.51163795348836,273.77777777777777,186.99252785777776,281.6,186.99252785777776C289.4222222222222,186.99252785777776,297.24444444444447,191.5321727255814,305.06666666666666,191.5321727255814C312.8888888888889,191.5321727255814,320.7111111111111,188.75657926666668,328.53333333333336,188.75657926666668C336.35555555555555,188.75657926666668,344.1777777777778,189.74989696,352,189.74989696C359.8222222222222,189.74989696,367.64444444444445,189.71163744,375.46666666666664,189.6351184C383.2888888888889,189.55859936000002,391.1111111111111,184.25858141935484,398.93333333333334,184.25858141935484C406.75555555555553,184.25858141935484,414.5777777777778,190.2827607652174,422.4,190.2827607652174C430.22222222222223,190.2827607652174,438.0444444444444,189.76271776603772,445.8666666666667,189.76271776603772C453.68888888888887,189.76271776603772,461.5111111111111,191.83746261333334,469.3333333333333,191.83746261333334C477.1555555555555,191.83746261333334,484.97777777777776,187.9456040347826,492.79999999999995,187.9456040347826C500.6222222222222,187.9456040347826,508.4444444444444,188.09594339288537,516.2666666666667,188.3966221090909C524.0888888888888,188.69730082529645,531.9111111111112,191.762533248,539.7333333333333,191.762533248C547.5555555555555,191.762533248,555.3777777777779,191.6625795195817,563.2,191.4626720627451C571.0222222222222,191.2627646059085,578.8444444444445,189.4011021381818,586.6666666666667,189.4011021381818C594.4888888888889,189.4011021381818,602.3111111111111,189.79567013943304,610.1333333333333,190.58480614193547C617.9555555555555,191.3739421444379,625.7777777777778,208,633.6,208C641.4222222222222,208,649.2444444444445,194.91739193977511,657.0666666666667,189.69166496603773C664.8888888888889,184.46593799230038,672.7111111111111,176.64563815757575,680.5333333333333,176.64563815757575C688.3555555555555,176.64563815757575,696.1777777777778,192.32281907878786,704,208"
               onClick={[Function]}
               onContextMenu={[Function]}
               onMouseOut={[Function]}
@@ -4513,7 +4513,7 @@ Array [
                 }
               />
               <circle
-                cx={24}
+                cx={23.466666666666665}
                 cy={188.0289012244898}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4530,7 +4530,7 @@ Array [
                 }
               />
               <circle
-                cx={48}
+                cx={46.93333333333333}
                 cy={190.93245866666666}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4547,7 +4547,7 @@ Array [
                 }
               />
               <circle
-                cx={72}
+                cx={70.4}
                 cy={189.81180675918367}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4564,7 +4564,7 @@ Array [
                 }
               />
               <circle
-                cx={96}
+                cx={93.86666666666666}
                 cy={188.114020224}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4581,7 +4581,7 @@ Array [
                 }
               />
               <circle
-                cx={120}
+                cx={117.33333333333333}
                 cy={188.75217580408165}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4598,7 +4598,7 @@ Array [
                 }
               />
               <circle
-                cx={144}
+                cx={140.8}
                 cy={186.9231112}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4615,7 +4615,7 @@ Array [
                 }
               />
               <circle
-                cx={168}
+                cx={164.26666666666668}
                 cy={183.64812915744682}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4632,7 +4632,7 @@ Array [
                 }
               />
               <circle
-                cx={192}
+                cx={187.73333333333332}
                 cy={188.65222657560977}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4649,7 +4649,7 @@ Array [
                 }
               />
               <circle
-                cx={216}
+                cx={211.2}
                 cy={191.1485786122449}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4666,7 +4666,7 @@ Array [
                 }
               />
               <circle
-                cx={240}
+                cx={234.66666666666666}
                 cy={187.99938938181816}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4683,7 +4683,7 @@ Array [
                 }
               />
               <circle
-                cx={264}
+                cx={258.1333333333333}
                 cy={192.51163795348836}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4700,7 +4700,7 @@ Array [
                 }
               />
               <circle
-                cx={288}
+                cx={281.6}
                 cy={186.99252785777776}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4717,7 +4717,7 @@ Array [
                 }
               />
               <circle
-                cx={312}
+                cx={305.06666666666666}
                 cy={191.5321727255814}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4734,7 +4734,7 @@ Array [
                 }
               />
               <circle
-                cx={336}
+                cx={328.53333333333336}
                 cy={188.75657926666668}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4751,7 +4751,7 @@ Array [
                 }
               />
               <circle
-                cx={360}
+                cx={352}
                 cy={189.74989696}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4768,7 +4768,7 @@ Array [
                 }
               />
               <circle
-                cx={384}
+                cx={375.46666666666664}
                 cy={189.6351184}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4785,7 +4785,7 @@ Array [
                 }
               />
               <circle
-                cx={408}
+                cx={398.93333333333334}
                 cy={184.25858141935484}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4802,7 +4802,7 @@ Array [
                 }
               />
               <circle
-                cx={432}
+                cx={422.4}
                 cy={190.2827607652174}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4819,7 +4819,7 @@ Array [
                 }
               />
               <circle
-                cx={456}
+                cx={445.8666666666667}
                 cy={189.76271776603772}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4836,7 +4836,7 @@ Array [
                 }
               />
               <circle
-                cx={480}
+                cx={469.3333333333333}
                 cy={191.83746261333334}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4853,7 +4853,7 @@ Array [
                 }
               />
               <circle
-                cx={503.99999999999994}
+                cx={492.79999999999995}
                 cy={187.9456040347826}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4870,7 +4870,7 @@ Array [
                 }
               />
               <circle
-                cx={528}
+                cx={516.2666666666667}
                 cy={188.3966221090909}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4887,7 +4887,7 @@ Array [
                 }
               />
               <circle
-                cx={552}
+                cx={539.7333333333333}
                 cy={191.762533248}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4904,7 +4904,7 @@ Array [
                 }
               />
               <circle
-                cx={576}
+                cx={563.2}
                 cy={191.4626720627451}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4921,7 +4921,7 @@ Array [
                 }
               />
               <circle
-                cx={600}
+                cx={586.6666666666667}
                 cy={189.4011021381818}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4938,7 +4938,7 @@ Array [
                 }
               />
               <circle
-                cx={624}
+                cx={610.1333333333333}
                 cy={190.58480614193547}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4955,7 +4955,7 @@ Array [
                 }
               />
               <circle
-                cx={648}
+                cx={633.6}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4972,7 +4972,7 @@ Array [
                 }
               />
               <circle
-                cx={672}
+                cx={657.0666666666667}
                 cy={189.69166496603773}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -4989,7 +4989,7 @@ Array [
                 }
               />
               <circle
-                cx={696}
+                cx={680.5333333333333}
                 cy={176.64563815757575}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -5006,7 +5006,7 @@ Array [
                 }
               />
               <circle
-                cx={720}
+                cx={704}
                 cy={208}
                 onClick={[Function]}
                 onContextMenu={[Function]}
@@ -5063,7 +5063,7 @@ Array [
             transform="translate(80,16)"
           >
             <circle
-              cx={360}
+              cx={352}
               cy={132.27231180799998}
               onClick={[Function]}
               onContextMenu={[Function]}
@@ -5080,7 +5080,7 @@ Array [
               }
             />
             <circle
-              cx={360}
+              cx={352}
               cy={143.21282560000003}
               onClick={[Function]}
               onContextMenu={[Function]}
@@ -5097,7 +5097,7 @@ Array [
               }
             />
             <circle
-              cx={360}
+              cx={352}
               cy={189.74989696}
               onClick={[Function]}
               onContextMenu={[Function]}
@@ -5120,8 +5120,8 @@ Array [
           >
             <line
               className="rv-xy-plot__grid-lines__line"
-              x1={360}
-              x2={360}
+              x1={352}
+              x2={352}
               y1={0}
               y2={208}
             />
@@ -5132,7 +5132,7 @@ Array [
      rv-hint--verticalAlign-bottom"
           style={
             Object {
-              "left": 440,
+              "left": 432,
               "position": "absolute",
               "top": 120,
             }
@@ -5339,7 +5339,7 @@ Array [
           >
             <path
               className="rv-voronoi__cell "
-              d="M92,256L92,16L80,16L80,256Z"
+              d="M91.7333335,256L91.7333335,16L80,16L80,256Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5354,7 +5354,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M92,16L92,256L116,256L116,16Z"
+              d="M91.7333335,16L91.7333335,256L115.19999999999999,256L115.19999999999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5369,7 +5369,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M116,16L116,256L140,256L140,16Z"
+              d="M115.19999999999999,16L115.19999999999999,256L138.6666665,256L138.6666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5384,7 +5384,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M140,16L140,256L164,256L164,16Z"
+              d="M138.6666665,16L138.6666665,256L162.1333335,256L162.1333335,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5399,7 +5399,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M164,16L164,256L188,256L188,16Z"
+              d="M162.1333335,16L162.1333335,256L185.59999999999997,256L185.59999999999997,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5414,7 +5414,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M188,16L188,256L212,256L212,16Z"
+              d="M185.59999999999997,16L185.59999999999997,256L209.0666665,256L209.0666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5429,7 +5429,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M212,16L212,256L236,256L236,16Z"
+              d="M209.0666665,16L209.0666665,256L232.53333349999997,256L232.53333349999997,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5444,7 +5444,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M236,16L236,256L260,256L260,16Z"
+              d="M232.53333349999997,16L232.53333349999997,256L256,256L256,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5459,7 +5459,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M260,16L260,256L284,256L284,16Z"
+              d="M256,16L256,256L279.4666665,256L279.4666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5474,7 +5474,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M284,16L284,256L308,256L308,16Z"
+              d="M279.4666665,16L279.4666665,256L302.9333335,256L302.9333335,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5489,7 +5489,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M308,16L308,256L332,256L332,16Z"
+              d="M302.9333335,16L302.9333335,256L326.4,256L326.4,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5504,7 +5504,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M332,16L332,256L356,256L356,16Z"
+              d="M326.4,16L326.4,256L349.86666649999995,256L349.86666649999995,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5519,7 +5519,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M356,16L356,256L380,256L380,16Z"
+              d="M349.86666649999995,16L349.86666649999995,256L373.3333335,256L373.3333335,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5534,7 +5534,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M380,16L380,256L404,256L404,16Z"
+              d="M373.3333335,16L373.3333335,256L396.79999999999995,256L396.79999999999995,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5549,7 +5549,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M404,16L404,256L428,256L428,16Z"
+              d="M396.79999999999995,16L396.79999999999995,256L420.2666665,256L420.2666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5564,7 +5564,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M428,16L428,256L452,256L452,16Z"
+              d="M420.2666665,16L420.2666665,256L443.73333349999996,256L443.73333349999996,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5579,7 +5579,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M452,16L452,256L476,256L476,16Z"
+              d="M443.73333349999996,16L443.73333349999996,256L467.2,256L467.2,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5594,7 +5594,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M476,16L476,256L500,256L500,16Z"
+              d="M467.2,16L467.2,256L490.6666665,256L490.6666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5609,7 +5609,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M500,16L500,256L524,256L524,16Z"
+              d="M490.6666665,16L490.6666665,256L514.1333334999999,256L514.1333334999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5624,7 +5624,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M524,16L524,256L548,256L548,16Z"
+              d="M514.1333334999999,16L514.1333334999999,256L537.5999999999999,256L537.5999999999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5639,7 +5639,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M548,16L548,256L572,256L572,16Z"
+              d="M537.5999999999999,16L537.5999999999999,256L561.0666664999999,256L561.0666664999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5654,7 +5654,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M572,16L572,256L596,256L596,16Z"
+              d="M561.0666664999999,16L561.0666664999999,256L584.5333335,256L584.5333335,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5669,7 +5669,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M596,16L596,256L620,256L620,16Z"
+              d="M584.5333335,16L584.5333335,256L608,256L608,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5684,7 +5684,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M620,16L620,256L644,256L644,16Z"
+              d="M608,16L608,256L631.4666665,256L631.4666665,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5699,7 +5699,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M644,16L644,256L668,256L668,16Z"
+              d="M631.4666665,16L631.4666665,256L654.9333334999999,256L654.9333334999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5714,7 +5714,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M668,16L668,256L692,256L692,16Z"
+              d="M654.9333334999999,16L654.9333334999999,256L678.4,256L678.4,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5729,7 +5729,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M692,16L692,256L716,256L716,16Z"
+              d="M678.4,16L678.4,256L701.8666665000001,256L701.8666665000001,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5744,7 +5744,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M716,16L716,256L740,256L740,16Z"
+              d="M701.8666665000001,16L701.8666665000001,256L725.3333335,256L725.3333335,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5759,7 +5759,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M740,16L740,256L764,256L764,16Z"
+              d="M725.3333335,16L725.3333335,256L748.8,256L748.8,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5774,7 +5774,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M764,16L764,256L788,256L788,16Z"
+              d="M748.8,16L748.8,256L772.2666664999999,256L772.2666664999999,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -5789,7 +5789,7 @@ Array [
             />
             <path
               className="rv-voronoi__cell "
-              d="M788,16L788,256L800,256L800,16Z"
+              d="M772.2666664999999,16L772.2666664999999,256L800,256L800,16Z"
               fill="none"
               onClick={[Function]}
               onMouseDown={[Function]}
@@ -6063,7 +6063,7 @@ Array [
               className="rv-xy-plot__axis__line"
               style={Object {}}
               x1={0}
-              x2={720}
+              x2={704}
               y1={0}
               y2={0}
             />
@@ -6097,7 +6097,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(60, 0)"
+                transform="translate(58.666666666666664, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6120,7 +6120,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(120, 0)"
+                transform="translate(117.33333333333333, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6143,7 +6143,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(180, 0)"
+                transform="translate(176, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6166,7 +6166,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(240, 0)"
+                transform="translate(234.66666666666666, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6189,7 +6189,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(300, 0)"
+                transform="translate(293.33333333333337, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6212,7 +6212,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(360, 0)"
+                transform="translate(352, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6235,7 +6235,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(420, 0)"
+                transform="translate(410.6666666666667, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6258,7 +6258,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(480, 0)"
+                transform="translate(469.3333333333333, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6281,7 +6281,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(540, 0)"
+                transform="translate(528, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6304,7 +6304,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(600, 0)"
+                transform="translate(586.6666666666667, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6327,7 +6327,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(660, 0)"
+                transform="translate(645.3333333333333, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6350,7 +6350,7 @@ Array [
               <g
                 className="rv-xy-plot__axis__tick"
                 style={Object {}}
-                transform="translate(720, 0)"
+                transform="translate(704, 0)"
               >
                 <line
                   className="rv-xy-plot__axis__tick__line"
@@ -6379,7 +6379,7 @@ Array [
               "left": "50%",
               "position": "absolute",
               "top": "50%",
-              "transform": "translate(calc(-50% + 30px),calc(-50% + -16px - 15px))",
+              "transform": "translate(calc(-50% + 14px),calc(-50% + -16px - 15px))",
             }
           }
         >
diff --git a/x-pack/plugins/apm/public/components/shared/charts/ErroneousTransactionsRateChart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/ErroneousTransactionsRateChart/index.tsx
index 3b6d1684e08e1c..1a91e398cec76c 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/ErroneousTransactionsRateChart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/ErroneousTransactionsRateChart/index.tsx
@@ -8,12 +8,13 @@ import theme from '@elastic/eui/dist/eui_theme_light.json';
 import { i18n } from '@kbn/i18n';
 import React, { useCallback } from 'react';
 import { EuiPanel } from '@elastic/eui';
+import { EuiSpacer } from '@elastic/eui';
+import { asPercent } from '../../../../../common/utils/formatters';
 import { useChartsSync } from '../../../../hooks/useChartsSync';
 import { useFetcher } from '../../../../hooks/useFetcher';
 import { useUrlParams } from '../../../../hooks/useUrlParams';
 import { callApmApi } from '../../../../services/rest/createCallApmApi';
-import { asPercent } from '../../../../utils/formatters';
-// @ts-ignore
+// @ts-expect-error
 import CustomPlot from '../CustomPlot';
 
 const tickFormatY = (y?: number) => {
@@ -71,6 +72,7 @@ export function ErroneousTransactionsRateChart() {
           })}
         </span>
       </EuiTitle>
+      <EuiSpacer size="m" />
       <CustomPlot
         {...syncedChartsProps}
         noHits={data?.noHits}
diff --git a/x-pack/plugins/apm/public/components/shared/charts/MetricsChart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/MetricsChart/index.tsx
index 5b167e8160ffab..3b77ef3b51403f 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/MetricsChart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/MetricsChart/index.tsx
@@ -5,13 +5,13 @@
  */
 import { EuiTitle } from '@elastic/eui';
 import React from 'react';
+import { asPercent } from '../../../../../common/utils/formatters';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { GenericMetricsChart } from '../../../../../server/lib/metrics/transform_metrics_chart';
 // @ts-expect-error
 import CustomPlot from '../CustomPlot';
 import {
   asDecimal,
-  asPercent,
   asInteger,
   asDynamicBytes,
   getFixedByteFormatter,
diff --git a/x-pack/plugins/apm/public/components/shared/charts/TransactionCharts/TransactionLineChart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/TransactionCharts/TransactionLineChart/index.tsx
index 07b7f01194d5c8..09e6b0e43945f1 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/TransactionCharts/TransactionLineChart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/TransactionCharts/TransactionLineChart/index.tsx
@@ -7,7 +7,7 @@
 import React, { useCallback } from 'react';
 import { Coordinate, TimeSeries } from '../../../../../../typings/timeseries';
 import { useChartsSync } from '../../../../../hooks/useChartsSync';
-// @ts-ignore
+// @ts-expect-error
 import CustomPlot from '../../CustomPlot';
 
 interface Props {
@@ -19,6 +19,7 @@ interface Props {
   height?: number;
   stacked?: boolean;
   onHover?: () => void;
+  visibleLegendCount?: number;
   onToggleLegend?: (disabledSeriesState: boolean[]) => void;
 }
 
@@ -32,6 +33,7 @@ function TransactionLineChart(props: Props) {
     truncateLegends,
     stacked = false,
     onHover,
+    visibleLegendCount,
     onToggleLegend,
   } = props;
 
@@ -59,6 +61,7 @@ function TransactionLineChart(props: Props) {
       height={height}
       truncateLegends={truncateLegends}
       {...(stacked ? { stackBy: 'y' } : {})}
+      visibleLegendCount={visibleLegendCount}
       onToggleLegend={onToggleLegend}
     />
   );
diff --git a/x-pack/plugins/apm/public/components/shared/charts/TransactionCharts/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/TransactionCharts/index.tsx
index d11925dc0303d2..6ba080a07b9d38 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/TransactionCharts/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/TransactionCharts/index.tsx
@@ -13,7 +13,6 @@ import {
   EuiTitle,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { Location } from 'history';
 import React from 'react';
 import { NOT_AVAILABLE_LABEL } from '../../../../../common/i18n';
 import {
@@ -29,6 +28,8 @@ import { asDecimal, tpmUnit } from '../../../../utils/formatters';
 import { isValidCoordinateValue } from '../../../../utils/isValidCoordinateValue';
 import { BrowserLineChart } from './BrowserLineChart';
 import { DurationByCountryMap } from './DurationByCountryMap';
+import { ErroneousTransactionsRateChart } from '../ErroneousTransactionsRateChart';
+import { TransactionBreakdown } from '../../TransactionBreakdown';
 import {
   getResponseTimeTickFormatter,
   getResponseTimeTooltipFormatter,
@@ -39,13 +40,11 @@ import { useFormatter } from './use_formatter';
 
 interface TransactionChartProps {
   charts: ITransactionChartData;
-  location: Location;
   urlParams: IUrlParams;
 }
 
 export function TransactionCharts({
   charts,
-  location,
   urlParams,
 }: TransactionChartProps) {
   const getTPMFormatter = (t: number) => {
@@ -72,48 +71,56 @@ export function TransactionCharts({
       <EuiFlexGrid columns={2} gutterSize="s">
         <EuiFlexItem data-cy={`transaction-duration-charts`}>
           <EuiPanel>
-            <React.Fragment>
-              <EuiFlexGroup justifyContent="spaceBetween">
-                <EuiFlexItem>
-                  <EuiTitle size="xs">
-                    <span>{responseTimeLabel(transactionType)}</span>
-                  </EuiTitle>
-                </EuiFlexItem>
-                <LicenseContext.Consumer>
-                  {(license) => (
-                    <MLHeader
-                      hasValidMlLicense={license?.getFeature('ml').isAvailable}
-                      mlJobId={charts.mlJobId}
-                    />
-                  )}
-                </LicenseContext.Consumer>
-              </EuiFlexGroup>
-              <TransactionLineChart
-                series={responseTimeSeries}
-                tickFormatY={getResponseTimeTickFormatter(formatter)}
-                formatTooltipValue={getResponseTimeTooltipFormatter(formatter)}
-                onToggleLegend={setDisabledSeriesState}
-              />
-            </React.Fragment>
+            <EuiFlexGroup justifyContent="spaceBetween">
+              <EuiFlexItem>
+                <EuiTitle size="xs">
+                  <span>{responseTimeLabel(transactionType)}</span>
+                </EuiTitle>
+              </EuiFlexItem>
+              <LicenseContext.Consumer>
+                {(license) => (
+                  <MLHeader
+                    hasValidMlLicense={license?.getFeature('ml').isAvailable}
+                    mlJobId={charts.mlJobId}
+                  />
+                )}
+              </LicenseContext.Consumer>
+            </EuiFlexGroup>
+            <TransactionLineChart
+              series={responseTimeSeries}
+              tickFormatY={getResponseTimeTickFormatter(formatter)}
+              formatTooltipValue={getResponseTimeTooltipFormatter(formatter)}
+              onToggleLegend={setDisabledSeriesState}
+            />
           </EuiPanel>
         </EuiFlexItem>
 
         <EuiFlexItem style={{ flexShrink: 1 }}>
           <EuiPanel>
-            <React.Fragment>
-              <EuiTitle size="xs">
-                <span>{tpmLabel(transactionType)}</span>
-              </EuiTitle>
-              <TransactionLineChart
-                series={tpmSeries}
-                tickFormatY={getTPMFormatter}
-                formatTooltipValue={getTPMTooltipFormatter}
-                truncateLegends
-              />
-            </React.Fragment>
+            <EuiTitle size="xs">
+              <span>{tpmLabel(transactionType)}</span>
+            </EuiTitle>
+            <TransactionLineChart
+              series={tpmSeries}
+              tickFormatY={getTPMFormatter}
+              formatTooltipValue={getTPMTooltipFormatter}
+              truncateLegends
+            />
           </EuiPanel>
         </EuiFlexItem>
       </EuiFlexGrid>
+
+      <EuiSpacer size="s" />
+
+      <EuiFlexGrid columns={2} gutterSize="s">
+        <EuiFlexItem>
+          <ErroneousTransactionsRateChart />
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <TransactionBreakdown />
+        </EuiFlexItem>
+      </EuiFlexGrid>
+
       {transactionType === TRANSACTION_PAGE_LOAD && (
         <>
           <EuiSpacer size="s" />
diff --git a/x-pack/plugins/apm/public/hooks/useTransactionBreakdown.ts b/x-pack/plugins/apm/public/hooks/useTransactionBreakdown.ts
index 2449c13f294352..9db78fde2d8c86 100644
--- a/x-pack/plugins/apm/public/hooks/useTransactionBreakdown.ts
+++ b/x-pack/plugins/apm/public/hooks/useTransactionBreakdown.ts
@@ -13,7 +13,7 @@ export function useTransactionBreakdown() {
     uiFilters,
   } = useUrlParams();
 
-  const { data = { kpis: [], timeseries: [] }, error, status } = useFetcher(
+  const { data = { timeseries: [] }, error, status } = useFetcher(
     (callApmApi) => {
       if (serviceName && start && end && transactionType) {
         return callApmApi({
diff --git a/x-pack/plugins/apm/public/services/__test__/callApi.test.ts b/x-pack/plugins/apm/public/services/__test__/callApi.test.ts
index 76cc275aa8c230..f82201bbd4de81 100644
--- a/x-pack/plugins/apm/public/services/__test__/callApi.test.ts
+++ b/x-pack/plugins/apm/public/services/__test__/callApi.test.ts
@@ -23,7 +23,7 @@ describe('callApi', () => {
       }),
     } as unknown) as HttpMock;
 
-    // @ts-ignore
+    // @ts-expect-error
     global.sessionStorage = new SessionStorageMock();
   });
 
diff --git a/x-pack/plugins/apm/public/utils/formatters/formatters.ts b/x-pack/plugins/apm/public/utils/formatters/formatters.ts
index 649f11063b149a..6249ce53b6779e 100644
--- a/x-pack/plugins/apm/public/utils/formatters/formatters.ts
+++ b/x-pack/plugins/apm/public/utils/formatters/formatters.ts
@@ -23,24 +23,3 @@ export function tpmUnit(type?: string) {
         defaultMessage: 'tpm',
       });
 }
-
-export function asPercent(
-  numerator: number,
-  denominator: number | undefined,
-  fallbackResult = ''
-) {
-  if (!denominator || isNaN(numerator)) {
-    return fallbackResult;
-  }
-
-  const decimal = numerator / denominator;
-
-  // 33.2 => 33%
-  // 3.32 => 3.3%
-  // 0 => 0%
-  if (Math.abs(decimal) >= 0.1 || decimal === 0) {
-    return numeral(decimal).format('0%');
-  }
-
-  return numeral(decimal).format('0.0%');
-}
diff --git a/x-pack/plugins/apm/scripts/tsconfig.json b/x-pack/plugins/apm/scripts/tsconfig.json
index 350db55e72446a..64602bc6b27699 100644
--- a/x-pack/plugins/apm/scripts/tsconfig.json
+++ b/x-pack/plugins/apm/scripts/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "include": [
     "./**/*"
   ],
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
index 3abc89c470b21e..e7eb7b8de65e35 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
@@ -73,10 +73,9 @@ export function registerTransactionDurationAnomalyAlertType({
         return;
       }
       const alertParams = params as TypeOf<typeof paramsSchema>;
-      const mlClient = services.getLegacyScopedClusterClient(ml.mlClient);
-      const request = { params: 'DummyKibanaRequest' } as KibanaRequest;
-      const { mlAnomalySearch } = ml.mlSystemProvider(mlClient, request);
-      const anomalyDetectors = ml.anomalyDetectorsProvider(mlClient, request);
+      const request = {} as KibanaRequest;
+      const { mlAnomalySearch } = ml.mlSystemProvider(request);
+      const anomalyDetectors = ml.anomalyDetectorsProvider(request);
 
       const mlJobIds = await getMLJobIds(
         anomalyDetectors,
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts
index 9d06fc2ad9309b..f0ae8467b215c3 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts
@@ -4,9 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AGENT_NAME } from '../../../../common/elasticsearch_fieldnames';
 import { ApmIndicesConfig } from '../../settings/apm_indices/get_apm_indices';
 import { tasks } from './tasks';
+import {
+  SERVICE_NAME,
+  SERVICE_ENVIRONMENT,
+} from '../../../../common/elasticsearch_fieldnames';
 
 describe('data telemetry collection tasks', () => {
   const indices = {
@@ -18,103 +21,136 @@ describe('data telemetry collection tasks', () => {
     /* eslint-enable @typescript-eslint/naming-convention */
   } as ApmIndicesConfig;
 
+  describe('environments', () => {
+    const task = tasks.find((t) => t.name === 'environments');
+
+    it('returns environment information', async () => {
+      const search = jest.fn().mockResolvedValueOnce({
+        aggregations: {
+          environments: {
+            buckets: [
+              {
+                key: 'production',
+              },
+              {
+                key: 'testing',
+              },
+            ],
+          },
+          service_environments: {
+            buckets: [
+              {
+                key: {
+                  [SERVICE_NAME]: 'opbeans-node',
+                  [SERVICE_ENVIRONMENT]: 'production',
+                },
+              },
+              {
+                key: {
+                  [SERVICE_NAME]: 'opbeans-node',
+                  [SERVICE_ENVIRONMENT]: null,
+                },
+              },
+              {
+                key: {
+                  [SERVICE_NAME]: 'opbeans-java',
+                  [SERVICE_ENVIRONMENT]: 'production',
+                },
+              },
+              {
+                key: {
+                  [SERVICE_NAME]: 'opbeans-rum',
+                  [SERVICE_ENVIRONMENT]: null,
+                },
+              },
+            ],
+          },
+        },
+      });
+
+      expect(await task?.executor({ search, indices } as any)).toEqual({
+        environments: {
+          services_with_multiple_environments: 1,
+          services_without_environment: 2,
+          top_environments: ['production', 'testing'],
+        },
+      });
+    });
+  });
+
   describe('aggregated_transactions', () => {
     const task = tasks.find((t) => t.name === 'aggregated_transactions');
 
-    it('returns aggregated transaction counts', async () => {
-      // This mock implementation returns different values based on the parameters,
-      // which should simulate all the queries that are done. For most of them we'll
-      // simulate the number of buckets by using the length of the key, but for a
-      // couple we'll simulate being paginated by returning an after_key.
-      const search = jest.fn().mockImplementation((params) => {
-        const isRumResult =
-          params.body.query.bool.filter &&
-          params.body.query.bool.filter.some(
-            (filter: any) =>
-              filter.terms && filter.terms[AGENT_NAME]?.includes('rum-js')
-          );
-        const isNonRumResult =
-          params.body.query.bool.filter &&
-          params.body.query.bool.filter.some(
-            (filter: any) =>
-              filter.terms && !filter.terms[AGENT_NAME]?.includes('rum-js')
-          );
-        const isPagedResult =
-          !!params.body.aggs?.current_implementation?.composite.after ||
-          !!params.body.aggs?.no_observer_name?.composite.after;
-        const isTotalResult = 'track_total_hits' in params.body;
-        const key = Object.keys(params.body.aggs ?? [])[0];
-
-        if (isRumResult) {
-          if (isTotalResult) {
-            return Promise.resolve({ hits: { total: { value: 3000 } } });
-          }
-        }
-
-        if (isNonRumResult) {
-          if (isTotalResult) {
-            return Promise.resolve({ hits: { total: { value: 2000 } } });
-          }
-        }
+    describe('without transactions', () => {
+      it('returns an empty result', async () => {
+        const search = jest.fn().mockReturnValueOnce({
+          hits: {
+            hits: [],
+            total: {
+              value: 0,
+            },
+          },
+        });
 
-        if (isPagedResult && key) {
-          return Promise.resolve({
-            hits: { total: { value: key.length } },
-            aggregations: { [key]: { buckets: [{}] } },
-          });
-        }
+        expect(await task?.executor({ indices, search } as any)).toEqual({});
+      });
+    });
 
-        if (isTotalResult) {
-          return Promise.resolve({ hits: { total: { value: 1000 } } });
-        }
+    it('returns aggregated transaction counts', async () => {
+      const search = jest
+        .fn()
+        // The first call to `search` asks for a transaction to get
+        // a fixed date range.
+        .mockReturnValueOnce({
+          hits: {
+            hits: [{ _source: { '@timestamp': new Date().toISOString() } }],
+          },
+          total: {
+            value: 1,
+          },
+        })
+        // Later calls are all composite aggregations. We return 2 pages of
+        // results to test if scrolling works.
+        .mockImplementation((params) => {
+          let arrayLength = 1000;
+          let nextAfter: Record<string, any> = { after_key: {} };
+
+          if (params.body.aggs.transaction_metric_groups.composite.after) {
+            arrayLength = 250;
+            nextAfter = {};
+          }
 
-        if (
-          key === 'current_implementation' ||
-          (key === 'no_observer_name' && !isPagedResult)
-        ) {
           return Promise.resolve({
-            hits: { total: { value: key.length } },
-            aggregations: {
-              [key]: { after_key: {}, buckets: key.split('').map((_) => ({})) },
+            hits: {
+              total: {
+                value: 5000,
+              },
             },
-          });
-        }
-
-        if (key) {
-          return Promise.resolve({
-            hits: { total: { value: key.length } },
             aggregations: {
-              [key]: { buckets: key.split('').map((_) => ({})) },
+              transaction_metric_groups: {
+                buckets: new Array(arrayLength),
+                ...nextAfter,
+              },
             },
           });
-        }
-      });
+        });
 
       expect(await task?.executor({ indices, search } as any)).toEqual({
         aggregated_transactions: {
           current_implementation: {
-            expected_metric_document_count: 23,
-            transaction_count: 1000,
+            expected_metric_document_count: 1250,
+            transaction_count: 5000,
+            ratio: 0.25,
           },
           no_observer_name: {
-            expected_metric_document_count: 17,
-            transaction_count: 1000,
-          },
-          no_rum: {
-            expected_metric_document_count: 6,
-            transaction_count: 2000,
-          },
-          no_rum_no_observer_name: {
-            expected_metric_document_count: 23,
-            transaction_count: 2000,
-          },
-          only_rum: {
-            expected_metric_document_count: 8,
-            transaction_count: 3000,
+            expected_metric_document_count: 1250,
+            transaction_count: 5000,
+            ratio: 0.25,
           },
-          only_rum_no_observer_name: {
-            expected_metric_document_count: 25,
-            transaction_count: 3000,
+          with_country: {
+            expected_metric_document_count: 1250,
+            transaction_count: 5000,
+            ratio: 0.25,
           },
         },
       });
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
index 840f47b0434184..a53068d152d03a 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
@@ -3,7 +3,10 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { flatten, merge, sortBy, sum } from 'lodash';
+import { ValuesType } from 'utility-types';
+import { flatten, merge, sortBy, sum, pickBy } from 'lodash';
+import { AggregationOptionsByType } from '../../../../typings/elasticsearch/aggregations';
+import { ProcessorEvent } from '../../../../common/processor_event';
 import { TelemetryTask } from '.';
 import { AGENT_NAMES, RUM_AGENTS } from '../../../../common/agent_name';
 import {
@@ -16,7 +19,7 @@ import {
   CONTAINER_ID,
   ERROR_GROUP_ID,
   HOST_NAME,
-  OBSERVER_NAME,
+  OBSERVER_HOSTNAME,
   PARENT_ID,
   POD_NAME,
   PROCESSOR_EVENT,
@@ -32,10 +35,8 @@ import {
   TRANSACTION_NAME,
   TRANSACTION_RESULT,
   TRANSACTION_TYPE,
-  USER_AGENT_NAME,
   USER_AGENT_ORIGINAL,
 } from '../../../../common/elasticsearch_fieldnames';
-import { ESFilter } from '../../../../typings/elasticsearch';
 import { APMError } from '../../../../typings/es_schemas/ui/apm_error';
 import { AgentName } from '../../../../typings/es_schemas/ui/fields/agent';
 import { Span } from '../../../../typings/es_schemas/ui/span';
@@ -57,79 +58,114 @@ export const tasks: TelemetryTask[] = [
     // the transaction count for that time range.
     executor: async ({ indices, search }) => {
       async function getBucketCountFromPaginatedQuery(
-        key: string,
-        filter: ESFilter[],
-        count: number = 0,
+        sources: Array<
+          ValuesType<AggregationOptionsByType['composite']['sources']>[string]
+        >,
+        prevResult?: {
+          transaction_count: number;
+          expected_metric_document_count: number;
+        },
         after?: any
-      ) {
+      ): Promise<{
+        transaction_count: number;
+        expected_metric_document_count: number;
+        ratio: number;
+      }> {
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        let { expected_metric_document_count } = prevResult ?? {
+          transaction_count: 0,
+          expected_metric_document_count: 0,
+        };
+
         const params = {
           index: [indices['apm_oss.transactionIndices']],
           body: {
             size: 0,
             timeout,
-            query: { bool: { filter } },
+            query: {
+              bool: {
+                filter: [
+                  { term: { [PROCESSOR_EVENT]: 'transaction' } },
+                  { range: { '@timestamp': { gte: start, lt: end } } },
+                ],
+              },
+            },
+            track_total_hits: true,
             aggs: {
-              [key]: {
+              transaction_metric_groups: {
                 composite: {
                   ...(after ? { after } : {}),
                   size: 10000,
-                  sources: fieldMap[key].map((field) => ({
-                    [field]: { terms: { field, missing_bucket: true } },
-                  })),
+                  sources: sources.map((source, index) => {
+                    return {
+                      [index]: source,
+                    };
+                  }),
                 },
               },
             },
           },
         };
+
         const result = await search(params);
+
         let nextAfter: any;
 
         if (result.aggregations) {
-          nextAfter = result.aggregations[key].after_key;
-          count += result.aggregations[key].buckets.length;
+          nextAfter = result.aggregations.transaction_metric_groups.after_key;
+          expected_metric_document_count +=
+            result.aggregations.transaction_metric_groups.buckets.length;
         }
 
         if (nextAfter) {
-          count = await getBucketCountFromPaginatedQuery(
-            key,
-            filter,
-            count,
+          return await getBucketCountFromPaginatedQuery(
+            sources,
+            {
+              expected_metric_document_count,
+              transaction_count: result.hits.total.value,
+            },
             nextAfter
           );
         }
 
-        return count;
+        return {
+          expected_metric_document_count,
+          transaction_count: result.hits.total.value,
+          ratio: expected_metric_document_count / result.hits.total.value,
+        };
       }
 
-      async function totalSearch(filter: ESFilter[]) {
-        const result = await search({
-          index: [indices['apm_oss.transactionIndices']],
+      // fixed date range for reliable results
+      const lastTransaction = (
+        await search({
+          index: indices['apm_oss.transactionIndices'],
           body: {
-            size: 0,
-            timeout,
-            query: { bool: { filter } },
-            track_total_hits: true,
+            query: {
+              bool: {
+                filter: [
+                  { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
+                ],
+              },
+            },
+            size: 1,
+            sort: {
+              '@timestamp': 'desc',
+            },
           },
-        });
+        })
+      ).hits.hits[0] as { _source: { '@timestamp': string } };
 
-        return result.hits.total.value;
+      if (!lastTransaction) {
+        return {};
       }
 
-      const nonRumAgentNames = AGENT_NAMES.filter(
-        (name) => !RUM_AGENTS.includes(name)
-      );
+      const end =
+        new Date(lastTransaction._source['@timestamp']).getTime() -
+        5 * 60 * 1000;
 
-      const filter: ESFilter[] = [
-        { term: { [PROCESSOR_EVENT]: 'transaction' } },
-        { range: { '@timestamp': { gte: 'now-1m' } } },
-      ];
-      const noRumFilter = [
-        ...filter,
-        { terms: { [AGENT_NAME]: nonRumAgentNames } },
-      ];
-      const rumFilter = [...filter, { terms: { [AGENT_NAME]: RUM_AGENTS } }];
+      const start = end - 60 * 1000;
 
-      const baseFields = [
+      const simpleTermFields = [
         TRANSACTION_NAME,
         TRANSACTION_RESULT,
         TRANSACTION_TYPE,
@@ -139,73 +175,61 @@ export const tasks: TelemetryTask[] = [
         HOST_NAME,
         CONTAINER_ID,
         POD_NAME,
-      ];
-
-      const fieldMap: Record<string, string[]> = {
-        current_implementation: [OBSERVER_NAME, ...baseFields, USER_AGENT_NAME],
-        no_observer_name: [...baseFields, USER_AGENT_NAME],
-        no_rum: [OBSERVER_NAME, ...baseFields],
-        no_rum_no_observer_name: baseFields,
-        only_rum: [OBSERVER_NAME, ...baseFields, USER_AGENT_NAME],
-        only_rum_no_observer_name: [...baseFields, USER_AGENT_NAME],
-      };
+      ].map((field) => ({ terms: { field, missing_bucket: true } }));
 
-      // It would be more performant to do these in parallel, but we have different filters and keys and it's easier to
-      // understand if we make the code slower and longer
-      const countMap: Record<string, number> = {
-        current_implementation: await getBucketCountFromPaginatedQuery(
-          'current_implementation',
-          filter
-        ),
-        no_observer_name: await getBucketCountFromPaginatedQuery(
-          'no_observer_name',
-          filter
-        ),
-        no_rum: await getBucketCountFromPaginatedQuery('no_rum', noRumFilter),
-        no_rum_no_observer_name: await getBucketCountFromPaginatedQuery(
-          'no_rum_no_observer_name',
-          noRumFilter
-        ),
-        only_rum: await getBucketCountFromPaginatedQuery('only_rum', rumFilter),
-        only_rum_no_observer_name: await getBucketCountFromPaginatedQuery(
-          'only_rum_no_observer_name',
-          rumFilter
-        ),
+      const observerHostname = {
+        terms: { field: OBSERVER_HOSTNAME, missing_bucket: true },
       };
 
-      const [allCount, noRumCount, rumCount] = await Promise.all([
-        totalSearch(filter),
-        totalSearch(noRumFilter),
-        totalSearch(rumFilter),
-      ]);
+      const baseFields = [
+        ...simpleTermFields,
+        // user_agent.name only for page-load transactions
+        {
+          terms: {
+            script: `
+              if (doc['transaction.type'].value == 'page-load' && doc['user_agent.name'].size() > 0) {
+                return doc['user_agent.name'].value;
+              }
 
-      return {
-        aggregated_transactions: {
-          current_implementation: {
-            transaction_count: allCount,
-            expected_metric_document_count: countMap.current_implementation,
-          },
-          no_observer_name: {
-            transaction_count: allCount,
-            expected_metric_document_count: countMap.no_observer_name,
-          },
-          no_rum: {
-            transaction_count: noRumCount,
-            expected_metric_document_count: countMap.no_rum,
+              return null;
+            `,
+            missing_bucket: true,
           },
-          no_rum_no_observer_name: {
-            transaction_count: noRumCount,
-            expected_metric_document_count: countMap.no_rum_no_observer_name,
-          },
-          only_rum: {
-            transaction_count: rumCount,
-            expected_metric_document_count: countMap.only_rum,
-          },
-          only_rum_no_observer_name: {
-            transaction_count: rumCount,
-            expected_metric_document_count: countMap.only_rum_no_observer_name,
+        },
+        // transaction.root
+        {
+          terms: {
+            script: `return doc['parent.id'].size() == 0`,
+            missing_bucket: true,
           },
         },
+      ];
+
+      const results = {
+        current_implementation: await getBucketCountFromPaginatedQuery([
+          ...baseFields,
+          observerHostname,
+        ]),
+        with_country: await getBucketCountFromPaginatedQuery([
+          ...baseFields,
+          observerHostname,
+          {
+            terms: {
+              script: `
+                if (doc['transaction.type'].value == 'page-load' && doc['client.geo.country_iso_code'].size() > 0) {
+                  return doc['client.geo.country_iso_code'].value;
+                }
+                return null;
+              `,
+              missing_bucket: true,
+            },
+          },
+        ]),
+        no_observer_name: await getBucketCountFromPaginatedQuery(baseFields),
+      };
+
+      return {
+        aggregated_transactions: results,
       };
     },
   },
@@ -270,6 +294,87 @@ export const tasks: TelemetryTask[] = [
       return { cloud };
     },
   },
+  {
+    name: 'environments',
+    executor: async ({ indices, search }) => {
+      const response = await search({
+        index: [indices['apm_oss.transactionIndices']],
+        body: {
+          query: {
+            bool: {
+              filter: [{ range: { '@timestamp': { gte: 'now-1d' } } }],
+            },
+          },
+          aggs: {
+            environments: {
+              terms: {
+                field: SERVICE_ENVIRONMENT,
+                size: 5,
+              },
+            },
+            service_environments: {
+              composite: {
+                size: 1000,
+                sources: [
+                  {
+                    [SERVICE_ENVIRONMENT]: {
+                      terms: {
+                        field: SERVICE_ENVIRONMENT,
+                        missing_bucket: true,
+                      },
+                    },
+                  },
+                  {
+                    [SERVICE_NAME]: {
+                      terms: {
+                        field: SERVICE_NAME,
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+          },
+        },
+      });
+
+      const topEnvironments =
+        response.aggregations?.environments.buckets.map(
+          (bucket) => bucket.key
+        ) ?? [];
+      const serviceEnvironments: Record<string, Array<string | null>> = {};
+
+      const buckets = response.aggregations?.service_environments.buckets ?? [];
+
+      buckets.forEach((bucket) => {
+        const serviceName = bucket.key['service.name'];
+        const environment = bucket.key['service.environment'] as string | null;
+
+        const environments = serviceEnvironments[serviceName] ?? [];
+
+        serviceEnvironments[serviceName] = environments.concat(environment);
+      });
+
+      const servicesWithoutEnvironment = Object.keys(
+        pickBy(serviceEnvironments, (environments) =>
+          environments.includes(null)
+        )
+      );
+
+      const servicesWithMultipleEnvironments = Object.keys(
+        pickBy(serviceEnvironments, (environments) => environments.length > 1)
+      );
+
+      return {
+        environments: {
+          services_without_environment: servicesWithoutEnvironment.length,
+          services_with_multiple_environments:
+            servicesWithMultipleEnvironments.length,
+          top_environments: topEnvironments as string[],
+        },
+      };
+    },
+  },
   {
     name: 'processor_events',
     executor: async ({ indices, search }) => {
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/index.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/index.ts
index 6f4f92c6833f78..3463865d326b0e 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/index.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/index.ts
@@ -6,6 +6,7 @@
 import { Observable } from 'rxjs';
 import { take } from 'rxjs/operators';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+import { DeepRequired } from 'utility-types';
 import {
   CoreSetup,
   Logger,
@@ -27,6 +28,7 @@ import {
   collectDataTelemetry,
   CollectTelemetryParams,
 } from './collect_data_telemetry';
+import { APMDataTelemetry } from './types';
 
 const APM_TELEMETRY_TASK_NAME = 'apm-telemetry-task';
 
@@ -36,12 +38,14 @@ export async function createApmTelemetry({
   usageCollector,
   taskManager,
   logger,
+  kibanaVersion,
 }: {
   core: CoreSetup;
   config$: Observable<APMConfig>;
   usageCollector: UsageCollectionSetup;
   taskManager: TaskManagerSetupContract;
   logger: Logger;
+  kibanaVersion: string;
 }) {
   taskManager.registerTaskDefinitions({
     [APM_TELEMETRY_TASK_NAME]: {
@@ -95,7 +99,10 @@ export async function createApmTelemetry({
 
     await savedObjectsClient.create(
       APM_TELEMETRY_SAVED_OBJECT_TYPE,
-      dataTelemetry,
+      {
+        ...dataTelemetry,
+        kibanaVersion,
+      },
       { id: APM_TELEMETRY_SAVED_OBJECT_TYPE, overwrite: true }
     );
   };
@@ -105,12 +112,14 @@ export async function createApmTelemetry({
     schema: getApmTelemetryMapping(),
     fetch: async () => {
       try {
-        const data = (
+        const { kibanaVersion: storedKibanaVersion, ...data } = (
           await savedObjectsClient.get(
             APM_TELEMETRY_SAVED_OBJECT_TYPE,
             APM_TELEMETRY_SAVED_OBJECT_ID
           )
-        ).attributes;
+        ).attributes as { kibanaVersion: string } & DeepRequired<
+          APMDataTelemetry
+        >;
 
         return data;
       } catch (err) {
@@ -126,7 +135,7 @@ export async function createApmTelemetry({
 
   usageCollector.registerCollector(collector);
 
-  core.getStartServices().then(([_coreStart, pluginsStart]) => {
+  core.getStartServices().then(async ([_coreStart, pluginsStart]) => {
     const { taskManager: taskManagerStart } = pluginsStart as {
       taskManager: TaskManagerStartContract;
     };
@@ -141,5 +150,25 @@ export async function createApmTelemetry({
       params: {},
       state: {},
     });
+
+    try {
+      const currentData = (
+        await savedObjectsClient.get(
+          APM_TELEMETRY_SAVED_OBJECT_TYPE,
+          APM_TELEMETRY_SAVED_OBJECT_ID
+        )
+      ).attributes as { kibanaVersion?: string };
+
+      if (currentData.kibanaVersion !== kibanaVersion) {
+        logger.debug(
+          `Stored telemetry is out of date. Task will run immediately. Stored: ${currentData.kibanaVersion}, expected: ${kibanaVersion}`
+        );
+        taskManagerStart.runNow(APM_TELEMETRY_TASK_NAME);
+      }
+    } catch (err) {
+      if (!SavedObjectsErrorHelpers.isNotFoundError(err)) {
+        logger.warn('Failed to fetch saved telemetry data.');
+      }
+    }
   });
 }
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts
index 82e4d1e395ed34..c7af292e817c7a 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts
@@ -30,6 +30,11 @@ export type APMDataTelemetry = DeepPartial<{
       patch: number;
     };
   };
+  environments: {
+    services_without_environments: number;
+    services_with_multiple_environments: number;
+    top_environments: string[];
+  };
   aggregated_transactions: {
     current_implementation: AggregatedTransactionsCounts;
     no_observer_name: AggregatedTransactionsCounts;
diff --git a/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts b/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts
index 29aaa98169fa5a..8060bf10da99cc 100644
--- a/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts
+++ b/x-pack/plugins/apm/server/lib/environments/get_all_environments.ts
@@ -37,6 +37,9 @@ export async function getAllEnvironments({
       ],
     },
     body: {
+      // use timeout + min_doc_count to return as early as possible
+      // if filter is not defined to prevent timeouts
+      ...(!serviceName ? { timeout: '1ms' } : {}),
       size: 0,
       query: {
         bool: {
@@ -48,6 +51,7 @@ export async function getAllEnvironments({
           terms: {
             field: SERVICE_ENVIRONMENT,
             size: 100,
+            ...(!serviceName ? { min_doc_count: 0 } : {}),
             missing: includeMissing ? ENVIRONMENT_NOT_DEFINED.value : undefined,
           },
         },
@@ -56,6 +60,7 @@ export async function getAllEnvironments({
   };
 
   const resp = await apmEventClient.search(params);
+
   const environments =
     resp.aggregations?.environments.buckets.map(
       (bucket) => bucket.key as string
diff --git a/x-pack/plugins/apm/server/lib/helpers/create_es_client/call_client_with_debug.ts b/x-pack/plugins/apm/server/lib/helpers/create_es_client/call_client_with_debug.ts
index c4756405952279..9f7aaafbefb8ce 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_es_client/call_client_with_debug.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_es_client/call_client_with_debug.ts
@@ -34,7 +34,7 @@ export async function callClientWithDebug({
   let res: any;
   let esError = null;
   try {
-    res = apiCaller(operationName, params);
+    res = await apiCaller(operationName, params);
   } catch (e) {
     // catch error and throw after outputting debug info
     esError = e;
diff --git a/x-pack/plugins/apm/server/lib/helpers/get_bucket_size/index.ts b/x-pack/plugins/apm/server/lib/helpers/get_bucket_size/index.ts
index 2e2f6c9a4c8b65..75b0471424e79f 100644
--- a/x-pack/plugins/apm/server/lib/helpers/get_bucket_size/index.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/get_bucket_size/index.ts
@@ -5,9 +5,9 @@
  */
 
 import moment from 'moment';
-// @ts-ignore
+// @ts-expect-error
 import { calculateAuto } from './calculate_auto';
-// @ts-ignore
+// @ts-expect-error
 import { unitToSeconds } from './unit_to_seconds';
 
 export function getBucketSize(start: number, end: number, interval: string) {
diff --git a/x-pack/plugins/apm/server/lib/helpers/setup_request.ts b/x-pack/plugins/apm/server/lib/helpers/setup_request.ts
index a242a0adb6d4c7..6b69e57389dffd 100644
--- a/x-pack/plugins/apm/server/lib/helpers/setup_request.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/setup_request.ts
@@ -122,13 +122,10 @@ function getMlSetup(
   if (!ml) {
     return;
   }
-  const mlClient = ml.mlClient.asScoped(request);
-  const mlSystem = ml.mlSystemProvider(mlClient, request);
+
   return {
-    mlClient,
-    mlSystem,
-    modules: ml.modulesProvider(mlClient, request, savedObjectsClient),
-    anomalyDetectors: ml.anomalyDetectorsProvider(mlClient, request),
-    mlAnomalySearch: mlSystem.mlAnomalySearch,
+    mlSystem: ml.mlSystemProvider(request),
+    anomalyDetectors: ml.anomalyDetectorsProvider(request),
+    modules: ml.modulesProvider(request, savedObjectsClient),
   };
 }
diff --git a/x-pack/plugins/apm/server/lib/rum_client/__snapshots__/queries.test.ts.snap b/x-pack/plugins/apm/server/lib/rum_client/__snapshots__/queries.test.ts.snap
index c5264373ea4954..2cb28d378e8fd5 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/__snapshots__/queries.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/rum_client/__snapshots__/queries.test.ts.snap
@@ -10,15 +10,25 @@ Object {
   "body": Object {
     "aggs": Object {
       "backEnd": Object {
-        "avg": Object {
+        "percentiles": Object {
           "field": "transaction.marks.agent.timeToFirstByte",
-          "missing": 0,
+          "hdr": Object {
+            "number_of_significant_value_digits": 3,
+          },
+          "percents": Array [
+            50,
+          ],
         },
       },
       "domInteractive": Object {
-        "avg": Object {
+        "percentiles": Object {
           "field": "transaction.marks.agent.domInteractive",
-          "missing": 0,
+          "hdr": Object {
+            "number_of_significant_value_digits": 3,
+          },
+          "percents": Array [
+            50,
+          ],
         },
       },
       "pageViews": Object {
@@ -138,7 +148,7 @@ Object {
   "body": Object {
     "aggs": Object {
       "pageViews": Object {
-        "aggs": Object {},
+        "aggs": undefined,
         "auto_date_histogram": Object {
           "buckets": 50,
           "field": "@timestamp",
diff --git a/x-pack/plugins/apm/server/lib/rum_client/get_client_metrics.ts b/x-pack/plugins/apm/server/lib/rum_client/get_client_metrics.ts
index 194c136e2b3d06..e0dec183f06d6c 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/get_client_metrics.ts
+++ b/x-pack/plugins/apm/server/lib/rum_client/get_client_metrics.ts
@@ -11,6 +11,10 @@ import {
   SetupTimeRange,
   SetupUIFilters,
 } from '../helpers/setup_request';
+import {
+  TRANSACTION_DOM_INTERACTIVE,
+  TRANSACTION_TIME_TO_FIRST_BYTE,
+} from '../../../common/elasticsearch_fieldnames';
 
 export async function getClientMetrics({
   setup,
@@ -30,15 +34,21 @@ export async function getClientMetrics({
       aggs: {
         pageViews: { value_count: { field: 'transaction.type' } },
         backEnd: {
-          avg: {
-            field: 'transaction.marks.agent.timeToFirstByte',
-            missing: 0,
+          percentiles: {
+            field: TRANSACTION_TIME_TO_FIRST_BYTE,
+            percents: [50],
+            hdr: {
+              number_of_significant_value_digits: 3,
+            },
           },
         },
         domInteractive: {
-          avg: {
-            field: 'transaction.marks.agent.domInteractive',
-            missing: 0,
+          percentiles: {
+            field: TRANSACTION_DOM_INTERACTIVE,
+            percents: [50],
+            hdr: {
+              number_of_significant_value_digits: 3,
+            },
           },
         },
       },
@@ -53,9 +63,11 @@ export async function getClientMetrics({
   // Divide by 1000 to convert ms into seconds
   return {
     pageViews,
-    backEnd: { value: (backEnd.value || 0) / 1000 },
+    backEnd: { value: (backEnd.values['50.0'] || 0) / 1000 },
     frontEnd: {
-      value: ((domInteractive.value || 0) - (backEnd.value || 0)) / 1000,
+      value:
+        ((domInteractive.values['50.0'] || 0) - (backEnd.values['50.0'] || 0)) /
+        1000,
     },
   };
 }
diff --git a/x-pack/plugins/apm/server/lib/rum_client/get_page_view_trends.ts b/x-pack/plugins/apm/server/lib/rum_client/get_page_view_trends.ts
index 23169ddaca5343..114137e9fad17e 100644
--- a/x-pack/plugins/apm/server/lib/rum_client/get_page_view_trends.ts
+++ b/x-pack/plugins/apm/server/lib/rum_client/get_page_view_trends.ts
@@ -11,7 +11,6 @@ import {
   SetupTimeRange,
   SetupUIFilters,
 } from '../helpers/setup_request';
-import { AggregationInputMap } from '../../../typings/elasticsearch/aggregations';
 import { BreakdownItem } from '../../../typings/ui_filters';
 
 export async function getPageViewTrends({
@@ -24,18 +23,9 @@ export async function getPageViewTrends({
   const projection = getRumOverviewProjection({
     setup,
   });
-  const breakdownAggs: AggregationInputMap = {};
+  let breakdownItem: BreakdownItem | null = null;
   if (breakdowns) {
-    const breakdownList: BreakdownItem[] = JSON.parse(breakdowns);
-    breakdownList.forEach(({ name, type, fieldName }) => {
-      breakdownAggs[name] = {
-        terms: {
-          field: fieldName,
-          size: 9,
-          missing: 'Other',
-        },
-      };
-    });
+    breakdownItem = JSON.parse(breakdowns);
   }
 
   const params = mergeProjection(projection, {
@@ -50,7 +40,17 @@ export async function getPageViewTrends({
             field: '@timestamp',
             buckets: 50,
           },
-          aggs: breakdownAggs,
+          aggs: breakdownItem
+            ? {
+                breakdown: {
+                  terms: {
+                    field: breakdownItem.fieldName,
+                    size: 9,
+                    missing: 'Other',
+                  },
+                },
+              }
+            : undefined,
         },
       },
     },
@@ -68,19 +68,18 @@ export async function getPageViewTrends({
       x: xVal,
       y: bCount,
     };
-
-    Object.keys(breakdownAggs).forEach((bKey) => {
-      const categoryBuckets = (bucket[bKey] as any).buckets;
+    if (breakdownItem) {
+      const categoryBuckets = (bucket.breakdown as any).buckets;
       categoryBuckets.forEach(
         ({ key, doc_count: docCount }: { key: string; doc_count: number }) => {
           if (key === 'Other') {
-            res[key + `(${bKey})`] = docCount;
+            res[key + `(${breakdownItem?.name})`] = docCount;
           } else {
             res[key] = docCount;
           }
         }
       );
-    });
+    }
 
     return res;
   });
diff --git a/x-pack/plugins/apm/server/lib/service_map/transform_service_map_responses.test.ts b/x-pack/plugins/apm/server/lib/service_map/transform_service_map_responses.test.ts
index 7e4bcfdda7382f..e529198e717d32 100644
--- a/x-pack/plugins/apm/server/lib/service_map/transform_service_map_responses.test.ts
+++ b/x-pack/plugins/apm/server/lib/service_map/transform_service_map_responses.test.ts
@@ -72,7 +72,6 @@ describe('transformServiceMapResponses', () => {
       (element) => 'source' in element.data && 'target' in element.data
     );
 
-    // @ts-ignore
     expect(connection?.data.target).toBe('opbeans-node');
 
     expect(
@@ -149,9 +148,9 @@ describe('transformServiceMapResponses', () => {
 
     const nodejsNode = nodes.find((node) => node.data.id === '>opbeans-node');
 
-    // @ts-ignore
+    // @ts-expect-error
     expect(nodejsNode?.data[SPAN_TYPE]).toBe('external');
-    // @ts-ignore
+    // @ts-expect-error
     expect(nodejsNode?.data[SPAN_SUBTYPE]).toBe('aa');
   });
 
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap b/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap
index 2b465a0f874752..c01e5c87eeea2f 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/__snapshots__/queries.test.ts.snap
@@ -127,11 +127,13 @@ Object {
       "services": Object {
         "terms": Object {
           "field": "service.name",
+          "min_doc_count": 0,
           "size": 50,
         },
       },
     },
     "size": 0,
+    "timeout": "1ms",
   },
 }
 `;
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
index 8b6c1d82beab00..91bdfeef003f13 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
@@ -25,12 +25,14 @@ export async function getServiceNames({ setup }: { setup: Setup }) {
       ],
     },
     body: {
+      timeout: '1ms',
       size: 0,
       aggs: {
         services: {
           terms: {
             field: SERVICE_NAME,
             size: 50,
+            min_doc_count: 0,
           },
         },
       },
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts b/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts
index 2a1a581c795742..5c1e1839d9c535 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/fetcher.ts
@@ -65,7 +65,7 @@ function getItemsWithRelativeImpact(
     key: string | Record<string, any>;
     avg?: number | null;
     count?: number | null;
-    p95?: number;
+    p95?: number | null;
     sample?: Transaction;
   }>
 ) {
@@ -185,10 +185,12 @@ export async function transactionGroupsFetcher(
 }
 
 export interface TransactionGroup {
-  key: Record<string, any> | string;
+  name?: string;
+  key?: Record<string, any> | string;
   averageResponseTime: number | null | undefined;
   transactionsPerMinute: number;
-  p95: number | undefined;
+  p95: number | null | undefined;
   impact: number;
+  impactRelative?: number;
   sample: Transaction;
 }
diff --git a/x-pack/plugins/apm/server/lib/transaction_groups/get_error_rate.ts b/x-pack/plugins/apm/server/lib/transaction_groups/get_error_rate.ts
index ec2d8144cf3ffc..f7b7f721681604 100644
--- a/x-pack/plugins/apm/server/lib/transaction_groups/get_error_rate.ts
+++ b/x-pack/plugins/apm/server/lib/transaction_groups/get_error_rate.ts
@@ -4,11 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { mean } from 'lodash';
+import { EventOutcome } from '../../../common/event_outcome';
 import {
-  HTTP_RESPONSE_STATUS_CODE,
   TRANSACTION_NAME,
   TRANSACTION_TYPE,
   SERVICE_NAME,
+  EVENT_OUTCOME,
 } from '../../../common/elasticsearch_fieldnames';
 import { ProcessorEvent } from '../../../common/processor_event';
 import { rangeFilter } from '../../../common/utils/range_filter';
@@ -42,7 +43,9 @@ export async function getErrorRate({
   const filter = [
     { term: { [SERVICE_NAME]: serviceName } },
     { range: rangeFilter(start, end) },
-    { exists: { field: HTTP_RESPONSE_STATUS_CODE } },
+    {
+      terms: { [EVENT_OUTCOME]: [EventOutcome.failure, EventOutcome.success] },
+    },
     ...transactionNamefilter,
     ...transactionTypefilter,
     ...uiFiltersES,
@@ -65,7 +68,7 @@ export async function getErrorRate({
           },
           aggs: {
             erroneous_transactions: {
-              filter: { range: { [HTTP_RESPONSE_STATUS_CODE]: { gte: 400 } } },
+              filter: { term: { [EVENT_OUTCOME]: EventOutcome.failure } },
             },
           },
         },
diff --git a/x-pack/plugins/apm/server/lib/transactions/breakdown/index.test.ts b/x-pack/plugins/apm/server/lib/transactions/breakdown/index.test.ts
index 731f75226cbe4c..34863c64f98041 100644
--- a/x-pack/plugins/apm/server/lib/transactions/breakdown/index.test.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/breakdown/index.test.ts
@@ -50,40 +50,9 @@ describe('getTransactionBreakdown', () => {
       setup: getMockSetup(noDataResponse),
     });
 
-    expect(response.kpis.length).toBe(0);
-
     expect(Object.keys(response.timeseries).length).toBe(0);
   });
 
-  it('returns transaction breakdowns grouped by type and subtype', async () => {
-    const response = await getTransactionBreakdown({
-      serviceName: 'myServiceName',
-      transactionType: 'request',
-      setup: getMockSetup(dataResponse),
-    });
-
-    expect(response.kpis.length).toBe(4);
-
-    expect(response.kpis.map((kpi) => kpi.name)).toEqual([
-      'app',
-      'dispatcher-servlet',
-      'http',
-      'postgresql',
-    ]);
-
-    expect(response.kpis[0]).toEqual({
-      name: 'app',
-      color: '#54b399',
-      percentage: 0.5408550899466306,
-    });
-
-    expect(response.kpis[3]).toEqual({
-      name: 'postgresql',
-      color: '#9170b8',
-      percentage: 0.047366859295002,
-    });
-  });
-
   it('returns a timeseries grouped by type and subtype', async () => {
     const response = await getTransactionBreakdown({
       serviceName: 'myServiceName',
@@ -98,7 +67,7 @@ describe('getTransactionBreakdown', () => {
     const appTimeseries = timeseries[0];
     expect(appTimeseries.title).toBe('app');
     expect(appTimeseries.type).toBe('areaStacked');
-    expect(appTimeseries.hideLegend).toBe(true);
+    expect(appTimeseries.hideLegend).toBe(false);
 
     // empty buckets should result in null values for visible types
     expect(appTimeseries.data.length).toBe(276);
@@ -110,7 +79,7 @@ describe('getTransactionBreakdown', () => {
   });
 
   it('should not include more KPIs than MAX_KPIs', async () => {
-    // @ts-ignore
+    // @ts-expect-error
     constants.MAX_KPIS = 2;
 
     const response = await getTransactionBreakdown({
diff --git a/x-pack/plugins/apm/server/lib/transactions/breakdown/index.ts b/x-pack/plugins/apm/server/lib/transactions/breakdown/index.ts
index fbdddea32deb4f..9730ddbbf38d7c 100644
--- a/x-pack/plugins/apm/server/lib/transactions/breakdown/index.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/breakdown/index.ts
@@ -5,6 +5,7 @@
  */
 
 import { flatten, orderBy, last } from 'lodash';
+import { asPercent } from '../../../../common/utils/formatters';
 import { ProcessorEvent } from '../../../../common/processor_event';
 import {
   SERVICE_NAME,
@@ -149,9 +150,16 @@ export async function getTransactionBreakdown({
       )
     : [];
 
-  const kpis = orderBy(visibleKpis, 'name').map((kpi, index) => {
-    return {
+  const kpis = orderBy(
+    visibleKpis.map((kpi) => ({
       ...kpi,
+      lowerCaseName: kpi.name.toLowerCase(),
+    })),
+    'lowerCaseName'
+  ).map((kpi, index) => {
+    const { lowerCaseName, ...rest } = kpi;
+    return {
+      ...rest,
       color: getVizColorForIndex(index),
     };
   });
@@ -213,11 +221,9 @@ export async function getTransactionBreakdown({
     color: kpi.color,
     type: 'areaStacked',
     data: timeseriesPerSubtype[kpi.name],
-    hideLegend: true,
+    hideLegend: false,
+    legendValue: asPercent(kpi.percentage, 1),
   }));
 
-  return {
-    kpis,
-    timeseries,
-  };
+  return { timeseries };
 }
diff --git a/x-pack/plugins/apm/server/plugin.ts b/x-pack/plugins/apm/server/plugin.ts
index 71202c62e6f6c1..f7e3977ae7d310 100644
--- a/x-pack/plugins/apm/server/plugin.ts
+++ b/x-pack/plugins/apm/server/plugin.ts
@@ -101,6 +101,7 @@ export class APMPlugin implements Plugin<APMPluginSetup> {
         usageCollector: plugins.usageCollection,
         taskManager: plugins.taskManager,
         logger: this.logger,
+        kibanaVersion: this.initContext.env.packageInfo.version,
       });
     }
 
diff --git a/x-pack/plugins/apm/server/projections/typings.ts b/x-pack/plugins/apm/server/projections/typings.ts
index 77a5beaf546053..332ac533e78c61 100644
--- a/x-pack/plugins/apm/server/projections/typings.ts
+++ b/x-pack/plugins/apm/server/projections/typings.ts
@@ -15,7 +15,7 @@ export type Projection = Omit<APMEventESSearchRequest, 'body'> & {
   body: Omit<ESSearchBody, 'aggs'> & {
     aggs?: {
       [key: string]: {
-        terms: AggregationOptionsByType['terms'];
+        terms: AggregationOptionsByType['terms'] & { field: string };
         aggs?: AggregationInputMap;
       };
     };
diff --git a/x-pack/plugins/apm/server/routes/create_api/index.ts b/x-pack/plugins/apm/server/routes/create_api/index.ts
index 92f52dd1552d64..42eebc51463db1 100644
--- a/x-pack/plugins/apm/server/routes/create_api/index.ts
+++ b/x-pack/plugins/apm/server/routes/create_api/index.ts
@@ -140,7 +140,7 @@ export function createApi() {
                   // Only return values for parameters that have runtime types,
                   // but always include query as _debug is always set even if
                   // it's not defined in the route.
-                  // @ts-ignore
+                  // @ts-expect-error
                   params: pick(parsedParams, ...Object.keys(params), 'query'),
                   config,
                   logger,
diff --git a/x-pack/plugins/apm/typings/cytoscape_dagre.d.ts b/x-pack/plugins/apm/typings/cytoscape_dagre.d.ts
new file mode 100644
index 00000000000000..b5bbdfc14d9d35
--- /dev/null
+++ b/x-pack/plugins/apm/typings/cytoscape_dagre.d.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+declare module 'cytoscape-dagre';
diff --git a/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts b/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
index d25ec8709e3bef..f9576141225475 100644
--- a/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
+++ b/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
@@ -23,13 +23,13 @@ type BucketsPath = string | Record<string, string>;
 
 type SourceOptions = string | string[];
 
-type MetricsAggregationOptions =
+type AggregationSourceOptions =
   | {
       field: string;
-      missing?: number;
+      missing?: unknown;
     }
   | {
-      script?: Script;
+      script: Script;
     };
 
 interface MetricsAggregationResponsePart {
@@ -51,48 +51,49 @@ type GetCompositeKeys<
 
 type CompositeOptionsSource = Record<
   string,
-  { terms: { field: string; missing_bucket?: boolean } } | undefined
+  | {
+      terms: ({ field: string } | { script: Script }) & {
+        missing_bucket?: boolean;
+      };
+    }
+  | undefined
 >;
 
 export interface AggregationOptionsByType {
   terms: {
-    field: string;
     size?: number;
-    missing?: string;
     order?: SortOptions;
     execution_hint?: 'map' | 'global_ordinals';
-  };
+  } & AggregationSourceOptions;
   date_histogram: {
-    field: string;
     format?: string;
     min_doc_count?: number;
     extended_bounds?: {
       min: number;
       max: number;
     };
-  } & ({ calendar_interval: string } | { fixed_interval: string });
+  } & ({ calendar_interval: string } | { fixed_interval: string }) &
+    AggregationSourceOptions;
   histogram: {
-    field: string;
     interval: number;
     min_doc_count?: number;
     extended_bounds?: {
       min?: number | string;
       max?: number | string;
     };
-  };
-  avg: MetricsAggregationOptions;
-  max: MetricsAggregationOptions;
-  min: MetricsAggregationOptions;
-  sum: MetricsAggregationOptions;
-  value_count: MetricsAggregationOptions;
-  cardinality: MetricsAggregationOptions & {
+  } & AggregationSourceOptions;
+  avg: AggregationSourceOptions;
+  max: AggregationSourceOptions;
+  min: AggregationSourceOptions;
+  sum: AggregationSourceOptions;
+  value_count: AggregationSourceOptions;
+  cardinality: AggregationSourceOptions & {
     precision_threshold?: number;
   };
   percentiles: {
-    field: string;
     percents?: number[];
     hdr?: { number_of_significant_value_digits: number };
-  };
+  } & AggregationSourceOptions;
   extended_stats: {
     field: string;
   };
@@ -133,7 +134,6 @@ export interface AggregationOptionsByType {
     reduce_script: Script;
   };
   date_range: {
-    field: string;
     format?: string;
     ranges: Array<
       | { from: string | number }
@@ -141,17 +141,15 @@ export interface AggregationOptionsByType {
       | { from: string | number; to: string | number }
     >;
     keyed?: boolean;
-  };
+  } & AggregationSourceOptions;
   auto_date_histogram: {
-    field: string;
     buckets: number;
-  };
+  } & AggregationSourceOptions;
   percentile_ranks: {
-    field: string;
     values: string[];
     keyed?: boolean;
     hdr?: { number_of_significant_value_digits: number };
-  };
+  } & AggregationSourceOptions;
 }
 
 type AggregationType = keyof AggregationOptionsByType;
@@ -223,7 +221,7 @@ interface AggregationResponsePart<
     value: number;
   };
   percentiles: {
-    values: Record<string, number>;
+    values: Record<string, number | null>;
   };
   extended_stats: {
     count: number;
@@ -288,10 +286,9 @@ interface AggregationResponsePart<
       }
     | undefined;
   composite: {
-    after_key: Record<
-      GetCompositeKeys<TAggregationOptionsMap>,
-      string | number
-    >;
+    after_key: {
+      [key in GetCompositeKeys<TAggregationOptionsMap>]: TAggregationOptionsMap;
+    };
     buckets: Array<
       {
         key: Record<GetCompositeKeys<TAggregationOptionsMap>, string | number>;
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/fields/host.ts b/x-pack/plugins/apm/typings/es_schemas/raw/fields/host.ts
index 51c09e59d9b686..1869a4fc1bef5c 100644
--- a/x-pack/plugins/apm/typings/es_schemas/raw/fields/host.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/fields/host.ts
@@ -5,5 +5,11 @@
  */
 
 export interface Host {
+  architecture?: string;
   hostname?: string;
+  name?: string;
+  ip?: string;
+  os?: {
+    platform?: string;
+  };
 }
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/fields/observer.ts b/x-pack/plugins/apm/typings/es_schemas/raw/fields/observer.ts
index 0815b7cd88163d..823d12cbd80950 100644
--- a/x-pack/plugins/apm/typings/es_schemas/raw/fields/observer.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/fields/observer.ts
@@ -5,7 +5,11 @@
  */
 
 export interface Observer {
+  ephemeral_id?: string;
+  hostname?: string;
+  id?: string;
   name?: string;
+  type?: string;
   version: string;
   version_major: number;
 }
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/fields/process.ts b/x-pack/plugins/apm/typings/es_schemas/raw/fields/process.ts
index 63e1faa3821634..898ef04ed6a008 100644
--- a/x-pack/plugins/apm/typings/es_schemas/raw/fields/process.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/fields/process.ts
@@ -5,8 +5,8 @@
  */
 
 export interface Process {
-  args: string[];
+  args?: string[];
   pid: number;
-  ppid: number;
-  title: string;
+  ppid?: number;
+  title?: string;
 }
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/fields/service.ts b/x-pack/plugins/apm/typings/es_schemas/raw/fields/service.ts
index 3ef852ebf6dd69..00795d69e13b64 100644
--- a/x-pack/plugins/apm/typings/es_schemas/raw/fields/service.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/fields/service.ts
@@ -9,7 +9,10 @@ export interface Service {
   environment?: string;
   framework?: {
     name: string;
-    version: string;
+    version?: string;
+  };
+  node?: {
+    name?: string;
   };
   runtime?: {
     name: string;
@@ -19,4 +22,5 @@ export interface Service {
     name: string;
     version?: string;
   };
+  version?: string;
 }
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/transaction_raw.ts b/x-pack/plugins/apm/typings/es_schemas/raw/transaction_raw.ts
index b8ebb4cf8da51d..cdfe4183c96f57 100644
--- a/x-pack/plugins/apm/typings/es_schemas/raw/transaction_raw.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/transaction_raw.ts
@@ -54,6 +54,7 @@ export interface TransactionRaw extends APMBaseDoc {
 
   // Shared by errors and transactions
   container?: Container;
+  ecs?: { version?: string };
   host?: Host;
   http?: Http;
   kubernetes?: Kubernetes;
diff --git a/x-pack/plugins/apm/typings/es_schemas/ui/fields/agent.ts b/x-pack/plugins/apm/typings/es_schemas/ui/fields/agent.ts
index 1e542dec06a724..4d98825f36b507 100644
--- a/x-pack/plugins/apm/typings/es_schemas/ui/fields/agent.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/ui/fields/agent.ts
@@ -19,6 +19,7 @@ export type AgentName =
   | 'ruby';
 
 export interface Agent {
+  ephemeral_id?: string;
   name: AgentName;
   version: string;
 }
diff --git a/x-pack/plugins/apm/typings/ui_filters.ts b/x-pack/plugins/apm/typings/ui_filters.ts
index 2a727dda7241da..efba6919778bbc 100644
--- a/x-pack/plugins/apm/typings/ui_filters.ts
+++ b/x-pack/plugins/apm/typings/ui_filters.ts
@@ -14,7 +14,6 @@ export type UIFilters = {
 
 export interface BreakdownItem {
   name: string;
-  count: number;
   type: string;
   fieldName: string;
   selected?: boolean;
diff --git a/x-pack/plugins/canvas/__tests__/fixtures/workpads.ts b/x-pack/plugins/canvas/__tests__/fixtures/workpads.ts
index 4b1f31cb14687a..0d2939ed0e8a5e 100644
--- a/x-pack/plugins/canvas/__tests__/fixtures/workpads.ts
+++ b/x-pack/plugins/canvas/__tests__/fixtures/workpads.ts
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { CanvasWorkpad, CanvasElement, CanvasPage } from '../../types';
+import { CanvasWorkpad, CanvasElement, CanvasPage, CanvasVariable } from '../../types';
 
 const BaseWorkpad: CanvasWorkpad = {
   '@created': '2019-02-08T18:35:23.029Z',
@@ -50,6 +50,12 @@ const BaseElement: CanvasElement = {
   filter: '',
 };
 
+const BaseVariable: CanvasVariable = {
+  name: 'my-var',
+  value: 'Hello World',
+  type: 'string',
+};
+
 export const workpads: CanvasWorkpad[] = [
   {
     ...BaseWorkpad,
@@ -71,6 +77,11 @@ export const workpads: CanvasWorkpad[] = [
         ],
       },
     ],
+    variables: [
+      {
+        ...BaseVariable,
+      },
+    ],
   },
   {
     ...BaseWorkpad,
@@ -82,6 +93,11 @@ export const workpads: CanvasWorkpad[] = [
         ],
       },
     ],
+    variables: [
+      {
+        ...BaseVariable,
+      },
+    ],
   },
   {
     ...BaseWorkpad,
@@ -103,6 +119,11 @@ export const workpads: CanvasWorkpad[] = [
       { ...BasePage, elements: [{ ...BaseElement, expression: 'image | render' }] },
       { ...BasePage, elements: [{ ...BaseElement, expression: 'image | render' }] },
     ],
+    variables: [
+      {
+        ...BaseVariable,
+      },
+    ],
   },
   {
     ...BaseWorkpad,
@@ -136,6 +157,11 @@ export const workpads: CanvasWorkpad[] = [
         ],
       },
     ],
+    variables: [
+      {
+        ...BaseVariable,
+      },
+    ],
   },
   {
     ...BaseWorkpad,
@@ -166,6 +192,17 @@ export const workpads: CanvasWorkpad[] = [
         ],
       },
     ],
+    variables: [
+      {
+        ...BaseVariable,
+      },
+      {
+        ...BaseVariable,
+      },
+      {
+        ...BaseVariable,
+      },
+    ],
   },
   {
     ...BaseWorkpad,
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/pie.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/common/pie.ts
index 16eee349475ef6..11551c50d9f257 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/pie.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/functions/common/pie.ts
@@ -39,9 +39,9 @@ interface PieOptions {
   colors: string[];
   legend: {
     show: boolean;
-    backgroundOpacity: number;
-    labelBoxBorderColor: string;
-    position: Legend;
+    backgroundOpacity?: number;
+    labelBoxBorderColor?: string;
+    position?: Legend;
   };
   grid: {
     show: boolean;
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_lens.test.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_lens.test.ts
index 882d1e2ea58b9a..33260b5c9303fb 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_lens.test.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_lens.test.ts
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-jest.mock('ui/new_platform');
+
 import { savedLens } from './saved_lens';
 import { getQueryFilters } from '../../../public/lib/build_embeddable_filters';
 import { ExpressionValueFilter } from '../../../types';
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_map.test.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_map.test.ts
index 74e41a030de35d..b2de0b6526d1e7 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_map.test.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_map.test.ts
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-jest.mock('ui/new_platform');
+
 import { savedMap } from './saved_map';
 import { getQueryFilters } from '../../../public/lib/build_embeddable_filters';
 import { ExpressionValueFilter } from '../../../types';
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_search.test.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_search.test.ts
index 9bd32202b563a0..7d5952754aa908 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_search.test.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_search.test.ts
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-jest.mock('ui/new_platform');
+
 import { savedSearch } from './saved_search';
 import { buildEmbeddableFilters } from '../../../public/lib/build_embeddable_filters';
 import { ExpressionValueFilter } from '../../../types';
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_visualization.test.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_visualization.test.ts
index 8327c1433b9af4..a64fb167dd19f0 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_visualization.test.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_visualization.test.ts
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-jest.mock('ui/new_platform');
+
 import { savedVisualization } from './saved_visualization';
 import { getQueryFilters } from '../../../public/lib/build_embeddable_filters';
 import { ExpressionValueFilter } from '../../../types';
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/__snapshots__/image.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/__snapshots__/image.stories.storyshot
new file mode 100644
index 00000000000000..b9bc21dd6e3ea1
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/__snapshots__/image.stories.storyshot
@@ -0,0 +1,14 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Storyshots renderers/image default 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "400px",
+    }
+  }
+>
+   
+</div>
+`;
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/__snapshots__/repeat_image.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/__snapshots__/repeat_image.stories.storyshot
new file mode 100644
index 00000000000000..9b97ae1fdacb32
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/__snapshots__/repeat_image.stories.storyshot
@@ -0,0 +1,14 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Storyshots renderers/repeatImage default 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "400px",
+    }
+  }
+>
+   
+</div>
+`;
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/__snapshots__/table.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/__snapshots__/table.stories.storyshot
new file mode 100644
index 00000000000000..cf9cc6dd82f7f8
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/__snapshots__/table.stories.storyshot
@@ -0,0 +1,14 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Storyshots renderers/table default 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "400px",
+    }
+  }
+>
+   
+</div>
+`;
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/image.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/image.stories.tsx
new file mode 100644
index 00000000000000..bcd83650344480
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/image.stories.tsx
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { image } from '../image';
+import { Render } from './render';
+import { elasticLogo } from '../../lib/elastic_logo';
+
+storiesOf('renderers/image', module).add('default', () => {
+  const config = {
+    type: 'image' as 'image',
+    mode: 'cover',
+    dataurl: elasticLogo,
+  };
+
+  return <Render renderer={image} config={config} width="400px" />;
+});
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/render.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/render.tsx
new file mode 100644
index 00000000000000..647c63c2c10427
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/render.tsx
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { action } from '@storybook/addon-actions';
+import React, { useRef, useEffect } from 'react';
+import { RendererFactory, RendererHandlers } from '../../../types';
+
+export const defaultHandlers: RendererHandlers = {
+  destroy: () => action('destroy'),
+  getElementId: () => 'element-id',
+  getFilter: () => 'filter',
+  onComplete: (fn) => undefined,
+  onEmbeddableDestroyed: action('onEmbeddableDestroyed'),
+  onEmbeddableInputChange: action('onEmbeddableInputChange'),
+  onResize: action('onResize'),
+  resize: action('resize'),
+  setFilter: action('setFilter'),
+  done: action('done'),
+  onDestroy: action('onDestroy'),
+  reload: action('reload'),
+  update: action('update'),
+  event: action('event'),
+};
+
+/*
+  Uses a RenderDefinitionFactory and Config to render into an element.
+
+  Intended to be used for stories for RenderDefinitionFactory
+*/
+interface RenderAdditionalProps {
+  height?: string;
+  width?: string;
+  handlers?: RendererHandlers;
+}
+
+export const Render = <Renderer,>({
+  renderer,
+  config,
+  ...rest
+}: Renderer extends RendererFactory<infer Config>
+  ? { renderer: Renderer; config: Config } & RenderAdditionalProps
+  : { renderer: undefined; config: undefined } & RenderAdditionalProps) => {
+  const { height, width, handlers } = {
+    height: '200px',
+    width: '200px',
+    handlers: defaultHandlers,
+    ...rest,
+  };
+
+  const containerRef = useRef<HTMLDivElement | null>(null);
+
+  useEffect(() => {
+    if (renderer && containerRef.current !== null) {
+      renderer().render(containerRef.current, config, handlers);
+    }
+  }, [renderer, config, handlers]);
+
+  return (
+    <div style={{ width, height }} ref={containerRef}>
+      {' '}
+    </div>
+  );
+};
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/repeat_image.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/repeat_image.stories.tsx
new file mode 100644
index 00000000000000..41ccc054a77fbd
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/repeat_image.stories.tsx
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { repeatImage } from '../repeat_image';
+import { Render } from './render';
+import { elasticLogo } from '../../lib/elastic_logo';
+import { elasticOutline } from '../../lib/elastic_outline';
+
+storiesOf('renderers/repeatImage', module).add('default', () => {
+  const config = {
+    count: 42,
+    image: elasticLogo,
+    size: 20,
+    max: 60,
+    emptyImage: elasticOutline,
+  };
+
+  return <Render renderer={repeatImage} config={config} width="400px" />;
+});
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/table.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/table.stories.tsx
new file mode 100644
index 00000000000000..f3c70cb30de454
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/__stories__/table.stories.tsx
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { table } from '../table';
+import { Render } from './render';
+
+storiesOf('renderers/table', module).add('default', () => {
+  const config = {
+    paginate: true,
+    perPage: 5,
+    showHeader: true,
+    datatable: {
+      type: 'datatable' as 'datatable',
+      columns: [
+        {
+          name: 'Foo',
+          type: 'string' as 'string',
+          id: 'id-foo',
+          meta: { type: 'string' as 'string' },
+        },
+        {
+          name: 'Bar',
+          type: 'number' as 'number',
+          id: 'id-bar',
+          meta: { type: 'string' as 'string' },
+        },
+      ],
+      rows: [
+        { Foo: 'a', Bar: 700 },
+        { Foo: 'b', Bar: 600 },
+        { Foo: 'c', Bar: 500 },
+        { Foo: 'd', Bar: 400 },
+        { Foo: 'e', Bar: 300 },
+        { Foo: 'f', Bar: 200 },
+        { Foo: 'g', Bar: 100 },
+      ],
+    },
+  };
+
+  return <Render renderer={table} config={config} width="400px" />;
+});
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/error/__stories__/__snapshots__/error.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/error/__stories__/__snapshots__/error.stories.storyshot
new file mode 100644
index 00000000000000..b7039ee1847c74
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/error/__stories__/__snapshots__/error.stories.storyshot
@@ -0,0 +1,14 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Storyshots renderers/error default 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "200px",
+    }
+  }
+>
+   
+</div>
+`;
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/error/__stories__/error.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/error/__stories__/error.stories.tsx
new file mode 100644
index 00000000000000..c71999bc04bb1c
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/error/__stories__/error.stories.tsx
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { error } from '../';
+import { Render } from '../../__stories__/render';
+
+storiesOf('renderers/error', module).add('default', () => {
+  const thrownError = new Error('There was an error');
+  const config = {
+    error: thrownError,
+  };
+  return <Render renderer={error} config={config} />;
+});
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/markdown/__stories__/__snapshots__/markdown.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/markdown/__stories__/__snapshots__/markdown.stories.storyshot
new file mode 100644
index 00000000000000..79f447c953d6d1
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/markdown/__stories__/__snapshots__/markdown.stories.storyshot
@@ -0,0 +1,27 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Storyshots renderers/markdown default 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "200px",
+    }
+  }
+>
+   
+</div>
+`;
+
+exports[`Storyshots renderers/markdown links in new tab 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "200px",
+    }
+  }
+>
+   
+</div>
+`;
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/markdown/__stories__/markdown.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/markdown/__stories__/markdown.stories.tsx
new file mode 100644
index 00000000000000..d5b190c74a92fd
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/markdown/__stories__/markdown.stories.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { markdown } from '../';
+import { Render } from '../../__stories__/render';
+
+storiesOf('renderers/markdown', module)
+  .add('default', () => {
+    const config = {
+      content: '# This is Markdown',
+      font: {
+        css: '',
+        spec: {},
+        type: 'style' as 'style',
+      },
+      openLinksInNewTab: false,
+    };
+    return <Render renderer={markdown} config={config} />;
+  })
+  .add('links in new tab', () => {
+    const config = {
+      content: '[Elastic.co](https://elastic.co)',
+      font: {
+        css: '',
+        spec: {},
+        type: 'style' as 'style',
+      },
+      openLinksInNewTab: true,
+    };
+    return <Render renderer={markdown} config={config} />;
+  });
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/pie/__stories__/__snapshots__/pie.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/pie/__stories__/__snapshots__/pie.stories.storyshot
new file mode 100644
index 00000000000000..3260dbe8c83c27
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/pie/__stories__/__snapshots__/pie.stories.storyshot
@@ -0,0 +1,27 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Storyshots renderers/pie default 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "200px",
+    }
+  }
+>
+   
+</div>
+`;
+
+exports[`Storyshots renderers/pie with legend 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "200px",
+    }
+  }
+>
+   
+</div>
+`;
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/pie/__stories__/pie.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/pie/__stories__/pie.stories.tsx
new file mode 100644
index 00000000000000..dea2876de0ec8a
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/pie/__stories__/pie.stories.tsx
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { pie } from '../';
+import { Render } from '../../__stories__/render';
+
+const pieOptions = {
+  canvas: false,
+  colors: ['#882E72', '#B178A6', '#D6C1DE'],
+  grid: { show: false },
+  legend: { show: false },
+  series: {
+    pie: {
+      show: true,
+      innerRadius: 0,
+      label: { show: true, radius: 1 },
+      radius: 'auto' as 'auto',
+      stroke: { width: 0 },
+      tilt: 1,
+    },
+  },
+};
+
+const data = [
+  {
+    data: [10],
+    label: 'A',
+  },
+  {
+    data: [10],
+    label: 'B',
+  },
+  {
+    data: [10],
+    label: 'C',
+  },
+];
+
+storiesOf('renderers/pie', module)
+  .add('default', () => {
+    const config = {
+      data,
+      options: pieOptions,
+      font: {
+        css: '',
+        spec: {},
+        type: 'style' as 'style',
+      },
+    };
+    return <Render renderer={pie} config={config} />;
+  })
+  .add('with legend', () => {
+    const options = {
+      ...pieOptions,
+      legend: { show: true },
+    };
+
+    const config = {
+      data,
+      options,
+      font: {
+        css: '',
+        spec: {},
+        type: 'style' as 'style',
+      },
+    };
+
+    return <Render renderer={pie} config={config} />;
+  });
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/plot/__stories__/__snapshots__/plot.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/plot/__stories__/__snapshots__/plot.stories.storyshot
new file mode 100644
index 00000000000000..7419d13fc7195b
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/plot/__stories__/__snapshots__/plot.stories.storyshot
@@ -0,0 +1,14 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Storyshots renderers/plot default 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "200px",
+    }
+  }
+>
+   
+</div>
+`;
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/plot/__stories__/plot.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/plot/__stories__/plot.stories.tsx
new file mode 100644
index 00000000000000..0e9566d2a5c20c
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/plot/__stories__/plot.stories.tsx
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { plot } from '../';
+import { Render } from '../../__stories__/render';
+
+const plotOptions = {
+  canvas: false,
+  colors: ['#882E72', '#B178A6', '#D6C1DE'],
+  grid: {
+    margin: {
+      bottom: 0,
+      left: 0,
+      right: 30,
+      top: 20,
+    },
+  },
+  legend: { show: true },
+  series: {
+    bubbles: {
+      show: true,
+      fill: false,
+    },
+  },
+  xaxis: {
+    show: true,
+    mode: 'time',
+  },
+  yaxis: {
+    show: true,
+  },
+};
+
+const data = [
+  {
+    bubbles: { show: true },
+    data: [
+      [1546351551031, 33, { size: 5 }],
+      [1546351551131, 38, { size: 2 }],
+    ],
+    label: 'done',
+  },
+  {
+    bubbles: { show: true },
+    data: [
+      [1546351551032, 37, { size: 4 }],
+      [1546351551139, 45, { size: 3 }],
+    ],
+    label: 'running',
+  },
+];
+
+storiesOf('renderers/plot', module).add('default', () => {
+  const config = {
+    data,
+    options: plotOptions,
+    font: {
+      css: '',
+      spec: {},
+      type: 'style' as 'style',
+    },
+  };
+  return <Render renderer={plot} config={config} />;
+});
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/progress/__stories__/__snapshots__/progress.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/progress/__stories__/__snapshots__/progress.stories.storyshot
new file mode 100644
index 00000000000000..1fe884656ef3b4
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/progress/__stories__/__snapshots__/progress.stories.storyshot
@@ -0,0 +1,14 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Storyshots renderers/progress default 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "200px",
+    }
+  }
+>
+   
+</div>
+`;
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/progress/__stories__/progress.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/progress/__stories__/progress.stories.tsx
new file mode 100644
index 00000000000000..3e20cfd4772a80
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/progress/__stories__/progress.stories.tsx
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { progress } from '../';
+import { Render } from '../../__stories__/render';
+import { Shape } from '../../../functions/common/progress';
+
+storiesOf('renderers/progress', module).add('default', () => {
+  const config = {
+    barColor: '#bc1234',
+    barWeight: 20,
+    font: {
+      css: '',
+      spec: {},
+      type: 'style' as 'style',
+    },
+    label: '66%',
+    max: 1,
+    shape: Shape.UNICORN,
+    value: 0.66,
+    valueColor: '#000',
+    valueWeight: 15,
+  };
+
+  return <Render renderer={progress} config={config} />;
+});
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/reveal_image/__stories__/__snapshots__/reveal_image.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/reveal_image/__stories__/__snapshots__/reveal_image.stories.storyshot
new file mode 100644
index 00000000000000..b9963565a09f58
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/reveal_image/__stories__/__snapshots__/reveal_image.stories.storyshot
@@ -0,0 +1,14 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Storyshots renderers/revealImage default 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "200px",
+    }
+  }
+>
+   
+</div>
+`;
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/reveal_image/__stories__/reveal_image.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/reveal_image/__stories__/reveal_image.stories.tsx
new file mode 100644
index 00000000000000..637f9a2bb6986e
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/reveal_image/__stories__/reveal_image.stories.tsx
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { revealImage } from '../';
+import { Render } from '../../__stories__/render';
+import { elasticOutline } from '../../../lib/elastic_outline';
+import { elasticLogo } from '../../../lib/elastic_logo';
+import { Origin } from '../../../functions/common/revealImage';
+
+storiesOf('renderers/revealImage', module).add('default', () => {
+  const config = {
+    image: elasticLogo,
+    emptyImage: elasticOutline,
+    origin: Origin.LEFT,
+    percent: 0.45,
+  };
+
+  return <Render renderer={revealImage} config={config} />;
+});
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/shape/__stories__/__snapshots__/shape.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/shape/__stories__/__snapshots__/shape.stories.storyshot
new file mode 100644
index 00000000000000..317c20021015af
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/shape/__stories__/__snapshots__/shape.stories.storyshot
@@ -0,0 +1,14 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Storyshots renderers/shape default 1`] = `
+<div
+  style={
+    Object {
+      "height": "200px",
+      "width": "200px",
+    }
+  }
+>
+   
+</div>
+`;
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/shape/__stories__/shape.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/shape/__stories__/shape.stories.tsx
new file mode 100644
index 00000000000000..19df14c08688f5
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/shape/__stories__/shape.stories.tsx
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { shape } from '../';
+import { Render } from '../../__stories__/render';
+import { Shape } from '../../../functions/common/shape';
+
+storiesOf('renderers/shape', module).add('default', () => {
+  const config = {
+    type: 'shape' as 'shape',
+    border: '#FFEEDD',
+    borderWidth: 8,
+    shape: Shape.BOOKMARK,
+    fill: '#112233',
+    maintainAspect: true,
+  };
+
+  return <Render renderer={shape} config={config} />;
+});
diff --git a/x-pack/plugins/canvas/common/lib/autocomplete.test.ts b/x-pack/plugins/canvas/common/lib/autocomplete.test.ts
index f7a773f6ca36a2..777810cad05ba6 100644
--- a/x-pack/plugins/canvas/common/lib/autocomplete.test.ts
+++ b/x-pack/plugins/canvas/common/lib/autocomplete.test.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-jest.mock('ui/new_platform');
 import { functionSpecs } from '../../__tests__/fixtures/function_specs';
 
 import {
diff --git a/x-pack/plugins/canvas/public/__tests__/setup.js b/x-pack/plugins/canvas/public/__tests__/setup.js
deleted file mode 100644
index 1792397d0614ee..00000000000000
--- a/x-pack/plugins/canvas/public/__tests__/setup.js
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import enzyme from 'enzyme';
-import Adapter from 'enzyme-adapter-react-16';
-
-// this will run before any code that's inside a describe block
-// so we can use it to set up whatever we need for our browser tests
-before(() => {
-  // configure enzume
-  enzyme.configure({ adapter: new Adapter() });
-});
diff --git a/x-pack/plugins/canvas/public/apps/workpad/workpad_app/workpad_telemetry.test.tsx b/x-pack/plugins/canvas/public/apps/workpad/workpad_app/workpad_telemetry.test.tsx
index e8b772e0f2fbd8..b037d30ada12f6 100644
--- a/x-pack/plugins/canvas/public/apps/workpad/workpad_app/workpad_telemetry.test.tsx
+++ b/x-pack/plugins/canvas/public/apps/workpad/workpad_app/workpad_telemetry.test.tsx
@@ -14,7 +14,6 @@ import {
 import { METRIC_TYPE } from '../../../lib/ui_metric';
 import { ResolvedArgType } from '../../../../types';
 
-jest.mock('ui/new_platform');
 const trackMetric = jest.fn();
 const Component = withUnconnectedElementsLoadedTelemetry(() => <div />, trackMetric);
 
diff --git a/x-pack/plugins/canvas/public/lib/aeroelastic/__fixtures__/typescript/typespec_tests.ts b/x-pack/plugins/canvas/public/lib/aeroelastic/__fixtures__/typescript/typespec_tests.ts
deleted file mode 100644
index cb46a3d6be4025..00000000000000
--- a/x-pack/plugins/canvas/public/lib/aeroelastic/__fixtures__/typescript/typespec_tests.ts
+++ /dev/null
@@ -1,218 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { select } from '../../select';
-import { Json, Selector, Vector2d, Vector3d, TransformMatrix2d, TransformMatrix3d } from '../..';
-import {
-  mvMultiply as mult2d,
-  ORIGIN as UNIT2D,
-  UNITMATRIX as UNITMATRIX2D,
-  add as add2d,
-} from '../../matrix2d';
-import {
-  mvMultiply as mult3d,
-  ORIGIN as UNIT3D,
-  NANMATRIX as NANMATRIX3D,
-  add as add3d,
-} from '../../matrix';
-
-/*
-
-  Type checking isn't too useful if future commits can accidentally weaken the type constraints, because a
-  TypeScript linter will not complain - everything that passed before will continue to pass. The coder
-  will not have feedback that the original intent with the typing got compromised. To declare the intent
-  via passing and failing type checks, test cases are needed, some of which designed to expect a TS pass,
-  some of them to expect a TS complaint. It documents intent for peers too, as type specs are a tough read.
-
-  Run compile-time type specification tests in the `kibana` root with:
-
-     yarn typespec
-
-  Test "cases" expecting to pass TS checks are not annotated, while ones we want TS to complain about
-  are prepended with the comment
- 
-  // typings:expect-error
-
-  The test "suite" and "cases" are wrapped in IIFEs to prevent linters from complaining about the unused
-  binding. It can be structured internally as desired.
-  
-*/
-
-((): void => {
-  /**
-   * TYPE TEST SUITE
-   */
-
-  (function vectorArrayCreationTests(vec2d: Vector2d, vec3d: Vector3d): void {
-    // 2D vector OK
-    vec2d = [0, 0, 0] as Vector2d; // OK
-    vec2d = [-0, NaN, -Infinity] as Vector2d; // IEEE 754 values are OK
-
-    // 3D vector OK
-    vec3d = [0, 0, 0, 0] as Vector3d;
-    vec3d = [100, -0, Infinity, NaN] as Vector3d;
-
-    // 2D vector not OK
-
-    // typings:expect-error
-    vec2d = 3; // not even an array
-    // typings:expect-error
-    vec2d = [] as Vector2d; // no elements
-    // typings:expect-error
-    vec2d = [0, 0] as Vector2d; // too few elements
-    // typings:expect-error
-    vec2d = [0, 0, 0, 0] as Vector2d; // too many elements
-
-    // 3D vector not OK
-
-    // typings:expect-error
-    vec3d = 3; // not even an array
-    // typings:expect-error
-    vec3d = [] as Vector3d; // no elements
-    // typings:expect-error
-    vec3d = [0, 0, 0] as Vector3d; // too few elements
-    // typings:expect-error
-    vec3d = [0, 0, 0, 0, 0] as Vector3d; // too many elements
-
-    return; // arrayCreationTests
-  })(UNIT2D, UNIT3D);
-
-  (function matrixArrayCreationTests(mat2d: TransformMatrix2d, mat3d: TransformMatrix3d): void {
-    // 2D matrix OK
-    mat2d = [0, 1, 2, 3, 4, 5, 6, 7, 8] as TransformMatrix2d; // OK
-    mat2d = [-0, NaN, -Infinity, 3, 4, 5, 6, 7, 8] as TransformMatrix2d; // IEEE 754 values are OK
-
-    // 3D matrix OK
-    mat3d = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15] as TransformMatrix3d;
-    mat3d = [100, -0, Infinity, NaN, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15] as TransformMatrix3d;
-
-    // 2D matrix not OK
-
-    // typings:expect-error
-    mat2d = 3; // not even an array
-    // typings:expect-error
-    mat2d = [] as TransformMatrix2d; // no elements
-    // typings:expect-error
-    mat2d = [0, 1, 2, 3, 4, 5, 6, 7] as TransformMatrix2d; // too few elements
-    // typings:expect-error
-    mat2d = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9] as TransformMatrix2d; // too many elements
-
-    // 3D vector not OK
-
-    // typings:expect-error
-    mat3d = 3; // not even an array
-    // typings:expect-error
-    mat3d = [] as TransformMatrix3d; // no elements
-    // typings:expect-error
-    mat3d = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14] as TransformMatrix3d; // too few elements
-    // typings:expect-error
-    mat3d = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16] as TransformMatrix3d; // too many elements
-
-    // Matrix modification should NOT be OK
-    mat3d[3] = 100; // too bad the ReadOnly part appears not to be enforced so can't precede it with typings:expect-error
-
-    return; // arrayCreationTests
-  })(UNITMATRIX2D, NANMATRIX3D);
-
-  (function matrixMatrixAdditionTests(mat2d: TransformMatrix2d, mat3d: TransformMatrix3d): void {
-    add2d(mat2d, mat2d); // OK
-    add3d(mat3d, mat3d); // OK
-
-    // typings:expect-error
-    add2d(mat2d, mat3d); // at least one arg doesn't comply
-    // typings:expect-error
-    add2d(mat3d, mat2d); // at least one arg doesn't comply
-    // typings:expect-error
-    add2d(mat3d, mat3d); // at least one arg doesn't comply
-    // typings:expect-error
-    add3d(mat2d, mat3d); // at least one arg doesn't comply
-    // typings:expect-error
-    add3d(mat3d, mat2d); // at least one arg doesn't comply
-    // typings:expect-error
-    add3d(mat2d, mat2d); // at least one arg doesn't comply
-
-    return; // matrixMatrixAdditionTests
-  })(UNITMATRIX2D, NANMATRIX3D);
-
-  (function matrixVectorMultiplicationTests(
-    vec2d: Vector2d,
-    mat2d: TransformMatrix2d,
-    vec3d: Vector3d,
-    mat3d: TransformMatrix3d
-  ): void {
-    mult2d(mat2d, vec2d); // OK
-    mult3d(mat3d, vec3d); // OK
-
-    // typings:expect-error
-    mult3d(mat2d, vec2d); // trying to use a 3d fun for 2d args
-    // typings:expect-error
-    mult2d(mat3d, vec3d); // trying to use a 2d fun for 3d args
-
-    // typings:expect-error
-    mult2d(mat3d, vec2d); // 1st arg is a mismatch
-    // typings:expect-error
-    mult2d(mat2d, vec3d); // 2nd arg is a mismatch
-
-    // typings:expect-error
-    mult3d(mat2d, vec3d); // 1st arg is a mismatch
-    // typings:expect-error
-    mult3d(mat3d, vec2d); // 2nd arg is a mismatch
-
-    return; // matrixVectorTests
-  })(UNIT2D, UNITMATRIX2D, UNIT3D, NANMATRIX3D);
-
-  (function jsonTests(plain: Json): void {
-    // numbers are OK
-    plain = 1;
-    plain = NaN;
-    plain = Infinity;
-    plain = -Infinity;
-    plain = Math.pow(2, 6);
-    // other JSON primitive types are OK
-    plain = false;
-    plain = 'hello';
-    plain = null;
-    // structures made of above and of structures are OK
-    plain = {};
-    plain = [];
-    plain = { a: 1 };
-    plain = [0, null, false, NaN, 3.14, 'one more'];
-    plain = { a: { b: 5, c: { d: [1, 'a', -Infinity, null], e: -1 }, f: 'b' }, g: false };
-
-    // typings:expect-error
-    plain = undefined; // it's undefined
-    // typings:expect-error
-    plain = (a) => a; // it's a function
-    // typings:expect-error
-    plain = [new Date()]; // it's a time
-    // typings:expect-error
-    plain = { a: Symbol('haha') }; // symbol isn't permitted either
-    // typings:expect-error
-    plain = window || void 0;
-    // typings:expect-error
-    plain = { a: { b: 5, c: { d: [1, 'a', undefined, null] } } }; // going deep into the structure
-
-    return; // jsonTests
-  })(null);
-
-  (function selectTests(selector: Selector): void {
-    selector = select((a: Json) => a); // one arg
-    selector = select((a: Json, b: Json): Json => `${a} and ${b}`); // more args
-    selector = select(() => 1); // zero arg
-    selector = select((...args: Json[]) => args); // variadic
-
-    // typings:expect-error
-    selector = (a: Json) => a; // not a selector
-    // typings:expect-error
-    selector = select(() => {}); // should yield a JSON value, but it returns void
-    // typings:expect-error
-    selector = select((x: Json) => ({ a: x, b: undefined })); // should return a Json
-
-    return; // selectTests
-  })(select((a: Json) => a));
-
-  return; // test suite
-})();
diff --git a/x-pack/plugins/canvas/public/lib/aeroelastic/tsconfig.json b/x-pack/plugins/canvas/public/lib/aeroelastic/tsconfig.json
deleted file mode 100644
index 3b61e4b414626c..00000000000000
--- a/x-pack/plugins/canvas/public/lib/aeroelastic/tsconfig.json
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  "extends": "../../../../../tsconfig",
-  "compilerOptions": {
-    "module": "commonjs",
-    "lib": ["es2018", "dom"],
-    "noImplicitAny": true,
-    "strictNullChecks": true,
-    "strictFunctionTypes": false,
-    "strictPropertyInitialization": true,
-    "noImplicitThis": true,
-    "noImplicitReturns": true,
-    "forceConsistentCasingInFileNames": true,
-    "noEmit": true,
-    "baseUrl": ".",
-    "paths": {
-      "layout/*": ["aeroelastic/*"]
-    },
-    "types": ["@kbn/x-pack/plugins/canvas/public/lib/aeroelastic"]
-  },
-  "exclude": ["node_modules", "**/*.spec.ts", "node_modules/@types/mocha"]
-}
diff --git a/x-pack/plugins/canvas/public/lib/aeroelastic/typespec.test.ts b/x-pack/plugins/canvas/public/lib/aeroelastic/typespec.test.ts
new file mode 100644
index 00000000000000..3b1fde12edcc48
--- /dev/null
+++ b/x-pack/plugins/canvas/public/lib/aeroelastic/typespec.test.ts
@@ -0,0 +1,228 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { select } from './select';
+import { Json, Selector, Vector2d, Vector3d, TransformMatrix2d, TransformMatrix3d } from './index';
+import {
+  mvMultiply as mult2d,
+  ORIGIN as UNIT2D,
+  UNITMATRIX as UNITMATRIX2D,
+  add as add2d,
+} from './matrix2d';
+import {
+  mvMultiply as mult3d,
+  ORIGIN as UNIT3D,
+  NANMATRIX as NANMATRIX3D,
+  add as add3d,
+} from './matrix';
+
+// helper to mark variables as "used" so they don't trigger errors
+const use = (...vars: any[]) => vars.includes(null);
+
+/*
+  Type checking isn't too useful if future commits can accidentally weaken the type constraints, because a
+  TypeScript linter will not complain - everything that passed before will continue to pass. The coder
+  will not have feedback that the original intent with the typing got compromised. To declare the intent
+  via passing and failing type checks, test cases are needed, some of which designed to expect a TS pass,
+  some of them to expect a TS complaint. It documents intent for peers too, as type specs are a tough read.
+
+  Test "cases" expecting to pass TS checks are not annotated, while ones we want TS to complain about
+  are prepended with the comment
+
+  // @ts-expect-error
+
+  The test "suite" and "cases" are wrapped in IIFEs to prevent linters from complaining about the unused
+  binding. It can be structured internally as desired.
+*/
+
+describe('vector array creation', () => {
+  it('passes typechecking', () => {
+    let vec2d: Vector2d = UNIT2D;
+    let vec3d: Vector3d = UNIT3D;
+
+    use(vec2d, vec3d);
+
+    // 2D vector OK
+    vec2d = [0, 0, 0] as Vector2d; // OK
+    vec2d = [-0, NaN, -Infinity] as Vector2d; // IEEE 754 values are OK
+
+    // 3D vector OK
+    vec3d = [0, 0, 0, 0] as Vector3d;
+    vec3d = [100, -0, Infinity, NaN] as Vector3d;
+
+    // 2D vector not OK
+
+    // @ts-expect-error
+    vec2d = 3; // not even an array
+    // @ts-expect-error
+    vec2d = [] as Vector2d; // no elements
+    // @ts-expect-error
+    vec2d = [0, 0] as Vector2d; // too few elements
+    // @ts-expect-error
+    vec2d = [0, 0, 0, 0] as Vector2d; // too many elements
+
+    // 3D vector not OK
+
+    // @ts-expect-error
+    vec3d = 3; // not even an array
+    // @ts-expect-error
+    vec3d = [] as Vector3d; // no elements
+    // @ts-expect-error
+    vec3d = [0, 0, 0] as Vector3d; // too few elements
+    // @ts-expect-error
+    vec3d = [0, 0, 0, 0, 0] as Vector3d; // too many elements
+  });
+});
+
+describe('matrix array creation', () => {
+  it('passes typechecking', () => {
+    let mat2d: TransformMatrix2d = UNITMATRIX2D;
+    let mat3d: TransformMatrix3d = NANMATRIX3D;
+
+    use(mat2d, mat3d);
+
+    // 2D matrix OK
+    mat2d = [0, 1, 2, 3, 4, 5, 6, 7, 8] as TransformMatrix2d; // OK
+    mat2d = [-0, NaN, -Infinity, 3, 4, 5, 6, 7, 8] as TransformMatrix2d; // IEEE 754 values are OK
+
+    // 3D matrix OK
+    mat3d = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15] as TransformMatrix3d;
+    mat3d = [100, -0, Infinity, NaN, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15] as TransformMatrix3d;
+
+    // 2D matrix not OK
+
+    // @ts-expect-error
+    mat2d = 3; // not even an array
+    // @ts-expect-error
+    mat2d = [] as TransformMatrix2d; // no elements
+    // @ts-expect-error
+    mat2d = [0, 1, 2, 3, 4, 5, 6, 7] as TransformMatrix2d; // too few elements
+    // @ts-expect-error
+    mat2d = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9] as TransformMatrix2d; // too many elements
+
+    // 3D vector not OK
+
+    // @ts-expect-error
+    mat3d = 3; // not even an array
+    // @ts-expect-error
+    mat3d = [] as TransformMatrix3d; // no elements
+    // @ts-expect-error
+    mat3d = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14] as TransformMatrix3d; // too few elements
+    // @ts-expect-error
+    mat3d = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16] as TransformMatrix3d; // too many elements
+
+    // @ts-expect-error
+    mat3d[3] = 100; // Matrix modification is NOT OK
+  });
+});
+
+describe('matrix addition', () => {
+  it('passes typecheck', () => {
+    const mat2d: TransformMatrix2d = UNITMATRIX2D;
+    const mat3d: TransformMatrix3d = NANMATRIX3D;
+
+    add2d(mat2d, mat2d); // OK
+    add3d(mat3d, mat3d); // OK
+
+    // @ts-expect-error
+    add2d(mat2d, mat3d); // at least one arg doesn't comply
+    // @ts-expect-error
+    add2d(mat3d, mat2d); // at least one arg doesn't comply
+    // @ts-expect-error
+    add2d(mat3d, mat3d); // at least one arg doesn't comply
+    // @ts-expect-error
+    add3d(mat2d, mat3d); // at least one arg doesn't comply
+    // @ts-expect-error
+    add3d(mat3d, mat2d); // at least one arg doesn't comply
+    // @ts-expect-error
+    add3d(mat2d, mat2d); // at least one arg doesn't comply
+  });
+});
+
+describe('matric vector multiplication', () => {
+  it('passes typecheck', () => {
+    const vec2d: Vector2d = UNIT2D;
+    const mat2d: TransformMatrix2d = UNITMATRIX2D;
+    const vec3d: Vector3d = UNIT3D;
+    const mat3d: TransformMatrix3d = NANMATRIX3D;
+
+    mult2d(mat2d, vec2d); // OK
+    mult3d(mat3d, vec3d); // OK
+
+    // @ts-expect-error
+    mult3d(mat2d, vec2d); // trying to use a 3d fun for 2d args
+    // @ts-expect-error
+    mult2d(mat3d, vec3d); // trying to use a 2d fun for 3d args
+
+    // @ts-expect-error
+    mult2d(mat3d, vec2d); // 1st arg is a mismatch
+    // @ts-expect-error
+    mult2d(mat2d, vec3d); // 2nd arg is a mismatch
+
+    // @ts-expect-error
+    mult3d(mat2d, vec3d); // 1st arg is a mismatch
+    // @ts-expect-error
+    mult3d(mat3d, vec2d); // 2nd arg is a mismatch
+  });
+});
+
+describe('json', () => {
+  it('passes typecheck', () => {
+    let plain: Json = null;
+
+    use(plain);
+
+    // numbers are OK
+    plain = 1;
+    plain = NaN;
+    plain = Infinity;
+    plain = -Infinity;
+    plain = Math.pow(2, 6);
+    // other JSON primitive types are OK
+    plain = false;
+    plain = 'hello';
+    plain = null;
+    // structures made of above and of structures are OK
+    plain = {};
+    plain = [];
+    plain = { a: 1 };
+    plain = [0, null, false, NaN, 3.14, 'one more'];
+    plain = { a: { b: 5, c: { d: [1, 'a', -Infinity, null], e: -1 }, f: 'b' }, g: false };
+
+    // @ts-expect-error
+    plain = undefined; // it's undefined
+    // @ts-expect-error
+    plain = (a) => a; // it's a function
+    // @ts-expect-error
+    plain = [new Date()]; // it's a time
+    // @ts-expect-error
+    plain = { a: Symbol('haha') }; // symbol isn't permitted either
+    // @ts-expect-error
+    plain = window || void 0;
+    // @ts-expect-error
+    plain = { a: { b: 5, c: { d: [1, 'a', undefined, null] } } }; // going deep into the structure
+  });
+});
+
+describe('select', () => {
+  it('passes typecheck', () => {
+    let selector: Selector;
+
+    selector = select((a: Json) => a); // one arg
+    selector = select((a: Json, b: Json): Json => `${a} and ${b}`); // more args
+    selector = select(() => 1); // zero arg
+    selector = select((...args: Json[]) => args); // variadic
+
+    // @ts-expect-error
+    selector = (a: Json) => a; // not a selector
+    // @ts-expect-error
+    selector = select(() => {}); // should yield a JSON value, but it returns void
+    // @ts-expect-error
+    selector = select((x: Json) => ({ a: x, b: undefined })); // should return a Json
+
+    use(selector);
+  });
+});
diff --git a/x-pack/plugins/canvas/public/state/middleware/__tests__/workpad_refresh.test.ts b/x-pack/plugins/canvas/public/state/middleware/__tests__/workpad_refresh.test.ts
index bf69a862d5c300..e451a39df06db4 100644
--- a/x-pack/plugins/canvas/public/state/middleware/__tests__/workpad_refresh.test.ts
+++ b/x-pack/plugins/canvas/public/state/middleware/__tests__/workpad_refresh.test.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-jest.mock('ui/new_platform'); // actions/elements has some dependencies on ui/new_platform.
 jest.mock('../../../lib/app_state');
 
 import { workpadRefresh } from '../workpad_refresh';
diff --git a/x-pack/plugins/canvas/public/state/reducers/embeddables.test.ts b/x-pack/plugins/canvas/public/state/reducers/embeddables.test.ts
index 5b1192630897a2..08b59e5fedc440 100644
--- a/x-pack/plugins/canvas/public/state/reducers/embeddables.test.ts
+++ b/x-pack/plugins/canvas/public/state/reducers/embeddables.test.ts
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-jest.mock('ui/new_platform');
+
 import { State } from '../../../types';
 import { updateEmbeddableExpression } from '../actions/embeddable';
 import { embeddableReducer } from './embeddable';
diff --git a/x-pack/plugins/canvas/server/collectors/workpad_collector.test.ts b/x-pack/plugins/canvas/server/collectors/workpad_collector.test.ts
index 9f71edcc05bf26..32665cc42dc4e7 100644
--- a/x-pack/plugins/canvas/server/collectors/workpad_collector.test.ts
+++ b/x-pack/plugins/canvas/server/collectors/workpad_collector.test.ts
@@ -49,6 +49,14 @@ describe('usage collector handle es response data', () => {
           'shape',
         ],
       },
+      variables: {
+        total: 7,
+        per_workpad: {
+          avg: 1.1666666666666667,
+          min: 0,
+          max: 3,
+        },
+      },
     });
   });
 
@@ -63,6 +71,7 @@ describe('usage collector handle es response data', () => {
       pages: { total: 1, per_workpad: { avg: 1, min: 1, max: 1 } },
       elements: { total: 1, per_page: { avg: 1, min: 1, max: 1 } },
       functions: { total: 1, in_use: ['toast'], per_element: { avg: 1, min: 1, max: 1 } },
+      variables: { total: 1, per_workpad: { avg: 1, min: 1, max: 1 } },
     });
   });
 
@@ -76,6 +85,39 @@ describe('usage collector handle es response data', () => {
       pages: { total: 0, per_workpad: { avg: 0, min: 0, max: 0 } },
       elements: undefined,
       functions: undefined,
+      variables: { total: 1, per_workpad: { avg: 1, min: 1, max: 1 } }, // Variables still possible even with no pages
+    });
+  });
+
+  it('should handle cases where the version workpad might not have variables', () => {
+    const workpad = cloneDeep(workpads[0]);
+    // @ts-ignore
+    workpad.variables = undefined;
+
+    const mockWorkpadsOld = [workpad];
+    const usage = summarizeWorkpads(mockWorkpadsOld);
+    expect(usage).toEqual({
+      workpads: { total: 1 },
+      pages: { total: 1, per_workpad: { avg: 1, min: 1, max: 1 } },
+      elements: { total: 1, per_page: { avg: 1, min: 1, max: 1 } },
+      functions: {
+        total: 7,
+        in_use: [
+          'demodata',
+          'ply',
+          'rowCount',
+          'as',
+          'staticColumn',
+          'math',
+          'mapColumn',
+          'sort',
+          'pointseries',
+          'plot',
+          'seriesStyle',
+        ],
+        per_element: { avg: 7, min: 7, max: 7 },
+      },
+      variables: { total: 0, per_workpad: { avg: 0, min: 0, max: 0 } }, // Variables still possible even with no pages
     });
   });
 
diff --git a/x-pack/plugins/canvas/server/collectors/workpad_collector.ts b/x-pack/plugins/canvas/server/collectors/workpad_collector.ts
index 4b00d061c17ce2..9fa39c580962de 100644
--- a/x-pack/plugins/canvas/server/collectors/workpad_collector.ts
+++ b/x-pack/plugins/canvas/server/collectors/workpad_collector.ts
@@ -44,6 +44,14 @@ interface WorkpadTelemetry {
       max: number;
     };
   };
+  variables?: {
+    total: number;
+    per_workpad: {
+      avg: number;
+      min: number;
+      max: number;
+    };
+  };
 }
 
 /**
@@ -81,7 +89,10 @@ export function summarizeWorkpads(workpadDocs: CanvasWorkpad[]): WorkpadTelemetr
       });
     }, []);
 
-    return { pages, elementCounts, functionCounts };
+    const variableCount =
+      workpad.variables && workpad.variables.length ? workpad.variables.length : 0;
+
+    return { pages, elementCounts, functionCounts, variableCount };
   });
 
   // combine together info from across the workpads
@@ -91,9 +102,10 @@ export function summarizeWorkpads(workpadDocs: CanvasWorkpad[]): WorkpadTelemetr
     pageCounts: number[];
     elementCounts: number[];
     functionCounts: number[];
+    variableCounts: number[];
   }>(
     (accum, pageInfo) => {
-      const { pages, elementCounts, functionCounts } = pageInfo;
+      const { pages, elementCounts, functionCounts, variableCount } = pageInfo;
 
       return {
         pageMin: pages.count < accum.pageMin ? pages.count : accum.pageMin,
@@ -101,6 +113,7 @@ export function summarizeWorkpads(workpadDocs: CanvasWorkpad[]): WorkpadTelemetr
         pageCounts: accum.pageCounts.concat(pages.count),
         elementCounts: accum.elementCounts.concat(elementCounts),
         functionCounts: accum.functionCounts.concat(functionCounts),
+        variableCounts: accum.variableCounts.concat([variableCount]),
       };
     },
     {
@@ -109,13 +122,23 @@ export function summarizeWorkpads(workpadDocs: CanvasWorkpad[]): WorkpadTelemetr
       pageCounts: [],
       elementCounts: [],
       functionCounts: [],
+      variableCounts: [],
     }
   );
-  const { pageCounts, pageMin, pageMax, elementCounts, functionCounts } = combinedWorkpadsInfo;
+  const {
+    pageCounts,
+    pageMin,
+    pageMax,
+    elementCounts,
+    functionCounts,
+    variableCounts,
+  } = combinedWorkpadsInfo;
 
   const pageTotal = arraySum(pageCounts);
   const elementsTotal = arraySum(elementCounts);
   const functionsTotal = arraySum(functionCounts);
+  const variableTotal = arraySum(variableCounts);
+
   const pagesInfo =
     workpadsInfo.length > 0
       ? {
@@ -151,11 +174,21 @@ export function summarizeWorkpads(workpadDocs: CanvasWorkpad[]): WorkpadTelemetr
         }
       : undefined;
 
+  const variableInfo = {
+    total: variableTotal,
+    per_workpad: {
+      avg: variableTotal / variableCounts.length,
+      min: arrayMin(variableCounts) || 0,
+      max: arrayMax(variableCounts) || 0,
+    },
+  };
+
   return {
     workpads: { total: workpadsInfo.length },
     pages: pagesInfo,
     elements: elementsInfo,
     functions: functionsInfo,
+    variables: variableInfo,
   };
 }
 
diff --git a/x-pack/plugins/canvas/shareable_runtime/components/footer/settings/__tests__/__snapshots__/settings.test.tsx.snap b/x-pack/plugins/canvas/shareable_runtime/components/footer/settings/__tests__/__snapshots__/settings.test.tsx.snap
index 75e132863e47e6..c4917539cbedac 100644
--- a/x-pack/plugins/canvas/shareable_runtime/components/footer/settings/__tests__/__snapshots__/settings.test.tsx.snap
+++ b/x-pack/plugins/canvas/shareable_runtime/components/footer/settings/__tests__/__snapshots__/settings.test.tsx.snap
@@ -6,7 +6,6 @@ exports[`<Settings /> can navigate Autoplay Settings 1`] = `
     data-eui="EuiFocusTrap"
   >
     <div
-      aria-describedby="generated-id"
       aria-live="assertive"
       aria-modal="true"
       class="euiPanel euiPopover__panel euiPopover__panel--top euiPopover__panel-withTitle"
@@ -97,7 +96,6 @@ exports[`<Settings /> can navigate Autoplay Settings 2`] = `
     data-eui="EuiFocusTrap"
   >
     <div
-      aria-describedby="generated-id"
       aria-live="assertive"
       aria-modal="true"
       class="euiPanel euiPopover__panel euiPopover__panel--top euiPopover__panel-isOpen euiPopover__panel-withTitle"
@@ -341,7 +339,6 @@ exports[`<Settings /> can navigate Toolbar Settings, closes when activated 1`] =
     data-eui="EuiFocusTrap"
   >
     <div
-      aria-describedby="generated-id"
       aria-live="assertive"
       aria-modal="true"
       class="euiPanel euiPopover__panel euiPopover__panel--top euiPopover__panel-withTitle"
@@ -432,7 +429,6 @@ exports[`<Settings /> can navigate Toolbar Settings, closes when activated 2`] =
     data-eui="EuiFocusTrap"
   >
     <div
-      aria-describedby="generated-id"
       aria-live="assertive"
       aria-modal="true"
       class="euiPanel euiPopover__panel euiPopover__panel--top euiPopover__panel-isOpen euiPopover__panel-withTitle"
@@ -605,4 +601,4 @@ exports[`<Settings /> can navigate Toolbar Settings, closes when activated 2`] =
 </div>
 `;
 
-exports[`<Settings /> can navigate Toolbar Settings, closes when activated 3`] = `"<div><div data-eui=\\"EuiFocusTrap\\"><div class=\\"euiPanel euiPopover__panel euiPopover__panel--top euiPopover__panel-withTitle\\" aria-live=\\"assertive\\" role=\\"dialog\\" aria-modal=\\"true\\" aria-describedby=\\"generated-id\\" style=\\"top: -16px; left: -22px; z-index: 2000;\\"><div class=\\"euiPopover__panelArrow euiPopover__panelArrow--top\\" style=\\"left: 10px; top: 0px;\\"></div><div><div class=\\"euiContextMenu\\" style=\\"height: 0px;\\"><div class=\\"euiContextMenuPanel euiContextMenu__panel euiContextMenuPanel-txOutLeft\\" tabindex=\\"0\\"><div class=\\"euiPopoverTitle\\"><span class=\\"euiContextMenu__itemLayout\\">Settings</span></div><div><div><button class=\\"euiContextMenuItem\\" type=\\"button\\"><span class=\\"euiContextMenu__itemLayout\\"><div data-euiicon-type=\\"play\\" class=\\"euiContextMenu__icon\\"></div><span class=\\"euiContextMenuItem__text\\">Auto Play</span><div data-euiicon-type=\\"arrowRight\\" class=\\"euiContextMenu__arrow\\"></div></span></button><button class=\\"euiContextMenuItem\\" type=\\"button\\"><span class=\\"euiContextMenu__itemLayout\\"><div data-euiicon-type=\\"boxesHorizontal\\" class=\\"euiContextMenu__icon\\"></div><span class=\\"euiContextMenuItem__text\\">Toolbar</span><div data-euiicon-type=\\"arrowRight\\" class=\\"euiContextMenu__arrow\\"></div></span></button></div></div></div><div class=\\"euiContextMenuPanel euiContextMenu__panel euiContextMenuPanel-txInLeft\\" tabindex=\\"0\\"><button class=\\"euiContextMenuPanelTitle\\" type=\\"button\\" data-test-subj=\\"contextMenuPanelTitleButton\\"><span class=\\"euiContextMenu__itemLayout\\"><div data-euiicon-type=\\"arrowLeft\\" class=\\"euiContextMenu__icon\\"></div><span class=\\"euiContextMenu__text\\">Toolbar</span></span></button><div><div><div style=\\"padding: 16px;\\"><div class=\\"euiFormRow\\" id=\\"generated-id-row\\"><div class=\\"euiFormRow__fieldWrapper\\"><div class=\\"euiSwitch\\"><button id=\\"generated-id\\" aria-checked=\\"true\\" class=\\"euiSwitch__button\\" role=\\"switch\\" type=\\"button\\" aria-labelledby=\\"generated-id\\" data-test-subj=\\"hideToolbarSwitch\\" name=\\"toolbarHide\\" aria-describedby=\\"generated-id-help\\"><span class=\\"euiSwitch__body\\"><span class=\\"euiSwitch__thumb\\"></span><span class=\\"euiSwitch__track\\"><div data-euiicon-type=\\"cross\\" class=\\"euiSwitch__icon\\"></div><div data-euiicon-type=\\"check\\" class=\\"euiSwitch__icon euiSwitch__icon--checked\\"></div></span></span></button><span class=\\"euiSwitch__label\\" id=\\"generated-id\\">Hide Toolbar</span></div><div class=\\"euiFormHelpText euiFormRow__text\\" id=\\"generated-id-help\\">Hide the toolbar when the mouse is not within the Canvas?</div></div></div></div></div></div></div></div></div></div></div></div>"`;
+exports[`<Settings /> can navigate Toolbar Settings, closes when activated 3`] = `"<div><div data-eui=\\"EuiFocusTrap\\"><div class=\\"euiPanel euiPopover__panel euiPopover__panel--top euiPopover__panel-withTitle\\" aria-live=\\"assertive\\" role=\\"dialog\\" aria-modal=\\"true\\" style=\\"top: -16px; left: -22px; z-index: 2000;\\"><div class=\\"euiPopover__panelArrow euiPopover__panelArrow--top\\" style=\\"left: 10px; top: 0px;\\"></div><div><div class=\\"euiContextMenu\\" style=\\"height: 0px;\\"><div class=\\"euiContextMenuPanel euiContextMenu__panel euiContextMenuPanel-txOutLeft\\" tabindex=\\"0\\"><div class=\\"euiPopoverTitle\\"><span class=\\"euiContextMenu__itemLayout\\">Settings</span></div><div><div><button class=\\"euiContextMenuItem\\" type=\\"button\\"><span class=\\"euiContextMenu__itemLayout\\"><div data-euiicon-type=\\"play\\" class=\\"euiContextMenu__icon\\"></div><span class=\\"euiContextMenuItem__text\\">Auto Play</span><div data-euiicon-type=\\"arrowRight\\" class=\\"euiContextMenu__arrow\\"></div></span></button><button class=\\"euiContextMenuItem\\" type=\\"button\\"><span class=\\"euiContextMenu__itemLayout\\"><div data-euiicon-type=\\"boxesHorizontal\\" class=\\"euiContextMenu__icon\\"></div><span class=\\"euiContextMenuItem__text\\">Toolbar</span><div data-euiicon-type=\\"arrowRight\\" class=\\"euiContextMenu__arrow\\"></div></span></button></div></div></div><div class=\\"euiContextMenuPanel euiContextMenu__panel euiContextMenuPanel-txInLeft\\" tabindex=\\"0\\"><button class=\\"euiContextMenuPanelTitle\\" type=\\"button\\" data-test-subj=\\"contextMenuPanelTitleButton\\"><span class=\\"euiContextMenu__itemLayout\\"><div data-euiicon-type=\\"arrowLeft\\" class=\\"euiContextMenu__icon\\"></div><span class=\\"euiContextMenu__text\\">Toolbar</span></span></button><div><div><div style=\\"padding: 16px;\\"><div class=\\"euiFormRow\\" id=\\"generated-id-row\\"><div class=\\"euiFormRow__fieldWrapper\\"><div class=\\"euiSwitch\\"><button id=\\"generated-id\\" aria-checked=\\"true\\" class=\\"euiSwitch__button\\" role=\\"switch\\" type=\\"button\\" aria-labelledby=\\"generated-id\\" data-test-subj=\\"hideToolbarSwitch\\" name=\\"toolbarHide\\" aria-describedby=\\"generated-id-help\\"><span class=\\"euiSwitch__body\\"><span class=\\"euiSwitch__thumb\\"></span><span class=\\"euiSwitch__track\\"><div data-euiicon-type=\\"cross\\" class=\\"euiSwitch__icon\\"></div><div data-euiicon-type=\\"check\\" class=\\"euiSwitch__icon euiSwitch__icon--checked\\"></div></span></span></button><span class=\\"euiSwitch__label\\" id=\\"generated-id\\">Hide Toolbar</span></div><div class=\\"euiFormHelpText euiFormRow__text\\" id=\\"generated-id-help\\">Hide the toolbar when the mouse is not within the Canvas?</div></div></div></div></div></div></div></div></div></div></div></div>"`;
diff --git a/x-pack/plugins/canvas/storybook/addon/tsconfig.json b/x-pack/plugins/canvas/storybook/addon/tsconfig.json
index 9cab0af235f2e5..2ab1856de661a1 100644
--- a/x-pack/plugins/canvas/storybook/addon/tsconfig.json
+++ b/x-pack/plugins/canvas/storybook/addon/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../../tsconfig.base.json",
   "include": [
     "src/**/*.ts",
     "src/**/*.tsx"
diff --git a/x-pack/plugins/canvas/storybook/webpack.config.js b/x-pack/plugins/canvas/storybook/webpack.config.js
index c9817de649c25b..d8434bd5d90809 100644
--- a/x-pack/plugins/canvas/storybook/webpack.config.js
+++ b/x-pack/plugins/canvas/storybook/webpack.config.js
@@ -184,8 +184,6 @@ module.exports = async ({ config: storybookConfig }) => {
           __dirname,
           '../tasks/mocks/uiAbsoluteToParsedUrl'
         ),
-        ui: path.resolve(KIBANA_ROOT, 'src/legacy/ui/public'),
-        ng_mock$: path.resolve(KIBANA_ROOT, 'src/test_utils/public/ng_mock'),
       },
     },
   };
diff --git a/x-pack/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_form.test.js b/x-pack/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_form.test.js
index eda275ba50c1a6..cdb107016e4659 100644
--- a/x-pack/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_form.test.js
+++ b/x-pack/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_form.test.js
@@ -11,8 +11,6 @@ jest.mock('../services/auto_follow_pattern_validators', () => ({
   validateLeaderIndexPattern: jest.fn(),
 }));
 
-jest.mock('ui/new_platform');
-
 describe('<AutoFollowPatternForm state update', () => {
   describe('updateFormErrors()', () => {
     it('should merge errors with existing fieldsErrors', () => {
diff --git a/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_form/follower_index_form.test.js b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_form/follower_index_form.test.js
index 93da20a8ed93c6..72c4832a631a7c 100644
--- a/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_form/follower_index_form.test.js
+++ b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_form/follower_index_form.test.js
@@ -6,8 +6,6 @@
 
 import { updateFields, updateFormErrors } from './follower_index_form';
 
-jest.mock('ui/new_platform');
-
 describe('<FollowerIndexForm /> state transitions', () => {
   it('updateFormErrors() should merge errors with existing fieldsErrors', () => {
     const errors = { name: 'Some error' };
diff --git a/x-pack/plugins/cross_cluster_replication/public/app/services/auto_follow_pattern_validators.test.js b/x-pack/plugins/cross_cluster_replication/public/app/services/auto_follow_pattern_validators.test.js
index 11ec125c17d59c..924bbe708c73a4 100644
--- a/x-pack/plugins/cross_cluster_replication/public/app/services/auto_follow_pattern_validators.test.js
+++ b/x-pack/plugins/cross_cluster_replication/public/app/services/auto_follow_pattern_validators.test.js
@@ -6,8 +6,6 @@
 
 import { validateAutoFollowPattern } from './auto_follow_pattern_validators';
 
-jest.mock('ui/new_platform');
-
 describe('Auto-follow pattern validators', () => {
   describe('validateAutoFollowPattern()', () => {
     it('returns empty object when autoFollowPattern is undefined', () => {
diff --git a/x-pack/plugins/cross_cluster_replication/public/app/store/reducers/api.test.js b/x-pack/plugins/cross_cluster_replication/public/app/store/reducers/api.test.js
index 01dccf70a21d6e..a3655df1f89566 100644
--- a/x-pack/plugins/cross_cluster_replication/public/app/store/reducers/api.test.js
+++ b/x-pack/plugins/cross_cluster_replication/public/app/store/reducers/api.test.js
@@ -8,7 +8,6 @@ import { reducer, initialState } from './api';
 import { API_STATUS } from '../../constants';
 import { apiRequestStart, apiRequestEnd, setApiError } from '../actions';
 
-jest.mock('ui/new_platform');
 jest.mock('../../constants', () => ({
   API_STATUS: {
     IDLE: 'idle',
diff --git a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/flyout_create_drilldown.tsx b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/flyout_create_drilldown.tsx
index b5e5e248eaeb1f..607a11a76a0661 100644
--- a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/flyout_create_drilldown.tsx
+++ b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/flyout_create_drilldown.tsx
@@ -80,6 +80,7 @@ export class FlyoutCreateDrilldownAction implements ActionByType<typeof OPEN_FLY
           viewMode={'create'}
           dynamicActionManager={embeddable.enhancements.dynamicActions}
           supportedTriggers={ensureNestedTriggers(embeddable.supportedTriggers())}
+          placeContext={{ embeddable }}
         />
       ),
       {
diff --git a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/flyout_edit_drilldown.tsx b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/flyout_edit_drilldown.tsx
index 6dfda93db71551..30de62d0d28dd7 100644
--- a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/flyout_edit_drilldown.tsx
+++ b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/flyout_edit_drilldown.tsx
@@ -64,6 +64,7 @@ export class FlyoutEditDrilldownAction implements ActionByType<typeof OPEN_FLYOU
           viewMode={'manage'}
           dynamicActionManager={embeddable.enhancements.dynamicActions}
           supportedTriggers={ensureNestedTriggers(embeddable.supportedTriggers())}
+          placeContext={{ embeddable }}
         />
       ),
       {
diff --git a/x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts b/x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts
index fe954f1602cd31..1e2c7987b70417 100644
--- a/x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts
+++ b/x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts
@@ -189,7 +189,7 @@ describe('EnhancedSearchInterceptor', () => {
       const abortController = new AbortController();
       abortController.abort();
 
-      const response = searchInterceptor.search({}, { signal: abortController.signal });
+      const response = searchInterceptor.search({}, { abortSignal: abortController.signal });
       response.subscribe({ next, error });
 
       await timeTravel(500);
@@ -225,7 +225,7 @@ describe('EnhancedSearchInterceptor', () => {
 
       const response = searchInterceptor.search(
         {},
-        { signal: abortController.signal, pollInterval: 0 }
+        { abortSignal: abortController.signal, pollInterval: 0 }
       );
       response.subscribe({ next, error });
 
diff --git a/x-pack/plugins/data_enhanced/server/search/es_search_strategy.test.ts b/x-pack/plugins/data_enhanced/server/search/es_search_strategy.test.ts
index 054baa6ac81d1d..a287f72ca91619 100644
--- a/x-pack/plugins/data_enhanced/server/search/es_search_strategy.test.ts
+++ b/x-pack/plugins/data_enhanced/server/search/es_search_strategy.test.ts
@@ -35,12 +35,24 @@ const mockRollupResponse = {
 
 describe('ES search strategy', () => {
   const mockApiCaller = jest.fn();
+  const mockGetCaller = jest.fn();
+  const mockSubmitCaller = jest.fn();
   const mockLogger: any = {
     debug: () => {},
   };
   const mockContext = {
     core: {
-      elasticsearch: { client: { asCurrentUser: { transport: { request: mockApiCaller } } } },
+      elasticsearch: {
+        client: {
+          asCurrentUser: {
+            asyncSearch: {
+              get: mockGetCaller,
+              submit: mockSubmitCaller,
+            },
+            transport: { request: mockApiCaller },
+          },
+        },
+      },
     },
   };
   const mockConfig$ = pluginInitializerContextConfigMock<any>({}).legacy.globalConfig$;
@@ -56,47 +68,32 @@ describe('ES search strategy', () => {
   });
 
   it('makes a POST request to async search with params when no ID is provided', async () => {
-    mockApiCaller.mockResolvedValueOnce(mockAsyncResponse);
+    mockSubmitCaller.mockResolvedValueOnce(mockAsyncResponse);
 
     const params = { index: 'logstash-*', body: { query: {} } };
     const esSearch = await enhancedEsSearchStrategyProvider(mockConfig$, mockLogger);
 
     await esSearch.search((mockContext as unknown) as RequestHandlerContext, { params });
 
-    expect(mockApiCaller).toBeCalled();
-    const { method, path, body } = mockApiCaller.mock.calls[0][0];
-    expect(method).toBe('POST');
-    expect(path).toBe('/logstash-*/_async_search');
-    expect(body).toEqual({ query: {} });
+    expect(mockSubmitCaller).toBeCalled();
+    const request = mockSubmitCaller.mock.calls[0][0];
+    expect(request.index).toEqual(params.index);
+    expect(request.body).toEqual(params.body);
   });
 
   it('makes a GET request to async search with ID when ID is provided', async () => {
-    mockApiCaller.mockResolvedValueOnce(mockAsyncResponse);
+    mockGetCaller.mockResolvedValueOnce(mockAsyncResponse);
 
     const params = { index: 'logstash-*', body: { query: {} } };
     const esSearch = await enhancedEsSearchStrategyProvider(mockConfig$, mockLogger);
 
     await esSearch.search((mockContext as unknown) as RequestHandlerContext, { id: 'foo', params });
 
-    expect(mockApiCaller).toBeCalled();
-    const { method, path, body } = mockApiCaller.mock.calls[0][0];
-    expect(method).toBe('GET');
-    expect(path).toBe('/_async_search/foo');
-    expect(body).toEqual(undefined);
-  });
-
-  it('encodes special characters in the path', async () => {
-    mockApiCaller.mockResolvedValueOnce(mockAsyncResponse);
-
-    const params = { index: 'foo-程', body: {} };
-    const esSearch = await enhancedEsSearchStrategyProvider(mockConfig$, mockLogger);
-
-    await esSearch.search((mockContext as unknown) as RequestHandlerContext, { params });
-
-    expect(mockApiCaller).toBeCalled();
-    const { method, path } = mockApiCaller.mock.calls[0][0];
-    expect(method).toBe('POST');
-    expect(path).toBe('/foo-%E7%A8%8B/_async_search');
+    expect(mockGetCaller).toBeCalled();
+    const request = mockGetCaller.mock.calls[0][0];
+    expect(request.id).toEqual('foo');
+    expect(request).toHaveProperty('wait_for_completion_timeout');
+    expect(request).toHaveProperty('keep_alive');
   });
 
   it('calls the rollup API if the index is a rollup type', async () => {
@@ -117,16 +114,16 @@ describe('ES search strategy', () => {
   });
 
   it('sets wait_for_completion_timeout and keep_alive in the request', async () => {
-    mockApiCaller.mockResolvedValueOnce(mockAsyncResponse);
+    mockSubmitCaller.mockResolvedValueOnce(mockAsyncResponse);
 
     const params = { index: 'foo-*', body: {} };
     const esSearch = await enhancedEsSearchStrategyProvider(mockConfig$, mockLogger);
 
     await esSearch.search((mockContext as unknown) as RequestHandlerContext, { params });
 
-    expect(mockApiCaller).toBeCalled();
-    const { querystring } = mockApiCaller.mock.calls[0][0];
-    expect(querystring).toHaveProperty('wait_for_completion_timeout');
-    expect(querystring).toHaveProperty('keep_alive');
+    expect(mockSubmitCaller).toBeCalled();
+    const request = mockSubmitCaller.mock.calls[0][0];
+    expect(request).toHaveProperty('wait_for_completion_timeout');
+    expect(request).toHaveProperty('keep_alive');
   });
 });
diff --git a/x-pack/plugins/data_enhanced/server/search/es_search_strategy.ts b/x-pack/plugins/data_enhanced/server/search/es_search_strategy.ts
index 46609af52d0722..4ace1c4c5385be 100644
--- a/x-pack/plugins/data_enhanced/server/search/es_search_strategy.ts
+++ b/x-pack/plugins/data_enhanced/server/search/es_search_strategy.ts
@@ -19,11 +19,10 @@ import {
   getTotalLoaded,
   ISearchStrategy,
   SearchUsage,
-  ISearchOptions,
 } from '../../../../../src/plugins/data/server';
 import { IEnhancedEsSearchRequest } from '../../common';
 import { shimHitsTotal } from './shim_hits_total';
-import { IEsSearchResponse } from '../../../../../src/plugins/data/common/search/es_search';
+import { ISearchOptions, IEsSearchResponse } from '../../../../../src/plugins/data/common/search';
 
 function isEnhancedEsSearchResponse(response: any): response is IEsSearchResponse {
   return response.hasOwnProperty('isPartial') && response.hasOwnProperty('isRunning');
@@ -71,9 +70,8 @@ export const enhancedEsSearchStrategyProvider = (
 
   const cancel = async (context: RequestHandlerContext, id: string) => {
     logger.debug(`cancel ${id}`);
-    await context.core.elasticsearch.client.asCurrentUser.transport.request({
-      method: 'DELETE',
-      path: encodeURI(`/_async_search/${id}`),
+    await context.core.elasticsearch.client.asCurrentUser.asyncSearch.delete({
+      id,
     });
   };
 
@@ -85,39 +83,29 @@ async function asyncSearch(
   request: IEnhancedEsSearchRequest,
   options?: ISearchOptions
 ): Promise<IEsSearchResponse> {
-  const { timeout = undefined, restTotalHitsAsInt = undefined, ...params } = {
-    ...request.params,
-  };
-
-  params.trackTotalHits = true; // Get the exact count of hits
-
-  // If we have an ID, then just poll for that ID, otherwise send the entire request body
-  const { body = undefined, index = undefined, ...queryParams } = request.id ? {} : params;
-
-  const method = request.id ? 'GET' : 'POST';
-  const path = encodeURI(request.id ? `/_async_search/${request.id}` : `/${index}/_async_search`);
-
-  // Only report partial results every 64 shards; this should be reduced when we actually display partial results
-  const batchedReduceSize = request.id ? undefined : 64;
+  let esResponse;
 
   const asyncOptions = {
     waitForCompletionTimeout: '100ms', // Wait up to 100ms for the response to return
     keepAlive: '1m', // Extend the TTL for this search request by one minute
   };
 
-  const querystring = toSnakeCase({
-    ...asyncOptions,
-    ...(batchedReduceSize && { batchedReduceSize }),
-    ...queryParams,
-  });
+  // If we have an ID, then just poll for that ID, otherwise send the entire request body
+  if (!request.id) {
+    const submitOptions = toSnakeCase({
+      batchedReduceSize: 64, // Only report partial results every 64 shards; this should be reduced when we actually display partial results
+      trackTotalHits: true, // Get the exact count of hits
+      ...asyncOptions,
+      ...request.params,
+    });
 
-  // TODO: replace with async endpoints once https://github.com/elastic/elasticsearch-js/issues/1280 is resolved
-  const esResponse = await client.transport.request({
-    method,
-    path,
-    body,
-    querystring,
-  });
+    esResponse = await client.asyncSearch.submit(submitOptions);
+  } else {
+    esResponse = await client.asyncSearch.get({
+      id: request.id,
+      ...toSnakeCase(asyncOptions),
+    });
+  }
 
   const { id, response, is_partial: isPartial, is_running: isRunning } = esResponse.body;
   return {
diff --git a/x-pack/plugins/embeddable_enhanced/kibana.json b/x-pack/plugins/embeddable_enhanced/kibana.json
index 5663671de7bd9c..acada946fe0d17 100644
--- a/x-pack/plugins/embeddable_enhanced/kibana.json
+++ b/x-pack/plugins/embeddable_enhanced/kibana.json
@@ -3,5 +3,6 @@
   "version": "kibana",
   "server": false,
   "ui": true,
-  "requiredPlugins": ["embeddable", "uiActionsEnhanced"]
+  "requiredPlugins": ["embeddable", "kibanaReact", "uiActions", "uiActionsEnhanced"],
+  "requiredBundles": ["kibanaUtils"]
 }
diff --git a/x-pack/plugins/embeddable_enhanced/public/drilldowns/index.ts b/x-pack/plugins/embeddable_enhanced/public/drilldowns/index.ts
new file mode 100644
index 00000000000000..a8d5a179dbac1f
--- /dev/null
+++ b/x-pack/plugins/embeddable_enhanced/public/drilldowns/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './url_drilldown';
diff --git a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/README.md b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/README.md
new file mode 100644
index 00000000000000..996723ccb914d9
--- /dev/null
+++ b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/README.md
@@ -0,0 +1,24 @@
+# Basic url drilldown implementation
+
+Url drilldown allows navigating to external URL or to internal kibana URL.
+By using variables in url template result url can be dynamic and depend on user's interaction.
+
+URL drilldown has 3 sources for variables:
+
+- Global static variables like, for example, `kibanaUrl`. Such variables won’t change depending on a place where url drilldown is used.
+- Context variables are dynamic and different depending on where drilldown is created and used.
+- Event variables depend on a trigger context. These variables are dynamically extracted from the action context when drilldown is executed.
+
+Difference between `event` and `context` variables, is that real `context` variables are available during drilldown creation (e.g. embeddable panel),
+but `event` variables mapped from trigger context. Since there is no trigger context during drilldown creation, we have to provide some _mock_ variables for validating and previewing the URL.
+
+In current implementation url drilldown has to be used inside the embeddable and with `ValueClickTrigger` or `RangeSelectTrigger`.
+
+- `context` variables extracted from `embeddable`
+- `event` variables extracted from `trigger` context
+
+In future this basic url drilldown implementation would allow injecting more variables into `context` (e.g. `dashboard` app specific variables) and would allow providing support for new trigger types from outside.
+This extensibility improvements are tracked here: https://github.com/elastic/kibana/issues/55324
+
+In case a solution app has a use case for url drilldown that has to be different from current basic implementation and
+just extending variables list is not enough, then recommendation is to create own custom url drilldown and reuse building blocks from `ui_actions_enhanced`.
diff --git a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/i18n.ts b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/i18n.ts
new file mode 100644
index 00000000000000..748f6f4cecedd5
--- /dev/null
+++ b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/i18n.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const txtUrlDrilldownDisplayName = i18n.translate(
+  'xpack.embeddableEnhanced.drilldowns.urlDrilldownDisplayName',
+  {
+    defaultMessage: 'Go to URL',
+  }
+);
diff --git a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/index.ts b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/index.ts
new file mode 100644
index 00000000000000..61406f7d843186
--- /dev/null
+++ b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { UrlDrilldown } from './url_drilldown';
diff --git a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.test.ts b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.test.ts
new file mode 100644
index 00000000000000..6a11663ea6c3dd
--- /dev/null
+++ b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.test.ts
@@ -0,0 +1,166 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UrlDrilldown, ActionContext, Config } from './url_drilldown';
+import { coreMock } from '../../../../../../src/core/public/mocks';
+import { IEmbeddable } from '../../../../../../src/plugins/embeddable/public/lib/embeddables';
+
+const mockDataPoints = [
+  {
+    table: {
+      columns: [
+        {
+          name: 'test',
+          id: '1-1',
+          meta: {
+            type: 'histogram',
+            indexPatternId: 'logstash-*',
+            aggConfigParams: {
+              field: 'bytes',
+              interval: 30,
+              otherBucket: true,
+            },
+          },
+        },
+      ],
+      rows: [
+        {
+          '1-1': '2048',
+        },
+      ],
+    },
+    column: 0,
+    row: 0,
+    value: 'test',
+  },
+];
+
+const mockEmbeddable = ({
+  getInput: () => ({
+    filters: [],
+    timeRange: { from: 'now-15m', to: 'now' },
+    query: { query: 'test', language: 'kuery' },
+  }),
+  getOutput: () => ({}),
+} as unknown) as IEmbeddable;
+
+const mockNavigateToUrl = jest.fn(() => Promise.resolve());
+
+describe('UrlDrilldown', () => {
+  const urlDrilldown = new UrlDrilldown({
+    getGlobalScope: () => ({ kibanaUrl: 'http://localhost:5601/' }),
+    getOpenModal: () => Promise.resolve(coreMock.createStart().overlays.openModal),
+    getSyntaxHelpDocsLink: () => 'http://localhost:5601/docs',
+    navigateToUrl: mockNavigateToUrl,
+  });
+
+  test('license', () => {
+    expect(urlDrilldown.minimalLicense).toBe('gold');
+  });
+
+  describe('isCompatible', () => {
+    test('throws if no embeddable', async () => {
+      const config: Config = {
+        url: {
+          template: `https://elasti.co/?{{event.value}}`,
+        },
+        openInNewTab: false,
+      };
+
+      const context: ActionContext = {
+        data: {
+          data: mockDataPoints,
+        },
+      };
+
+      await expect(urlDrilldown.isCompatible(config, context)).rejects.toThrowError();
+    });
+
+    test('compatible if url is valid', async () => {
+      const config: Config = {
+        url: {
+          template: `https://elasti.co/?{{event.value}}&{{rison context.panel.query}}`,
+        },
+        openInNewTab: false,
+      };
+
+      const context: ActionContext = {
+        data: {
+          data: mockDataPoints,
+        },
+        embeddable: mockEmbeddable,
+      };
+
+      await expect(urlDrilldown.isCompatible(config, context)).resolves.toBe(true);
+    });
+
+    test('not compatible if url is invalid', async () => {
+      const config: Config = {
+        url: {
+          template: `https://elasti.co/?{{event.value}}&{{rison context.panel.somethingFake}}`,
+        },
+        openInNewTab: false,
+      };
+
+      const context: ActionContext = {
+        data: {
+          data: mockDataPoints,
+        },
+        embeddable: mockEmbeddable,
+      };
+
+      await expect(urlDrilldown.isCompatible(config, context)).resolves.toBe(false);
+    });
+  });
+
+  describe('getHref & execute', () => {
+    beforeEach(() => {
+      mockNavigateToUrl.mockReset();
+    });
+
+    test('valid url', async () => {
+      const config: Config = {
+        url: {
+          template: `https://elasti.co/?{{event.value}}&{{rison context.panel.query}}`,
+        },
+        openInNewTab: false,
+      };
+
+      const context: ActionContext = {
+        data: {
+          data: mockDataPoints,
+        },
+        embeddable: mockEmbeddable,
+      };
+
+      const url = await urlDrilldown.getHref(config, context);
+      expect(url).toMatchInlineSnapshot(`"https://elasti.co/?test&(language:kuery,query:test)"`);
+
+      await urlDrilldown.execute(config, context);
+      expect(mockNavigateToUrl).toBeCalledWith(url);
+    });
+
+    test('invalid url', async () => {
+      const config: Config = {
+        url: {
+          template: `https://elasti.co/?{{event.value}}&{{rison context.panel.invalid}}`,
+        },
+        openInNewTab: false,
+      };
+
+      const context: ActionContext = {
+        data: {
+          data: mockDataPoints,
+        },
+        embeddable: mockEmbeddable,
+      };
+
+      await expect(urlDrilldown.getHref(config, context)).rejects.toThrowError();
+      await expect(urlDrilldown.execute(config, context)).rejects.toThrowError();
+      expect(mockNavigateToUrl).not.toBeCalled();
+    });
+  });
+});
diff --git a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.tsx b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.tsx
new file mode 100644
index 00000000000000..d5ab095fdd2875
--- /dev/null
+++ b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown.tsx
@@ -0,0 +1,145 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { OverlayStart } from 'kibana/public';
+import { reactToUiComponent } from '../../../../../../src/plugins/kibana_react/public';
+import { ChartActionContext, IEmbeddable } from '../../../../../../src/plugins/embeddable/public';
+import { CollectConfigProps as CollectConfigPropsBase } from '../../../../../../src/plugins/kibana_utils/public';
+import {
+  SELECT_RANGE_TRIGGER,
+  VALUE_CLICK_TRIGGER,
+} from '../../../../../../src/plugins/ui_actions/public';
+import {
+  UiActionsEnhancedDrilldownDefinition as Drilldown,
+  UrlDrilldownGlobalScope,
+  UrlDrilldownConfig,
+  UrlDrilldownCollectConfig,
+  urlDrilldownValidateUrlTemplate,
+  urlDrilldownBuildScope,
+  urlDrilldownCompileUrl,
+  UiActionsEnhancedBaseActionFactoryContext as BaseActionFactoryContext,
+} from '../../../../ui_actions_enhanced/public';
+import { getContextScope, getEventScope, getMockEventScope } from './url_drilldown_scope';
+import { txtUrlDrilldownDisplayName } from './i18n';
+
+interface UrlDrilldownDeps {
+  getGlobalScope: () => UrlDrilldownGlobalScope;
+  navigateToUrl: (url: string) => Promise<void>;
+  getOpenModal: () => Promise<OverlayStart['openModal']>;
+  getSyntaxHelpDocsLink: () => string;
+}
+
+export type ActionContext = ChartActionContext;
+export type Config = UrlDrilldownConfig;
+export type UrlTrigger = typeof VALUE_CLICK_TRIGGER | typeof SELECT_RANGE_TRIGGER;
+export interface ActionFactoryContext extends BaseActionFactoryContext<UrlTrigger> {
+  embeddable?: IEmbeddable;
+}
+export type CollectConfigProps = CollectConfigPropsBase<Config, ActionFactoryContext>;
+
+const URL_DRILLDOWN = 'URL_DRILLDOWN';
+
+export class UrlDrilldown implements Drilldown<Config, UrlTrigger, ActionFactoryContext> {
+  public readonly id = URL_DRILLDOWN;
+
+  constructor(private deps: UrlDrilldownDeps) {}
+
+  public readonly order = 8;
+
+  readonly minimalLicense = 'gold';
+  readonly licenseFeatureName = 'URL drilldown';
+
+  public readonly getDisplayName = () => txtUrlDrilldownDisplayName;
+
+  public readonly euiIcon = 'link';
+
+  supportedTriggers(): UrlTrigger[] {
+    return [VALUE_CLICK_TRIGGER, SELECT_RANGE_TRIGGER];
+  }
+
+  private readonly ReactCollectConfig: React.FC<CollectConfigProps> = ({
+    config,
+    onConfig,
+    context,
+  }) => {
+    // eslint-disable-next-line react-hooks/rules-of-hooks
+    const scope = React.useMemo(() => this.buildEditorScope(context), [context]);
+    return (
+      <UrlDrilldownCollectConfig
+        config={config}
+        onConfig={onConfig}
+        scope={scope}
+        syntaxHelpDocsLink={this.deps.getSyntaxHelpDocsLink()}
+      />
+    );
+  };
+
+  public readonly CollectConfig = reactToUiComponent(this.ReactCollectConfig);
+
+  public readonly createConfig = () => ({
+    url: { template: '' },
+    openInNewTab: false,
+  });
+
+  public readonly isConfigValid = (
+    config: Config,
+    context: ActionFactoryContext
+  ): config is Config => {
+    const { isValid } = urlDrilldownValidateUrlTemplate(config.url, this.buildEditorScope(context));
+    return isValid;
+  };
+
+  public readonly isCompatible = async (config: Config, context: ActionContext) => {
+    const { isValid, error } = urlDrilldownValidateUrlTemplate(
+      config.url,
+      await this.buildRuntimeScope(context)
+    );
+
+    if (!isValid) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        `UrlDrilldown [${config.url.template}] is not valid. Error [${error}]. Skipping execution.`
+      );
+    }
+
+    return Promise.resolve(isValid);
+  };
+
+  public readonly getHref = async (config: Config, context: ActionContext) =>
+    urlDrilldownCompileUrl(config.url.template, await this.buildRuntimeScope(context));
+
+  public readonly execute = async (config: Config, context: ActionContext) => {
+    const url = await urlDrilldownCompileUrl(
+      config.url.template,
+      await this.buildRuntimeScope(context, { allowPrompts: true })
+    );
+    if (config.openInNewTab) {
+      window.open(url, '_blank', 'noopener');
+    } else {
+      await this.deps.navigateToUrl(url);
+    }
+  };
+
+  private buildEditorScope = (context: ActionFactoryContext) => {
+    return urlDrilldownBuildScope({
+      globalScope: this.deps.getGlobalScope(),
+      contextScope: getContextScope(context),
+      eventScope: getMockEventScope(context.triggers),
+    });
+  };
+
+  private buildRuntimeScope = async (
+    context: ActionContext,
+    opts: { allowPrompts: boolean } = { allowPrompts: false }
+  ) => {
+    return urlDrilldownBuildScope({
+      globalScope: this.deps.getGlobalScope(),
+      contextScope: getContextScope(context),
+      eventScope: await getEventScope(context, this.deps, opts),
+    });
+  };
+}
diff --git a/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.tsx b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.tsx
new file mode 100644
index 00000000000000..d3e3510f1b24e4
--- /dev/null
+++ b/x-pack/plugins/embeddable_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.tsx
@@ -0,0 +1,319 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/**
+ * This file contains all the logic for mapping from trigger's context and action factory context to variables for URL drilldown scope,
+ * Please refer to ./README.md for explanation of different scope sources
+ */
+
+import React from 'react';
+import {
+  EuiButton,
+  EuiButtonEmpty,
+  EuiModalBody,
+  EuiModalFooter,
+  EuiModalHeader,
+  EuiModalHeaderTitle,
+  EuiRadioGroup,
+} from '@elastic/eui';
+import uniqBy from 'lodash/uniqBy';
+import { FormattedMessage } from '@kbn/i18n/react';
+import type { Query, Filter, TimeRange } from '../../../../../../src/plugins/data/public';
+import {
+  IEmbeddable,
+  isRangeSelectTriggerContext,
+  isValueClickTriggerContext,
+  RangeSelectContext,
+  ValueClickContext,
+} from '../../../../../../src/plugins/embeddable/public';
+import type { ActionContext, ActionFactoryContext, UrlTrigger } from './url_drilldown';
+import { SELECT_RANGE_TRIGGER } from '../../../../../../src/plugins/ui_actions/public';
+import { OverlayStart } from '../../../../../../src/core/public';
+import { toMountPoint } from '../../../../../../src/plugins/kibana_react/public';
+
+type ContextScopeInput = ActionContext | ActionFactoryContext;
+
+/**
+ * Part of context scope extracted from an embeddable
+ * Expose on the scope as: `{{context.panel.id}}`, `{{context.panel.filters.[0]}}`
+ */
+interface EmbeddableUrlDrilldownContextScope {
+  id: string;
+  title?: string;
+  query?: Query;
+  filters?: Filter[];
+  timeRange?: TimeRange;
+  savedObjectId?: string;
+  /**
+   * In case panel supports only 1 index patterns
+   */
+  indexPatternId?: string;
+  /**
+   * In case panel supports more then 1 index patterns
+   */
+  indexPatternIds?: string[];
+}
+
+/**
+ * Url drilldown context scope
+ * `{{context.$}}`
+ */
+interface UrlDrilldownContextScope {
+  panel?: EmbeddableUrlDrilldownContextScope;
+}
+
+export function getContextScope(contextScopeInput: ContextScopeInput): UrlDrilldownContextScope {
+  function hasEmbeddable(val: unknown): val is { embeddable: IEmbeddable } {
+    if (val && typeof val === 'object' && 'embeddable' in val) return true;
+    return false;
+  }
+  if (!hasEmbeddable(contextScopeInput))
+    throw new Error(
+      "UrlDrilldown [getContextScope] can't build scope because embeddable object is missing in context"
+    );
+
+  const embeddable = contextScopeInput.embeddable;
+  const input = embeddable.getInput();
+  const output = embeddable.getOutput();
+  function hasSavedObjectId(obj: Record<string, any>): obj is { savedObjectId: string } {
+    return 'savedObjectId' in obj && typeof obj.savedObjectId === 'string';
+  }
+  function getIndexPatternIds(): string[] {
+    function hasIndexPatterns(
+      _output: Record<string, any>
+    ): _output is { indexPatterns: Array<{ id?: string }> } {
+      return (
+        'indexPatterns' in _output &&
+        Array.isArray(_output.indexPatterns) &&
+        _output.indexPatterns.length > 0
+      );
+    }
+    return hasIndexPatterns(output)
+      ? (output.indexPatterns.map((ip) => ip.id).filter(Boolean) as string[])
+      : [];
+  }
+  const indexPatternsIds = getIndexPatternIds();
+  return {
+    panel: cleanEmptyKeys({
+      id: input.id,
+      title: output.title ?? input.title,
+      savedObjectId:
+        output.savedObjectId ?? (hasSavedObjectId(input) ? input.savedObjectId : undefined),
+      query: input.query,
+      timeRange: input.timeRange,
+      filters: input.filters,
+      indexPatternIds: indexPatternsIds.length > 1 ? indexPatternsIds : undefined,
+      indexPatternId: indexPatternsIds.length === 1 ? indexPatternsIds[0] : undefined,
+    }),
+  };
+}
+
+/**
+ * URL drilldown event scope,
+ * available as: {{event.key}}, {{event.from}}
+ */
+type UrlDrilldownEventScope = ValueClickTriggerEventScope | RangeSelectTriggerEventScope;
+type EventScopeInput = ActionContext;
+interface ValueClickTriggerEventScope {
+  key?: string;
+  value?: string | number | boolean;
+  negate: boolean;
+}
+interface RangeSelectTriggerEventScope {
+  key: string;
+  from?: string | number;
+  to?: string | number;
+}
+
+export async function getEventScope(
+  eventScopeInput: EventScopeInput,
+  deps: { getOpenModal: () => Promise<OverlayStart['openModal']> },
+  opts: { allowPrompts: boolean } = { allowPrompts: false }
+): Promise<UrlDrilldownEventScope> {
+  if (isRangeSelectTriggerContext(eventScopeInput)) {
+    return getEventScopeFromRangeSelectTriggerContext(eventScopeInput);
+  } else if (isValueClickTriggerContext(eventScopeInput)) {
+    return getEventScopeFromValueClickTriggerContext(eventScopeInput, deps, opts);
+  } else {
+    throw new Error("UrlDrilldown [getEventScope] can't build scope from not supported trigger");
+  }
+}
+
+async function getEventScopeFromRangeSelectTriggerContext(
+  eventScopeInput: RangeSelectContext
+): Promise<RangeSelectTriggerEventScope> {
+  const { table, column: columnIndex, range } = eventScopeInput.data;
+  const column = table.columns[columnIndex];
+  return cleanEmptyKeys({
+    key: toPrimitiveOrUndefined(column?.meta?.aggConfigParams?.field) as string,
+    from: toPrimitiveOrUndefined(range[0]) as string | number | undefined,
+    to: toPrimitiveOrUndefined(range[range.length - 1]) as string | number | undefined,
+  });
+}
+
+async function getEventScopeFromValueClickTriggerContext(
+  eventScopeInput: ValueClickContext,
+  deps: { getOpenModal: () => Promise<OverlayStart['openModal']> },
+  opts: { allowPrompts: boolean } = { allowPrompts: false }
+): Promise<ValueClickTriggerEventScope> {
+  const negate = eventScopeInput.data.negate ?? false;
+  const point = await getSingleValue(eventScopeInput.data.data, deps, opts);
+  const { key, value } = getKeyValueFromPoint(point);
+  return cleanEmptyKeys({
+    key,
+    value,
+    negate,
+  });
+}
+
+/**
+ * @remarks
+ * Difference between `event` and `context` variables, is that real `context` variables are available during drilldown creation (e.g. embeddable panel)
+ * `event` variables are mapped from trigger context. Since there is no trigger context during drilldown creation, we have to provide some _mock_ variables for validating and previewing the URL
+ */
+export function getMockEventScope([trigger]: UrlTrigger[]): UrlDrilldownEventScope {
+  if (trigger === SELECT_RANGE_TRIGGER) {
+    return {
+      key: 'event.key',
+      from: new Date(Date.now() - 15 * 60 * 1000).toISOString(), // 15 minutes ago
+      to: new Date().toISOString(),
+    };
+  } else {
+    return {
+      key: 'event.key',
+      value: 'event.value',
+      negate: false,
+    };
+  }
+}
+
+function getKeyValueFromPoint(
+  point: ValueClickContext['data']['data'][0]
+): Pick<ValueClickTriggerEventScope, 'key' | 'value'> {
+  const { table, column: columnIndex, value } = point;
+  const column = table.columns[columnIndex];
+  return {
+    key: toPrimitiveOrUndefined(column?.meta?.aggConfigParams?.field) as string | undefined,
+    value: toPrimitiveOrUndefined(value),
+  };
+}
+
+function toPrimitiveOrUndefined(v: unknown): string | number | boolean | undefined {
+  if (typeof v === 'number' || typeof v === 'boolean' || typeof v === 'string') return v;
+  if (typeof v === 'object' && v instanceof Date) return v.toISOString();
+  if (typeof v === 'undefined' || v === null) return undefined;
+  return String(v);
+}
+
+function cleanEmptyKeys<T extends Record<string, any>>(obj: T): T {
+  Object.keys(obj).forEach((key) => {
+    if (obj[key] === undefined) {
+      delete obj[key];
+    }
+  });
+  return obj;
+}
+
+/**
+ * VALUE_CLICK_TRIGGER could have multiple data points
+ * Prompt user which data point to use in a drilldown
+ */
+async function getSingleValue(
+  data: ValueClickContext['data']['data'],
+  deps: { getOpenModal: () => Promise<OverlayStart['openModal']> },
+  opts: { allowPrompts: boolean } = { allowPrompts: false }
+): Promise<ValueClickContext['data']['data'][0]> {
+  data = uniqBy(data.filter(Boolean), (point) => {
+    const { key, value } = getKeyValueFromPoint(point);
+    return `${key}:${value}`;
+  });
+  if (data.length === 0)
+    throw new Error(`[trigger = "VALUE_CLICK_TRIGGER"][getSingleValue] no value to pick from`);
+  if (data.length === 1) return Promise.resolve(data[0]);
+  if (!opts.allowPrompts) return Promise.resolve(data[0]);
+  return new Promise(async (resolve, reject) => {
+    const openModal = await deps.getOpenModal();
+    const overlay = openModal(
+      toMountPoint(
+        <GetSingleValuePopup
+          onCancel={() => overlay.close()}
+          onSubmit={(point) => {
+            if (point) {
+              resolve(point);
+            }
+            overlay.close();
+          }}
+          data={data}
+        />
+      )
+    );
+    overlay.onClose.then(() => reject());
+  });
+}
+
+function GetSingleValuePopup({
+  data,
+  onCancel,
+  onSubmit,
+}: {
+  data: ValueClickContext['data']['data'];
+  onCancel: () => void;
+  onSubmit: (value: ValueClickContext['data']['data'][0]) => void;
+}) {
+  const values = data
+    .map((point) => {
+      const { key, value } = getKeyValueFromPoint(point);
+      return {
+        point,
+        id: key ?? '',
+        label: `${key}:${value}`,
+      };
+    })
+    .filter((value) => Boolean(value.id));
+
+  const [selectedValueId, setSelectedValueId] = React.useState(values[0].id);
+
+  return (
+    <React.Fragment>
+      <EuiModalHeader>
+        <EuiModalHeaderTitle>
+          <FormattedMessage
+            id="xpack.embeddableEnhanced.drilldowns.pickSingleValuePopup.popupHeader"
+            defaultMessage="Select a value to drill down into"
+          />
+        </EuiModalHeaderTitle>
+      </EuiModalHeader>
+
+      <EuiModalBody>
+        <EuiRadioGroup
+          options={values}
+          idSelected={selectedValueId}
+          onChange={(id) => setSelectedValueId(id)}
+          name="drilldownValues"
+        />
+      </EuiModalBody>
+
+      <EuiModalFooter>
+        <EuiButtonEmpty onClick={onCancel}>
+          <FormattedMessage
+            id="xpack.embeddableEnhanced.drilldowns.pickSingleValuePopup.cancelButtonLabel"
+            defaultMessage="Cancel"
+          />
+        </EuiButtonEmpty>
+        <EuiButton
+          onClick={() => onSubmit(values.find((v) => v.id === selectedValueId)?.point!)}
+          data-test-subj="applySingleValuePopoverButton"
+          fill
+        >
+          <FormattedMessage
+            id="xpack.embeddableEnhanced.drilldowns.pickSingleValuePopup.applyButtonLabel"
+            defaultMessage="Apply"
+          />
+        </EuiButton>
+      </EuiModalFooter>
+    </React.Fragment>
+  );
+}
diff --git a/x-pack/plugins/embeddable_enhanced/public/plugin.ts b/x-pack/plugins/embeddable_enhanced/public/plugin.ts
index fd0bcc2023269e..37e102b40131d6 100644
--- a/x-pack/plugins/embeddable_enhanced/public/plugin.ts
+++ b/x-pack/plugins/embeddable_enhanced/public/plugin.ts
@@ -28,8 +28,11 @@ import {
   UiActionsEnhancedDynamicActionManager as DynamicActionManager,
   AdvancedUiActionsSetup,
   AdvancedUiActionsStart,
+  urlDrilldownGlobalScopeProvider,
 } from '../../ui_actions_enhanced/public';
 import { PanelNotificationsAction, ACTION_PANEL_NOTIFICATIONS } from './actions';
+import { UrlDrilldown } from './drilldowns';
+import { createStartServicesGetter } from '../../../../src/plugins/kibana_utils/public';
 
 declare module '../../../../src/plugins/ui_actions/public' {
   export interface ActionContextMapping {
@@ -61,11 +64,21 @@ export class EmbeddableEnhancedPlugin
 
   public setup(core: CoreSetup<StartDependencies>, plugins: SetupDependencies): SetupContract {
     this.setCustomEmbeddableFactoryProvider(plugins);
-
+    const startServices = createStartServicesGetter(core.getStartServices);
     const panelNotificationAction = new PanelNotificationsAction();
     plugins.uiActionsEnhanced.registerAction(panelNotificationAction);
     plugins.uiActionsEnhanced.attachAction(PANEL_NOTIFICATION_TRIGGER, panelNotificationAction.id);
 
+    plugins.uiActionsEnhanced.registerDrilldown(
+      new UrlDrilldown({
+        getGlobalScope: urlDrilldownGlobalScopeProvider({ core }),
+        navigateToUrl: (url: string) =>
+          core.getStartServices().then(([{ application }]) => application.navigateToUrl(url)),
+        getOpenModal: () => core.getStartServices().then(([{ overlays }]) => overlays.openModal),
+        getSyntaxHelpDocsLink: () => startServices().core.docLinks.links.dashboard.drilldowns, // TODO: replace with docs https://github.com/elastic/kibana/issues/69414
+      })
+    );
+
     return {};
   }
 
diff --git a/x-pack/plugins/enterprise_search/common/constants.ts b/x-pack/plugins/enterprise_search/common/constants.ts
index c5839df4c603b3..05d27d7337a6ef 100644
--- a/x-pack/plugins/enterprise_search/common/constants.ts
+++ b/x-pack/plugins/enterprise_search/common/constants.ts
@@ -24,6 +24,7 @@ export const APP_SEARCH_PLUGIN = {
       'Leverage dashboards, analytics, and APIs for advanced application search made simple.',
   }),
   URL: '/app/enterprise_search/app_search',
+  SUPPORT_URL: 'https://discuss.elastic.co/c/enterprise-search/app-search/',
 };
 
 export const WORKPLACE_SEARCH_PLUGIN = {
@@ -36,8 +37,11 @@ export const WORKPLACE_SEARCH_PLUGIN = {
       'Search all documents, files, and sources available across your virtual workplace.',
   }),
   URL: '/app/enterprise_search/workplace_search',
+  SUPPORT_URL: 'https://discuss.elastic.co/c/enterprise-search/workplace-search/',
 };
 
+export const LICENSED_SUPPORT_URL = 'https://support.elastic.co';
+
 export const JSON_HEADER = { 'Content-Type': 'application/json' }; // This needs specific casing or Chrome throws a 415 error
 
 export const ENGINES_PAGE_SIZE = 10;
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/assets/engine.svg b/x-pack/plugins/enterprise_search/public/applications/app_search/assets/engine.svg
deleted file mode 100644
index ceab918e92e702..00000000000000
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/assets/engine.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18" width="18" height="18">
-  <path fill-rule="evenodd" clip-rule="evenodd" d="M9.776 1.389a7.66 7.66 0 00-.725-.04v.001H9a7.65 7.65 0 00-.051 15.301v-.001H9a7.65 7.65 0 00.776-15.261zm-1.52 1.254a6.401 6.401 0 00.02 12.716l2.333-3.791a.875.875 0 00-.354-1.242l-3.07-1.534a2.125 2.125 0 01-.859-3.015l1.93-3.134zm1.489 12.714l1.929-3.134a2.125 2.125 0 00-.86-3.015l-3.07-1.534a.875.875 0 01-.353-1.242L9.724 2.64a6.401 6.401 0 01.02 12.717z" fill="#000"/>
-</svg>
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/assets/logo.svg b/x-pack/plugins/enterprise_search/public/applications/app_search/assets/logo.svg
deleted file mode 100644
index 2284a425b5add2..00000000000000
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/assets/logo.svg
+++ /dev/null
@@ -1,4 +0,0 @@
-<svg width="32" height="32" viewBox="0 0 32 32" xmlns="http://www.w3.org/2000/svg" fill="none">
-  <path fill-rule="evenodd" clip-rule="evenodd" d="M15.5 11.915L27 5.277 19.5.937a7.002 7.002 0 00-7 0l-8 4.62A7 7 0 001 11.62v9.237a7 7 0 003.5 6.062l7.5 4.33V17.979a7 7 0 013.5-6.063zM10 27.785v-9.808a9 9 0 014.5-7.793l8.503-4.91L18.5 2.67a5.003 5.003 0 00-5 0l-8 4.619a5 5 0 00-2.5 4.33v9.238a5 5 0 002.5 4.33l4.5 2.598z" fill="#343741" />
-  <path fill-rule="evenodd" clip-rule="evenodd" d="M18.409 13.55a7.09 7.09 0 011.035 1.711A6.93 6.93 0 0120 17.978v13.27l7.5-4.33a7 7 0 003.5-6.061v-9.238a6.992 6.992 0 00-1.587-4.422L18.409 13.55zm2.777.705A8.933 8.933 0 0122 17.978v9.807l4.5-2.598a5 5 0 002.5-4.33v-9.238c0-.588-.106-1.161-.303-1.7l-7.51 4.336z" fill="#017D73" />
-</svg>
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/assets/meta_engine.svg b/x-pack/plugins/enterprise_search/public/applications/app_search/assets/meta_engine.svg
deleted file mode 100644
index 4e01e9a0b34fb9..00000000000000
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/assets/meta_engine.svg
+++ /dev/null
@@ -1,4 +0,0 @@
-<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18" width="18" height="18">
-  <path fill-rule="evenodd" clip-rule="evenodd" d="M4 9a5.002 5.002 0 005 5 5 5 0 10-5-5zm5.506 1.653L8.37 12.697a3.751 3.751 0 01-.003-7.394L7.402 7.04a1.625 1.625 0 00.519 2.142l1.465.976a.375.375 0 01.12.495zm1.092.607l-.777 1.4a3.751 3.751 0 00-.04-7.329L8.494 7.647a.375.375 0 00.12.495l1.465.976c.705.47.93 1.402.52 2.142z" fill="#000"/>
-  <path fill-rule="evenodd" clip-rule="evenodd" d="M6.5 1.375A5.125 5.125 0 001.375 6.5v5A5.125 5.125 0 006.5 16.625h5a5.125 5.125 0 005.125-5.125v-5A5.125 5.125 0 0011.5 1.375h-5zM2.625 6.5A3.875 3.875 0 016.5 2.625h5A3.875 3.875 0 0115.375 6.5v5a3.875 3.875 0 01-3.875 3.875h-5A3.875 3.875 0 012.625 11.5v-5z" fill="#000"/>
-  </svg>
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/assets/engine_icon.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/assets/engine_icon.tsx
new file mode 100644
index 00000000000000..64494bfaa7949f
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/assets/engine_icon.tsx
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+export const EngineIcon: React.FC = () => (
+  <svg
+    xmlns="http://www.w3.org/2000/svg"
+    viewBox="0 0 18 18"
+    width="18"
+    height="18"
+    className="euiIcon engineIcon"
+    aria-hidden="true"
+  >
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M9.776 1.389a7.66 7.66 0 00-.725-.04v.001H9a7.65 7.65 0 00-.051 15.301v-.001H9a7.65 7.65 0 00.776-15.261zm-1.52 1.254a6.401 6.401 0 00.02 12.716l2.333-3.791a.875.875 0 00-.354-1.242l-3.07-1.534a2.125 2.125 0 01-.859-3.015l1.93-3.134zm1.489 12.714l1.929-3.134a2.125 2.125 0 00-.86-3.015l-3.07-1.534a.875.875 0 01-.353-1.242L9.724 2.64a6.401 6.401 0 01.02 12.717z"
+    />
+  </svg>
+);
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/assets/meta_engine_icon.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/assets/meta_engine_icon.tsx
new file mode 100644
index 00000000000000..e2939ddcde9d79
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/assets/meta_engine_icon.tsx
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+export const MetaEngineIcon: React.FC = () => (
+  <svg
+    xmlns="http://www.w3.org/2000/svg"
+    viewBox="0 0 18 18"
+    width="18"
+    height="18"
+    className="euiIcon engineIcon"
+    aria-hidden="true"
+  >
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M4 9a5.002 5.002 0 005 5 5 5 0 10-5-5zm5.506 1.653L8.37 12.697a3.751 3.751 0 01-.003-7.394L7.402 7.04a1.625 1.625 0 00.519 2.142l1.465.976a.375.375 0 01.12.495zm1.092.607l-.777 1.4a3.751 3.751 0 00-.04-7.329L8.494 7.647a.375.375 0 00.12.495l1.465.976c.705.47.93 1.402.52 2.142z"
+    />
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M6.5 1.375A5.125 5.125 0 001.375 6.5v5A5.125 5.125 0 006.5 16.625h5a5.125 5.125 0 005.125-5.125v-5A5.125 5.125 0 0011.5 1.375h-5zM2.625 6.5A3.875 3.875 0 016.5 2.625h5A3.875 3.875 0 0115.375 6.5v5a3.875 3.875 0 01-3.875 3.875h-5A3.875 3.875 0 012.625 11.5v-5z"
+    />
+  </svg>
+);
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/engine_overview.scss b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/engine_overview.scss
index e39bbbc95564b4..5e8a20ba425add 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/engine_overview.scss
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/engine_overview.scss
@@ -15,6 +15,8 @@
 .engineIcon {
   display: inline-block;
   width: $euiSize;
-  height: $euiSize;
+  // Use line-height of EuiTitle - SVG will vertically center accordingly
+  height: map-get(map-get($euiTitles, 's'), 'line-height');
+  vertical-align: top;
   margin-right: $euiSizeXS;
 }
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/engine_overview.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/engine_overview.tsx
index c3b47b2b585bd4..9703fde7e140af 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/engine_overview.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/engine_overview.tsx
@@ -20,8 +20,8 @@ import { FlashMessages } from '../../../shared/flash_messages';
 import { LicenseContext, ILicenseContext, hasPlatinumLicense } from '../../../shared/licensing';
 import { KibanaContext, IKibanaContext } from '../../../index';
 
-import EnginesIcon from '../../assets/engine.svg';
-import MetaEnginesIcon from '../../assets/meta_engine.svg';
+import { EngineIcon } from './assets/engine_icon';
+import { MetaEngineIcon } from './assets/meta_engine_icon';
 
 import { EngineOverviewHeader, LoadingState, EmptyState } from './components';
 import { EngineTable } from './engine_table';
@@ -93,7 +93,7 @@ export const EngineOverview: React.FC = () => {
         <EuiPageContentHeader>
           <EuiTitle size="s">
             <h2>
-              <img src={EnginesIcon} alt="" className="engineIcon" />
+              <EngineIcon />
               <FormattedMessage
                 id="xpack.enterpriseSearch.appSearch.enginesOverview.engines"
                 defaultMessage="Engines"
@@ -118,7 +118,7 @@ export const EngineOverview: React.FC = () => {
             <EuiPageContentHeader>
               <EuiTitle size="s">
                 <h2>
-                  <img src={MetaEnginesIcon} alt="" className="engineIcon" />
+                  <MetaEngineIcon />
                   <FormattedMessage
                     id="xpack.enterpriseSearch.appSearch.enginesOverview.metaEngines"
                     defaultMessage="Meta Engines"
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/assets/getting_started.png b/x-pack/plugins/enterprise_search/public/applications/app_search/components/setup_guide/assets/getting_started.png
similarity index 100%
rename from x-pack/plugins/enterprise_search/public/applications/app_search/assets/getting_started.png
rename to x-pack/plugins/enterprise_search/public/applications/app_search/components/setup_guide/assets/getting_started.png
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/setup_guide/setup_guide.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/setup_guide/setup_guide.tsx
index 204f355c7a31a9..12a1be3b3e4bd6 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/setup_guide/setup_guide.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/setup_guide/setup_guide.tsx
@@ -13,7 +13,7 @@ import { APP_SEARCH_PLUGIN } from '../../../../../common/constants';
 import { SetupGuide as SetupGuideLayout } from '../../../shared/setup_guide';
 import { SetAppSearchChrome as SetPageChrome } from '../../../shared/kibana_chrome';
 import { SendAppSearchTelemetry as SendTelemetry } from '../../../shared/telemetry';
-import GettingStarted from '../../assets/getting_started.png';
+import GettingStarted from './assets/getting_started.png';
 
 export const SetupGuide: React.FC = () => (
   <SetupGuideLayout
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx
index 6575e44f509ebc..c4a366930d22aa 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/index.tsx
@@ -29,6 +29,7 @@ import {
 
 import { SetupGuide } from './components/setup_guide';
 import { ErrorConnecting } from './components/error_connecting';
+import { NotFound } from '../shared/not_found';
 import { EngineOverview } from './components/engine_overview';
 
 export const AppSearch: React.FC<IInitialAppData> = (props) => {
@@ -73,6 +74,9 @@ export const AppSearchConfigured: React.FC<IInitialAppData> = (props) => {
               <Route exact path={ENGINES_PATH}>
                 <EngineOverview />
               </Route>
+              <Route>
+                <NotFound product={APP_SEARCH_PLUGIN} />
+              </Route>
             </Switch>
           )}
         </Layout>
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/licensing/index.ts b/x-pack/plugins/enterprise_search/public/applications/shared/licensing/index.ts
index 9c8c1417d48db2..29c11ffa1cef8c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/licensing/index.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/licensing/index.ts
@@ -5,4 +5,4 @@
  */
 
 export { LicenseContext, LicenseProvider, ILicenseContext } from './license_context';
-export { hasPlatinumLicense } from './license_checks';
+export { hasPlatinumLicense, hasGoldLicense } from './license_checks';
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/licensing/license_checks.test.ts b/x-pack/plugins/enterprise_search/public/applications/shared/licensing/license_checks.test.ts
index ad134e7d36b10c..40f0f6380c21cd 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/licensing/license_checks.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/licensing/license_checks.test.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { hasPlatinumLicense } from './license_checks';
+import { hasPlatinumLicense, hasGoldLicense } from './license_checks';
 
 describe('hasPlatinumLicense', () => {
   it('is true for platinum licenses', () => {
@@ -31,3 +31,24 @@ describe('hasPlatinumLicense', () => {
     expect(hasPlatinumLicense({ isActive: true, type: 'gold' } as any)).toEqual(false);
   });
 });
+
+describe('hasGoldLicense', () => {
+  it('is true for gold+ and trial licenses', () => {
+    expect(hasGoldLicense({ isActive: true, type: 'gold' } as any)).toEqual(true);
+    expect(hasGoldLicense({ isActive: true, type: 'platinum' } as any)).toEqual(true);
+    expect(hasGoldLicense({ isActive: true, type: 'enterprise' } as any)).toEqual(true);
+    expect(hasGoldLicense({ isActive: true, type: 'trial' } as any)).toEqual(true);
+  });
+
+  it('is false if the current license is expired', () => {
+    expect(hasGoldLicense({ isActive: false, type: 'gold' } as any)).toEqual(false);
+    expect(hasGoldLicense({ isActive: false, type: 'platinum' } as any)).toEqual(false);
+    expect(hasGoldLicense({ isActive: false, type: 'enterprise' } as any)).toEqual(false);
+    expect(hasGoldLicense({ isActive: false, type: 'trial' } as any)).toEqual(false);
+  });
+
+  it('is false for licenses below gold', () => {
+    expect(hasGoldLicense({ isActive: true, type: 'basic' } as any)).toEqual(false);
+    expect(hasGoldLicense({ isActive: false, type: 'standard' } as any)).toEqual(false);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/licensing/license_checks.ts b/x-pack/plugins/enterprise_search/public/applications/shared/licensing/license_checks.ts
index de4a17ce2bd3c1..d13d0909243be7 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/licensing/license_checks.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/licensing/license_checks.ts
@@ -7,5 +7,11 @@
 import { ILicense } from '../../../../../licensing/public';
 
 export const hasPlatinumLicense = (license?: ILicense) => {
-  return license?.isActive && ['platinum', 'enterprise', 'trial'].includes(license?.type as string);
+  const qualifyingLicenses = ['platinum', 'enterprise', 'trial'];
+  return license?.isActive && qualifyingLicenses.includes(license?.type as string);
+};
+
+export const hasGoldLicense = (license?: ILicense) => {
+  const qualifyingLicenses = ['gold', 'platinum', 'enterprise', 'trial'];
+  return license?.isActive && qualifyingLicenses.includes(license?.type as string);
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/not_found/assets/app_search_logo.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/assets/app_search_logo.tsx
new file mode 100644
index 00000000000000..6bd0486532576d
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/assets/app_search_logo.tsx
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+export const AppSearchLogo: React.FC = () => (
+  <svg
+    xmlns="http://www.w3.org/2000/svg"
+    width="136"
+    height="136"
+    viewBox="0 0 136 136"
+    className="logo404"
+    aria-hidden="true"
+  >
+    <rect x="1" y="1" width="134" height="134" rx="67" strokeWidth="2" strokeDasharray="8 4" />
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M105.305 43.282l2.934-1.692c3.015 3.693 4.761 8.35 4.761 13.267V82.57a21 21 0 01-10.5 18.186L80 113.747V73.934c0-4.93-1.753-9.588-4.774-13.284l30.079-17.367zM66.5 55.747A21 21 0 0056 73.933v39.817l-22.5-12.993A21.001 21.001 0 0123 82.57V54.86c0-7.503 4.002-14.44 10.5-18.19l1.478-.853.022.014 33 19.05-1.5.867z"
+      className="logo404__light"
+    />
+    <path
+      d="M78.5 22.813a21.007 21.007 0 00-21 0L35 35.83l33 19.05 33.001-19.05-22.5-13.017z"
+      fillRule="evenodd"
+      clipRule="evenodd"
+      className="logo404__dark"
+    />
+  </svg>
+);
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/not_found/assets/logo.scss b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/assets/logo.scss
new file mode 100644
index 00000000000000..322e6a4182c5c1
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/assets/logo.scss
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+.logo404 {
+  width: $euiSize * 8;
+  height: $euiSize * 8;
+
+  fill: $euiColorEmptyShade;
+  stroke: $euiColorLightShade;
+
+  &__light {
+    fill: $euiColorLightShade;
+  }
+
+  &__dark {
+    fill: $euiColorMediumShade;
+  }
+}
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/not_found/assets/workplace_search_logo.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/assets/workplace_search_logo.tsx
new file mode 100644
index 00000000000000..30bcf9ad2d7fda
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/assets/workplace_search_logo.tsx
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+export const WorkplaceSearchLogo: React.FC = () => (
+  <svg
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+    width="137"
+    height="137"
+    viewBox="0 0 137 137"
+    className="logo404"
+    aria-hidden="true"
+  >
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M136.886 72.486l-1.997-.115a67.11 67.11 0 000-7.742l1.997-.115a69.278 69.278 0 010 7.972zm-.343-11.943l-1.987.23a66.084 66.084 0 00-1.335-7.617l1.947-.46a68.478 68.478 0 011.375 7.847zm-2.404-11.696l-1.916.573a65.939 65.939 0 00-2.645-7.265l1.836-.794a67.996 67.996 0 012.725 7.486zm-4.412-11.096l-1.786.899a66.668 66.668 0 00-3.873-6.694l1.67-1.101a68.365 68.365 0 013.989 6.896zm-6.278-10.158l-1.603 1.195a66.966 66.966 0 00-4.975-5.923l1.454-1.372a68.733 68.733 0 015.124 6.1zm-7.941-8.918l-1.373 1.454a66.818 66.818 0 00-5.924-4.975l1.196-1.603a68.803 68.803 0 016.101 5.124zm-9.363-7.413l-1.101 1.67A66.34 66.34 0 0098.35 9.06l.9-1.786a68.38 68.38 0 016.895 3.99zM95.638 5.586l-.793 1.836a66 66 0 00-7.265-2.645l.573-1.916a67.995 67.995 0 017.485 2.725zM84.304 1.832l-.46 1.947a66.263 66.263 0 00-7.617-1.335l.23-1.987c2.665.309 5.284.77 7.847 1.375zM72.486.114l-.115 1.997a67.582 67.582 0 00-7.742 0L64.514.114a69.582 69.582 0 017.972 0zM60.543.457l.23 1.987c-2.588.3-5.13.747-7.617 1.335l-.46-1.947A68.267 68.267 0 0160.543.457zM48.847 2.861l.573 1.916a65.986 65.986 0 00-7.265 2.645l-.794-1.836a67.995 67.995 0 017.486-2.725zM37.75 7.273l.899 1.786a66.406 66.406 0 00-6.694 3.873l-1.101-1.67a68.42 68.42 0 016.896-3.99zM27.593 13.55l1.195 1.603a66.85 66.85 0 00-5.923 4.975l-1.372-1.454a68.853 68.853 0 016.1-5.124zm-8.918 7.941l1.454 1.373a66.866 66.866 0 00-4.975 5.924l-1.603-1.196a68.855 68.855 0 015.124-6.1zm-7.413 9.363l1.67 1.1A66.423 66.423 0 009.06 38.65l-1.786-.9a68.424 68.424 0 013.99-6.895zM5.586 41.361l1.836.794a66 66 0 00-2.645 7.265l-1.916-.573a67.995 67.995 0 012.725-7.486zM1.832 52.697l1.947.46a66.263 66.263 0 00-1.335 7.617l-1.987-.23c.309-2.665.77-5.284 1.375-7.847zM.114 64.514a69.582 69.582 0 000 7.972l1.997-.115a67.582 67.582 0 010-7.742l-1.997-.115zm.343 11.943l1.987-.23c.3 2.588.747 5.13 1.335 7.617l-1.947.46a68.267 68.267 0 01-1.375-7.847zm2.404 11.696l1.916-.573a66 66 0 002.645 7.266l-1.836.792a67.995 67.995 0 01-2.725-7.485zM7.273 99.25l1.786-.898a66.323 66.323 0 003.873 6.693l-1.67 1.101a68.378 68.378 0 01-3.99-6.895zm6.278 10.158l1.603-1.196a66.801 66.801 0 004.975 5.924l-1.454 1.373a68.803 68.803 0 01-5.124-6.101zm7.941 8.918l1.373-1.454a66.966 66.966 0 005.924 4.975l-1.196 1.603a68.734 68.734 0 01-6.1-5.124zm9.363 7.413l1.1-1.67a66.668 66.668 0 006.695 3.873l-.9 1.786a68.354 68.354 0 01-6.895-3.989zm10.506 5.676l.794-1.836a65.953 65.953 0 007.265 2.645l-.573 1.916a67.996 67.996 0 01-7.486-2.725zm11.335 3.754l.46-1.947a66.084 66.084 0 007.617 1.335l-.23 1.987a68.478 68.478 0 01-7.847-1.375zm11.818 1.718l.115-1.997a67.11 67.11 0 007.742 0l.115 1.997a69.278 69.278 0 01-7.972 0zm11.943-.343l-.23-1.987a66.084 66.084 0 007.617-1.335l.46 1.947a68.478 68.478 0 01-7.847 1.375zm11.696-2.404l-.573-1.916a65.953 65.953 0 007.266-2.645l.792 1.836a67.996 67.996 0 01-7.485 2.725zm11.096-4.412l-.898-1.786a66.584 66.584 0 006.693-3.873l1.101 1.67a68.31 68.31 0 01-6.895 3.989zm10.158-6.278l-1.196-1.603a66.918 66.918 0 005.924-4.975l1.373 1.454a68.682 68.682 0 01-6.101 5.124zm8.918-7.941l-1.454-1.373a66.918 66.918 0 004.975-5.924l1.603 1.196a68.682 68.682 0 01-5.124 6.101zm7.413-9.363l-1.67-1.101a66.584 66.584 0 003.873-6.694l1.786.9a68.31 68.31 0 01-3.989 6.895zm5.676-10.507l-1.836-.793a65.953 65.953 0 002.645-7.265l1.916.573a67.996 67.996 0 01-2.725 7.485zm3.754-11.334l-1.947-.46a66.084 66.084 0 001.335-7.617l1.987.23a68.478 68.478 0 01-1.375 7.847zM72.406 44.047c.372-.442 1-1.12 1.881-2.034 2.332-2.413 7.462-6.825 11.778-6.825h13.56v65.624H86.062c-4.313 0-8.739-3.17-11.775-6.794l-1.671-2.301 6.016-7.606c7.573-9.573 7.575-22.601.002-32.172l-6.228-7.892z"
+      className="logo404__light"
+    />
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M38.375 100.812V35.188h12.71c3.74 0 7.328 1.719 9.596 4.593l12.808 16.232c5.683 7.181 5.683 16.839-.005 24.025L60.677 96.232c-2.269 2.868-5.852 4.58-9.582 4.58h-12.72z"
+      className="logo404__light"
+    />
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M67.653 87.447l-7.075-6.978c-6.274-7.258-6.274-17.981.005-24.767 3.357-3.585 5.711-5.946 7.065-7.083l5.84 7.083c5.77 7.405 5.634 17.471-.135 24.88l-5.703 6.863.002.002z"
+      className="logo404__dark"
+    />
+  </svg>
+);
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/not_found/index.ts b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/index.ts
new file mode 100644
index 00000000000000..dcc7762b932141
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { NotFound } from './not_found';
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/not_found/not_found.test.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/not_found.test.tsx
new file mode 100644
index 00000000000000..ce9071ad7b9d0c
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/not_found.test.tsx
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import '../../__mocks__/shallow_usecontext.mock';
+
+import React, { useContext } from 'react';
+import { shallow } from 'enzyme';
+
+import { EuiButton as EuiButtonExternal, EuiEmptyPrompt } from '@elastic/eui';
+
+import { APP_SEARCH_PLUGIN, WORKPLACE_SEARCH_PLUGIN } from '../../../../common/constants';
+import { AppSearchLogo } from './assets/app_search_logo';
+import { WorkplaceSearchLogo } from './assets/workplace_search_logo';
+
+import { NotFound } from './';
+
+describe('NotFound', () => {
+  const basicLicense = { isActive: true, type: 'basic' };
+  const goldLicense = { isActive: true, type: 'gold' };
+
+  beforeEach(() => {
+    (useContext as jest.Mock).mockImplementation(() => ({ license: basicLicense }));
+  });
+
+  it('renders an App Search 404 view', () => {
+    const wrapper = shallow(<NotFound product={APP_SEARCH_PLUGIN} />);
+    const prompt = wrapper.find(EuiEmptyPrompt).dive().shallow();
+
+    expect(prompt.find('h2').text()).toEqual('404 error');
+    expect(prompt.find(EuiButtonExternal).prop('href')).toEqual(APP_SEARCH_PLUGIN.SUPPORT_URL);
+
+    const logo = prompt.find(AppSearchLogo).dive().shallow();
+    expect(logo.type()).toEqual('svg');
+  });
+
+  it('renders a Workplace Search 404 view', () => {
+    const wrapper = shallow(<NotFound product={WORKPLACE_SEARCH_PLUGIN} />);
+    const prompt = wrapper.find(EuiEmptyPrompt).dive().shallow();
+
+    expect(prompt.find('h2').text()).toEqual('404 error');
+    expect(prompt.find(EuiButtonExternal).prop('href')).toEqual(
+      WORKPLACE_SEARCH_PLUGIN.SUPPORT_URL
+    );
+
+    const logo = prompt.find(WorkplaceSearchLogo).dive().shallow();
+    expect(logo.type()).toEqual('svg');
+  });
+
+  it('changes the support URL if the user has a gold+ license', () => {
+    (useContext as jest.Mock).mockImplementation(() => ({ license: goldLicense }));
+    const wrapper = shallow(<NotFound product={APP_SEARCH_PLUGIN} />);
+    const prompt = wrapper.find(EuiEmptyPrompt).dive().shallow();
+
+    expect(prompt.find(EuiButtonExternal).prop('href')).toEqual('https://support.elastic.co');
+  });
+
+  it('does not render anything without a valid product', () => {
+    const wrapper = shallow(<NotFound product={undefined as any} />);
+
+    expect(wrapper.isEmptyRender()).toBe(true);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/not_found/not_found.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/not_found.tsx
new file mode 100644
index 00000000000000..bd988854225fbd
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/not_found/not_found.tsx
@@ -0,0 +1,110 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useContext } from 'react';
+import { i18n } from '@kbn/i18n';
+import {
+  EuiPageContent,
+  EuiEmptyPrompt,
+  EuiTitle,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButton as EuiButtonExternal,
+} from '@elastic/eui';
+
+import {
+  APP_SEARCH_PLUGIN,
+  WORKPLACE_SEARCH_PLUGIN,
+  LICENSED_SUPPORT_URL,
+} from '../../../../common/constants';
+
+import { EuiButton } from '../react_router_helpers';
+import { SetAppSearchChrome, SetWorkplaceSearchChrome } from '../kibana_chrome';
+import { SendAppSearchTelemetry, SendWorkplaceSearchTelemetry } from '../telemetry';
+import { LicenseContext, ILicenseContext, hasGoldLicense } from '../licensing';
+
+import { AppSearchLogo } from './assets/app_search_logo';
+import { WorkplaceSearchLogo } from './assets/workplace_search_logo';
+import './assets/logo.scss';
+
+interface NotFoundProps {
+  // Expects product plugin constants (@see common/constants.ts)
+  product: {
+    ID: string;
+    SUPPORT_URL: string;
+  };
+}
+
+export const NotFound: React.FC<NotFoundProps> = ({ product = {} }) => {
+  const { license } = useContext(LicenseContext) as ILicenseContext;
+  const supportUrl = hasGoldLicense(license) ? LICENSED_SUPPORT_URL : product.SUPPORT_URL;
+
+  let Logo;
+  let SetPageChrome;
+  let SendTelemetry;
+
+  switch (product.ID) {
+    case APP_SEARCH_PLUGIN.ID:
+      Logo = AppSearchLogo;
+      SetPageChrome = SetAppSearchChrome;
+      SendTelemetry = SendAppSearchTelemetry;
+      break;
+    case WORKPLACE_SEARCH_PLUGIN.ID:
+      Logo = WorkplaceSearchLogo;
+      SetPageChrome = SetWorkplaceSearchChrome;
+      SendTelemetry = SendWorkplaceSearchTelemetry;
+      break;
+    default:
+      return null;
+  }
+
+  return (
+    <>
+      <SetPageChrome isRoot />
+      <SendTelemetry action="error" metric="not_found" />
+
+      <EuiPageContent>
+        <EuiEmptyPrompt
+          title={<Logo />}
+          body={
+            <>
+              <EuiTitle>
+                <h2>
+                  {i18n.translate('xpack.enterpriseSearch.notFound.title', {
+                    defaultMessage: '404 error',
+                  })}
+                </h2>
+              </EuiTitle>
+              <p>
+                {i18n.translate('xpack.enterpriseSearch.notFound.description', {
+                  defaultMessage: 'The page you’re looking for was not found.',
+                })}
+              </p>
+            </>
+          }
+          actions={
+            <EuiFlexGroup>
+              <EuiFlexItem>
+                <EuiButton to="/" color="primary" fill>
+                  {i18n.translate('xpack.enterpriseSearch.notFound.action1', {
+                    defaultMessage: 'Back to your dashboard',
+                  })}
+                </EuiButton>
+              </EuiFlexItem>
+              <EuiFlexItem>
+                <EuiButtonExternal href={supportUrl} target="_blank">
+                  {i18n.translate('xpack.enterpriseSearch.notFound.action2', {
+                    defaultMessage: 'Contact support',
+                  })}
+                </EuiButtonExternal>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          }
+        />
+      </EuiPageContent>
+    </>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/__mocks__/content_sources.mock.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/__mocks__/content_sources.mock.ts
new file mode 100644
index 00000000000000..7789d0caba3458
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/__mocks__/content_sources.mock.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const contentSources = [
+  {
+    id: '123',
+    serviceType: 'custom',
+    searchable: true,
+    supportedByLicense: true,
+    status: 'foo',
+    statusMessage: 'bar',
+    name: 'source',
+    documentCount: '123',
+    isFederatedSource: false,
+    errorReason: 0,
+    allowsReauth: true,
+    boost: 1,
+  },
+  {
+    id: '123',
+    serviceType: 'jira',
+    searchable: true,
+    supportedByLicense: true,
+    status: 'synced',
+    statusMessage: 'all green',
+    name: 'Jira',
+    documentCount: '34234',
+    isFederatedSource: false,
+    errorReason: 0,
+    allowsReauth: true,
+    boost: 0.5,
+  },
+];
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/__mocks__/users.mock.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/__mocks__/users.mock.ts
new file mode 100644
index 00000000000000..0294803042ada7
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/__mocks__/users.mock.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const users = [
+  {
+    id: '1z1z',
+    name: 'John Does',
+    pictureUrl: 'http://google.cats',
+    color: '#ededed',
+    initials: 'JD',
+    email: 'jd@elastic.co',
+    groupIds: [],
+  },
+];
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/assets/logo.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/assets/logo.svg
deleted file mode 100644
index e6b987c3982686..00000000000000
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/assets/logo.svg
+++ /dev/null
@@ -1,5 +0,0 @@
-<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
-  <path d="M21.1882 8.03747L18.8672 5.09605C18.9491 5.00964 19.0388 4.91586 19.1365 4.81452C19.6347 4.29902 20.4324 3.57073 21.3224 2.9792C22.242 2.368 23.1165 2 23.801 2H29V30H23.8C22.2799 30 20.5224 28.8398 19.2054 27.2777L18.9076 26.8678L21.1873 23.9854C21.1873 23.9854 21.1873 23.9854 21.1873 23.9853C24.9367 19.2461 24.9381 12.7767 21.1886 8.03797C21.1885 8.0378 21.1883 8.03763 21.1882 8.03747Z" stroke="#017D73" stroke-width="2"/>
-  <path d="M17.267 11.1395L17.2678 11.1406C19.5779 14.0598 19.5782 17.9609 17.2659 20.8824L17.2657 20.8827L11.4107 28.2856C11.4107 28.2856 11.4107 28.2857 11.4107 28.2857C10.5677 29.3513 9.22146 30 7.815 30H3V2H7.81C9.22095 2 10.5689 2.65129 11.412 3.71946C11.412 3.71947 11.412 3.71949 11.412 3.71951L17.267 11.1395Z" stroke="#343741" stroke-width="2"/>
-  <path d="M17.2105 21.1254L15.31 23.4123L12.8814 21.0168C10.3527 18.0627 10.3903 13.7569 12.884 11.0593C13.898 9.97667 14.6939 9.15785 15.2809 8.58921L17.2714 11.0032C19.6073 14.0114 19.5622 18.094 17.2105 21.1254Z" stroke="#343741" stroke-width="2"/>
-</svg>
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/box.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/box.svg
new file mode 100644
index 00000000000000..1e7324d9581a78
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/box.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg"><g fill="#29ace3" fill-rule="evenodd" transform="translate(14 31)"><path d="m37.16568 32.6140377c-4.45176 0-8.06112-3.5913585-8.06112-8.0237358 0-4.4287925 3.60936-8.019434 8.06112-8.019434 4.4496 0 8.0568 3.5906415 8.0568 8.019434 0 4.4323773-3.6072 8.0237358-8.0568 8.0237358zm-23.7348 0c-4.45032 0-8.06184-3.5899245-8.06184-8.0223019 0-4.4302264 3.61152-8.0208679 8.06184-8.0208679s8.05464 3.5906415 8.05464 8.019434c0 4.4323773-3.60432 8.0237358-8.05464 8.0237358zm23.7348-21.3983019c-5.1408 0-9.61344 2.8793963-11.86632 7.106717-2.2536-4.2273207-6.72408-7.106717-11.86848-7.106717-3.0204 0-5.81112.9951699-8.06184 2.6757736v-11.2695094c-.02664-1.45690566-1.21968-2.622-2.68704-2.622s-2.64816 1.16509434-2.682 2.622v22.191283h.00288c.11808 7.2866793 6.08112 13.1558868 13.428 13.1558868 5.1444 0 9.61488-2.8815472 11.86848-7.104566 2.25288 4.2230188 6.72552 7.104566 11.86632 7.104566 7.416 0 13.43232-5.9882264 13.43232-13.3788679 0-7.3870566-6.01632-13.3745661-13.43232-13.3745661z"/><path d="m71.44128 33.4909057-7.30152-8.9178114 7.31088-8.9357358c.92376-1.178717.6588-2.8249057-.61704-3.6996227-1.27728-.8818867-3.07008-.6553207-4.05864.4882642v-.0021509l-6.2892 7.676-6.28344-7.676v.0021509c-.97848-1.1435849-2.78208-1.3701509-4.05576-.4882642-1.27368.875434-1.53936 2.5209057-.61056 3.6996227h-.00288l7.2972 8.9357358-7.2972 8.9178114h.00288c-.9288 1.1823018-.66312 2.8234717.61056 3.7017735 1.27368.8783019 3.07728.6546038 4.05576-.491132l6.28344-7.6652453 6.28056 7.6652453c.98928 1.1457358 2.78136 1.3694339 4.05864.491132 1.27656-.8783018 1.54224-2.5194717.61632-3.7017735z"/></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/confluence.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/confluence.svg
new file mode 100644
index 00000000000000..23eff13915401d
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/confluence.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><linearGradient id="a"><stop offset=".18" stop-color="#0052cc"/><stop offset="1" stop-color="#2684ff"/></linearGradient><linearGradient id="b" x1="99.14%" x2="33.859%" xlink:href="#a" y1="112.708%" y2="37.755%"/><linearGradient id="c" x1="7053.827%" x2="6067.181%" xlink:href="#a" y1="-161634%" y2="-163895%"/><g fill="none" transform="translate(18 20)"><path d="m3.23 46.53c-.65 1.06-1.38 2.29-2 3.27-.55494813.9377932-.25702976 2.1472528.67 2.72l13 8c.4563267.2817439 1.0066877.3684166 1.5275199.2405589.5208321-.1278577.9684941-.4595324 1.2424801-.9205589.52-.87 1.19-2 1.92-3.21 5.15-8.5 10.33-7.46 19.67-3l12.89 6.13c.48819.2323645 1.0496589.2571765 1.5564427.068781.5067839-.1883955.9157017-.573946 1.1335573-1.068781l6.19-14c.4373336-.9998956-.0076609-2.165781-1-2.62-2.72-1.28-8.13-3.83-13-6.18-17.52-8.51-32.41-7.96-43.8 10.57z" fill="url(#b)"/><path d="m61.52 14.76c.65-1.06 1.38-2.29 2-3.27.5549481-.9377932.2570298-2.14725284-.67-2.72l-13-8c-.4600501-.30985835-1.0281196-.4147483-1.5684887-.28961019s-1.0045021.46906442-1.2815113.94961019c-.52.87-1.19 2-1.92 3.21-5.15 8.5-10.33 7.46-19.67 3l-12.85-6.1c-.48819-.23236451-1.0496589-.25717646-1.5564427-.06878099-.5067839.18839548-.9157017.57394602-1.1335573 1.06878099l-6.19 14c-.43733358.9998956.00766087 2.165781 1 2.62 2.72 1.28 8.13 3.83 13 6.18 17.56 8.5 32.45 7.93 43.84-10.58z" fill="url(#c)"/></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/connection_illustration.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/connection_illustration.svg
new file mode 100644
index 00000000000000..c1c3c3b3ee9eeb
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/connection_illustration.svg
@@ -0,0 +1 @@
+<svg width="398" height="552" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="#22272D" d="M0 0h398v552H0z"/><mask id="a" mask-type="alpha" maskUnits="userSpaceOnUse" x="0" y="0" width="398" height="552"><path d="M0 4a4 4 0 014-4h394v552H4a4 4 0 01-4-4V4z" fill="#22272D"/></mask><g mask="url(#a)"><path d="M197 471.611l89.25 48.346L197 568.303l-89.25-48.346L197 471.611z" fill="#171A1F"/><path d="M197 471.611l89.25 48.346L197 568.303v-96.692z" fill="#2E353D"/><path d="M245.75 445.904L335 494.25l-48.75 25.846L197 471.75l48.75-25.846zM148.25 445.904L59 494.25l48.75 25.846L197 471.75l-48.75-25.846z" fill="#3D434B"/><g filter="url(#filter0_d)"><path d="M131 409h105c13.807 0 25 11.193 25 25v20H156c-13.807 0-25-11.193-25-25v-20z" fill="#696F76"/></g><g filter="url(#filter1_d)"><path d="M131 462h105c13.807 0 25 11.193 25 25v20H156c-13.807 0-25-11.193-25-25v-20z" fill="#696F76"/></g><g filter="url(#filter2_d)"><path d="M131 515h105c13.807 0 25 11.193 25 25v20H156c-13.807 0-25-11.193-25-25v-20z" fill="#696F76"/></g><g filter="url(#filter3_d)" fill="#fff"><path d="M167.835 428.192h2.505c-.036-2.203-1.847-3.725-4.6-3.725-2.711 0-4.697 1.498-4.685 3.743-.006 1.823 1.28 2.868 3.369 3.369l1.346.338c1.346.326 2.095.712 2.101 1.545-.006.906-.863 1.522-2.192 1.522-1.358 0-2.336-.628-2.42-1.866h-2.53c.067 2.675 1.98 4.057 4.981 4.057 3.018 0 4.793-1.443 4.799-3.707-.006-2.058-1.558-3.151-3.707-3.634l-1.111-.265c-1.074-.248-1.974-.646-1.955-1.534 0-.797.706-1.382 1.986-1.382 1.249 0 2.016.567 2.113 1.539zM176.329 437.181c2.813 0 4.563-1.926 4.563-4.781 0-2.874-1.75-4.793-4.563-4.793-2.814 0-4.564 1.919-4.564 4.793 0 2.855 1.75 4.781 4.564 4.781zm.012-1.992c-1.298 0-1.962-1.189-1.962-2.807 0-1.618.664-2.813 1.962-2.813 1.273 0 1.937 1.195 1.937 2.813s-.664 2.807-1.937 2.807zM188.431 433.052c.006 1.243-.845 1.895-1.769 1.895-.972 0-1.6-.682-1.606-1.774v-5.446h-2.571v5.904c.006 2.168 1.273 3.49 3.139 3.49 1.394 0 2.397-.719 2.813-1.805h.097V437h2.469v-9.273h-2.572v5.325zM192.98 437h2.572v-5.246c0-1.141.833-1.926 1.968-1.926.356 0 .845.061 1.086.139v-2.282a3.876 3.876 0 00-.809-.091c-1.038 0-1.889.604-2.227 1.751h-.097v-1.618h-2.493V437zM203.614 437.181c2.469 0 4.021-1.449 4.141-3.58h-2.427c-.15.99-.802 1.546-1.684 1.546-1.201 0-1.98-1.008-1.98-2.783 0-1.751.785-2.753 1.98-2.753.942 0 1.546.622 1.684 1.545h2.427c-.108-2.143-1.732-3.549-4.153-3.549-2.813 0-4.552 1.949-4.552 4.793 0 2.819 1.708 4.781 4.564 4.781zM213.548 437.181c2.294 0 3.839-1.117 4.201-2.837l-2.378-.157c-.26.706-.924 1.074-1.781 1.074-1.286 0-2.101-.851-2.101-2.233v-.006h6.315v-.707c0-3.151-1.908-4.708-4.359-4.708-2.729 0-4.497 1.937-4.497 4.799 0 2.94 1.744 4.775 4.6 4.775zm-2.059-5.753c.054-1.057.857-1.902 1.998-1.902 1.117 0 1.89.797 1.896 1.902h-3.894zM225.436 437l.918-2.819h4.461l.917 2.819h2.802l-4.263-12.364h-3.368L222.635 437h2.801zm1.582-4.86l1.521-4.678h.096l1.522 4.678h-3.139zM168.573 481.192h2.506c-.037-2.203-1.848-3.725-4.6-3.725-2.711 0-4.697 1.498-4.685 3.743-.006 1.823 1.28 2.868 3.368 3.369l1.347.338c1.346.326 2.095.712 2.101 1.545-.006.906-.864 1.522-2.192 1.522-1.358 0-2.336-.628-2.421-1.866h-2.529c.066 2.675 1.98 4.057 4.98 4.057 3.019 0 4.794-1.443 4.8-3.707-.006-2.058-1.558-3.151-3.707-3.634l-1.111-.265c-1.074-.248-1.974-.646-1.956-1.534 0-.797.707-1.382 1.986-1.382 1.25 0 2.017.567 2.113 1.539zM177.067 490.181c2.814 0 4.564-1.926 4.564-4.781 0-2.874-1.75-4.793-4.564-4.793-2.813 0-4.564 1.919-4.564 4.793 0 2.855 1.751 4.781 4.564 4.781zm.012-1.992c-1.298 0-1.962-1.189-1.962-2.807 0-1.618.664-2.813 1.962-2.813 1.274 0 1.938 1.195 1.938 2.813s-.664 2.807-1.938 2.807zM189.17 486.052c.006 1.243-.845 1.895-1.769 1.895-.972 0-1.6-.682-1.606-1.774v-5.446h-2.572v5.904c.007 2.168 1.274 3.49 3.14 3.49 1.394 0 2.396-.719 2.813-1.805h.096V490h2.47v-9.273h-2.572v5.325zM193.719 490h2.571v-5.246c0-1.141.833-1.926 1.968-1.926.357 0 .846.061 1.087.139v-2.282a3.876 3.876 0 00-.809-.091c-1.038 0-1.889.604-2.227 1.751h-.097v-1.618h-2.493V490zM204.353 490.181c2.469 0 4.02-1.449 4.141-3.58h-2.427c-.151.99-.803 1.546-1.684 1.546-1.201 0-1.98-1.008-1.98-2.783 0-1.751.785-2.753 1.98-2.753.942 0 1.545.622 1.684 1.545h2.427c-.109-2.143-1.733-3.549-4.153-3.549-2.814 0-4.552 1.949-4.552 4.793 0 2.819 1.708 4.781 4.564 4.781zM214.286 490.181c2.295 0 3.84-1.117 4.202-2.837l-2.378-.157c-.26.706-.924 1.074-1.781 1.074-1.286 0-2.101-.851-2.101-2.233v-.006h6.315v-.707c0-3.151-1.908-4.708-4.359-4.708-2.729 0-4.498 1.937-4.498 4.799 0 2.94 1.745 4.775 4.6 4.775zm-2.058-5.753c.054-1.057.857-1.902 1.998-1.902 1.117 0 1.89.797 1.896 1.902h-3.894zM224.044 490h5.282c2.777 0 4.256-1.449 4.256-3.417 0-1.829-1.31-2.934-2.717-3v-.121c1.286-.29 2.234-1.201 2.234-2.656 0-1.854-1.376-3.17-4.105-3.17h-4.95V490zm2.614-2.137v-3.284h2.191c1.256 0 2.034.724 2.034 1.745 0 .929-.633 1.539-2.094 1.539h-2.131zm0-5.053v-3.061h1.986c1.159 0 1.817.598 1.817 1.491 0 .978-.797 1.57-1.866 1.57h-1.937zM167.801 533.192h2.506c-.037-2.203-1.848-3.725-4.6-3.725-2.711 0-4.697 1.498-4.685 3.743-.006 1.823 1.28 2.868 3.369 3.369l1.346.338c1.346.326 2.095.712 2.101 1.545-.006.906-.864 1.522-2.192 1.522-1.358 0-2.336-.628-2.421-1.866h-2.529c.066 2.675 1.98 4.057 4.98 4.057 3.019 0 4.794-1.443 4.8-3.707-.006-2.058-1.558-3.151-3.707-3.634l-1.111-.265c-1.074-.248-1.974-.646-1.956-1.534 0-.797.707-1.382 1.986-1.382 1.25 0 2.017.567 2.113 1.539zM176.295 542.181c2.814 0 4.564-1.926 4.564-4.781 0-2.874-1.75-4.793-4.564-4.793-2.813 0-4.564 1.919-4.564 4.793 0 2.855 1.751 4.781 4.564 4.781zm.012-1.992c-1.298 0-1.962-1.189-1.962-2.807 0-1.618.664-2.813 1.962-2.813 1.274 0 1.938 1.195 1.938 2.813s-.664 2.807-1.938 2.807zM188.398 538.052c.006 1.243-.845 1.895-1.769 1.895-.972 0-1.6-.682-1.606-1.774v-5.446h-2.572v5.904c.007 2.168 1.274 3.49 3.14 3.49 1.394 0 2.396-.719 2.813-1.805h.096V542h2.47v-9.273h-2.572v5.325zM192.947 542h2.571v-5.246c0-1.141.834-1.926 1.968-1.926.357 0 .846.061 1.087.139v-2.282a3.876 3.876 0 00-.809-.091c-1.038 0-1.889.604-2.227 1.751h-.097v-1.618h-2.493V542zM203.581 542.181c2.469 0 4.02-1.449 4.141-3.58h-2.427c-.151.99-.803 1.546-1.684 1.546-1.201 0-1.98-1.008-1.98-2.783 0-1.751.785-2.753 1.98-2.753.942 0 1.545.622 1.684 1.545h2.427c-.109-2.143-1.733-3.549-4.153-3.549-2.814 0-4.552 1.949-4.552 4.793 0 2.819 1.708 4.781 4.564 4.781zM213.514 542.181c2.295 0 3.84-1.117 4.202-2.837l-2.378-.157c-.26.706-.924 1.074-1.781 1.074-1.286 0-2.101-.851-2.101-2.233v-.006h6.315v-.707c0-3.151-1.908-4.708-4.359-4.708-2.729 0-4.498 1.937-4.498 4.799 0 2.94 1.745 4.775 4.6 4.775zm-2.058-5.753c.054-1.057.857-1.902 1.998-1.902 1.117 0 1.89.797 1.896 1.902h-3.894zM234.18 533.965c-.344-2.856-2.505-4.498-5.366-4.498-3.266 0-5.76 2.306-5.76 6.351 0 4.033 2.451 6.351 5.76 6.351 3.169 0 5.083-2.107 5.366-4.383l-2.644-.012c-.247 1.322-1.286 2.083-2.68 2.083-1.878 0-3.151-1.395-3.151-4.039 0-2.572 1.255-4.039 3.169-4.039 1.431 0 2.463.828 2.662 2.186h2.644z"/></g><path d="M197 568.172l89.25 48.345L197 664.863l-89.25-48.346L197 568.172z" fill="#171A1F"/><path d="M197 568.171l89.25 48.346L197 664.863v-96.692z" fill="#22272D"/><path d="M286.25 519.898L197 568.244l48.75 25.846L335 545.744l-48.75-25.846zM107.75 519.898L197 568.244l-48.75 25.846L59 545.744l48.75-25.846z" fill="#3D434B"/><g filter="url(#filter4_d)"><path fill="#DBE4EE" d="M185.037 259.776h26.925v30.056h-26.925z"/></g><g filter="url(#filter5_d)"><path d="M241.13 289.409l-42.409 42.409-42.409-42.409h84.818z" fill="#fff"/></g><path opacity=".14" d="M210.207 320.332L183.039 347.5l-27.169-27.168h54.337z" fill="#fff"/><g filter="url(#filter6_d)"><path d="M233.841 311.276l-15.131 15.13-15.13-15.13h30.261z" fill="#696F76"/></g><path d="M328 75c0 68.483-55.517 124-124 124S80 143.483 80 75 135.517-49 204-49 328 6.517 328 75z" fill="url(#paint0_linear)"/><g filter="url(#filter7_d)"><path d="M186 219c-68.483 0-124-55.517-124-124h124v124z" fill="#00C8AC"/></g><g filter="url(#filter8_d)"><path d="M294 75c0 48.601-39.399 88-88 88V75h88z" fill="#FFB92F"/></g><g filter="url(#filter9_dd)"><path fill="#fff" d="M38 163h134v33H38z"/></g><g filter="url(#filter10_dd)"><path fill="#fff" d="M225 97h134v33H225z"/></g><path d="M293.567 117.636h1.726l-.157-2.876 2.415 1.584.867-1.506-2.586-1.293 2.586-1.292-.867-1.506-2.415 1.584.157-2.876h-1.726l.163 2.876-2.415-1.584-.866 1.506 2.578 1.292-2.578 1.293.866 1.506 2.415-1.584-.163 2.876zM304.926 117.636h1.726l-.156-2.876 2.415 1.584.866-1.506-2.585-1.293 2.585-1.292-.866-1.506-2.415 1.584.156-2.876h-1.726l.164 2.876-2.415-1.584-.867 1.506 2.578 1.292-2.578 1.293.867 1.506 2.415-1.584-.164 2.876zM316.286 117.636h1.725l-.156-2.876 2.415 1.584.866-1.506-2.585-1.293 2.585-1.292-.866-1.506-2.415 1.584.156-2.876h-1.725l.163 2.876-2.415-1.584-.866 1.506 2.578 1.292-2.578 1.293.866 1.506 2.415-1.584-.163 2.876zM327.645 117.636h1.726l-.156-2.876 2.414 1.584.867-1.506-2.585-1.293 2.585-1.292-.867-1.506-2.414 1.584.156-2.876h-1.726l.163 2.876-2.414-1.584-.867 1.506 2.578 1.292-2.578 1.293.867 1.506 2.414-1.584-.163 2.876zM339.004 117.636h1.726l-.156-2.876 2.415 1.584.866-1.506-2.585-1.293 2.585-1.292-.866-1.506-2.415 1.584.156-2.876h-1.726l.164 2.876-2.415-1.584-.867 1.506 2.579 1.292-2.579 1.293.867 1.506 2.415-1.584-.164 2.876z" fill="#FFB92F"/><path d="M242.408 111.746h2.064c-.03-1.814-1.522-3.067-3.789-3.067-2.232 0-3.868 1.233-3.858 3.082-.005 1.502 1.054 2.362 2.774 2.775l1.109.278c1.109.268 1.725.587 1.73 1.273-.005.745-.711 1.252-1.804 1.252-1.119 0-1.924-.517-1.994-1.536h-2.083c.055 2.203 1.631 3.341 4.101 3.341 2.486 0 3.948-1.188 3.953-3.052-.005-1.696-1.283-2.596-3.053-2.993l-.914-.219c-.885-.204-1.626-.532-1.611-1.263 0-.656.581-1.138 1.635-1.138 1.03 0 1.661.467 1.74 1.267zM249.419 119.149c1.889 0 3.162-.92 3.46-2.337l-1.958-.129c-.214.582-.761.885-1.467.885-1.059 0-1.73-.701-1.73-1.839v-.005h5.2v-.582c0-2.595-1.571-3.878-3.589-3.878-2.247 0-3.704 1.596-3.704 3.953 0 2.421 1.437 3.932 3.788 3.932zm-1.695-4.738c.045-.87.706-1.566 1.645-1.566.92 0 1.557.656 1.562 1.566h-3.207zM257.677 119.149c2.033 0 3.311-1.193 3.41-2.948h-1.999c-.124.815-.661 1.273-1.387 1.273-.989 0-1.63-.831-1.63-2.292 0-1.442.646-2.267 1.63-2.267.776 0 1.273.512 1.387 1.272h1.999c-.089-1.764-1.427-2.923-3.42-2.923-2.317 0-3.749 1.606-3.749 3.948 0 2.321 1.407 3.937 3.759 3.937zM262.363 119h2.118v-4.32c0-.94.686-1.586 1.621-1.586.293 0 .696.049.895.114v-1.879a3.168 3.168 0 00-.667-.075c-.855 0-1.556.497-1.834 1.442h-.08v-1.332h-2.053V119zM271.136 119.149c1.889 0 3.162-.92 3.46-2.337l-1.958-.129c-.214.582-.761.885-1.467.885-1.059 0-1.73-.701-1.73-1.839v-.005h5.2v-.582c0-2.595-1.571-3.878-3.589-3.878-2.247 0-3.704 1.596-3.704 3.953 0 2.421 1.437 3.932 3.788 3.932zm-1.695-4.738c.045-.87.706-1.566 1.645-1.566.92 0 1.557.656 1.562 1.566h-3.207zM280.005 111.364h-1.437v-1.83h-2.118v1.83h-1.044v1.591h1.044v3.977c-.01 1.496 1.01 2.237 2.546 2.172a4.113 4.113 0 001.148-.198l-.333-1.576c-.104.019-.328.069-.527.069-.422 0-.716-.159-.716-.746v-3.698h1.437v-1.591zM282.543 113.785a1.21 1.21 0 001.193-1.193 1.208 1.208 0 00-1.193-1.184 1.189 1.189 0 100 2.377zm0 5.344a1.21 1.21 0 001.193-1.193 1.208 1.208 0 00-1.193-1.183 1.188 1.188 0 100 2.376z" fill="#343741"/><path d="M85.057 184h1.057v-3.409h1.909c.076 0 .149 0 .221-.004L90.085 184h1.227l-1.973-3.605c1.113-.379 1.633-1.287 1.633-2.446 0-1.543-.92-2.676-2.966-2.676h-2.95V184zm1.057-4.364v-3.426h1.858c1.414 0 1.96.691 1.96 1.739s-.546 1.687-1.943 1.687h-1.875zM93.233 184h3.153c2.063 0 2.915-1.006 2.915-2.318 0-1.381-.955-2.131-1.756-2.182v-.085c.75-.205 1.415-.699 1.415-1.824 0-1.279-.852-2.318-2.676-2.318h-3.052V184zm1.056-.938v-3.034h2.148c1.142 0 1.858.767 1.858 1.654 0 .767-.528 1.38-1.909 1.38h-2.097zm0-3.954v-2.898h1.995c1.159 0 1.67.614 1.67 1.381 0 .92-.75 1.517-1.704 1.517h-1.96zM104.282 184.119c1.764.022 2.914-1.308 2.914-2.932 0-1.687-1.248-2.897-2.744-2.897-.899 0-1.67.439-2.148 1.159h-.068c.004-2.144.831-3.375 2.182-3.375.92 0 1.474.579 1.67 1.381h1.04c-.213-1.373-1.244-2.319-2.71-2.319-1.965 0-3.171 1.739-3.171 4.841 0 3.226 1.603 4.125 3.035 4.142zm0-.937c-1.096 0-1.897-.933-1.892-1.977.004-1.044.843-1.978 1.926-1.978 1.069 0 1.858.878 1.858 1.96 0 1.108-.823 1.995-1.892 1.995zM112.151 175.136c-1.773-.017-2.915 1.313-2.915 2.932 0 1.688 1.244 2.898 2.744 2.898.903 0 1.671-.443 2.148-1.159h.068c0 2.148-.835 3.375-2.182 3.375-.92 0-1.483-.58-1.67-1.381h-1.04c.204 1.381 1.244 2.318 2.71 2.318 1.96 0 3.171-1.738 3.171-4.841 0-3.221-1.603-4.125-3.034-4.142zm0 .938c1.09 0 1.892.937 1.892 1.977s-.853 1.977-1.927 1.977c-1.073 0-1.858-.869-1.858-1.96 0-1.108.819-1.994 1.893-1.994zM117.514 184h3.153c2.063 0 2.915-1.006 2.915-2.318 0-1.381-.955-2.131-1.756-2.182v-.085c.75-.205 1.415-.699 1.415-1.824 0-1.279-.852-2.318-2.676-2.318h-3.051V184zm1.057-.938v-3.034h2.147c1.142 0 1.858.767 1.858 1.654 0 .767-.528 1.38-1.909 1.38h-2.096zm0-3.954v-2.898h1.994c1.159 0 1.67.614 1.67 1.381 0 .92-.75 1.517-1.704 1.517h-1.96zM128.392 184.119c1.662 0 2.881-1.227 2.881-2.897 0-1.692-1.176-2.932-2.778-2.932-.588 0-1.159.209-1.517.494h-.052l.307-2.574h3.648v-.937h-4.534l-.529 4.295.989.119c.362-.259.98-.447 1.517-.443 1.112.009 1.926.853 1.926 1.995 0 1.12-.784 1.943-1.858 1.943-.895 0-1.606-.575-1.687-1.364h-1.023c.064 1.33 1.21 2.301 2.71 2.301zM133.977 175.273h-1.108l3.205 8.727h1.091l3.204-8.727h-1.108l-2.591 7.346h-.102l-2.591-7.346zM147.784 178h1.091c-.324-1.688-1.738-2.847-3.579-2.847-2.237 0-3.818 1.722-3.818 4.483 0 2.762 1.568 4.483 3.886 4.483 2.079 0 3.562-1.385 3.562-3.545v-.938h-3.323v.938h2.301c-.03 1.568-1.061 2.557-2.54 2.557-1.619 0-2.864-1.228-2.864-3.495 0-2.267 1.245-3.494 2.796-3.494 1.261 0 2.118.712 2.488 1.858z" fill="#00B8AA"/><path d="M63.038 174.818h-2.153V185h2.153v-10.182zM68.338 185c3.102 0 4.982-1.919 4.982-5.101 0-3.172-1.88-5.081-4.952-5.081h-3.64V185h3.61zm-1.457-1.844v-6.493h1.373c1.909 0 2.918.974 2.918 3.236 0 2.272-1.01 3.257-2.923 3.257H66.88zM76.032 178.825a1.21 1.21 0 001.194-1.193 1.208 1.208 0 00-1.194-1.183 1.188 1.188 0 100 2.376zm0 4.992a1.21 1.21 0 001.194-1.193 1.208 1.208 0 00-1.194-1.184 1.188 1.188 0 100 2.377z" fill="#343741"/><g filter="url(#filter11_d)" fill="#fff"><path d="M96.455 118.492c-.364-3.023-2.653-4.762-5.682-4.762-3.459 0-6.098 2.442-6.098 6.725 0 4.269 2.595 6.724 6.098 6.724 3.355 0 5.382-2.231 5.682-4.641l-2.8-.012c-.262 1.399-1.361 2.205-2.838 2.205-1.988 0-3.336-1.477-3.336-4.276 0-2.723 1.33-4.277 3.356-4.277 1.514 0 2.607.876 2.818 2.314h2.8zM102.745 127.192c2.978 0 4.832-2.039 4.832-5.063 0-3.042-1.854-5.075-4.832-5.075-2.979 0-4.833 2.033-4.833 5.075 0 3.024 1.854 5.063 4.833 5.063zm.013-2.11c-1.375 0-2.078-1.259-2.078-2.972s.703-2.979 2.078-2.979c1.348 0 2.051 1.266 2.051 2.979s-.703 2.972-2.051 2.972zM111.991 121.324c.006-1.266.76-2.007 1.86-2.007 1.093 0 1.751.716 1.745 1.917V127h2.723v-6.251c0-2.289-1.342-3.695-3.388-3.695-1.457 0-2.512.716-2.953 1.86h-.115v-1.732h-2.595V127h2.723v-5.676zM125.665 117.182h-1.95v-.659c0-.664.269-1.054 1.068-1.054.326 0 .658.07.875.14l.48-2.045a7.182 7.182 0 00-1.924-.269c-1.847 0-3.222 1.042-3.222 3.177v.71h-1.387v2.045h1.387V127h2.723v-7.773h1.95v-2.045zM127.248 127h2.723v-9.818h-2.723V127zm1.368-11.084c.812 0 1.477-.62 1.477-1.38 0-.755-.665-1.375-1.477-1.375-.805 0-1.47.62-1.47 1.375 0 .76.665 1.38 1.47 1.38zM136.496 130.822c2.806 0 4.8-1.278 4.8-3.726v-9.914h-2.703v1.649h-.103c-.364-.799-1.163-1.777-2.806-1.777-2.154 0-3.976 1.675-3.976 5.018 0 3.266 1.771 4.787 3.983 4.787 1.566 0 2.441-.786 2.799-1.598h.115v1.797c0 1.284-.863 1.808-2.045 1.808-1.202 0-1.809-.524-2.033-1.054l-2.518.339c.326 1.483 1.841 2.671 4.487 2.671zm.058-6.008c-1.336 0-2.065-1.061-2.065-2.755 0-1.668.716-2.838 2.065-2.838 1.323 0 2.064 1.118 2.064 2.838 0 1.732-.754 2.755-2.064 2.755zM149.679 122.82c.007 1.316-.894 2.007-1.872 2.007-1.03 0-1.694-.723-1.701-1.88v-5.765h-2.723v6.251c.007 2.295 1.349 3.695 3.324 3.695 1.477 0 2.538-.761 2.979-1.911h.102V127h2.614v-9.818h-2.723v5.638zM154.501 127h2.723v-5.555c0-1.208.882-2.039 2.083-2.039.378 0 .895.064 1.151.147v-2.416a4.126 4.126 0 00-.857-.096c-1.099 0-2 .639-2.358 1.854h-.103v-1.713h-2.639V127zM165.803 127.192c2.429 0 4.066-1.183 4.449-3.004l-2.518-.167c-.275.748-.978 1.138-1.886 1.138-1.362 0-2.224-.901-2.224-2.365v-.006h6.686v-.748c0-3.337-2.02-4.986-4.615-4.986-2.89 0-4.763 2.052-4.763 5.082 0 3.113 1.848 5.056 4.871 5.056zm-2.179-6.092c.057-1.118.907-2.013 2.115-2.013 1.183 0 2.001.843 2.007 2.013h-4.122zM131.793 139.492c-.364-3.023-2.652-4.762-5.682-4.762-3.458 0-6.098 2.442-6.098 6.725 0 4.269 2.595 6.724 6.098 6.724 3.356 0 5.382-2.231 5.682-4.641l-2.799-.012c-.263 1.399-1.362 2.205-2.839 2.205-1.987 0-3.336-1.477-3.336-4.276 0-2.723 1.329-4.277 3.356-4.277 1.515 0 2.608.876 2.819 2.314h2.799zM136.37 134.909h-2.723V148h2.723v-13.091zM138.471 148h2.723v-9.818h-2.723V148zm1.368-11.084c.812 0 1.477-.62 1.477-1.38 0-.755-.665-1.375-1.477-1.375-.805 0-1.47.62-1.47 1.375 0 .76.665 1.38 1.47 1.38zM147.77 148.192c2.429 0 4.065-1.183 4.449-3.004l-2.519-.167c-.275.748-.978 1.138-1.885 1.138-1.362 0-2.225-.901-2.225-2.365v-.006h6.686v-.748c0-3.337-2.02-4.986-4.615-4.986-2.889 0-4.762 2.052-4.762 5.082 0 3.113 1.847 5.056 4.871 5.056zm-2.18-6.092c.058-1.118.908-2.013 2.116-2.013 1.182 0 2.001.843 2.007 2.013h-4.123zM156.696 142.324c.007-1.266.761-2.007 1.86-2.007 1.093 0 1.752.716 1.745 1.917V148h2.723v-6.251c0-2.289-1.342-3.695-3.387-3.695-1.458 0-2.512.716-2.954 1.86h-.115v-1.732h-2.595V148h2.723v-5.676zM170.313 138.182h-1.848v-2.352h-2.723v2.352H164.4v2.045h1.342v5.114c-.012 1.924 1.298 2.876 3.273 2.793a5.306 5.306 0 001.477-.255l-.428-2.027c-.135.026-.422.09-.678.09-.543 0-.921-.205-.921-.959v-4.756h1.848v-2.045z"/></g><g filter="url(#filter12_d)" fill="#fff"><path d="M133.837 372.492c-.364-3.023-2.653-4.762-5.682-4.762-3.459 0-6.098 2.442-6.098 6.725 0 4.269 2.595 6.724 6.098 6.724 3.355 0 5.382-2.231 5.682-4.641l-2.8-.012c-.262 1.399-1.361 2.205-2.838 2.205-1.988 0-3.336-1.477-3.336-4.276 0-2.723 1.329-4.277 3.355-4.277 1.515 0 2.608.876 2.819 2.314h2.8zM140.127 381.192c2.978 0 4.832-2.039 4.832-5.063 0-3.042-1.854-5.075-4.832-5.075-2.979 0-4.833 2.033-4.833 5.075 0 3.024 1.854 5.063 4.833 5.063zm.013-2.11c-1.375 0-2.078-1.259-2.078-2.972s.703-2.979 2.078-2.979c1.348 0 2.051 1.266 2.051 2.979s-.703 2.972-2.051 2.972zM149.373 375.324c.006-1.266.76-2.007 1.86-2.007 1.093 0 1.751.716 1.745 1.917V381h2.723v-6.251c0-2.289-1.342-3.695-3.388-3.695-1.457 0-2.512.716-2.953 1.86h-.115v-1.732h-2.595V381h2.723v-5.676zM160.49 375.324c.006-1.266.761-2.007 1.86-2.007 1.093 0 1.751.716 1.745 1.917V381h2.723v-6.251c0-2.289-1.342-3.695-3.388-3.695-1.457 0-2.512.716-2.953 1.86h-.115v-1.732h-2.595V381h2.723v-5.676zM173.359 381.192c2.429 0 4.065-1.183 4.449-3.005l-2.519-.166c-.275.748-.978 1.138-1.886 1.138-1.361 0-2.224-.901-2.224-2.365v-.006h6.686v-.748c0-3.337-2.02-4.986-4.615-4.986-2.889 0-4.762 2.052-4.762 5.082 0 3.113 1.847 5.056 4.871 5.056zm-2.18-6.092c.058-1.118.908-2.013 2.116-2.013 1.182 0 2 .843 2.007 2.013h-4.123zM183.998 381.192c2.614 0 4.257-1.534 4.385-3.791h-2.57c-.159 1.049-.85 1.637-1.783 1.637-1.272 0-2.096-1.068-2.096-2.947 0-1.854.83-2.915 2.096-2.915.997 0 1.636.659 1.783 1.636h2.57c-.115-2.269-1.834-3.758-4.398-3.758-2.978 0-4.819 2.065-4.819 5.075 0 2.985 1.809 5.063 4.832 5.063zM195.269 371.182h-1.847v-2.352h-2.724v2.352h-1.342v2.045h1.342v5.114c-.012 1.924 1.298 2.876 3.273 2.793a5.306 5.306 0 001.477-.255l-.428-2.027c-.135.026-.422.09-.678.09-.543 0-.92-.205-.92-.959v-4.756h1.847v-2.045zM208.201 371.674h2.653c-.038-2.333-1.956-3.944-4.871-3.944-2.87 0-4.973 1.585-4.96 3.963-.006 1.931 1.355 3.036 3.567 3.567l1.425.358c1.426.345 2.218.754 2.225 1.636-.007.959-.914 1.611-2.321 1.611-1.438 0-2.473-.665-2.563-1.975h-2.678c.07 2.832 2.096 4.295 5.273 4.295 3.196 0 5.076-1.527 5.082-3.924-.006-2.18-1.649-3.337-3.925-3.848l-1.176-.282c-1.138-.262-2.09-.684-2.071-1.623 0-.844.748-1.464 2.103-1.464 1.323 0 2.135.601 2.237 1.63zM217.2 381.192c2.978 0 4.832-2.039 4.832-5.063 0-3.042-1.854-5.075-4.832-5.075-2.979 0-4.833 2.033-4.833 5.075 0 3.024 1.854 5.063 4.833 5.063zm.012-2.11c-1.374 0-2.077-1.259-2.077-2.972s.703-2.979 2.077-2.979c1.349 0 2.052 1.266 2.052 2.979s-.703 2.972-2.052 2.972zM230.019 376.82c.006 1.316-.895 2.007-1.873 2.007-1.029 0-1.694-.723-1.7-1.88v-5.765h-2.723v6.251c.006 2.295 1.348 3.695 3.323 3.695 1.477 0 2.538-.761 2.979-1.911h.102V381h2.615v-9.818h-2.723v5.638zM234.84 381h2.723v-5.555c0-1.208.882-2.039 2.084-2.039.377 0 .895.064 1.15.147v-2.416a4.117 4.117 0 00-.856-.096c-1.1 0-2.001.639-2.359 1.854h-.102v-1.713h-2.64V381zM246.104 381.192c2.615 0 4.257-1.534 4.385-3.791h-2.57c-.159 1.049-.85 1.637-1.783 1.637-1.272 0-2.096-1.068-2.096-2.947 0-1.854.83-2.915 2.096-2.915.997 0 1.636.659 1.783 1.636h2.57c-.115-2.269-1.834-3.758-4.398-3.758-2.978 0-4.819 2.065-4.819 5.075 0 2.985 1.809 5.063 4.832 5.063zM256.627 381.192c2.429 0 4.065-1.183 4.449-3.005l-2.519-.166c-.274.748-.978 1.138-1.885 1.138-1.362 0-2.225-.901-2.225-2.365v-.006h6.686v-.748c0-3.337-2.02-4.986-4.615-4.986-2.889 0-4.762 2.052-4.762 5.082 0 3.113 1.848 5.056 4.871 5.056zm-2.18-6.092c.058-1.118.908-2.013 2.116-2.013 1.183 0 2.001.843 2.007 2.013h-4.123zM270.999 373.982c-.243-1.809-1.7-2.928-4.18-2.928-2.512 0-4.168 1.163-4.161 3.055-.007 1.471.92 2.423 2.838 2.806l1.7.339c.857.173 1.247.486 1.259.978-.012.582-.645.997-1.598.997-.971 0-1.617-.415-1.783-1.214l-2.678.141c.255 1.879 1.853 3.036 4.455 3.036 2.544 0 4.366-1.298 4.372-3.235-.006-1.419-.933-2.269-2.838-2.659l-1.777-.358c-.914-.198-1.253-.511-1.246-.984-.007-.588.658-.972 1.502-.972.946 0 1.508.518 1.642 1.151l2.493-.153z"/></g><path opacity=".85" fill="url(#paint1_linear)" d="M0 288h398v264H0z"/></g><defs><filter id="filter0_d" x="101" y="389" width="190" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="10"/><feGaussianBlur stdDeviation="15"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.45 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/></filter><filter id="filter1_d" x="101" y="442" width="190" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="10"/><feGaussianBlur stdDeviation="15"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.45 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/></filter><filter id="filter2_d" x="101" y="495" width="190" height="105" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="10"/><feGaussianBlur stdDeviation="15"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.45 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/></filter><filter id="filter3_d" x="156.696" y="421.467" width="81.838" height="125.714" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="1"/><feGaussianBlur stdDeviation="2"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.27 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/></filter><filter id="filter4_d" x="155.037" y="239.776" width="86.925" height="90.056" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="10"/><feGaussianBlur stdDeviation="15"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.45 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/></filter><filter id="filter5_d" x="126.312" y="227" width="144.818" height="144.818" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="10"/><feGaussianBlur stdDeviation="15"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.45 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/></filter><filter id="filter6_d" x="173.58" y="276.146" width="90.26" height="90.26" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="10"/><feGaussianBlur stdDeviation="15"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.45 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/></filter><filter id="filter7_d" x="32" y="75" width="184" height="184" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="10"/><feGaussianBlur stdDeviation="15"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.45 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/></filter><filter id="filter8_d" x="176" y="55" width="148" height="148" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="10"/><feGaussianBlur stdDeviation="15"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.45 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/></filter><filter id="filter9_dd" x="8" y="143" width="194" height="93" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="10"/><feGaussianBlur stdDeviation="15"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.45 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="3"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0.631373 0 0 0 0 0.937255 0 0 0 1 0"/><feBlend mode="normal" in2="effect1_dropShadow" result="effect2_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow" result="shape"/></filter><filter id="filter10_dd" x="195" y="77" width="194" height="93" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="10"/><feGaussianBlur stdDeviation="15"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.45 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="3"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0.631373 0 0 0 0 0.937255 0 0 0 1 0"/><feBlend mode="normal" in2="effect1_dropShadow" result="effect2_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect2_dropShadow" result="shape"/></filter><filter id="filter11_d" x="80.675" y="110.161" width="93.817" height="43.031" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="1"/><feGaussianBlur stdDeviation="2"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.27 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/></filter><filter id="filter12_d" x="118.057" y="364.73" width="157.167" height="21.462" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/><feOffset dy="1"/><feGaussianBlur stdDeviation="2"/><feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.27 0"/><feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow"/><feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow" result="shape"/></filter><linearGradient id="paint0_linear" x1="204" y1="28" x2="204" y2="145" gradientUnits="userSpaceOnUse"><stop stop-color="#3E444B" stop-opacity="0"/><stop offset="1" stop-color="#3E444B"/></linearGradient><linearGradient id="paint1_linear" x1="199" y1="288" x2="199" y2="504" gradientUnits="userSpaceOnUse"><stop stop-color="#13171C" stop-opacity="0"/><stop offset="1" stop-color="#13171C"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/crawler.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/crawler.svg
new file mode 100644
index 00000000000000..d241989f1aff16
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/crawler.svg
@@ -0,0 +1 @@
+<svg fill="none" height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg"><circle cx="50" cy="50" fill="#017f4b" r="35"/><path clip-rule="evenodd" d="m52.2348 25.0436c12.7604 1.1309 22.768 11.8589 22.768 24.9288 0 6.7302-2.6536 12.8393-6.9702 17.3369l1.8767 2.3728c5.0039-5.0634 8.0935-12.0257 8.0935-19.7097 0-14.7253-11.3463-26.8004-25.768-27.9394zm-4-3.0436c-14.6429.9124-26.2348 13.0886-26.2348 27.9724 0 8.8748 4.1213 16.7869 10.5534 21.9224l1.6417-2.5305c-5.612-4.5892-9.1951-11.5713-9.1951-19.3919 0-13.2289 10.2524-24.0585 23.2348-24.9658zm-10.7496 49.6425-1.6349 2.52c4.1523 2.4388 8.9884 3.8372 14.1511 3.8372 6.3473 0 12.201-2.1137 16.8972-5.6761l-1.8616-2.3538c-4.1846 3.1578-9.3919 5.0299-15.0356 5.0299-4.5601 0-8.8352-1.2222-12.5162-3.3572zm-5.6311-15.4785c2.5729 7.5568 9.7251 12.9934 18.1474 12.9934 10.5874 0 19.1676-8.5907 19.1676-19.1849 0-.8008-.049-1.5903-.1442-2.3654l-2.9317.7863c.0502.5196.0759 1.0464.0759 1.5791 0 8.9401-7.2398 16.1849-16.1676 16.1849-7.0322 0-13.0171-4.495-15.2416-10.7728zm2.0484-4.6908-2.9337.7868c-.089-.75-.1348-1.5134-.1348-2.2875 0-10.5941 8.5802-19.1848 19.1675-19.1848 8.395 0 15.5281 5.4012 18.1222 12.9197l-2.9068.7797c-2.2449-6.2394-8.2106-10.6994-15.2154-10.6994-8.9277 0-16.1675 7.2448-16.1675 16.1848 0 .506.0231 1.0066.0685 1.5007zm22.5661 1.9658c.5532-1.0318.8667-2.2112.8667-3.4664 0-4.0565-3.2848-7.3424-7.3338-7.3424-4.0489 0-7.3337 3.2859-7.3337 7.3424s3.2848 7.3424 7.3337 7.3424c1.3472 0 2.6069-.3624 3.6905-.9957l2.1703 2.1725c-1.6655 1.1495-3.6864 1.8232-5.8608 1.8232-5.7085 0-10.3337-4.6318-10.3337-10.3424s4.6252-10.3424 10.3337-10.3424c5.7086 0 10.3338 4.6318 10.3338 10.3424 0 2.0851-.6179 4.0294-1.6803 5.655z" fill="#fff" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/custom.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/custom.svg
new file mode 100644
index 00000000000000..f8f6415dea22b9
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/custom.svg
@@ -0,0 +1 @@
+<svg width="100" height="100" fill="none" xmlns="http://www.w3.org/2000/svg"><circle cx="50" cy="50" r="35" fill="#0060D5"/><mask id="a" mask-type="alpha" maskUnits="userSpaceOnUse" x="15" y="15" width="70" height="70"><circle cx="50" cy="50" r="35" fill="#0060D5"/></mask><g mask="url(#a)"><path clip-rule="evenodd" d="M50 10c-7.295 0-14.112 1.985-20 5.395C41.943 22.315 50 35.203 50 50c0 14.797-8.057 27.685-20 34.605C35.888 88.015 42.705 90 50 90c22.093 0 40-17.907 40-40S72.093 10 50 10z" stroke="#fff" stroke-width="3"/><path d="M50.555 30l1.181-.925-.45-.575h-.731V30zm.006.008l-1.181.924.435.556.705.02.041-1.5zm0 39.984l-.041-1.5-.706.02-.434.556 1.181.924zm-.006.008v1.5h.731l.45-.576L50.556 70zM30 71.5h14.62v-3H30v3zM8.5 50c0 11.873 9.627 21.5 21.5 21.5v-3c-10.217 0-18.5-8.283-18.5-18.5h-3zM30 28.5C18.127 28.5 8.5 38.127 8.5 50h3c0-10.217 8.283-18.5 18.5-18.5v-3zm14.62 0H30v3h14.62v-3zm5.38 0h-5.38v3H50v-3zm.555 0H50v3h.555v-3zm1.187.583l-.006-.008-2.362 1.85a.22.22 0 01.006.007l2.362-1.849zM71.5 50c0-11.672-9.302-21.172-20.898-21.492l-.082 3c9.976.274 17.98 8.45 17.98 18.492h3zM50.602 71.492C62.198 71.172 71.5 61.672 71.5 50h-3c0 10.043-8.004 18.218-17.98 18.493l.082 2.999zm1.135-.568l.002-.003.004-.005-2.363-1.848-.003.004-.004.004 2.364 1.848zM50 71.5h.555v-3H50v3zm-5.38 0H50v-3h-5.38v3z" fill="#fff"/></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/drive.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/drive.svg
new file mode 100644
index 00000000000000..40b65df3a1ce3a
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/drive.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><linearGradient id="a" x1="15.093%" x2="84.907%" y1="0%" y2="100%"><stop offset="0" stop-color="#f6c338"/><stop offset=".52278" stop-color="#ffd351"/><stop offset="1" stop-color="#f6c338"/></linearGradient><linearGradient id="b" x1="56.638%" x2="43.362%" y1="0%" y2="100%"><stop offset="0" stop-color="#286ee6"/><stop offset=".52105" stop-color="#4286fb"/><stop offset="1" stop-color="#286ee6"/></linearGradient><linearGradient id="c" x1="65.289%" x2="35.995%" y1="33.288%" y2="66.712%"><stop offset="0" stop-color="#069b5a"/><stop offset=".53103" stop-color="#11aa62"/><stop offset="1" stop-color="#069b5a"/></linearGradient><g fill="none" fill-rule="evenodd" transform="translate(15 20)"><path d="m22.776 0h24.335l22.885 39.455h-24.389z" fill="url(#a)"/><path d="m69.996 39.455-12.194 21.081h-45.662l12.222-21.081z" fill="url(#b)"/><path d="m12.14 60.536-12.14-21.081 22.776-39.455 12.222 21.136z" fill="url(#c)"/><g fill="#000"><path d="m12.14 60.536 22.721-21.081h-10.499z" opacity=".1"/><path d="m69.996 39.455h-24.362l-5.359-9.242z" opacity=".1"/><path d="m22.776 0 7.027 30.077 5.195-8.941z" opacity=".1"/></g></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/dropbox.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/dropbox.svg
new file mode 100644
index 00000000000000..d16f293fde6dc6
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/dropbox.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg"><path d="m14.23744 24.847309-14.23744-11.4018811 20.5915056-13.4452194 14.4077992 12.0267509-20.7617694 12.820426 20.7618391 12.8202176-14.4077994 12.0274457-20.5915056-13.4452194zm20.7621428 12.820294 14.4084942 12.0274457 20.5908109-13.4452194-14.2375357-11.4026524zm34.9995134-24.2223836-20.5908105-13.4452194-14.4084942 12.0267508 20.7617694 12.8204261zm-34.9573991 26.8099593-14.4501915 11.9913065-6.1830113-4.0371796v4.5264506l20.6332028 12.3742444 20.6338978-12.3742444v-4.5264506l-6.1823164 4.0371796z" fill="#007ee5" fill-rule="evenodd" transform="translate(15 17)"/></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/github.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/github.svg
new file mode 100644
index 00000000000000..c4b4176560d5b1
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/github.svg
@@ -0,0 +1 @@
+<svg height="52" viewBox="0 0 52 52" width="52" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd"><circle cx="26" cy="26" fill="#fff" r="26"/><path d="m26.2884088 9c-9.5464114 0-17.2884088 7.740936-17.2884088 17.2905316 0 7.6390397 4.9536471 14.1190087 11.8242187 16.4053074.8650573.159213 1.180299-.3746813 1.180299-.8332147 0-.4107695-.0148599-1.4976636-.0233512-2.9401334-4.809294 1.0444373-5.8240115-2.3181412-5.8240115-2.3181412-.7865122-1.9975925-1.9201088-2.5293639-1.9201088-2.5293639-1.5698401-1.0720342.1188791-1.0508058.1188791-1.0508058 1.7354216.1220633 2.6482428 1.7821242 2.6482428 1.7821242 1.5422433 2.6418744 4.0471945 1.8787134 5.0321922 1.4361012.1570902-1.1166138.603948-1.8787133 1.0975083-2.3107113-3.8391561-.4362436-7.8757363-1.9201087-7.8757363-8.5454923 0-1.8872047.6740017-3.4315708 1.7800013-4.6394668-.1783186-.437305-.7716524-2.1960779.1698272-4.5757816 0 0 1.4509611-.4649019 4.7541001 1.7725714 1.3787846-.384234 2.858404-.5752896 4.3284707-.5827195 1.4690053.0074299 2.9475633.1984855 4.3284707.5827195 3.3010162-2.2374733 4.7498545-1.7725714 4.7498545-1.7725714.9436024 2.3797037.3502686 4.1384766.1730115 4.5757816 1.1081224 1.207896 1.776817 2.7522621 1.776817 4.6394668 0 6.6423663-4.0429487 8.1039416-7.8937804 8.5316939.6198692.5338942 1.172869 1.5889457 1.172869 3.2012427 0 2.3117727-.0212284 4.1766876-.0212284 4.7434859 0 .4627791.3120575 1.000919 1.1887904.8321533 6.8652645-2.2916058 11.8146659-8.7673292 11.8146659-16.404246 0-9.5495956-7.7419974-17.2905316-17.291593-17.2905316" fill="#1a1919"/></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/gmail.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/gmail.svg
new file mode 100644
index 00000000000000..ee824f730aca67
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/gmail.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd" transform="translate(21 29)"><path d="m55.074 0c2.706 0 4.92 2.22169863 4.92 4.93764384v1.43150684l-6.828 4.90027402-23.25 16.0883287-23.25-16.2516712v32.5015342h-1.752c-2.7 0-4.914-2.2223013-4.914-4.9376438v-33.73112328c0-2.71594521 2.214-4.93764384 4.914-4.93764384l25.002 18.61923292 25.158-18.61923292z" fill="#e75a4d"/><path d="m6.666 11.106v32.502h46.5v-32.339l-23.25 16.089z" fill="#e7e4d7"/><path d="m6.666 43.608 23.25-16.25-.108-.076-23.142 15.968z" fill="#b8b7ae"/><path d="m53.166 11.269.012 32.339-23.262-16.25z" fill="#b7b6ad"/><path d="m59.994 6.36915068.006 32.30443832c-.12 3.5911233-1.668 4.872548-6.822 4.932822l-.012-32.3387946 6.828-4.90027393z" fill="#b2392f"/><path d="m4.914 0 25.002 18.619 25.158-18.619z" fill="#f7f5ed"/></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/google.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/google.svg
new file mode 100644
index 00000000000000..22630f533dcbf2
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/google.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd" transform="translate(15 14)"><path d="m70 36.457165c0-2.9324271-.23828-5.0721553-.75397-7.2915728h-33.53175v13.2354175h19.68239c-.39669 3.288932-2.53953 8.2429515-7.30149 11.5710291l-.06678.4431845 10.60213 8.2017087.73451.0733981c6.7459-6.2213592 10.63496-15.3751456 10.63496-26.2331651" fill="#4285f4"/><path d="m35.71428 71.328932c9.64271 0 17.73786-3.170097 23.65076-8.6386019l-11.26986-8.7182913c-3.01588 2.1005826-7.06356 3.5664466-12.3809 3.5664466-9.4444 0-17.46017-6.2213592-20.31764-14.8201165l-.41881.0356505-11.02423 8.519767-.1442.3998447c5.873 11.6507184 17.93652 19.6553009 31.90488 19.6553009" fill="#34a853"/><path d="m15.39664 42.7183689c-.7539-2.2194174-1.19028-4.5968155-1.19028-7.0539029s.43638-4.8344854 1.15066-7.0539029l-.01995-.4725437-11.16241-8.6567767-.36526.1733592c-2.42053 4.8344855-3.8094 10.2638447-3.8094 16.0098641s1.38887 11.1746796 3.8094 16.0091651z" fill="#fbbc05"/><path d="m35.71428 13.7897476c6.70628 0 11.22996 2.8932815 13.80946 5.3105242l10.0793-9.82765044c-6.19031-5.74601942-14.24605-9.27262136-23.88876-9.27262136-13.96836 0-26.03188 8.00458252-31.90488 19.6546019l11.54762 8.9559612c2.89709-8.5987573 10.91286-14.8208155 20.35726-14.8208155" fill="#eb4335"/></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/google_drive.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/google_drive.svg
new file mode 100644
index 00000000000000..59469d814e35fd
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/google_drive.svg
@@ -0,0 +1 @@
+<svg height="52" viewBox="0 0 52 52" width="52" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd"><circle cx="26" cy="26" fill="#f9fafb" r="26"/><g transform="translate(8 10)"><path d="m5.98703634 31.1142993 5.98622706-10.3714331h23.9467966l-5.9867666 10.3714331z" fill="#3777e3"/><path d="m23.9470663 20.7428662h11.9729937l-11.9729937-20.7428662h-11.9738029z" fill="#ffcf63"/><path d="m0 20.7428662 5.98703634 10.3714331 11.97299366-20.7428662-5.9867666-10.3714331z" fill="#11a861"/></g></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/index.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/index.ts
new file mode 100644
index 00000000000000..5f93694da09b8f
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/index.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import box from './box.svg';
+import confluence from './confluence.svg';
+import crawler from './crawler.svg';
+import custom from './custom.svg';
+import drive from './drive.svg';
+import dropbox from './dropbox.svg';
+import github from './github.svg';
+import gmail from './gmail.svg';
+import google from './google.svg';
+import googleDrive from './google_drive.svg';
+import jira from './jira.svg';
+import jiraServer from './jira_server.svg';
+import loadingSmall from './loading_small.svg';
+import office365 from './office365.svg';
+import oneDrive from './one_drive.svg';
+import outlook from './outlook.svg';
+import people from './people.svg';
+import salesforce from './salesforce.svg';
+import serviceNow from './service_now.svg';
+import sharePoint from './share_point.svg';
+import slack from './slack.svg';
+import zendesk from './zendesk.svg';
+
+export const images = {
+  box,
+  confluence,
+  crawler,
+  custom,
+  drive,
+  dropbox,
+  github,
+  gmail,
+  googleDrive,
+  google,
+  jira,
+  jiraServer,
+  loadingSmall,
+  office365,
+  oneDrive,
+  outlook,
+  people,
+  salesforce,
+  serviceNow,
+  sharePoint,
+  slack,
+  zendesk,
+} as { [key: string]: string };
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/jira.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/jira.svg
new file mode 100644
index 00000000000000..224bb822a581ca
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/jira.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><linearGradient id="a"><stop offset=".18" stop-color="#0052cc"/><stop offset="1" stop-color="#2684ff"/></linearGradient><linearGradient id="b" x1="98.031%" x2="58.888%" xlink:href="#a" y1=".161%" y2="40.766%"/><linearGradient id="c" x1="3739.421%" x2="2058.278%" xlink:href="#a" y1="3462%" y2="5116%"/><g fill="none" transform="translate(14 14)"><path d="m68.81 0h-34.58c0 4.14002941 1.6446203 8.11049399 4.5720631 11.0379369 2.9274429 2.9274428 6.8979075 4.5720631 11.0379369 4.5720631h6.37v6.15c.0055161 8.6133562 6.9866438 15.5944839 15.6 15.6v-34.36c0-1.65685425-1.3431458-3-3-3z" fill="#2684ff"/><path d="m51.7 17.23h-34.58c.0055161 8.6133562 6.9866438 15.5944839 15.6 15.6h6.37v6.17c.0110357 8.6133534 6.9966395 15.5900071 15.61 15.59v-34.36c0-1.6568542-1.3431458-3-3-3z" fill="url(#b)"/><path d="m34.58 34.45h-34.58c0 8.6211649 6.98883506 15.61 15.61 15.61h6.39v6.15c.005497 8.6055588 6.9744553 15.5834632 15.58 15.6v-34.36c0-1.6568542-1.3431458-3-3-3z" fill="url(#c)"/></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/jira_server.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/jira_server.svg
new file mode 100644
index 00000000000000..71750fb6e25a01
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/jira_server.svg
@@ -0,0 +1 @@
+<svg fill="none" height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><linearGradient id="a"><stop offset=".18" stop-color="#0052cc"/><stop offset="1" stop-color="#2684ff"/></linearGradient><linearGradient id="b" gradientUnits="userSpaceOnUse" x1="48.0798" x2="33.1398" xlink:href="#a" y1="28.4649" y2="43.4049"/><linearGradient id="c" gradientUnits="userSpaceOnUse" x1="1038.61" x2="1532.16" xlink:href="#a" y1="2278.21" y2="1958.05"/><path d="m84.1499 47.9249-31.18-31.0999-3-3-23.42 23.42-10.72 10.6799c-.2664.2657-.4778.5813-.622.9288s-.2184.72-.2184 1.0963c0 .3762.0742.7487.2184 1.0962s.3556.6631.622.9287l21.42 21.46 12.72 12.74 23.47-23.4399.36-.36 10.35-10.3601c.2724-.2663.4889-.5844.6366-.9356.1478-.3512.224-.7283.224-1.1094 0-.381-.0762-.7581-.224-1.1093-.1477-.3512-.3642-.6693-.6366-.9357zm-34.18 12.7701-10.7-10.7001 10.7-10.6999 10.7 10.6999z" fill="#2684ff"/><path d="m49.9698 39.2949c-3.3494-3.3721-5.2293-7.9321-5.2293-12.685s1.8799-9.3129 5.2293-12.685l-23.46 23.37 12.74 12.74z" fill="url(#b)"/><path d="m60.7198 49.9249-10.75 10.77c1.6751 1.6719 3.0041 3.6577 3.9108 5.8438s1.3734 4.5296 1.3734 6.8962c0 2.3667-.4667 4.7101-1.3734 6.8962s-2.2357 4.1719-3.9108 5.8438l23.5-23.47z" fill="url(#c)"/></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/loading_small.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/loading_small.svg
new file mode 100644
index 00000000000000..159408ea029386
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/loading_small.svg
@@ -0,0 +1 @@
+<svg width="154" height="154" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" preserveAspectRatio="xMidYMid" class="uil-ring"><path fill="none" class="bk" d="M0 0h100v100H0z"/><circle cx="50" cy="50" r="40" stroke-dasharray="163.36281798666926 87.9645943005142" stroke="#258BF8" fill="none" stroke-width="20"><animateTransform attributeName="transform" type="rotate" values="0 50 50;180 50 50;360 50 50;" keyTimes="0;0.5;1" dur="1s" repeatCount="indefinite" begin="0s"/></circle></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/office365.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/office365.svg
new file mode 100644
index 00000000000000..fdce5d02da3cda
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/office365.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg"><path d="m39.8071 64.45585c.11284-.7067.14198-51.8080167.03472-52.92295-8.7296 2.0683-17.4468 4.13475-26.19934 6.2079833v36.0225834c-4.50616 1.75195-8.9962 3.4965-13.485 5.2392-.02852-.01665-.05332-.0252834-.07688-.0419334-.01984-.0141833-.04464-.0357666-.0465-.0555-.01426-.13505-.03224-.2694833-.03224-.4063833-.00186-14.5551833-.00186-29.1122167-.00186-43.6316333.20088-.2466667.46066-.2775.68634-.3595167 12.82904-4.77855 25.6618-9.55216667 38.49208-14.33071667.44454-.16588333.84754-.24666666 1.34044-.10236666 7.0401 2.03191666 14.0864 4.04101666 21.13146 6.0569.1023.03083333.2046.0666.34968.11346666v61.34908337c-2.02306.5593166-4.02752 1.1186333-6.03446 1.6687-5.10818 1.4010666-10.22008 2.79165-15.32454 4.2032-.50034.13875-.93744.1282666-1.42848-.0518-12.61886-4.6385667-25.24392-9.2623334-37.86464-13.8885667-.24924-.0912667-.49352-.19425-.70308-.4150167 13.05472 1.7821667 26.10944 3.5624834 39.1623 5.3452667z" fill="#dc3e15" fill-rule="evenodd" transform="translate(19 13)"/></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/one_drive.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/one_drive.svg
new file mode 100644
index 00000000000000..1856e5e3ce1af8
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/one_drive.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="100" width="100" viewBox="-154.506 -164.981 1339.055 989.883"><path d="M622.292 445.338l212.613-203.327C790.741 69.804 615.338-33.996 443.13 10.168a321.9 321.9 0 00-188.92 134.837c3.29-.083 368.082 300.333 368.082 300.333z" fill="#0364B8"/><path d="M392.776 183.283l-.01.035A256.233 256.233 0 00257.5 144.921c-1.104 0-2.189.07-3.29.083C112.063 146.765-1.74 263.424.02 405.567a257.389 257.389 0 0046.244 144.04l318.528-39.894 244.21-196.915z" fill="#0078D4"/><path d="M834.905 242.012c-4.674-.312-9.37-.528-14.123-.528a208.464 208.464 0 00-82.93 17.117l-.006-.022-128.844 54.22 142.041 175.456 253.934 61.728c54.8-101.732 16.752-228.625-84.98-283.424a209.23 209.23 0 00-85.09-24.546z" fill="#1490DF"/><path d="M46.264 549.607C94.36 618.757 173.27 659.967 257.5 659.922h563.281c76.946.022 147.691-42.202 184.195-109.937L609.001 312.798z" fill="#28A8EA"/></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/outlook.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/outlook.svg
new file mode 100644
index 00000000000000..2680bc99cc3677
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/outlook.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg"><path d="m58.470798 31.205258h22.4994182c.8279025 0 2.294983 1.1273613 2.294983 2.7001315l-19.7112086 13.2892772c-.1207888.0377477-.3824974.0352299-.5032862 0l-4.5799064-2.8838314zm0 17.9950047 4.1797934 2.8712488c.5888452.4328264 1.2984792 0 1.2984792 0-.7071175.4328264 19.3186464-12.8690327 19.3186464-12.8690327v24.0872863c0 2.6221222-1.67846 3.7218025-3.5657824 3.7218025h-21.2336531v-17.8113049zm-41.470798-24.6509669 39.0046948-7.5492958v67l-39.0046948-8.1784038zm26.1004319 34.304c1.6482629-2.1691643 2.4736526-5.027831 2.4711362-8.5734836 0-3.4500282-.7951925-6.228169-2.3855775-8.336939-1.5878685-2.1087699-3.6714742-3.1606385-6.245784-3.1606385-2.7252958 0-4.9145916 1.1021972-6.5678874 3.3040752-1.6532957 2.2018779-2.4786854 5.0857089-2.4786854 8.6514929 0 3.3770517.8153239 6.1149296 2.440939 8.2186667 1.6281314 2.1012206 3.7318685 3.1530892 6.3162441 3.1530892 2.6523193 0 4.8013521-1.0870986 6.449615-3.2562629zm-6.2709483-15.6949859c1.3840375 0 2.4736526.6492394 3.2713615 1.9477183.7977089 1.3009953 1.1953051 3.1203756 1.1953051 5.4581408 0 2.2421409-.4126948 3.9960939-1.2330516 5.2593427-.8203568 1.2632489-1.9326197 1.8948733-3.3342723 1.8948733-1.3588732 0-2.458554-.646723-3.2965258-1.9477183-.8379719-1.2984789-1.258216-3.0650141-1.258216-5.2996057 0-2.2018779.4202441-3.9709295 1.258216-5.3071549.8379718-1.3362253 1.9728826-2.0055962 3.3971831-2.0055962z" fill="#0072c6"/></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/people.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/people.svg
new file mode 100644
index 00000000000000..4500c494c23b77
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/people.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg"><g fill="#db351d" transform="translate(22 23)"><path d="m23.2613385 10.1789755c0-2.92393845-2.3701795-5.29411803-5.294118-5.29411803-2.9239384 0-5.2941179 2.37017958-5.2941179 5.29411803 0 2.9239384 2.3701795 5.294118 5.2941179 5.294118 2.9239385 0 5.294118-2.3701796 5.294118-5.294118zm0 0c0-1.26700623 1.0271115-2.29411768 2.2941177-2.29411768 1.2670061 0 2.2941176 1.02711145 2.2941176 2.29411768 0 5.4579508-4.4244025 9.8823533-9.8823533 9.8823533s-9.88235323-4.4244025-9.88235323-9.8823533c0-5.45795082 4.42440243-9.88235331 9.88235323-9.88235331s9.8823533 4.42440249 9.8823533 9.88235331c0 1.2670062-1.0271115 2.2941176-2.2941176 2.2941176-1.2670062 0-2.2941177-1.0271114-2.2941177-2.2941176zm-17.32804825 28.247194c.45461188-5.6818277 5.04031305-8.9531083 12.03393025-8.9531083 6.2670404 0 10.6642786 2.6733501 11.7756237 7.3018317.2958132 1.2319899 1.5343424 1.9909112 2.7663323 1.6950978 1.2319899-.2958131 1.9909111-1.5343422 1.6950981-2.7663321-1.6681955-6.9476274-8.0357162-10.8188327-16.2370541-10.8188327-9.17625601 0-15.93938722 4.8245836-16.6075497 13.1754086l-.66768645 8.3452182c-.10680098 1.334874.94767014 2.4770813 2.28681 2.4770813h23.25041425c1.2670061 0 2.2941176-1.0271114 2.2941176-2.2941176 0-1.2670063-1.0271115-2.2941177-2.2941176-2.2941177h-20.76541722zm40.01761635-21.1883705c0-2.9239384-2.3701797-5.294118-5.294118-5.294118-2.9239384 0-5.294118 2.3701796-5.294118 5.294118s2.3701796 5.294118 5.294118 5.294118c2.9239383 0 5.294118-2.3701796 5.294118-5.294118zm0 0c0-1.2670062 1.0271114-2.2941176 2.2941176-2.2941176 1.2670063 0 2.2941177 1.0271114 2.2941177 2.2941176 0 5.4579508-4.4244025 9.8823533-9.8823533 9.8823533s-9.8823533-4.4244025-9.8823533-9.8823533 4.4244025-9.88235329 9.8823533-9.88235329 9.8823533 4.42440249 9.8823533 9.88235329c0 1.2670062-1.0271114 2.2941176-2.2941177 2.2941176-1.2670062 0-2.2941176-1.0271114-2.2941176-2.2941176z"/><path d="m52.6907193 45.4850005c-.4546122-5.6818352-5.0403134-8.9531157-12.0339307-8.9531157s-11.5793185 3.2712805-12.0339303 8.9531083l-.4694989 5.8681291h25.0068581zm2.9544953 10.456357h-29.9768522c-1.3391399 0-2.393611-1.1422073-2.28681-2.4770813l.6676864-8.3452182c.6681625-8.3508251 7.4312937-13.1754085 16.6075498-13.1754085 9.176256 0 15.9393872 4.8245834 16.6075503 13.1754159l.6676857 8.3452108c.106801 1.334874-.94767 2.4770813-2.28681 2.4770813z"/></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/salesforce.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/salesforce.svg
new file mode 100644
index 00000000000000..510c438a281951
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/salesforce.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd" transform="translate(15 26)"><path d="m29.134 5.3732c2.2561-2.3499 5.3956-3.8073 8.8683-3.8073 4.6158 0 8.6429 2.5739 10.7877 6.3952 1.9183227-.85671211 3.996069-1.298263 6.097-1.2957 8.3258 0 15.0752 6.8082 15.0752 15.2068 0 8.3993-6.7494 15.2075-15.0752 15.2075-.9971928.0004729-1.9919365-.0987201-2.9694-.2961-1.8886 3.3691-5.488 5.6455-9.618 5.6455-1.729 0-3.3649-.3997-4.8216-1.1102-1.9145 4.5038-6.3749 7.6615-11.5738 7.6615-5.4138 0-10.0282-3.4258-11.7992-8.2299-.7884736.1668588-1.5922646.2506164-2.3982.2499-6.4463 0-11.6718-5.2794-11.6718-11.7929 0-4.3652 2.3478-8.176 5.8366-10.2151-.73942666-1.7021192-1.11998158-3.5384098-1.1179-5.3942-.0007-7.4907 6.0809-13.5632 13.5821-13.5632 4.4037 0 8.3174 2.0937 10.7989 5.3382" fill="#00a1e0"/><g fill="#fff"><path d="m10.1633 25.417c-.0441.1141.0161.1386.0301.1582.1316.0959.2646.1645.399.2408.714.3787 1.3867.4893 2.0909.4893 1.435 0 2.3254-.763 2.3254-1.9915v-.0238c0-1.1354-1.0052-1.5477-1.9488-1.8459l-.1225-.0399c-.7112-.231-1.3244-.4298-1.3244-.8981v-.0252c0-.4004.3584-.6951.9142-.6951.6174 0 1.351.2051 1.8228.4662 0 0 .1386.0896.189-.0448.028-.0714.2674-.7154.2919-.7847.0273-.0763-.021-.1316-.07-.161-.539-.329-1.2838-.553-2.0545-.553l-.1435.0014c-1.3125 0-2.2295.7931-2.2295 1.9299v.0238c0 1.1984 1.0115 1.5869 1.9586 1.8578l.1526.0469c.6902.2121 1.2845.3941 1.2845.8806v.0238c0 .4438-.3864.7749-1.0094.7749-.6544212.0046414-1.2962145-.1801173-1.848-.532-.1008-.0588-.1596-.1015-.2373-.1484-.0406-.0259-.1435-.0707-.1883.0644zm20.9993 0c-.0441.1141.0161.1386.0301.1582.1309.0959.2646.1645.399.2408.714.3787 1.3867.4893 2.0909.4893 1.435 0 2.3247-.763 2.3247-1.9915v-.0238c0-1.1354-1.0045-1.5477-1.9481-1.8459l-.1225-.0399c-.7112-.231-1.3251-.4298-1.3251-.8981v-.0252c0-.4004.3591-.6951.9149-.6951.6174 0 1.351.2051 1.8228.4662 0 0 .1386.0896.189-.0448.028-.0714.2674-.7154.2919-.7847.0273-.0763-.021-.1316-.07-.161-.539-.329-1.2838-.553-2.0545-.553l-.1435.0014c-1.3132 0-2.2295.7931-2.2295 1.9299v.0238c0 1.1984 1.0115 1.5869 1.9586 1.8578l.1526.0469c.6902.2121 1.2859.3941 1.2859.8806v.0238c0 .4438-.3878.7749-1.0115.7749-.6544212.0046414-1.2962145-.1801173-1.848-.532-.1001-.0588-.1596-.0994-.2359-.1484-.0259-.0168-.147-.0637-.189.0644zm14.3353-2.4059c0 .6944-.1295 1.2411-.385 1.6275-.252.3822-.6328.5691-1.1648.5691-.5327 0-.9128-.1855-1.1606-.5691-.2506-.385-.378-.9331-.378-1.6275 0-.693.1274-1.239.378-1.6219.2478-.378.6279-.5628 1.1606-.5628.532 0 .9135.1841 1.1662.5628.2541.3829.3836.9282.3836 1.6219zm1.197-1.2873c-.1082986-.3801918-.2936766-.7340301-.5446-1.0395-.2507916-.2984721-.5647079-.5375553-.9191-.7-.3654-.1701-.798-.2562-1.2831-.2562-.4858 0-.9184.0861-1.2838.2569-.3668.1708-.6755.406-.9205.6993-.2429.2926-.427.6433-.5453 1.0395-.1195795.4185263-.1785128.8520401-.175 1.2873 0 .4592.0588.8925.175 1.2866.119.3969.301.7476.546 1.0402.2443.2926.5537.5271.9198.693.3661.1666.798.2513 1.2838.2513.4851 0 .917-.084 1.2831-.2513.3548283-.1585275.6690782-.3954715.9191-.693.2443-.2919.427-.6426.5453-1.0402.1204054-.4181438.1798181-.8514793.1764-1.2866 0-.4585-.0588-.8918-.1764-1.2873zm9.8329 3.2984c-.0399-.1169-.1526-.0728-.1526-.0728-.1793652.0726398-.3658994.1261364-.5565.1596-.2002.0308-.42.0462-.6566.0462-.5796 0-1.0402-.1722-1.3699-.5124-.3304-.3409-.5159-.8918-.5138-1.6366.0021-.679.1652-1.1886.4592-1.5771.2919-.3864.7364-.5845 1.3286-.5845.4942 0 .8708.056 1.2656.1813 0 0 .0945.0406.1393-.0833.105-.2905.182-.4984.294-.819.0315-.0903-.0462-.1288-.0742-.14-.2595687-.0903228-.5266056-.1575505-.798-.2009-.2978788-.0428571-.5985628-.0632147-.8995-.0609-.5026 0-.9506.0854-1.3342.2569-.3684641.1600304-.6976327.3984268-.9646.6986-.2569.2926-.4522.6433-.5824 1.0395-.1330277.4167496-.1991813.8519454-.196 1.2894 0 .9926.2688 1.7955.798 2.3835.5292.5894 1.3251.889 2.3632.889.6139 0 1.2432-.1239 1.6954-.3024 0 0 .0868-.042.049-.1421zm2.0951-2.6761c.056-.3857.1631-.707.3276-.9562.2478-.3801.6265-.588 1.1585-.588s.8834.2093 1.1354.588c.168.2499.2401.5845.2688.9562h-2.891zm4.0313-.8477c-.1023734-.3500617-.2795959-.6736956-.5194-.9485-.2611-.2807-.5159-.4774-.7686-.5866-.3675396-.1558601-.7627791-.2358604-1.162-.2352-.5054 0-.9646.084-1.337.2597-.3738.175-.6881.4144-.9338.7126-.2464.2968-.4312.651-.5488 1.0521-.1213995.4203722-.1815187.8560597-.1785 1.2936 0 .4669.0616.903.1841 1.2943.1239.3941.3213.742.588 1.0297.266.2898.609.5173 1.0192.6755.4074.1575.9023.2387 1.4714.238 1.1704-.0042 1.7864-.2653 2.0405-.406.0448-.0245.0882-.0679.0343-.1939l-.2653-.742c-.0399-.1106-.1526-.07-.1526-.07-.2898.1078-.7021.301-1.6632.2989-.6286-.0007-1.0948-.1862-1.386-.476-.301-.2968-.4466-.7329-.4725-1.3489l4.053.0042s.1064-.0021.1176-.105c.0042-.0441.14-.833-.1204-1.7465zm-36.4917.8477c.0574-.3857.1631-.707.3276-.9562.2478-.3801.6265-.588 1.1585-.588s.8834.2093 1.1368.588c.1659.2499.2387.5845.2674.9562h-2.891zm4.0299-.8477c-.1019379-.3499497-.2786797-.6735784-.518-.9485-.2604-.2807-.5159-.4774-.7686-.5866-.3675396-.1558601-.7627791-.2358604-1.162-.2352-.504 0-.9646.084-1.337.2597-.3738.175-.6874.4144-.9338.7126-.2457.2968-.4312.651-.5488 1.0521-.120915.4204749-.1810245.856092-.1785 1.2936 0 .4669.0623.903.1848 1.2943.1232.3941.3206.742.588 1.0297.266.2898.6083.5173 1.0185.6755.4074.1575.903.2387 1.4714.238 1.1704-.0042 1.7871-.2653 2.0405-.406.0455-.0245.0882-.0679.0343-.1939l-.2639-.742c-.0413-.1106-.154-.07-.154-.07-.2891.1078-.7007.301-1.6639.2989-.6279-.0007-1.0941-.1862-1.386-.476-.2996-.2968-.4459-.7329-.4718-1.3489l4.053.0042s.1064-.0021.1176-.105c.0042-.0441.14-.833-.1218-1.7465zm-12.7904 3.5014c-.1589-.126-.1806-.1582-.2345-.2401-.0798-.1246-.1204-.3017-.1204-.5271 0-.357.1169-.6125.3612-.7847-.0028.0007.3486-.3038 1.176-.2926.5803.0077 1.099.0931 1.099.0931v1.8431h.0014s-.5152.1106-1.0948.1456c-.8246.049-1.1914-.238-1.1886-.2373zm1.6121-2.8476c-.1645-.0119-.378-.0189-.6328-.0189-.3472 0-.6832.0434-.9975.1281-.3171.0847-.602.217-.847.392-.244902.1748278-.4461288.403843-.588.6692-.1435.2667-.2156.581-.2156.9338 0 .3591.0616.6706.1848.9254.1239.2562.3017.469.5292.6335.2254.1645.5033.2849.826.3577.3178.0728.6783.1099 1.0724.1099.4158 0 .8302-.0343 1.232-.1029.3414896-.0586887.681759-.1242687 1.0206-.1967.1344-.0322.2835-.0728.2835-.0728.1008-.0252.0931-.133.0931-.133l-.0021-3.7065c0-.812-.217-1.4154-.6447-1.7885-.4256-.3731-1.0521-.5614-1.862-.5614-.3038 0-.7924.042-1.085.1008 0 0-.8862.1715-1.2509.4564 0 0-.0791.0497-.035.161l.2863.7714c.0357.0994.133.0658.133.0658s.0301-.0119.0665-.0329c.7798-.4242 1.7661-.4116 1.7661-.4116.4382 0 .7749.0875 1.0017.2618.2212.1694.3339.4256.3339.966v.1708c-.3486-.0497-.6685-.0784-.6685-.0784zm32.6907-2.0888c.0119193-.0273156.0121564-.0583161.0006562-.0858108s-.0337383-.0490944-.0615562-.0597892c-.0686-.0266-.413-.0994-.679-.1162-.5089-.0308-.7917.0546-1.0451.168-.2506.1141-.5299.2968-.6853.5054v-.4935c0-.0686-.049-.1232-.1162-.1232h-1.0395c-.0672 0-.1162.0546-.1162.1232v6.0459c0 .0672.056.1232.1232.1232h1.0654c.0672 0 .1225-.056.1225-.1232v-3.0205c0-.406.0448-.8099.1344-1.064.0875-.2506.2072-.4522.3542-.5964.1484-.1435.3171-.2443.5012-.301.1767669-.0511631.3598778-.0770861.5439-.077.2121 0 .4452.0553.4452.0553.0777.0091.1218-.0392.147-.1099.07-.1848.2674-.7399.3052-.8505z"/><path d="m41.7095 17.262c-.131459-.0398337-.2651592-.0718563-.4004-.0959-.1820629-.0299909-.3663948-.0440441-.5509-.042-.7329 0-1.3104.2072-1.7164.616-.4032.406-.6769 1.0248-.8148 1.8382l-.049.2744h-.9212s-.1113-.0042-.1351.1176l-.1505.8435c-.0112.0798.0238.1302.1316.1302h.896l-.9093 5.0722c-.0534811.3392846-.1347205.673607-.2429.9996-.0889.2506-.175.4389-.2828.5768-.1036.1309-.2016.2289-.371.2856-.1393.0469-.301.0686-.4767.0686-.098 0-.2282-.0161-.3248-.0357-.075604-.0146961-.1491658-.0384332-.2191-.0707 0 0-.105-.0399-.147.0644l-.3003.8239c-.028.0812.0119.1435.063.1624.119.042.2079.07.3703.1085.2254.0532.4151.056.5936.056.3724 0 .714-.0525.9954-.154.2828-.1029.5299-.2814.749-.5222.2359-.2611.385-.5341.5257-.9079.14-.3682.2611-.826.357-1.3601l.9135-5.1674h1.3342s.1127.0042.1358-.1183l.1512-.8428c.0105-.0805-.0238-.1302-.1323-.1302h-1.2957c.007-.0294.0658-.4851.2142-.9149.063-.182.1827-.3304.2835-.4319.0994-.1001.2142-.1708.3395-.2114.1288-.042.2751-.0616.4354-.0616.1218 0 .2422.014.3332.0329.1253.0266.1743.0406.2072.0504.1323.0399.1498.0014.1757-.063l.3101-.8505c.0322-.091-.0469-.1302-.0749-.1414zm-18.1069 8.7654c0 .0679-.049.1225-.1162.1225h-1.0752c-.0672 0-.1155-.0546-.1155-.1225v-8.6499c0-.0679.0483-.1225.1155-.1225h1.0752c.0679 0 .1162.0546.1162.1225z"/></g></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/service_now.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/service_now.svg
new file mode 100644
index 00000000000000..2d0c09db4e1c31
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/service_now.svg
@@ -0,0 +1 @@
+<svg fill="none" height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg"><path clip-rule="evenodd" d="m50 15c-18.9 0-35 15.4-35 34.65 0 10.15 4.2 19.2501 10.85 25.9001 2.45 2.45 6.3 2.45 9.1.35 3.85-3.15 9.1-4.9 15.05-4.9s10.85 1.75 15.05 4.9c2.8 2.1 6.65 1.75 9.1-.7 6.65-6.3 10.85-15.4001 10.85-25.5501-.35-18.9-15.75-34.65-35-34.65zm-.35 52.5001c-10.15 0-17.5-7.7001-17.5-17.5001s7-17.5 17.5-17.5 17.5 8.05 17.5 17.5-7 17.5001-17.5 17.5001z" fill="#82b6a1" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/share_point.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/share_point.svg
new file mode 100644
index 00000000000000..8724be9da88cf0
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/share_point.svg
@@ -0,0 +1 @@
+<svg fill="none" height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><linearGradient id="a" gradientUnits="userSpaceOnUse" x1="21.2216" x2="44.5924" y1="29.5987" y2="70.0757"><stop offset="0" stop-color="#058f92"/><stop offset=".5" stop-color="#038489"/><stop offset="1" stop-color="#026d71"/></linearGradient><path d="m50.814 54.7209c10.7888 0 19.5348-8.746 19.5348-19.5348s-8.746-19.5349-19.5348-19.5349c-10.7889 0-19.5349 8.7461-19.5349 19.5349s8.746 19.5348 19.5349 19.5348z" fill="#036c70"/><path d="m67.093 71c9.8898 0 17.907-8.0172 17.907-17.907 0-9.8897-8.0172-17.9069-17.907-17.9069-9.8897 0-17.9069 8.0172-17.9069 17.9069 0 9.8898 8.0172 17.907 17.9069 17.907z" fill="#1a9ba1"/><path d="m53.2558 84.0232c7.6421 0 13.8372-6.1951 13.8372-13.8372 0-7.642-6.1951-13.8372-13.8372-13.8372s-13.8372 6.1952-13.8372 13.8372c0 7.6421 6.1951 13.8372 13.8372 13.8372z" fill="#37c6d0"/><g fill="#000"><path d="m54.0697 33.2814v34.7395c-.008 1.2071-.7395 2.2916-1.8558 2.7512-.3554.1503-.7373.2278-1.1232.2279h-11.6558c-.0163-.2768-.0163-.5372-.0163-.814-.0054-.2717.0055-.5435.0326-.8139.2979-5.2037 3.5036-9.795 8.286-11.8675v-3.0279c-10.6434-1.6866-17.9043-11.6821-16.2177-22.3255.0117-.0737.0238-.1474.0364-.221.081-.549.1952-1.0926.3418-1.6278h19.193c1.6427.0062 2.9728 1.3363 2.979 2.979z" opacity=".1"/><path d="m49.4628 31.9302h-17.907c-1.8089 10.6243 5.3373 20.7033 15.9615 22.5123.3217.0548.6447.1015.9687.14-5.0465 2.3931-8.7239 9.1896-9.0365 14.7895-.027.2705-.0379.5423-.0325.814 0 .2768 0 .5372.0162.814.0294.5472.1002 1.0914.2117 1.6279h9.8162c1.2071-.0081 2.2916-.7396 2.7512-1.8559.1503-.3553.2278-.7373.2279-1.1232v-34.7395c-.0062-1.642-1.3353-2.9719-2.9774-2.9791z" opacity=".2"/><path d="m49.4628 31.9302h-17.907c-1.8085 10.6252 5.3388 20.7048 15.964 22.5134.2173.037.4352.0703.6537.0999-4.8837 2.5656-8.4162 9.3458-8.7223 14.8286h10.0116c1.6401-.0124 2.9667-1.339 2.9791-2.9791v-31.4837c-.0063-1.6427-1.3364-2.9728-2.9791-2.9791z" opacity=".2"/><path d="m47.8349 31.9302h-16.2791c-1.7077 10.0303 4.5774 19.6896 14.4396 22.1916-3.7343 4.2666-6.0248 9.6042-6.5442 15.2503h8.3837c1.6427-.0063 2.9728-1.3364 2.9791-2.9791v-31.4837c-.0009-1.6449-1.3342-2.9781-2.9791-2.9791z" opacity=".2"/></g><path d="m17.984 31.9302h29.846c1.648 0 2.9839 1.336 2.9839 2.984v29.846c0 1.648-1.3359 2.9839-2.9839 2.9839h-29.846c-1.648 0-2.984-1.3359-2.984-2.9839v-29.846c0-1.648 1.336-2.984 2.984-2.984z" fill="url(#a)"/><path d="m28.3277 49.4726c-.6993-.4639-1.2834-1.0814-1.7077-1.8054-.4111-.7569-.616-1.6085-.5942-2.4695-.0366-1.1658.3568-2.3044 1.1054-3.1989.7866-.8956 1.8033-1.5588 2.94-1.9177 1.2954-.4264 2.6523-.6365 4.016-.6218 1.7934-.0655 3.5843.1852 5.2907.7407v3.7442c-.7415-.4492-1.549-.7788-2.393-.9767-.9158-.2246-1.8555-.3372-2.7984-.3354-.9943-.0365-1.9823.1726-2.8765.6088-.6904.2978-1.1381.977-1.1395 1.7289-.0029.4561.1724.8952.4883 1.2242.3732.3878.8147.7034 1.3024.9311.5426.2703 1.3566.6295 2.4418 1.0777.1195.0378.236.0846.3484.14 1.0681.4175 2.0985.9256 3.08 1.5189.7432.4582 1.367 1.0865 1.82 1.833.4644.8462.6895 1.8029.6512 2.7674.053 1.1969-.3132 2.3748-1.0354 3.3307-.7198.8788-1.6822 1.5265-2.7674 1.8623-1.2764.4001-2.6086.5935-3.9461.5731-1.2.0054-2.3982-.0926-3.5814-.2931-.999-.1635-1.9739-.4499-2.9025-.853v-3.9477c.8876.634 1.8793 1.1078 2.9302 1.4 1.0474.3264 2.1361.5008 3.233.5177 1.0153.0643 2.0287-.1507 2.9303-.6218.6316-.3564 1.0157-1.0315.9995-1.7565.0042-.5045-.1953-.9894-.5535-1.3447-.4453-.4372-.961-.7965-1.5253-1.063-.6511-.3256-1.61-.7548-2.8765-1.2877-1.0076-.4051-1.9723-.9095-2.8798-1.5058z" fill="#fff"/></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/slack.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/slack.svg
new file mode 100644
index 00000000000000..14dbd0289da848
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/slack.svg
@@ -0,0 +1 @@
+<svg fill="none" height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg"><path d="m29.7068 59.2345c0 4.0473-3.3061 7.3535-7.3534 7.3535-4.0472 0-7.3534-3.3062-7.3534-7.3535 0-4.0472 3.3062-7.3534 7.3534-7.3534h7.3534z" fill="#e01e5a"/><path d="m33.412 59.2345c0-4.0472 3.3062-7.3534 7.3535-7.3534 4.0472 0 7.3534 3.3062 7.3534 7.3534v18.4121c0 4.0472-3.3062 7.3534-7.3534 7.3534-4.0473 0-7.3535-3.3062-7.3535-7.3534z" fill="#e01e5a"/><path d="m40.7655 29.7068c-4.0473 0-7.3535-3.3061-7.3535-7.3534 0-4.0472 3.3062-7.3534 7.3535-7.3534 4.0472 0 7.3534 3.3062 7.3534 7.3534v7.3534z" fill="#36c5f0"/><path d="m40.7655 33.4121c4.0472 0 7.3534 3.3061 7.3534 7.3534 0 4.0472-3.3062 7.3534-7.3534 7.3534h-18.4121c-4.0472 0-7.3534-3.3062-7.3534-7.3534 0-4.0473 3.3062-7.3534 7.3534-7.3534z" fill="#36c5f0"/><path d="m70.2932 40.7655c0-4.0473 3.3062-7.3534 7.3534-7.3534s7.3534 3.3061 7.3534 7.3534c0 4.0472-3.3062 7.3534-7.3534 7.3534h-7.3534z" fill="#2eb67d"/><path d="m66.588 40.7655c0 4.0472-3.3062 7.3534-7.3534 7.3534-4.0473 0-7.3535-3.3062-7.3535-7.3534v-18.4121c0-4.0472 3.3062-7.3534 7.3535-7.3534 4.0472 0 7.3534 3.3062 7.3534 7.3534z" fill="#2eb67d"/><g fill="#ecb22e"><path d="m59.2346 70.2932c4.0472 0 7.3534 3.3062 7.3534 7.3534s-3.3062 7.3534-7.3534 7.3534c-4.0473 0-7.3535-3.3062-7.3535-7.3534v-7.3534z"/><path d="m59.2346 66.588c-4.0473 0-7.3535-3.3062-7.3535-7.3535 0-4.0472 3.3062-7.3534 7.3535-7.3534h18.412c4.0472 0 7.3534 3.3062 7.3534 7.3534 0 4.0473-3.3062 7.3535-7.3534 7.3535z"/></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/zendesk.svg b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/zendesk.svg
new file mode 100644
index 00000000000000..f7bc1fda0c9ac7
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/assets/zendesk.svg
@@ -0,0 +1 @@
+<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><mask id="a"><path d="m912 1779h100v100h-100z" fill="#fff"/></mask><g transform="translate(-912 -1779)"><path d="m912 1779h100v100h-100z" fill="#fff"/><g fill="#03363d" mask="url(#a)"><path d="m32.3348.0000004v36.7933996h-32.3347981z" transform="translate(927 1817.21)"/><path d="m32.3348-.0000003c0 4.0412803-1.7033 7.9170403-4.7353 10.7747003-3.032 2.8576-7.1442 4.463-11.4321 4.463s-8.4001-1.6054-11.43207-4.463c-3.03198-2.85766-4.7353281-6.73342-4.7353281-10.7747003z" transform="translate(927 1804)"/><path d="m-.00000169 15.2377c0-4.0413 1.70334169-7.91708 4.73532169-10.77469 3.03198-2.85762 7.14418-4.46301119 11.43208-4.46301119s8.4001 1.60539119 11.4321 4.46301119c3.032 2.85761 4.7353 6.73339 4.7353 10.77469z" transform="translate(964.662 1838.76)"/><path d="m-.00000169 36.7934v-36.7934003h32.33830169z" transform="translate(964.662 1804)"/></g></g></svg>
\ No newline at end of file
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_icon/index.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_icon/index.ts
new file mode 100644
index 00000000000000..da0d11cc1fdc5c
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_icon/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { SourceIcon } from './source_icon';
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_icon/source_icon.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_icon/source_icon.test.tsx
new file mode 100644
index 00000000000000..dd37ba9b6d8590
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_icon/source_icon.test.tsx
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import '../../../../__mocks__/shallow_usecontext.mock';
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import { SourceIcon } from './';
+
+describe('SourceIcon', () => {
+  it('renders unwrapped icon', () => {
+    const wrapper = shallow(<SourceIcon name="foo" serviceType="custom" />);
+
+    expect(wrapper.find('img')).toHaveLength(1);
+    expect(wrapper.find('.user-group-source')).toHaveLength(0);
+  });
+
+  it('renders wrapped icon', () => {
+    const wrapper = shallow(<SourceIcon name="foo" wrapped serviceType="custom" />);
+
+    expect(wrapper.find('.user-group-source')).toHaveLength(1);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_icon/source_icon.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_icon/source_icon.tsx
new file mode 100644
index 00000000000000..ddbe327a40a305
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_icon/source_icon.tsx
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import _camelCase from 'lodash/camelCase';
+
+import { images } from '../assets';
+
+interface ISourceIconProps {
+  serviceType: string;
+  name: string;
+  className?: string;
+  wrapped?: boolean;
+}
+
+export const SourceIcon: React.FC<ISourceIconProps> = ({
+  name,
+  serviceType,
+  className,
+  wrapped,
+}) => {
+  const icon = <img src={images[_camelCase(serviceType)]} alt={name} className={className} />;
+  return wrapped ? (
+    <div className="user-group-source" title={name}>
+      {icon}
+    </div>
+  ) : (
+    <>{icon}</>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/index.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/index.ts
new file mode 100644
index 00000000000000..f7a99b59837a5d
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { SourceRow, ISourceRow } from './source_row';
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/source_row.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/source_row.test.tsx
new file mode 100644
index 00000000000000..2bde3b70f82b50
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/source_row.test.tsx
@@ -0,0 +1,83 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import '../../../../__mocks__/shallow_usecontext.mock';
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import { EuiTableRow, EuiSwitch, EuiIcon } from '@elastic/eui';
+import { contentSources } from '../../../__mocks__/content_sources.mock';
+
+import { SourceIcon } from '../source_icon';
+
+import { SourceRow } from './';
+
+const onToggle = jest.fn();
+
+describe('SourceRow', () => {
+  it('renders with no "Fix" link', () => {
+    const wrapper = shallow(<SourceRow source={contentSources[0]} />);
+
+    expect(wrapper.find(EuiTableRow)).toHaveLength(1);
+    expect(wrapper.contains('Fix')).toBeFalsy();
+    expect(wrapper.find(SourceIcon).prop('serviceType')).toEqual('custom');
+  });
+
+  it('calls handler on click', () => {
+    const wrapper = shallow(<SourceRow onSearchableToggle={onToggle} source={contentSources[0]} />);
+    wrapper.find(EuiSwitch).simulate('change', { target: { checked: true } });
+
+    expect(onToggle).toHaveBeenCalled();
+  });
+
+  it('renders "Fix" link', () => {
+    const source = {
+      ...contentSources[0],
+      status: 'error',
+      errorReason: 1,
+    };
+    const wrapper = shallow(<SourceRow isOrganization source={source} />);
+
+    expect(wrapper.contains('Fix')).toBeTruthy();
+  });
+
+  it('renders loading icon when indexing', () => {
+    const source = {
+      ...contentSources[0],
+      status: 'indexing',
+    };
+    const wrapper = shallow(<SourceRow isOrganization source={source} />);
+
+    expect(wrapper.find(SourceIcon).prop('serviceType')).toEqual('loadingSmall');
+  });
+
+  it('renders warning dot when more config needed', () => {
+    const source = {
+      ...contentSources[0],
+      status: 'need-more-config',
+    };
+    const wrapper = shallow(<SourceRow isOrganization source={source} />);
+
+    expect(wrapper.find(EuiIcon).prop('color')).toEqual('warning');
+  });
+
+  it('renders remote tooltip when source is federated', () => {
+    const source = {
+      ...contentSources[0],
+      isFederatedSource: true,
+    };
+    const wrapper = shallow(<SourceRow isOrganization source={source} />);
+
+    expect(wrapper.find('.source-row__document-count').contains('Remote')).toBeTruthy();
+  });
+
+  it('renders details link', () => {
+    const wrapper = shallow(<SourceRow isOrganization showDetails source={contentSources[0]} />);
+
+    expect(wrapper.find('[data-test-subj="SourceDetailsLink"]')).toHaveLength(1);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/source_row.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/source_row.tsx
new file mode 100644
index 00000000000000..17ca8e58a80fab
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/source_row.tsx
@@ -0,0 +1,171 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import classNames from 'classnames';
+import _kebabCase from 'lodash/kebabCase';
+import { Link } from 'react-router-dom';
+
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiSwitch,
+  EuiSwitchEvent,
+  EuiTableRow,
+  EuiTableRowCell,
+  EuiText,
+  EuiToolTip,
+} from '@elastic/eui';
+
+import { SOURCE_STATUSES as statuses } from '../../../constants';
+import { IContentSourceDetails } from '../../../types';
+import { ADD_SOURCE_PATH, SOURCE_DETAILS_PATH, getContentSourcePath } from '../../../routes';
+
+import { SourceIcon } from '../source_icon';
+
+const CREDENTIALS_INVALID_ERROR_REASON = 1;
+
+export interface ISourceRow {
+  showDetails?: boolean;
+  isOrganization?: boolean;
+  onSearchableToggle?(sourceId: string, isSearchable: boolean): void;
+}
+
+interface ISourceRowProps extends ISourceRow {
+  source: IContentSourceDetails;
+}
+
+export const SourceRow: React.FC<ISourceRowProps> = ({
+  source: {
+    id,
+    serviceType,
+    searchable,
+    supportedByLicense,
+    status,
+    statusMessage,
+    name,
+    documentCount,
+    isFederatedSource,
+    errorReason,
+    allowsReauth,
+  },
+  onSearchableToggle,
+  isOrganization,
+  showDetails,
+}) => {
+  const isIndexing = status === statuses.INDEXING;
+  const hasError = status === statuses.ERROR || status === statuses.DISCONNECTED;
+  const showFix =
+    isOrganization && hasError && allowsReauth && errorReason === CREDENTIALS_INVALID_ERROR_REASON;
+
+  const rowClass = classNames(
+    'source-row',
+    { 'content-section--disabled': !searchable },
+    { 'source-row source-row--error': hasError }
+  );
+
+  // eslint-disable-next-line @typescript-eslint/naming-convention
+  const imageClass = classNames('source-row__icon', { 'source-row__icon--loading': isIndexing });
+
+  const fixLink = (
+    <Link
+      to={{
+        pathname: `${ADD_SOURCE_PATH}/${_kebabCase(serviceType)}/re-authenticate`,
+        search: `?sourceId=${id}`,
+      }}
+    >
+      Fix
+    </Link>
+  );
+
+  const remoteTooltip = (
+    <>
+      <span>Remote</span>
+      <EuiToolTip
+        position="top"
+        content="Remote sources rely on the source's search service directly, and no content is indexed with Workplace Search. Speed and integrity of results are functions of the third-party service's health and performance."
+      >
+        <EuiIcon type="questionInCircle" />
+      </EuiToolTip>
+    </>
+  );
+
+  return (
+    <EuiTableRow data-test-subj="GroupsRow" className={rowClass}>
+      <EuiTableRowCell>
+        <EuiFlexGroup justifyContent="flexStart" alignItems="center" responsive={false}>
+          <EuiFlexItem grow={false}>
+            <SourceIcon
+              serviceType={isIndexing ? 'loadingSmall' : serviceType}
+              name={name}
+              className={imageClass}
+            />
+          </EuiFlexItem>
+          <EuiFlexItem>
+            <span className="source-row__name">{name}</span>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiTableRowCell>
+      <EuiTableRowCell>
+        <EuiFlexGroup
+          justifyContent="flexStart"
+          alignItems="center"
+          responsive={false}
+          gutterSize="xs"
+        >
+          {status === 'need-more-config' && (
+            <EuiFlexItem grow={false}>
+              <EuiIcon size="m" type="dot" color="warning" />
+            </EuiFlexItem>
+          )}
+          <EuiFlexItem>
+            <EuiText
+              className={`source-row__status source-row__status--${status}`}
+              color={status === 'need-more-config' ? 'default' : 'subdued'}
+              size="xs"
+            >
+              {statusMessage}
+            </EuiText>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiTableRowCell>
+      <EuiTableRowCell className="source-row__document-count" data-test-subj="SourceDocumentCount">
+        {isFederatedSource ? remoteTooltip : parseInt(documentCount, 10).toLocaleString('en-US')}
+      </EuiTableRowCell>
+      {onSearchableToggle && (
+        <EuiTableRowCell>
+          <EuiSwitch
+            checked={searchable}
+            onChange={(e: EuiSwitchEvent) => onSearchableToggle(id, e.target.checked)}
+            disabled={!supportedByLicense}
+            compressed
+            label="Source Searchable Toggle"
+            showLabel={false}
+            data-test-subj="SourceSearchableToggle"
+          />
+        </EuiTableRowCell>
+      )}
+      <EuiTableRowCell className="source-row__actions">
+        <EuiFlexGroup justifyContent="flexEnd" alignItems="center" gutterSize="s">
+          {showFix && <EuiFlexItem grow={false}>{fixLink}</EuiFlexItem>}
+          <EuiFlexItem grow={false}>
+            {showDetails && (
+              <Link
+                className="eui-textNoWrap"
+                data-test-subj="SourceDetailsLink"
+                to={getContentSourcePath(SOURCE_DETAILS_PATH, id, !!isOrganization)}
+              >
+                Details
+              </Link>
+            )}
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiTableRowCell>
+    </EuiTableRow>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/sources_table/index.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/sources_table/index.ts
new file mode 100644
index 00000000000000..bb5f490ed472b1
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/sources_table/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { SourcesTable } from './sources_table';
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/sources_table/sources_table.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/sources_table/sources_table.test.tsx
new file mode 100644
index 00000000000000..dfac8525471b49
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/sources_table/sources_table.test.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import { EuiTable } from '@elastic/eui';
+import { TableHeader } from '../../../../shared/table_header/table_header';
+import { contentSources } from '../../../__mocks__/content_sources.mock';
+
+import { SourceRow } from '../source_row';
+
+import { SourcesTable } from './';
+
+const onToggle = jest.fn();
+
+describe('SourcesTable', () => {
+  it('renders', () => {
+    const wrapper = shallow(<SourcesTable sources={contentSources} />);
+
+    expect(wrapper.find(EuiTable)).toHaveLength(1);
+    expect(wrapper.find(SourceRow)).toHaveLength(2);
+  });
+
+  it('renders "Searchable" header item when toggle fn present', () => {
+    const wrapper = shallow(
+      <SourcesTable onSearchableToggle={onToggle} sources={contentSources} />
+    );
+
+    expect(wrapper.find(TableHeader).prop('headerItems')).toContain('Searchable');
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/sources_table/sources_table.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/sources_table/sources_table.tsx
new file mode 100644
index 00000000000000..184aadc1dad848
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/sources_table/sources_table.tsx
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { EuiTable, EuiTableBody } from '@elastic/eui';
+
+import { TableHeader } from '../../../../shared/table_header/table_header';
+import { SourceRow, ISourceRow } from '../source_row';
+import { IContentSourceDetails } from '../../../types';
+
+interface ISourcesTableProps extends ISourceRow {
+  sources: IContentSourceDetails[];
+}
+
+export const SourcesTable: React.FC<ISourcesTableProps> = ({
+  sources,
+  showDetails,
+  isOrganization,
+  onSearchableToggle,
+}) => {
+  const headerItems = ['Source', 'Status', 'Documents'];
+  if (onSearchableToggle) headerItems.push('Searchable');
+
+  return (
+    <EuiTable className="table table--emphasized" responsive={false}>
+      <TableHeader extraCell headerItems={headerItems} />
+      <EuiTableBody>
+        {sources.map((source) => (
+          <SourceRow
+            key={source.id}
+            source={source}
+            showDetails={showDetails}
+            isOrganization={isOrganization}
+            onSearchableToggle={onSearchableToggle}
+          />
+        ))}
+      </EuiTableBody>
+    </EuiTable>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/table_pagination_bar/index.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/table_pagination_bar/index.ts
new file mode 100644
index 00000000000000..1598ee760c059a
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/table_pagination_bar/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { TablePaginationBar } from './table_pagination_bar';
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/table_pagination_bar/table_pagination_bar.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/table_pagination_bar/table_pagination_bar.test.tsx
new file mode 100644
index 00000000000000..14d4dfecd0094d
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/table_pagination_bar/table_pagination_bar.test.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import { EuiFlexGroup, EuiTablePagination } from '@elastic/eui';
+
+import { TablePaginationBar } from './';
+
+const onChange = jest.fn();
+
+describe('TablePaginationBar', () => {
+  it('renders', () => {
+    const wrapper = shallow(
+      <TablePaginationBar onChangePage={onChange} totalPages={1} totalItems={10} />
+    );
+
+    expect(wrapper.find(EuiTablePagination)).toHaveLength(1);
+    expect(wrapper.find(EuiFlexGroup)).toHaveLength(2);
+    expect(wrapper.find(EuiTablePagination).prop('itemsPerPage')).toEqual(10);
+    expect(wrapper.find(EuiTablePagination).prop('pageCount')).toEqual(1);
+  });
+
+  it('passes max page count when showAllPages false', () => {
+    const wrapper = shallow(
+      <TablePaginationBar onChangePage={onChange} totalPages={1000} totalItems={10000} />
+    );
+
+    expect(wrapper.find(EuiTablePagination).prop('pageCount')).toEqual(100);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/table_pagination_bar/table_pagination_bar.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/table_pagination_bar/table_pagination_bar.tsx
new file mode 100644
index 00000000000000..04f5b9a477058a
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/table_pagination_bar/table_pagination_bar.tsx
@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { EuiFlexGroup, EuiFlexItem, EuiTablePagination } from '@elastic/eui';
+
+interface ITablePaginationBarProps {
+  itemLabel?: string;
+  itemsPerPage?: number;
+  totalPages: number;
+  totalItems: number;
+  activePage?: number;
+  hidePerPageOptions?: boolean;
+  hideLabelCount?: boolean;
+  clearFiltersLink?: React.ReactElement;
+  onChangePage(nextPage: number): void;
+}
+
+const MAX_PAGES = 100;
+
+export const TablePaginationBar: React.FC<ITablePaginationBarProps> = ({
+  itemLabel = 'Items',
+  itemsPerPage = 10,
+  totalPages,
+  totalItems,
+  activePage = 1,
+  hidePerPageOptions = true,
+  hideLabelCount = false,
+  onChangePage,
+  clearFiltersLink,
+}) => {
+  // EUI component starts page at 0. API starts at 1.
+  const currentPage = activePage - 1;
+  const showAllPages = totalPages < MAX_PAGES;
+
+  const pageRangeText = () => {
+    const rangeEnd = activePage === totalPages ? totalItems : itemsPerPage * activePage;
+    const rangeStart = currentPage * itemsPerPage + 1;
+    const rangeEl = (
+      <strong>
+        {rangeStart}-{rangeEnd}
+      </strong>
+    );
+    const totalEl = <strong>{totalItems.toLocaleString()}</strong>;
+
+    return (
+      <EuiFlexGroup alignItems="center" justifyContent="flexStart">
+        <EuiFlexItem grow={false}>
+          <div>
+            Showing {rangeEl}
+            {showAllPages && (
+              <>
+                {' '}
+                of {totalEl} {itemLabel}
+              </>
+            )}
+          </div>
+        </EuiFlexItem>
+        <EuiFlexItem>{clearFiltersLink}</EuiFlexItem>
+      </EuiFlexGroup>
+    );
+  };
+
+  return (
+    <EuiFlexGroup alignItems="center">
+      {!hideLabelCount && <EuiFlexItem>{pageRangeText()}</EuiFlexItem>}
+      <EuiFlexItem>
+        <EuiTablePagination
+          hidePerPageOptions={hidePerPageOptions}
+          activePage={currentPage}
+          itemsPerPage={itemsPerPage}
+          pageCount={showAllPages ? totalPages : MAX_PAGES}
+          onChangePage={onChangePage}
+        />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_icon/index.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_icon/index.ts
new file mode 100644
index 00000000000000..e9ee92bed68cad
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_icon/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { UserIcon } from './user_icon';
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_icon/user_icon.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_icon/user_icon.test.tsx
new file mode 100644
index 00000000000000..f8c1d00047825f
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_icon/user_icon.test.tsx
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import { users } from '../../../__mocks__/users.mock';
+
+import { UserIcon } from './user_icon';
+
+describe('SourcesTable', () => {
+  it('renders with picture', () => {
+    const wrapper = shallow(<UserIcon {...users[0]} />);
+
+    expect(wrapper.find('.avatar')).toHaveLength(1);
+    expect(wrapper.find('.avatar__image')).toHaveLength(1);
+  });
+
+  it('renders without picture', () => {
+    const user = {
+      ...users[0],
+      pictureUrl: null,
+    };
+    const wrapper = shallow(<UserIcon {...user} />);
+
+    expect(wrapper.find('.avatar')).toHaveLength(1);
+    expect(wrapper.find('.avatar__text')).toHaveLength(1);
+  });
+
+  it('renders fallback "alt" value when name not present', () => {
+    const user = {
+      ...users[0],
+      name: null,
+    };
+    const wrapper = shallow(<UserIcon {...user} />);
+
+    expect(wrapper.find('img').prop('alt')).toEqual(user.email);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_icon/user_icon.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_icon/user_icon.tsx
new file mode 100644
index 00000000000000..28ea303d14eaf9
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_icon/user_icon.tsx
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { IUser } from '../../../types';
+
+export const UserIcon: React.FC<IUser> = ({ name, pictureUrl, color, initials, email }) => (
+  <div className="avatar avatar--small" style={{ backgroundColor: color }}>
+    {pictureUrl ? (
+      <img src={pictureUrl} className="avatar__image" alt={name || email} />
+    ) : (
+      <span className="avatar__text">{initials}</span>
+    )}
+  </div>
+);
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_row/index.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_row/index.ts
new file mode 100644
index 00000000000000..cc4650d70dad03
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_row/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { UserRow } from './user_row';
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_row/user_row.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_row/user_row.test.tsx
new file mode 100644
index 00000000000000..20d2732e8c82a3
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_row/user_row.test.tsx
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import { EuiTableRow } from '@elastic/eui';
+
+import { users } from '../../../__mocks__/users.mock';
+
+import { UserRow } from './';
+
+describe('SourcesTable', () => {
+  it('renders', () => {
+    const wrapper = shallow(<UserRow user={users[0]} />);
+
+    expect(wrapper.find(EuiTableRow)).toHaveLength(1);
+    expect(wrapper.find('span')).toHaveLength(0);
+  });
+
+  it('renders with email visible', () => {
+    const wrapper = shallow(<UserRow user={users[0]} showEmail />);
+
+    expect(wrapper.find('span')).toHaveLength(1);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_row/user_row.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_row/user_row.tsx
new file mode 100644
index 00000000000000..45866c10a5b217
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/user_row/user_row.tsx
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { EuiTableRow, EuiTableRowCell } from '@elastic/eui';
+
+import { IUser } from '../../../types';
+
+interface IUserRowProps {
+  user: IUser;
+  showEmail?: boolean;
+}
+
+export const UserRow: React.FC<IUserRowProps> = ({ user: { name, email }, showEmail }) => (
+  <EuiTableRow>
+    <EuiTableRowCell>{name}</EuiTableRowCell>
+    <EuiTableRowCell>{showEmail && <span>{email}</span>}</EuiTableRowCell>
+  </EuiTableRow>
+);
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/constants.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/constants.ts
new file mode 100644
index 00000000000000..9f313a6995ad58
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/constants.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const MAX_TABLE_ROW_ICONS = 3;
+
+export const SOURCE_STATUSES = {
+  INDEXING: 'indexing',
+  SYNCED: 'synced',
+  SYNCING: 'syncing',
+  AWAITING_USER_ACTION: 'awaiting_user_action',
+  ERROR: 'error',
+  DISCONNECTED: 'disconnected',
+  ALWAYS_SYNCED: 'always_synced',
+};
+
+export const CUSTOM_SERVICE_TYPE = 'custom';
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx
index 23e24e343937d4..6a51b49869eafb 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx
@@ -8,6 +8,7 @@ import React, { useContext, useEffect } from 'react';
 import { Route, Redirect, Switch } from 'react-router-dom';
 import { useActions, useValues } from 'kea';
 
+import { WORKPLACE_SEARCH_PLUGIN } from '../../../common/constants';
 import { IInitialAppData } from '../../../common/types';
 import { KibanaContext, IKibanaContext } from '../index';
 import { HttpLogic } from '../shared/http';
@@ -19,6 +20,7 @@ import { SETUP_GUIDE_PATH } from './routes';
 
 import { SetupGuide } from './views/setup_guide';
 import { ErrorState } from './views/error_state';
+import { NotFound } from '../shared/not_found';
 import { Overview } from './views/overview';
 
 export const WorkplaceSearch: React.FC<IInitialAppData> = (props) => {
@@ -53,6 +55,9 @@ export const WorkplaceSearchConfigured: React.FC<IInitialAppData> = (props) => {
                 {/* Will replace with groups component subsequent PR */}
                 <div />
               </Route>
+              <Route>
+                <NotFound product={WORKPLACE_SEARCH_PLUGIN} />
+              </Route>
             </Switch>
           )}
         </Layout>
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/routes.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/routes.test.tsx
new file mode 100644
index 00000000000000..d03c0abb441b98
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/routes.test.tsx
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import { EuiLink } from '@elastic/eui';
+
+import {
+  getContentSourcePath,
+  SOURCES_PATH,
+  ORG_SOURCES_PATH,
+  SOURCE_DETAILS_PATH,
+} from './routes';
+
+const TestComponent = ({ id, isOrg }: { id: string; isOrg?: boolean }) => {
+  const href = getContentSourcePath(SOURCE_DETAILS_PATH, id, !!isOrg);
+  return <EuiLink href={href}>test</EuiLink>;
+};
+
+describe('getContentSourcePath', () => {
+  it('should format org route', () => {
+    const wrapper = shallow(<TestComponent id="123" isOrg />);
+    const path = wrapper.find(EuiLink).prop('href');
+
+    expect(path).toEqual(`${ORG_SOURCES_PATH}/123`);
+  });
+
+  it('should format user route', () => {
+    const wrapper = shallow(<TestComponent id="123" />);
+    const path = wrapper.find(EuiLink).prop('href');
+
+    expect(path).toEqual(`${SOURCES_PATH}/123`);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/routes.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/routes.ts
index 993a1a378e7385..e833dde4c1b728 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/routes.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/routes.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { generatePath } from 'react-router-dom';
+
 import { CURRENT_MAJOR_VERSION } from '../../../common/version';
 
 export const SETUP_GUIDE_PATH = '/setup_guide';
@@ -107,4 +109,8 @@ export const EDIT_SLACK_PATH = `${ORG_SETTINGS_CONNECTORS_PATH}/slack/edit`;
 export const EDIT_ZENDESK_PATH = `${ORG_SETTINGS_CONNECTORS_PATH}/zendesk/edit`;
 export const EDIT_CUSTOM_PATH = `${ORG_SETTINGS_CONNECTORS_PATH}/custom/edit`;
 
-export const getSourcePath = (sourceId: string): string => `${ORG_SOURCES_PATH}/${sourceId}`;
+export const getContentSourcePath = (
+  path: string,
+  sourceId: string,
+  isOrganization: boolean
+): string => generatePath(isOrganization ? ORG_PATH + path : path, { sourceId });
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/types.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/types.ts
index a8348a6f69a394..3866da738cbb61 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/types.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/types.ts
@@ -7,3 +7,43 @@
 export * from '../../../common/types/workplace_search';
 
 export type TSpacerSize = 'xs' | 's' | 'm' | 'l' | 'xl' | 'xxl';
+
+export interface IGroup {
+  id: string;
+  name: string;
+  createdAt: string;
+  updatedAt: string;
+  contentSources: IContentSource[];
+  users: IUser[];
+  usersCount: number;
+  color?: string;
+}
+
+export interface IUser {
+  id: string;
+  name: string | null;
+  initials: string;
+  pictureUrl: string | null;
+  color: string;
+  email: string;
+  role?: string;
+  groupIds: string[];
+}
+
+export interface IContentSource {
+  id: string;
+  serviceType: string;
+  name: string;
+}
+
+export interface IContentSourceDetails extends IContentSource {
+  status: string;
+  statusMessage: string;
+  documentCount: string;
+  isFederatedSource: boolean;
+  searchable: boolean;
+  supportedByLicense: boolean;
+  errorReason: number;
+  allowsReauth: boolean;
+  boost: number;
+}
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.tsx
index 3c476be8d10e66..441f45a947a493 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.tsx
@@ -15,7 +15,7 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { ContentSection } from '../../components/shared/content_section';
 import { sendTelemetry } from '../../../shared/telemetry';
 import { KibanaContext, IKibanaContext } from '../../../index';
-import { getSourcePath } from '../../routes';
+import { SOURCE_DETAILS_PATH, getContentSourcePath } from '../../routes';
 
 import { OverviewLogic } from './overview_logic';
 
@@ -107,7 +107,7 @@ export const RecentActivityItem: React.FC<IFeedActivity> = ({
   const linkProps = {
     onClick,
     target: '_blank',
-    href: getWorkplaceSearchUrl(getSourcePath(sourceId)),
+    href: getWorkplaceSearchUrl(getContentSourcePath(SOURCE_DETAILS_PATH, sourceId, true)),
     external: true,
     color: status === 'error' ? 'danger' : 'primary',
     'data-test-subj': 'viewSourceDetailsLink',
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/assets/getting_started.png b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/setup_guide/assets/getting_started.png
similarity index 100%
rename from x-pack/plugins/enterprise_search/public/applications/workplace_search/assets/getting_started.png
rename to x-pack/plugins/enterprise_search/public/applications/workplace_search/views/setup_guide/assets/getting_started.png
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/setup_guide/setup_guide.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/setup_guide/setup_guide.tsx
index f9b00bdf29642d..d632792f2a666f 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/setup_guide/setup_guide.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/setup_guide/setup_guide.tsx
@@ -13,7 +13,7 @@ import { WORKPLACE_SEARCH_PLUGIN } from '../../../../../common/constants';
 import { SetupGuide as SetupGuideLayout } from '../../../shared/setup_guide';
 import { SetWorkplaceSearchChrome as SetPageChrome } from '../../../shared/kibana_chrome';
 import { SendWorkplaceSearchTelemetry as SendTelemetry } from '../../../shared/telemetry';
-import GettingStarted from '../../assets/getting_started.png';
+import GettingStarted from './assets/getting_started.png';
 
 const GETTING_STARTED_LINK_URL =
   'https://www.elastic.co/guide/en/workplace-search/current/workplace-search-getting-started.html';
diff --git a/x-pack/plugins/enterprise_search/public/plugin.ts b/x-pack/plugins/enterprise_search/public/plugin.ts
index 1ce6bae8ff6031..83598a0dc971dc 100644
--- a/x-pack/plugins/enterprise_search/public/plugin.ts
+++ b/x-pack/plugins/enterprise_search/public/plugin.ts
@@ -27,8 +27,6 @@ import {
   WORKPLACE_SEARCH_PLUGIN,
 } from '../common/constants';
 import { ExternalUrl, IExternalUrl } from './applications/shared/enterprise_search_url';
-import AppSearchLogo from './applications/app_search/assets/logo.svg';
-import WorkplaceSearchLogo from './applications/workplace_search/assets/logo.svg';
 
 export interface ClientConfigType {
   host?: string;
@@ -117,7 +115,7 @@ export class EnterpriseSearchPlugin implements Plugin {
       plugins.home.featureCatalogue.register({
         id: APP_SEARCH_PLUGIN.ID,
         title: APP_SEARCH_PLUGIN.NAME,
-        icon: AppSearchLogo,
+        icon: 'appSearchApp',
         description: APP_SEARCH_PLUGIN.DESCRIPTION,
         path: APP_SEARCH_PLUGIN.URL,
         category: FeatureCatalogueCategory.DATA,
@@ -127,7 +125,7 @@ export class EnterpriseSearchPlugin implements Plugin {
       plugins.home.featureCatalogue.register({
         id: WORKPLACE_SEARCH_PLUGIN.ID,
         title: WORKPLACE_SEARCH_PLUGIN.NAME,
-        icon: WorkplaceSearchLogo,
+        icon: 'workplaceSearchApp',
         description: WORKPLACE_SEARCH_PLUGIN.DESCRIPTION,
         path: WORKPLACE_SEARCH_PLUGIN.URL,
         category: FeatureCatalogueCategory.DATA,
diff --git a/x-pack/plugins/enterprise_search/server/collectors/app_search/telemetry.test.ts b/x-pack/plugins/enterprise_search/server/collectors/app_search/telemetry.test.ts
index 189f8278f1b070..6532e06f7051cf 100644
--- a/x-pack/plugins/enterprise_search/server/collectors/app_search/telemetry.test.ts
+++ b/x-pack/plugins/enterprise_search/server/collectors/app_search/telemetry.test.ts
@@ -22,6 +22,7 @@ describe('App Search Telemetry Usage Collector', () => {
         'ui_viewed.setup_guide': 10,
         'ui_viewed.engines_overview': 20,
         'ui_error.cannot_connect': 3,
+        'ui_error.not_found': 7,
         'ui_clicked.create_first_engine_button': 40,
         'ui_clicked.header_launch_button': 50,
         'ui_clicked.engine_table_link': 60,
@@ -60,6 +61,7 @@ describe('App Search Telemetry Usage Collector', () => {
         },
         ui_error: {
           cannot_connect: 3,
+          not_found: 7,
         },
         ui_clicked: {
           create_first_engine_button: 40,
@@ -86,6 +88,7 @@ describe('App Search Telemetry Usage Collector', () => {
         },
         ui_error: {
           cannot_connect: 0,
+          not_found: 0,
         },
         ui_clicked: {
           create_first_engine_button: 0,
diff --git a/x-pack/plugins/enterprise_search/server/collectors/app_search/telemetry.ts b/x-pack/plugins/enterprise_search/server/collectors/app_search/telemetry.ts
index f700088cb67a03..ede776b6e0dce1 100644
--- a/x-pack/plugins/enterprise_search/server/collectors/app_search/telemetry.ts
+++ b/x-pack/plugins/enterprise_search/server/collectors/app_search/telemetry.ts
@@ -17,6 +17,7 @@ interface ITelemetry {
   };
   ui_error: {
     cannot_connect: number;
+    not_found: number;
   };
   ui_clicked: {
     create_first_engine_button: number;
@@ -47,6 +48,7 @@ export const registerTelemetryUsageCollector = (
       },
       ui_error: {
         cannot_connect: { type: 'long' },
+        not_found: { type: 'long' },
       },
       ui_clicked: {
         create_first_engine_button: { type: 'long' },
@@ -77,6 +79,7 @@ const fetchTelemetryMetrics = async (savedObjects: SavedObjectsServiceStart, log
     },
     ui_error: {
       cannot_connect: 0,
+      not_found: 0,
     },
     ui_clicked: {
       create_first_engine_button: 0,
@@ -97,6 +100,7 @@ const fetchTelemetryMetrics = async (savedObjects: SavedObjectsServiceStart, log
     },
     ui_error: {
       cannot_connect: get(savedObjectAttributes, 'ui_error.cannot_connect', 0),
+      not_found: get(savedObjectAttributes, 'ui_error.not_found', 0),
     },
     ui_clicked: {
       create_first_engine_button: get(
diff --git a/x-pack/plugins/enterprise_search/server/collectors/workplace_search/telemetry.test.ts b/x-pack/plugins/enterprise_search/server/collectors/workplace_search/telemetry.test.ts
index 8960d6fa9b67b4..f7d73cb232b8dd 100644
--- a/x-pack/plugins/enterprise_search/server/collectors/workplace_search/telemetry.test.ts
+++ b/x-pack/plugins/enterprise_search/server/collectors/workplace_search/telemetry.test.ts
@@ -22,6 +22,7 @@ describe('Workplace Search Telemetry Usage Collector', () => {
         'ui_viewed.setup_guide': 10,
         'ui_viewed.overview': 20,
         'ui_error.cannot_connect': 3,
+        'ui_error.not_found': 7,
         'ui_clicked.header_launch_button': 30,
         'ui_clicked.org_name_change_button': 40,
         'ui_clicked.onboarding_card_button': 50,
@@ -61,6 +62,7 @@ describe('Workplace Search Telemetry Usage Collector', () => {
         },
         ui_error: {
           cannot_connect: 3,
+          not_found: 7,
         },
         ui_clicked: {
           header_launch_button: 30,
@@ -88,6 +90,7 @@ describe('Workplace Search Telemetry Usage Collector', () => {
         },
         ui_error: {
           cannot_connect: 0,
+          not_found: 0,
         },
         ui_clicked: {
           header_launch_button: 0,
diff --git a/x-pack/plugins/enterprise_search/server/collectors/workplace_search/telemetry.ts b/x-pack/plugins/enterprise_search/server/collectors/workplace_search/telemetry.ts
index 892de5cfee35e0..cc08febf41f454 100644
--- a/x-pack/plugins/enterprise_search/server/collectors/workplace_search/telemetry.ts
+++ b/x-pack/plugins/enterprise_search/server/collectors/workplace_search/telemetry.ts
@@ -17,6 +17,7 @@ interface ITelemetry {
   };
   ui_error: {
     cannot_connect: number;
+    not_found: number;
   };
   ui_clicked: {
     header_launch_button: number;
@@ -48,6 +49,7 @@ export const registerTelemetryUsageCollector = (
       },
       ui_error: {
         cannot_connect: { type: 'long' },
+        not_found: { type: 'long' },
       },
       ui_clicked: {
         header_launch_button: { type: 'long' },
@@ -79,6 +81,7 @@ const fetchTelemetryMetrics = async (savedObjects: SavedObjectsServiceStart, log
     },
     ui_error: {
       cannot_connect: 0,
+      not_found: 0,
     },
     ui_clicked: {
       header_launch_button: 0,
@@ -100,6 +103,7 @@ const fetchTelemetryMetrics = async (savedObjects: SavedObjectsServiceStart, log
     },
     ui_error: {
       cannot_connect: get(savedObjectAttributes, 'ui_error.cannot_connect', 0),
+      not_found: get(savedObjectAttributes, 'ui_error.not_found', 0),
     },
     ui_clicked: {
       header_launch_button: get(savedObjectAttributes, 'ui_clicked.header_launch_button', 0),
diff --git a/x-pack/plugins/features/server/plugin.test.ts b/x-pack/plugins/features/server/plugin.test.ts
index 3d85c2e9eb751c..00d578f5ca8664 100644
--- a/x-pack/plugins/features/server/plugin.test.ts
+++ b/x-pack/plugins/features/server/plugin.test.ts
@@ -4,23 +4,30 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { coreMock, savedObjectsServiceMock } from 'src/core/server/mocks';
-
 import { Plugin } from './plugin';
-const initContext = coreMock.createPluginInitializerContext();
-const coreSetup = coreMock.createSetup();
-const coreStart = coreMock.createStart();
-const typeRegistry = savedObjectsServiceMock.createTypeRegistryMock();
-typeRegistry.getVisibleTypes.mockReturnValue([
-  {
-    name: 'foo',
-    hidden: false,
-    mappings: { properties: {} },
-    namespaceType: 'single' as 'single',
-  },
-]);
-coreStart.savedObjects.getTypeRegistry.mockReturnValue(typeRegistry);
 
 describe('Features Plugin', () => {
+  let initContext: ReturnType<typeof coreMock.createPluginInitializerContext>;
+  let coreSetup: ReturnType<typeof coreMock.createSetup>;
+  let coreStart: ReturnType<typeof coreMock.createStart>;
+  let typeRegistry: ReturnType<typeof savedObjectsServiceMock.createTypeRegistryMock>;
+
+  beforeEach(() => {
+    initContext = coreMock.createPluginInitializerContext();
+    coreSetup = coreMock.createSetup();
+    coreStart = coreMock.createStart();
+    typeRegistry = savedObjectsServiceMock.createTypeRegistryMock();
+    typeRegistry.getVisibleTypes.mockReturnValue([
+      {
+        name: 'foo',
+        hidden: false,
+        mappings: { properties: {} },
+        namespaceType: 'single' as 'single',
+      },
+    ]);
+    coreStart.savedObjects.getTypeRegistry.mockReturnValue(typeRegistry);
+  });
+
   it('returns OSS + registered features', async () => {
     const plugin = new Plugin(initContext);
     const { registerFeature } = await plugin.setup(coreSetup, {});
@@ -88,4 +95,12 @@ describe('Features Plugin', () => {
     expect(soTypes.includes('foo')).toBe(true);
     expect(soTypes.includes('bar')).toBe(false);
   });
+
+  it('registers a capabilities provider', async () => {
+    const plugin = new Plugin(initContext);
+    await plugin.setup(coreSetup, {});
+
+    expect(coreSetup.capabilities.registerProvider).toHaveBeenCalledTimes(1);
+    expect(coreSetup.capabilities.registerProvider).toHaveBeenCalledWith(expect.any(Function));
+  });
 });
diff --git a/x-pack/plugins/features/server/plugin.ts b/x-pack/plugins/features/server/plugin.ts
index 5783b20eae6484..61b66d95ca44f3 100644
--- a/x-pack/plugins/features/server/plugin.ts
+++ b/x-pack/plugins/features/server/plugin.ts
@@ -61,10 +61,15 @@ export class Plugin {
       featureRegistry: this.featureRegistry,
     });
 
+    const getFeaturesUICapabilities = () =>
+      uiCapabilitiesForFeatures(this.featureRegistry.getAll());
+
+    core.capabilities.registerProvider(getFeaturesUICapabilities);
+
     return deepFreeze({
       registerFeature: this.featureRegistry.register.bind(this.featureRegistry),
       getFeatures: this.featureRegistry.getAll.bind(this.featureRegistry),
-      getFeaturesUICapabilities: () => uiCapabilitiesForFeatures(this.featureRegistry.getAll()),
+      getFeaturesUICapabilities,
     });
   }
 
diff --git a/x-pack/plugins/global_search/common/types.ts b/x-pack/plugins/global_search/common/types.ts
index 26940806a4ecd2..a08ecaf41b2137 100644
--- a/x-pack/plugins/global_search/common/types.ts
+++ b/x-pack/plugins/global_search/common/types.ts
@@ -51,12 +51,12 @@ export interface GlobalSearchProviderResult {
   icon?: string;
   /**
    * The url associated with this result.
-   * This can be either an absolute url, a path relative to the basePath, or a structure specifying if the basePath should be prepended.
+   * This can be either an absolute url, a path relative to the incoming request's basePath, or a structure specifying if the basePath should be prepended.
    *
    * @example
    * `result.url = 'https://kibana-instance:8080/base-path/app/my-app/my-result-type/id';`
    * `result.url = '/app/my-app/my-result-type/id';`
-   * `result.url = { path: '/base-path/app/my-app/my-result-type/id', prependBasePath: false };`
+   * `result.url = { path: '/base-path/s/my-other-space/app/my-app/my-result-type/id', prependBasePath: false };`
    */
   url: GlobalSearchProviderResultUrl;
   /** the score of the result, from 1 (lowest) to 100 (highest) */
diff --git a/x-pack/plugins/global_search/server/services/search_service.test.ts b/x-pack/plugins/global_search/server/services/search_service.test.ts
index fd705b4286680a..2460100a46dbbe 100644
--- a/x-pack/plugins/global_search/server/services/search_service.test.ts
+++ b/x-pack/plugins/global_search/server/services/search_service.test.ts
@@ -62,8 +62,8 @@ describe('SearchService', () => {
 
   beforeEach(() => {
     service = new SearchService();
-    basePath = httpServiceMock.createBasePath();
-    basePath.prepend.mockImplementation((path) => `/base-path${path}`);
+    basePath = httpServiceMock.createBasePath('/base-path');
+    basePath.get.mockReturnValue('/base-path/s/space');
     coreStart = coreMock.createStart();
     licenseChecker = licenseCheckerMock.create();
   });
@@ -283,7 +283,7 @@ describe('SearchService', () => {
         expect(batch.results).toHaveLength(2);
         expect(batch.results[0]).toEqual({
           ...resultA,
-          url: '/base-path/foo/bar',
+          url: '/base-path/s/space/foo/bar',
         });
         expect(batch.results[1]).toEqual({
           ...resultB,
diff --git a/x-pack/plugins/global_search/server/services/search_service.ts b/x-pack/plugins/global_search/server/services/search_service.ts
index 12eada2a1385ec..d79f3781c6bec1 100644
--- a/x-pack/plugins/global_search/server/services/search_service.ts
+++ b/x-pack/plugins/global_search/server/services/search_service.ts
@@ -17,6 +17,7 @@ import { processProviderResult } from '../../common/process_result';
 import { GlobalSearchConfigType } from '../config';
 import { getContextFactory, GlobalSearchContextFactory } from './context';
 import { GlobalSearchResultProvider, GlobalSearchFindOptions } from '../types';
+import { getRequestBasePath } from './utils';
 
 /** @public */
 export interface SearchServiceSetup {
@@ -132,6 +133,7 @@ export class SearchService {
     }
 
     const context = this.contextFactory!(request);
+    const basePath = getRequestBasePath(request, this.basePath!);
 
     const timeout$ = timer(this.config!.search_timeout.asMilliseconds()).pipe(map(mapToUndefined));
     const aborted$ = options.aborted$ ? merge(options.aborted$, timeout$) : timeout$;
@@ -143,7 +145,7 @@ export class SearchService {
     };
 
     const processResult = (result: GlobalSearchProviderResult) =>
-      processProviderResult(result, this.basePath!);
+      processProviderResult(result, basePath);
 
     const providersResults$ = [...this.providers.values()].map((provider) =>
       provider.find(term, providerOptions, context).pipe(
diff --git a/x-pack/plugins/global_search/server/services/utils.test.ts b/x-pack/plugins/global_search/server/services/utils.test.ts
new file mode 100644
index 00000000000000..232f72818f3307
--- /dev/null
+++ b/x-pack/plugins/global_search/server/services/utils.test.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { httpServiceMock, httpServerMock } from '../../../../../src/core/server/mocks';
+import { getRequestBasePath } from './utils';
+
+describe('getRequestBasePath', () => {
+  let basePath: ReturnType<typeof httpServiceMock.createBasePath>;
+  let request: ReturnType<typeof httpServerMock.createKibanaRequest>;
+
+  beforeEach(() => {
+    basePath = httpServiceMock.createBasePath();
+    request = httpServerMock.createKibanaRequest();
+  });
+
+  it('return a IBasePath prepending the request basePath', () => {
+    basePath.get.mockReturnValue('/base-path/s/my-space');
+    const requestBasePath = getRequestBasePath(request, basePath);
+
+    const fullPath = requestBasePath.prepend('/app/dashboard/some-id');
+
+    expect(fullPath).toBe('/base-path/s/my-space/app/dashboard/some-id');
+
+    expect(basePath.get).toHaveBeenCalledTimes(1);
+    expect(basePath.get).toHaveBeenCalledWith(request);
+
+    expect(basePath.prepend).not.toHaveBeenCalled();
+  });
+});
+
+httpServiceMock.createBasePath();
diff --git a/x-pack/plugins/global_search/server/services/utils.ts b/x-pack/plugins/global_search/server/services/utils.ts
new file mode 100644
index 00000000000000..18a01cfbe97578
--- /dev/null
+++ b/x-pack/plugins/global_search/server/services/utils.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import type { IBasePath, KibanaRequest } from 'src/core/server';
+import type { IBasePath as BasePathAccessor } from '../../common/utils';
+
+export const getRequestBasePath = (
+  request: KibanaRequest,
+  basePath: IBasePath
+): BasePathAccessor => {
+  const requestBasePath = basePath.get(request);
+  return {
+    prepend: (path) => {
+      return `${requestBasePath}/${path}`.replace(/\/{2,}/g, '/');
+    },
+  };
+};
diff --git a/x-pack/plugins/global_search_providers/public/providers/application.test.ts b/x-pack/plugins/global_search_providers/public/providers/application.test.ts
index 7d4143f9bcfa72..385ce91d8f9810 100644
--- a/x-pack/plugins/global_search_providers/public/providers/application.test.ts
+++ b/x-pack/plugins/global_search_providers/public/providers/application.test.ts
@@ -25,7 +25,6 @@ const createApp = (props: Partial<PublicAppInfo> = {}): PublicAppInfo => ({
   id: 'app1',
   title: 'App 1',
   appRoute: '/app/app1',
-  legacy: false,
   status: AppStatus.accessible,
   navLinkStatus: AppNavLinkStatus.visible,
   chromeless: false,
diff --git a/x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts b/x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts
index 1c5a446b8e5645..0c9daadf14fc62 100644
--- a/x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts
+++ b/x-pack/plugins/global_search_providers/public/providers/get_app_results.test.ts
@@ -4,30 +4,19 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AppNavLinkStatus, AppStatus, PublicAppInfo, PublicLegacyAppInfo } from 'src/core/public';
+import { AppNavLinkStatus, AppStatus, PublicAppInfo } from 'src/core/public';
 import { appToResult, getAppResults, scoreApp } from './get_app_results';
 
 const createApp = (props: Partial<PublicAppInfo> = {}): PublicAppInfo => ({
   id: 'app1',
   title: 'App 1',
   appRoute: '/app/app1',
-  legacy: false,
   status: AppStatus.accessible,
   navLinkStatus: AppNavLinkStatus.visible,
   chromeless: false,
   ...props,
 });
 
-const createLegacyApp = (props: Partial<PublicLegacyAppInfo> = {}): PublicLegacyAppInfo => ({
-  id: 'app1',
-  title: 'App 1',
-  appUrl: '/app/app1',
-  legacy: true,
-  status: AppStatus.accessible,
-  navLinkStatus: AppNavLinkStatus.visible,
-  ...props,
-});
-
 describe('getAppResults', () => {
   it('retrieves the matching results', () => {
     const apps = [
@@ -72,14 +61,6 @@ describe('scoreApp', () => {
       expect(scoreApp('1-2-3-4-5', createApp({ title: '123456789' }))).toBe(0);
     });
   });
-
-  it('works with legacy apps', () => {
-    expect(scoreApp('dashboard', createLegacyApp({ title: 'dashboard' }))).toBe(100);
-    expect(scoreApp('dash', createLegacyApp({ title: 'dashboard' }))).toBe(90);
-    expect(scoreApp('board', createLegacyApp({ title: 'dashboard' }))).toBe(75);
-    expect(scoreApp('0123456789', createLegacyApp({ title: '012345' }))).toBe(60);
-    expect(scoreApp('0123456789', createLegacyApp({ title: '12345' }))).toBe(0);
-  });
 });
 
 describe('appToResult', () => {
@@ -99,21 +80,4 @@ describe('appToResult', () => {
       score: 42,
     });
   });
-
-  it('converts a legacy app to a result', () => {
-    const app = createLegacyApp({
-      id: 'legacy',
-      title: 'Legacy',
-      euiIconType: 'legacyIcon',
-      appUrl: '/app/legacy',
-    });
-    expect(appToResult(app, 69)).toEqual({
-      id: 'legacy',
-      title: 'Legacy',
-      type: 'application',
-      icon: 'legacyIcon',
-      url: '/app/legacy',
-      score: 69,
-    });
-  });
 });
diff --git a/x-pack/plugins/global_search_providers/public/providers/get_app_results.ts b/x-pack/plugins/global_search_providers/public/providers/get_app_results.ts
index 1a1939230105b2..4b2901254076cf 100644
--- a/x-pack/plugins/global_search_providers/public/providers/get_app_results.ts
+++ b/x-pack/plugins/global_search_providers/public/providers/get_app_results.ts
@@ -5,12 +5,12 @@
  */
 
 import levenshtein from 'js-levenshtein';
-import { PublicAppInfo, PublicLegacyAppInfo } from 'src/core/public';
+import { PublicAppInfo } from 'src/core/public';
 import { GlobalSearchProviderResult } from '../../../global_search/public';
 
 export const getAppResults = (
   term: string,
-  apps: Array<PublicAppInfo | PublicLegacyAppInfo>
+  apps: PublicAppInfo[]
 ): GlobalSearchProviderResult[] => {
   return apps
     .map((app) => ({ app, score: scoreApp(term, app) }))
@@ -18,7 +18,7 @@ export const getAppResults = (
     .map(({ app, score }) => appToResult(app, score));
 };
 
-export const scoreApp = (term: string, { title }: PublicAppInfo | PublicLegacyAppInfo): number => {
+export const scoreApp = (term: string, { title }: PublicAppInfo): number => {
   term = term.toLowerCase();
   title = title.toLowerCase();
 
@@ -43,16 +43,13 @@ export const scoreApp = (term: string, { title }: PublicAppInfo | PublicLegacyAp
   return 0;
 };
 
-export const appToResult = (
-  app: PublicAppInfo | PublicLegacyAppInfo,
-  score: number
-): GlobalSearchProviderResult => {
+export const appToResult = (app: PublicAppInfo, score: number): GlobalSearchProviderResult => {
   return {
     id: app.id,
     title: app.title,
     type: 'application',
     icon: app.euiIconType,
-    url: app.legacy ? app.appUrl : app.appRoute,
+    url: app.appRoute,
     score,
   };
 };
diff --git a/x-pack/plugins/graph/public/components/search_bar.test.tsx b/x-pack/plugins/graph/public/components/search_bar.test.tsx
index 100122af943e18..1b783df1b7d026 100644
--- a/x-pack/plugins/graph/public/components/search_bar.test.tsx
+++ b/x-pack/plugins/graph/public/components/search_bar.test.tsx
@@ -21,7 +21,6 @@ import { ReactWrapper } from 'enzyme';
 import { createMockGraphStore } from '../state_management/mocks';
 import { Provider } from 'react-redux';
 
-jest.mock('ui/new_platform');
 jest.mock('../services/source_modal', () => ({ openSourceModal: jest.fn() }));
 
 const waitForIndexPatternFetch = () => new Promise((r) => setTimeout(r));
diff --git a/x-pack/plugins/graph/public/state_management/mocks.ts b/x-pack/plugins/graph/public/state_management/mocks.ts
index d32bc9a175a47c..f28f51544a6ede 100644
--- a/x-pack/plugins/graph/public/state_management/mocks.ts
+++ b/x-pack/plugins/graph/public/state_management/mocks.ts
@@ -17,8 +17,6 @@ import { GraphStoreDependencies, createRootReducer, GraphStore, GraphState } fro
 import { Workspace, GraphWorkspaceSavedObject, IndexPatternSavedObject } from '../types';
 import { IndexPattern } from '../../../../../src/plugins/data/public';
 
-jest.mock('ui/new_platform');
-
 export interface MockedGraphEnvironment {
   store: GraphStore;
   mockedDeps: jest.Mocked<GraphStoreDependencies>;
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.js.snap b/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.js.snap
deleted file mode 100644
index 39eb54b941ac4b..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.js.snap
+++ /dev/null
@@ -1,899 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`extend index management ilm banner extension should return extension when any index has lifecycle error 1`] = `
-Object {
-  "filter": Query {
-    "ast": _AST {
-      "_clauses": Array [
-        Object {
-          "field": "ilm.step",
-          "match": "must",
-          "operator": "eq",
-          "type": "field",
-          "value": "ERROR",
-        },
-      ],
-      "_indexedClauses": Object {
-        "field": Object {
-          "ilm.step": Array [
-            Object {
-              "field": "ilm.step",
-              "match": "must",
-              "operator": "eq",
-              "type": "field",
-              "value": "ERROR",
-            },
-          ],
-        },
-        "group": Array [],
-        "is": Object {},
-        "term": Array [],
-      },
-    },
-    "syntax": Object {
-      "parse": [Function],
-      "print": [Function],
-      "printClause": [Function],
-    },
-    "text": "ilm.step:ERROR",
-  },
-  "filterLabel": "Show errors",
-  "title": "1
-          index has
-          lifecycle errors",
-  "type": "warning",
-}
-`;
-
-exports[`extend index management ilm filter extension should return extension when any index has lifecycle policy 1`] = `
-Array [
-  Object {
-    "field": "ilm.managed",
-    "multiSelect": false,
-    "name": "Lifecycle status",
-    "options": Array [
-      Object {
-        "value": true,
-        "view": "Managed",
-      },
-      Object {
-        "value": false,
-        "view": "Unmanaged",
-      },
-    ],
-    "type": "field_value_selection",
-  },
-  Object {
-    "field": "ilm.phase",
-    "multiSelect": "or",
-    "name": "Lifecycle phase",
-    "options": Array [
-      Object {
-        "value": "hot",
-        "view": "Hot",
-      },
-      Object {
-        "value": "warm",
-        "view": "Warm",
-      },
-      Object {
-        "value": "frozen",
-        "view": "Frozen",
-      },
-      Object {
-        "value": "cold",
-        "view": "Cold",
-      },
-      Object {
-        "value": "delete",
-        "view": "Delete",
-      },
-    ],
-    "type": "field_value_selection",
-  },
-]
-`;
-
-exports[`extend index management ilm summary extension should return extension when index has lifecycle error 1`] = `
-<IndexLifecycleSummary
-  getUrlForApp={[Function]}
-  index={
-    Object {
-      "aliases": "none",
-      "documents": "2",
-      "documents_deleted": "0",
-      "health": "yellow",
-      "ilm": Object {
-        "action": "rollover",
-        "action_time_millis": 1544187775891,
-        "failed_step": "check-rollover-ready",
-        "index": "testy3",
-        "lifecycle_date_millis": 1544020872361,
-        "managed": true,
-        "phase": "hot",
-        "phase_execution": Object {
-          "modified_date_in_millis": 1544031699844,
-          "phase_definition": Object {
-            "actions": Object {
-              "rollover": Object {
-                "max_size": "1gb",
-              },
-            },
-            "min_age": "0s",
-          },
-          "policy": "testy",
-          "version": 1,
-        },
-        "phase_time_millis": 1544187775891,
-        "policy": "testy",
-        "step": "ERROR",
-        "step_info": Object {
-          "reason": "setting [index.lifecycle.rollover_alias] for index [testy3] is empty or not defined",
-          "stack_trace": "fakestacktrace",
-          "type": "illegal_argument_exception",
-        },
-        "step_time_millis": 1544187776208,
-      },
-      "name": "testy3",
-      "primary": "1",
-      "primary_size": "6.5kb",
-      "replica": "1",
-      "size": "6.5kb",
-      "status": "open",
-      "uuid": "XL11TLa3Tvq298_dMUzLHQ",
-    }
-  }
-  intl={
-    Object {
-      "defaultFormats": Object {},
-      "defaultLocale": "en",
-      "formatDate": [Function],
-      "formatHTMLMessage": [Function],
-      "formatMessage": [Function],
-      "formatNumber": [Function],
-      "formatPlural": [Function],
-      "formatRelative": [Function],
-      "formatTime": [Function],
-      "formats": Object {
-        "date": Object {
-          "full": Object {
-            "day": "numeric",
-            "month": "long",
-            "weekday": "long",
-            "year": "numeric",
-          },
-          "long": Object {
-            "day": "numeric",
-            "month": "long",
-            "year": "numeric",
-          },
-          "medium": Object {
-            "day": "numeric",
-            "month": "short",
-            "year": "numeric",
-          },
-          "short": Object {
-            "day": "numeric",
-            "month": "numeric",
-            "year": "2-digit",
-          },
-        },
-        "number": Object {
-          "currency": Object {
-            "style": "currency",
-          },
-          "percent": Object {
-            "style": "percent",
-          },
-        },
-        "relative": Object {
-          "days": Object {
-            "units": "day",
-          },
-          "hours": Object {
-            "units": "hour",
-          },
-          "minutes": Object {
-            "units": "minute",
-          },
-          "months": Object {
-            "units": "month",
-          },
-          "seconds": Object {
-            "units": "second",
-          },
-          "years": Object {
-            "units": "year",
-          },
-        },
-        "time": Object {
-          "full": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "long": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "medium": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-          },
-          "short": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-          },
-        },
-      },
-      "formatters": Object {
-        "getDateTimeFormat": [Function],
-        "getMessageFormat": [Function],
-        "getNumberFormat": [Function],
-        "getPluralFormat": [Function],
-        "getRelativeFormat": [Function],
-      },
-      "locale": "en",
-      "messages": Object {},
-      "now": [Function],
-      "onError": [Function],
-      "textComponent": Symbol(react.fragment),
-      "timeZone": null,
-    }
-  }
->
-  <EuiTitle
-    size="s"
-  >
-    <h3
-      className="euiTitle euiTitle--small"
-    >
-      <FormattedMessage
-        defaultMessage="Index lifecycle management"
-        id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryTitle"
-        values={Object {}}
-      >
-        Index lifecycle management
-      </FormattedMessage>
-    </h3>
-  </EuiTitle>
-  <EuiSpacer
-    size="s"
-  >
-    <div
-      className="euiSpacer euiSpacer--s"
-    />
-  </EuiSpacer>
-  <EuiCallOut
-    color="danger"
-    iconType="cross"
-    title={
-      <FormattedMessage
-        defaultMessage="Index lifecycle error"
-        id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryErrorMessage"
-        values={Object {}}
-      />
-    }
-  >
-    <div
-      className="euiCallOut euiCallOut--danger"
-    >
-      <div
-        className="euiCallOutHeader"
-      >
-        <EuiIcon
-          aria-hidden="true"
-          className="euiCallOutHeader__icon"
-          size="m"
-          type="cross"
-        >
-          <div
-            aria-hidden="true"
-            className="euiCallOutHeader__icon"
-            data-euiicon-type="cross"
-            size="m"
-          />
-        </EuiIcon>
-        <span
-          className="euiCallOutHeader__title"
-        >
-          <FormattedMessage
-            defaultMessage="Index lifecycle error"
-            id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryErrorMessage"
-            values={Object {}}
-          >
-            Index lifecycle error
-          </FormattedMessage>
-        </span>
-      </div>
-      <EuiText
-        size="s"
-      >
-        <div
-          className="euiText euiText--small"
-        >
-          illegal_argument_exception
-          : 
-          setting [index.lifecycle.rollover_alias] for index [testy3] is empty or not defined
-          <EuiSpacer
-            size="s"
-          >
-            <div
-              className="euiSpacer euiSpacer--s"
-            />
-          </EuiSpacer>
-        </div>
-      </EuiText>
-    </div>
-  </EuiCallOut>
-  <EuiSpacer
-    size="m"
-  >
-    <div
-      className="euiSpacer euiSpacer--m"
-    />
-  </EuiSpacer>
-  <EuiFlexGroup>
-    <div
-      className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
-    >
-      <EuiFlexItem>
-        <div
-          className="euiFlexItem"
-        >
-          <EuiDescriptionList
-            type="column"
-          >
-            <dl
-              className="euiDescriptionList euiDescriptionList--column"
-            >
-              <EuiDescriptionListTitle
-                key="policy"
-              >
-                <dt
-                  className="euiDescriptionList__title"
-                >
-                  <strong>
-                    Lifecycle policy
-                  </strong>
-                </dt>
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription
-                key="policy_desc"
-              >
-                <dd
-                  className="euiDescriptionList__description"
-                >
-                  <EuiLink
-                    href="management/data/index_lifecycle_management//policies/edit/testy"
-                  >
-                    <a
-                      className="euiLink euiLink--primary"
-                      href="management/data/index_lifecycle_management//policies/edit/testy"
-                      rel="noreferrer"
-                    >
-                      testy
-                    </a>
-                  </EuiLink>
-                </dd>
-              </EuiDescriptionListDescription>
-              <EuiDescriptionListTitle
-                key="action"
-              >
-                <dt
-                  className="euiDescriptionList__title"
-                >
-                  <strong>
-                    Current action
-                  </strong>
-                </dt>
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription
-                key="action_desc"
-              >
-                <dd
-                  className="euiDescriptionList__description"
-                >
-                  rollover
-                </dd>
-              </EuiDescriptionListDescription>
-              <EuiDescriptionListTitle
-                key="failed_step"
-              >
-                <dt
-                  className="euiDescriptionList__title"
-                >
-                  <strong>
-                    Failed step
-                  </strong>
-                </dt>
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription
-                key="failed_step_desc"
-              >
-                <dd
-                  className="euiDescriptionList__description"
-                >
-                  check-rollover-ready
-                </dd>
-              </EuiDescriptionListDescription>
-            </dl>
-          </EuiDescriptionList>
-        </div>
-      </EuiFlexItem>
-      <EuiFlexItem>
-        <div
-          className="euiFlexItem"
-        >
-          <EuiDescriptionList
-            type="column"
-          >
-            <dl
-              className="euiDescriptionList euiDescriptionList--column"
-            >
-              <EuiDescriptionListTitle
-                key="phase"
-              >
-                <dt
-                  className="euiDescriptionList__title"
-                >
-                  <strong>
-                    Current phase
-                  </strong>
-                </dt>
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription
-                key="phase_desc"
-              >
-                <dd
-                  className="euiDescriptionList__description"
-                >
-                  hot
-                </dd>
-              </EuiDescriptionListDescription>
-              <EuiDescriptionListTitle
-                key="action_time_millis"
-              >
-                <dt
-                  className="euiDescriptionList__title"
-                >
-                  <strong>
-                    Current action time
-                  </strong>
-                </dt>
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription
-                key="action_time_millis_desc"
-              >
-                <dd
-                  className="euiDescriptionList__description"
-                >
-                  2018-12-07 13:02:55
-                </dd>
-              </EuiDescriptionListDescription>
-              <EuiDescriptionListTitle>
-                <dt
-                  className="euiDescriptionList__title"
-                >
-                  <strong>
-                    <FormattedMessage
-                      defaultMessage="Phase definition"
-                      id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionDescriptionTitle"
-                      values={Object {}}
-                    >
-                      Phase definition
-                    </FormattedMessage>
-                  </strong>
-                </dt>
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription
-                key="phaseDefinition_desc"
-              >
-                <dd
-                  className="euiDescriptionList__description"
-                >
-                  <EuiPopover
-                    anchorPosition="downCenter"
-                    button={
-                      <EuiLink
-                        onClick={[Function]}
-                      >
-                        <FormattedMessage
-                          defaultMessage="Show definition"
-                          id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionButton"
-                          values={Object {}}
-                        />
-                      </EuiLink>
-                    }
-                    closePopover={[Function]}
-                    display="inlineBlock"
-                    hasArrow={true}
-                    id="phaseExecutionPopover"
-                    isOpen={false}
-                    key="phaseExecutionPopover"
-                    ownFocus={false}
-                    panelPaddingSize="m"
-                    withTitle={true}
-                  >
-                    <EuiOutsideClickDetector
-                      isDisabled={true}
-                      onOutsideClick={[Function]}
-                    >
-                      <div
-                        className="euiPopover euiPopover--anchorDownCenter euiPopover--withTitle"
-                        id="phaseExecutionPopover"
-                        onKeyDown={[Function]}
-                        onMouseDown={[Function]}
-                        onMouseUp={[Function]}
-                        onTouchEnd={[Function]}
-                        onTouchStart={[Function]}
-                      >
-                        <div
-                          className="euiPopover__anchor"
-                        >
-                          <EuiLink
-                            onClick={[Function]}
-                          >
-                            <button
-                              className="euiLink euiLink--primary"
-                              onClick={[Function]}
-                              type="button"
-                            >
-                              <FormattedMessage
-                                defaultMessage="Show definition"
-                                id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionButton"
-                                values={Object {}}
-                              >
-                                Show definition
-                              </FormattedMessage>
-                            </button>
-                          </EuiLink>
-                        </div>
-                      </div>
-                    </EuiOutsideClickDetector>
-                  </EuiPopover>
-                </dd>
-              </EuiDescriptionListDescription>
-            </dl>
-          </EuiDescriptionList>
-        </div>
-      </EuiFlexItem>
-    </div>
-  </EuiFlexGroup>
-</IndexLifecycleSummary>
-`;
-
-exports[`extend index management ilm summary extension should return extension when index has lifecycle policy 1`] = `
-<IndexLifecycleSummary
-  getUrlForApp={[Function]}
-  index={
-    Object {
-      "aliases": "none",
-      "documents": "2",
-      "documents_deleted": "0",
-      "health": "yellow",
-      "ilm": Object {
-        "action": "complete",
-        "action_time_millis": 1544187775867,
-        "index": "testy3",
-        "lifecycle_date_millis": 1544020872361,
-        "managed": true,
-        "phase": "new",
-        "phase_time_millis": 1544187775867,
-        "policy": "testy",
-        "step": "complete",
-        "step_time_millis": 1544187775867,
-      },
-      "name": "testy3",
-      "primary": "1",
-      "primary_size": "6.5kb",
-      "replica": "1",
-      "size": "6.5kb",
-      "status": "open",
-      "uuid": "XL11TLa3Tvq298_dMUzLHQ",
-    }
-  }
-  intl={
-    Object {
-      "defaultFormats": Object {},
-      "defaultLocale": "en",
-      "formatDate": [Function],
-      "formatHTMLMessage": [Function],
-      "formatMessage": [Function],
-      "formatNumber": [Function],
-      "formatPlural": [Function],
-      "formatRelative": [Function],
-      "formatTime": [Function],
-      "formats": Object {
-        "date": Object {
-          "full": Object {
-            "day": "numeric",
-            "month": "long",
-            "weekday": "long",
-            "year": "numeric",
-          },
-          "long": Object {
-            "day": "numeric",
-            "month": "long",
-            "year": "numeric",
-          },
-          "medium": Object {
-            "day": "numeric",
-            "month": "short",
-            "year": "numeric",
-          },
-          "short": Object {
-            "day": "numeric",
-            "month": "numeric",
-            "year": "2-digit",
-          },
-        },
-        "number": Object {
-          "currency": Object {
-            "style": "currency",
-          },
-          "percent": Object {
-            "style": "percent",
-          },
-        },
-        "relative": Object {
-          "days": Object {
-            "units": "day",
-          },
-          "hours": Object {
-            "units": "hour",
-          },
-          "minutes": Object {
-            "units": "minute",
-          },
-          "months": Object {
-            "units": "month",
-          },
-          "seconds": Object {
-            "units": "second",
-          },
-          "years": Object {
-            "units": "year",
-          },
-        },
-        "time": Object {
-          "full": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "long": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "medium": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-          },
-          "short": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-          },
-        },
-      },
-      "formatters": Object {
-        "getDateTimeFormat": [Function],
-        "getMessageFormat": [Function],
-        "getNumberFormat": [Function],
-        "getPluralFormat": [Function],
-        "getRelativeFormat": [Function],
-      },
-      "locale": "en",
-      "messages": Object {},
-      "now": [Function],
-      "onError": [Function],
-      "textComponent": Symbol(react.fragment),
-      "timeZone": null,
-    }
-  }
->
-  <EuiTitle
-    size="s"
-  >
-    <h3
-      className="euiTitle euiTitle--small"
-    >
-      <FormattedMessage
-        defaultMessage="Index lifecycle management"
-        id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryTitle"
-        values={Object {}}
-      >
-        Index lifecycle management
-      </FormattedMessage>
-    </h3>
-  </EuiTitle>
-  <EuiSpacer
-    size="m"
-  >
-    <div
-      className="euiSpacer euiSpacer--m"
-    />
-  </EuiSpacer>
-  <EuiFlexGroup>
-    <div
-      className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
-    >
-      <EuiFlexItem>
-        <div
-          className="euiFlexItem"
-        >
-          <EuiDescriptionList
-            type="column"
-          >
-            <dl
-              className="euiDescriptionList euiDescriptionList--column"
-            >
-              <EuiDescriptionListTitle
-                key="policy"
-              >
-                <dt
-                  className="euiDescriptionList__title"
-                >
-                  <strong>
-                    Lifecycle policy
-                  </strong>
-                </dt>
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription
-                key="policy_desc"
-              >
-                <dd
-                  className="euiDescriptionList__description"
-                >
-                  <EuiLink
-                    href="management/data/index_lifecycle_management//policies/edit/testy"
-                  >
-                    <a
-                      className="euiLink euiLink--primary"
-                      href="management/data/index_lifecycle_management//policies/edit/testy"
-                      rel="noreferrer"
-                    >
-                      testy
-                    </a>
-                  </EuiLink>
-                </dd>
-              </EuiDescriptionListDescription>
-              <EuiDescriptionListTitle
-                key="action"
-              >
-                <dt
-                  className="euiDescriptionList__title"
-                >
-                  <strong>
-                    Current action
-                  </strong>
-                </dt>
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription
-                key="action_desc"
-              >
-                <dd
-                  className="euiDescriptionList__description"
-                >
-                  complete
-                </dd>
-              </EuiDescriptionListDescription>
-              <EuiDescriptionListTitle
-                key="failed_step"
-              >
-                <dt
-                  className="euiDescriptionList__title"
-                >
-                  <strong>
-                    Failed step
-                  </strong>
-                </dt>
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription
-                key="failed_step_desc"
-              >
-                <dd
-                  className="euiDescriptionList__description"
-                >
-                  -
-                </dd>
-              </EuiDescriptionListDescription>
-            </dl>
-          </EuiDescriptionList>
-        </div>
-      </EuiFlexItem>
-      <EuiFlexItem>
-        <div
-          className="euiFlexItem"
-        >
-          <EuiDescriptionList
-            type="column"
-          >
-            <dl
-              className="euiDescriptionList euiDescriptionList--column"
-            >
-              <EuiDescriptionListTitle
-                key="phase"
-              >
-                <dt
-                  className="euiDescriptionList__title"
-                >
-                  <strong>
-                    Current phase
-                  </strong>
-                </dt>
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription
-                key="phase_desc"
-              >
-                <dd
-                  className="euiDescriptionList__description"
-                >
-                  new
-                </dd>
-              </EuiDescriptionListDescription>
-              <EuiDescriptionListTitle
-                key="action_time_millis"
-              >
-                <dt
-                  className="euiDescriptionList__title"
-                >
-                  <strong>
-                    Current action time
-                  </strong>
-                </dt>
-              </EuiDescriptionListTitle>
-              <EuiDescriptionListDescription
-                key="action_time_millis_desc"
-              >
-                <dd
-                  className="euiDescriptionList__description"
-                >
-                  2018-12-07 13:02:55
-                </dd>
-              </EuiDescriptionListDescription>
-            </dl>
-          </EuiDescriptionList>
-        </div>
-      </EuiFlexItem>
-    </div>
-  </EuiFlexGroup>
-</IndexLifecycleSummary>
-`;
-
-exports[`extend index management remove lifecycle action extension should return extension when all indices have lifecycle policy 1`] = `
-Object {
-  "buttonLabel": "Remove lifecycle policy",
-  "icon": "stopFilled",
-  "indexNames": Array [
-    Array [
-      "testy3",
-      "testy3",
-    ],
-  ],
-  "renderConfirmModal": [Function],
-}
-`;
-
-exports[`extend index management retry lifecycle action extension should return extension when all indices have lifecycle errors 1`] = `
-Object {
-  "buttonLabel": "Retry lifecycle step",
-  "icon": "play",
-  "indexNames": Array [
-    Array [
-      "testy3",
-      "testy3",
-    ],
-  ],
-  "requestMethod": [Function],
-  "successMessage": "Called retry lifecycle step for: \\"testy3\\", \\"testy3\\"",
-}
-`;
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap b/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap
new file mode 100644
index 00000000000000..59d1723c39488a
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap
@@ -0,0 +1,977 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`extend index management ilm banner extension should return extension when any index has lifecycle error 1`] = `
+Object {
+  "filter": Query {
+    "ast": _AST {
+      "_clauses": Array [
+        Object {
+          "field": "ilm.step",
+          "match": "must",
+          "operator": "eq",
+          "type": "field",
+          "value": "ERROR",
+        },
+      ],
+      "_indexedClauses": Object {
+        "field": Object {
+          "ilm.step": Array [
+            Object {
+              "field": "ilm.step",
+              "match": "must",
+              "operator": "eq",
+              "type": "field",
+              "value": "ERROR",
+            },
+          ],
+        },
+        "group": Array [],
+        "is": Object {},
+        "term": Array [],
+      },
+    },
+    "syntax": Object {
+      "parse": [Function],
+      "print": [Function],
+      "printClause": [Function],
+    },
+    "text": "ilm.step:ERROR",
+  },
+  "filterLabel": "Show errors",
+  "title": "1
+          index has
+          lifecycle errors",
+  "type": "warning",
+}
+`;
+
+exports[`extend index management ilm filter extension should return extension when any index has lifecycle policy 1`] = `
+Array [
+  Object {
+    "field": "ilm.managed",
+    "multiSelect": false,
+    "name": "Lifecycle status",
+    "options": Array [
+      Object {
+        "value": true,
+        "view": "Managed",
+      },
+      Object {
+        "value": false,
+        "view": "Unmanaged",
+      },
+    ],
+    "type": "field_value_selection",
+  },
+  Object {
+    "field": "ilm.phase",
+    "multiSelect": "or",
+    "name": "Lifecycle phase",
+    "options": Array [
+      Object {
+        "value": "hot",
+        "view": "Hot",
+      },
+      Object {
+        "value": "warm",
+        "view": "Warm",
+      },
+      Object {
+        "value": "frozen",
+        "view": "Frozen",
+      },
+      Object {
+        "value": "cold",
+        "view": "Cold",
+      },
+      Object {
+        "value": "delete",
+        "view": "Delete",
+      },
+    ],
+    "type": "field_value_selection",
+  },
+]
+`;
+
+exports[`extend index management ilm summary extension should return extension when index has lifecycle error 1`] = `
+<IndexLifecycleSummary
+  getUrlForApp={[Function]}
+  index={
+    Object {
+      "aliases": "none",
+      "documents": "2",
+      "documents_deleted": "0",
+      "health": "yellow",
+      "ilm": Object {
+        "action": "rollover",
+        "action_time_millis": 1544187775891,
+        "failed_step": "check-rollover-ready",
+        "index": "testy3",
+        "lifecycle_date_millis": 1544020872361,
+        "managed": true,
+        "phase": "hot",
+        "phase_execution": Object {
+          "modified_date_in_millis": 1544031699844,
+          "phase_definition": Object {
+            "actions": Object {
+              "rollover": Object {
+                "max_size": "1gb",
+              },
+            },
+            "min_age": "0s",
+          },
+          "policy": "testy",
+          "version": 1,
+        },
+        "phase_time_millis": 1544187775891,
+        "policy": "testy",
+        "step": "ERROR",
+        "step_info": Object {
+          "reason": "setting [index.lifecycle.rollover_alias] for index [testy3] is empty or not defined",
+          "stack_trace": "fakestacktrace",
+          "type": "illegal_argument_exception",
+        },
+        "step_time_millis": 1544187776208,
+      },
+      "isFrozen": false,
+      "name": "testy3",
+      "primary": "1",
+      "primary_size": "6.5kb",
+      "replica": "1",
+      "size": "6.5kb",
+      "status": "open",
+      "uuid": "XL11TLa3Tvq298_dMUzLHQ",
+    }
+  }
+  intl={
+    Object {
+      "defaultFormats": Object {},
+      "defaultLocale": "en",
+      "formatDate": [Function],
+      "formatHTMLMessage": [Function],
+      "formatMessage": [Function],
+      "formatNumber": [Function],
+      "formatPlural": [Function],
+      "formatRelative": [Function],
+      "formatTime": [Function],
+      "formats": Object {
+        "date": Object {
+          "full": Object {
+            "day": "numeric",
+            "month": "long",
+            "weekday": "long",
+            "year": "numeric",
+          },
+          "long": Object {
+            "day": "numeric",
+            "month": "long",
+            "year": "numeric",
+          },
+          "medium": Object {
+            "day": "numeric",
+            "month": "short",
+            "year": "numeric",
+          },
+          "short": Object {
+            "day": "numeric",
+            "month": "numeric",
+            "year": "2-digit",
+          },
+        },
+        "number": Object {
+          "currency": Object {
+            "style": "currency",
+          },
+          "percent": Object {
+            "style": "percent",
+          },
+        },
+        "relative": Object {
+          "days": Object {
+            "units": "day",
+          },
+          "hours": Object {
+            "units": "hour",
+          },
+          "minutes": Object {
+            "units": "minute",
+          },
+          "months": Object {
+            "units": "month",
+          },
+          "seconds": Object {
+            "units": "second",
+          },
+          "years": Object {
+            "units": "year",
+          },
+        },
+        "time": Object {
+          "full": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "long": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "medium": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+          },
+          "short": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+          },
+        },
+      },
+      "formatters": Object {
+        "getDateTimeFormat": [Function],
+        "getMessageFormat": [Function],
+        "getNumberFormat": [Function],
+        "getPluralFormat": [Function],
+        "getRelativeFormat": [Function],
+      },
+      "locale": "en",
+      "messages": Object {},
+      "now": [Function],
+      "onError": [Function],
+      "textComponent": Symbol(react.fragment),
+      "timeZone": null,
+    }
+  }
+>
+  <EuiTitle
+    size="s"
+  >
+    <h3
+      className="euiTitle euiTitle--small"
+    >
+      <FormattedMessage
+        defaultMessage="Index lifecycle management"
+        id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryTitle"
+        values={Object {}}
+      >
+        Index lifecycle management
+      </FormattedMessage>
+    </h3>
+  </EuiTitle>
+  <EuiSpacer
+    size="s"
+  >
+    <div
+      className="euiSpacer euiSpacer--s"
+    />
+  </EuiSpacer>
+  <EuiCallOut
+    color="danger"
+    iconType="cross"
+    title={
+      <FormattedMessage
+        defaultMessage="Index lifecycle error"
+        id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryErrorMessage"
+        values={Object {}}
+      />
+    }
+  >
+    <div
+      className="euiCallOut euiCallOut--danger"
+    >
+      <div
+        className="euiCallOutHeader"
+      >
+        <EuiIcon
+          aria-hidden="true"
+          className="euiCallOutHeader__icon"
+          size="m"
+          type="cross"
+        >
+          <div
+            aria-hidden="true"
+            className="euiCallOutHeader__icon"
+            data-euiicon-type="cross"
+            size="m"
+          />
+        </EuiIcon>
+        <span
+          className="euiCallOutHeader__title"
+        >
+          <FormattedMessage
+            defaultMessage="Index lifecycle error"
+            id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryErrorMessage"
+            values={Object {}}
+          >
+            Index lifecycle error
+          </FormattedMessage>
+        </span>
+      </div>
+      <EuiText
+        size="s"
+      >
+        <div
+          className="euiText euiText--small"
+        >
+          illegal_argument_exception
+          : 
+          setting [index.lifecycle.rollover_alias] for index [testy3] is empty or not defined
+          <EuiSpacer
+            size="s"
+          >
+            <div
+              className="euiSpacer euiSpacer--s"
+            />
+          </EuiSpacer>
+          <EuiPopover
+            anchorPosition="downCenter"
+            button={
+              <EuiButtonEmpty
+                onClick={[Function]}
+              >
+                <FormattedMessage
+                  defaultMessage="Stack trace"
+                  id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.stackTraceButton"
+                  values={Object {}}
+                />
+              </EuiButtonEmpty>
+            }
+            closePopover={[Function]}
+            display="inlineBlock"
+            hasArrow={true}
+            id="stackPopover"
+            isOpen={false}
+            ownFocus={false}
+            panelPaddingSize="m"
+          >
+            <EuiOutsideClickDetector
+              isDisabled={true}
+              onOutsideClick={[Function]}
+            >
+              <div
+                className="euiPopover euiPopover--anchorDownCenter"
+                id="stackPopover"
+                onKeyDown={[Function]}
+                onMouseDown={[Function]}
+                onMouseUp={[Function]}
+                onTouchEnd={[Function]}
+                onTouchStart={[Function]}
+              >
+                <div
+                  className="euiPopover__anchor"
+                >
+                  <EuiButtonEmpty
+                    onClick={[Function]}
+                  >
+                    <button
+                      className="euiButtonEmpty euiButtonEmpty--primary"
+                      onClick={[Function]}
+                      type="button"
+                    >
+                      <EuiButtonContent
+                        className="euiButtonEmpty__content"
+                        iconSide="left"
+                        textProps={
+                          Object {
+                            "className": "euiButtonEmpty__text",
+                          }
+                        }
+                      >
+                        <span
+                          className="euiButtonContent euiButtonEmpty__content"
+                        >
+                          <span
+                            className="euiButtonEmpty__text"
+                          >
+                            <FormattedMessage
+                              defaultMessage="Stack trace"
+                              id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.stackTraceButton"
+                              values={Object {}}
+                            >
+                              Stack trace
+                            </FormattedMessage>
+                          </span>
+                        </span>
+                      </EuiButtonContent>
+                    </button>
+                  </EuiButtonEmpty>
+                </div>
+              </div>
+            </EuiOutsideClickDetector>
+          </EuiPopover>
+        </div>
+      </EuiText>
+    </div>
+  </EuiCallOut>
+  <EuiSpacer
+    size="m"
+  >
+    <div
+      className="euiSpacer euiSpacer--m"
+    />
+  </EuiSpacer>
+  <EuiFlexGroup>
+    <div
+      className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
+    >
+      <EuiFlexItem>
+        <div
+          className="euiFlexItem"
+        >
+          <EuiDescriptionList
+            type="column"
+          >
+            <dl
+              className="euiDescriptionList euiDescriptionList--column"
+            >
+              <EuiDescriptionListTitle
+                key="policy"
+              >
+                <dt
+                  className="euiDescriptionList__title"
+                >
+                  <strong>
+                    Lifecycle policy
+                  </strong>
+                </dt>
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                key="policy_desc"
+              >
+                <dd
+                  className="euiDescriptionList__description"
+                >
+                  <EuiLink
+                    href="management/data/index_lifecycle_management//policies/edit/testy"
+                  >
+                    <a
+                      className="euiLink euiLink--primary"
+                      href="management/data/index_lifecycle_management//policies/edit/testy"
+                      rel="noreferrer"
+                    >
+                      testy
+                    </a>
+                  </EuiLink>
+                </dd>
+              </EuiDescriptionListDescription>
+              <EuiDescriptionListTitle
+                key="action"
+              >
+                <dt
+                  className="euiDescriptionList__title"
+                >
+                  <strong>
+                    Current action
+                  </strong>
+                </dt>
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                key="action_desc"
+              >
+                <dd
+                  className="euiDescriptionList__description"
+                >
+                  rollover
+                </dd>
+              </EuiDescriptionListDescription>
+              <EuiDescriptionListTitle
+                key="failed_step"
+              >
+                <dt
+                  className="euiDescriptionList__title"
+                >
+                  <strong>
+                    Failed step
+                  </strong>
+                </dt>
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                key="failed_step_desc"
+              >
+                <dd
+                  className="euiDescriptionList__description"
+                >
+                  check-rollover-ready
+                </dd>
+              </EuiDescriptionListDescription>
+            </dl>
+          </EuiDescriptionList>
+        </div>
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <div
+          className="euiFlexItem"
+        >
+          <EuiDescriptionList
+            type="column"
+          >
+            <dl
+              className="euiDescriptionList euiDescriptionList--column"
+            >
+              <EuiDescriptionListTitle
+                key="phase"
+              >
+                <dt
+                  className="euiDescriptionList__title"
+                >
+                  <strong>
+                    Current phase
+                  </strong>
+                </dt>
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                key="phase_desc"
+              >
+                <dd
+                  className="euiDescriptionList__description"
+                >
+                  hot
+                </dd>
+              </EuiDescriptionListDescription>
+              <EuiDescriptionListTitle
+                key="action_time_millis"
+              >
+                <dt
+                  className="euiDescriptionList__title"
+                >
+                  <strong>
+                    Current action time
+                  </strong>
+                </dt>
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                key="action_time_millis_desc"
+              >
+                <dd
+                  className="euiDescriptionList__description"
+                >
+                  2018-12-07 13:02:55
+                </dd>
+              </EuiDescriptionListDescription>
+              <EuiDescriptionListTitle>
+                <dt
+                  className="euiDescriptionList__title"
+                >
+                  <strong>
+                    <FormattedMessage
+                      defaultMessage="Phase definition"
+                      id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionDescriptionTitle"
+                      values={Object {}}
+                    >
+                      Phase definition
+                    </FormattedMessage>
+                  </strong>
+                </dt>
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                key="phaseDefinition_desc"
+              >
+                <dd
+                  className="euiDescriptionList__description"
+                >
+                  <EuiPopover
+                    anchorPosition="downCenter"
+                    button={
+                      <EuiLink
+                        onClick={[Function]}
+                      >
+                        <FormattedMessage
+                          defaultMessage="Show definition"
+                          id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionButton"
+                          values={Object {}}
+                        />
+                      </EuiLink>
+                    }
+                    closePopover={[Function]}
+                    display="inlineBlock"
+                    hasArrow={true}
+                    id="phaseExecutionPopover"
+                    isOpen={false}
+                    key="phaseExecutionPopover"
+                    ownFocus={false}
+                    panelPaddingSize="m"
+                    withTitle={true}
+                  >
+                    <EuiOutsideClickDetector
+                      isDisabled={true}
+                      onOutsideClick={[Function]}
+                    >
+                      <div
+                        className="euiPopover euiPopover--anchorDownCenter euiPopover--withTitle"
+                        id="phaseExecutionPopover"
+                        onKeyDown={[Function]}
+                        onMouseDown={[Function]}
+                        onMouseUp={[Function]}
+                        onTouchEnd={[Function]}
+                        onTouchStart={[Function]}
+                      >
+                        <div
+                          className="euiPopover__anchor"
+                        >
+                          <EuiLink
+                            onClick={[Function]}
+                          >
+                            <button
+                              className="euiLink euiLink--primary"
+                              onClick={[Function]}
+                              type="button"
+                            >
+                              <FormattedMessage
+                                defaultMessage="Show definition"
+                                id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionButton"
+                                values={Object {}}
+                              >
+                                Show definition
+                              </FormattedMessage>
+                            </button>
+                          </EuiLink>
+                        </div>
+                      </div>
+                    </EuiOutsideClickDetector>
+                  </EuiPopover>
+                </dd>
+              </EuiDescriptionListDescription>
+            </dl>
+          </EuiDescriptionList>
+        </div>
+      </EuiFlexItem>
+    </div>
+  </EuiFlexGroup>
+</IndexLifecycleSummary>
+`;
+
+exports[`extend index management ilm summary extension should return extension when index has lifecycle policy 1`] = `
+<IndexLifecycleSummary
+  getUrlForApp={[Function]}
+  index={
+    Object {
+      "aliases": "none",
+      "documents": "2",
+      "documents_deleted": "0",
+      "health": "yellow",
+      "ilm": Object {
+        "action": "complete",
+        "action_time_millis": 1544187775867,
+        "index": "testy3",
+        "lifecycle_date_millis": 1544020872361,
+        "managed": true,
+        "phase": "new",
+        "phase_time_millis": 1544187775867,
+        "policy": "testy",
+        "step": "complete",
+        "step_time_millis": 1544187775867,
+      },
+      "isFrozen": false,
+      "name": "testy3",
+      "primary": "1",
+      "primary_size": "6.5kb",
+      "replica": "1",
+      "size": "6.5kb",
+      "status": "open",
+      "uuid": "XL11TLa3Tvq298_dMUzLHQ",
+    }
+  }
+  intl={
+    Object {
+      "defaultFormats": Object {},
+      "defaultLocale": "en",
+      "formatDate": [Function],
+      "formatHTMLMessage": [Function],
+      "formatMessage": [Function],
+      "formatNumber": [Function],
+      "formatPlural": [Function],
+      "formatRelative": [Function],
+      "formatTime": [Function],
+      "formats": Object {
+        "date": Object {
+          "full": Object {
+            "day": "numeric",
+            "month": "long",
+            "weekday": "long",
+            "year": "numeric",
+          },
+          "long": Object {
+            "day": "numeric",
+            "month": "long",
+            "year": "numeric",
+          },
+          "medium": Object {
+            "day": "numeric",
+            "month": "short",
+            "year": "numeric",
+          },
+          "short": Object {
+            "day": "numeric",
+            "month": "numeric",
+            "year": "2-digit",
+          },
+        },
+        "number": Object {
+          "currency": Object {
+            "style": "currency",
+          },
+          "percent": Object {
+            "style": "percent",
+          },
+        },
+        "relative": Object {
+          "days": Object {
+            "units": "day",
+          },
+          "hours": Object {
+            "units": "hour",
+          },
+          "minutes": Object {
+            "units": "minute",
+          },
+          "months": Object {
+            "units": "month",
+          },
+          "seconds": Object {
+            "units": "second",
+          },
+          "years": Object {
+            "units": "year",
+          },
+        },
+        "time": Object {
+          "full": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "long": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+            "timeZoneName": "short",
+          },
+          "medium": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+            "second": "numeric",
+          },
+          "short": Object {
+            "hour": "numeric",
+            "minute": "numeric",
+          },
+        },
+      },
+      "formatters": Object {
+        "getDateTimeFormat": [Function],
+        "getMessageFormat": [Function],
+        "getNumberFormat": [Function],
+        "getPluralFormat": [Function],
+        "getRelativeFormat": [Function],
+      },
+      "locale": "en",
+      "messages": Object {},
+      "now": [Function],
+      "onError": [Function],
+      "textComponent": Symbol(react.fragment),
+      "timeZone": null,
+    }
+  }
+>
+  <EuiTitle
+    size="s"
+  >
+    <h3
+      className="euiTitle euiTitle--small"
+    >
+      <FormattedMessage
+        defaultMessage="Index lifecycle management"
+        id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryTitle"
+        values={Object {}}
+      >
+        Index lifecycle management
+      </FormattedMessage>
+    </h3>
+  </EuiTitle>
+  <EuiSpacer
+    size="m"
+  >
+    <div
+      className="euiSpacer euiSpacer--m"
+    />
+  </EuiSpacer>
+  <EuiFlexGroup>
+    <div
+      className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
+    >
+      <EuiFlexItem>
+        <div
+          className="euiFlexItem"
+        >
+          <EuiDescriptionList
+            type="column"
+          >
+            <dl
+              className="euiDescriptionList euiDescriptionList--column"
+            >
+              <EuiDescriptionListTitle
+                key="policy"
+              >
+                <dt
+                  className="euiDescriptionList__title"
+                >
+                  <strong>
+                    Lifecycle policy
+                  </strong>
+                </dt>
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                key="policy_desc"
+              >
+                <dd
+                  className="euiDescriptionList__description"
+                >
+                  <EuiLink
+                    href="management/data/index_lifecycle_management//policies/edit/testy"
+                  >
+                    <a
+                      className="euiLink euiLink--primary"
+                      href="management/data/index_lifecycle_management//policies/edit/testy"
+                      rel="noreferrer"
+                    >
+                      testy
+                    </a>
+                  </EuiLink>
+                </dd>
+              </EuiDescriptionListDescription>
+              <EuiDescriptionListTitle
+                key="action"
+              >
+                <dt
+                  className="euiDescriptionList__title"
+                >
+                  <strong>
+                    Current action
+                  </strong>
+                </dt>
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                key="action_desc"
+              >
+                <dd
+                  className="euiDescriptionList__description"
+                >
+                  complete
+                </dd>
+              </EuiDescriptionListDescription>
+              <EuiDescriptionListTitle
+                key="failed_step"
+              >
+                <dt
+                  className="euiDescriptionList__title"
+                >
+                  <strong>
+                    Failed step
+                  </strong>
+                </dt>
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                key="failed_step_desc"
+              >
+                <dd
+                  className="euiDescriptionList__description"
+                >
+                  -
+                </dd>
+              </EuiDescriptionListDescription>
+            </dl>
+          </EuiDescriptionList>
+        </div>
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <div
+          className="euiFlexItem"
+        >
+          <EuiDescriptionList
+            type="column"
+          >
+            <dl
+              className="euiDescriptionList euiDescriptionList--column"
+            >
+              <EuiDescriptionListTitle
+                key="phase"
+              >
+                <dt
+                  className="euiDescriptionList__title"
+                >
+                  <strong>
+                    Current phase
+                  </strong>
+                </dt>
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                key="phase_desc"
+              >
+                <dd
+                  className="euiDescriptionList__description"
+                >
+                  new
+                </dd>
+              </EuiDescriptionListDescription>
+              <EuiDescriptionListTitle
+                key="action_time_millis"
+              >
+                <dt
+                  className="euiDescriptionList__title"
+                >
+                  <strong>
+                    Current action time
+                  </strong>
+                </dt>
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                key="action_time_millis_desc"
+              >
+                <dd
+                  className="euiDescriptionList__description"
+                >
+                  2018-12-07 13:02:55
+                </dd>
+              </EuiDescriptionListDescription>
+            </dl>
+          </EuiDescriptionList>
+        </div>
+      </EuiFlexItem>
+    </div>
+  </EuiFlexGroup>
+</IndexLifecycleSummary>
+`;
+
+exports[`extend index management remove lifecycle action extension should return extension when all indices have lifecycle policy 1`] = `
+Object {
+  "buttonLabel": "Remove lifecycle policy",
+  "icon": "stopFilled",
+  "indexNames": Array [
+    Array [
+      "testy3",
+      "testy3",
+    ],
+  ],
+  "renderConfirmModal": [Function],
+}
+`;
+
+exports[`extend index management retry lifecycle action extension should return extension when all indices have lifecycle errors 1`] = `
+Object {
+  "buttonLabel": "Retry lifecycle step",
+  "icon": "play",
+  "indexNames": Array [
+    Array [
+      "testy3",
+      "testy3",
+    ],
+  ],
+  "requestMethod": [Function],
+  "successMessage": "Called retry lifecycle step for: \\"testy3\\", \\"testy3\\"",
+}
+`;
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/client_integration/edit_policy/constants.ts b/x-pack/plugins/index_lifecycle_management/__jest__/client_integration/edit_policy/constants.ts
index acf642f250a7b7..4dff70518c1157 100644
--- a/x-pack/plugins/index_lifecycle_management/__jest__/client_integration/edit_policy/constants.ts
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/client_integration/edit_policy/constants.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { PolicyFromES } from '../../../public/application/services/policies/types';
+import { PolicyFromES } from '../../../common/types';
 
 export const POLICY_NAME = 'my_policy';
 export const SNAPSHOT_POLICY_NAME = 'my_snapshot_policy';
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/__snapshots__/policy_table.test.js.snap b/x-pack/plugins/index_lifecycle_management/__jest__/components/__snapshots__/policy_table.test.js.snap
deleted file mode 100644
index ad3e0956fcf259..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/__jest__/components/__snapshots__/policy_table.test.js.snap
+++ /dev/null
@@ -1,240 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`policy table should change pages when a pagination link is clicked on 1`] = `
-Array [
-  "testy0",
-  "testy1",
-  "testy10",
-  "testy100",
-  "testy101",
-  "testy102",
-  "testy103",
-  "testy104",
-  "testy11",
-  "testy12",
-]
-`;
-
-exports[`policy table should change pages when a pagination link is clicked on 2`] = `
-Array [
-  "testy13",
-  "testy14",
-  "testy15",
-  "testy16",
-  "testy17",
-  "testy18",
-  "testy19",
-  "testy2",
-  "testy20",
-  "testy21",
-]
-`;
-
-exports[`policy table should filter based on content of search input 1`] = `
-Array [
-  "testy0",
-  "testy1",
-  "testy10",
-  "testy100",
-  "testy101",
-  "testy102",
-  "testy103",
-  "testy104",
-  "testy11",
-  "testy12",
-]
-`;
-
-exports[`policy table should show empty state when there are not any policies 1`] = `
-<main
-  class="euiPageBody"
->
-  <div
-    class="euiPanel euiPanel--paddingLarge euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter"
-  >
-    <div>
-      <div
-        class="euiSpacer euiSpacer--l"
-      />
-      <div
-        class="euiEmptyPrompt"
-      >
-        <div
-          color="subdued"
-          data-euiicon-type="managementApp"
-        />
-        <div
-          class="euiSpacer euiSpacer--s"
-        />
-        <span
-          class="euiTextColor euiTextColor--subdued"
-        >
-          <h1
-            class="euiTitle euiTitle--medium"
-          >
-            Create your first index lifecycle policy
-          </h1>
-          <div
-            class="euiSpacer euiSpacer--m"
-          />
-          <div
-            class="euiText euiText--medium"
-          >
-            <p>
-               An index lifecycle policy helps you manage your indices as they age.
-            </p>
-          </div>
-        </span>
-        <div
-          class="euiSpacer euiSpacer--l"
-        />
-        <div
-          class="euiSpacer euiSpacer--s"
-        />
-        <button
-          class="euiButton euiButton--primary euiButton--fill"
-          data-test-subj="createPolicyButton"
-          type="button"
-        >
-          <span
-            class="euiButtonContent euiButton__content"
-          >
-            <div
-              class="euiButtonContent__icon"
-              data-euiicon-type="plusInCircle"
-            />
-            <span
-              class="euiButton__text"
-            >
-              Create policy
-            </span>
-          </span>
-        </button>
-      </div>
-      <div
-        class="euiSpacer euiSpacer--m"
-      />
-    </div>
-  </div>
-</main>
-`;
-
-exports[`policy table should sort when linked indices header is clicked 1`] = `
-Array [
-  "testy1",
-  "testy3",
-  "testy5",
-  "testy7",
-  "testy9",
-  "testy11",
-  "testy13",
-  "testy15",
-  "testy17",
-  "testy19",
-]
-`;
-
-exports[`policy table should sort when linked indices header is clicked 2`] = `
-Array [
-  "testy104",
-  "testy102",
-  "testy100",
-  "testy98",
-  "testy96",
-  "testy94",
-  "testy92",
-  "testy90",
-  "testy88",
-  "testy86",
-]
-`;
-
-exports[`policy table should sort when modified date header is clicked 1`] = `
-Array [
-  "testy104",
-  "testy103",
-  "testy102",
-  "testy101",
-  "testy100",
-  "testy99",
-  "testy98",
-  "testy97",
-  "testy96",
-  "testy95",
-]
-`;
-
-exports[`policy table should sort when modified date header is clicked 2`] = `
-Array [
-  "testy0",
-  "testy1",
-  "testy2",
-  "testy3",
-  "testy4",
-  "testy5",
-  "testy6",
-  "testy7",
-  "testy8",
-  "testy9",
-]
-`;
-
-exports[`policy table should sort when name header is clicked 1`] = `
-Array [
-  "testy99",
-  "testy98",
-  "testy97",
-  "testy96",
-  "testy95",
-  "testy94",
-  "testy93",
-  "testy92",
-  "testy91",
-  "testy90",
-]
-`;
-
-exports[`policy table should sort when name header is clicked 2`] = `
-Array [
-  "testy0",
-  "testy1",
-  "testy10",
-  "testy100",
-  "testy101",
-  "testy102",
-  "testy103",
-  "testy104",
-  "testy11",
-  "testy12",
-]
-`;
-
-exports[`policy table should sort when version header is clicked 1`] = `
-Array [
-  "testy0",
-  "testy1",
-  "testy2",
-  "testy3",
-  "testy4",
-  "testy5",
-  "testy6",
-  "testy7",
-  "testy8",
-  "testy9",
-]
-`;
-
-exports[`policy table should sort when version header is clicked 2`] = `
-Array [
-  "testy104",
-  "testy103",
-  "testy102",
-  "testy101",
-  "testy100",
-  "testy99",
-  "testy98",
-  "testy97",
-  "testy96",
-  "testy95",
-]
-`;
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/__snapshots__/policy_table.test.tsx.snap b/x-pack/plugins/index_lifecycle_management/__jest__/components/__snapshots__/policy_table.test.tsx.snap
new file mode 100644
index 00000000000000..cbb9f828887018
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/components/__snapshots__/policy_table.test.tsx.snap
@@ -0,0 +1,232 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`policy table should change pages when a pagination link is clicked on 1`] = `
+Array [
+  "testy0",
+  "testy1",
+  "testy10",
+  "testy100",
+  "testy101",
+  "testy102",
+  "testy103",
+  "testy104",
+  "testy11",
+  "testy12",
+]
+`;
+
+exports[`policy table should change pages when a pagination link is clicked on 2`] = `
+Array [
+  "testy13",
+  "testy14",
+  "testy15",
+  "testy16",
+  "testy17",
+  "testy18",
+  "testy19",
+  "testy2",
+  "testy20",
+  "testy21",
+]
+`;
+
+exports[`policy table should filter based on content of search input 1`] = `
+Array [
+  "testy0",
+  "testy1",
+  "testy10",
+  "testy100",
+  "testy101",
+  "testy102",
+  "testy103",
+  "testy104",
+  "testy11",
+  "testy12",
+]
+`;
+
+exports[`policy table should show empty state when there are not any policies 1`] = `
+<main
+  class="euiPageBody"
+>
+  <div
+    class="euiPanel euiPanel--paddingLarge euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter"
+  >
+    <div
+      class="euiEmptyPrompt"
+    >
+      <div
+        color="subdued"
+        data-euiicon-type="managementApp"
+      />
+      <div
+        class="euiSpacer euiSpacer--s"
+      />
+      <span
+        class="euiTextColor euiTextColor--subdued"
+      >
+        <h1
+          class="euiTitle euiTitle--medium"
+        >
+          Create your first index lifecycle policy
+        </h1>
+        <div
+          class="euiSpacer euiSpacer--m"
+        />
+        <div
+          class="euiText euiText--medium"
+        >
+          <p>
+             An index lifecycle policy helps you manage your indices as they age.
+          </p>
+        </div>
+      </span>
+      <div
+        class="euiSpacer euiSpacer--l"
+      />
+      <div
+        class="euiSpacer euiSpacer--s"
+      />
+      <button
+        class="euiButton euiButton--primary euiButton--fill"
+        data-test-subj="createPolicyButton"
+        type="button"
+      >
+        <span
+          class="euiButtonContent euiButton__content"
+        >
+          <div
+            class="euiButtonContent__icon"
+            data-euiicon-type="plusInCircle"
+          />
+          <span
+            class="euiButton__text"
+          >
+            Create policy
+          </span>
+        </span>
+      </button>
+    </div>
+  </div>
+</main>
+`;
+
+exports[`policy table should sort when linked indices header is clicked 1`] = `
+Array [
+  "testy1",
+  "testy3",
+  "testy5",
+  "testy7",
+  "testy9",
+  "testy11",
+  "testy13",
+  "testy15",
+  "testy17",
+  "testy19",
+]
+`;
+
+exports[`policy table should sort when linked indices header is clicked 2`] = `
+Array [
+  "testy104",
+  "testy102",
+  "testy100",
+  "testy98",
+  "testy96",
+  "testy94",
+  "testy92",
+  "testy90",
+  "testy88",
+  "testy86",
+]
+`;
+
+exports[`policy table should sort when modified date header is clicked 1`] = `
+Array [
+  "testy104",
+  "testy103",
+  "testy102",
+  "testy101",
+  "testy100",
+  "testy99",
+  "testy98",
+  "testy97",
+  "testy96",
+  "testy95",
+]
+`;
+
+exports[`policy table should sort when modified date header is clicked 2`] = `
+Array [
+  "testy0",
+  "testy1",
+  "testy2",
+  "testy3",
+  "testy4",
+  "testy5",
+  "testy6",
+  "testy7",
+  "testy8",
+  "testy9",
+]
+`;
+
+exports[`policy table should sort when name header is clicked 1`] = `
+Array [
+  "testy99",
+  "testy98",
+  "testy97",
+  "testy96",
+  "testy95",
+  "testy94",
+  "testy93",
+  "testy92",
+  "testy91",
+  "testy90",
+]
+`;
+
+exports[`policy table should sort when name header is clicked 2`] = `
+Array [
+  "testy0",
+  "testy1",
+  "testy10",
+  "testy100",
+  "testy101",
+  "testy102",
+  "testy103",
+  "testy104",
+  "testy11",
+  "testy12",
+]
+`;
+
+exports[`policy table should sort when version header is clicked 1`] = `
+Array [
+  "testy0",
+  "testy1",
+  "testy2",
+  "testy3",
+  "testy4",
+  "testy5",
+  "testy6",
+  "testy7",
+  "testy8",
+  "testy9",
+]
+`;
+
+exports[`policy table should sort when version header is clicked 2`] = `
+Array [
+  "testy104",
+  "testy103",
+  "testy102",
+  "testy101",
+  "testy100",
+  "testy99",
+  "testy98",
+  "testy97",
+  "testy96",
+  "testy95",
+]
+`;
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.js b/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.js
deleted file mode 100644
index e4227bac520fef..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.js
+++ /dev/null
@@ -1,546 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { act } from 'react-dom/test-utils';
-import moment from 'moment-timezone';
-// axios has a $http like interface so using it to simulate $http
-import axios from 'axios';
-import axiosXhrAdapter from 'axios/lib/adapters/xhr';
-import { findTestSubject } from '@elastic/eui/lib/test';
-
-import { init as initHttpRequests } from './helpers/http_requests';
-import {
-  notificationServiceMock,
-  fatalErrorsServiceMock,
-} from '../../../../../src/core/public/mocks';
-import { usageCollectionPluginMock } from '../../../../../src/plugins/usage_collection/public/mocks';
-
-import { mountWithIntl } from '../../../../test_utils/enzyme_helpers';
-import { EditPolicy } from '../../public/application/sections/edit_policy/edit_policy';
-import { init as initHttp } from '../../public/application/services/http';
-import { init as initUiMetric } from '../../public/application/services/ui_metric';
-import { init as initNotification } from '../../public/application/services/notification';
-import {
-  positiveNumbersAboveZeroErrorMessage,
-  positiveNumberRequiredMessage,
-  numberRequiredMessage,
-  maximumAgeRequiredMessage,
-  maximumSizeRequiredMessage,
-  policyNameRequiredMessage,
-  policyNameStartsWithUnderscoreErrorMessage,
-  policyNameContainsCommaErrorMessage,
-  policyNameContainsSpaceErrorMessage,
-  policyNameMustBeDifferentErrorMessage,
-  policyNameAlreadyUsedErrorMessage,
-  maximumDocumentsRequiredMessage,
-} from '../../public/application/services/policies/policy_validation';
-
-initHttp(axios.create({ adapter: axiosXhrAdapter }));
-initUiMetric(usageCollectionPluginMock.createSetupContract());
-initNotification(
-  notificationServiceMock.createSetupContract().toasts,
-  fatalErrorsServiceMock.createSetupContract()
-);
-
-let server;
-let httpRequestsMockHelpers;
-const policy = {
-  phases: {
-    hot: {
-      min_age: '0s',
-      actions: {
-        rollover: {
-          max_size: '1gb',
-        },
-      },
-    },
-  },
-};
-const policies = [];
-for (let i = 0; i < 105; i++) {
-  policies.push({
-    version: i,
-    modified_date: moment().subtract(i, 'days').valueOf(),
-    linkedIndices: i % 2 === 0 ? [`index${i}`] : null,
-    name: `testy${i}`,
-    policy: {
-      ...policy,
-    },
-  });
-}
-window.scrollTo = jest.fn();
-window.TextEncoder = null;
-let component;
-const activatePhase = async (rendered, phase) => {
-  const testSubject = `enablePhaseSwitch-${phase}`;
-  await act(async () => {
-    await findTestSubject(rendered, testSubject).simulate('click');
-  });
-  rendered.update();
-};
-const expectedErrorMessages = (rendered, expectedErrorMessages) => {
-  const errorMessages = rendered.find('.euiFormErrorText');
-  expect(errorMessages.length).toBe(expectedErrorMessages.length);
-  expectedErrorMessages.forEach((expectedErrorMessage) => {
-    let foundErrorMessage;
-    for (let i = 0; i < errorMessages.length; i++) {
-      if (errorMessages.at(i).text() === expectedErrorMessage) {
-        foundErrorMessage = true;
-      }
-    }
-    expect(foundErrorMessage).toBe(true);
-  });
-};
-const noRollover = (rendered) => {
-  findTestSubject(rendered, 'rolloverSwitch').simulate('click');
-  rendered.update();
-};
-const getNodeAttributeSelect = (rendered, phase) => {
-  return rendered.find(`select#${phase}-selectedNodeAttrs`);
-};
-const setPolicyName = (rendered, policyName) => {
-  const policyNameField = findTestSubject(rendered, 'policyNameField');
-  policyNameField.simulate('change', { target: { value: policyName } });
-  rendered.update();
-};
-const setPhaseAfter = (rendered, phase, after) => {
-  const afterInput = rendered.find(`input#${phase}-selectedMinimumAge`);
-  afterInput.simulate('change', { target: { value: after } });
-  rendered.update();
-};
-const setPhaseIndexPriority = (rendered, phase, priority) => {
-  const priorityInput = rendered.find(`input#${phase}-phaseIndexPriority`);
-  priorityInput.simulate('change', { target: { value: priority } });
-  rendered.update();
-};
-const save = (rendered) => {
-  const saveButton = findTestSubject(rendered, 'savePolicyButton');
-  saveButton.simulate('click');
-  rendered.update();
-};
-describe('edit policy', () => {
-  beforeEach(() => {
-    component = (
-      <EditPolicy
-        history={{ push: () => {} }}
-        getUrlForApp={() => {}}
-        policies={policies}
-        policyName={''}
-      />
-    );
-    ({ server, httpRequestsMockHelpers } = initHttpRequests());
-
-    httpRequestsMockHelpers.setPoliciesResponse(policies);
-  });
-  describe('top level form', () => {
-    test('should show error when trying to save empty form', () => {
-      const rendered = mountWithIntl(component);
-      save(rendered);
-      expectedErrorMessages(rendered, [policyNameRequiredMessage]);
-    });
-    test('should show error when trying to save policy name with space', () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'my policy');
-      save(rendered);
-      expectedErrorMessages(rendered, [policyNameContainsSpaceErrorMessage]);
-    });
-    test('should show error when trying to save policy name that is already used', () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'testy0');
-      rendered.update();
-      save(rendered);
-      expectedErrorMessages(rendered, [policyNameAlreadyUsedErrorMessage]);
-    });
-    test('should show error when trying to save as new policy but using the same name', () => {
-      component = (
-        <EditPolicy
-          policyName={'testy0'}
-          policies={policies}
-          getUrlForApp={() => {}}
-          history={{ push: () => {} }}
-        />
-      );
-      const rendered = mountWithIntl(component);
-      findTestSubject(rendered, 'saveAsNewSwitch').simulate('click');
-      rendered.update();
-      setPolicyName(rendered, 'testy0');
-      save(rendered);
-      expectedErrorMessages(rendered, [policyNameMustBeDifferentErrorMessage]);
-    });
-    test('should show error when trying to save policy name with comma', () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'my,policy');
-      save(rendered);
-      expectedErrorMessages(rendered, [policyNameContainsCommaErrorMessage]);
-    });
-    test('should show error when trying to save policy name starting with underscore', () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, '_mypolicy');
-      save(rendered);
-      expectedErrorMessages(rendered, [policyNameStartsWithUnderscoreErrorMessage]);
-    });
-    test('should show correct json in policy flyout', () => {
-      const rendered = mountWithIntl(component);
-      findTestSubject(rendered, 'requestButton').simulate('click');
-      const json = rendered.find(`code`).text();
-      const expected = `PUT _ilm/policy/<policyName>\n${JSON.stringify(
-        {
-          policy: {
-            phases: {
-              hot: {
-                min_age: '0ms',
-                actions: {
-                  rollover: {
-                    max_age: '30d',
-                    max_size: '50gb',
-                  },
-                  set_priority: {
-                    priority: 100,
-                  },
-                },
-              },
-            },
-          },
-        },
-        null,
-        2
-      )}`;
-      expect(json).toBe(expected);
-    });
-  });
-  describe('hot phase', () => {
-    test('should show errors when trying to save with no max size and no max age', () => {
-      const rendered = mountWithIntl(component);
-      setPolicyName(rendered, 'mypolicy');
-      const maxSizeInput = rendered.find(`input#hot-selectedMaxSizeStored`);
-      maxSizeInput.simulate('change', { target: { value: '' } });
-      const maxAgeInput = rendered.find(`input#hot-selectedMaxAge`);
-      maxAgeInput.simulate('change', { target: { value: '' } });
-      rendered.update();
-      save(rendered);
-      expectedErrorMessages(rendered, [
-        maximumSizeRequiredMessage,
-        maximumAgeRequiredMessage,
-        maximumDocumentsRequiredMessage,
-      ]);
-    });
-    test('should show number above 0 required error when trying to save with -1 for max size', () => {
-      const rendered = mountWithIntl(component);
-      setPolicyName(rendered, 'mypolicy');
-      const maxSizeInput = rendered.find(`input#hot-selectedMaxSizeStored`);
-      maxSizeInput.simulate('change', { target: { value: -1 } });
-      rendered.update();
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
-    });
-    test('should show number above 0 required error when trying to save with 0 for max size', () => {
-      const rendered = mountWithIntl(component);
-      setPolicyName(rendered, 'mypolicy');
-      const maxSizeInput = rendered.find(`input#hot-selectedMaxSizeStored`);
-      maxSizeInput.simulate('change', { target: { value: 0 } });
-      rendered.update();
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
-    });
-    test('should show number above 0 required error when trying to save with -1 for max age', () => {
-      const rendered = mountWithIntl(component);
-      setPolicyName(rendered, 'mypolicy');
-      const maxSizeInput = rendered.find(`input#hot-selectedMaxAge`);
-      maxSizeInput.simulate('change', { target: { value: -1 } });
-      rendered.update();
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
-    });
-    test('should show number above 0 required error when trying to save with 0 for max age', () => {
-      const rendered = mountWithIntl(component);
-      setPolicyName(rendered, 'mypolicy');
-      const maxSizeInput = rendered.find(`input#hot-selectedMaxAge`);
-      maxSizeInput.simulate('change', { target: { value: 0 } });
-      rendered.update();
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
-    });
-    test('should show positive number required error when trying to save with -1 for index priority', () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      setPhaseIndexPriority(rendered, 'hot', -1);
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
-    });
-  });
-  describe('warm phase', () => {
-    beforeEach(() => {
-      server.respondImmediately = true;
-      httpRequestsMockHelpers.setNodesListResponse({});
-      httpRequestsMockHelpers.setNodesDetailsResponse('attribute:true', [
-        { nodeId: 'testNodeId', stats: { name: 'testNodeName', host: 'testHost' } },
-      ]);
-    });
-
-    test('should show number required error when trying to save empty warm phase', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      setPhaseAfter(rendered, 'warm', '');
-      save(rendered);
-      expectedErrorMessages(rendered, [numberRequiredMessage]);
-    });
-    test('should allow 0 for phase timing', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      setPhaseAfter(rendered, 'warm', 0);
-      save(rendered);
-      expectedErrorMessages(rendered, []);
-    });
-    test('should show positive number required error when trying to save warm phase with -1 for after', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      setPhaseAfter(rendered, 'warm', -1);
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
-    });
-    test('should show positive number required error when trying to save warm phase with -1 for index priority', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      setPhaseAfter(rendered, 'warm', 1);
-      setPhaseIndexPriority(rendered, 'warm', -1);
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
-    });
-    test('should show positive number required above zero error when trying to save warm phase with 0 for shrink', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      findTestSubject(rendered, 'shrinkSwitch').simulate('click');
-      rendered.update();
-      setPhaseAfter(rendered, 'warm', 1);
-      const shrinkInput = rendered.find('input#warm-selectedPrimaryShardCount');
-      shrinkInput.simulate('change', { target: { value: '0' } });
-      rendered.update();
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
-    });
-    test('should show positive number above 0 required error when trying to save warm phase with -1 for shrink', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      setPhaseAfter(rendered, 'warm', 1);
-      findTestSubject(rendered, 'shrinkSwitch').simulate('click');
-      rendered.update();
-      const shrinkInput = rendered.find('input#warm-selectedPrimaryShardCount');
-      shrinkInput.simulate('change', { target: { value: '-1' } });
-      rendered.update();
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
-    });
-    test('should show positive number required above zero error when trying to save warm phase with 0 for force merge', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      setPhaseAfter(rendered, 'warm', 1);
-      findTestSubject(rendered, 'forceMergeSwitch').simulate('click');
-      rendered.update();
-      const shrinkInput = rendered.find('input#warm-selectedForceMergeSegments');
-      shrinkInput.simulate('change', { target: { value: '0' } });
-      rendered.update();
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
-    });
-    test('should show positive number above 0 required error when trying to save warm phase with -1 for force merge', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      setPhaseAfter(rendered, 'warm', 1);
-      findTestSubject(rendered, 'forceMergeSwitch').simulate('click');
-      rendered.update();
-      const shrinkInput = rendered.find('input#warm-selectedForceMergeSegments');
-      shrinkInput.simulate('change', { target: { value: '-1' } });
-      rendered.update();
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
-    });
-    test('should show spinner for node attributes input when loading', async () => {
-      server.respondImmediately = false;
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      expect(rendered.find('.euiLoadingSpinner').exists()).toBeTruthy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
-      expect(getNodeAttributeSelect(rendered, 'warm').exists()).toBeFalsy();
-    });
-    test('should show warning instead of node attributes input when none exist', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeTruthy();
-      expect(getNodeAttributeSelect(rendered, 'warm').exists()).toBeFalsy();
-    });
-    test('should show node attributes input when attributes exist', async () => {
-      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
-      const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'warm');
-      expect(nodeAttributesSelect.exists()).toBeTruthy();
-      expect(nodeAttributesSelect.find('option').length).toBe(2);
-    });
-    test('should show view node attributes link when attribute selected and show flyout when clicked', async () => {
-      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'warm');
-      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
-      const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'warm');
-      expect(nodeAttributesSelect.exists()).toBeTruthy();
-      expect(findTestSubject(rendered, 'warm-viewNodeDetailsFlyoutButton').exists()).toBeFalsy();
-      expect(nodeAttributesSelect.find('option').length).toBe(2);
-      nodeAttributesSelect.simulate('change', { target: { value: 'attribute:true' } });
-      rendered.update();
-      const flyoutButton = findTestSubject(rendered, 'warm-viewNodeDetailsFlyoutButton');
-      expect(flyoutButton.exists()).toBeTruthy();
-      await act(async () => {
-        await flyoutButton.simulate('click');
-      });
-      rendered.update();
-      expect(rendered.find('.euiFlyout').exists()).toBeTruthy();
-    });
-  });
-  describe('cold phase', () => {
-    beforeEach(() => {
-      server.respondImmediately = true;
-      httpRequestsMockHelpers.setNodesListResponse({});
-      httpRequestsMockHelpers.setNodesDetailsResponse('attribute:true', [
-        { nodeId: 'testNodeId', stats: { name: 'testNodeName', host: 'testHost' } },
-      ]);
-    });
-    test('should allow 0 for phase timing', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'cold');
-      setPhaseAfter(rendered, 'cold', 0);
-      save(rendered);
-      expectedErrorMessages(rendered, []);
-    });
-    test('should show positive number required error when trying to save cold phase with -1 for after', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'cold');
-      setPhaseAfter(rendered, 'cold', -1);
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
-    });
-    test('should show spinner for node attributes input when loading', async () => {
-      server.respondImmediately = false;
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'cold');
-      expect(rendered.find('.euiLoadingSpinner').exists()).toBeTruthy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
-      expect(getNodeAttributeSelect(rendered, 'cold').exists()).toBeFalsy();
-    });
-    test('should show warning instead of node attributes input when none exist', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'cold');
-      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeTruthy();
-      expect(getNodeAttributeSelect(rendered, 'cold').exists()).toBeFalsy();
-    });
-    test('should show node attributes input when attributes exist', async () => {
-      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'cold');
-      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
-      const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'cold');
-      expect(nodeAttributesSelect.exists()).toBeTruthy();
-      expect(nodeAttributesSelect.find('option').length).toBe(2);
-    });
-    test('should show view node attributes link when attribute selected and show flyout when clicked', async () => {
-      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'cold');
-      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
-      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
-      const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'cold');
-      expect(nodeAttributesSelect.exists()).toBeTruthy();
-      expect(findTestSubject(rendered, 'cold-viewNodeDetailsFlyoutButton').exists()).toBeFalsy();
-      expect(nodeAttributesSelect.find('option').length).toBe(2);
-      nodeAttributesSelect.simulate('change', { target: { value: 'attribute:true' } });
-      rendered.update();
-      const flyoutButton = findTestSubject(rendered, 'cold-viewNodeDetailsFlyoutButton');
-      expect(flyoutButton.exists()).toBeTruthy();
-      await act(async () => {
-        await flyoutButton.simulate('click');
-      });
-      rendered.update();
-      expect(rendered.find('.euiFlyout').exists()).toBeTruthy();
-    });
-    test('should show positive number required error when trying to save with -1 for index priority', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'cold');
-      setPhaseAfter(rendered, 'cold', 1);
-      setPhaseIndexPriority(rendered, 'cold', -1);
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
-    });
-  });
-  describe('delete phase', () => {
-    test('should allow 0 for phase timing', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'delete');
-      setPhaseAfter(rendered, 'delete', 0);
-      save(rendered);
-      expectedErrorMessages(rendered, []);
-    });
-    test('should show positive number required error when trying to save delete phase with -1 for after', async () => {
-      const rendered = mountWithIntl(component);
-      noRollover(rendered);
-      setPolicyName(rendered, 'mypolicy');
-      await activatePhase(rendered, 'delete');
-      setPhaseAfter(rendered, 'delete', -1);
-      save(rendered);
-      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
-    });
-  });
-});
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx b/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx
new file mode 100644
index 00000000000000..28b25c3eb4530f
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx
@@ -0,0 +1,553 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { ReactElement } from 'react';
+import { act } from 'react-dom/test-utils';
+import moment from 'moment-timezone';
+
+import { findTestSubject } from '@elastic/eui/lib/test';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { SinonFakeServer } from 'sinon';
+import { ReactWrapper } from 'enzyme';
+import axios from 'axios';
+import axiosXhrAdapter from 'axios/lib/adapters/xhr';
+
+import { init as initHttpRequests } from './helpers/http_requests';
+import {
+  notificationServiceMock,
+  fatalErrorsServiceMock,
+} from '../../../../../src/core/public/mocks';
+import { usageCollectionPluginMock } from '../../../../../src/plugins/usage_collection/public/mocks';
+
+import { EditPolicy } from '../../public/application/sections/edit_policy/edit_policy';
+import { init as initHttp } from '../../public/application/services/http';
+import { init as initUiMetric } from '../../public/application/services/ui_metric';
+import { init as initNotification } from '../../public/application/services/notification';
+import { PolicyFromES } from '../../common/types';
+import {
+  positiveNumbersAboveZeroErrorMessage,
+  positiveNumberRequiredMessage,
+  numberRequiredMessage,
+  maximumAgeRequiredMessage,
+  maximumSizeRequiredMessage,
+  policyNameRequiredMessage,
+  policyNameStartsWithUnderscoreErrorMessage,
+  policyNameContainsCommaErrorMessage,
+  policyNameContainsSpaceErrorMessage,
+  policyNameMustBeDifferentErrorMessage,
+  policyNameAlreadyUsedErrorMessage,
+  maximumDocumentsRequiredMessage,
+} from '../../public/application/services/policies/policy_validation';
+import { HttpResponse } from './helpers/http_requests';
+import { createMemoryHistory } from 'history';
+
+// @ts-ignore
+initHttp(axios.create({ adapter: axiosXhrAdapter }));
+initUiMetric(usageCollectionPluginMock.createSetupContract());
+initNotification(
+  notificationServiceMock.createSetupContract().toasts,
+  fatalErrorsServiceMock.createSetupContract()
+);
+
+const history = createMemoryHistory();
+let server: SinonFakeServer;
+let httpRequestsMockHelpers: {
+  setPoliciesResponse: (response: HttpResponse) => void;
+  setNodesListResponse: (response: HttpResponse) => void;
+  setNodesDetailsResponse: (nodeAttributes: string, response: HttpResponse) => void;
+};
+const policy = {
+  phases: {
+    hot: {
+      min_age: '0s',
+      actions: {
+        rollover: {
+          max_size: '1gb',
+        },
+      },
+    },
+  },
+};
+const policies: PolicyFromES[] = [];
+for (let i = 0; i < 105; i++) {
+  policies.push({
+    version: i,
+    modified_date: moment().subtract(i, 'days').toISOString(),
+    linkedIndices: i % 2 === 0 ? [`index${i}`] : undefined,
+    name: `testy${i}`,
+    policy: {
+      ...policy,
+      name: `testy${i}`,
+    },
+  });
+}
+window.scrollTo = jest.fn();
+
+let component: ReactElement;
+const activatePhase = async (rendered: ReactWrapper, phase: string) => {
+  const testSubject = `enablePhaseSwitch-${phase}`;
+  await act(async () => {
+    await findTestSubject(rendered, testSubject).simulate('click');
+  });
+  rendered.update();
+};
+const expectedErrorMessages = (rendered: ReactWrapper, expectedMessages: string[]) => {
+  const errorMessages = rendered.find('.euiFormErrorText');
+  expect(errorMessages.length).toBe(expectedMessages.length);
+  expectedMessages.forEach((expectedErrorMessage) => {
+    let foundErrorMessage;
+    for (let i = 0; i < errorMessages.length; i++) {
+      if (errorMessages.at(i).text() === expectedErrorMessage) {
+        foundErrorMessage = true;
+      }
+    }
+    expect(foundErrorMessage).toBe(true);
+  });
+};
+const noRollover = (rendered: ReactWrapper) => {
+  findTestSubject(rendered, 'rolloverSwitch').simulate('click');
+  rendered.update();
+};
+const getNodeAttributeSelect = (rendered: ReactWrapper, phase: string) => {
+  return rendered.find(`select#${phase}-selectedNodeAttrs`);
+};
+const setPolicyName = (rendered: ReactWrapper, policyName: string) => {
+  const policyNameField = findTestSubject(rendered, 'policyNameField');
+  policyNameField.simulate('change', { target: { value: policyName } });
+  rendered.update();
+};
+const setPhaseAfter = (rendered: ReactWrapper, phase: string, after: string) => {
+  const afterInput = rendered.find(`input#${phase}-selectedMinimumAge`);
+  afterInput.simulate('change', { target: { value: after } });
+  rendered.update();
+};
+const setPhaseIndexPriority = (rendered: ReactWrapper, phase: string, priority: string) => {
+  const priorityInput = rendered.find(`input#${phase}-phaseIndexPriority`);
+  priorityInput.simulate('change', { target: { value: priority } });
+  rendered.update();
+};
+const save = (rendered: ReactWrapper) => {
+  const saveButton = findTestSubject(rendered, 'savePolicyButton');
+  saveButton.simulate('click');
+  rendered.update();
+};
+describe('edit policy', () => {
+  beforeEach(() => {
+    component = (
+      <EditPolicy history={history} getUrlForApp={jest.fn()} policies={policies} policyName={''} />
+    );
+    ({ server, httpRequestsMockHelpers } = initHttpRequests());
+
+    httpRequestsMockHelpers.setPoliciesResponse(policies);
+  });
+  describe('top level form', () => {
+    test('should show error when trying to save empty form', () => {
+      const rendered = mountWithIntl(component);
+      save(rendered);
+      expectedErrorMessages(rendered, [policyNameRequiredMessage]);
+    });
+    test('should show error when trying to save policy name with space', () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'my policy');
+      save(rendered);
+      expectedErrorMessages(rendered, [policyNameContainsSpaceErrorMessage]);
+    });
+    test('should show error when trying to save policy name that is already used', () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'testy0');
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [policyNameAlreadyUsedErrorMessage]);
+    });
+    test('should show error when trying to save as new policy but using the same name', () => {
+      component = (
+        <EditPolicy
+          policyName={'testy0'}
+          policies={policies}
+          getUrlForApp={jest.fn()}
+          history={history}
+        />
+      );
+      const rendered = mountWithIntl(component);
+      findTestSubject(rendered, 'saveAsNewSwitch').simulate('click');
+      rendered.update();
+      setPolicyName(rendered, 'testy0');
+      save(rendered);
+      expectedErrorMessages(rendered, [policyNameMustBeDifferentErrorMessage]);
+    });
+    test('should show error when trying to save policy name with comma', () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'my,policy');
+      save(rendered);
+      expectedErrorMessages(rendered, [policyNameContainsCommaErrorMessage]);
+    });
+    test('should show error when trying to save policy name starting with underscore', () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, '_mypolicy');
+      save(rendered);
+      expectedErrorMessages(rendered, [policyNameStartsWithUnderscoreErrorMessage]);
+    });
+    test('should show correct json in policy flyout', () => {
+      const rendered = mountWithIntl(component);
+      findTestSubject(rendered, 'requestButton').simulate('click');
+      const json = rendered.find(`code`).text();
+      const expected = `PUT _ilm/policy/<policyName>\n${JSON.stringify(
+        {
+          policy: {
+            phases: {
+              hot: {
+                min_age: '0ms',
+                actions: {
+                  rollover: {
+                    max_age: '30d',
+                    max_size: '50gb',
+                  },
+                  set_priority: {
+                    priority: 100,
+                  },
+                },
+              },
+            },
+          },
+        },
+        null,
+        2
+      )}`;
+      expect(json).toBe(expected);
+    });
+  });
+  describe('hot phase', () => {
+    test('should show errors when trying to save with no max size and no max age', () => {
+      const rendered = mountWithIntl(component);
+      setPolicyName(rendered, 'mypolicy');
+      const maxSizeInput = rendered.find(`input#hot-selectedMaxSizeStored`);
+      maxSizeInput.simulate('change', { target: { value: '' } });
+      const maxAgeInput = rendered.find(`input#hot-selectedMaxAge`);
+      maxAgeInput.simulate('change', { target: { value: '' } });
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [
+        maximumSizeRequiredMessage,
+        maximumAgeRequiredMessage,
+        maximumDocumentsRequiredMessage,
+      ]);
+    });
+    test('should show number above 0 required error when trying to save with -1 for max size', () => {
+      const rendered = mountWithIntl(component);
+      setPolicyName(rendered, 'mypolicy');
+      const maxSizeInput = rendered.find(`input#hot-selectedMaxSizeStored`);
+      maxSizeInput.simulate('change', { target: { value: -1 } });
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
+    });
+    test('should show number above 0 required error when trying to save with 0 for max size', () => {
+      const rendered = mountWithIntl(component);
+      setPolicyName(rendered, 'mypolicy');
+      const maxSizeInput = rendered.find(`input#hot-selectedMaxSizeStored`);
+      maxSizeInput.simulate('change', { target: { value: 0 } });
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
+    });
+    test('should show number above 0 required error when trying to save with -1 for max age', () => {
+      const rendered = mountWithIntl(component);
+      setPolicyName(rendered, 'mypolicy');
+      const maxSizeInput = rendered.find(`input#hot-selectedMaxAge`);
+      maxSizeInput.simulate('change', { target: { value: -1 } });
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
+    });
+    test('should show number above 0 required error when trying to save with 0 for max age', () => {
+      const rendered = mountWithIntl(component);
+      setPolicyName(rendered, 'mypolicy');
+      const maxSizeInput = rendered.find(`input#hot-selectedMaxAge`);
+      maxSizeInput.simulate('change', { target: { value: 0 } });
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
+    });
+    test('should show positive number required error when trying to save with -1 for index priority', () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      setPhaseIndexPriority(rendered, 'hot', '-1');
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
+    });
+  });
+  describe('warm phase', () => {
+    beforeEach(() => {
+      server.respondImmediately = true;
+      httpRequestsMockHelpers.setNodesListResponse({});
+      httpRequestsMockHelpers.setNodesDetailsResponse('attribute:true', [
+        { nodeId: 'testNodeId', stats: { name: 'testNodeName', host: 'testHost' } },
+      ]);
+    });
+
+    test('should show number required error when trying to save empty warm phase', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      setPhaseAfter(rendered, 'warm', '');
+      save(rendered);
+      expectedErrorMessages(rendered, [numberRequiredMessage]);
+    });
+    test('should allow 0 for phase timing', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      setPhaseAfter(rendered, 'warm', '0');
+      save(rendered);
+      expectedErrorMessages(rendered, []);
+    });
+    test('should show positive number required error when trying to save warm phase with -1 for after', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      setPhaseAfter(rendered, 'warm', '-1');
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
+    });
+    test('should show positive number required error when trying to save warm phase with -1 for index priority', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      setPhaseAfter(rendered, 'warm', '1');
+      setPhaseIndexPriority(rendered, 'warm', '-1');
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
+    });
+    test('should show positive number required above zero error when trying to save warm phase with 0 for shrink', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      findTestSubject(rendered, 'shrinkSwitch').simulate('click');
+      rendered.update();
+      setPhaseAfter(rendered, 'warm', '1');
+      const shrinkInput = rendered.find('input#warm-selectedPrimaryShardCount');
+      shrinkInput.simulate('change', { target: { value: '0' } });
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
+    });
+    test('should show positive number above 0 required error when trying to save warm phase with -1 for shrink', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      setPhaseAfter(rendered, 'warm', '1');
+      findTestSubject(rendered, 'shrinkSwitch').simulate('click');
+      rendered.update();
+      const shrinkInput = rendered.find('input#warm-selectedPrimaryShardCount');
+      shrinkInput.simulate('change', { target: { value: '-1' } });
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
+    });
+    test('should show positive number required above zero error when trying to save warm phase with 0 for force merge', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      setPhaseAfter(rendered, 'warm', '1');
+      findTestSubject(rendered, 'forceMergeSwitch').simulate('click');
+      rendered.update();
+      const shrinkInput = rendered.find('input#warm-selectedForceMergeSegments');
+      shrinkInput.simulate('change', { target: { value: '0' } });
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
+    });
+    test('should show positive number above 0 required error when trying to save warm phase with -1 for force merge', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      setPhaseAfter(rendered, 'warm', '1');
+      findTestSubject(rendered, 'forceMergeSwitch').simulate('click');
+      rendered.update();
+      const shrinkInput = rendered.find('input#warm-selectedForceMergeSegments');
+      shrinkInput.simulate('change', { target: { value: '-1' } });
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
+    });
+    test('should show spinner for node attributes input when loading', async () => {
+      server.respondImmediately = false;
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeTruthy();
+      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
+      expect(getNodeAttributeSelect(rendered, 'warm').exists()).toBeFalsy();
+    });
+    test('should show warning instead of node attributes input when none exist', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      expect(rendered.find('.euiCallOut--warning').exists()).toBeTruthy();
+      expect(getNodeAttributeSelect(rendered, 'warm').exists()).toBeFalsy();
+    });
+    test('should show node attributes input when attributes exist', async () => {
+      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
+      const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'warm');
+      expect(nodeAttributesSelect.exists()).toBeTruthy();
+      expect(nodeAttributesSelect.find('option').length).toBe(2);
+    });
+    test('should show view node attributes link when attribute selected and show flyout when clicked', async () => {
+      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'warm');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
+      const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'warm');
+      expect(nodeAttributesSelect.exists()).toBeTruthy();
+      expect(findTestSubject(rendered, 'warm-viewNodeDetailsFlyoutButton').exists()).toBeFalsy();
+      expect(nodeAttributesSelect.find('option').length).toBe(2);
+      nodeAttributesSelect.simulate('change', { target: { value: 'attribute:true' } });
+      rendered.update();
+      const flyoutButton = findTestSubject(rendered, 'warm-viewNodeDetailsFlyoutButton');
+      expect(flyoutButton.exists()).toBeTruthy();
+      await act(async () => {
+        await flyoutButton.simulate('click');
+      });
+      rendered.update();
+      expect(rendered.find('.euiFlyout').exists()).toBeTruthy();
+    });
+  });
+  describe('cold phase', () => {
+    beforeEach(() => {
+      server.respondImmediately = true;
+      httpRequestsMockHelpers.setNodesListResponse({});
+      httpRequestsMockHelpers.setNodesDetailsResponse('attribute:true', [
+        { nodeId: 'testNodeId', stats: { name: 'testNodeName', host: 'testHost' } },
+      ]);
+    });
+    test('should allow 0 for phase timing', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'cold');
+      setPhaseAfter(rendered, 'cold', '0');
+      save(rendered);
+      expectedErrorMessages(rendered, []);
+    });
+    test('should show positive number required error when trying to save cold phase with -1 for after', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'cold');
+      setPhaseAfter(rendered, 'cold', '-1');
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
+    });
+    test('should show spinner for node attributes input when loading', async () => {
+      server.respondImmediately = false;
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'cold');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeTruthy();
+      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
+      expect(getNodeAttributeSelect(rendered, 'cold').exists()).toBeFalsy();
+    });
+    test('should show warning instead of node attributes input when none exist', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'cold');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      expect(rendered.find('.euiCallOut--warning').exists()).toBeTruthy();
+      expect(getNodeAttributeSelect(rendered, 'cold').exists()).toBeFalsy();
+    });
+    test('should show node attributes input when attributes exist', async () => {
+      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'cold');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
+      const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'cold');
+      expect(nodeAttributesSelect.exists()).toBeTruthy();
+      expect(nodeAttributesSelect.find('option').length).toBe(2);
+    });
+    test('should show view node attributes link when attribute selected and show flyout when clicked', async () => {
+      httpRequestsMockHelpers.setNodesListResponse({ 'attribute:true': ['node1'] });
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'cold');
+      expect(rendered.find('.euiLoadingSpinner').exists()).toBeFalsy();
+      expect(rendered.find('.euiCallOut--warning').exists()).toBeFalsy();
+      const nodeAttributesSelect = getNodeAttributeSelect(rendered, 'cold');
+      expect(nodeAttributesSelect.exists()).toBeTruthy();
+      expect(findTestSubject(rendered, 'cold-viewNodeDetailsFlyoutButton').exists()).toBeFalsy();
+      expect(nodeAttributesSelect.find('option').length).toBe(2);
+      nodeAttributesSelect.simulate('change', { target: { value: 'attribute:true' } });
+      rendered.update();
+      const flyoutButton = findTestSubject(rendered, 'cold-viewNodeDetailsFlyoutButton');
+      expect(flyoutButton.exists()).toBeTruthy();
+      await act(async () => {
+        await flyoutButton.simulate('click');
+      });
+      rendered.update();
+      expect(rendered.find('.euiFlyout').exists()).toBeTruthy();
+    });
+    test('should show positive number required error when trying to save with -1 for index priority', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'cold');
+      setPhaseAfter(rendered, 'cold', '1');
+      setPhaseIndexPriority(rendered, 'cold', '-1');
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
+    });
+  });
+  describe('delete phase', () => {
+    test('should allow 0 for phase timing', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'delete');
+      setPhaseAfter(rendered, 'delete', '0');
+      save(rendered);
+      expectedErrorMessages(rendered, []);
+    });
+    test('should show positive number required error when trying to save delete phase with -1 for after', async () => {
+      const rendered = mountWithIntl(component);
+      noRollover(rendered);
+      setPolicyName(rendered, 'mypolicy');
+      await activatePhase(rendered, 'delete');
+      setPhaseAfter(rendered, 'delete', '-1');
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumberRequiredMessage]);
+    });
+  });
+});
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/http_requests.ts b/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/http_requests.ts
index 668cbedbf0c950..6cbe3bdf1f8c6a 100644
--- a/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/http_requests.ts
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/components/helpers/http_requests.ts
@@ -6,7 +6,7 @@
 
 import sinon, { SinonFakeServer } from 'sinon';
 
-type HttpResponse = Record<string, any> | any[];
+export type HttpResponse = Record<string, any> | any[];
 
 const registerHttpRequestMockHelpers = (server: SinonFakeServer) => {
   const setPoliciesResponse = (response: HttpResponse = []) => {
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/policy_table.test.js b/x-pack/plugins/index_lifecycle_management/__jest__/components/policy_table.test.js
deleted file mode 100644
index 60e3e9443bec98..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/__jest__/components/policy_table.test.js
+++ /dev/null
@@ -1,174 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import moment from 'moment-timezone';
-import React from 'react';
-import { Provider } from 'react-redux';
-// axios has a $http like interface so using it to simulate $http
-import axios from 'axios';
-import axiosXhrAdapter from 'axios/lib/adapters/xhr';
-import sinon from 'sinon';
-import { findTestSubject, takeMountedSnapshot } from '@elastic/eui/lib/test';
-
-import { scopedHistoryMock } from '../../../../../src/core/public/mocks';
-import { mountWithIntl } from '../../../../test_utils/enzyme_helpers';
-import { fetchedPolicies } from '../../public/application/store/actions';
-import { indexLifecycleManagementStore } from '../../public/application/store';
-import { PolicyTable } from '../../public/application/sections/policy_table';
-import { init as initHttp } from '../../public/application/services/http';
-import { init as initUiMetric } from '../../public/application/services/ui_metric';
-
-initHttp(axios.create({ adapter: axiosXhrAdapter }), (path) => path);
-initUiMetric({ reportUiStats: () => {} });
-
-let server = null;
-
-let store = null;
-const policies = [];
-for (let i = 0; i < 105; i++) {
-  policies.push({
-    version: i,
-    modified_date: moment().subtract(i, 'days').valueOf(),
-    linkedIndices: i % 2 === 0 ? [`index${i}`] : null,
-    name: `testy${i}`,
-  });
-}
-jest.mock('');
-let component = null;
-
-const snapshot = (rendered) => {
-  expect(rendered).toMatchSnapshot();
-};
-const mountedSnapshot = (rendered) => {
-  expect(takeMountedSnapshot(rendered)).toMatchSnapshot();
-};
-const names = (rendered) => {
-  return findTestSubject(rendered, 'policyTablePolicyNameLink');
-};
-const namesText = (rendered) => {
-  return names(rendered).map((button) => button.text());
-};
-
-const testSort = (headerName) => {
-  const rendered = mountWithIntl(component);
-  const nameHeader = findTestSubject(rendered, `policyTableHeaderCell-${headerName}`).find(
-    'button'
-  );
-  nameHeader.simulate('click');
-  rendered.update();
-  snapshot(namesText(rendered));
-  nameHeader.simulate('click');
-  rendered.update();
-  snapshot(namesText(rendered));
-};
-const openContextMenu = (buttonIndex) => {
-  const rendered = mountWithIntl(component);
-  const actionsButton = findTestSubject(rendered, 'policyActionsContextMenuButton');
-  actionsButton.at(buttonIndex).simulate('click');
-  rendered.update();
-  return rendered;
-};
-
-describe('policy table', () => {
-  beforeEach(() => {
-    store = indexLifecycleManagementStore();
-    component = (
-      <Provider store={store}>
-        <PolicyTable history={scopedHistoryMock.create()} navigateToApp={() => {}} />
-      </Provider>
-    );
-    store.dispatch(fetchedPolicies(policies));
-    server = sinon.fakeServer.create();
-    server.respondWith('/api/index_lifecycle_management/policies', [
-      200,
-      { 'Content-Type': 'application/json' },
-      JSON.stringify(policies),
-    ]);
-  });
-  test('should show spinner when policies are loading', () => {
-    store = indexLifecycleManagementStore();
-    component = (
-      <Provider store={store}>
-        <PolicyTable history={scopedHistoryMock.create()} navigateToApp={() => {}} />
-      </Provider>
-    );
-    const rendered = mountWithIntl(component);
-    expect(rendered.find('.euiLoadingSpinner').exists()).toBeTruthy();
-  });
-  test('should show empty state when there are not any policies', () => {
-    store.dispatch(fetchedPolicies([]));
-    const rendered = mountWithIntl(component);
-    mountedSnapshot(rendered);
-  });
-  test('should change pages when a pagination link is clicked on', () => {
-    const rendered = mountWithIntl(component);
-    snapshot(namesText(rendered));
-    const pagingButtons = rendered.find('.euiPaginationButton');
-    pagingButtons.at(2).simulate('click');
-    rendered.update();
-    snapshot(namesText(rendered));
-  });
-  test('should show more when per page value is increased', () => {
-    const rendered = mountWithIntl(component);
-    const perPageButton = rendered.find('EuiTablePagination EuiPopover').find('button');
-    perPageButton.simulate('click');
-    rendered.update();
-    const fiftyButton = rendered.find('.euiContextMenuItem').at(1);
-    fiftyButton.simulate('click');
-    rendered.update();
-    expect(namesText(rendered).length).toBe(50);
-  });
-  test('should filter based on content of search input', () => {
-    const rendered = mountWithIntl(component);
-    const searchInput = rendered.find('.euiFieldSearch').first();
-    searchInput.instance().value = 'testy0';
-    searchInput.simulate('keyup', { key: 'Enter', keyCode: 13, which: 13 });
-    rendered.update();
-    snapshot(namesText(rendered));
-  });
-  test('should sort when name header is clicked', () => {
-    testSort('name');
-  });
-  test('should sort when version header is clicked', () => {
-    testSort('version');
-  });
-  test('should sort when modified date header is clicked', () => {
-    testSort('modified_date');
-  });
-  test('should sort when linked indices header is clicked', () => {
-    testSort('linkedIndices');
-  });
-  test('should have proper actions in context menu when there are linked indices', () => {
-    const rendered = openContextMenu(0);
-    const buttons = rendered.find('button.euiContextMenuItem');
-    expect(buttons.length).toBe(3);
-    expect(buttons.at(0).text()).toBe('View indices linked to policy');
-    expect(buttons.at(1).text()).toBe('Add policy to index template');
-    expect(buttons.at(2).text()).toBe('Delete policy');
-    expect(buttons.at(2).getDOMNode().disabled).toBeTruthy();
-  });
-  test('should have proper actions in context menu when there are not linked indices', () => {
-    const rendered = openContextMenu(1);
-    const buttons = rendered.find('button.euiContextMenuItem');
-    expect(buttons.length).toBe(2);
-    expect(buttons.at(0).text()).toBe('Add policy to index template');
-    expect(buttons.at(1).text()).toBe('Delete policy');
-    expect(buttons.at(1).getDOMNode().disabled).toBeFalsy();
-  });
-  test('confirmation modal should show when delete button is pressed', () => {
-    const rendered = openContextMenu(1);
-    const deleteButton = rendered.find('button.euiContextMenuItem').at(1);
-    deleteButton.simulate('click');
-    rendered.update();
-    expect(rendered.find('.euiModal--confirmation').exists()).toBeTruthy();
-  });
-  test('confirmation modal should show when add policy to index template button is pressed', () => {
-    const rendered = openContextMenu(1);
-    const deleteButton = rendered.find('button.euiContextMenuItem').at(0);
-    deleteButton.simulate('click');
-    rendered.update();
-    expect(rendered.find('.euiModal--confirmation').exists()).toBeTruthy();
-  });
-});
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/policy_table.test.tsx b/x-pack/plugins/index_lifecycle_management/__jest__/components/policy_table.test.tsx
new file mode 100644
index 00000000000000..0d66d9a8cdf9f8
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/components/policy_table.test.tsx
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import moment from 'moment-timezone';
+import React, { ReactElement } from 'react';
+import { ReactWrapper } from 'enzyme';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { findTestSubject, takeMountedSnapshot } from '@elastic/eui/lib/test';
+
+import {
+  fatalErrorsServiceMock,
+  injectedMetadataServiceMock,
+  scopedHistoryMock,
+} from '../../../../../src/core/public/mocks';
+import { HttpService } from '../../../../../src/core/public/http';
+import { usageCollectionPluginMock } from '../../../../../src/plugins/usage_collection/public/mocks';
+
+import { PolicyFromES } from '../../common/types';
+import { PolicyTable } from '../../public/application/sections/policy_table/policy_table';
+import { init as initHttp } from '../../public/application/services/http';
+import { init as initUiMetric } from '../../public/application/services/ui_metric';
+
+initHttp(
+  new HttpService().setup({
+    injectedMetadata: injectedMetadataServiceMock.createSetupContract(),
+    fatalErrors: fatalErrorsServiceMock.createSetupContract(),
+  })
+);
+initUiMetric(usageCollectionPluginMock.createSetupContract());
+
+const policies: PolicyFromES[] = [];
+for (let i = 0; i < 105; i++) {
+  policies.push({
+    version: i,
+    modified_date: moment().subtract(i, 'days').toISOString(),
+    linkedIndices: i % 2 === 0 ? [`index${i}`] : undefined,
+    name: `testy${i}`,
+    policy: {
+      name: `testy${i}`,
+      phases: {},
+    },
+  });
+}
+jest.mock('');
+let component: ReactElement;
+
+const snapshot = (rendered: string[]) => {
+  expect(rendered).toMatchSnapshot();
+};
+const mountedSnapshot = (rendered: ReactWrapper) => {
+  expect(takeMountedSnapshot(rendered)).toMatchSnapshot();
+};
+const names = (rendered: ReactWrapper) => {
+  return findTestSubject(rendered, 'policyTablePolicyNameLink');
+};
+const namesText = (rendered: ReactWrapper): string[] => {
+  return (names(rendered) as ReactWrapper).map((button) => button.text());
+};
+
+const testSort = (headerName: string) => {
+  const rendered = mountWithIntl(component);
+  const nameHeader = findTestSubject(rendered, `policyTableHeaderCell-${headerName}`).find(
+    'button'
+  );
+  nameHeader.simulate('click');
+  rendered.update();
+  snapshot(namesText(rendered));
+  nameHeader.simulate('click');
+  rendered.update();
+  snapshot(namesText(rendered));
+};
+const openContextMenu = (buttonIndex: number) => {
+  const rendered = mountWithIntl(component);
+  const actionsButton = findTestSubject(rendered, 'policyActionsContextMenuButton');
+  actionsButton.at(buttonIndex).simulate('click');
+  rendered.update();
+  return rendered;
+};
+
+describe('policy table', () => {
+  beforeEach(() => {
+    component = (
+      <PolicyTable
+        policies={policies}
+        history={scopedHistoryMock.create()}
+        navigateToApp={jest.fn()}
+        updatePolicies={jest.fn()}
+      />
+    );
+  });
+
+  test('should show empty state when there are not any policies', () => {
+    component = (
+      <PolicyTable
+        policies={[]}
+        history={scopedHistoryMock.create()}
+        navigateToApp={jest.fn()}
+        updatePolicies={jest.fn()}
+      />
+    );
+    const rendered = mountWithIntl(component);
+    mountedSnapshot(rendered);
+  });
+  test('should change pages when a pagination link is clicked on', () => {
+    const rendered = mountWithIntl(component);
+    snapshot(namesText(rendered));
+    const pagingButtons = rendered.find('.euiPaginationButton');
+    pagingButtons.at(2).simulate('click');
+    rendered.update();
+    snapshot(namesText(rendered));
+  });
+  test('should show more when per page value is increased', () => {
+    const rendered = mountWithIntl(component);
+    const perPageButton = rendered.find('EuiTablePagination EuiPopover').find('button');
+    perPageButton.simulate('click');
+    rendered.update();
+    const fiftyButton = rendered.find('.euiContextMenuItem').at(1);
+    fiftyButton.simulate('click');
+    rendered.update();
+    expect(namesText(rendered).length).toBe(50);
+  });
+  test('should filter based on content of search input', () => {
+    const rendered = mountWithIntl(component);
+    const searchInput = rendered.find('.euiFieldSearch').first();
+    ((searchInput.instance() as unknown) as HTMLInputElement).value = 'testy0';
+    searchInput.simulate('keyup', { key: 'Enter', keyCode: 13, which: 13 });
+    rendered.update();
+    snapshot(namesText(rendered));
+  });
+  test('should sort when name header is clicked', () => {
+    testSort('name');
+  });
+  test('should sort when version header is clicked', () => {
+    testSort('version');
+  });
+  test('should sort when modified date header is clicked', () => {
+    testSort('modified_date');
+  });
+  test('should sort when linked indices header is clicked', () => {
+    testSort('linkedIndices');
+  });
+  test('should have proper actions in context menu when there are linked indices', () => {
+    const rendered = openContextMenu(0);
+    const buttons = rendered.find('button.euiContextMenuItem');
+    expect(buttons.length).toBe(3);
+    expect(buttons.at(0).text()).toBe('View indices linked to policy');
+    expect(buttons.at(1).text()).toBe('Add policy to index template');
+    expect(buttons.at(2).text()).toBe('Delete policy');
+    expect((buttons.at(2).getDOMNode() as HTMLButtonElement).disabled).toBeTruthy();
+  });
+  test('should have proper actions in context menu when there are not linked indices', () => {
+    const rendered = openContextMenu(1);
+    const buttons = rendered.find('button.euiContextMenuItem');
+    expect(buttons.length).toBe(2);
+    expect(buttons.at(0).text()).toBe('Add policy to index template');
+    expect(buttons.at(1).text()).toBe('Delete policy');
+    expect((buttons.at(1).getDOMNode() as HTMLButtonElement).disabled).toBeFalsy();
+  });
+  test('confirmation modal should show when delete button is pressed', () => {
+    const rendered = openContextMenu(1);
+    const deleteButton = rendered.find('button.euiContextMenuItem').at(1);
+    deleteButton.simulate('click');
+    rendered.update();
+    expect(rendered.find('.euiModal--confirmation').exists()).toBeTruthy();
+  });
+  test('confirmation modal should show when add policy to index template button is pressed', () => {
+    const rendered = openContextMenu(1);
+    const deleteButton = rendered.find('button.euiContextMenuItem').at(0);
+    deleteButton.simulate('click');
+    rendered.update();
+    expect(rendered.find('.euiModal--confirmation').exists()).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/extend_index_management.test.js b/x-pack/plugins/index_lifecycle_management/__jest__/extend_index_management.test.js
deleted file mode 100644
index 4fa1838115840b..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/__jest__/extend_index_management.test.js
+++ /dev/null
@@ -1,271 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import moment from 'moment-timezone';
-import axios from 'axios';
-import axiosXhrAdapter from 'axios/lib/adapters/xhr';
-
-import { mountWithIntl } from '../../../test_utils/enzyme_helpers';
-import {
-  retryLifecycleActionExtension,
-  removeLifecyclePolicyActionExtension,
-  addLifecyclePolicyActionExtension,
-  ilmBannerExtension,
-  ilmFilterExtension,
-  ilmSummaryExtension,
-} from '../public/extend_index_management';
-import { init as initHttp } from '../public/application/services/http';
-import { init as initUiMetric } from '../public/application/services/ui_metric';
-
-// We need to init the http with a mock for any tests that depend upon the http service.
-// For example, add_lifecycle_confirm_modal makes an API request in its componentDidMount
-// lifecycle method. If we don't mock this, CI will fail with "Call retries were exceeded".
-initHttp(axios.create({ adapter: axiosXhrAdapter }), (path) => path);
-initUiMetric({ reportUiStats: () => {} });
-
-jest.mock('../../../plugins/index_management/public', async () => {
-  const { indexManagementMock } = await import('../../../plugins/index_management/public/mocks.ts');
-  return indexManagementMock.createSetup();
-});
-
-const indexWithoutLifecyclePolicy = {
-  health: 'yellow',
-  status: 'open',
-  name: 'noPolicy',
-  uuid: 'BJ-nrZYuSrG-jaofr6SeLg',
-  primary: '1',
-  replica: '1',
-  documents: '1',
-  documents_deleted: '0',
-  size: '3.4kb',
-  primary_size: '3.4kb',
-  aliases: 'none',
-  ilm: {
-    index: 'testy1',
-    managed: false,
-  },
-};
-
-const indexWithLifecyclePolicy = {
-  health: 'yellow',
-  status: 'open',
-  name: 'testy3',
-  uuid: 'XL11TLa3Tvq298_dMUzLHQ',
-  primary: '1',
-  replica: '1',
-  documents: '2',
-  documents_deleted: '0',
-  size: '6.5kb',
-  primary_size: '6.5kb',
-  aliases: 'none',
-  ilm: {
-    index: 'testy3',
-    managed: true,
-    policy: 'testy',
-    lifecycle_date_millis: 1544020872361,
-    phase: 'new',
-    phase_time_millis: 1544187775867,
-    action: 'complete',
-    action_time_millis: 1544187775867,
-    step: 'complete',
-    step_time_millis: 1544187775867,
-  },
-};
-
-const indexWithLifecycleError = {
-  health: 'yellow',
-  status: 'open',
-  name: 'testy3',
-  uuid: 'XL11TLa3Tvq298_dMUzLHQ',
-  primary: '1',
-  replica: '1',
-  documents: '2',
-  documents_deleted: '0',
-  size: '6.5kb',
-  primary_size: '6.5kb',
-  aliases: 'none',
-  ilm: {
-    index: 'testy3',
-    managed: true,
-    policy: 'testy',
-    lifecycle_date_millis: 1544020872361,
-    phase: 'hot',
-    phase_time_millis: 1544187775891,
-    action: 'rollover',
-    action_time_millis: 1544187775891,
-    step: 'ERROR',
-    step_time_millis: 1544187776208,
-    failed_step: 'check-rollover-ready',
-    step_info: {
-      type: 'illegal_argument_exception',
-      reason: 'setting [index.lifecycle.rollover_alias] for index [testy3] is empty or not defined',
-      stack_trace: 'fakestacktrace',
-    },
-    phase_execution: {
-      policy: 'testy',
-      phase_definition: { min_age: '0s', actions: { rollover: { max_size: '1gb' } } },
-      version: 1,
-      modified_date_in_millis: 1544031699844,
-    },
-  },
-};
-
-moment.tz.setDefault('utc');
-
-const getUrlForApp = (appId, options) => {
-  return appId + '/' + (options ? options.path : '');
-};
-
-describe('extend index management', () => {
-  describe('retry lifecycle action extension', () => {
-    test('should return null when no indices have index lifecycle policy', () => {
-      const extension = retryLifecycleActionExtension({ indices: [indexWithoutLifecyclePolicy] });
-      expect(extension).toBeNull();
-    });
-
-    test('should return null when no index has lifecycle errors', () => {
-      const extension = retryLifecycleActionExtension({
-        indices: [indexWithLifecyclePolicy, indexWithLifecyclePolicy],
-      });
-      expect(extension).toBeNull();
-    });
-
-    test('should return null when not all indices have lifecycle errors', () => {
-      const extension = retryLifecycleActionExtension({
-        indices: [indexWithLifecyclePolicy, indexWithLifecycleError],
-      });
-      expect(extension).toBeNull();
-    });
-
-    test('should return extension when all indices have lifecycle errors', () => {
-      const extension = retryLifecycleActionExtension({
-        indices: [indexWithLifecycleError, indexWithLifecycleError],
-      });
-      expect(extension).toBeDefined();
-      expect(extension).toMatchSnapshot();
-    });
-  });
-
-  describe('remove lifecycle action extension', () => {
-    test('should return null when no indices have index lifecycle policy', () => {
-      const extension = removeLifecyclePolicyActionExtension({
-        indices: [indexWithoutLifecyclePolicy],
-      });
-      expect(extension).toBeNull();
-    });
-
-    test('should return null when some indices have index lifecycle policy', () => {
-      const extension = removeLifecyclePolicyActionExtension({
-        indices: [indexWithoutLifecyclePolicy, indexWithLifecyclePolicy],
-      });
-      expect(extension).toBeNull();
-    });
-
-    test('should return extension when all indices have lifecycle policy', () => {
-      const extension = removeLifecyclePolicyActionExtension({
-        indices: [indexWithLifecycleError, indexWithLifecycleError],
-      });
-      expect(extension).toBeDefined();
-      expect(extension).toMatchSnapshot();
-    });
-  });
-
-  describe('add lifecycle policy action extension', () => {
-    test('should return null when index has index lifecycle policy', () => {
-      const extension = addLifecyclePolicyActionExtension(
-        { indices: [indexWithLifecyclePolicy] },
-        getUrlForApp
-      );
-      expect(extension).toBeNull();
-    });
-
-    test('should return null when more than one index is passed', () => {
-      const extension = addLifecyclePolicyActionExtension({
-        indices: [indexWithoutLifecyclePolicy, indexWithoutLifecyclePolicy],
-        getUrlForApp,
-      });
-      expect(extension).toBeNull();
-    });
-
-    test('should return extension when one index is passed and it does not have lifecycle policy', () => {
-      const extension = addLifecyclePolicyActionExtension({
-        indices: [indexWithoutLifecyclePolicy],
-        getUrlForApp,
-      });
-      expect(extension.renderConfirmModal).toBeDefined;
-      const component = extension.renderConfirmModal(jest.fn());
-      const rendered = mountWithIntl(component);
-      expect(rendered.exists('.euiModal--confirmation'));
-    });
-  });
-
-  describe('ilm banner extension', () => {
-    test('should return null when no index has index lifecycle policy', () => {
-      const extension = ilmBannerExtension([
-        indexWithoutLifecyclePolicy,
-        indexWithoutLifecyclePolicy,
-      ]);
-      expect(extension).toBeNull();
-    });
-
-    test('should return null no index has lifecycle error', () => {
-      const extension = ilmBannerExtension([indexWithoutLifecyclePolicy, indexWithLifecyclePolicy]);
-      expect(extension).toBeNull();
-    });
-
-    test('should return extension when any index has lifecycle error', () => {
-      const extension = ilmBannerExtension([
-        indexWithoutLifecyclePolicy,
-        indexWithLifecyclePolicy,
-        indexWithLifecycleError,
-      ]);
-      expect(extension).toBeDefined();
-      expect(extension).toMatchSnapshot();
-    });
-  });
-
-  describe('ilm summary extension', () => {
-    test('should render null when index has no index lifecycle policy', () => {
-      const extension = ilmSummaryExtension(indexWithoutLifecyclePolicy, getUrlForApp);
-      const rendered = mountWithIntl(extension);
-      expect(rendered.isEmptyRender()).toBeTruthy();
-    });
-
-    test('should return extension when index has lifecycle policy', () => {
-      const extension = ilmSummaryExtension(indexWithLifecyclePolicy, getUrlForApp);
-      expect(extension).toBeDefined();
-      const rendered = mountWithIntl(extension);
-      expect(rendered).toMatchSnapshot();
-    });
-
-    test('should return extension when index has lifecycle error', () => {
-      const extension = ilmSummaryExtension(indexWithLifecycleError, getUrlForApp);
-      expect(extension).toBeDefined();
-      const rendered = mountWithIntl(extension);
-      expect(rendered).toMatchSnapshot();
-    });
-  });
-
-  describe('ilm filter extension', () => {
-    test('should return empty array when no indices have index lifecycle policy', () => {
-      const extension = ilmFilterExtension([
-        indexWithoutLifecyclePolicy,
-        indexWithoutLifecyclePolicy,
-      ]);
-      expect(extension.length).toBe(0);
-    });
-
-    test('should return extension when any index has lifecycle policy', () => {
-      const extension = ilmFilterExtension([
-        indexWithLifecyclePolicy,
-        indexWithoutLifecyclePolicy,
-        indexWithoutLifecyclePolicy,
-      ]);
-      expect(extension).toBeDefined();
-      expect(extension).toMatchSnapshot();
-    });
-  });
-});
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/extend_index_management.test.tsx b/x-pack/plugins/index_lifecycle_management/__jest__/extend_index_management.test.tsx
new file mode 100644
index 00000000000000..ca3121bf6b7a6e
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/extend_index_management.test.tsx
@@ -0,0 +1,286 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import moment from 'moment-timezone';
+import axios from 'axios';
+import axiosXhrAdapter from 'axios/lib/adapters/xhr';
+
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { usageCollectionPluginMock } from '../../../../src/plugins/usage_collection/public/mocks';
+import { Index } from '../common/types';
+import {
+  retryLifecycleActionExtension,
+  removeLifecyclePolicyActionExtension,
+  addLifecyclePolicyActionExtension,
+  ilmBannerExtension,
+  ilmFilterExtension,
+  ilmSummaryExtension,
+} from '../public/extend_index_management';
+import { init as initHttp } from '../public/application/services/http';
+import { init as initUiMetric } from '../public/application/services/ui_metric';
+
+// We need to init the http with a mock for any tests that depend upon the http service.
+// For example, add_lifecycle_confirm_modal makes an API request in its componentDidMount
+// lifecycle method. If we don't mock this, CI will fail with "Call retries were exceeded".
+// This expects HttpSetup but we're giving it AxiosInstance.
+// @ts-ignore
+initHttp(axios.create({ adapter: axiosXhrAdapter }));
+initUiMetric(usageCollectionPluginMock.createSetupContract());
+
+jest.mock('../../../plugins/index_management/public', async () => {
+  const { indexManagementMock } = await import('../../../plugins/index_management/public/mocks');
+  return indexManagementMock.createSetup();
+});
+
+const indexWithoutLifecyclePolicy: Index = {
+  health: 'yellow',
+  status: 'open',
+  name: 'noPolicy',
+  uuid: 'BJ-nrZYuSrG-jaofr6SeLg',
+  primary: '1',
+  replica: '1',
+  documents: '1',
+  documents_deleted: '0',
+  size: '3.4kb',
+  primary_size: '3.4kb',
+  aliases: 'none',
+  isFrozen: false,
+  ilm: {
+    index: 'testy1',
+    managed: false,
+  },
+};
+
+const indexWithLifecyclePolicy: Index = {
+  health: 'yellow',
+  status: 'open',
+  name: 'testy3',
+  uuid: 'XL11TLa3Tvq298_dMUzLHQ',
+  primary: '1',
+  replica: '1',
+  documents: '2',
+  documents_deleted: '0',
+  size: '6.5kb',
+  primary_size: '6.5kb',
+  aliases: 'none',
+  isFrozen: false,
+  ilm: {
+    index: 'testy3',
+    managed: true,
+    policy: 'testy',
+    lifecycle_date_millis: 1544020872361,
+    phase: 'new',
+    phase_time_millis: 1544187775867,
+    action: 'complete',
+    action_time_millis: 1544187775867,
+    step: 'complete',
+    step_time_millis: 1544187775867,
+  },
+};
+
+const indexWithLifecycleError = {
+  health: 'yellow',
+  status: 'open',
+  name: 'testy3',
+  uuid: 'XL11TLa3Tvq298_dMUzLHQ',
+  primary: '1',
+  replica: '1',
+  documents: '2',
+  documents_deleted: '0',
+  size: '6.5kb',
+  primary_size: '6.5kb',
+  aliases: 'none',
+  isFrozen: false,
+  ilm: {
+    index: 'testy3',
+    managed: true,
+    policy: 'testy',
+    lifecycle_date_millis: 1544020872361,
+    phase: 'hot',
+    phase_time_millis: 1544187775891,
+    action: 'rollover',
+    action_time_millis: 1544187775891,
+    step: 'ERROR',
+    step_time_millis: 1544187776208,
+    failed_step: 'check-rollover-ready',
+    step_info: {
+      type: 'illegal_argument_exception',
+      reason: 'setting [index.lifecycle.rollover_alias] for index [testy3] is empty or not defined',
+      stack_trace: 'fakestacktrace',
+    },
+    phase_execution: {
+      policy: 'testy',
+      phase_definition: { min_age: '0s', actions: { rollover: { max_size: '1gb' } } },
+      version: 1,
+      modified_date_in_millis: 1544031699844,
+    },
+  },
+};
+
+moment.tz.setDefault('utc');
+
+const getUrlForApp = (appId: string, options: any) => {
+  return appId + '/' + (options ? options.path : '');
+};
+
+const reloadIndices = () => {};
+
+describe('extend index management', () => {
+  describe('retry lifecycle action extension', () => {
+    test('should return null when no indices have index lifecycle policy', () => {
+      const extension = retryLifecycleActionExtension({ indices: [indexWithoutLifecyclePolicy] });
+      expect(extension).toBeNull();
+    });
+
+    test('should return null when no index has lifecycle errors', () => {
+      const extension = retryLifecycleActionExtension({
+        indices: [indexWithLifecyclePolicy, indexWithLifecyclePolicy],
+      });
+      expect(extension).toBeNull();
+    });
+
+    test('should return null when not all indices have lifecycle errors', () => {
+      const extension = retryLifecycleActionExtension({
+        indices: [indexWithLifecyclePolicy, indexWithLifecycleError],
+      });
+      expect(extension).toBeNull();
+    });
+
+    test('should return extension when all indices have lifecycle errors', () => {
+      const extension = retryLifecycleActionExtension({
+        indices: [indexWithLifecycleError, indexWithLifecycleError],
+      });
+      expect(extension).toBeDefined();
+      expect(extension).toMatchSnapshot();
+    });
+  });
+
+  describe('remove lifecycle action extension', () => {
+    test('should return null when no indices have index lifecycle policy', () => {
+      const extension = removeLifecyclePolicyActionExtension({
+        indices: [indexWithoutLifecyclePolicy],
+        reloadIndices,
+      });
+      expect(extension).toBeNull();
+    });
+
+    test('should return null when some indices have index lifecycle policy', () => {
+      const extension = removeLifecyclePolicyActionExtension({
+        indices: [indexWithoutLifecyclePolicy, indexWithLifecyclePolicy],
+        reloadIndices,
+      });
+      expect(extension).toBeNull();
+    });
+
+    test('should return extension when all indices have lifecycle policy', () => {
+      const extension = removeLifecyclePolicyActionExtension({
+        indices: [indexWithLifecycleError, indexWithLifecycleError],
+        reloadIndices,
+      });
+      expect(extension).toBeDefined();
+      expect(extension).toMatchSnapshot();
+    });
+  });
+
+  describe('add lifecycle policy action extension', () => {
+    test('should return null when index has index lifecycle policy', () => {
+      const extension = addLifecyclePolicyActionExtension({
+        indices: [indexWithLifecyclePolicy],
+        reloadIndices,
+        getUrlForApp,
+      });
+      expect(extension).toBeNull();
+    });
+
+    test('should return null when more than one index is passed', () => {
+      const extension = addLifecyclePolicyActionExtension({
+        indices: [indexWithoutLifecyclePolicy, indexWithoutLifecyclePolicy],
+        reloadIndices,
+        getUrlForApp,
+      });
+      expect(extension).toBeNull();
+    });
+
+    test('should return extension when one index is passed and it does not have lifecycle policy', () => {
+      const extension = addLifecyclePolicyActionExtension({
+        indices: [indexWithoutLifecyclePolicy],
+        reloadIndices,
+        getUrlForApp,
+      });
+      expect(extension?.renderConfirmModal).toBeDefined();
+      const component = extension!.renderConfirmModal(jest.fn());
+      const rendered = mountWithIntl(component);
+      expect(rendered.exists('.euiModal--confirmation'));
+    });
+  });
+
+  describe('ilm banner extension', () => {
+    test('should return null when no index has index lifecycle policy', () => {
+      const extension = ilmBannerExtension([
+        indexWithoutLifecyclePolicy,
+        indexWithoutLifecyclePolicy,
+      ]);
+      expect(extension).toBeNull();
+    });
+
+    test('should return null no index has lifecycle error', () => {
+      const extension = ilmBannerExtension([indexWithoutLifecyclePolicy, indexWithLifecyclePolicy]);
+      expect(extension).toBeNull();
+    });
+
+    test('should return extension when any index has lifecycle error', () => {
+      const extension = ilmBannerExtension([
+        indexWithoutLifecyclePolicy,
+        indexWithLifecyclePolicy,
+        indexWithLifecycleError,
+      ]);
+      expect(extension).toBeDefined();
+      expect(extension).toMatchSnapshot();
+    });
+  });
+
+  describe('ilm summary extension', () => {
+    test('should render null when index has no index lifecycle policy', () => {
+      const extension = ilmSummaryExtension(indexWithoutLifecyclePolicy, getUrlForApp);
+      const rendered = mountWithIntl(extension);
+      expect(rendered.isEmptyRender()).toBeTruthy();
+    });
+
+    test('should return extension when index has lifecycle policy', () => {
+      const extension = ilmSummaryExtension(indexWithLifecyclePolicy, getUrlForApp);
+      expect(extension).toBeDefined();
+      const rendered = mountWithIntl(extension);
+      expect(rendered).toMatchSnapshot();
+    });
+
+    test('should return extension when index has lifecycle error', () => {
+      const extension = ilmSummaryExtension(indexWithLifecycleError, getUrlForApp);
+      expect(extension).toBeDefined();
+      const rendered = mountWithIntl(extension);
+      expect(rendered).toMatchSnapshot();
+    });
+  });
+
+  describe('ilm filter extension', () => {
+    test('should return empty array when no indices have index lifecycle policy', () => {
+      const extension = ilmFilterExtension([
+        indexWithoutLifecyclePolicy,
+        indexWithoutLifecyclePolicy,
+      ]);
+      expect(extension.length).toBe(0);
+    });
+
+    test('should return extension when any index has lifecycle policy', () => {
+      const extension = ilmFilterExtension([
+        indexWithLifecyclePolicy,
+        indexWithoutLifecyclePolicy,
+        indexWithoutLifecyclePolicy,
+      ]);
+      expect(extension).toBeDefined();
+      expect(extension).toMatchSnapshot();
+    });
+  });
+});
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/store/actions/index.js b/x-pack/plugins/index_lifecycle_management/common/types/index.ts
similarity index 100%
rename from x-pack/plugins/index_lifecycle_management/public/application/store/actions/index.js
rename to x-pack/plugins/index_lifecycle_management/common/types/index.ts
diff --git a/x-pack/plugins/index_lifecycle_management/common/types/policies.ts b/x-pack/plugins/index_lifecycle_management/common/types/policies.ts
new file mode 100644
index 00000000000000..d88d5b5021a250
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/common/types/policies.ts
@@ -0,0 +1,206 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Index as IndexInterface } from '../../../index_management/common/types';
+
+export interface SerializedPolicy {
+  name: string;
+  phases: Phases;
+}
+
+export interface Phases {
+  hot?: SerializedHotPhase;
+  warm?: SerializedWarmPhase;
+  cold?: SerializedColdPhase;
+  frozen?: SerializedFrozenPhase;
+  delete?: SerializedDeletePhase;
+}
+
+export interface PolicyFromES {
+  modified_date: string;
+  name: string;
+  policy: SerializedPolicy;
+  version: number;
+  linkedIndices?: string[];
+}
+
+export interface SerializedPhase {
+  min_age?: string;
+  actions: {
+    [action: string]: any;
+  };
+}
+
+export interface SerializedHotPhase extends SerializedPhase {
+  actions: {
+    rollover?: {
+      max_size?: string;
+      max_age?: string;
+      max_docs?: number;
+    };
+    set_priority?: {
+      priority: number | null;
+    };
+  };
+}
+
+export interface SerializedWarmPhase extends SerializedPhase {
+  actions: {
+    allocate?: AllocateAction;
+    shrink?: {
+      number_of_shards: number;
+    };
+    forcemerge?: {
+      max_num_segments: number;
+    };
+    set_priority?: {
+      priority: number | null;
+    };
+  };
+}
+
+export interface SerializedColdPhase extends SerializedPhase {
+  actions: {
+    freeze?: {};
+    allocate?: AllocateAction;
+    set_priority?: {
+      priority: number | null;
+    };
+  };
+}
+
+export interface SerializedFrozenPhase extends SerializedPhase {
+  actions: {
+    freeze?: {};
+    allocate?: AllocateAction;
+    set_priority?: {
+      priority: number | null;
+    };
+  };
+}
+
+export interface SerializedDeletePhase extends SerializedPhase {
+  actions: {
+    wait_for_snapshot?: {
+      policy: string;
+    };
+    delete?: {
+      delete_searchable_snapshot: boolean;
+    };
+  };
+}
+
+export interface AllocateAction {
+  number_of_replicas?: number;
+  include: {};
+  exclude: {};
+  require?: {
+    [attribute: string]: string;
+  };
+}
+
+export interface Policy {
+  name: string;
+  phases: {
+    hot: HotPhase;
+    warm: WarmPhase;
+    cold: ColdPhase;
+    frozen: FrozenPhase;
+    delete: DeletePhase;
+  };
+}
+
+export interface CommonPhaseSettings {
+  phaseEnabled: boolean;
+}
+
+export interface PhaseWithMinAge {
+  selectedMinimumAge: string;
+  selectedMinimumAgeUnits: string;
+}
+
+export interface PhaseWithAllocationAction {
+  selectedNodeAttrs: string;
+  selectedReplicaCount: string;
+}
+
+export interface PhaseWithIndexPriority {
+  phaseIndexPriority: string;
+}
+
+export interface HotPhase extends CommonPhaseSettings, PhaseWithIndexPriority {
+  rolloverEnabled: boolean;
+  selectedMaxSizeStored: string;
+  selectedMaxSizeStoredUnits: string;
+  selectedMaxDocuments: string;
+  selectedMaxAge: string;
+  selectedMaxAgeUnits: string;
+}
+
+export interface WarmPhase
+  extends CommonPhaseSettings,
+    PhaseWithMinAge,
+    PhaseWithAllocationAction,
+    PhaseWithIndexPriority {
+  warmPhaseOnRollover: boolean;
+  shrinkEnabled: boolean;
+  selectedPrimaryShardCount: string;
+  forceMergeEnabled: boolean;
+  selectedForceMergeSegments: string;
+}
+
+export interface ColdPhase
+  extends CommonPhaseSettings,
+    PhaseWithMinAge,
+    PhaseWithAllocationAction,
+    PhaseWithIndexPriority {
+  freezeEnabled: boolean;
+}
+
+export interface FrozenPhase
+  extends CommonPhaseSettings,
+    PhaseWithMinAge,
+    PhaseWithAllocationAction,
+    PhaseWithIndexPriority {
+  freezeEnabled: boolean;
+}
+
+export interface DeletePhase extends CommonPhaseSettings, PhaseWithMinAge {
+  waitForSnapshotPolicy: string;
+}
+
+export interface IndexLifecyclePolicy {
+  index: string;
+  managed: boolean;
+  action?: string;
+  action_time_millis?: number;
+  age?: string;
+  failed_step?: string;
+  failed_step_retry_count?: number;
+  is_auto_retryable_error?: boolean;
+  lifecycle_date_millis?: number;
+  phase?: string;
+  phase_execution?: {
+    policy: string;
+    modified_date_in_millis: number;
+    version: number;
+    phase_definition: SerializedPhase;
+  };
+  phase_time_millis?: number;
+  policy?: string;
+  step?: string;
+  step_info?: {
+    reason?: string;
+    stack_trace?: string;
+    type?: string;
+    message?: string;
+  };
+  step_time_millis?: number;
+}
+
+export interface Index extends IndexInterface {
+  ilm: IndexLifecyclePolicy;
+}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts b/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts
index fb626e7d7fe769..4fd74da06f1b35 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts
@@ -11,7 +11,7 @@ import {
   HotPhase,
   WarmPhase,
   FrozenPhase,
-} from '../services/policies/types';
+} from '../../../common/types';
 
 export const defaultNewHotPhase: HotPhase = {
   phaseEnabled: true,
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/index.tsx b/x-pack/plugins/index_lifecycle_management/public/application/index.tsx
index 31a9abdc7145ee..d7812f186a03fc 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/index.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/index.tsx
@@ -6,12 +6,10 @@
 
 import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
-import { Provider } from 'react-redux';
 import { I18nStart, ScopedHistory, ApplicationStart } from 'kibana/public';
 import { UnmountCallback } from 'src/core/public';
 
 import { App } from './app';
-import { indexLifecycleManagementStore } from './store';
 
 export const renderApp = (
   element: Element,
@@ -22,9 +20,7 @@ export const renderApp = (
 ): UnmountCallback => {
   render(
     <I18nContext>
-      <Provider store={indexLifecycleManagementStore()}>
-        <App history={history} navigateToApp={navigateToApp} getUrlForApp={getUrlForApp} />
-      </Provider>
+      <App history={history} navigateToApp={navigateToApp} getUrlForApp={getUrlForApp} />
     </I18nContext>,
     element
   );
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/min_age_input.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/min_age_input.tsx
index 5128ba1c881a0c..d7edbac3d1c54f 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/min_age_input.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/min_age_input.tsx
@@ -12,7 +12,7 @@ import { EuiFieldNumber, EuiFlexGroup, EuiFlexItem, EuiFormRow, EuiSelect } from
 import { LearnMoreLink } from './learn_more_link';
 import { ErrableFormRow } from './form_errors';
 import { PhaseValidationErrors, propertyof } from '../../../services/policies/policy_validation';
-import { PhaseWithMinAge, Phases } from '../../../services/policies/types';
+import { PhaseWithMinAge, Phases } from '../../../../../common/types';
 
 function getTimingLabelForPhase(phase: keyof Phases) {
   // NOTE: Hot phase isn't necessary, because indices begin in the hot phase.
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx
index b4ff62bfb03dcd..6f80afccbff5e6 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx
@@ -20,7 +20,7 @@ import { LearnMoreLink } from './learn_more_link';
 import { ErrableFormRow } from './form_errors';
 import { useLoadNodes } from '../../../services/api';
 import { NodeAttrsDetails } from './node_attrs_details';
-import { PhaseWithAllocationAction, Phases } from '../../../services/policies/types';
+import { PhaseWithAllocationAction, Phases } from '../../../../../common/types';
 import { PhaseValidationErrors, propertyof } from '../../../services/policies/policy_validation';
 
 const learnMoreLink = (
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/policy_json_flyout.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/policy_json_flyout.tsx
index 2f246f21aaf2ef..98d2409ffea6d5 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/policy_json_flyout.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/policy_json_flyout.tsx
@@ -18,7 +18,7 @@ import {
   EuiText,
   EuiTitle,
 } from '@elastic/eui';
-import { Policy, PolicyFromES } from '../../../services/policies/types';
+import { Policy, PolicyFromES } from '../../../../../common/types';
 import { serializePolicy } from '../../../services/policies/policy_serialization';
 
 interface Props {
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/set_priority_input.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/set_priority_input.tsx
index 1505532a2b16e7..7f839fc94918b6 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/set_priority_input.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/set_priority_input.tsx
@@ -10,7 +10,7 @@ import { EuiFieldNumber, EuiTextColor, EuiDescribedFormGroup } from '@elastic/eu
 import { LearnMoreLink } from './';
 import { OptionalLabel } from './';
 import { ErrableFormRow } from './';
-import { PhaseWithIndexPriority, Phases } from '../../../services/policies/types';
+import { PhaseWithIndexPriority, Phases } from '../../../../../common/types';
 import { PhaseValidationErrors, propertyof } from '../../../services/policies/policy_validation';
 
 interface Props<T extends PhaseWithIndexPriority> {
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.container.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.container.tsx
index 359134e015f7f2..f4697693b86c6f 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.container.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.container.tsx
@@ -6,7 +6,7 @@
 
 import React from 'react';
 import { RouteComponentProps } from 'react-router-dom';
-import { EuiButton, EuiCallOut, EuiEmptyPrompt, EuiLoadingSpinner } from '@elastic/eui';
+import { EuiButton, EuiEmptyPrompt, EuiLoadingSpinner } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { useLoadPoliciesList } from '../../services/api';
 
@@ -50,25 +50,29 @@ export const EditPolicy: React.FunctionComponent<Props & RouteComponentProps<Rou
   if (error || !policies) {
     const { statusCode, message } = error ? error : { statusCode: '', message: '' };
     return (
-      <EuiCallOut
+      <EuiEmptyPrompt
         title={
-          <FormattedMessage
-            id="xpack.indexLifecycleMgmt.editPolicy.lifecyclePoliciesLoadingFailedTitle"
-            defaultMessage="Unable to load existing lifecycle policies"
-          />
+          <h2>
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.editPolicy.lifecyclePoliciesLoadingFailedTitle"
+              defaultMessage="Unable to load existing lifecycle policies"
+            />
+          </h2>
         }
-        color="danger"
-      >
-        <p>
-          {message} ({statusCode})
-        </p>
-        <EuiButton onClick={sendRequest} iconType="refresh" color="danger">
-          <FormattedMessage
-            id="xpack.indexLifecycleMgmt.editPolicy.lifecyclePoliciesReloadButton"
-            defaultMessage="Try again"
-          />
-        </EuiButton>
-      </EuiCallOut>
+        body={
+          <p>
+            {message} ({statusCode})
+          </p>
+        }
+        actions={
+          <EuiButton onClick={sendRequest} iconType="refresh" color="danger">
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.editPolicy.lifecyclePoliciesReloadButton"
+              defaultMessage="Try again"
+            />
+          </EuiButton>
+        }
+      />
     );
   }
 
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.tsx
index db58c64a8ae8cd..f1c287788e08da 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.tsx
@@ -5,7 +5,9 @@
  */
 
 import React, { Fragment, useEffect, useState } from 'react';
+import { RouteComponentProps } from 'react-router-dom';
 import { FormattedMessage } from '@kbn/i18n/react';
+
 import { i18n } from '@kbn/i18n';
 
 import {
@@ -25,10 +27,9 @@ import {
   EuiText,
   EuiTitle,
 } from '@elastic/eui';
-
 import { toasts } from '../../services/notification';
 
-import { Phases, Policy, PolicyFromES } from '../../services/policies/types';
+import { Phases, Policy, PolicyFromES } from '../../../../common/types';
 import {
   validatePolicy,
   ValidationErrors,
@@ -54,7 +55,7 @@ interface Props {
       absolute?: boolean;
     }
   ) => string;
-  history: any;
+  history: RouteComponentProps['history'];
 }
 export const EditPolicy: React.FunctionComponent<Props> = ({
   policies,
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/cold_phase.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/cold_phase.tsx
index 9df6da7a88b2f8..ae2858e7a84aeb 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/cold_phase.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/cold_phase.tsx
@@ -18,7 +18,7 @@ import {
   EuiTextColor,
 } from '@elastic/eui';
 
-import { ColdPhase as ColdPhaseInterface, Phases } from '../../../services/policies/types';
+import { ColdPhase as ColdPhaseInterface, Phases } from '../../../../../common/types';
 import { PhaseValidationErrors } from '../../../services/policies/policy_validation';
 
 import {
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/delete_phase.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/delete_phase.tsx
index eab93777a72bde..11adebdd094bf4 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/delete_phase.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/delete_phase.tsx
@@ -8,7 +8,7 @@ import React, { PureComponent, Fragment } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiDescribedFormGroup, EuiSwitch, EuiTextColor, EuiFormRow } from '@elastic/eui';
 
-import { DeletePhase as DeletePhaseInterface, Phases } from '../../../services/policies/types';
+import { DeletePhase as DeletePhaseInterface, Phases } from '../../../../../common/types';
 import { PhaseValidationErrors } from '../../../services/policies/policy_validation';
 
 import {
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/frozen_phase.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/frozen_phase.tsx
index 782906a56a9baf..bfaf1414381696 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/frozen_phase.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/frozen_phase.tsx
@@ -18,7 +18,7 @@ import {
   EuiTextColor,
 } from '@elastic/eui';
 
-import { FrozenPhase as FrozenPhaseInterface, Phases } from '../../../services/policies/types';
+import { FrozenPhase as FrozenPhaseInterface, Phases } from '../../../../../common/types';
 import { PhaseValidationErrors } from '../../../services/policies/policy_validation';
 
 import {
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/hot_phase.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/hot_phase.tsx
index 106e3b9139a9b1..59949ad93fa5d4 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/hot_phase.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/hot_phase.tsx
@@ -18,7 +18,7 @@ import {
   EuiDescribedFormGroup,
 } from '@elastic/eui';
 
-import { HotPhase as HotPhaseInterface, Phases } from '../../../services/policies/types';
+import { HotPhase as HotPhaseInterface, Phases } from '../../../../../common/types';
 import { PhaseValidationErrors } from '../../../services/policies/policy_validation';
 
 import {
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx
index 2733d01ac222d3..71286475bcfe95 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx
@@ -18,6 +18,8 @@ import {
   EuiDescribedFormGroup,
 } from '@elastic/eui';
 
+import { Phases, WarmPhase as WarmPhaseInterface } from '../../../../../common/types';
+import { PhaseValidationErrors } from '../../../services/policies/policy_validation';
 import {
   LearnMoreLink,
   ActiveBadge,
@@ -29,9 +31,6 @@ import {
   MinAgeInput,
 } from '../components';
 
-import { Phases, WarmPhase as WarmPhaseInterface } from '../../../services/policies/types';
-import { PhaseValidationErrors } from '../../../services/policies/policy_validation';
-
 const shrinkLabel = i18n.translate('xpack.indexLifecycleMgmt.warmPhase.shrinkIndexLabel', {
   defaultMessage: 'Shrink index',
 });
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/add_policy_to_template_confirm_modal.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/add_policy_to_template_confirm_modal.tsx
new file mode 100644
index 00000000000000..265d5146b2c37c
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/add_policy_to_template_confirm_modal.tsx
@@ -0,0 +1,243 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { Component, Fragment } from 'react';
+import { get, find } from 'lodash';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiCallOut,
+  EuiSelect,
+  EuiForm,
+  EuiFormRow,
+  EuiOverlayMask,
+  EuiConfirmModal,
+  EuiFieldText,
+  EuiSpacer,
+  EuiText,
+} from '@elastic/eui';
+
+import { PolicyFromES } from '../../../../../common/types';
+import { LearnMoreLink } from '../../edit_policy/components';
+import { addLifecyclePolicyToTemplate, loadIndexTemplates } from '../../../services/api';
+import { toasts } from '../../../services/notification';
+import { showApiError } from '../../../services/api_errors';
+
+interface Props {
+  policy: PolicyFromES;
+  onCancel: () => void;
+}
+interface State {
+  templates: Array<{ name: string }>;
+  templateName?: string;
+  aliasName?: string;
+  templateError?: string;
+}
+export class AddPolicyToTemplateConfirmModal extends Component<Props, State> {
+  constructor(props: Props) {
+    super(props);
+    this.state = {
+      templates: [],
+    };
+  }
+  async componentDidMount() {
+    const templates = await loadIndexTemplates();
+    this.setState({ templates });
+  }
+  addPolicyToTemplate = async () => {
+    const { policy, onCancel } = this.props;
+    const { templateName, aliasName } = this.state;
+    const policyName = policy.name;
+    if (!templateName) {
+      this.setState({
+        templateError: i18n.translate(
+          'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.noTemplateSelectedErrorMessage',
+          { defaultMessage: 'You must select an index template.' }
+        ),
+      });
+      return;
+    }
+    try {
+      await addLifecyclePolicyToTemplate({
+        policyName,
+        templateName,
+        aliasName,
+      });
+      const message = i18n.translate(
+        'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.successMessage',
+        {
+          defaultMessage: 'Added policy {policyName} to index template {templateName}',
+          values: { policyName, templateName },
+        }
+      );
+      toasts.addSuccess(message);
+      onCancel();
+    } catch (e) {
+      const title = i18n.translate(
+        'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.errorMessage',
+        {
+          defaultMessage: 'Error adding policy "{policyName}" to index template {templateName}',
+          values: { policyName, templateName },
+        }
+      );
+      showApiError(e, title);
+    }
+  };
+  renderTemplateHasPolicyWarning() {
+    const selectedTemplate = this.getSelectedTemplate();
+    const existingPolicyName = get(selectedTemplate, 'settings.index.lifecycle.name');
+    if (!existingPolicyName) {
+      return;
+    }
+    return (
+      <Fragment>
+        <EuiCallOut
+          style={{ maxWidth: 400 }}
+          title={
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.templateHasPolicyWarningTitle"
+              defaultMessage="Template already has policy"
+            />
+          }
+          color="warning"
+        >
+          <FormattedMessage
+            id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyToTemplateConfirmModal.indexHasNoAliasesWarningMessage"
+            defaultMessage="This index template already has the policy {existingPolicyName} attached to it.
+            Adding this policy will overwrite that configuration."
+            values={{
+              existingPolicyName,
+            }}
+          />
+        </EuiCallOut>
+        <EuiSpacer size="s" />
+      </Fragment>
+    );
+  }
+  getSelectedTemplate() {
+    const { templates, templateName } = this.state;
+    return find(templates, (template) => template.name === templateName);
+  }
+  renderForm() {
+    const { templates, templateName, templateError } = this.state;
+    const options = templates.map(({ name }) => {
+      return {
+        value: name,
+        text: name,
+      };
+    });
+    options.unshift({
+      value: '',
+      text: i18n.translate(
+        'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.chooseTemplateMessage',
+        {
+          defaultMessage: 'Select an index template',
+        }
+      ),
+    });
+    return (
+      <EuiForm>
+        {this.renderTemplateHasPolicyWarning()}
+        <EuiFormRow
+          isInvalid={!!templateError}
+          error={templateError}
+          label={
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.chooseTemplateLabel"
+              defaultMessage="Index template"
+            />
+          }
+        >
+          <EuiSelect
+            options={options}
+            value={templateName}
+            onChange={(e) => {
+              this.setState({ templateError: undefined, templateName: e.target.value });
+            }}
+          />
+        </EuiFormRow>
+        {this.renderAliasFormElement()}
+      </EuiForm>
+    );
+  }
+  renderAliasFormElement = () => {
+    const { aliasName } = this.state;
+    const { policy } = this.props;
+    const showAliasTextInput = policy && get(policy, 'policy.phases.hot.actions.rollover');
+    if (!showAliasTextInput) {
+      return null;
+    }
+    return (
+      <EuiFormRow
+        label={
+          <FormattedMessage
+            id="xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.rolloverAliasLabel"
+            defaultMessage="Alias for rollover index"
+          />
+        }
+      >
+        <EuiFieldText
+          value={aliasName}
+          onChange={(e) => {
+            this.setState({ aliasName: e.target.value });
+          }}
+        />
+      </EuiFormRow>
+    );
+  };
+  render() {
+    const { policy, onCancel } = this.props;
+    const title = i18n.translate(
+      'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.title',
+      {
+        defaultMessage: 'Add policy "{name}" to index template',
+        values: { name: policy.name },
+      }
+    );
+    return (
+      <EuiOverlayMask>
+        <EuiConfirmModal
+          title={title}
+          onCancel={onCancel}
+          onConfirm={this.addPolicyToTemplate}
+          cancelButtonText={i18n.translate(
+            'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.cancelButton',
+            {
+              defaultMessage: 'Cancel',
+            }
+          )}
+          confirmButtonText={i18n.translate(
+            'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.confirmButton',
+            {
+              defaultMessage: 'Add policy',
+            }
+          )}
+        >
+          <EuiText>
+            <p>
+              <FormattedMessage
+                id="xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.explanationText"
+                defaultMessage="This will apply the lifecycle policy to
+                  all indices which match the index template."
+              />{' '}
+              <LearnMoreLink
+                docPath="indices-templates.html"
+                text={
+                  <FormattedMessage
+                    id="xpack.indexLifecycleMgmt.editPolicy.learnAboutIndexTemplatesLink"
+                    defaultMessage="Learn about index templates"
+                  />
+                }
+              />
+            </p>
+          </EuiText>
+          <EuiSpacer size="m" />
+          {this.renderForm()}
+        </EuiConfirmModal>
+      </EuiOverlayMask>
+    );
+  }
+}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/confirm_delete.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/confirm_delete.tsx
new file mode 100644
index 00000000000000..59e213fae846b2
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/confirm_delete.tsx
@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { Component } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiOverlayMask, EuiConfirmModal } from '@elastic/eui';
+
+import { PolicyFromES } from '../../../../../common/types';
+import { toasts } from '../../../services/notification';
+import { showApiError } from '../../../services/api_errors';
+import { deletePolicy } from '../../../services/api';
+
+interface Props {
+  policyToDelete: PolicyFromES;
+  callback: () => void;
+  onCancel: () => void;
+}
+export class ConfirmDelete extends Component<Props> {
+  deletePolicy = async () => {
+    const { policyToDelete, callback } = this.props;
+    const policyName = policyToDelete.name;
+
+    try {
+      await deletePolicy(policyName);
+      const message = i18n.translate('xpack.indexLifecycleMgmt.confirmDelete.successMessage', {
+        defaultMessage: 'Deleted policy {policyName}',
+        values: { policyName },
+      });
+      toasts.addSuccess(message);
+    } catch (e) {
+      const title = i18n.translate('xpack.indexLifecycleMgmt.confirmDelete.errorMessage', {
+        defaultMessage: 'Error deleting policy {policyName}',
+        values: { policyName },
+      });
+      showApiError(e, title);
+    }
+    if (callback) {
+      callback();
+    }
+  };
+  render() {
+    const { policyToDelete, onCancel } = this.props;
+    const title = i18n.translate('xpack.indexLifecycleMgmt.confirmDelete.title', {
+      defaultMessage: 'Delete policy "{name}"',
+      values: { name: policyToDelete.name },
+    });
+    return (
+      <EuiOverlayMask>
+        <EuiConfirmModal
+          title={title}
+          onCancel={onCancel}
+          onConfirm={this.deletePolicy}
+          cancelButtonText={
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.confirmDelete.cancelButton"
+              defaultMessage="Cancel"
+            />
+          }
+          confirmButtonText={
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.confirmDelete.deleteButton"
+              defaultMessage="Delete"
+            />
+          }
+          buttonColor="danger"
+        >
+          <div>
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.confirmDelete.undoneWarning"
+              defaultMessage="You can't recover a deleted policy."
+            />
+          </div>
+        </EuiConfirmModal>
+      </EuiOverlayMask>
+    );
+  }
+}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/no_match/components/no_match/index.js b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/no_match/components/no_match/index.js
deleted file mode 100644
index 2cdbc4a7094a89..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/no_match/components/no_match/index.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export { NoMatch } from './no_match';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/no_match/components/no_match/no_match.js b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/no_match/components/no_match/no_match.js
deleted file mode 100644
index 45eaaab8a82ae4..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/no_match/components/no_match/no_match.js
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { FormattedMessage } from '@kbn/i18n/react';
-
-export const NoMatch = () => (
-  <div>
-    <FormattedMessage
-      id="xpack.indexLifecycleMgmt.noMatch.noPolicicesDescription"
-      defaultMessage="No policies to show"
-    />
-  </div>
-);
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/no_match/index.js b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/no_match/index.js
deleted file mode 100644
index 63e8cdebd97716..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/no_match/index.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export { NoMatch } from './components/no_match';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/add_policy_to_template_confirm_modal.js b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/add_policy_to_template_confirm_modal.js
deleted file mode 100644
index 47134ad0977209..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/add_policy_to_template_confirm_modal.js
+++ /dev/null
@@ -1,233 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { Component, Fragment } from 'react';
-import { get, find } from 'lodash';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import {
-  EuiCallOut,
-  EuiSelect,
-  EuiForm,
-  EuiFormRow,
-  EuiOverlayMask,
-  EuiConfirmModal,
-  EuiFieldText,
-  EuiSpacer,
-  EuiText,
-} from '@elastic/eui';
-
-import { toasts } from '../../../../services/notification';
-import { addLifecyclePolicyToTemplate, loadIndexTemplates } from '../../../../services/api';
-import { showApiError } from '../../../../services/api_errors';
-import { LearnMoreLink } from '../../../edit_policy/components';
-
-export class AddPolicyToTemplateConfirmModal extends Component {
-  state = {
-    templates: [],
-  };
-  async componentDidMount() {
-    const templates = await loadIndexTemplates();
-    this.setState({ templates });
-  }
-  addPolicyToTemplate = async () => {
-    const { policy, callback, onCancel } = this.props;
-    const { templateName, aliasName } = this.state;
-    const policyName = policy.name;
-    if (!templateName) {
-      this.setState({
-        templateError: i18n.translate(
-          'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.noTemplateSelectedErrorMessage',
-          { defaultMessage: 'You must select an index template.' }
-        ),
-      });
-      return;
-    }
-    try {
-      await addLifecyclePolicyToTemplate({
-        policyName,
-        templateName,
-        aliasName,
-      });
-      const message = i18n.translate(
-        'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.successMessage',
-        {
-          defaultMessage: 'Added policy {policyName} to index template {templateName}',
-          values: { policyName, templateName },
-        }
-      );
-      toasts.addSuccess(message);
-      onCancel();
-    } catch (e) {
-      const title = i18n.translate(
-        'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.errorMessage',
-        {
-          defaultMessage: 'Error adding policy "{policyName}" to index template {templateName}',
-          values: { policyName, templateName },
-        }
-      );
-      showApiError(e, title);
-    }
-    if (callback) {
-      callback();
-    }
-  };
-  renderTemplateHasPolicyWarning() {
-    const selectedTemplate = this.getSelectedTemplate();
-    const existingPolicyName = get(selectedTemplate, 'settings.index.lifecycle.name');
-    if (!existingPolicyName) {
-      return;
-    }
-    return (
-      <Fragment>
-        <EuiCallOut
-          style={{ maxWidth: 400 }}
-          title={
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.templateHasPolicyWarningTitle"
-              defaultMessage="Template already has policy"
-            />
-          }
-          color="warning"
-        >
-          <FormattedMessage
-            id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyToTemplateConfirmModal.indexHasNoAliasesWarningMessage"
-            defaultMessage="This index template already has the policy {existingPolicyName} attached to it.
-            Adding this policy will overwrite that configuration."
-            values={{
-              existingPolicyName,
-            }}
-          />
-        </EuiCallOut>
-        <EuiSpacer size="s" />
-      </Fragment>
-    );
-  }
-  getSelectedTemplate() {
-    const { templates, templateName } = this.state;
-    return find(templates, (template) => template.name === templateName);
-  }
-  renderForm() {
-    const { templates, templateName, templateError } = this.state;
-    const options = templates.map(({ name }) => {
-      return {
-        value: name,
-        text: name,
-      };
-    });
-    options.unshift({
-      value: '',
-      text: i18n.translate(
-        'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.chooseTemplateMessage',
-        {
-          defaultMessage: 'Select an index template',
-        }
-      ),
-    });
-    return (
-      <EuiForm>
-        {this.renderTemplateHasPolicyWarning()}
-        <EuiFormRow
-          isInvalid={!!templateError}
-          error={templateError}
-          label={
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.chooseTemplateLabel"
-              defaultMessage="Index template"
-            />
-          }
-        >
-          <EuiSelect
-            options={options}
-            value={templateName}
-            onChange={(e) => {
-              this.setState({ templateError: null, templateName: e.target.value });
-            }}
-          />
-        </EuiFormRow>
-        {this.renderAliasFormElement()}
-      </EuiForm>
-    );
-  }
-  renderAliasFormElement = () => {
-    const { aliasName } = this.state;
-    const { policy } = this.props;
-    const showAliasTextInput = policy && get(policy, 'policy.phases.hot.actions.rollover');
-    if (!showAliasTextInput) {
-      return null;
-    }
-    return (
-      <EuiFormRow
-        label={
-          <FormattedMessage
-            id="xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.rolloverAliasLabel"
-            defaultMessage="Alias for rollover index"
-          />
-        }
-      >
-        <EuiFieldText
-          value={aliasName}
-          onChange={(e) => {
-            this.setState({ aliasName: e.target.value });
-          }}
-        />
-      </EuiFormRow>
-    );
-  };
-  render() {
-    const { policy, onCancel } = this.props;
-    const title = i18n.translate(
-      'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.title',
-      {
-        defaultMessage: 'Add policy "{name}" to index template',
-        values: { name: policy.name },
-      }
-    );
-    return (
-      <EuiOverlayMask>
-        <EuiConfirmModal
-          title={title}
-          onCancel={onCancel}
-          onConfirm={this.addPolicyToTemplate}
-          cancelButtonText={i18n.translate(
-            'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.cancelButton',
-            {
-              defaultMessage: 'Cancel',
-            }
-          )}
-          confirmButtonText={i18n.translate(
-            'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.confirmButton',
-            {
-              defaultMessage: 'Add policy',
-            }
-          )}
-          onClose={onCancel}
-        >
-          <EuiText>
-            <p>
-              <FormattedMessage
-                id="xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.explanationText"
-                defaultMessage="This will apply the lifecycle policy to
-                  all indices which match the index template."
-              />{' '}
-              <LearnMoreLink
-                docPath="indices-templates.html"
-                text={
-                  <FormattedMessage
-                    id="xpack.indexLifecycleMgmt.editPolicy.learnAboutIndexTemplatesLink"
-                    defaultMessage="Learn about index templates"
-                  />
-                }
-              />
-            </p>
-          </EuiText>
-          <EuiSpacer size="m" />
-          {this.renderForm()}
-        </EuiConfirmModal>
-      </EuiOverlayMask>
-    );
-  }
-}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/confirm_delete.js b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/confirm_delete.js
deleted file mode 100644
index 0ecc9cc13ecd0a..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/confirm_delete.js
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { Component } from 'react';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { EuiOverlayMask, EuiConfirmModal } from '@elastic/eui';
-
-import { toasts } from '../../../../services/notification';
-import { deletePolicy } from '../../../../services/api';
-import { showApiError } from '../../../../services/api_errors';
-
-export class ConfirmDelete extends Component {
-  deletePolicy = async () => {
-    const { policyToDelete, callback } = this.props;
-    const policyName = policyToDelete.name;
-
-    try {
-      await deletePolicy(policyName);
-      const message = i18n.translate('xpack.indexLifecycleMgmt.confirmDelete.successMessage', {
-        defaultMessage: 'Deleted policy {policyName}',
-        values: { policyName },
-      });
-      toasts.addSuccess(message);
-    } catch (e) {
-      const title = i18n.translate('xpack.indexLifecycleMgmt.confirmDelete.errorMessage', {
-        defaultMessage: 'Error deleting policy {policyName}',
-        values: { policyName },
-      });
-      showApiError(e, title);
-    }
-    if (callback) {
-      callback();
-    }
-  };
-  render() {
-    const { policyToDelete, onCancel } = this.props;
-    const title = i18n.translate('xpack.indexLifecycleMgmt.confirmDelete.title', {
-      defaultMessage: 'Delete policy "{name}"',
-      values: { name: policyToDelete.name },
-    });
-    return (
-      <EuiOverlayMask>
-        <EuiConfirmModal
-          title={title}
-          onCancel={onCancel}
-          onConfirm={this.deletePolicy}
-          cancelButtonText={
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.confirmDelete.cancelButton"
-              defaultMessage="Cancel"
-            />
-          }
-          confirmButtonText={
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.confirmDelete.deleteButton"
-              defaultMessage="Delete"
-            />
-          }
-          buttonColor="danger"
-          onClose={onCancel}
-        >
-          <div>
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.confirmDelete.undoneWarning"
-              defaultMessage="You can't recover a deleted policy."
-            />
-          </div>
-        </EuiConfirmModal>
-      </EuiOverlayMask>
-    );
-  }
-}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/policy_table.container.js b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/policy_table.container.js
deleted file mode 100644
index 8bd78774d2d55a..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/policy_table.container.js
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { connect } from 'react-redux';
-
-import {
-  fetchPolicies,
-  policyFilterChanged,
-  policyPageChanged,
-  policyPageSizeChanged,
-  policySortChanged,
-} from '../../../../store/actions';
-
-import {
-  getPolicies,
-  getPageOfPolicies,
-  getPolicyPager,
-  getPolicyFilter,
-  getPolicySort,
-  isPolicyListLoaded,
-} from '../../../../store/selectors';
-
-import { PolicyTable as PresentationComponent } from './policy_table';
-
-const mapDispatchToProps = (dispatch) => {
-  return {
-    policyFilterChanged: (filter) => {
-      dispatch(policyFilterChanged({ filter }));
-    },
-    policyPageChanged: (pageNumber) => {
-      dispatch(policyPageChanged({ pageNumber }));
-    },
-    policyPageSizeChanged: (pageSize) => {
-      dispatch(policyPageSizeChanged({ pageSize }));
-    },
-    policySortChanged: (sortField, isSortAscending) => {
-      dispatch(policySortChanged({ sortField, isSortAscending }));
-    },
-    fetchPolicies: (withIndices) => {
-      dispatch(fetchPolicies(withIndices));
-    },
-  };
-};
-
-export const PolicyTable = connect(
-  (state) => ({
-    totalNumberOfPolicies: getPolicies(state).length,
-    policies: getPageOfPolicies(state),
-    pager: getPolicyPager(state),
-    filter: getPolicyFilter(state),
-    sortField: getPolicySort(state).sortField,
-    isSortAscending: getPolicySort(state).isSortAscending,
-    policyListLoaded: isPolicyListLoaded(state),
-  }),
-  mapDispatchToProps
-)(PresentationComponent);
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/policy_table.js b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/policy_table.js
deleted file mode 100644
index ec1cdb987f4b32..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/policy_table.js
+++ /dev/null
@@ -1,530 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { Component, Fragment } from 'react';
-import moment from 'moment-timezone';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-
-import {
-  EuiButton,
-  EuiButtonEmpty,
-  EuiLink,
-  EuiEmptyPrompt,
-  EuiFieldSearch,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiLoadingSpinner,
-  EuiPopover,
-  EuiContextMenu,
-  EuiSpacer,
-  EuiTable,
-  EuiTableBody,
-  EuiTableHeader,
-  EuiTableHeaderCell,
-  EuiTablePagination,
-  EuiTableRow,
-  EuiTableRowCell,
-  EuiTitle,
-  EuiText,
-  EuiPageBody,
-  EuiPageContent,
-  EuiScreenReaderOnly,
-} from '@elastic/eui';
-
-import { RIGHT_ALIGNMENT } from '@elastic/eui/lib/services';
-import { reactRouterNavigate } from '../../../../../../../../../src/plugins/kibana_react/public';
-import { getIndexListUri } from '../../../../../../../index_management/public';
-import { UIM_EDIT_CLICK } from '../../../../constants/ui_metric';
-import { getPolicyPath } from '../../../../services/navigation';
-import { flattenPanelTree } from '../../../../services/flatten_panel_tree';
-import { trackUiMetric } from '../../../../services/ui_metric';
-import { NoMatch } from '../no_match';
-import { ConfirmDelete } from './confirm_delete';
-import { AddPolicyToTemplateConfirmModal } from './add_policy_to_template_confirm_modal';
-
-const COLUMNS = {
-  name: {
-    label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.nameHeader', {
-      defaultMessage: 'Name',
-    }),
-    width: 200,
-  },
-  linkedIndices: {
-    label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.linkedIndicesHeader', {
-      defaultMessage: 'Linked indices',
-    }),
-    width: 120,
-  },
-  version: {
-    label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.versionHeader', {
-      defaultMessage: 'Version',
-    }),
-    width: 120,
-  },
-  modified_date: {
-    label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.modifiedDateHeader', {
-      defaultMessage: 'Modified date',
-    }),
-    width: 200,
-  },
-};
-
-export class PolicyTable extends Component {
-  constructor(props) {
-    super(props);
-
-    this.state = {
-      selectedPoliciesMap: {},
-      renderConfirmModal: null,
-    };
-  }
-  componentDidMount() {
-    this.props.fetchPolicies(true);
-  }
-  renderEmpty() {
-    return (
-      <EuiEmptyPrompt
-        iconType="managementApp"
-        title={
-          <h1>
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.policyTable.emptyPromptTitle"
-              defaultMessage="Create your first index lifecycle policy"
-            />
-          </h1>
-        }
-        body={
-          <Fragment>
-            <p>
-              <FormattedMessage
-                id="xpack.indexLifecycleMgmt.policyTable.emptyPromptDescription"
-                defaultMessage=" An index lifecycle policy helps you manage your indices as they age."
-              />
-            </p>
-          </Fragment>
-        }
-        actions={this.renderCreatePolicyButton()}
-      />
-    );
-  }
-  renderDeleteConfirmModal = () => {
-    const { policyToDelete } = this.state;
-    if (!policyToDelete) {
-      return null;
-    }
-    return (
-      <ConfirmDelete
-        policyToDelete={policyToDelete}
-        callback={this.handleDelete}
-        onCancel={() => this.setState({ renderConfirmModal: null, policyToDelete: null })}
-      />
-    );
-  };
-  renderAddPolicyToTemplateConfirmModal = () => {
-    const { policyToAddToTemplate } = this.state;
-    if (!policyToAddToTemplate) {
-      return null;
-    }
-    return (
-      <AddPolicyToTemplateConfirmModal
-        policy={policyToAddToTemplate}
-        onCancel={() => this.setState({ renderConfirmModal: null, policyToAddToTemplate: null })}
-      />
-    );
-  };
-  handleDelete = () => {
-    this.props.fetchPolicies(true);
-    this.setState({ renderDeleteConfirmModal: null, policyToDelete: null });
-  };
-  onSort = (column) => {
-    const { sortField, isSortAscending, policySortChanged } = this.props;
-    const newIsSortAscending = sortField === column ? !isSortAscending : true;
-    policySortChanged(column, newIsSortAscending);
-  };
-
-  buildHeader() {
-    const { sortField, isSortAscending } = this.props;
-    const headers = Object.entries(COLUMNS).map(([fieldName, { label, width }]) => {
-      const isSorted = sortField === fieldName;
-      return (
-        <EuiTableHeaderCell
-          key={fieldName}
-          onSort={() => this.onSort(fieldName)}
-          isSorted={isSorted}
-          isSortAscending={isSortAscending}
-          data-test-subj={`policyTableHeaderCell-${fieldName}`}
-          className={'policyTable__header--' + fieldName}
-          width={width}
-        >
-          {label}
-        </EuiTableHeaderCell>
-      );
-    });
-    headers.push(
-      <EuiTableHeaderCell
-        key="deleteHeader"
-        data-test-subj="policyTableHeaderCell-delete"
-        width={150}
-      />
-    );
-    return headers;
-  }
-
-  buildRowCell(fieldName, value) {
-    if (fieldName === 'name') {
-      return (
-        /* eslint-disable-next-line @elastic/eui/href-or-on-click */
-        <EuiLink
-          data-test-subj="policyTablePolicyNameLink"
-          {...reactRouterNavigate(this.props.history, getPolicyPath(value), () =>
-            trackUiMetric('click', UIM_EDIT_CLICK)
-          )}
-        >
-          {value}
-        </EuiLink>
-      );
-    } else if (fieldName === 'linkedIndices') {
-      return (
-        <EuiText>
-          <b>{value ? value.length : '0'}</b>
-        </EuiText>
-      );
-    } else if (fieldName === 'modified_date' && value) {
-      return moment(value).format('YYYY-MM-DD HH:mm:ss');
-    }
-    return value;
-  }
-  renderCreatePolicyButton() {
-    return (
-      <EuiButton
-        {...reactRouterNavigate(this.props.history, '/policies/edit')}
-        fill
-        iconType="plusInCircle"
-        data-test-subj="createPolicyButton"
-      >
-        <FormattedMessage
-          id="xpack.indexLifecycleMgmt.policyTable.emptyPrompt.createButtonLabel"
-          defaultMessage="Create policy"
-        />
-      </EuiButton>
-    );
-  }
-  renderConfirmModal() {
-    const { renderConfirmModal } = this.state;
-    if (renderConfirmModal) {
-      return renderConfirmModal();
-    } else {
-      return null;
-    }
-  }
-  buildActionPanelTree(policy) {
-    const hasLinkedIndices = Boolean(policy.linkedIndices && policy.linkedIndices.length);
-
-    const viewIndicesLabel = i18n.translate(
-      'xpack.indexLifecycleMgmt.policyTable.viewIndicesButtonText',
-      {
-        defaultMessage: 'View indices linked to policy',
-      }
-    );
-    const addPolicyToTemplateLabel = i18n.translate(
-      'xpack.indexLifecycleMgmt.policyTable.addPolicyToTemplateButtonText',
-      {
-        defaultMessage: 'Add policy to index template',
-      }
-    );
-    const deletePolicyLabel = i18n.translate(
-      'xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonText',
-      {
-        defaultMessage: 'Delete policy',
-      }
-    );
-    const deletePolicyTooltip = hasLinkedIndices
-      ? i18n.translate('xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonDisabledTooltip', {
-          defaultMessage: 'You cannot delete a policy that is being used by an index',
-        })
-      : null;
-    const items = [];
-    if (hasLinkedIndices) {
-      items.push({
-        name: viewIndicesLabel,
-        icon: 'list',
-        onClick: () => {
-          this.props.navigateToApp('management', {
-            path: `/data/index_management${getIndexListUri(`ilm.policy:${policy.name}`, true)}`,
-          });
-        },
-      });
-    }
-    items.push({
-      name: addPolicyToTemplateLabel,
-      icon: 'plusInCircle',
-      onClick: () =>
-        this.setState({
-          renderConfirmModal: this.renderAddPolicyToTemplateConfirmModal,
-          policyToAddToTemplate: policy,
-        }),
-    });
-    items.push({
-      name: deletePolicyLabel,
-      disabled: hasLinkedIndices,
-      icon: 'trash',
-      toolTipContent: deletePolicyTooltip,
-      onClick: () =>
-        this.setState({
-          renderConfirmModal: this.renderDeleteConfirmModal,
-          policyToDelete: policy,
-        }),
-    });
-    const panelTree = {
-      id: 0,
-      title: i18n.translate('xpack.indexLifecycleMgmt.policyTable.policyActionsMenu.panelTitle', {
-        defaultMessage: 'Policy options',
-      }),
-      items,
-    };
-    return flattenPanelTree(panelTree);
-  }
-  togglePolicyPopover = (policy) => {
-    if (this.isPolicyPopoverOpen(policy)) {
-      this.closePolicyPopover(policy);
-    } else {
-      this.openPolicyPopover(policy);
-    }
-  };
-  isPolicyPopoverOpen = (policy) => {
-    return this.state.policyPopover === policy.name;
-  };
-  closePolicyPopover = (policy) => {
-    if (this.isPolicyPopoverOpen(policy)) {
-      this.setState({ policyPopover: null });
-    }
-  };
-  openPolicyPopover = (policy) => {
-    this.setState({ policyPopover: policy.name });
-  };
-  buildRowCells(policy) {
-    const { name } = policy;
-    const cells = Object.entries(COLUMNS).map(([fieldName, { width }]) => {
-      const value = policy[fieldName];
-
-      if (fieldName === 'name') {
-        return (
-          <th
-            key={`${fieldName}-${name}`}
-            className="euiTableRowCell"
-            scope="row"
-            data-test-subj={`policyTableCell-${fieldName}`}
-          >
-            <div className={`euiTableCellContent policyTable__content--${fieldName}`}>
-              {this.buildRowCell(fieldName, value)}
-            </div>
-          </th>
-        );
-      }
-
-      return (
-        <EuiTableRowCell
-          key={`${fieldName}-${name}`}
-          truncateText={false}
-          data-test-subj={`policyTableCell-${fieldName}`}
-          className={'policyTable__content--' + fieldName}
-          width={width}
-        >
-          {this.buildRowCell(fieldName, value)}
-        </EuiTableRowCell>
-      );
-    });
-    const button = (
-      <EuiButtonEmpty
-        data-test-subj="policyActionsContextMenuButton"
-        onClick={() => this.togglePolicyPopover(policy)}
-        color="primary"
-      >
-        {i18n.translate('xpack.indexLifecycleMgmt.policyTable.actionsButtonText', {
-          defaultMessage: 'Actions',
-        })}
-      </EuiButtonEmpty>
-    );
-    cells.push(
-      <EuiTableRowCell
-        align={RIGHT_ALIGNMENT}
-        key={`delete-${name}`}
-        truncateText={false}
-        data-test-subj={`policyTableCell-actions-${name}`}
-        style={{ width: 150 }}
-      >
-        <EuiPopover
-          id="contextMenuPolicy"
-          button={button}
-          isOpen={this.isPolicyPopoverOpen(policy)}
-          closePopover={() => this.closePolicyPopover(policy)}
-          panelPaddingSize="none"
-          withTitle
-          anchorPosition="rightUp"
-          repositionOnScroll
-        >
-          <EuiContextMenu initialPanelId={0} panels={this.buildActionPanelTree(policy)} />
-        </EuiPopover>
-      </EuiTableRowCell>
-    );
-    return cells;
-  }
-
-  buildRows() {
-    const { policies = [] } = this.props;
-    return policies.map((policy) => {
-      const { name } = policy;
-      return <EuiTableRow key={`${name}-row`}>{this.buildRowCells(policy)}</EuiTableRow>;
-    });
-  }
-
-  renderPager() {
-    const { pager, policyPageChanged, policyPageSizeChanged } = this.props;
-    return (
-      <EuiTablePagination
-        activePage={pager.getCurrentPageIndex()}
-        itemsPerPage={pager.itemsPerPage}
-        itemsPerPageOptions={[10, 50, 100]}
-        pageCount={pager.getTotalPages()}
-        onChangeItemsPerPage={policyPageSizeChanged}
-        onChangePage={policyPageChanged}
-      />
-    );
-  }
-
-  onItemSelectionChanged = (selectedPolicies) => {
-    this.setState({ selectedPolicies });
-  };
-
-  render() {
-    const {
-      totalNumberOfPolicies,
-      policyFilterChanged,
-      filter,
-      policyListLoaded,
-      policies,
-    } = this.props;
-    const { selectedPoliciesMap } = this.state;
-    const numSelected = Object.keys(selectedPoliciesMap).length;
-    let content;
-    let tableContent;
-    if (totalNumberOfPolicies || !policyListLoaded) {
-      if (!policyListLoaded) {
-        tableContent = <EuiLoadingSpinner size="m" />;
-      } else if (totalNumberOfPolicies > 0) {
-        tableContent = (
-          <EuiTable>
-            <EuiScreenReaderOnly>
-              <caption role="status" aria-relevant="text" aria-live="polite">
-                <FormattedMessage
-                  id="xpack.indexLifecycleMgmt.policyTable.captionText"
-                  defaultMessage="Below is the index lifecycle policy table
-                    containing {count, plural, one {# row} other {# rows}} out of {total}."
-                  values={{ count: policies.length, total: totalNumberOfPolicies }}
-                />
-              </caption>
-            </EuiScreenReaderOnly>
-            <EuiTableHeader>{this.buildHeader()}</EuiTableHeader>
-            <EuiTableBody>{this.buildRows()}</EuiTableBody>
-          </EuiTable>
-        );
-      } else {
-        tableContent = <NoMatch />;
-      }
-      content = (
-        <Fragment>
-          <EuiFlexGroup gutterSize="l" alignItems="center">
-            {numSelected > 0 ? (
-              <EuiFlexItem grow={false}>
-                <EuiButton
-                  data-test-subj="deletePolicyButton"
-                  color="danger"
-                  onClick={() => this.setState({ showDeleteConfirmation: true })}
-                >
-                  <FormattedMessage
-                    id="xpack.indexLifecycleMgmt.policyTable.deletedPoliciesText"
-                    defaultMessage="Deleted {numSelected} {numSelected, plural, one {policy} other {policies}}"
-                    values={{ numSelected }}
-                  />
-                </EuiButton>
-              </EuiFlexItem>
-            ) : null}
-            <EuiFlexItem>
-              <EuiFieldSearch
-                fullWidth
-                value={filter}
-                onChange={(event) => {
-                  policyFilterChanged(event.target.value);
-                }}
-                data-test-subj="policyTableFilterInput"
-                placeholder={i18n.translate(
-                  'xpack.indexLifecycleMgmt.policyTable.systempoliciesSearchInputPlaceholder',
-                  {
-                    defaultMessage: 'Search',
-                  }
-                )}
-                aria-label={i18n.translate(
-                  'xpack.indexLifecycleMgmt.policyTable.systempoliciesSearchInputAriaLabel',
-                  {
-                    defaultMessage: 'Search policies',
-                  }
-                )}
-              />
-            </EuiFlexItem>
-          </EuiFlexGroup>
-          <EuiSpacer size="m" />
-          {tableContent}
-        </Fragment>
-      );
-    } else {
-      content = this.renderEmpty();
-    }
-
-    return (
-      <EuiPageBody>
-        <EuiPageContent verticalPosition="center" horizontalPosition="center">
-          <div>
-            {this.renderConfirmModal()}
-            {totalNumberOfPolicies || !policyListLoaded ? (
-              <Fragment>
-                <EuiFlexGroup justifyContent="spaceBetween" alignItems="center">
-                  <EuiFlexItem grow={false}>
-                    <EuiTitle size="l">
-                      <h1 data-test-subj="sectionHeading">
-                        <FormattedMessage
-                          id="xpack.indexLifecycleMgmt.policyTable.sectionHeading"
-                          defaultMessage="Index Lifecycle Policies"
-                        />
-                      </h1>
-                    </EuiTitle>
-                  </EuiFlexItem>
-                  {totalNumberOfPolicies ? (
-                    <EuiFlexItem grow={false}>{this.renderCreatePolicyButton()}</EuiFlexItem>
-                  ) : null}
-                </EuiFlexGroup>
-                <EuiSpacer size="s" />
-                <EuiText>
-                  <p>
-                    <FormattedMessage
-                      id="xpack.indexLifecycleMgmt.policyTable.sectionDescription"
-                      defaultMessage="Manage your indices as they age.  Attach a policy to automate
-                        when and how to transition an index through its lifecycle."
-                    />
-                  </p>
-                </EuiText>
-              </Fragment>
-            ) : null}
-            <EuiSpacer />
-            {content}
-            <EuiSpacer size="m" />
-            {totalNumberOfPolicies && totalNumberOfPolicies > 10 ? this.renderPager() : null}
-          </div>
-        </EuiPageContent>
-      </EuiPageBody>
-    );
-  }
-}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/table_content.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/table_content.tsx
new file mode 100644
index 00000000000000..3481a2f0d4a2a6
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/table_content.tsx
@@ -0,0 +1,376 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { ReactElement, useState, Fragment, ReactNode } from 'react';
+import {
+  EuiButtonEmpty,
+  EuiContextMenu,
+  EuiLink,
+  EuiPopover,
+  EuiScreenReaderOnly,
+  EuiSpacer,
+  EuiTable,
+  EuiTableBody,
+  EuiTableHeader,
+  EuiTableHeaderCell,
+  EuiTablePagination,
+  EuiTableRow,
+  EuiTableRowCell,
+  EuiText,
+  Pager,
+  EuiContextMenuPanelDescriptor,
+} from '@elastic/eui';
+
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { RIGHT_ALIGNMENT } from '@elastic/eui/lib/services';
+
+import moment from 'moment';
+import { ApplicationStart } from 'kibana/public';
+import { METRIC_TYPE } from '@kbn/analytics';
+import { RouteComponentProps } from 'react-router-dom';
+import { reactRouterNavigate } from '../../../../../../../../src/plugins/kibana_react/public';
+import { getIndexListUri } from '../../../../../../index_management/public';
+import { PolicyFromES } from '../../../../../common/types';
+import { getPolicyPath } from '../../../services/navigation';
+import { sortTable } from '../../../services';
+import { trackUiMetric } from '../../../services/ui_metric';
+
+import { UIM_EDIT_CLICK } from '../../../constants';
+import { AddPolicyToTemplateConfirmModal } from './add_policy_to_template_confirm_modal';
+import { ConfirmDelete } from './confirm_delete';
+
+type PolicyProperty = Extract<
+  keyof PolicyFromES,
+  'version' | 'name' | 'linkedIndices' | 'modified_date'
+>;
+const COLUMNS: Array<[PolicyProperty, { label: string; width: number }]> = [
+  [
+    'name',
+    {
+      label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.nameHeader', {
+        defaultMessage: 'Name',
+      }),
+      width: 200,
+    },
+  ],
+  [
+    'linkedIndices',
+    {
+      label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.linkedIndicesHeader', {
+        defaultMessage: 'Linked indices',
+      }),
+      width: 120,
+    },
+  ],
+  [
+    'version',
+    {
+      label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.versionHeader', {
+        defaultMessage: 'Version',
+      }),
+      width: 120,
+    },
+  ],
+  [
+    'modified_date',
+    {
+      label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.modifiedDateHeader', {
+        defaultMessage: 'Modified date',
+      }),
+      width: 200,
+    },
+  ],
+];
+
+interface Props {
+  policies: PolicyFromES[];
+  totalNumber: number;
+  navigateToApp: ApplicationStart['navigateToApp'];
+  setConfirmModal: (modal: ReactElement | null) => void;
+  handleDelete: () => void;
+  history: RouteComponentProps['history'];
+}
+export const TableContent: React.FunctionComponent<Props> = ({
+  policies,
+  totalNumber,
+  navigateToApp,
+  setConfirmModal,
+  handleDelete,
+  history,
+}) => {
+  const [popoverPolicy, setPopoverPolicy] = useState<string>();
+  const [sort, setSort] = useState<{ sortField: PolicyProperty; isSortAscending: boolean }>({
+    sortField: 'name',
+    isSortAscending: true,
+  });
+  const [pageSize, setPageSize] = useState<number>(10);
+  const [currentPage, setCurrentPage] = useState<number>(0);
+
+  let sortedPolicies = sortTable(policies, sort.sortField, sort.isSortAscending);
+  const pager = new Pager(totalNumber, pageSize, currentPage);
+  const { firstItemIndex, lastItemIndex } = pager;
+  sortedPolicies = sortedPolicies.slice(firstItemIndex, lastItemIndex + 1);
+
+  const isPolicyPopoverOpen = (policyName: string): boolean => popoverPolicy === policyName;
+  const closePolicyPopover = (): void => {
+    setPopoverPolicy('');
+  };
+  const openPolicyPopover = (policyName: string): void => {
+    setPopoverPolicy(policyName);
+  };
+  const togglePolicyPopover = (policyName: string): void => {
+    if (isPolicyPopoverOpen(policyName)) {
+      closePolicyPopover();
+    } else {
+      openPolicyPopover(policyName);
+    }
+  };
+
+  const onSort = (column: PolicyProperty) => {
+    const newIsSortAscending = sort.sortField === column ? !sort.isSortAscending : true;
+    setSort({ sortField: column, isSortAscending: newIsSortAscending });
+  };
+
+  const headers = [];
+  COLUMNS.forEach(([fieldName, { label, width }]) => {
+    const isSorted = sort.sortField === fieldName;
+    headers.push(
+      <EuiTableHeaderCell
+        key={fieldName}
+        onSort={() => onSort(fieldName)}
+        isSorted={isSorted}
+        isSortAscending={sort.isSortAscending}
+        data-test-subj={`policyTableHeaderCell-${fieldName}`}
+        className={'policyTable__header--' + fieldName}
+        width={width}
+      >
+        {label}
+      </EuiTableHeaderCell>
+    );
+  });
+  headers.push(
+    <EuiTableHeaderCell
+      key="deleteHeader"
+      data-test-subj="policyTableHeaderCell-delete"
+      width={150}
+    />
+  );
+
+  const buildActionPanelTree = (policy: PolicyFromES): EuiContextMenuPanelDescriptor[] => {
+    const hasLinkedIndices = Boolean(policy.linkedIndices && policy.linkedIndices.length);
+
+    const viewIndicesLabel = i18n.translate(
+      'xpack.indexLifecycleMgmt.policyTable.viewIndicesButtonText',
+      {
+        defaultMessage: 'View indices linked to policy',
+      }
+    );
+    const addPolicyToTemplateLabel = i18n.translate(
+      'xpack.indexLifecycleMgmt.policyTable.addPolicyToTemplateButtonText',
+      {
+        defaultMessage: 'Add policy to index template',
+      }
+    );
+    const deletePolicyLabel = i18n.translate(
+      'xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonText',
+      {
+        defaultMessage: 'Delete policy',
+      }
+    );
+    const deletePolicyTooltip = hasLinkedIndices
+      ? i18n.translate('xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonDisabledTooltip', {
+          defaultMessage: 'You cannot delete a policy that is being used by an index',
+        })
+      : null;
+    const items = [];
+    if (hasLinkedIndices) {
+      items.push({
+        name: viewIndicesLabel,
+        icon: 'list',
+        onClick: () => {
+          navigateToApp('management', {
+            path: `/data/index_management${getIndexListUri(`ilm.policy:${policy.name}`, true)}`,
+          });
+        },
+      });
+    }
+    items.push({
+      name: addPolicyToTemplateLabel,
+      icon: 'plusInCircle',
+      onClick: () => {
+        setConfirmModal(renderAddPolicyToTemplateConfirmModal(policy));
+      },
+    });
+    items.push({
+      name: deletePolicyLabel,
+      disabled: hasLinkedIndices,
+      icon: 'trash',
+      toolTipContent: deletePolicyTooltip,
+      onClick: () => {
+        setConfirmModal(renderDeleteConfirmModal(policy));
+      },
+    });
+    const panelTree = {
+      id: 0,
+      title: i18n.translate('xpack.indexLifecycleMgmt.policyTable.policyActionsMenu.panelTitle', {
+        defaultMessage: 'Policy options',
+      }),
+      items,
+    };
+    return [panelTree];
+  };
+
+  const renderRowCell = (fieldName: string, value: string | number | string[]): ReactNode => {
+    if (fieldName === 'name') {
+      return (
+        <EuiLink
+          data-test-subj="policyTablePolicyNameLink"
+          {...reactRouterNavigate(history, getPolicyPath(value as string), () =>
+            trackUiMetric(METRIC_TYPE.CLICK, UIM_EDIT_CLICK)
+          )}
+        >
+          {value}
+        </EuiLink>
+      );
+    } else if (fieldName === 'linkedIndices') {
+      return (
+        <EuiText>
+          <b>{value ? (value as string[]).length : '0'}</b>
+        </EuiText>
+      );
+    } else if (fieldName === 'modified_date' && value) {
+      return moment(value).format('YYYY-MM-DD HH:mm:ss');
+    }
+    return value;
+  };
+
+  const renderRowCells = (policy: PolicyFromES): ReactElement[] => {
+    const { name } = policy;
+    const cells = [];
+    COLUMNS.forEach(([fieldName, { width }]) => {
+      const value: any = policy[fieldName];
+
+      if (fieldName === 'name') {
+        cells.push(
+          <th
+            key={`${fieldName}-${name}`}
+            className="euiTableRowCell"
+            scope="row"
+            data-test-subj={`policyTableCell-${fieldName}`}
+          >
+            <div className={`euiTableCellContent policyTable__content--${fieldName}`}>
+              {renderRowCell(fieldName, value)}
+            </div>
+          </th>
+        );
+      } else {
+        cells.push(
+          <EuiTableRowCell
+            key={`${fieldName}-${name}`}
+            truncateText={false}
+            data-test-subj={`policyTableCell-${fieldName}`}
+            className={'policyTable__content--' + fieldName}
+            width={width}
+          >
+            {renderRowCell(fieldName, value)}
+          </EuiTableRowCell>
+        );
+      }
+    });
+    const button = (
+      <EuiButtonEmpty
+        data-test-subj="policyActionsContextMenuButton"
+        onClick={() => togglePolicyPopover(policy.name)}
+        color="primary"
+      >
+        {i18n.translate('xpack.indexLifecycleMgmt.policyTable.actionsButtonText', {
+          defaultMessage: 'Actions',
+        })}
+      </EuiButtonEmpty>
+    );
+    cells.push(
+      <EuiTableRowCell
+        align={RIGHT_ALIGNMENT}
+        key={`delete-${name}`}
+        truncateText={false}
+        data-test-subj={`policyTableCell-actions-${name}`}
+        style={{ width: 150 }}
+      >
+        <EuiPopover
+          id="contextMenuPolicy"
+          button={button}
+          isOpen={isPolicyPopoverOpen(policy.name)}
+          closePopover={closePolicyPopover}
+          panelPaddingSize="none"
+          withTitle
+          anchorPosition="rightUp"
+          repositionOnScroll
+        >
+          <EuiContextMenu initialPanelId={0} panels={buildActionPanelTree(policy)} />
+        </EuiPopover>
+      </EuiTableRowCell>
+    );
+    return cells;
+  };
+
+  const rows = sortedPolicies.map((policy) => {
+    const { name } = policy;
+    return <EuiTableRow key={`${name}-row`}>{renderRowCells(policy)}</EuiTableRow>;
+  });
+
+  const renderAddPolicyToTemplateConfirmModal = (policy: PolicyFromES): ReactElement => {
+    return (
+      <AddPolicyToTemplateConfirmModal policy={policy} onCancel={() => setConfirmModal(null)} />
+    );
+  };
+
+  const renderDeleteConfirmModal = (policy: PolicyFromES): ReactElement => {
+    return (
+      <ConfirmDelete
+        policyToDelete={policy}
+        callback={handleDelete}
+        onCancel={() => {
+          setConfirmModal(null);
+        }}
+      />
+    );
+  };
+
+  const renderPager = (): ReactNode => {
+    return (
+      <EuiTablePagination
+        activePage={pager.getCurrentPageIndex()}
+        itemsPerPage={pager.itemsPerPage}
+        itemsPerPageOptions={[10, 50, 100]}
+        pageCount={pager.getTotalPages()}
+        onChangeItemsPerPage={setPageSize}
+        onChangePage={setCurrentPage}
+      />
+    );
+  };
+
+  return (
+    <Fragment>
+      <EuiTable>
+        <EuiScreenReaderOnly>
+          <caption role="status" aria-relevant="text" aria-live="polite">
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.policyTable.captionText"
+              defaultMessage="Below is the index lifecycle policy table
+                    containing {count, plural, one {# row} other {# rows}} out of {total}."
+              values={{ count: sortedPolicies.length, total: totalNumber }}
+            />
+          </caption>
+        </EuiScreenReaderOnly>
+        <EuiTableHeader>{headers}</EuiTableHeader>
+        <EuiTableBody>{rows}</EuiTableBody>
+      </EuiTable>
+      <EuiSpacer size="m" />
+      {policies.length > 10 ? renderPager() : null}
+    </Fragment>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/index.d.ts b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/index.d.ts
deleted file mode 100644
index fa1b1129523eb4..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/index.d.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export declare const PolicyTable: any;
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/index.js b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/index.js
deleted file mode 100644
index c4aa32f1f7dc28..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/index.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export { PolicyTable } from './components/policy_table';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/index.js b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/index.ts
similarity index 100%
rename from x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/policy_table/index.js
rename to x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/index.ts
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.container.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.container.tsx
new file mode 100644
index 00000000000000..f6471ff2da4d3b
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.container.tsx
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { ApplicationStart } from 'kibana/public';
+import { RouteComponentProps } from 'react-router-dom';
+import { EuiButton, EuiEmptyPrompt, EuiLoadingSpinner } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { PolicyTable as PresentationComponent } from './policy_table';
+import { useLoadPoliciesList } from '../../services/api';
+
+interface Props {
+  navigateToApp: ApplicationStart['navigateToApp'];
+}
+
+export const PolicyTable: React.FunctionComponent<Props & RouteComponentProps> = ({
+  navigateToApp,
+  history,
+}) => {
+  const { data: policies, isLoading, error, sendRequest } = useLoadPoliciesList(true);
+
+  if (isLoading) {
+    return (
+      <EuiEmptyPrompt
+        title={<EuiLoadingSpinner size="xl" />}
+        body={
+          <FormattedMessage
+            id="xpack.indexLifecycleMgmt.policyTable.policiesLoading"
+            defaultMessage="Loading policies..."
+          />
+        }
+      />
+    );
+  }
+  if (error) {
+    const { statusCode, message } = error ? error : { statusCode: '', message: '' };
+    return (
+      <EuiEmptyPrompt
+        title={
+          <h2>
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.policyTable.policiesLoadingFailedTitle"
+              defaultMessage="Unable to load existing lifecycle policies"
+            />
+          </h2>
+        }
+        body={
+          <p>
+            {message} ({statusCode})
+          </p>
+        }
+        actions={
+          <EuiButton onClick={sendRequest} iconType="refresh" color="danger">
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.policyTable.policiesReloadButton"
+              defaultMessage="Try again"
+            />
+          </EuiButton>
+        }
+      />
+    );
+  }
+
+  return (
+    <PresentationComponent
+      policies={policies || []}
+      history={history}
+      navigateToApp={navigateToApp}
+      updatePolicies={sendRequest}
+    />
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.tsx
new file mode 100644
index 00000000000000..0c396dae757831
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.tsx
@@ -0,0 +1,183 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { Fragment, ReactElement, ReactNode, useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import {
+  EuiButton,
+  EuiEmptyPrompt,
+  EuiFieldSearch,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSpacer,
+  EuiTitle,
+  EuiText,
+  EuiPageBody,
+  EuiPageContent,
+} from '@elastic/eui';
+import { ApplicationStart } from 'kibana/public';
+import { RouteComponentProps } from 'react-router-dom';
+import { reactRouterNavigate } from '../../../../../../../src/plugins/kibana_react/public';
+import { PolicyFromES } from '../../../../common/types';
+import { filterItems } from '../../services';
+import { TableContent } from './components/table_content';
+
+interface Props {
+  policies: PolicyFromES[];
+  history: RouteComponentProps['history'];
+  navigateToApp: ApplicationStart['navigateToApp'];
+  updatePolicies: () => void;
+}
+
+export const PolicyTable: React.FunctionComponent<Props> = ({
+  policies,
+  history,
+  navigateToApp,
+  updatePolicies,
+}) => {
+  const [confirmModal, setConfirmModal] = useState<ReactNode | null>();
+  const [filter, setFilter] = useState<string>('');
+
+  const createPolicyButton = (
+    <EuiButton
+      {...reactRouterNavigate(history, '/policies/edit')}
+      fill
+      iconType="plusInCircle"
+      data-test-subj="createPolicyButton"
+    >
+      <FormattedMessage
+        id="xpack.indexLifecycleMgmt.policyTable.emptyPrompt.createButtonLabel"
+        defaultMessage="Create policy"
+      />
+    </EuiButton>
+  );
+
+  let content: ReactElement;
+
+  if (policies.length > 0) {
+    const filteredPolicies = filterItems('name', filter, policies);
+    let tableContent: ReactElement;
+    if (filteredPolicies.length > 0) {
+      tableContent = (
+        <TableContent
+          policies={filteredPolicies}
+          totalNumber={policies.length}
+          navigateToApp={navigateToApp}
+          setConfirmModal={setConfirmModal}
+          handleDelete={() => {
+            updatePolicies();
+            setConfirmModal(null);
+          }}
+          history={history}
+        />
+      );
+    } else {
+      tableContent = (
+        <FormattedMessage
+          id="xpack.indexLifecycleMgmt.noMatch.noPolicicesDescription"
+          defaultMessage="No policies to show"
+        />
+      );
+    }
+
+    content = (
+      <Fragment>
+        <EuiFlexGroup gutterSize="l" alignItems="center">
+          <EuiFlexItem>
+            <EuiFieldSearch
+              fullWidth
+              value={filter}
+              onChange={(event) => {
+                setFilter(event.target.value);
+              }}
+              data-test-subj="policyTableFilterInput"
+              placeholder={i18n.translate(
+                'xpack.indexLifecycleMgmt.policyTable.systempoliciesSearchInputPlaceholder',
+                {
+                  defaultMessage: 'Search',
+                }
+              )}
+              aria-label={i18n.translate(
+                'xpack.indexLifecycleMgmt.policyTable.systempoliciesSearchInputAriaLabel',
+                {
+                  defaultMessage: 'Search policies',
+                }
+              )}
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+        <EuiSpacer size="m" />
+        {tableContent}
+      </Fragment>
+    );
+  } else {
+    return (
+      <EuiPageBody>
+        <EuiPageContent verticalPosition="center" horizontalPosition="center">
+          <EuiEmptyPrompt
+            iconType="managementApp"
+            title={
+              <h1>
+                <FormattedMessage
+                  id="xpack.indexLifecycleMgmt.policyTable.emptyPromptTitle"
+                  defaultMessage="Create your first index lifecycle policy"
+                />
+              </h1>
+            }
+            body={
+              <Fragment>
+                <p>
+                  <FormattedMessage
+                    id="xpack.indexLifecycleMgmt.policyTable.emptyPromptDescription"
+                    defaultMessage=" An index lifecycle policy helps you manage your indices as they age."
+                  />
+                </p>
+              </Fragment>
+            }
+            actions={createPolicyButton}
+          />
+        </EuiPageContent>
+      </EuiPageBody>
+    );
+  }
+
+  return (
+    <EuiPageBody>
+      <EuiPageContent verticalPosition="center" horizontalPosition="center">
+        {confirmModal}
+
+        <EuiFlexGroup justifyContent="spaceBetween" alignItems="center">
+          <EuiFlexItem grow={false}>
+            <EuiTitle size="l">
+              <h1 data-test-subj="sectionHeading">
+                <FormattedMessage
+                  id="xpack.indexLifecycleMgmt.policyTable.sectionHeading"
+                  defaultMessage="Index Lifecycle Policies"
+                />
+              </h1>
+            </EuiTitle>
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>{createPolicyButton}</EuiFlexItem>
+        </EuiFlexGroup>
+        <EuiSpacer size="s" />
+        <EuiText>
+          <p>
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.policyTable.sectionDescription"
+              defaultMessage="Manage your indices as they age.  Attach a policy to automate
+                        when and how to transition an index through its lifecycle."
+            />
+          </p>
+        </EuiText>
+
+        <EuiSpacer />
+        {content}
+      </EuiPageContent>
+    </EuiPageBody>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/api.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/api.ts
index b80e9e70c54faa..3d068433becbd4 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/api.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/api.ts
@@ -6,17 +6,17 @@
 
 import { METRIC_TYPE } from '@kbn/analytics';
 
+import { PolicyFromES, SerializedPolicy } from '../../../common/types';
+
 import {
   UIM_POLICY_DELETE,
   UIM_POLICY_ATTACH_INDEX,
   UIM_POLICY_ATTACH_INDEX_TEMPLATE,
   UIM_POLICY_DETACH_INDEX,
   UIM_INDEX_RETRY_STEP,
-} from '../constants/ui_metric';
-
+} from '../constants';
 import { trackUiMetric } from './ui_metric';
 import { sendGet, sendPost, sendDelete, useRequest } from './http';
-import { PolicyFromES, SerializedPolicy } from './policies/types';
 
 interface GenericObject {
   [key: string]: any;
@@ -78,7 +78,11 @@ export const removeLifecycleForIndex = async (indexNames: string[]) => {
   return response;
 };
 
-export const addLifecyclePolicyToIndex = async (body: GenericObject) => {
+export const addLifecyclePolicyToIndex = async (body: {
+  indexName: string;
+  policyName: string;
+  alias: string;
+}) => {
   const response = await sendPost(`index/add`, body);
   // Only track successful actions.
   trackUiMetric(METRIC_TYPE.COUNT, UIM_POLICY_ATTACH_INDEX);
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/filter_items.js b/x-pack/plugins/index_lifecycle_management/public/application/services/filter_items.js
deleted file mode 100644
index dcc9036463b821..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/filter_items.js
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export const filterItems = (fields, filter = '', items = []) => {
-  const lowerFilter = filter.toLowerCase();
-  return items.filter((item) => {
-    const actualFields = fields || Object.keys(item);
-    const indexOfMatch = actualFields.findIndex((field) => {
-      const normalizedField = String(item[field]).toLowerCase();
-      return normalizedField.includes(lowerFilter);
-    });
-    return indexOfMatch !== -1;
-  });
-};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/filter_items.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/filter_items.ts
new file mode 100644
index 00000000000000..237ce567707bbe
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/filter_items.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const filterItems = <T>(field: keyof T, filter: string, items: T[] = []): T[] => {
+  const lowerFilter = filter.toLowerCase();
+  return items.filter((item: T) => {
+    const normalizedValue = String(item[field]).toLowerCase();
+    return normalizedValue.includes(lowerFilter);
+  });
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/flatten_panel_tree.js b/x-pack/plugins/index_lifecycle_management/public/application/services/flatten_panel_tree.js
deleted file mode 100644
index 2bb3903a6ef45a..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/flatten_panel_tree.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export const flattenPanelTree = (tree, array = []) => {
-  array.push(tree);
-
-  if (tree.items) {
-    tree.items.forEach((item) => {
-      if (item.panel) {
-        flattenPanelTree(item.panel, array);
-        item.panel = item.panel.id;
-      }
-    });
-  }
-
-  return array;
-};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/index.js b/x-pack/plugins/index_lifecycle_management/public/application/services/index.ts
similarity index 100%
rename from x-pack/plugins/index_lifecycle_management/public/application/services/index.js
rename to x-pack/plugins/index_lifecycle_management/public/application/services/index.ts
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/cold_phase.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/cold_phase.ts
index 7fa82a004b872e..3b71c11349752f 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/cold_phase.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/cold_phase.ts
@@ -5,8 +5,8 @@
  */
 
 import { isEmpty } from 'lodash';
+import { AllocateAction, ColdPhase, SerializedColdPhase } from '../../../../common/types';
 import { serializedPhaseInitialization } from '../../constants';
-import { AllocateAction, ColdPhase, SerializedColdPhase } from './types';
 import { isNumber, splitSizeAndUnits } from './policy_serialization';
 import {
   numberRequiredMessage,
@@ -90,7 +90,6 @@ export const coldPhaseToES = (
     };
   } else {
     if (esPhase.actions.allocate) {
-      // @ts-expect-error
       delete esPhase.actions.allocate.require;
     }
   }
@@ -100,7 +99,6 @@ export const coldPhaseToES = (
     esPhase.actions.allocate.number_of_replicas = parseInt(phase.selectedReplicaCount, 10);
   } else {
     if (esPhase.actions.allocate) {
-      // @ts-expect-error
       delete esPhase.actions.allocate.number_of_replicas;
     }
   }
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/delete_phase.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/delete_phase.ts
index 70e7c21da8cb68..6ada039d45cd99 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/delete_phase.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/delete_phase.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { DeletePhase, SerializedDeletePhase } from '../../../../common/types';
 import { serializedPhaseInitialization } from '../../constants';
-import { DeletePhase, SerializedDeletePhase } from './types';
 import { isNumber, splitSizeAndUnits } from './policy_serialization';
 import {
   numberRequiredMessage,
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/frozen_phase.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/frozen_phase.ts
index bad43bfcf8a9c0..6249507bcb4078 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/frozen_phase.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/frozen_phase.ts
@@ -6,7 +6,7 @@
 
 import { isEmpty } from 'lodash';
 import { serializedPhaseInitialization } from '../../constants';
-import { AllocateAction, FrozenPhase, SerializedFrozenPhase } from './types';
+import { AllocateAction, FrozenPhase, SerializedFrozenPhase } from '../../../../common/types';
 import { isNumber, splitSizeAndUnits } from './policy_serialization';
 import {
   numberRequiredMessage,
@@ -90,7 +90,6 @@ export const frozenPhaseToES = (
     };
   } else {
     if (esPhase.actions.allocate) {
-      // @ts-expect-error
       delete esPhase.actions.allocate.require;
     }
   }
@@ -100,7 +99,6 @@ export const frozenPhaseToES = (
     esPhase.actions.allocate.number_of_replicas = parseInt(phase.selectedReplicaCount, 10);
   } else {
     if (esPhase.actions.allocate) {
-      // @ts-expect-error
       delete esPhase.actions.allocate.number_of_replicas;
     }
   }
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/hot_phase.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/hot_phase.ts
index 34ac8f3e270e6d..fb7f74efeb66e1 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/hot_phase.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/hot_phase.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { HotPhase, SerializedHotPhase } from '../../../../common/types';
 import { serializedPhaseInitialization } from '../../constants';
 import { isNumber, splitSizeAndUnits } from './policy_serialization';
-import { HotPhase, SerializedHotPhase } from './types';
 import {
   maximumAgeRequiredMessage,
   maximumDocumentsRequiredMessage,
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_save.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_save.ts
index 12df0715449528..a96b6f57a0f9f1 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_save.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_save.ts
@@ -7,12 +7,12 @@
 import { i18n } from '@kbn/i18n';
 import { METRIC_TYPE } from '@kbn/analytics';
 
+import { Policy, PolicyFromES } from '../../../../common/types';
 import { savePolicy as savePolicyApi } from '../api';
 import { showApiError } from '../api_errors';
 import { getUiMetricsForPhases, trackUiMetric } from '../ui_metric';
-import { UIM_POLICY_CREATE, UIM_POLICY_UPDATE } from '../../constants/ui_metric';
+import { UIM_POLICY_CREATE, UIM_POLICY_UPDATE } from '../../constants';
 import { toasts } from '../notification';
-import { Policy, PolicyFromES } from './types';
 import { serializePolicy } from './policy_serialization';
 
 export const savePolicy = async (
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_serialization.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_serialization.ts
index 807a6fe8ec3959..31c063aba2c4aa 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_serialization.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_serialization.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { Policy, PolicyFromES, SerializedPolicy } from '../../../../common/types';
+
 import {
   defaultNewColdPhase,
   defaultNewDeletePhase,
@@ -13,8 +15,6 @@ import {
   serializedPhaseInitialization,
 } from '../../constants';
 
-import { Policy, PolicyFromES, SerializedPolicy } from './types';
-
 import { hotPhaseFromES, hotPhaseToES } from './hot_phase';
 import { warmPhaseFromES, warmPhaseToES } from './warm_phase';
 import { coldPhaseFromES, coldPhaseToES } from './cold_phase';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_validation.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_validation.ts
index 6fdbc4babd3f3f..f5197e6ffec998 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_validation.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/policy_validation.ts
@@ -5,12 +5,6 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { validateHotPhase } from './hot_phase';
-import { validateWarmPhase } from './warm_phase';
-import { validateColdPhase } from './cold_phase';
-import { validateDeletePhase } from './delete_phase';
-import { validateFrozenPhase } from './frozen_phase';
-
 import {
   ColdPhase,
   DeletePhase,
@@ -19,7 +13,12 @@ import {
   Policy,
   PolicyFromES,
   WarmPhase,
-} from './types';
+} from '../../../../common/types';
+import { validateHotPhase } from './hot_phase';
+import { validateWarmPhase } from './warm_phase';
+import { validateColdPhase } from './cold_phase';
+import { validateDeletePhase } from './delete_phase';
+import { validateFrozenPhase } from './frozen_phase';
 
 export const propertyof = <T>(propertyName: keyof T & string) => propertyName;
 
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/types.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/types.ts
deleted file mode 100644
index 3d4c73cf4a82cf..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/types.ts
+++ /dev/null
@@ -1,170 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export interface SerializedPolicy {
-  name: string;
-  phases: Phases;
-}
-
-export interface Phases {
-  hot?: SerializedHotPhase;
-  warm?: SerializedWarmPhase;
-  cold?: SerializedColdPhase;
-  frozen?: SerializedFrozenPhase;
-  delete?: SerializedDeletePhase;
-}
-
-export interface PolicyFromES {
-  modified_date: string;
-  name: string;
-  policy: SerializedPolicy;
-  version: number;
-}
-
-export interface SerializedPhase {
-  min_age: string;
-  actions: {
-    [action: string]: any;
-  };
-}
-
-export interface SerializedHotPhase extends SerializedPhase {
-  actions: {
-    rollover?: {
-      max_size?: string;
-      max_age?: string;
-      max_docs?: number;
-    };
-    set_priority?: {
-      priority: number | null;
-    };
-  };
-}
-
-export interface SerializedWarmPhase extends SerializedPhase {
-  actions: {
-    allocate?: AllocateAction;
-    shrink?: {
-      number_of_shards: number;
-    };
-    forcemerge?: {
-      max_num_segments: number;
-    };
-    set_priority?: {
-      priority: number | null;
-    };
-  };
-}
-
-export interface SerializedColdPhase extends SerializedPhase {
-  actions: {
-    freeze?: {};
-    allocate?: AllocateAction;
-    set_priority?: {
-      priority: number | null;
-    };
-  };
-}
-
-export interface SerializedFrozenPhase extends SerializedPhase {
-  actions: {
-    freeze?: {};
-    allocate?: AllocateAction;
-    set_priority?: {
-      priority: number | null;
-    };
-  };
-}
-
-export interface SerializedDeletePhase extends SerializedPhase {
-  actions: {
-    wait_for_snapshot?: {
-      policy: string;
-    };
-    delete?: {
-      delete_searchable_snapshot: boolean;
-    };
-  };
-}
-
-export interface AllocateAction {
-  number_of_replicas: number;
-  include: {};
-  exclude: {};
-  require: {
-    [attribute: string]: string;
-  };
-}
-
-export interface Policy {
-  name: string;
-  phases: {
-    hot: HotPhase;
-    warm: WarmPhase;
-    cold: ColdPhase;
-    frozen: FrozenPhase;
-    delete: DeletePhase;
-  };
-}
-
-export interface CommonPhaseSettings {
-  phaseEnabled: boolean;
-}
-
-export interface PhaseWithMinAge {
-  selectedMinimumAge: string;
-  selectedMinimumAgeUnits: string;
-}
-
-export interface PhaseWithAllocationAction {
-  selectedNodeAttrs: string;
-  selectedReplicaCount: string;
-}
-
-export interface PhaseWithIndexPriority {
-  phaseIndexPriority: string;
-}
-
-export interface HotPhase extends CommonPhaseSettings, PhaseWithIndexPriority {
-  rolloverEnabled: boolean;
-  selectedMaxSizeStored: string;
-  selectedMaxSizeStoredUnits: string;
-  selectedMaxDocuments: string;
-  selectedMaxAge: string;
-  selectedMaxAgeUnits: string;
-}
-
-export interface WarmPhase
-  extends CommonPhaseSettings,
-    PhaseWithMinAge,
-    PhaseWithAllocationAction,
-    PhaseWithIndexPriority {
-  warmPhaseOnRollover: boolean;
-  shrinkEnabled: boolean;
-  selectedPrimaryShardCount: string;
-  forceMergeEnabled: boolean;
-  selectedForceMergeSegments: string;
-}
-
-export interface ColdPhase
-  extends CommonPhaseSettings,
-    PhaseWithMinAge,
-    PhaseWithAllocationAction,
-    PhaseWithIndexPriority {
-  freezeEnabled: boolean;
-}
-
-export interface FrozenPhase
-  extends CommonPhaseSettings,
-    PhaseWithMinAge,
-    PhaseWithAllocationAction,
-    PhaseWithIndexPriority {
-  freezeEnabled: boolean;
-}
-
-export interface DeletePhase extends CommonPhaseSettings, PhaseWithMinAge {
-  waitForSnapshotPolicy: string;
-}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/warm_phase.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/warm_phase.ts
index c331f4ccce38f5..cc815d67dbc18e 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/warm_phase.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/warm_phase.ts
@@ -5,8 +5,8 @@
  */
 
 import { isEmpty } from 'lodash';
+import { AllocateAction, WarmPhase, SerializedWarmPhase } from '../../../../common/types';
 import { serializedPhaseInitialization } from '../../constants';
-import { AllocateAction, WarmPhase, SerializedWarmPhase } from './types';
 import { isNumber, splitSizeAndUnits } from './policy_serialization';
 
 import {
@@ -96,7 +96,6 @@ export const warmPhaseToES = (
   // An index lifecycle switches to warm phase when rollover occurs, so you cannot specify a warm phase time
   // They are mutually exclusive
   if (phase.warmPhaseOnRollover) {
-    // @ts-expect-error
     delete esPhase.min_age;
   }
 
@@ -110,7 +109,6 @@ export const warmPhaseToES = (
     };
   } else {
     if (esPhase.actions.allocate) {
-      // @ts-expect-error
       delete esPhase.actions.allocate.require;
     }
   }
@@ -120,7 +118,6 @@ export const warmPhaseToES = (
     esPhase.actions.allocate.number_of_replicas = parseInt(phase.selectedReplicaCount, 10);
   } else {
     if (esPhase.actions.allocate) {
-      // @ts-expect-error
       delete esPhase.actions.allocate.number_of_replicas;
     }
   }
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/sort_table.js b/x-pack/plugins/index_lifecycle_management/public/application/services/sort_table.js
deleted file mode 100644
index 1b1446bb735c13..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/sort_table.js
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { sortBy } from 'lodash';
-
-const stringSort = (fieldName) => (item) => item[fieldName];
-const arraySort = (fieldName) => (item) => (item[fieldName] || []).length;
-
-const sorters = {
-  version: stringSort('version'),
-  name: stringSort('name'),
-  linkedIndices: arraySort('linkedIndices'),
-  modified_date: stringSort('modified_date'),
-};
-export const sortTable = (array = [], sortField, isSortAscending) => {
-  const sorted = sortBy(array, sorters[sortField]);
-  return isSortAscending ? sorted : sorted.reverse();
-};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/sort_table.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/sort_table.ts
new file mode 100644
index 00000000000000..509c827904232c
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/sort_table.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { sortBy } from 'lodash';
+import { PolicyFromES } from '../../../common/types';
+
+export const sortTable = (
+  array: PolicyFromES[] = [],
+  sortField: Extract<keyof PolicyFromES, 'version' | 'name' | 'linkedIndices' | 'modified_date'>,
+  isSortAscending: boolean
+): PolicyFromES[] => {
+  let sorter;
+  if (sortField === 'linkedIndices') {
+    sorter = (item: PolicyFromES) => (item[sortField] || []).length;
+  } else {
+    sorter = (item: PolicyFromES) => item[sortField];
+  }
+  const sorted = sortBy(array, sorter);
+  return isSortAscending ? sorted : sorted.reverse();
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/ui_metric.test.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/ui_metric.test.ts
index 7c7c0b70c0eedf..81eb1c8cad1358 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/ui_metric.test.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/ui_metric.test.ts
@@ -14,7 +14,6 @@ import {
 } from '../constants/';
 
 import { getUiMetricsForPhases } from './ui_metric';
-jest.mock('ui/new_platform');
 
 describe('getUiMetricsForPhases', () => {
   test('gets cold phase', () => {
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/ui_metric.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/ui_metric.ts
index b38a7347705466..aeb2c8ce917c65 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/ui_metric.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/ui_metric.ts
@@ -18,9 +18,9 @@ import {
   defaultNewWarmPhase,
 } from '../constants';
 
-import { Phases } from './policies/types';
+import { Phases } from '../../../common/types';
 
-export let trackUiMetric = (metricType: UiStatsMetricType, eventName: string) => {};
+export let trackUiMetric = (metricType: UiStatsMetricType, eventName: string | string[]) => {};
 
 export function init(usageCollection?: UsageCollectionSetup): void {
   if (usageCollection) {
@@ -28,7 +28,7 @@ export function init(usageCollection?: UsageCollectionSetup): void {
   }
 }
 
-export function getUiMetricsForPhases(phases: Phases): any {
+export function getUiMetricsForPhases(phases: Phases): string[] {
   const phaseUiMetrics = [
     {
       metric: UIM_CONFIG_COLD_PHASE,
@@ -72,7 +72,7 @@ export function getUiMetricsForPhases(phases: Phases): any {
     },
   ];
 
-  return phaseUiMetrics.reduce((tracked: any, { metric, isTracked }) => {
+  return phaseUiMetrics.reduce((tracked: string[], { metric, isTracked }) => {
     if (isTracked()) {
       tracked.push(metric);
     }
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/store/actions/policies.js b/x-pack/plugins/index_lifecycle_management/public/application/store/actions/policies.js
deleted file mode 100644
index d47136679604fd..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/store/actions/policies.js
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { i18n } from '@kbn/i18n';
-import { createAction } from 'redux-actions';
-
-import { showApiError } from '../../services/api_errors';
-import { loadPolicies } from '../../services/api';
-
-export const fetchedPolicies = createAction('FETCHED_POLICIES');
-export const setSelectedPolicy = createAction('SET_SELECTED_POLICY');
-export const unsetSelectedPolicy = createAction('UNSET_SELECTED_POLICY');
-export const setSelectedPolicyName = createAction('SET_SELECTED_POLICY_NAME');
-export const setSaveAsNewPolicy = createAction('SET_SAVE_AS_NEW_POLICY');
-export const policySortChanged = createAction('POLICY_SORT_CHANGED');
-export const policyPageSizeChanged = createAction('POLICY_PAGE_SIZE_CHANGED');
-export const policyPageChanged = createAction('POLICY_PAGE_CHANGED');
-export const policySortDirectionChanged = createAction('POLICY_SORT_DIRECTION_CHANGED');
-export const policyFilterChanged = createAction('POLICY_FILTER_CHANGED');
-
-export const fetchPolicies = (withIndices, callback) => async (dispatch) => {
-  let policies;
-  try {
-    policies = await loadPolicies(withIndices);
-  } catch (err) {
-    const title = i18n.translate('xpack.indexLifecycleMgmt.editPolicy.loadPolicyErrorMessage', {
-      defaultMessage: 'Error loading policies',
-    });
-    showApiError(err, title);
-    return false;
-  }
-
-  dispatch(fetchedPolicies(policies));
-  if (policies.length === 0) {
-    dispatch(setSelectedPolicy());
-  }
-  callback && callback();
-  return policies;
-};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/store/index.d.ts b/x-pack/plugins/index_lifecycle_management/public/application/store/index.d.ts
deleted file mode 100644
index 8617a7045a5c34..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/store/index.d.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export declare const indexLifecycleManagementStore: any;
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/store/index.js b/x-pack/plugins/index_lifecycle_management/public/application/store/index.js
deleted file mode 100644
index 808eb489bf9137..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/store/index.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export { indexLifecycleManagementStore } from './store';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/store/reducers/index.js b/x-pack/plugins/index_lifecycle_management/public/application/store/reducers/index.js
deleted file mode 100644
index 7fe7134f5f5db6..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/store/reducers/index.js
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { combineReducers } from 'redux';
-import { policies } from './policies';
-
-export const indexLifecycleManagement = combineReducers({
-  policies,
-});
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/store/reducers/policies.js b/x-pack/plugins/index_lifecycle_management/public/application/store/reducers/policies.js
deleted file mode 100644
index ca9d59e295a29d..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/store/reducers/policies.js
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { handleActions } from 'redux-actions';
-import {
-  fetchedPolicies,
-  policyFilterChanged,
-  policyPageChanged,
-  policyPageSizeChanged,
-  policySortChanged,
-} from '../actions';
-
-const defaultState = {
-  isLoading: false,
-  isLoaded: false,
-  originalPolicyName: undefined,
-  selectedPolicySet: false,
-  policies: [],
-  sort: {
-    sortField: 'name',
-    isSortAscending: true,
-  },
-  pageSize: 10,
-  currentPage: 0,
-  filter: '',
-};
-
-export const policies = handleActions(
-  {
-    [fetchedPolicies](state, { payload: policies }) {
-      return {
-        ...state,
-        isLoading: false,
-        isLoaded: true,
-        policies,
-      };
-    },
-    [policyFilterChanged](state, action) {
-      const { filter } = action.payload;
-      return {
-        ...state,
-        filter,
-        currentPage: 0,
-      };
-    },
-    [policySortChanged](state, action) {
-      const { sortField, isSortAscending } = action.payload;
-
-      return {
-        ...state,
-        sort: {
-          sortField,
-          isSortAscending,
-        },
-      };
-    },
-    [policyPageChanged](state, action) {
-      const { pageNumber } = action.payload;
-      return {
-        ...state,
-        currentPage: pageNumber,
-      };
-    },
-    [policyPageSizeChanged](state, action) {
-      const { pageSize } = action.payload;
-      return {
-        ...state,
-        pageSize,
-      };
-    },
-  },
-  defaultState
-);
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/store/selectors/index.js b/x-pack/plugins/index_lifecycle_management/public/application/store/selectors/index.js
deleted file mode 100644
index fef79c7782bb05..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/store/selectors/index.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export * from './policies';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/store/selectors/policies.js b/x-pack/plugins/index_lifecycle_management/public/application/store/selectors/policies.js
deleted file mode 100644
index e1c89314a2ec56..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/store/selectors/policies.js
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { createSelector } from 'reselect';
-import { Pager } from '@elastic/eui';
-
-import { filterItems, sortTable } from '../../services';
-
-export const getPolicies = (state) => state.policies.policies;
-export const getPolicyFilter = (state) => state.policies.filter;
-export const getPolicySort = (state) => state.policies.sort;
-export const getPolicyCurrentPage = (state) => state.policies.currentPage;
-export const getPolicyPageSize = (state) => state.policies.pageSize;
-export const isPolicyListLoaded = (state) => state.policies.isLoaded;
-
-const getFilteredPolicies = createSelector(getPolicies, getPolicyFilter, (policies, filter) => {
-  return filterItems(['name'], filter, policies);
-});
-export const getTotalPolicies = createSelector(getFilteredPolicies, (filteredPolicies) => {
-  return filteredPolicies.length;
-});
-export const getPolicyPager = createSelector(
-  getPolicyCurrentPage,
-  getPolicyPageSize,
-  getTotalPolicies,
-  (currentPage, pageSize, totalPolicies) => {
-    return new Pager(totalPolicies, pageSize, currentPage);
-  }
-);
-export const getPageOfPolicies = createSelector(
-  getFilteredPolicies,
-  getPolicySort,
-  getPolicyPager,
-  (filteredPolicies, sort, pager) => {
-    const sortedPolicies = sortTable(filteredPolicies, sort.sortField, sort.isSortAscending);
-    const { firstItemIndex, lastItemIndex } = pager;
-    return sortedPolicies.slice(firstItemIndex, lastItemIndex + 1);
-  }
-);
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/store/store.js b/x-pack/plugins/index_lifecycle_management/public/application/store/store.js
deleted file mode 100644
index c5774a3da238a5..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/store/store.js
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { createStore, applyMiddleware, compose } from 'redux';
-import thunk from 'redux-thunk';
-
-import { indexLifecycleManagement } from './reducers/';
-
-export const indexLifecycleManagementStore = (initialState = {}) => {
-  const enhancers = [applyMiddleware(thunk)];
-
-  window.__REDUX_DEVTOOLS_EXTENSION__ && enhancers.push(window.__REDUX_DEVTOOLS_EXTENSION__());
-  return createStore(indexLifecycleManagement, initialState, compose(...enhancers));
-};
diff --git a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/add_lifecycle_confirm_modal.js b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/add_lifecycle_confirm_modal.js
deleted file mode 100644
index 0bd313c9a9f8d9..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/add_lifecycle_confirm_modal.js
+++ /dev/null
@@ -1,289 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { Component, Fragment } from 'react';
-import { get } from 'lodash';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import {
-  EuiLink,
-  EuiSelect,
-  EuiForm,
-  EuiFormRow,
-  EuiOverlayMask,
-  EuiConfirmModal,
-  EuiModal,
-  EuiModalBody,
-  EuiModalHeader,
-  EuiCallOut,
-  EuiSpacer,
-  EuiModalHeaderTitle,
-} from '@elastic/eui';
-
-import { loadPolicies, addLifecyclePolicyToIndex } from '../../application/services/api';
-import { showApiError } from '../../application/services/api_errors';
-import { toasts } from '../../application/services/notification';
-
-export class AddLifecyclePolicyConfirmModal extends Component {
-  constructor(props) {
-    super(props);
-    this.state = {
-      policies: [],
-      selectedPolicyName: '',
-      selectedAlias: '',
-    };
-  }
-  addPolicy = async () => {
-    const { indexName, closeModal, reloadIndices } = this.props;
-    const { selectedPolicyName, selectedAlias } = this.state;
-    if (!selectedPolicyName) {
-      this.setState({
-        policyError: i18n.translate(
-          'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.noPolicySelectedErrorMessage',
-          { defaultMessage: 'You must select a policy.' }
-        ),
-      });
-      return;
-    }
-    try {
-      const body = {
-        indexName,
-        policyName: selectedPolicyName,
-        alias: selectedAlias,
-      };
-      await addLifecyclePolicyToIndex(body);
-      closeModal();
-      toasts.addSuccess(
-        i18n.translate(
-          'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyToIndexSuccess',
-          {
-            defaultMessage: 'Added policy {policyName} to index {indexName}.',
-            values: {
-              policyName: selectedPolicyName,
-              indexName,
-            },
-          }
-        )
-      );
-      reloadIndices();
-    } catch (err) {
-      showApiError(
-        err,
-        i18n.translate(
-          'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyToIndexError',
-          {
-            defaultMessage: 'Error adding policy to index',
-          }
-        )
-      );
-    }
-  };
-  renderAliasFormElement = (selectedPolicy) => {
-    const { selectedAlias } = this.state;
-    const { index } = this.props;
-    const showAliasSelect =
-      selectedPolicy && get(selectedPolicy, 'policy.phases.hot.actions.rollover');
-    if (!showAliasSelect) {
-      return null;
-    }
-    const { aliases } = index;
-    if (aliases === 'none') {
-      return (
-        <Fragment>
-          <EuiSpacer size="m" />
-          <EuiCallOut
-            style={{ maxWidth: 400 }}
-            title={
-              <FormattedMessage
-                id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.indexHasNoAliasesWarningTitle"
-                defaultMessage="Index has no aliases"
-              />
-            }
-            color="warning"
-          >
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.indexHasNoAliasesWarningMessage"
-              defaultMessage="Policy {policyName} is configured for rollover,
-                but index {indexName} does not have an alias, which is required for rollover."
-              values={{
-                policyName: selectedPolicy.name,
-                indexName: index.name,
-              }}
-            />
-          </EuiCallOut>
-        </Fragment>
-      );
-    }
-    const aliasOptions = aliases.map((alias) => {
-      return {
-        text: alias,
-        value: alias,
-      };
-    });
-    aliasOptions.unshift({
-      text: i18n.translate(
-        'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.chooseAliasMessage',
-        {
-          defaultMessage: 'Choose an alias',
-        }
-      ),
-      value: '',
-    });
-    return (
-      <EuiFormRow
-        label={
-          <FormattedMessage
-            id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.chooseAliasLabel"
-            defaultMessage="Index rollover alias"
-          />
-        }
-      >
-        <EuiSelect
-          options={aliasOptions}
-          value={selectedAlias}
-          onChange={(e) => {
-            this.setState({ selectedAlias: e.target.value });
-          }}
-        />
-      </EuiFormRow>
-    );
-  };
-  renderForm() {
-    const { policies, selectedPolicyName, policyError } = this.state;
-    const selectedPolicy = selectedPolicyName
-      ? policies.find((policy) => policy.name === selectedPolicyName)
-      : null;
-
-    const options = policies.map(({ name }) => {
-      return {
-        value: name,
-        text: name,
-      };
-    });
-    options.unshift({
-      value: '',
-      text: i18n.translate(
-        'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.choosePolicyMessage',
-        {
-          defaultMessage: 'Select a lifecycle policy',
-        }
-      ),
-    });
-    return (
-      <EuiForm>
-        <EuiFormRow
-          isInvalid={!!policyError}
-          error={policyError}
-          label={
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.choosePolicyLabel"
-              defaultMessage="Lifecycle policy"
-            />
-          }
-        >
-          <EuiSelect
-            options={options}
-            value={selectedPolicyName}
-            onChange={(e) => {
-              this.setState({ policyError: null, selectedPolicyName: e.target.value });
-            }}
-          />
-        </EuiFormRow>
-        {this.renderAliasFormElement(selectedPolicy)}
-      </EuiForm>
-    );
-  }
-  async componentDidMount() {
-    try {
-      const policies = await loadPolicies(false, this.props.httpClient);
-      this.setState({ policies });
-    } catch (err) {
-      showApiError(
-        err,
-        i18n.translate(
-          'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.loadPolicyError',
-          {
-            defaultMessage: 'Error loading policy list',
-          }
-        )
-      );
-      this.props.closeModal();
-    }
-  }
-  render() {
-    const { policies } = this.state;
-    const { indexName, closeModal, getUrlForApp } = this.props;
-    const title = (
-      <FormattedMessage
-        id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.modalTitle"
-        defaultMessage='Add lifecycle policy to "{indexName}"'
-        values={{
-          indexName,
-        }}
-      />
-    );
-    if (!policies.length) {
-      return (
-        <EuiOverlayMask>
-          <EuiModal onClose={closeModal}>
-            <EuiModalHeader>
-              <EuiModalHeaderTitle>{title}</EuiModalHeaderTitle>
-            </EuiModalHeader>
-
-            <EuiModalBody>
-              <EuiCallOut
-                style={{ maxWidth: 400 }}
-                title={
-                  <FormattedMessage
-                    id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.noPoliciesWarningTitle"
-                    defaultMessage="No index lifecycle policies defined"
-                  />
-                }
-                color="warning"
-              >
-                <p>
-                  <EuiLink
-                    href={getUrlForApp('management', {
-                      path: `data/index_lifecycle_management/policies/edit`,
-                    })}
-                  >
-                    <FormattedMessage
-                      id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.defineLifecyclePolicyLinkText"
-                      defaultMessage="Define lifecycle policy"
-                    />
-                  </EuiLink>
-                </p>
-              </EuiCallOut>
-            </EuiModalBody>
-          </EuiModal>
-        </EuiOverlayMask>
-      );
-    }
-    return (
-      <EuiOverlayMask>
-        <EuiConfirmModal
-          title={title}
-          onCancel={closeModal}
-          onConfirm={this.addPolicy}
-          cancelButtonText={
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.cancelButtonText"
-              defaultMessage="Cancel"
-            />
-          }
-          confirmButtonText={
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyButtonText"
-              defaultMessage="Add policy"
-            />
-          }
-        >
-          {this.renderForm()}
-        </EuiConfirmModal>
-      </EuiOverlayMask>
-    );
-  }
-}
diff --git a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/add_lifecycle_confirm_modal.tsx b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/add_lifecycle_confirm_modal.tsx
new file mode 100644
index 00000000000000..54b09b95c51ec7
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/add_lifecycle_confirm_modal.tsx
@@ -0,0 +1,307 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { Component, Fragment } from 'react';
+import { get } from 'lodash';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { ApplicationStart } from 'kibana/public';
+
+import {
+  EuiLink,
+  EuiSelect,
+  EuiForm,
+  EuiFormRow,
+  EuiOverlayMask,
+  EuiConfirmModal,
+  EuiModal,
+  EuiModalBody,
+  EuiModalHeader,
+  EuiCallOut,
+  EuiSpacer,
+  EuiModalHeaderTitle,
+} from '@elastic/eui';
+
+import { loadPolicies, addLifecyclePolicyToIndex } from '../../application/services/api';
+import { showApiError } from '../../application/services/api_errors';
+import { toasts } from '../../application/services/notification';
+import { Index, PolicyFromES } from '../../../common/types';
+
+interface Props {
+  indexName: string;
+  closeModal: () => void;
+  index: Index;
+  reloadIndices: () => void;
+  getUrlForApp: ApplicationStart['getUrlForApp'];
+}
+
+interface State {
+  selectedPolicyName: string;
+  selectedAlias: string;
+  policies: PolicyFromES[];
+  policyErrorMessage?: string;
+}
+
+export class AddLifecyclePolicyConfirmModal extends Component<Props, State> {
+  constructor(props: Props) {
+    super(props);
+    this.state = {
+      policies: [],
+      selectedPolicyName: '',
+      selectedAlias: '',
+    };
+  }
+  addPolicy = async () => {
+    const { indexName, closeModal, reloadIndices } = this.props;
+    const { selectedPolicyName, selectedAlias } = this.state;
+    if (!selectedPolicyName) {
+      this.setState({
+        policyErrorMessage: i18n.translate(
+          'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.noPolicySelectedErrorMessage',
+          { defaultMessage: 'You must select a policy.' }
+        ),
+      });
+      return;
+    }
+    try {
+      const body = {
+        indexName,
+        policyName: selectedPolicyName,
+        alias: selectedAlias,
+      };
+      await addLifecyclePolicyToIndex(body);
+      closeModal();
+      toasts.addSuccess(
+        i18n.translate(
+          'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyToIndexSuccess',
+          {
+            defaultMessage: 'Added policy {policyName} to index {indexName}.',
+            values: {
+              policyName: selectedPolicyName,
+              indexName,
+            },
+          }
+        )
+      );
+      reloadIndices();
+    } catch (err) {
+      showApiError(
+        err,
+        i18n.translate(
+          'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyToIndexError',
+          {
+            defaultMessage: 'Error adding policy to index',
+          }
+        )
+      );
+    }
+  };
+  renderAliasFormElement = (selectedPolicy?: PolicyFromES) => {
+    const { selectedAlias } = this.state;
+    const { index } = this.props;
+    const showAliasSelect =
+      selectedPolicy && get(selectedPolicy, 'policy.phases.hot.actions.rollover');
+    if (!showAliasSelect) {
+      return null;
+    }
+    const { aliases } = index;
+    if (aliases === 'none') {
+      return (
+        <Fragment>
+          <EuiSpacer size="m" />
+          <EuiCallOut
+            style={{ maxWidth: 400 }}
+            title={
+              <FormattedMessage
+                id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.indexHasNoAliasesWarningTitle"
+                defaultMessage="Index has no aliases"
+              />
+            }
+            color="warning"
+          >
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.indexHasNoAliasesWarningMessage"
+              defaultMessage="Policy {policyName} is configured for rollover,
+                but index {indexName} does not have an alias, which is required for rollover."
+              values={{
+                policyName: selectedPolicy?.name,
+                indexName: index.name,
+              }}
+            />
+          </EuiCallOut>
+        </Fragment>
+      );
+    }
+    const aliasOptions = (aliases as string[]).map((alias: string) => {
+      return {
+        text: alias,
+        value: alias,
+      };
+    });
+    aliasOptions.unshift({
+      text: i18n.translate(
+        'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.chooseAliasMessage',
+        {
+          defaultMessage: 'Choose an alias',
+        }
+      ),
+      value: '',
+    });
+    return (
+      <EuiFormRow
+        label={
+          <FormattedMessage
+            id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.chooseAliasLabel"
+            defaultMessage="Index rollover alias"
+          />
+        }
+      >
+        <EuiSelect
+          options={aliasOptions}
+          value={selectedAlias}
+          onChange={(e) => {
+            this.setState({ selectedAlias: e.target.value });
+          }}
+        />
+      </EuiFormRow>
+    );
+  };
+  renderForm() {
+    const { policies, selectedPolicyName, policyErrorMessage } = this.state;
+    const selectedPolicy = selectedPolicyName
+      ? policies.find((policy) => policy.name === selectedPolicyName)
+      : undefined;
+
+    const options = policies.map(({ name }) => {
+      return {
+        value: name,
+        text: name,
+      };
+    });
+    options.unshift({
+      value: '',
+      text: i18n.translate(
+        'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.choosePolicyMessage',
+        {
+          defaultMessage: 'Select a lifecycle policy',
+        }
+      ),
+    });
+    return (
+      <EuiForm>
+        <EuiFormRow
+          isInvalid={!!policyErrorMessage}
+          error={policyErrorMessage}
+          label={
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.choosePolicyLabel"
+              defaultMessage="Lifecycle policy"
+            />
+          }
+        >
+          <EuiSelect
+            options={options}
+            value={selectedPolicyName}
+            onChange={(e) => {
+              this.setState({ policyErrorMessage: undefined, selectedPolicyName: e.target.value });
+            }}
+          />
+        </EuiFormRow>
+        {this.renderAliasFormElement(selectedPolicy)}
+      </EuiForm>
+    );
+  }
+  async componentDidMount() {
+    try {
+      const policies = await loadPolicies(false);
+      this.setState({ policies });
+    } catch (err) {
+      showApiError(
+        err,
+        i18n.translate(
+          'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.loadPolicyError',
+          {
+            defaultMessage: 'Error loading policy list',
+          }
+        )
+      );
+      this.props.closeModal();
+    }
+  }
+  render() {
+    const { policies } = this.state;
+    const { indexName, closeModal, getUrlForApp } = this.props;
+    const title = (
+      <FormattedMessage
+        id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.modalTitle"
+        defaultMessage='Add lifecycle policy to "{indexName}"'
+        values={{
+          indexName,
+        }}
+      />
+    );
+    if (!policies.length) {
+      return (
+        <EuiOverlayMask>
+          <EuiModal onClose={closeModal}>
+            <EuiModalHeader>
+              <EuiModalHeaderTitle>{title}</EuiModalHeaderTitle>
+            </EuiModalHeader>
+
+            <EuiModalBody>
+              <EuiCallOut
+                style={{ maxWidth: 400 }}
+                title={
+                  <FormattedMessage
+                    id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.noPoliciesWarningTitle"
+                    defaultMessage="No index lifecycle policies defined"
+                  />
+                }
+                color="warning"
+              >
+                <p>
+                  <EuiLink
+                    href={getUrlForApp('management', {
+                      path: `data/index_lifecycle_management/policies/edit`,
+                    })}
+                  >
+                    <FormattedMessage
+                      id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.defineLifecyclePolicyLinkText"
+                      defaultMessage="Define lifecycle policy"
+                    />
+                  </EuiLink>
+                </p>
+              </EuiCallOut>
+            </EuiModalBody>
+          </EuiModal>
+        </EuiOverlayMask>
+      );
+    }
+    return (
+      <EuiOverlayMask>
+        <EuiConfirmModal
+          title={title}
+          onCancel={closeModal}
+          onConfirm={this.addPolicy}
+          cancelButtonText={
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.cancelButtonText"
+              defaultMessage="Cancel"
+            />
+          }
+          confirmButtonText={
+            <FormattedMessage
+              id="xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyButtonText"
+              defaultMessage="Add policy"
+            />
+          }
+        >
+          {this.renderForm()}
+        </EuiConfirmModal>
+      </EuiOverlayMask>
+    );
+  }
+}
diff --git a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.js b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.js
deleted file mode 100644
index 9e9dc009e4c406..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.js
+++ /dev/null
@@ -1,262 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { Component, Fragment } from 'react';
-import moment from 'moment-timezone';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import {
-  EuiButtonEmpty,
-  EuiCallOut,
-  EuiCodeBlock,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiDescriptionList,
-  EuiDescriptionListTitle,
-  EuiDescriptionListDescription,
-  EuiSpacer,
-  EuiTitle,
-  EuiLink,
-  EuiPopover,
-  EuiPopoverTitle,
-} from '@elastic/eui';
-
-import { getPolicyPath } from '../../application/services/navigation';
-
-const getHeaders = () => {
-  return {
-    policy: i18n.translate(
-      'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.lifecyclePolicyHeader',
-      {
-        defaultMessage: 'Lifecycle policy',
-      }
-    ),
-    phase: i18n.translate(
-      'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentPhaseHeader',
-      {
-        defaultMessage: 'Current phase',
-      }
-    ),
-    action: i18n.translate(
-      'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionHeader',
-      {
-        defaultMessage: 'Current action',
-      }
-    ),
-    action_time_millis: i18n.translate(
-      'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionTimeHeader',
-      {
-        defaultMessage: 'Current action time',
-      }
-    ),
-    failed_step: i18n.translate(
-      'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.failedStepHeader',
-      {
-        defaultMessage: 'Failed step',
-      }
-    ),
-  };
-};
-export class IndexLifecycleSummary extends Component {
-  constructor(props) {
-    super(props);
-    this.state = {
-      showStackPopover: false,
-      showPhaseExecutionPopover: false,
-    };
-  }
-  toggleStackPopover = () => {
-    this.setState({ showStackPopover: !this.state.showStackPopover });
-  };
-  closeStackPopover = () => {
-    this.setState({ showStackPopover: false });
-  };
-  togglePhaseExecutionPopover = () => {
-    this.setState({ showPhaseExecutionPopover: !this.state.showPhaseExecutionPopover });
-  };
-  closePhaseExecutionPopover = () => {
-    this.setState({ showPhaseExecutionPopover: false });
-  };
-  renderStackPopoverButton(ilm) {
-    if (!ilm.stack_trace) {
-      return null;
-    }
-    const button = (
-      <EuiButtonEmpty onClick={this.toggleStackPopover}>
-        <FormattedMessage
-          defaultMessage="Stack trace"
-          id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.stackTraceButton"
-        />
-      </EuiButtonEmpty>
-    );
-    return (
-      <EuiPopover
-        id="stackPopover"
-        button={button}
-        isOpen={this.state.showStackPopover}
-        closePopover={this.closeStackPopover}
-      >
-        <div style={{ maxHeight: '400px', width: '900px', overflowY: 'scroll' }}>
-          <pre>{ilm.step_info.stack_trace}</pre>
-        </div>
-      </EuiPopover>
-    );
-  }
-  renderPhaseExecutionPopoverButton(ilm) {
-    if (!ilm.phase_execution) {
-      return null;
-    }
-    const button = (
-      <EuiLink onClick={this.togglePhaseExecutionPopover}>
-        <FormattedMessage
-          defaultMessage="Show definition"
-          id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionButton"
-        />
-      </EuiLink>
-    );
-    return (
-      <Fragment key="phaseDefinition">
-        <EuiDescriptionListTitle>
-          <strong>
-            <FormattedMessage
-              defaultMessage="Phase definition"
-              id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionDescriptionTitle"
-            />
-          </strong>
-        </EuiDescriptionListTitle>
-        <EuiDescriptionListDescription key="phaseDefinition_desc">
-          <EuiPopover
-            key="phaseExecutionPopover"
-            id="phaseExecutionPopover"
-            button={button}
-            isOpen={this.state.showPhaseExecutionPopover}
-            closePopover={this.closePhaseExecutionPopover}
-            withTitle
-          >
-            <EuiPopoverTitle>
-              <FormattedMessage
-                defaultMessage="Phase definition"
-                id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.phaseDefinitionTitle"
-              />
-            </EuiPopoverTitle>
-            <EuiCodeBlock lang="json">{JSON.stringify(ilm.phase_execution, null, 2)}</EuiCodeBlock>
-          </EuiPopover>
-        </EuiDescriptionListDescription>
-      </Fragment>
-    );
-  }
-  buildRows() {
-    const {
-      index: { ilm = {} },
-    } = this.props;
-    const headers = getHeaders();
-    const rows = {
-      left: [],
-      right: [],
-    };
-    Object.keys(headers).forEach((fieldName, arrayIndex) => {
-      const value = ilm[fieldName];
-      let content;
-      if (fieldName === 'action_time_millis') {
-        content = moment(value).format('YYYY-MM-DD HH:mm:ss');
-      } else if (fieldName === 'policy') {
-        content = (
-          <EuiLink
-            href={this.props.getUrlForApp('management', {
-              path: `data/index_lifecycle_management/${getPolicyPath(value)}`,
-            })}
-          >
-            {value}
-          </EuiLink>
-        );
-      } else {
-        content = value;
-      }
-      content = content || '-';
-      const cell = [
-        <EuiDescriptionListTitle key={fieldName}>
-          <strong>{headers[fieldName]}</strong>
-        </EuiDescriptionListTitle>,
-        <EuiDescriptionListDescription key={fieldName + '_desc'}>
-          {content}
-        </EuiDescriptionListDescription>,
-      ];
-      if (arrayIndex % 2 === 0) {
-        rows.left.push(cell);
-      } else {
-        rows.right.push(cell);
-      }
-    });
-    rows.right.push(this.renderPhaseExecutionPopoverButton(ilm));
-    return rows;
-  }
-
-  render() {
-    const {
-      index: { ilm = {} },
-    } = this.props;
-    if (!ilm.managed) {
-      return null;
-    }
-    const { left, right } = this.buildRows();
-    return (
-      <Fragment>
-        <EuiTitle size="s">
-          <h3>
-            <FormattedMessage
-              defaultMessage="Index lifecycle management"
-              id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryTitle"
-            />
-          </h3>
-        </EuiTitle>
-        {ilm.step_info && ilm.step_info.type ? (
-          <Fragment>
-            <EuiSpacer size="s" />
-            <EuiCallOut
-              color="danger"
-              title={
-                <FormattedMessage
-                  defaultMessage="Index lifecycle error"
-                  id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryErrorMessage"
-                />
-              }
-              iconType="cross"
-            >
-              {ilm.step_info.type}: {ilm.step_info.reason}
-              <EuiSpacer size="s" />
-              {this.renderStackPopoverButton(ilm)}
-            </EuiCallOut>
-          </Fragment>
-        ) : null}
-        {ilm.step_info && ilm.step_info.message && !ilm.step_info.stack_trace ? (
-          <Fragment>
-            <EuiSpacer size="s" />
-            <EuiCallOut
-              color="primary"
-              title={
-                <FormattedMessage
-                  defaultMessage="Action status"
-                  id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.actionStatusTitle"
-                />
-              }
-            >
-              {ilm.step_info.message}
-            </EuiCallOut>
-          </Fragment>
-        ) : null}
-        <EuiSpacer size="m" />
-        <EuiFlexGroup>
-          <EuiFlexItem>
-            <EuiDescriptionList type="column">{left}</EuiDescriptionList>
-          </EuiFlexItem>
-          <EuiFlexItem>
-            <EuiDescriptionList type="column">{right}</EuiDescriptionList>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </Fragment>
-    );
-  }
-}
diff --git a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.tsx b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.tsx
new file mode 100644
index 00000000000000..ce36a3650c2ff3
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.tsx
@@ -0,0 +1,293 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { Component, Fragment } from 'react';
+import moment from 'moment-timezone';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiButtonEmpty,
+  EuiCallOut,
+  EuiCodeBlock,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiDescriptionList,
+  EuiDescriptionListTitle,
+  EuiDescriptionListDescription,
+  EuiSpacer,
+  EuiTitle,
+  EuiLink,
+  EuiPopover,
+  EuiPopoverTitle,
+} from '@elastic/eui';
+
+import { ApplicationStart } from 'kibana/public';
+import { getPolicyPath } from '../../application/services/navigation';
+import { Index, IndexLifecyclePolicy } from '../../../common/types';
+
+const getHeaders = (): Array<[keyof IndexLifecyclePolicy, string]> => {
+  return [
+    [
+      'policy',
+      i18n.translate(
+        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.lifecyclePolicyHeader',
+        {
+          defaultMessage: 'Lifecycle policy',
+        }
+      ),
+    ],
+    [
+      'phase',
+      i18n.translate(
+        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentPhaseHeader',
+        {
+          defaultMessage: 'Current phase',
+        }
+      ),
+    ],
+    [
+      'action',
+      i18n.translate(
+        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionHeader',
+        {
+          defaultMessage: 'Current action',
+        }
+      ),
+    ],
+    [
+      'action_time_millis',
+      i18n.translate(
+        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionTimeHeader',
+        {
+          defaultMessage: 'Current action time',
+        }
+      ),
+    ],
+    [
+      'failed_step',
+      i18n.translate(
+        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.failedStepHeader',
+        {
+          defaultMessage: 'Failed step',
+        }
+      ),
+    ],
+  ];
+};
+
+interface Props {
+  index: Index;
+  getUrlForApp: ApplicationStart['getUrlForApp'];
+}
+interface State {
+  showStackPopover: boolean;
+  showPhaseExecutionPopover: boolean;
+}
+
+export class IndexLifecycleSummary extends Component<Props, State> {
+  constructor(props: Props) {
+    super(props);
+    this.state = {
+      showStackPopover: false,
+      showPhaseExecutionPopover: false,
+    };
+  }
+  toggleStackPopover = () => {
+    this.setState({ showStackPopover: !this.state.showStackPopover });
+  };
+  closeStackPopover = () => {
+    this.setState({ showStackPopover: false });
+  };
+  togglePhaseExecutionPopover = () => {
+    this.setState({ showPhaseExecutionPopover: !this.state.showPhaseExecutionPopover });
+  };
+  closePhaseExecutionPopover = () => {
+    this.setState({ showPhaseExecutionPopover: false });
+  };
+  renderStackPopoverButton(ilm: IndexLifecyclePolicy) {
+    if (!ilm.step_info!.stack_trace) {
+      return null;
+    }
+    const button = (
+      <EuiButtonEmpty onClick={this.toggleStackPopover}>
+        <FormattedMessage
+          defaultMessage="Stack trace"
+          id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.stackTraceButton"
+        />
+      </EuiButtonEmpty>
+    );
+    return (
+      <EuiPopover
+        id="stackPopover"
+        button={button}
+        isOpen={this.state.showStackPopover}
+        closePopover={this.closeStackPopover}
+      >
+        <div style={{ maxHeight: '400px', width: '900px', overflowY: 'scroll' }}>
+          <pre>{ilm.step_info!.stack_trace}</pre>
+        </div>
+      </EuiPopover>
+    );
+  }
+  renderPhaseExecutionPopoverButton(ilm: IndexLifecyclePolicy) {
+    const button = (
+      <EuiLink onClick={this.togglePhaseExecutionPopover}>
+        <FormattedMessage
+          defaultMessage="Show definition"
+          id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionButton"
+        />
+      </EuiLink>
+    );
+    return (
+      <Fragment key="phaseDefinition">
+        <EuiDescriptionListTitle>
+          <strong>
+            <FormattedMessage
+              defaultMessage="Phase definition"
+              id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionDescriptionTitle"
+            />
+          </strong>
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription key="phaseDefinition_desc">
+          <EuiPopover
+            key="phaseExecutionPopover"
+            id="phaseExecutionPopover"
+            button={button}
+            isOpen={this.state.showPhaseExecutionPopover}
+            closePopover={this.closePhaseExecutionPopover}
+            withTitle
+          >
+            <EuiPopoverTitle>
+              <FormattedMessage
+                defaultMessage="Phase definition"
+                id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.phaseDefinitionTitle"
+              />
+            </EuiPopoverTitle>
+            <EuiCodeBlock lang="json">{JSON.stringify(ilm.phase_execution, null, 2)}</EuiCodeBlock>
+          </EuiPopover>
+        </EuiDescriptionListDescription>
+      </Fragment>
+    );
+  }
+  buildRows() {
+    const {
+      index: { ilm },
+    } = this.props;
+    const headers = getHeaders();
+    const rows: {
+      left: JSX.Element[];
+      right: JSX.Element[];
+    } = {
+      left: [],
+      right: [],
+    };
+    headers.forEach(([fieldName, label], arrayIndex) => {
+      const value: any = ilm[fieldName];
+      let content;
+      if (fieldName === 'action_time_millis') {
+        content = moment(value).format('YYYY-MM-DD HH:mm:ss');
+      } else if (fieldName === 'policy') {
+        content = (
+          <EuiLink
+            href={this.props.getUrlForApp('management', {
+              path: `data/index_lifecycle_management/${getPolicyPath(value)}`,
+            })}
+          >
+            {value}
+          </EuiLink>
+        );
+      } else {
+        content = value;
+      }
+      content = content || '-';
+      const cell = (
+        <>
+          <EuiDescriptionListTitle key={fieldName}>
+            <strong>{label}</strong>
+          </EuiDescriptionListTitle>
+          <EuiDescriptionListDescription key={fieldName + '_desc'}>
+            {content}
+          </EuiDescriptionListDescription>
+        </>
+      );
+      if (arrayIndex % 2 === 0) {
+        rows.left.push(cell);
+      } else {
+        rows.right.push(cell);
+      }
+    });
+    if (ilm.phase_execution) {
+      rows.right.push(this.renderPhaseExecutionPopoverButton(ilm));
+    }
+    return rows;
+  }
+
+  render() {
+    const {
+      index: { ilm },
+    } = this.props;
+    if (!ilm.managed) {
+      return null;
+    }
+    const { left, right } = this.buildRows();
+    return (
+      <>
+        <EuiTitle size="s">
+          <h3>
+            <FormattedMessage
+              defaultMessage="Index lifecycle management"
+              id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryTitle"
+            />
+          </h3>
+        </EuiTitle>
+        {ilm.step_info && ilm.step_info.type ? (
+          <>
+            <EuiSpacer size="s" />
+            <EuiCallOut
+              color="danger"
+              title={
+                <FormattedMessage
+                  defaultMessage="Index lifecycle error"
+                  id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryErrorMessage"
+                />
+              }
+              iconType="cross"
+            >
+              {ilm.step_info.type}: {ilm.step_info.reason}
+              <EuiSpacer size="s" />
+              {this.renderStackPopoverButton(ilm)}
+            </EuiCallOut>
+          </>
+        ) : null}
+        {ilm.step_info && ilm.step_info!.message && !ilm.step_info!.stack_trace ? (
+          <>
+            <EuiSpacer size="s" />
+            <EuiCallOut
+              color="primary"
+              title={
+                <FormattedMessage
+                  defaultMessage="Action status"
+                  id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.actionStatusTitle"
+                />
+              }
+            >
+              {ilm.step_info!.message}
+            </EuiCallOut>
+          </>
+        ) : null}
+        <EuiSpacer size="m" />
+        <EuiFlexGroup>
+          <EuiFlexItem>
+            <EuiDescriptionList type="column">{left}</EuiDescriptionList>
+          </EuiFlexItem>
+          <EuiFlexItem>
+            <EuiDescriptionList type="column">{right}</EuiDescriptionList>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </>
+    );
+  }
+}
diff --git a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/index.d.ts b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/index.d.ts
deleted file mode 100644
index 086ba677031225..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/index.d.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export declare const addAllExtensions: any;
diff --git a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/index.js b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/index.js
deleted file mode 100644
index 8d01f4a4c200e9..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/index.js
+++ /dev/null
@@ -1,211 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { get, every, some } from 'lodash';
-import { i18n } from '@kbn/i18n';
-import { EuiSearchBar } from '@elastic/eui';
-
-import { retryLifecycleForIndex } from '../application/services/api';
-import { IndexLifecycleSummary } from './components/index_lifecycle_summary';
-import { AddLifecyclePolicyConfirmModal } from './components/add_lifecycle_confirm_modal';
-import { RemoveLifecyclePolicyConfirmModal } from './components/remove_lifecycle_confirm_modal';
-
-const stepPath = 'ilm.step';
-
-export const retryLifecycleActionExtension = ({ indices }) => {
-  const allHaveErrors = every(indices, (index) => {
-    return index.ilm && index.ilm.failed_step;
-  });
-  if (!allHaveErrors) {
-    return null;
-  }
-  const indexNames = indices.map(({ name }) => name);
-  return {
-    requestMethod: retryLifecycleForIndex,
-    icon: 'play',
-    indexNames: [indexNames],
-    buttonLabel: i18n.translate('xpack.indexLifecycleMgmt.retryIndexLifecycleActionButtonLabel', {
-      defaultMessage: 'Retry lifecycle step',
-    }),
-    successMessage: i18n.translate(
-      'xpack.indexLifecycleMgmt.retryIndexLifecycleAction.retriedLifecycleMessage',
-      {
-        defaultMessage: 'Called retry lifecycle step for: {indexNames}',
-        values: { indexNames: indexNames.map((indexName) => `"${indexName}"`).join(', ') },
-      }
-    ),
-  };
-};
-
-export const removeLifecyclePolicyActionExtension = ({ indices, reloadIndices }) => {
-  const allHaveIlm = every(indices, (index) => {
-    return index.ilm && index.ilm.managed;
-  });
-  if (!allHaveIlm) {
-    return null;
-  }
-  const indexNames = indices.map(({ name }) => name);
-  return {
-    renderConfirmModal: (closeModal) => {
-      return (
-        <RemoveLifecyclePolicyConfirmModal
-          indexNames={indexNames}
-          closeModal={closeModal}
-          reloadIndices={reloadIndices}
-        />
-      );
-    },
-    icon: 'stopFilled',
-    indexNames: [indexNames],
-    buttonLabel: i18n.translate('xpack.indexLifecycleMgmt.removeIndexLifecycleActionButtonLabel', {
-      defaultMessage: 'Remove lifecycle policy',
-    }),
-  };
-};
-
-export const addLifecyclePolicyActionExtension = ({ indices, reloadIndices, getUrlForApp }) => {
-  if (indices.length !== 1) {
-    return null;
-  }
-  const index = indices[0];
-  const hasIlm = index.ilm && index.ilm.managed;
-
-  if (hasIlm) {
-    return null;
-  }
-  const indexName = index.name;
-  return {
-    renderConfirmModal: (closeModal) => {
-      return (
-        <AddLifecyclePolicyConfirmModal
-          indexName={indexName}
-          closeModal={closeModal}
-          index={index}
-          reloadIndices={reloadIndices}
-          getUrlForApp={getUrlForApp}
-        />
-      );
-    },
-    icon: 'plusInCircle',
-    buttonLabel: i18n.translate('xpack.indexLifecycleMgmt.addLifecyclePolicyActionButtonLabel', {
-      defaultMessage: 'Add lifecycle policy',
-    }),
-  };
-};
-
-export const ilmBannerExtension = (indices) => {
-  const { Query } = EuiSearchBar;
-  if (!indices.length) {
-    return null;
-  }
-  const indicesWithLifecycleErrors = indices.filter((index) => {
-    return get(index, stepPath) === 'ERROR';
-  });
-  const numIndicesWithLifecycleErrors = indicesWithLifecycleErrors.length;
-  if (!numIndicesWithLifecycleErrors) {
-    return null;
-  }
-  return {
-    type: 'warning',
-    filter: Query.parse(`${stepPath}:ERROR`),
-    filterLabel: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtBanner.filterLabel', {
-      defaultMessage: 'Show errors',
-    }),
-    title: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtBanner.errorMessage', {
-      defaultMessage: `{ numIndicesWithLifecycleErrors, number}
-          {numIndicesWithLifecycleErrors, plural, one {index has} other {indices have} }
-          lifecycle errors`,
-      values: { numIndicesWithLifecycleErrors },
-    }),
-  };
-};
-
-export const ilmSummaryExtension = (index, getUrlForApp) => {
-  return <IndexLifecycleSummary index={index} getUrlForApp={getUrlForApp} />;
-};
-
-export const ilmFilterExtension = (indices) => {
-  const hasIlm = some(indices, (index) => index.ilm && index.ilm.managed);
-  if (!hasIlm) {
-    return [];
-  } else {
-    return [
-      {
-        type: 'field_value_selection',
-        name: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.lifecycleStatusLabel', {
-          defaultMessage: 'Lifecycle status',
-        }),
-        multiSelect: false,
-        field: 'ilm.managed',
-        options: [
-          {
-            value: true,
-            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.managedLabel', {
-              defaultMessage: 'Managed',
-            }),
-          },
-          {
-            value: false,
-            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.unmanagedLabel', {
-              defaultMessage: 'Unmanaged',
-            }),
-          },
-        ],
-      },
-      {
-        type: 'field_value_selection',
-        field: 'ilm.phase',
-        name: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.lifecyclePhaseLabel', {
-          defaultMessage: 'Lifecycle phase',
-        }),
-        multiSelect: 'or',
-        options: [
-          {
-            value: 'hot',
-            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.hotLabel', {
-              defaultMessage: 'Hot',
-            }),
-          },
-          {
-            value: 'warm',
-            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.warmLabel', {
-              defaultMessage: 'Warm',
-            }),
-          },
-          {
-            value: 'frozen',
-            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.frozenLabel', {
-              defaultMessage: 'Frozen',
-            }),
-          },
-          {
-            value: 'cold',
-            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.coldLabel', {
-              defaultMessage: 'Cold',
-            }),
-          },
-          {
-            value: 'delete',
-            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.deleteLabel', {
-              defaultMessage: 'Delete',
-            }),
-          },
-        ],
-      },
-    ];
-  }
-};
-
-export const addAllExtensions = (extensionsService) => {
-  extensionsService.addAction(retryLifecycleActionExtension);
-  extensionsService.addAction(removeLifecyclePolicyActionExtension);
-  extensionsService.addAction(addLifecyclePolicyActionExtension);
-
-  extensionsService.addBanner(ilmBannerExtension);
-  extensionsService.addSummary(ilmSummaryExtension);
-  extensionsService.addFilter(ilmFilterExtension);
-};
diff --git a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/index.tsx b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/index.tsx
new file mode 100644
index 00000000000000..e36f3769617949
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/index.tsx
@@ -0,0 +1,235 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { get, every, some } from 'lodash';
+import { i18n } from '@kbn/i18n';
+import { EuiSearchBar } from '@elastic/eui';
+import { ApplicationStart } from 'kibana/public';
+
+import { IndexManagementPluginSetup } from '../../../index_management/public';
+
+import { retryLifecycleForIndex } from '../application/services/api';
+import { IndexLifecycleSummary } from './components/index_lifecycle_summary';
+
+import { AddLifecyclePolicyConfirmModal } from './components/add_lifecycle_confirm_modal';
+import { RemoveLifecyclePolicyConfirmModal } from './components/remove_lifecycle_confirm_modal';
+import { Index } from '../../common/types';
+
+const stepPath = 'ilm.step';
+
+export const retryLifecycleActionExtension = ({ indices }: { indices: Index[] }) => {
+  const allHaveErrors = every(indices, (index) => {
+    return index.ilm && index.ilm.failed_step;
+  });
+  if (!allHaveErrors) {
+    return null;
+  }
+  const indexNames = indices.map(({ name }: Index) => name);
+  return {
+    requestMethod: retryLifecycleForIndex,
+    icon: 'play',
+    indexNames: [indexNames],
+    buttonLabel: i18n.translate('xpack.indexLifecycleMgmt.retryIndexLifecycleActionButtonLabel', {
+      defaultMessage: 'Retry lifecycle step',
+    }),
+    successMessage: i18n.translate(
+      'xpack.indexLifecycleMgmt.retryIndexLifecycleAction.retriedLifecycleMessage',
+      {
+        defaultMessage: 'Called retry lifecycle step for: {indexNames}',
+        values: { indexNames: indexNames.map((indexName: string) => `"${indexName}"`).join(', ') },
+      }
+    ),
+  };
+};
+
+export const removeLifecyclePolicyActionExtension = ({
+  indices,
+  reloadIndices,
+}: {
+  indices: Index[];
+  reloadIndices: () => void;
+}) => {
+  const allHaveIlm = every(indices, (index) => {
+    return index.ilm && index.ilm.managed;
+  });
+  if (!allHaveIlm) {
+    return null;
+  }
+  const indexNames = indices.map(({ name }: Index) => name);
+  return {
+    renderConfirmModal: (closeModal: () => void) => {
+      return (
+        <RemoveLifecyclePolicyConfirmModal
+          indexNames={indexNames}
+          closeModal={closeModal}
+          reloadIndices={reloadIndices}
+        />
+      );
+    },
+    icon: 'stopFilled',
+    indexNames: [indexNames],
+    buttonLabel: i18n.translate('xpack.indexLifecycleMgmt.removeIndexLifecycleActionButtonLabel', {
+      defaultMessage: 'Remove lifecycle policy',
+    }),
+  };
+};
+
+export const addLifecyclePolicyActionExtension = ({
+  indices,
+  reloadIndices,
+  getUrlForApp,
+}: {
+  indices: Index[];
+  reloadIndices: () => void;
+  getUrlForApp: ApplicationStart['getUrlForApp'];
+}) => {
+  if (indices.length !== 1) {
+    return null;
+  }
+  const index = indices[0];
+  const hasIlm = index.ilm && index.ilm.managed;
+
+  if (hasIlm) {
+    return null;
+  }
+  const indexName = index.name;
+  return {
+    renderConfirmModal: (closeModal: () => void) => {
+      return (
+        <AddLifecyclePolicyConfirmModal
+          indexName={indexName}
+          closeModal={closeModal}
+          index={index}
+          reloadIndices={reloadIndices}
+          getUrlForApp={getUrlForApp}
+        />
+      );
+    },
+    icon: 'plusInCircle',
+    buttonLabel: i18n.translate('xpack.indexLifecycleMgmt.addLifecyclePolicyActionButtonLabel', {
+      defaultMessage: 'Add lifecycle policy',
+    }),
+  };
+};
+
+export const ilmBannerExtension = (indices: Index[]) => {
+  const { Query } = EuiSearchBar;
+  if (!indices.length) {
+    return null;
+  }
+  const indicesWithLifecycleErrors = indices.filter((index: Index) => {
+    return get(index, stepPath) === 'ERROR';
+  });
+  const numIndicesWithLifecycleErrors = indicesWithLifecycleErrors.length;
+  if (!numIndicesWithLifecycleErrors) {
+    return null;
+  }
+  return {
+    type: 'warning',
+    filter: Query.parse(`${stepPath}:ERROR`),
+    filterLabel: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtBanner.filterLabel', {
+      defaultMessage: 'Show errors',
+    }),
+    title: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtBanner.errorMessage', {
+      defaultMessage: `{ numIndicesWithLifecycleErrors, number}
+          {numIndicesWithLifecycleErrors, plural, one {index has} other {indices have} }
+          lifecycle errors`,
+      values: { numIndicesWithLifecycleErrors },
+    }),
+  };
+};
+
+export const ilmSummaryExtension = (
+  index: Index,
+  getUrlForApp: ApplicationStart['getUrlForApp']
+) => {
+  return <IndexLifecycleSummary index={index} getUrlForApp={getUrlForApp} />;
+};
+
+export const ilmFilterExtension = (indices: Index[]) => {
+  const hasIlm = some(indices, (index) => index.ilm && index.ilm.managed);
+  if (!hasIlm) {
+    return [];
+  } else {
+    return [
+      {
+        type: 'field_value_selection',
+        name: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.lifecycleStatusLabel', {
+          defaultMessage: 'Lifecycle status',
+        }),
+        multiSelect: false,
+        field: 'ilm.managed',
+        options: [
+          {
+            value: true,
+            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.managedLabel', {
+              defaultMessage: 'Managed',
+            }),
+          },
+          {
+            value: false,
+            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.unmanagedLabel', {
+              defaultMessage: 'Unmanaged',
+            }),
+          },
+        ],
+      },
+      {
+        type: 'field_value_selection',
+        field: 'ilm.phase',
+        name: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.lifecyclePhaseLabel', {
+          defaultMessage: 'Lifecycle phase',
+        }),
+        multiSelect: 'or',
+        options: [
+          {
+            value: 'hot',
+            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.hotLabel', {
+              defaultMessage: 'Hot',
+            }),
+          },
+          {
+            value: 'warm',
+            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.warmLabel', {
+              defaultMessage: 'Warm',
+            }),
+          },
+          {
+            value: 'frozen',
+            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.frozenLabel', {
+              defaultMessage: 'Frozen',
+            }),
+          },
+          {
+            value: 'cold',
+            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.coldLabel', {
+              defaultMessage: 'Cold',
+            }),
+          },
+          {
+            value: 'delete',
+            view: i18n.translate('xpack.indexLifecycleMgmt.indexMgmtFilter.deleteLabel', {
+              defaultMessage: 'Delete',
+            }),
+          },
+        ],
+      },
+    ];
+  }
+};
+
+export const addAllExtensions = (
+  extensionsService: IndexManagementPluginSetup['extensionsService']
+) => {
+  extensionsService.addAction(retryLifecycleActionExtension);
+  extensionsService.addAction(removeLifecyclePolicyActionExtension);
+  extensionsService.addAction(addLifecyclePolicyActionExtension);
+
+  extensionsService.addBanner(ilmBannerExtension);
+  extensionsService.addSummary(ilmSummaryExtension);
+  extensionsService.addFilter(ilmFilterExtension);
+};
diff --git a/x-pack/plugins/index_lifecycle_management/server/plugin.ts b/x-pack/plugins/index_lifecycle_management/server/plugin.ts
index ed179255226100..76d8539eb4a07d 100644
--- a/x-pack/plugins/index_lifecycle_management/server/plugin.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/plugin.ts
@@ -15,16 +15,21 @@ import {
   LegacyAPICaller,
 } from 'src/core/server';
 
+import { Index as IndexWithoutIlm } from '../../index_management/common/types';
 import { PLUGIN } from '../common/constants';
+import { Index, IndexLifecyclePolicy } from '../common/types';
 import { Dependencies } from './types';
 import { registerApiRoutes } from './routes';
 import { License } from './services';
 import { IndexLifecycleManagementConfig } from './config';
 import { isEsError } from './shared_imports';
 
-const indexLifecycleDataEnricher = async (indicesList: any, callAsCurrentUser: LegacyAPICaller) => {
+const indexLifecycleDataEnricher = async (
+  indicesList: IndexWithoutIlm[],
+  callAsCurrentUser: LegacyAPICaller
+): Promise<Index[]> => {
   if (!indicesList || !indicesList.length) {
-    return;
+    return [];
   }
 
   const params = {
@@ -32,9 +37,11 @@ const indexLifecycleDataEnricher = async (indicesList: any, callAsCurrentUser: L
     method: 'GET',
   };
 
-  const { indices: ilmIndicesData } = await callAsCurrentUser('transport.request', params);
+  const { indices: ilmIndicesData } = await callAsCurrentUser<{
+    indices: { [indexName: string]: IndexLifecyclePolicy };
+  }>('transport.request', params);
 
-  return indicesList.map((index: any): any => {
+  return indicesList.map((index: IndexWithoutIlm) => {
     return {
       ...index,
       ilm: { ...(ilmIndicesData[index.name] || {}) },
diff --git a/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_fetch_route.ts b/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_fetch_route.ts
index 2dc1ed1006adb8..4fb21ea8c6a62b 100644
--- a/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_fetch_route.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_fetch_route.ts
@@ -7,15 +7,21 @@
 import { schema } from '@kbn/config-schema';
 import { LegacyAPICaller } from 'src/core/server';
 
+import { IndexLifecyclePolicy, PolicyFromES } from '../../../../common/types';
 import { RouteDependencies } from '../../../types';
 import { addBasePath } from '../../../services';
 
-function formatPolicies(policiesMap: any): any {
+type PoliciesMap = {
+  [K: string]: Omit<PolicyFromES, 'name'>;
+} & {
+  status?: number;
+};
+function formatPolicies(policiesMap: PoliciesMap): PolicyFromES[] {
   if (policiesMap.status === 404) {
     return [];
   }
 
-  return Object.keys(policiesMap).reduce((accum: any[], lifecycleName: string) => {
+  return Object.keys(policiesMap).reduce((accum: PolicyFromES[], lifecycleName: string) => {
     const policyEntry = policiesMap[lifecycleName];
     accum.push({
       ...policyEntry,
@@ -25,7 +31,7 @@ function formatPolicies(policiesMap: any): any {
   }, []);
 }
 
-async function fetchPolicies(callAsCurrentUser: LegacyAPICaller): Promise<any> {
+async function fetchPolicies(callAsCurrentUser: LegacyAPICaller): Promise<PoliciesMap> {
   const params = {
     method: 'GET',
     path: '/_ilm/policy',
@@ -36,7 +42,7 @@ async function fetchPolicies(callAsCurrentUser: LegacyAPICaller): Promise<any> {
   return await callAsCurrentUser('transport.request', params);
 }
 
-async function addLinkedIndices(callAsCurrentUser: LegacyAPICaller, policiesMap: any) {
+async function addLinkedIndices(callAsCurrentUser: LegacyAPICaller, policiesMap: PoliciesMap) {
   if (policiesMap.status === 404) {
     return policiesMap;
   }
@@ -47,11 +53,13 @@ async function addLinkedIndices(callAsCurrentUser: LegacyAPICaller, policiesMap:
     ignore: [404],
   };
 
-  const policyExplanation: any = await callAsCurrentUser('transport.request', params);
-  Object.entries(policyExplanation.indices).forEach(([indexName, { policy }]: [string, any]) => {
+  const policyExplanation: {
+    indices: { [indexName: string]: IndexLifecyclePolicy };
+  } = await callAsCurrentUser('transport.request', params);
+  Object.entries(policyExplanation.indices).forEach(([indexName, { policy }]) => {
     if (policy && policiesMap[policy]) {
       policiesMap[policy].linkedIndices = policiesMap[policy].linkedIndices || [];
-      policiesMap[policy].linkedIndices.push(indexName);
+      policiesMap[policy].linkedIndices!.push(indexName);
     }
   });
 }
diff --git a/x-pack/plugins/index_lifecycle_management/server/routes/api/templates/register_add_policy_route.ts b/x-pack/plugins/index_lifecycle_management/server/routes/api/templates/register_add_policy_route.ts
index 21a389b9a0e358..c11d981b33dfe4 100644
--- a/x-pack/plugins/index_lifecycle_management/server/routes/api/templates/register_add_policy_route.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/routes/api/templates/register_add_policy_route.ts
@@ -8,13 +8,14 @@ import { merge } from 'lodash';
 import { schema } from '@kbn/config-schema';
 import { LegacyAPICaller } from 'src/core/server';
 
+import { LegacyTemplateSerialized } from '../../../../../index_management/server';
 import { RouteDependencies } from '../../../types';
 import { addBasePath } from '../../../services';
 
 async function getIndexTemplate(
   callAsCurrentUser: LegacyAPICaller,
   templateName: string
-): Promise<any> {
+): Promise<LegacyTemplateSerialized> {
   const response = await callAsCurrentUser('indices.getTemplate', { name: templateName });
   return response[templateName];
 }
diff --git a/x-pack/plugins/index_lifecycle_management/server/routes/api/templates/register_fetch_route.ts b/x-pack/plugins/index_lifecycle_management/server/routes/api/templates/register_fetch_route.ts
index c8d02783864e1d..afbee246af0d97 100644
--- a/x-pack/plugins/index_lifecycle_management/server/routes/api/templates/register_fetch_route.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/routes/api/templates/register_fetch_route.ts
@@ -5,6 +5,7 @@
  */
 
 import { LegacyAPICaller } from 'src/core/server';
+import { LegacyTemplateSerialized } from '../../../../../index_management/server';
 
 import { RouteDependencies } from '../../../types';
 import { addBasePath } from '../../../services';
@@ -27,7 +28,9 @@ function isReservedSystemTemplate(templateName: string, indexPatterns: string[])
   );
 }
 
-function filterAndFormatTemplates(templates: any): any {
+function filterAndFormatTemplates(templates: {
+  [templateName: string]: LegacyTemplateSerialized;
+}): Array<{}> {
   const formattedTemplates = [];
   const templateNames = Object.keys(templates);
   for (const templateName of templateNames) {
@@ -38,10 +41,10 @@ function filterAndFormatTemplates(templates: any): any {
     }
     const formattedTemplate = {
       index_lifecycle_name:
-        settings.index && settings.index.lifecycle ? settings.index.lifecycle.name : undefined,
+        settings!.index && settings!.index.lifecycle ? settings!.index.lifecycle.name : undefined,
       index_patterns,
       allocation_rules:
-        settings.index && settings.index.routing ? settings.index.routing : undefined,
+        settings!.index && settings!.index.routing ? settings!.index.routing : undefined,
       settings,
       name: templateName,
     };
@@ -50,7 +53,9 @@ function filterAndFormatTemplates(templates: any): any {
   return formattedTemplates;
 }
 
-async function fetchTemplates(callAsCurrentUser: LegacyAPICaller): Promise<any> {
+async function fetchTemplates(
+  callAsCurrentUser: LegacyAPICaller
+): Promise<{ [templateName: string]: LegacyTemplateSerialized }> {
   const params = {
     method: 'GET',
     path: '/_template',
diff --git a/x-pack/plugins/index_management/common/types/indices.ts b/x-pack/plugins/index_management/common/types/indices.ts
index ecf5ba21fe60c1..6e471047ffc202 100644
--- a/x-pack/plugins/index_management/common/types/indices.ts
+++ b/x-pack/plugins/index_management/common/types/indices.ts
@@ -15,6 +15,14 @@ interface IndexModule {
   number_of_replicas: number;
   auto_expand_replicas: false | string;
   lifecycle: LifecycleModule;
+  routing: {
+    allocation: {
+      enable: 'all' | 'primaries' | 'new_primaries' | 'none';
+    };
+    rebalance: {
+      enable: 'all' | 'primaries' | 'replicas' | 'none';
+    };
+  };
 }
 
 interface AnalysisModule {
@@ -41,3 +49,18 @@ export interface IndexSettings {
   analysis?: AnalysisModule;
   [key: string]: any;
 }
+
+export interface Index {
+  health: string;
+  status: string;
+  name: string;
+  uuid: string;
+  primary: string;
+  replica: string;
+  documents: any;
+  size: any;
+  isFrozen: boolean;
+  aliases: string | string[];
+  data_stream?: string;
+  [key: string]: any;
+}
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_details.test.ts b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_details.test.ts
index a112d73230b82b..2a0585d61d6f6d 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_details.test.ts
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_details.test.ts
@@ -12,11 +12,6 @@ import { ComponentTemplateDeserialized } from '../../shared_imports';
 
 const { setup } = pageHelpers.componentTemplateDetails;
 
-jest.mock('ui/i18n', () => {
-  const I18nContext = ({ children }: any) => children;
-  return { I18nContext };
-});
-
 const COMPONENT_TEMPLATE: ComponentTemplateDeserialized = {
   name: 'comp-1',
   template: {
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_list.test.ts b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_list.test.ts
index bd6ac273758363..9bf7df263ec26c 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_list.test.ts
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_list.test.ts
@@ -14,11 +14,6 @@ import { API_BASE_PATH } from './helpers/constants';
 
 const { setup } = pageHelpers.componentTemplateList;
 
-jest.mock('ui/i18n', () => {
-  const I18nContext = ({ children }: any) => children;
-  return { I18nContext };
-});
-
 describe('<ComponentTemplateList />', () => {
   const { server, httpRequestsMockHelpers } = setupEnvironment();
   let testBed: ComponentTemplateListTestBed;
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field.tsx
index 6b5a848ce85d32..95575124b6abdd 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field.tsx
@@ -163,7 +163,7 @@ export const EditField = React.memo(({ form, field, allFields, exitEdit, updateF
       </EuiFlyoutBody>
 
       <EuiFlyoutFooter>
-        {form.isSubmitted && form.isValid === false && (
+        {form.isSubmitted && !form.isValid && (
           <>
             <EuiCallOut
               title={i18n.translate(
@@ -193,7 +193,7 @@ export const EditField = React.memo(({ form, field, allFields, exitEdit, updateF
               fill
               onClick={submitForm}
               type="submit"
-              disabled={form.isSubmitted && form.isValid === false}
+              disabled={form.isSubmitted && !form.isValid}
               data-test-subj="editFieldUpdateButton"
             >
               {i18n.translate('xpack.idxMgmt.mappingsEditor.editFieldUpdateButtonLabel', {
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/load_mappings/load_mappings_provider.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/load_mappings/load_mappings_provider.tsx
index a50572df9004e4..af0590be5c9410 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/load_mappings/load_mappings_provider.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/load_mappings/load_mappings_provider.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useState, useRef } from 'react';
+import React, { useState, useRef, useCallback } from 'react';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import {
@@ -134,9 +134,9 @@ export const LoadMappingsProvider = ({ onJson, children }: Props) => {
     state.json !== undefined && state.errors !== undefined ? 'validationResult' : 'json';
   const i18nTexts = getTexts(view, state.errors?.length);
 
-  const onJsonUpdate: OnJsonEditorUpdateHandler = (jsonUpdateData) => {
+  const onJsonUpdate: OnJsonEditorUpdateHandler = useCallback((jsonUpdateData) => {
     jsonContent.current = jsonUpdateData;
-  };
+  }, []);
 
   const openModal: OpenJsonModalFunc = () => {
     setState({ isModalOpen: true });
diff --git a/x-pack/plugins/index_management/public/application/components/template_form/steps/step_logistics.tsx b/x-pack/plugins/index_management/public/application/components/template_form/steps/step_logistics.tsx
index fcc9795617ebb6..56f040fc59a7b1 100644
--- a/x-pack/plugins/index_management/public/application/components/template_form/steps/step_logistics.tsx
+++ b/x-pack/plugins/index_management/public/application/components/template_form/steps/step_logistics.tsx
@@ -17,13 +17,13 @@ import { i18n } from '@kbn/i18n';
 
 import {
   useForm,
+  useFormData,
   Form,
   getUseField,
   getFormRow,
   Field,
   Forms,
   JsonEditorField,
-  FormDataProvider,
 } from '../../../../shared_imports';
 import { documentationService } from '../../../services/documentation';
 import { schemas, nameConfig, nameConfigWithoutValidations } from '../template_form_schemas';
@@ -118,9 +118,7 @@ interface LogisticsForm {
 }
 
 interface LogisticsFormInternal extends LogisticsForm {
-  __internal__: {
-    addMeta: boolean;
-  };
+  addMeta: boolean;
 }
 
 interface Props {
@@ -133,14 +131,12 @@ interface Props {
 function formDeserializer(formData: LogisticsForm): LogisticsFormInternal {
   return {
     ...formData,
-    __internal__: {
-      addMeta: Boolean(formData._meta && Object.keys(formData._meta).length),
-    },
+    addMeta: Boolean(formData._meta && Object.keys(formData._meta).length),
   };
 }
 
 function formSerializer(formData: LogisticsFormInternal): LogisticsForm {
-  const { __internal__, ...rest } = formData;
+  const { addMeta, ...rest } = formData;
   return rest;
 }
 
@@ -153,7 +149,18 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
       serializer: formSerializer,
       deserializer: formDeserializer,
     });
-    const { subscribe, submit, isSubmitted, isValid: isFormValid, getErrors: getFormErrors } = form;
+    const {
+      submit,
+      isSubmitted,
+      isValid: isFormValid,
+      getErrors: getFormErrors,
+      getFormData,
+    } = form;
+
+    const [{ addMeta }] = useFormData({
+      form,
+      watch: 'addMeta',
+    });
 
     /**
      * When the consumer call validate() on this step, we submit the form so it enters the "isSubmitted" state
@@ -164,15 +171,12 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
     }, [submit]);
 
     useEffect(() => {
-      const subscription = subscribe(({ data, isValid }) => {
-        onChange({
-          isValid,
-          validate,
-          getData: data.format,
-        });
+      onChange({
+        isValid: isFormValid,
+        getData: getFormData,
+        validate,
       });
-      return subscription.unsubscribe;
-    }, [onChange, validate, subscribe]);
+    }, [onChange, isFormValid, validate, getFormData]);
 
     const { name, indexPatterns, dataStream, order, priority, version } = getFieldsMeta(
       documentationService.getEsDocsBase()
@@ -296,34 +300,28 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
                     defaultMessage="Use the _meta field to store any metadata you want."
                   />
                   <EuiSpacer size="m" />
-                  <UseField path="__internal__.addMeta" data-test-subj="metaToggle" />
+                  <UseField path="addMeta" data-test-subj="metaToggle" />
                 </>
               }
             >
-              <FormDataProvider pathsToWatch="__internal__.addMeta">
-                {({ '__internal__.addMeta': addMeta }) => {
-                  return (
-                    addMeta && (
-                      <UseField
-                        path="_meta"
-                        component={JsonEditorField}
-                        componentProps={{
-                          euiCodeEditorProps: {
-                            height: '280px',
-                            'aria-label': i18n.translate(
-                              'xpack.idxMgmt.templateForm.stepLogistics.metaFieldEditorAriaLabel',
-                              {
-                                defaultMessage: '_meta field data editor',
-                              }
-                            ),
-                            'data-test-subj': 'metaField',
-                          },
-                        }}
-                      />
-                    )
-                  );
-                }}
-              </FormDataProvider>
+              {addMeta && (
+                <UseField
+                  path="_meta"
+                  component={JsonEditorField}
+                  componentProps={{
+                    euiCodeEditorProps: {
+                      height: '280px',
+                      'aria-label': i18n.translate(
+                        'xpack.idxMgmt.templateForm.stepLogistics.metaFieldEditorAriaLabel',
+                        {
+                          defaultMessage: '_meta field data editor',
+                        }
+                      ),
+                      'data-test-subj': 'metaField',
+                    },
+                  }}
+                />
+              )}
             </FormRow>
           )}
         </Form>
diff --git a/x-pack/plugins/index_management/public/application/components/template_form/template_form.tsx b/x-pack/plugins/index_management/public/application/components/template_form/template_form.tsx
index 537f4211733588..3a03835e859701 100644
--- a/x-pack/plugins/index_management/public/application/components/template_form/template_form.tsx
+++ b/x-pack/plugins/index_management/public/application/components/template_form/template_form.tsx
@@ -192,8 +192,8 @@ export const TemplateForm = ({
       wizardData: WizardContent
     ): TemplateDeserialized => {
       const outputTemplate = {
-        ...initialTemplate,
         ...wizardData.logistics,
+        _kbnMeta: initialTemplate._kbnMeta,
         composedOf: wizardData.components,
         template: {
           settings: wizardData.settings,
diff --git a/x-pack/plugins/index_management/public/application/components/template_form/template_form_schemas.tsx b/x-pack/plugins/index_management/public/application/components/template_form/template_form_schemas.tsx
index 0d9ce57a64c843..c85126f08685e0 100644
--- a/x-pack/plugins/index_management/public/application/components/template_form/template_form_schemas.tsx
+++ b/x-pack/plugins/index_management/public/application/components/template_form/template_form_schemas.tsx
@@ -125,6 +125,7 @@ export const schemas: Record<string, FormSchema> = {
         {
           validator: indexPatternField(i18n),
           type: VALIDATION_TYPES.ARRAY_ITEM,
+          isBlocking: false,
         },
       ],
     },
@@ -213,13 +214,11 @@ export const schemas: Record<string, FormSchema> = {
         }
       },
     },
-    __internal__: {
-      addMeta: {
-        type: FIELD_TYPES.TOGGLE,
-        label: i18n.translate('xpack.idxMgmt.templateForm.stepLogistics.addMetadataLabel', {
-          defaultMessage: 'Add metadata',
-        }),
-      },
+    addMeta: {
+      type: FIELD_TYPES.TOGGLE,
+      label: i18n.translate('xpack.idxMgmt.templateForm.stepLogistics.addMetadataLabel', {
+        defaultMessage: 'Add metadata',
+      }),
     },
   },
 };
diff --git a/x-pack/plugins/index_management/public/index.ts b/x-pack/plugins/index_management/public/index.ts
index a2e9a41feb165d..538dcaf25c47d1 100644
--- a/x-pack/plugins/index_management/public/index.ts
+++ b/x-pack/plugins/index_management/public/index.ts
@@ -14,3 +14,5 @@ export const plugin = () => {
 export { IndexManagementPluginSetup };
 
 export { getIndexListUri } from './application/services/routing';
+
+export { Index } from '../common';
diff --git a/x-pack/plugins/index_management/public/shared_imports.ts b/x-pack/plugins/index_management/public/shared_imports.ts
index 16dcab18c3caf4..f7f992a090501f 100644
--- a/x-pack/plugins/index_management/public/shared_imports.ts
+++ b/x-pack/plugins/index_management/public/shared_imports.ts
@@ -13,7 +13,7 @@ export {
   Forms,
   extractQueryParams,
   GlobalFlyout,
-} from '../../../../src/plugins/es_ui_shared/public/';
+} from '../../../../src/plugins/es_ui_shared/public';
 
 export {
   FormSchema,
@@ -21,6 +21,7 @@ export {
   VALIDATION_TYPES,
   FieldConfig,
   useForm,
+  useFormData,
   Form,
   getUseField,
   UseField,
diff --git a/x-pack/plugins/index_management/server/index.ts b/x-pack/plugins/index_management/server/index.ts
index 4d9409e4a516cd..b8d9124b4135ae 100644
--- a/x-pack/plugins/index_management/server/index.ts
+++ b/x-pack/plugins/index_management/server/index.ts
@@ -18,5 +18,5 @@ export const config = {
 /** @public */
 export { Dependencies } from './types';
 export { IndexManagementPluginSetup } from './plugin';
-export { Index } from './types';
+export { Index, LegacyTemplateSerialized } from '../common';
 export { IndexManagementConfig } from './config';
diff --git a/x-pack/plugins/index_management/server/lib/fetch_indices.ts b/x-pack/plugins/index_management/server/lib/fetch_indices.ts
index ae10629e069e84..e9eaec3e22428c 100644
--- a/x-pack/plugins/index_management/server/lib/fetch_indices.ts
+++ b/x-pack/plugins/index_management/server/lib/fetch_indices.ts
@@ -5,7 +5,8 @@
  */
 import { CatIndicesParams } from 'elasticsearch';
 import { IndexDataEnricher } from '../services';
-import { Index, CallAsCurrentUser } from '../types';
+import { CallAsCurrentUser } from '../types';
+import { Index } from '../index';
 
 interface Hit {
   health: string;
@@ -44,7 +45,9 @@ async function fetchIndicesCall(
   // This call retrieves alias and settings (incl. hidden status) information about indices
   const indices: GetIndicesResponse = await callAsCurrentUser('transport.request', {
     method: 'GET',
-    path: `/${indexNamesString}`,
+    // transport.request doesn't do any URI encoding, unlike other JS client APIs. This enables
+    // working with Logstash indices with names like %{[@metadata][beat]}-%{[@metadata][version]}.
+    path: `/${encodeURIComponent(indexNamesString)}`,
     query: {
       expand_wildcards: 'hidden,all',
     },
diff --git a/x-pack/plugins/index_management/server/services/index_data_enricher.ts b/x-pack/plugins/index_management/server/services/index_data_enricher.ts
index 7a62ce9f7a3c3a..80bdf76820f288 100644
--- a/x-pack/plugins/index_management/server/services/index_data_enricher.ts
+++ b/x-pack/plugins/index_management/server/services/index_data_enricher.ts
@@ -4,7 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Index, CallAsCurrentUser } from '../types';
+import { CallAsCurrentUser } from '../types';
+import { Index } from '../index';
 
 export type Enricher = (indices: Index[], callAsCurrentUser: CallAsCurrentUser) => Promise<Index[]>;
 
diff --git a/x-pack/plugins/index_management/server/types.ts b/x-pack/plugins/index_management/server/types.ts
index cd3eb5dfecd401..fce0414dee9369 100644
--- a/x-pack/plugins/index_management/server/types.ts
+++ b/x-pack/plugins/index_management/server/types.ts
@@ -26,19 +26,4 @@ export interface RouteDependencies {
   };
 }
 
-export interface Index {
-  health: string;
-  status: string;
-  name: string;
-  uuid: string;
-  primary: string;
-  replica: string;
-  documents: any;
-  size: any;
-  isFrozen: boolean;
-  aliases: string | string[];
-  data_stream?: string;
-  [key: string]: any;
-}
-
 export type CallAsCurrentUser = LegacyScopedClusterClient['callAsCurrentUser'];
diff --git a/x-pack/plugins/infra/public/components/log_stream/README.md b/x-pack/plugins/infra/public/components/log_stream/README.md
new file mode 100644
index 00000000000000..59b3edfab736cd
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/log_stream/README.md
@@ -0,0 +1,73 @@
+# Embeddable `<LogStream />` component
+
+The purpose of this component is to allow you, the developer, to have your very own Log Stream in your plugin.
+
+The plugin is exposed through `infra/public`. Since Kibana uses relative paths is up to you to find how to import it (sorry).
+
+```tsx
+import { LogStream } from '../../../../../../infra/public';
+```
+
+## Prerequisites
+
+To use the component, there are several things you need to ensure in your plugin:
+
+- In your plugin's `kibana.json` plugin, add `"infra"` to `requiredPlugins`.
+- The component needs to be mounted inside the hiearchy of a [`kibana-react` provider](https://github.com/elastic/kibana/blob/b2d0aa7b7fae1c89c8f9e8854ae73e71be64e765/src/plugins/kibana_react/README.md#L45).
+
+## Usage
+
+The simplest way to use the component is with a date range, passed with the `startTimestamp` and `endTimestamp` props.
+
+```tsx
+const endTimestamp = Date.now();
+const startTimestamp = endTimestamp - 15 * 60 * 1000; // 15 minutes
+
+<LogStream startTimestamp={startTimestamp} endTimestamp={endTimestamp} />;
+```
+
+This will show a list of log entries between the time range, in ascending order (oldest first), but with the scroll position all the way to the bottom (showing the newest entries)
+
+### Filtering data
+
+You might want to show specific data for the purpose of your plugin. Maybe you want to show log lines from a specific host, or for an APM trace. You can pass a KQL expression via the `query` prop.
+
+```tsx
+<LogStream
+  startTimestamp={startTimestamp}
+  endTimestamp={endTimestamp}
+  query="trace.id: 18fabada9384abd4"
+/>
+```
+
+### Modifying rendering
+
+By default the component will initially load at the bottom of the list, showing the newest entries. You can change what log line is shown in the center via the `center` prop. The prop takes a [`LogEntriesCursor`](https://github.com/elastic/kibana/blob/0a6c748cc837c016901f69ff05d81395aa2d41c8/x-pack/plugins/infra/common/http_api/log_entries/common.ts#L9-L13).
+
+```tsx
+<LogStream
+  startTimestamp={startTimestamp}
+  endTimestamp={endTimestamp}
+  center={{ time: ..., tiebreaker: ... }}
+/>
+```
+
+If you want to highlight a specific log line, you can do so by passing its ID in the `highlight` prop.
+
+```tsx
+<LogStream startTimestamp={startTimestamp} endTimestamp={endTimestamp} highlight="abcde12345" />
+```
+
+### Source configuration
+
+The infra plugin has the concept of "source configuration" to store settings for the logs UI. The component will use the source configuration to determine which indices to query or what columns to show.
+
+By default the `<LogStream />` uses the `"default"` source confiuration, but if your plugin uses a different one you can specify it via the `sourceId` prop.
+
+```tsx
+<LogStream startTimestamp={startTimestamp} endTimestamp={endTimestamp} sourceId="my_source" />
+```
+
+### Considerations
+
+As mentioned in the prerequisites, the component relies on `kibana-react` to access kibana's core services. If this is not the case the component will throw an exception when rendering. We advise to use an `<EuiErrorBoundary>` in your component hierarchy to catch this error if necessary.
diff --git a/x-pack/plugins/infra/public/components/log_stream/index.tsx b/x-pack/plugins/infra/public/components/log_stream/index.tsx
new file mode 100644
index 00000000000000..f9bfbf95647980
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/log_stream/index.tsx
@@ -0,0 +1,133 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useMemo } from 'react';
+import { noop } from 'lodash';
+import { useMount } from 'react-use';
+import { euiStyled } from '../../../../observability/public';
+
+import { LogEntriesCursor } from '../../../common/http_api';
+
+import { useKibana } from '../../../../../../src/plugins/kibana_react/public';
+import { useLogSource } from '../../containers/logs/log_source';
+import { useLogStream } from '../../containers/logs/log_stream';
+
+import { ScrollableLogTextStreamView } from '../logging/log_text_stream';
+
+export interface LogStreamProps {
+  sourceId?: string;
+  startTimestamp: number;
+  endTimestamp: number;
+  query?: string;
+  center?: LogEntriesCursor;
+  highlight?: string;
+  height?: string | number;
+}
+
+export const LogStream: React.FC<LogStreamProps> = ({
+  sourceId = 'default',
+  startTimestamp,
+  endTimestamp,
+  query,
+  center,
+  highlight,
+  height = '400px',
+}) => {
+  // source boilerplate
+  const { services } = useKibana();
+  if (!services?.http?.fetch) {
+    throw new Error(
+      `<LogStream /> cannot access kibana core services.
+
+Ensure the component is mounted within kibana-react's <KibanaContextProvider> hierarchy.
+Read more at https://github.com/elastic/kibana/blob/master/src/plugins/kibana_react/README.md"
+`
+    );
+  }
+
+  const {
+    sourceConfiguration,
+    loadSourceConfiguration,
+    isLoadingSourceConfiguration,
+  } = useLogSource({
+    sourceId,
+    fetch: services.http.fetch,
+  });
+
+  // Internal state
+  const { loadingState, entries, fetchEntries } = useLogStream({
+    sourceId,
+    startTimestamp,
+    endTimestamp,
+    query,
+    center,
+  });
+
+  // Derived state
+  const isReloading =
+    isLoadingSourceConfiguration || loadingState === 'uninitialized' || loadingState === 'loading';
+
+  const columnConfigurations = useMemo(() => {
+    return sourceConfiguration ? sourceConfiguration.configuration.logColumns : [];
+  }, [sourceConfiguration]);
+
+  const streamItems = useMemo(
+    () =>
+      entries.map((entry) => ({
+        kind: 'logEntry' as const,
+        logEntry: entry,
+        highlights: [],
+      })),
+    [entries]
+  );
+
+  // Component lifetime
+  useMount(() => {
+    loadSourceConfiguration();
+    fetchEntries();
+  });
+
+  const parsedHeight = typeof height === 'number' ? `${height}px` : height;
+
+  return (
+    <LogStreamContent height={parsedHeight}>
+      <ScrollableLogTextStreamView
+        target={center ? center : entries.length ? entries[entries.length - 1].cursor : null}
+        columnConfigurations={columnConfigurations}
+        items={streamItems}
+        scale="medium"
+        wrap={false}
+        isReloading={isReloading}
+        isLoadingMore={false}
+        hasMoreBeforeStart={false}
+        hasMoreAfterEnd={false}
+        isStreaming={false}
+        lastLoadedTime={null}
+        jumpToTarget={noop}
+        reportVisibleInterval={noop}
+        loadNewerItems={noop}
+        reloadItems={fetchEntries}
+        highlightedItem={highlight ?? null}
+        currentHighlightKey={null}
+        startDateExpression={''}
+        endDateExpression={''}
+        updateDateRange={noop}
+        startLiveStreaming={noop}
+        hideScrollbar={false}
+      />
+    </LogStreamContent>
+  );
+};
+
+const LogStreamContent = euiStyled.div<{ height: string }>`
+  display: flex;
+  background-color: ${(props) => props.theme.eui.euiColorEmptyShade};
+  height: ${(props) => props.height};
+`;
+
+// Allow for lazy loading
+// eslint-disable-next-line import/no-default-export
+export default LogStream;
diff --git a/x-pack/plugins/infra/public/components/log_stream/lazy_log_stream_wrapper.tsx b/x-pack/plugins/infra/public/components/log_stream/lazy_log_stream_wrapper.tsx
new file mode 100644
index 00000000000000..65433aab15716f
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/log_stream/lazy_log_stream_wrapper.tsx
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import type { LogStreamProps } from './';
+
+const LazyLogStream = React.lazy(() => import('./'));
+
+export const LazyLogStreamWrapper: React.FC<LogStreamProps> = (props) => (
+  <React.Suspense fallback={<div />}>
+    <LazyLogStream {...props} />
+  </React.Suspense>
+);
diff --git a/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_row.tsx b/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_row.tsx
index 5077bccdc1ca2d..c1d4fc8b8d3c87 100644
--- a/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_row.tsx
+++ b/x-pack/plugins/infra/public/components/logging/log_text_stream/log_entry_row.tsx
@@ -85,7 +85,7 @@ export const LogEntryRow = memo(
     ]);
 
     const handleOpenViewLogInContext = useCallback(() => {
-      openViewLogInContext?.(logEntry); // eslint-disable-line no-unused-expressions
+      openViewLogInContext?.(logEntry);
       trackMetric({ metric: 'view_in_context__stream' });
     }, [openViewLogInContext, logEntry, trackMetric]);
 
diff --git a/x-pack/plugins/infra/public/components/logging/log_text_stream/scrollable_log_text_stream_view.tsx b/x-pack/plugins/infra/public/components/logging/log_text_stream/scrollable_log_text_stream_view.tsx
index fc0c50b9044dc1..ae375392b6b93e 100644
--- a/x-pack/plugins/infra/public/components/logging/log_text_stream/scrollable_log_text_stream_view.tsx
+++ b/x-pack/plugins/infra/public/components/logging/log_text_stream/scrollable_log_text_stream_view.tsx
@@ -60,6 +60,7 @@ interface ScrollableLogTextStreamViewProps {
   endDateExpression: string;
   updateDateRange: (range: { startDateExpression?: string; endDateExpression?: string }) => void;
   startLiveStreaming: () => void;
+  hideScrollbar?: boolean;
 }
 
 interface ScrollableLogTextStreamViewState {
@@ -146,6 +147,7 @@ export class ScrollableLogTextStreamView extends React.PureComponent<
       setFlyoutVisibility,
       setContextEntry,
     } = this.props;
+    const hideScrollbar = this.props.hideScrollbar ?? true;
 
     const { targetId, items, isScrollLocked } = this.state;
     const hasItems = items.length > 0;
@@ -196,7 +198,7 @@ export class ScrollableLogTextStreamView extends React.PureComponent<
                         width={width}
                         onVisibleChildrenChange={this.handleVisibleChildrenChange}
                         target={targetId}
-                        hideScrollbar={true}
+                        hideScrollbar={hideScrollbar}
                         data-test-subj={'logStream'}
                         isLocked={isScrollLocked}
                         entriesCount={items.length}
diff --git a/x-pack/plugins/infra/public/containers/logs/log_stream/index.ts b/x-pack/plugins/infra/public/containers/logs/log_stream/index.ts
new file mode 100644
index 00000000000000..b414408512db29
--- /dev/null
+++ b/x-pack/plugins/infra/public/containers/logs/log_stream/index.ts
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useState, useMemo } from 'react';
+import { esKuery } from '../../../../../../../src/plugins/data/public';
+import { fetchLogEntries } from '../log_entries/api/fetch_log_entries';
+import { useTrackedPromise } from '../../../utils/use_tracked_promise';
+import { LogEntry, LogEntriesCursor } from '../../../../common/http_api';
+
+interface LogStreamProps {
+  sourceId: string;
+  startTimestamp: number;
+  endTimestamp: number;
+  query?: string;
+  center?: LogEntriesCursor;
+}
+
+interface LogStreamState {
+  entries: LogEntry[];
+  fetchEntries: () => void;
+  loadingState: 'uninitialized' | 'loading' | 'success' | 'error';
+}
+
+export function useLogStream({
+  sourceId,
+  startTimestamp,
+  endTimestamp,
+  query,
+  center,
+}: LogStreamProps): LogStreamState {
+  const [entries, setEntries] = useState<LogStreamState['entries']>([]);
+
+  const parsedQuery = useMemo(() => {
+    return query
+      ? JSON.stringify(esKuery.toElasticsearchQuery(esKuery.fromKueryExpression(query)))
+      : null;
+  }, [query]);
+
+  // Callbacks
+  const [entriesPromise, fetchEntries] = useTrackedPromise(
+    {
+      cancelPreviousOn: 'creation',
+      createPromise: () => {
+        setEntries([]);
+        const fetchPosition = center ? { center } : { before: 'last' };
+
+        return fetchLogEntries({
+          sourceId,
+          startTimestamp,
+          endTimestamp,
+          query: parsedQuery,
+          ...fetchPosition,
+        });
+      },
+      onResolve: ({ data }) => {
+        setEntries(data.entries);
+      },
+    },
+    [sourceId, startTimestamp, endTimestamp, query]
+  );
+
+  const loadingState = useMemo(() => convertPromiseStateToLoadingState(entriesPromise.state), [
+    entriesPromise.state,
+  ]);
+
+  return {
+    entries,
+    fetchEntries,
+    loadingState,
+  };
+}
+
+function convertPromiseStateToLoadingState(
+  state: 'uninitialized' | 'pending' | 'resolved' | 'rejected'
+): LogStreamState['loadingState'] {
+  switch (state) {
+    case 'uninitialized':
+      return 'uninitialized';
+    case 'pending':
+      return 'loading';
+    case 'resolved':
+      return 'success';
+    case 'rejected':
+      return 'error';
+  }
+}
diff --git a/x-pack/plugins/infra/public/containers/logs/view_log_in_context/view_log_in_context.ts b/x-pack/plugins/infra/public/containers/logs/view_log_in_context/view_log_in_context.ts
index bc719cbd694e4f..61e1ea353880a0 100644
--- a/x-pack/plugins/infra/public/containers/logs/view_log_in_context/view_log_in_context.ts
+++ b/x-pack/plugins/infra/public/containers/logs/view_log_in_context/view_log_in_context.ts
@@ -3,24 +3,9 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { useState, useEffect, useCallback } from 'react';
+import { useState } from 'react';
 import createContainer from 'constate';
 import { LogEntry } from '../../../../common/http_api';
-import { fetchLogEntries } from '../log_entries/api/fetch_log_entries';
-import { esKuery } from '../../../../../../../src/plugins/data/public';
-
-function getQueryFromLogEntry(entry: LogEntry) {
-  const expression = Object.entries(entry.context).reduce((kuery, [key, value]) => {
-    const currentExpression = `${key} : "${value}"`;
-    if (kuery.length > 0) {
-      return `${kuery} AND ${currentExpression}`;
-    } else {
-      return currentExpression;
-    }
-  }, '');
-
-  return JSON.stringify(esKuery.toElasticsearchQuery(esKuery.fromKueryExpression(expression)));
-}
 
 interface ViewLogInContextProps {
   sourceId: string;
@@ -28,9 +13,7 @@ interface ViewLogInContextProps {
   endTimestamp: number;
 }
 
-export interface ViewLogInContextState {
-  entries: LogEntry[];
-  isLoading: boolean;
+export interface ViewLogInContextState extends ViewLogInContextProps {
   contextEntry?: LogEntry;
 }
 
@@ -42,37 +25,14 @@ export const useViewLogInContext = (
   props: ViewLogInContextProps
 ): [ViewLogInContextState, ViewLogInContextCallbacks] => {
   const [contextEntry, setContextEntry] = useState<LogEntry | undefined>();
-  const [entries, setEntries] = useState<LogEntry[]>([]);
-  const [isLoading, setIsLoading] = useState<boolean>(false);
   const { startTimestamp, endTimestamp, sourceId } = props;
 
-  const maybeFetchLogs = useCallback(async () => {
-    if (contextEntry) {
-      setIsLoading(true);
-      const { data } = await fetchLogEntries({
-        sourceId,
-        startTimestamp,
-        endTimestamp,
-        center: contextEntry.cursor,
-        query: getQueryFromLogEntry(contextEntry),
-      });
-      setEntries(data.entries);
-      setIsLoading(false);
-    } else {
-      setEntries([]);
-      setIsLoading(false);
-    }
-  }, [contextEntry, startTimestamp, endTimestamp, sourceId]);
-
-  useEffect(() => {
-    maybeFetchLogs();
-  }, [maybeFetchLogs]);
-
   return [
     {
+      startTimestamp,
+      endTimestamp,
+      sourceId,
       contextEntry,
-      entries,
-      isLoading,
     },
     {
       setContextEntry,
diff --git a/x-pack/plugins/infra/public/index.ts b/x-pack/plugins/infra/public/index.ts
index cadf9a48378665..873e3b1ce05837 100644
--- a/x-pack/plugins/infra/public/index.ts
+++ b/x-pack/plugins/infra/public/index.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
 import { PluginInitializer, PluginInitializerContext } from 'kibana/public';
 import { Plugin } from './plugin';
 import {
@@ -26,3 +25,6 @@ export { FORMATTERS } from '../common/formatters';
 export { InfraFormatterType } from './lib/lib';
 
 export type InfraAppId = 'logs' | 'metrics';
+
+// Shared components
+export { LazyLogStreamWrapper as LogStream } from './components/log_stream/lazy_log_stream_wrapper';
diff --git a/x-pack/plugins/infra/public/pages/logs/log_entry_categories/page_results_content.tsx b/x-pack/plugins/infra/public/pages/logs/log_entry_categories/page_results_content.tsx
index 028dd0d3a1a7bf..740fc8b7bafcdb 100644
--- a/x-pack/plugins/infra/public/pages/logs/log_entry_categories/page_results_content.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/log_entry_categories/page_results_content.tsx
@@ -73,7 +73,6 @@ export const LogEntryCategoriesResultsContent: React.FunctionComponent<LogEntryC
 
   const showLoadDataErrorNotification = useCallback(
     (error: Error) => {
-      // eslint-disable-next-line no-unused-expressions
       services.notifications?.toasts.addError(error, {
         title: loadDataErrorTitle,
       });
diff --git a/x-pack/plugins/infra/public/pages/logs/log_entry_rate/page_results_content.tsx b/x-pack/plugins/infra/public/pages/logs/log_entry_rate/page_results_content.tsx
index de72ac5c5a574e..b33eaf7e77bc3b 100644
--- a/x-pack/plugins/infra/public/pages/logs/log_entry_rate/page_results_content.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/log_entry_rate/page_results_content.tsx
@@ -103,7 +103,6 @@ export const LogEntryRateResultsContent: React.FunctionComponent = () => {
         }),
       };
 
-      // eslint-disable-next-line no-unused-expressions
       navigateToApp?.('logs', { path: `/stream?${stringify(params)}` });
     },
     [queryTimeRange, navigateToApp]
diff --git a/x-pack/plugins/infra/public/pages/logs/stream/page_view_log_in_context.tsx b/x-pack/plugins/infra/public/pages/logs/stream/page_view_log_in_context.tsx
index 3ef32c920e2938..4ac3d15a822226 100644
--- a/x-pack/plugins/infra/public/pages/logs/stream/page_view_log_in_context.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/stream/page_view_log_in_context.tsx
@@ -12,43 +12,38 @@ import {
   EuiText,
   EuiTextColor,
   EuiToolTip,
-  EuiSpacer,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { noop } from 'lodash';
+import { isEmpty } from 'lodash';
 import React, { useCallback, useContext, useMemo } from 'react';
 import { LogEntry } from '../../../../common/http_api';
-import { ScrollableLogTextStreamView } from '../../../components/logging/log_text_stream';
-import { useLogSourceContext } from '../../../containers/logs/log_source';
-import { LogViewConfiguration } from '../../../containers/logs/log_view_configuration';
 import { ViewLogInContext } from '../../../containers/logs/view_log_in_context';
 import { useViewportDimensions } from '../../../utils/use_viewport_dimensions';
 import { euiStyled } from '../../../../../observability/public';
+import { LogStream } from '../../../components/log_stream';
 
 const MODAL_MARGIN = 25;
 
 export const PageViewLogInContext: React.FC = () => {
-  const { sourceConfiguration } = useLogSourceContext();
-  const { textScale, textWrap } = useContext(LogViewConfiguration.Context);
-  /* eslint-disable-next-line react-hooks/exhaustive-deps */
-  const columnConfigurations = useMemo(() => sourceConfiguration?.configuration.logColumns ?? [], [
-    sourceConfiguration,
-  ]);
-  const [{ contextEntry, entries, isLoading }, { setContextEntry }] = useContext(
-    ViewLogInContext.Context
-  );
+  const [
+    { contextEntry, startTimestamp, endTimestamp, sourceId },
+    { setContextEntry },
+  ] = useContext(ViewLogInContext.Context);
   const closeModal = useCallback(() => setContextEntry(undefined), [setContextEntry]);
   const { width: vw, height: vh } = useViewportDimensions();
 
-  const streamItems = useMemo(
-    () =>
-      entries.map((entry) => ({
-        kind: 'logEntry' as const,
-        logEntry: entry,
-        highlights: [],
-      })),
-    [entries]
-  );
+  const contextQuery = useMemo(() => {
+    if (contextEntry && !isEmpty(contextEntry.context)) {
+      return Object.entries(contextEntry.context).reduce((kuery, [key, value]) => {
+        const currentExpression = `${key} : "${value}"`;
+        if (kuery.length > 0) {
+          return `${kuery} AND ${currentExpression}`;
+        } else {
+          return currentExpression;
+        }
+      }, '');
+    }
+  }, [contextEntry]);
 
   if (!contextEntry) {
     return null;
@@ -64,31 +59,18 @@ export const PageViewLogInContext: React.FC = () => {
             wrap={false}
             style={{ height: '100%' }}
           >
-            <EuiFlexItem grow={1}>
+            <EuiFlexItem grow={false}>
               <LogEntryContext context={contextEntry.context} />
-              <EuiSpacer size="m" />
-              <ScrollableLogTextStreamView
-                target={contextEntry.cursor}
-                columnConfigurations={columnConfigurations}
-                items={streamItems}
-                scale={textScale}
-                wrap={textWrap}
-                isReloading={isLoading}
-                isLoadingMore={false}
-                hasMoreBeforeStart={false}
-                hasMoreAfterEnd={false}
-                isStreaming={false}
-                lastLoadedTime={null}
-                jumpToTarget={noop}
-                reportVisibleInterval={noop}
-                loadNewerItems={noop}
-                reloadItems={noop}
-                highlightedItem={contextEntry.id}
-                currentHighlightKey={null}
-                startDateExpression={''}
-                endDateExpression={''}
-                updateDateRange={noop}
-                startLiveStreaming={noop}
+            </EuiFlexItem>
+            <EuiFlexItem grow={1}>
+              <LogStream
+                sourceId={sourceId}
+                startTimestamp={startTimestamp}
+                endTimestamp={endTimestamp}
+                query={contextQuery}
+                center={contextEntry.cursor}
+                highlight={contextEntry.id}
+                height="100%"
               />
             </EuiFlexItem>
           </EuiFlexGroup>
diff --git a/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_chart_preview.ts b/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_chart_preview.ts
index 026f003463ef27..71115ad3a5745d 100644
--- a/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_chart_preview.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_chart_preview.ts
@@ -50,8 +50,8 @@ export async function getChartPreviewData(
   const { rangeFilter } = buildFiltersFromCriteria(expandedAlertParams, timestampField);
 
   const query = isGrouped
-    ? getGroupedESQuery(expandedAlertParams, sourceConfiguration.configuration, indexPattern)
-    : getUngroupedESQuery(expandedAlertParams, sourceConfiguration.configuration, indexPattern);
+    ? getGroupedESQuery(expandedAlertParams, timestampField, indexPattern)
+    : getUngroupedESQuery(expandedAlertParams, timestampField, indexPattern);
 
   if (!query) {
     throw new Error('ES query could not be built from the provided alert params');
diff --git a/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.test.ts b/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.test.ts
index 940afd72f6c73c..f730513991a781 100644
--- a/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.test.ts
@@ -4,527 +4,617 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { createLogThresholdExecutor } from './log_threshold_executor';
+import {
+  getPositiveComparators,
+  getNegativeComparators,
+  queryMappings,
+  buildFiltersFromCriteria,
+  getUngroupedESQuery,
+  getGroupedESQuery,
+  processUngroupedResults,
+  processGroupByResults,
+} from './log_threshold_executor';
 import {
   Comparator,
   AlertStates,
   LogDocumentCountAlertParams,
   Criterion,
+  UngroupedSearchQueryResponse,
+  GroupedSearchQueryResponse,
 } from '../../../../common/alerting/logs/types';
-import { AlertExecutorOptions } from '../../../../../alerts/server';
-import {
-  alertsMock,
-  AlertInstanceMock,
-  AlertServicesMock,
-} from '../../../../../alerts/server/mocks';
-import { libsMock } from './mocks';
-
-interface AlertTestInstance {
-  instance: AlertInstanceMock;
-  actionQueue: any[];
-  state: any;
-}
-
-/*
- * Mocks
- */
-const alertInstances = new Map();
-
-const services: AlertServicesMock = alertsMock.createAlertServices();
-services.alertInstanceFactory.mockImplementation((instanceId: string) => {
-  const alertInstance: AlertTestInstance = {
-    instance: alertsMock.createAlertInstanceFactory(),
-    actionQueue: [],
-    state: {},
-  };
-  alertInstance.instance.replaceState.mockImplementation((newState: any) => {
-    alertInstance.state = newState;
-    return alertInstance.instance;
-  });
-  alertInstance.instance.scheduleActions.mockImplementation((id: string, action: any) => {
-    alertInstance.actionQueue.push({ id, action });
-    return alertInstance.instance;
-  });
-
-  alertInstances.set(instanceId, alertInstance);
-
-  return alertInstance.instance;
-});
-
-/*
- * Helper functions
- */
-function getAlertState(): AlertStates {
-  const alert = alertInstances.get('*');
-  if (alert) {
-    return alert.state.alertState;
-  } else {
-    throw new Error('Could not find alert instance');
-  }
-}
-
-/*
- * Executor instance (our test subject)
- */
-const executor = (createLogThresholdExecutor(libsMock) as unknown) as (opts: {
-  params: LogDocumentCountAlertParams;
-  services: { callCluster: AlertExecutorOptions['params']['callCluster'] };
-}) => Promise<void>;
-
-// Wrapper to test
-type Comparison = [number, Comparator, number];
-
-async function callExecutor(
-  [value, comparator, threshold]: Comparison,
-  criteria: Criterion[] = []
-) {
-  services.callCluster.mockImplementationOnce(async (..._) => ({
-    _shards: {
-      total: 1,
-      successful: 1,
-      skipped: 0,
-      failed: 0,
-    },
-    timed_out: false,
-    took: 123456789,
-    hits: {
-      total: {
-        value,
-      },
-    },
-  }));
-
-  return await executor({
-    services,
-    params: {
-      count: { value: threshold, comparator },
-      timeSize: 1,
-      timeUnit: 'm',
-      criteria,
-    },
-  });
-}
-
-describe('Ungrouped alerts', () => {
-  describe('Comparators trigger alerts correctly', () => {
-    it('does not alert when counts do not reach the threshold', async () => {
-      await callExecutor([0, Comparator.GT, 1]);
-      expect(getAlertState()).toBe(AlertStates.OK);
-
-      await callExecutor([0, Comparator.GT_OR_EQ, 1]);
-      expect(getAlertState()).toBe(AlertStates.OK);
-
-      await callExecutor([1, Comparator.LT, 0]);
-      expect(getAlertState()).toBe(AlertStates.OK);
-
-      await callExecutor([1, Comparator.LT_OR_EQ, 0]);
-      expect(getAlertState()).toBe(AlertStates.OK);
+import { alertsMock } from '../../../../../alerts/server/mocks';
+
+// Mocks //
+const numericField = {
+  field: 'numericField',
+  value: 10,
+};
+
+const keywordField = {
+  field: 'keywordField',
+  value: 'error',
+};
+
+const textField = {
+  field: 'textField',
+  value: 'Something went wrong',
+};
+
+const positiveCriteria: Criterion[] = [
+  { ...numericField, comparator: Comparator.GT },
+  { ...numericField, comparator: Comparator.GT_OR_EQ },
+  { ...numericField, comparator: Comparator.LT },
+  { ...numericField, comparator: Comparator.LT_OR_EQ },
+  { ...keywordField, comparator: Comparator.EQ },
+  { ...textField, comparator: Comparator.MATCH },
+  { ...textField, comparator: Comparator.MATCH_PHRASE },
+];
+
+const negativeCriteria: Criterion[] = [
+  { ...keywordField, comparator: Comparator.NOT_EQ },
+  { ...textField, comparator: Comparator.NOT_MATCH },
+  { ...textField, comparator: Comparator.NOT_MATCH_PHRASE },
+];
+
+const baseAlertParams: Pick<LogDocumentCountAlertParams, 'count' | 'timeSize' | 'timeUnit'> = {
+  count: {
+    comparator: Comparator.GT,
+    value: 5,
+  },
+  timeSize: 5,
+  timeUnit: 'm',
+};
+
+const TIMESTAMP_FIELD = '@timestamp';
+const FILEBEAT_INDEX = 'filebeat-*';
+
+describe('Log threshold executor', () => {
+  describe('Comparators', () => {
+    test('Correctly categorises positive comparators', () => {
+      expect(getPositiveComparators().length).toBe(7);
     });
 
-    it('alerts when counts reach the threshold', async () => {
-      await callExecutor([2, Comparator.GT, 1]);
-      expect(getAlertState()).toBe(AlertStates.ALERT);
-
-      await callExecutor([1, Comparator.GT_OR_EQ, 1]);
-      expect(getAlertState()).toBe(AlertStates.ALERT);
-
-      await callExecutor([1, Comparator.LT, 2]);
-      expect(getAlertState()).toBe(AlertStates.ALERT);
-
-      await callExecutor([2, Comparator.LT_OR_EQ, 2]);
-      expect(getAlertState()).toBe(AlertStates.ALERT);
+    test('Correctly categorises negative comparators', () => {
+      expect(getNegativeComparators().length).toBe(3);
     });
-  });
 
-  describe('Comparators create the correct ES queries', () => {
-    beforeEach(() => {
-      services.callCluster.mockReset();
+    test('There is a query mapping for every comparator', () => {
+      const comparators = [...getPositiveComparators(), ...getNegativeComparators()];
+      expect(Object.keys(queryMappings).length).toBe(comparators.length);
     });
-
-    it('Works with `Comparator.EQ`', async () => {
-      await callExecutor(
-        [2, Comparator.GT, 1], // Not relevant
-        [{ field: 'foo', comparator: Comparator.EQ, value: 'bar' }]
-      );
-
-      const query = services.callCluster.mock.calls[0][1]!;
-
-      expect(query.body).toMatchObject({
-        track_total_hits: true,
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    format: 'epoch_millis',
-                  },
-                },
-              },
-              {
-                term: {
-                  foo: {
-                    value: 'bar',
-                  },
-                },
-              },
-            ],
+  });
+  describe('Criteria filter building', () => {
+    test('Handles positive criteria', () => {
+      const alertParams: LogDocumentCountAlertParams = {
+        ...baseAlertParams,
+        criteria: positiveCriteria,
+      };
+      const filters = buildFiltersFromCriteria(alertParams, TIMESTAMP_FIELD);
+      expect(filters.mustFilters).toEqual([
+        {
+          range: {
+            numericField: {
+              gt: 10,
+            },
           },
         },
-        size: 0,
-      });
-    });
-
-    it('works with `Comparator.NOT_EQ`', async () => {
-      await callExecutor(
-        [2, Comparator.GT, 1], // Not relevant
-        [{ field: 'foo', comparator: Comparator.NOT_EQ, value: 'bar' }]
-      );
-
-      const query = services.callCluster.mock.calls[0][1]!;
-
-      expect(query.body).toMatchObject({
-        track_total_hits: true,
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    format: 'epoch_millis',
-                  },
-                },
-              },
-            ],
-            must_not: [
-              {
-                term: {
-                  foo: {
-                    value: 'bar',
-                  },
-                },
-              },
-            ],
+        {
+          range: {
+            numericField: {
+              gte: 10,
+            },
           },
         },
-        size: 0,
-      });
-    });
-
-    it('works with `Comparator.MATCH`', async () => {
-      await callExecutor(
-        [2, Comparator.GT, 1], // Not relevant
-        [{ field: 'foo', comparator: Comparator.MATCH, value: 'bar' }]
-      );
-
-      const query = services.callCluster.mock.calls[0][1]!;
-
-      expect(query.body).toMatchObject({
-        track_total_hits: true,
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    format: 'epoch_millis',
-                  },
-                },
-              },
-              {
-                match: {
-                  foo: 'bar',
-                },
-              },
-            ],
+        {
+          range: {
+            numericField: {
+              lt: 10,
+            },
           },
         },
-        size: 0,
-      });
-    });
-
-    it('works with `Comparator.NOT_MATCH`', async () => {
-      await callExecutor(
-        [2, Comparator.GT, 1], // Not relevant
-        [{ field: 'foo', comparator: Comparator.NOT_MATCH, value: 'bar' }]
-      );
-
-      const query = services.callCluster.mock.calls[0][1]!;
-
-      expect(query.body).toMatchObject({
-        track_total_hits: true,
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    format: 'epoch_millis',
-                  },
-                },
-              },
-            ],
-            must_not: [
-              {
-                match: {
-                  foo: 'bar',
-                },
-              },
-            ],
+        {
+          range: {
+            numericField: {
+              lte: 10,
+            },
           },
         },
-        size: 0,
-      });
-    });
-
-    it('works with `Comparator.MATCH_PHRASE`', async () => {
-      await callExecutor(
-        [2, Comparator.GT, 1], // Not relevant
-        [{ field: 'foo', comparator: Comparator.MATCH_PHRASE, value: 'bar' }]
-      );
-
-      const query = services.callCluster.mock.calls[0][1]!;
-
-      expect(query.body).toMatchObject({
-        track_total_hits: true,
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    format: 'epoch_millis',
-                  },
-                },
-              },
-              {
-                match_phrase: {
-                  foo: 'bar',
-                },
-              },
-            ],
+        {
+          term: {
+            keywordField: {
+              value: 'error',
+            },
           },
         },
-        size: 0,
-      });
-    });
-
-    it('works with `Comparator.NOT_MATCH_PHRASE`', async () => {
-      await callExecutor(
-        [2, Comparator.GT, 1], // Not relevant
-        [{ field: 'foo', comparator: Comparator.NOT_MATCH_PHRASE, value: 'bar' }]
-      );
-
-      const query = services.callCluster.mock.calls[0][1]!;
-
-      expect(query.body).toMatchObject({
-        track_total_hits: true,
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    format: 'epoch_millis',
-                  },
-                },
-              },
-            ],
-            must_not: [
-              {
-                match_phrase: {
-                  foo: 'bar',
-                },
-              },
-            ],
+        {
+          match: {
+            textField: 'Something went wrong',
           },
         },
-        size: 0,
-      });
-    });
-
-    it('works with `Comparator.GT`', async () => {
-      await callExecutor(
-        [2, Comparator.GT, 1], // Not relevant
-        [{ field: 'foo', comparator: Comparator.GT, value: 1 }]
-      );
-
-      const query = services.callCluster.mock.calls[0][1]!;
-
-      expect(query.body).toMatchObject({
-        track_total_hits: true,
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    format: 'epoch_millis',
-                  },
-                },
-              },
-              {
-                range: {
-                  foo: {
-                    gt: 1,
-                  },
-                },
-              },
-            ],
+        {
+          match_phrase: {
+            textField: 'Something went wrong',
           },
         },
-        size: 0,
-      });
+      ]);
     });
 
-    it('works with `Comparator.GT_OR_EQ`', async () => {
-      await callExecutor(
-        [2, Comparator.GT, 1], // Not relevant
-        [{ field: 'foo', comparator: Comparator.GT_OR_EQ, value: 1 }]
-      );
-
-      const query = services.callCluster.mock.calls[0][1]!;
-
-      expect(query.body).toMatchObject({
-        track_total_hits: true,
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    format: 'epoch_millis',
-                  },
-                },
-              },
-              {
-                range: {
-                  foo: {
-                    gte: 1,
-                  },
-                },
-              },
-            ],
+    test('Handles negative criteria', () => {
+      const alertParams: LogDocumentCountAlertParams = {
+        ...baseAlertParams,
+        criteria: negativeCriteria,
+      };
+      const filters = buildFiltersFromCriteria(alertParams, TIMESTAMP_FIELD);
+
+      expect(filters.mustNotFilters).toEqual([
+        {
+          term: {
+            keywordField: {
+              value: 'error',
+            },
           },
         },
-        size: 0,
-      });
+        {
+          match: {
+            textField: 'Something went wrong',
+          },
+        },
+        {
+          match_phrase: {
+            textField: 'Something went wrong',
+          },
+        },
+      ]);
     });
 
-    it('works with `Comparator.LT`', async () => {
-      await callExecutor(
-        [2, Comparator.GT, 1], // Not relevant
-        [{ field: 'foo', comparator: Comparator.LT, value: 1 }]
-      );
+    test('Handles time range', () => {
+      const alertParams: LogDocumentCountAlertParams = { ...baseAlertParams, criteria: [] };
+      const filters = buildFiltersFromCriteria(alertParams, TIMESTAMP_FIELD);
+      expect(typeof filters.rangeFilter.range[TIMESTAMP_FIELD].gte).toBe('number');
+      expect(typeof filters.rangeFilter.range[TIMESTAMP_FIELD].lte).toBe('number');
+      expect(filters.rangeFilter.range[TIMESTAMP_FIELD].format).toBe('epoch_millis');
 
-      const query = services.callCluster.mock.calls[0][1]!;
+      expect(typeof filters.groupedRangeFilter.range[TIMESTAMP_FIELD].gte).toBe('number');
+      expect(typeof filters.groupedRangeFilter.range[TIMESTAMP_FIELD].lte).toBe('number');
+      expect(filters.groupedRangeFilter.range[TIMESTAMP_FIELD].format).toBe('epoch_millis');
+    });
+  });
 
-      expect(query.body).toMatchObject({
-        track_total_hits: true,
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    format: 'epoch_millis',
+  describe('ES queries', () => {
+    describe('Query generation', () => {
+      test('Correctly generates ungrouped queries', () => {
+        const alertParams: LogDocumentCountAlertParams = {
+          ...baseAlertParams,
+          criteria: [...positiveCriteria, ...negativeCriteria],
+        };
+        const query = getUngroupedESQuery(alertParams, TIMESTAMP_FIELD, FILEBEAT_INDEX);
+        expect(query).toEqual({
+          index: 'filebeat-*',
+          allowNoIndices: true,
+          ignoreUnavailable: true,
+          body: {
+            track_total_hits: true,
+            query: {
+              bool: {
+                filter: [
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: expect.any(Number),
+                        lte: expect.any(Number),
+                        format: 'epoch_millis',
+                      },
+                    },
                   },
-                },
-              },
-              {
-                range: {
-                  foo: {
-                    lt: 1,
+                  {
+                    range: {
+                      numericField: {
+                        gt: 10,
+                      },
+                    },
                   },
-                },
+                  {
+                    range: {
+                      numericField: {
+                        gte: 10,
+                      },
+                    },
+                  },
+                  {
+                    range: {
+                      numericField: {
+                        lt: 10,
+                      },
+                    },
+                  },
+                  {
+                    range: {
+                      numericField: {
+                        lte: 10,
+                      },
+                    },
+                  },
+                  {
+                    term: {
+                      keywordField: {
+                        value: 'error',
+                      },
+                    },
+                  },
+                  {
+                    match: {
+                      textField: 'Something went wrong',
+                    },
+                  },
+                  {
+                    match_phrase: {
+                      textField: 'Something went wrong',
+                    },
+                  },
+                ],
+                must_not: [
+                  {
+                    term: {
+                      keywordField: {
+                        value: 'error',
+                      },
+                    },
+                  },
+                  {
+                    match: {
+                      textField: 'Something went wrong',
+                    },
+                  },
+                  {
+                    match_phrase: {
+                      textField: 'Something went wrong',
+                    },
+                  },
+                ],
               },
-            ],
+            },
+            size: 0,
           },
-        },
-        size: 0,
+        });
       });
-    });
-
-    it('works with `Comparator.LT_OR_EQ`', async () => {
-      await callExecutor(
-        [2, Comparator.GT, 1], // Not relevant
-        [{ field: 'foo', comparator: Comparator.LT_OR_EQ, value: 1 }]
-      );
-
-      const query = services.callCluster.mock.calls[0][1]!;
 
-      expect(query.body).toMatchObject({
-        track_total_hits: true,
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    format: 'epoch_millis',
+      test('Correctly generates grouped queries', () => {
+        const alertParams: LogDocumentCountAlertParams = {
+          ...baseAlertParams,
+          groupBy: ['host.name'],
+          criteria: [...positiveCriteria, ...negativeCriteria],
+        };
+        const query = getGroupedESQuery(alertParams, TIMESTAMP_FIELD, FILEBEAT_INDEX);
+        expect(query).toEqual({
+          index: 'filebeat-*',
+          allowNoIndices: true,
+          ignoreUnavailable: true,
+          body: {
+            query: {
+              bool: {
+                filter: [
+                  {
+                    range: {
+                      '@timestamp': {
+                        gte: expect.any(Number),
+                        lte: expect.any(Number),
+                        format: 'epoch_millis',
+                      },
+                    },
                   },
-                },
+                ],
+                must_not: [
+                  {
+                    term: {
+                      keywordField: {
+                        value: 'error',
+                      },
+                    },
+                  },
+                  {
+                    match: {
+                      textField: 'Something went wrong',
+                    },
+                  },
+                  {
+                    match_phrase: {
+                      textField: 'Something went wrong',
+                    },
+                  },
+                ],
               },
-              {
-                range: {
-                  foo: {
-                    lte: 1,
+            },
+            aggregations: {
+              groups: {
+                composite: {
+                  size: 40,
+                  sources: [
+                    {
+                      'group-0-host.name': {
+                        terms: {
+                          field: 'host.name',
+                        },
+                      },
+                    },
+                  ],
+                },
+                aggregations: {
+                  filtered_results: {
+                    filter: {
+                      bool: {
+                        filter: [
+                          {
+                            range: {
+                              '@timestamp': {
+                                gte: expect.any(Number),
+                                lte: expect.any(Number),
+                                format: 'epoch_millis',
+                              },
+                            },
+                          },
+                          {
+                            range: {
+                              numericField: {
+                                gt: 10,
+                              },
+                            },
+                          },
+                          {
+                            range: {
+                              numericField: {
+                                gte: 10,
+                              },
+                            },
+                          },
+                          {
+                            range: {
+                              numericField: {
+                                lt: 10,
+                              },
+                            },
+                          },
+                          {
+                            range: {
+                              numericField: {
+                                lte: 10,
+                              },
+                            },
+                          },
+                          {
+                            term: {
+                              keywordField: {
+                                value: 'error',
+                              },
+                            },
+                          },
+                          {
+                            match: {
+                              textField: 'Something went wrong',
+                            },
+                          },
+                          {
+                            match_phrase: {
+                              textField: 'Something went wrong',
+                            },
+                          },
+                        ],
+                      },
+                    },
                   },
                 },
               },
-            ],
+            },
+            size: 0,
           },
-        },
-        size: 0,
+        });
       });
     });
   });
 
-  describe('Multiple criteria create the right ES query', () => {
-    beforeEach(() => {
-      services.callCluster.mockReset();
+  describe('Results processors', () => {
+    describe('Can process ungrouped results', () => {
+      test('It handles the OK state correctly', () => {
+        const alertInstanceUpdaterMock = jest.fn();
+        const alertParams = {
+          ...baseAlertParams,
+          criteria: [positiveCriteria[0]],
+        };
+        const results = {
+          hits: {
+            total: {
+              value: 2,
+            },
+          },
+        } as UngroupedSearchQueryResponse;
+        processUngroupedResults(
+          results,
+          alertParams,
+          alertsMock.createAlertInstanceFactory,
+          alertInstanceUpdaterMock
+        );
+        // First call, second argument
+        expect(alertInstanceUpdaterMock.mock.calls[0][1]).toBe(AlertStates.OK);
+        // First call, third argument
+        expect(alertInstanceUpdaterMock.mock.calls[0][2]).toBe(undefined);
+      });
+
+      test('It handles the ALERT state correctly', () => {
+        const alertInstanceUpdaterMock = jest.fn();
+        const alertParams = {
+          ...baseAlertParams,
+          criteria: [positiveCriteria[0]],
+        };
+        const results = {
+          hits: {
+            total: {
+              value: 10,
+            },
+          },
+        } as UngroupedSearchQueryResponse;
+        processUngroupedResults(
+          results,
+          alertParams,
+          alertsMock.createAlertInstanceFactory,
+          alertInstanceUpdaterMock
+        );
+        // First call, second argument
+        expect(alertInstanceUpdaterMock.mock.calls[0][1]).toBe(AlertStates.ALERT);
+        // First call, third argument
+        expect(alertInstanceUpdaterMock.mock.calls[0][2]).toEqual([
+          {
+            actionGroup: 'logs.threshold.fired',
+            context: {
+              conditions: ' numericField more than 10',
+              group: null,
+              matchingDocuments: 10,
+            },
+          },
+        ]);
+      });
     });
-    it('works', async () => {
-      await callExecutor(
-        [2, Comparator.GT, 1], // Not relevant
-        [
-          { field: 'foo', comparator: Comparator.EQ, value: 'bar' },
-          { field: 'http.status', comparator: Comparator.LT, value: 400 },
-        ]
-      );
 
-      const query = services.callCluster.mock.calls[0][1]!;
+    describe('Can process grouped results', () => {
+      test('It handles the OK state correctly', () => {
+        const alertInstanceUpdaterMock = jest.fn();
+        const alertParams = {
+          ...baseAlertParams,
+          criteria: [positiveCriteria[0]],
+          groupBy: ['host.name', 'event.dataset'],
+        };
+        const results = [
+          {
+            key: {
+              'host.name': 'i-am-a-host-name',
+              'event.dataset': 'i-am-a-dataset',
+            },
+            doc_count: 100,
+            filtered_results: {
+              doc_count: 1,
+            },
+          },
+          {
+            key: {
+              'host.name': 'i-am-a-host-name',
+              'event.dataset': 'i-am-a-dataset',
+            },
+            doc_count: 100,
+            filtered_results: {
+              doc_count: 2,
+            },
+          },
+          {
+            key: {
+              'host.name': 'i-am-a-host-name',
+              'event.dataset': 'i-am-a-dataset',
+            },
+            doc_count: 100,
+            filtered_results: {
+              doc_count: 3,
+            },
+          },
+        ] as GroupedSearchQueryResponse['aggregations']['groups']['buckets'];
+        processGroupByResults(
+          results,
+          alertParams,
+          alertsMock.createAlertInstanceFactory,
+          alertInstanceUpdaterMock
+        );
+        expect(alertInstanceUpdaterMock.mock.calls.length).toBe(3);
+        // First call, second argument
+        expect(alertInstanceUpdaterMock.mock.calls[0][1]).toBe(AlertStates.OK);
+        // First call, third argument
+        expect(alertInstanceUpdaterMock.mock.calls[0][2]).toBe(undefined);
+
+        // Second call, second argument
+        expect(alertInstanceUpdaterMock.mock.calls[1][1]).toBe(AlertStates.OK);
+        // Second call, third argument
+        expect(alertInstanceUpdaterMock.mock.calls[1][2]).toBe(undefined);
+
+        // Third call, second argument
+        expect(alertInstanceUpdaterMock.mock.calls[2][1]).toBe(AlertStates.OK);
+        // Third call, third argument
+        expect(alertInstanceUpdaterMock.mock.calls[2][2]).toBe(undefined);
+      });
 
-      expect(query.body).toMatchObject({
-        track_total_hits: true,
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    format: 'epoch_millis',
-                  },
-                },
-              },
-              {
-                term: {
-                  foo: {
-                    value: 'bar',
-                  },
-                },
-              },
-              {
-                range: {
-                  'http.status': {
-                    lt: 400,
-                  },
-                },
-              },
-            ],
+      test('It handles the ALERT state correctly', () => {
+        const alertInstanceUpdaterMock = jest.fn();
+        const alertParams = {
+          ...baseAlertParams,
+          criteria: [positiveCriteria[0]],
+          groupBy: ['host.name', 'event.dataset'],
+        };
+        // Two groups should fire, one shouldn't
+        const results = [
+          {
+            key: {
+              'host.name': 'i-am-a-host-name-1',
+              'event.dataset': 'i-am-a-dataset-1',
+            },
+            doc_count: 100,
+            filtered_results: {
+              doc_count: 10,
+            },
           },
-        },
-        size: 0,
+          {
+            key: {
+              'host.name': 'i-am-a-host-name-2',
+              'event.dataset': 'i-am-a-dataset-2',
+            },
+            doc_count: 100,
+            filtered_results: {
+              doc_count: 2,
+            },
+          },
+          {
+            key: {
+              'host.name': 'i-am-a-host-name-3',
+              'event.dataset': 'i-am-a-dataset-3',
+            },
+            doc_count: 100,
+            filtered_results: {
+              doc_count: 20,
+            },
+          },
+        ] as GroupedSearchQueryResponse['aggregations']['groups']['buckets'];
+        processGroupByResults(
+          results,
+          alertParams,
+          alertsMock.createAlertInstanceFactory,
+          alertInstanceUpdaterMock
+        );
+        expect(alertInstanceUpdaterMock.mock.calls.length).toBe(results.length);
+        // First call, second argument
+        expect(alertInstanceUpdaterMock.mock.calls[0][1]).toBe(AlertStates.ALERT);
+        // First call, third argument
+        expect(alertInstanceUpdaterMock.mock.calls[0][2]).toEqual([
+          {
+            actionGroup: 'logs.threshold.fired',
+            context: {
+              conditions: ' numericField more than 10',
+              group: 'i-am-a-host-name-1, i-am-a-dataset-1',
+              matchingDocuments: 10,
+            },
+          },
+        ]);
+
+        // Second call, second argument
+        expect(alertInstanceUpdaterMock.mock.calls[1][1]).toBe(AlertStates.OK);
+        // Second call, third argument
+        expect(alertInstanceUpdaterMock.mock.calls[1][2]).toBe(undefined);
+
+        // Third call, second argument
+        expect(alertInstanceUpdaterMock.mock.calls[2][1]).toBe(AlertStates.ALERT);
+        // Third call, third argument
+        expect(alertInstanceUpdaterMock.mock.calls[2][2]).toEqual([
+          {
+            actionGroup: 'logs.threshold.fired',
+            context: {
+              conditions: ' numericField more than 10',
+              group: 'i-am-a-host-name-3, i-am-a-dataset-3',
+              matchingDocuments: 20,
+            },
+          },
+        ]);
       });
     });
   });
diff --git a/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts
index db76e955f00734..224b898141c364 100644
--- a/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts
@@ -5,7 +5,12 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { AlertExecutorOptions, AlertServices } from '../../../../../alerts/server';
+import {
+  AlertExecutorOptions,
+  AlertServices,
+  AlertInstance,
+  AlertInstanceContext,
+} from '../../../../../alerts/server';
 import {
   AlertStates,
   Comparator,
@@ -19,7 +24,6 @@ import {
 } from '../../../../common/alerting/logs/types';
 import { InfraBackendLibs } from '../../infra_types';
 import { getIntervalInSeconds } from '../../../utils/get_interval_in_seconds';
-import { InfraSource } from '../../../../common/http_api/source_api';
 import { decodeOrThrow } from '../../../../common/runtime_types';
 import { UNGROUPED_FACTORY_KEY } from '../common/utils';
 
@@ -42,6 +46,7 @@ export const createLogThresholdExecutor = (libs: InfraBackendLibs) =>
 
     const sourceConfiguration = await sources.getSourceConfiguration(savedObjectsClient, 'default');
     const indexPattern = sourceConfiguration.configuration.logAlias;
+    const timestampField = sourceConfiguration.configuration.fields.timestamp;
     const alertInstance = alertInstanceFactory(UNGROUPED_FACTORY_KEY);
 
     try {
@@ -49,8 +54,8 @@ export const createLogThresholdExecutor = (libs: InfraBackendLibs) =>
 
       const query =
         groupBy && groupBy.length > 0
-          ? getGroupedESQuery(validatedParams, sourceConfiguration.configuration, indexPattern)
-          : getUngroupedESQuery(validatedParams, sourceConfiguration.configuration, indexPattern);
+          ? getGroupedESQuery(validatedParams, timestampField, indexPattern)
+          : getUngroupedESQuery(validatedParams, timestampField, indexPattern);
 
       if (!query) {
         throw new Error('ES query could not be built from the provided alert params');
@@ -60,13 +65,15 @@ export const createLogThresholdExecutor = (libs: InfraBackendLibs) =>
         processGroupByResults(
           await getGroupedResults(query, callCluster),
           validatedParams,
-          alertInstanceFactory
+          alertInstanceFactory,
+          updateAlertInstance
         );
       } else {
         processUngroupedResults(
           await getUngroupedResults(query, callCluster),
           validatedParams,
-          alertInstanceFactory
+          alertInstanceFactory,
+          updateAlertInstance
         );
       }
     } catch (e) {
@@ -78,10 +85,11 @@ export const createLogThresholdExecutor = (libs: InfraBackendLibs) =>
     }
   };
 
-const processUngroupedResults = (
+export const processUngroupedResults = (
   results: UngroupedSearchQueryResponse,
   params: LogDocumentCountAlertParams,
-  alertInstanceFactory: AlertExecutorOptions['services']['alertInstanceFactory']
+  alertInstanceFactory: AlertExecutorOptions['services']['alertInstanceFactory'],
+  alertInstaceUpdater: AlertInstanceUpdater
 ) => {
   const { count, criteria } = params;
 
@@ -89,19 +97,18 @@ const processUngroupedResults = (
   const documentCount = results.hits.total.value;
 
   if (checkValueAgainstComparatorMap[count.comparator](documentCount, count.value)) {
-    alertInstance.scheduleActions(FIRED_ACTIONS.id, {
-      matchingDocuments: documentCount,
-      conditions: createConditionsMessage(criteria),
-      group: null,
-    });
-
-    alertInstance.replaceState({
-      alertState: AlertStates.ALERT,
-    });
+    alertInstaceUpdater(alertInstance, AlertStates.ALERT, [
+      {
+        actionGroup: FIRED_ACTIONS.id,
+        context: {
+          matchingDocuments: documentCount,
+          conditions: createConditionsMessage(criteria),
+          group: null,
+        },
+      },
+    ]);
   } else {
-    alertInstance.replaceState({
-      alertState: AlertStates.OK,
-    });
+    alertInstaceUpdater(alertInstance, AlertStates.OK);
   }
 };
 
@@ -110,10 +117,11 @@ interface ReducedGroupByResults {
   documentCount: number;
 }
 
-const processGroupByResults = (
+export const processGroupByResults = (
   results: GroupedSearchQueryResponse['aggregations']['groups']['buckets'],
   params: LogDocumentCountAlertParams,
-  alertInstanceFactory: AlertExecutorOptions['services']['alertInstanceFactory']
+  alertInstanceFactory: AlertExecutorOptions['services']['alertInstanceFactory'],
+  alertInstaceUpdater: AlertInstanceUpdater
 ) => {
   const { count, criteria } = params;
 
@@ -128,23 +136,41 @@ const processGroupByResults = (
     const documentCount = group.documentCount;
 
     if (checkValueAgainstComparatorMap[count.comparator](documentCount, count.value)) {
-      alertInstance.scheduleActions(FIRED_ACTIONS.id, {
-        matchingDocuments: documentCount,
-        conditions: createConditionsMessage(criteria),
-        group: group.name,
-      });
-
-      alertInstance.replaceState({
-        alertState: AlertStates.ALERT,
-      });
+      alertInstaceUpdater(alertInstance, AlertStates.ALERT, [
+        {
+          actionGroup: FIRED_ACTIONS.id,
+          context: {
+            matchingDocuments: documentCount,
+            conditions: createConditionsMessage(criteria),
+            group: group.name,
+          },
+        },
+      ]);
     } else {
-      alertInstance.replaceState({
-        alertState: AlertStates.OK,
-      });
+      alertInstaceUpdater(alertInstance, AlertStates.OK);
     }
   });
 };
 
+type AlertInstanceUpdater = (
+  alertInstance: AlertInstance,
+  state: AlertStates,
+  actions?: Array<{ actionGroup: string; context: AlertInstanceContext }>
+) => void;
+
+export const updateAlertInstance: AlertInstanceUpdater = (alertInstance, state, actions) => {
+  if (actions && actions.length > 0) {
+    actions.forEach((actionSet) => {
+      const { actionGroup, context } = actionSet;
+      alertInstance.scheduleActions(actionGroup, context);
+    });
+  }
+
+  alertInstance.replaceState({
+    alertState: state,
+  });
+};
+
 export const buildFiltersFromCriteria = (
   params: Omit<LogDocumentCountAlertParams, 'count'>,
   timestampField: string
@@ -198,7 +224,7 @@ export const buildFiltersFromCriteria = (
 
 export const getGroupedESQuery = (
   params: Omit<LogDocumentCountAlertParams, 'count'>,
-  sourceConfiguration: InfraSource['configuration'],
+  timestampField: string,
   index: string
 ): object | undefined => {
   const { groupBy } = params;
@@ -207,8 +233,6 @@ export const getGroupedESQuery = (
     return;
   }
 
-  const timestampField = sourceConfiguration.fields.timestamp;
-
   const { rangeFilter, groupedRangeFilter, mustFilters, mustNotFilters } = buildFiltersFromCriteria(
     params,
     timestampField
@@ -258,12 +282,12 @@ export const getGroupedESQuery = (
 
 export const getUngroupedESQuery = (
   params: Omit<LogDocumentCountAlertParams, 'count'>,
-  sourceConfiguration: InfraSource['configuration'],
+  timestampField: string,
   index: string
 ): object => {
   const { rangeFilter, mustFilters, mustNotFilters } = buildFiltersFromCriteria(
     params,
-    sourceConfiguration.fields.timestamp
+    timestampField
   );
 
   const body = {
@@ -357,7 +381,7 @@ const buildCriterionQuery = (criterion: Criterion): Filter | undefined => {
   }
 };
 
-const getPositiveComparators = () => {
+export const getPositiveComparators = () => {
   return [
     Comparator.GT,
     Comparator.GT_OR_EQ,
@@ -369,11 +393,11 @@ const getPositiveComparators = () => {
   ];
 };
 
-const getNegativeComparators = () => {
+export const getNegativeComparators = () => {
   return [Comparator.NOT_EQ, Comparator.NOT_MATCH, Comparator.NOT_MATCH_PHRASE];
 };
 
-const queryMappings: {
+export const queryMappings: {
   [key: string]: string;
 } = {
   [Comparator.GT]: 'range',
diff --git a/x-pack/plugins/infra/server/plugin.ts b/x-pack/plugins/infra/server/plugin.ts
index 7cd6383a9b2e5e..51f91d7189db70 100644
--- a/x-pack/plugins/infra/server/plugin.ts
+++ b/x-pack/plugins/infra/server/plugin.ts
@@ -152,9 +152,8 @@ export class InfraServerPlugin {
     core.http.registerRouteHandlerContext(
       'infra',
       (context, request): InfraRequestHandlerContext => {
-        const mlSystem = context.ml && plugins.ml?.mlSystemProvider(context.ml?.mlClient, request);
-        const mlAnomalyDetectors =
-          context.ml && plugins.ml?.anomalyDetectorsProvider(context.ml?.mlClient, request);
+        const mlSystem = plugins.ml?.mlSystemProvider(request);
+        const mlAnomalyDetectors = plugins.ml?.anomalyDetectorsProvider(request);
         const spaceId = plugins.spaces?.spacesService.getSpaceId(request) || 'default';
 
         return {
diff --git a/x-pack/plugins/ingest_manager/common/constants/agent.ts b/x-pack/plugins/ingest_manager/common/constants/agent.ts
index 6d0d9ee801a941..82d2ad712ef023 100644
--- a/x-pack/plugins/ingest_manager/common/constants/agent.ts
+++ b/x-pack/plugins/ingest_manager/common/constants/agent.ts
@@ -12,6 +12,7 @@ export const AGENT_TYPE_PERMANENT = 'PERMANENT';
 export const AGENT_TYPE_EPHEMERAL = 'EPHEMERAL';
 export const AGENT_TYPE_TEMPORARY = 'TEMPORARY';
 
+export const AGENT_POLLING_REQUEST_TIMEOUT_MS = 300000; // 5 minutes
 export const AGENT_POLLING_THRESHOLD_MS = 30000;
 export const AGENT_POLLING_INTERVAL = 1000;
 export const AGENT_UPDATE_LAST_CHECKIN_INTERVAL_MS = 30000;
diff --git a/x-pack/plugins/ingest_manager/common/openapi/spec_oas3.json b/x-pack/plugins/ingest_manager/common/openapi/spec_oas3.json
index 8c9ede1fde9ba1..d75a914e080d73 100644
--- a/x-pack/plugins/ingest_manager/common/openapi/spec_oas3.json
+++ b/x-pack/plugins/ingest_manager/common/openapi/spec_oas3.json
@@ -43,12 +43,9 @@
                     },
                     "perPage": {
                       "type": "number"
-                    },
-                    "success": {
-                      "type": "boolean"
                     }
                   },
-                  "required": ["items", "total", "page", "perPage", "success"]
+                  "required": ["items", "total", "page", "perPage"]
                 },
                 "examples": {
                   "success": {
@@ -71,8 +68,7 @@
                       ],
                       "total": 1,
                       "page": 1,
-                      "perPage": 50,
-                      "success": true
+                      "perPage": 50
                     }
                   }
                 }
@@ -107,9 +103,6 @@
                   "properties": {
                     "item": {
                       "$ref": "#/components/schemas/AgentPolicy"
-                    },
-                    "success": {
-                      "type": "boolean"
                     }
                   }
                 }
@@ -159,12 +152,9 @@
                   "properties": {
                     "item": {
                       "$ref": "#/components/schemas/AgentPolicy"
-                    },
-                    "success": {
-                      "type": "boolean"
                     }
                   },
-                  "required": ["item", "success"]
+                  "required": ["item"]
                 },
                 "examples": {
                   "success": {
@@ -707,8 +697,7 @@
                         "revision": 2,
                         "updated_on": "2020-05-06T17:32:21.905Z",
                         "updated_by": "system"
-                      },
-                      "success": true
+                      }
                     }
                   }
                 }
@@ -733,12 +722,9 @@
                   "properties": {
                     "item": {
                       "$ref": "#/components/schemas/AgentPolicy"
-                    },
-                    "success": {
-                      "type": "boolean"
                     }
                   },
-                  "required": ["item", "success"]
+                  "required": ["item"]
                 },
                 "examples": {
                   "example-1": {
@@ -751,8 +737,7 @@
                         "updated_on": "Fri Feb 28 2020 16:22:31 GMT-0500 (Eastern Standard Time)",
                         "updated_by": "elastic",
                         "packagePolicies": []
-                      },
-                      "success": true
+                      }
                     }
                   }
                 }
@@ -810,12 +795,9 @@
                   "properties": {
                     "item": {
                       "$ref": "#/components/schemas/AgentPolicy"
-                    },
-                    "success": {
-                      "type": "boolean"
                     }
                   },
-                  "required": ["item", "success"]
+                  "required": ["item"]
                 }
               }
             }
@@ -948,12 +930,9 @@
                     },
                     "perPage": {
                       "type": "number"
-                    },
-                    "success": {
-                      "type": "boolean"
                     }
                   },
-                  "required": ["items", "success"]
+                  "required": ["items"]
                 },
                 "examples": {
                   "example-1": {
@@ -1157,8 +1136,7 @@
                       ],
                       "total": 6,
                       "page": 1,
-                      "perPage": 20,
-                      "success": true
+                      "perPage": 20
                     }
                   }
                 }
@@ -1251,12 +1229,9 @@
                   "properties": {
                     "item": {
                       "$ref": "#/components/schemas/PackagePolicy"
-                    },
-                    "success": {
-                      "type": "boolean"
                     }
                   },
-                  "required": ["item", "success"]
+                  "required": ["item"]
                 }
               }
             }
@@ -1415,9 +1390,6 @@
                       "properties": {
                         "response": {
                           "$ref": "#/components/schemas/PackageInfo"
-                        },
-                        "success": {
-                          "type": "boolean"
                         }
                       }
                     },
@@ -1709,8 +1681,7 @@
                           },
                           "references": []
                         }
-                      },
-                      "success": true
+                      }
                     }
                   },
                   "required-package": {
@@ -1899,8 +1870,7 @@
                           },
                           "references": []
                         }
-                      },
-                      "success": true
+                      }
                     }
                   }
                 }
@@ -1950,12 +1920,9 @@
                         },
                         "required": ["id", "type"]
                       }
-                    },
-                    "success": {
-                      "type": "boolean"
                     }
                   },
-                  "required": ["response", "success"]
+                  "required": ["response"]
                 }
               }
             }
@@ -1994,12 +1961,9 @@
                         },
                         "required": ["id", "type"]
                       }
-                    },
-                    "success": {
-                      "type": "boolean"
                     }
                   },
-                  "required": ["response", "success"]
+                  "required": ["response"]
                 }
               }
             }
@@ -2678,8 +2642,7 @@
                           "version": "1.0.0",
                           "status": "not_installed"
                         }
-                      ],
-                      "success": true
+                      ]
                     }
                   }
                 }
@@ -2743,9 +2706,6 @@
                         "type": "object"
                       }
                     },
-                    "success": {
-                      "type": "boolean"
-                    },
                     "total": {
                       "type": "number"
                     },
@@ -2756,7 +2716,7 @@
                       "type": "number"
                     }
                   },
-                  "required": ["list", "success", "total", "page", "perPage"]
+                  "required": ["list", "total", "page", "perPage"]
                 },
                 "examples": {
                   "example-1": {
@@ -2793,7 +2753,6 @@
                           "status": "online"
                         }
                       ],
-                      "success": true,
                       "total": 1,
                       "page": 1,
                       "perPage": 20
@@ -2836,12 +2795,9 @@
                   "properties": {
                     "item": {
                       "type": "object"
-                    },
-                    "success": {
-                      "type": "string"
                     }
                   },
-                  "required": ["item", "success"]
+                  "required": ["item"]
                 }
               }
             }
@@ -2916,9 +2872,6 @@
                       "type": "string",
                       "enum": ["checkin"]
                     },
-                    "success": {
-                      "type": "string"
-                    },
                     "actions": {
                       "type": "array",
                       "items": {
@@ -2950,7 +2903,6 @@
                   "success": {
                     "value": {
                       "action": "checkin",
-                      "success": true,
                       "actions": [
                         {
                           "agent_id": "a6f14bd2-1a2a-481c-9212-9494d064ffdf",
@@ -3346,21 +3298,17 @@
                 "schema": {
                   "type": "object",
                   "properties": {
-                    "success": {
-                      "type": "boolean"
-                    },
                     "action": {
                       "type": "string",
                       "enum": ["acks"]
                     }
                   },
-                  "required": ["success", "action"]
+                  "required": ["action"]
                 },
                 "examples": {
                   "success": {
                     "value": {
-                      "action": "checkin",
-                      "success": true
+                      "action": "checkin"
                     }
                   }
                 }
@@ -3417,9 +3365,6 @@
                     "action": {
                       "type": "string"
                     },
-                    "success": {
-                      "type": "boolean"
-                    },
                     "item": {
                       "$ref": "#/components/schemas/Agent"
                     }
@@ -3429,7 +3374,6 @@
                   "success": {
                     "value": {
                       "action": "created",
-                      "success": true,
                       "item": {
                         "id": "8086fb1a-72ca-4a67-8533-09300c1639fa",
                         "active": true,
diff --git a/x-pack/plugins/ingest_manager/common/services/index.ts b/x-pack/plugins/ingest_manager/common/services/index.ts
index ad739bf9ff844d..46a1c65872d1b6 100644
--- a/x-pack/plugins/ingest_manager/common/services/index.ts
+++ b/x-pack/plugins/ingest_manager/common/services/index.ts
@@ -11,3 +11,4 @@ export { fullAgentPolicyToYaml } from './full_agent_policy_to_yaml';
 export { isPackageLimited, doesAgentPolicyAlreadyIncludePackage } from './limited_package';
 export { decodeCloudId } from './decode_cloud_id';
 export { isValidNamespace } from './is_valid_namespace';
+export { isDiffPathProtocol } from './is_diff_path_protocol';
diff --git a/x-pack/plugins/ingest_manager/common/services/is_diff_path_protocol.test.ts b/x-pack/plugins/ingest_manager/common/services/is_diff_path_protocol.test.ts
new file mode 100644
index 00000000000000..c488d552d7676a
--- /dev/null
+++ b/x-pack/plugins/ingest_manager/common/services/is_diff_path_protocol.test.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { isDiffPathProtocol } from './is_diff_path_protocol';
+
+describe('Ingest Manager - isDiffPathProtocol', () => {
+  it('returns true for different paths', () => {
+    expect(
+      isDiffPathProtocol([
+        'http://localhost:8888/abc',
+        'http://localhost:8888/abc',
+        'http://localhost:8888/efg',
+      ])
+    ).toBe(true);
+  });
+  it('returns true for different protocols', () => {
+    expect(
+      isDiffPathProtocol([
+        'http://localhost:8888/abc',
+        'https://localhost:8888/abc',
+        'http://localhost:8888/abc',
+      ])
+    ).toBe(true);
+  });
+  it('returns false for same paths and protocols and different host or port', () => {
+    expect(
+      isDiffPathProtocol([
+        'http://localhost:8888/abc',
+        'http://localhost2:8888/abc',
+        'http://localhost:8883/abc',
+      ])
+    ).toBe(false);
+  });
+  it('returns false for one url', () => {
+    expect(isDiffPathProtocol(['http://localhost:8888/abc'])).toBe(false);
+  });
+});
diff --git a/x-pack/plugins/ingest_manager/common/services/is_diff_path_protocol.ts b/x-pack/plugins/ingest_manager/common/services/is_diff_path_protocol.ts
new file mode 100644
index 00000000000000..666e886d745b15
--- /dev/null
+++ b/x-pack/plugins/ingest_manager/common/services/is_diff_path_protocol.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+// validates an array of urls have the same path and protocol
+export function isDiffPathProtocol(kibanaUrls: string[]) {
+  const urlCompare = new URL(kibanaUrls[0]);
+  const compareProtocol = urlCompare.protocol;
+  const comparePathname = urlCompare.pathname;
+  return kibanaUrls.some((v) => {
+    const url = new URL(v);
+    const protocol = url.protocol;
+    const pathname = url.pathname;
+    return compareProtocol !== protocol || comparePathname !== pathname;
+  });
+}
diff --git a/x-pack/plugins/ingest_manager/common/services/package_policies_to_agent_inputs.test.ts b/x-pack/plugins/ingest_manager/common/services/package_policies_to_agent_inputs.test.ts
index 956423a4973731..1df06df1de2750 100644
--- a/x-pack/plugins/ingest_manager/common/services/package_policies_to_agent_inputs.test.ts
+++ b/x-pack/plugins/ingest_manager/common/services/package_policies_to_agent_inputs.test.ts
@@ -117,6 +117,7 @@ describe('Ingest Manager - storedPackagePoliciesToAgentInputs', () => {
       {
         id: 'some-uuid',
         name: 'mock-package-policy',
+        revision: 1,
         type: 'test-logs',
         data_stream: { namespace: 'default' },
         use_output: 'default',
@@ -159,6 +160,7 @@ describe('Ingest Manager - storedPackagePoliciesToAgentInputs', () => {
       {
         id: 'some-uuid',
         name: 'mock-package-policy',
+        revision: 1,
         type: 'test-logs',
         data_stream: { namespace: 'default' },
         use_output: 'default',
diff --git a/x-pack/plugins/ingest_manager/common/services/package_policies_to_agent_inputs.ts b/x-pack/plugins/ingest_manager/common/services/package_policies_to_agent_inputs.ts
index 639f20eb088281..e74256ce732a61 100644
--- a/x-pack/plugins/ingest_manager/common/services/package_policies_to_agent_inputs.ts
+++ b/x-pack/plugins/ingest_manager/common/services/package_policies_to_agent_inputs.ts
@@ -22,6 +22,7 @@ export const storedPackagePoliciesToAgentInputs = (
 
       const fullInput: FullAgentPolicyInput = {
         id: packagePolicy.id || packagePolicy.name,
+        revision: packagePolicy.revision,
         name: packagePolicy.name,
         type: input.type,
         data_stream: {
diff --git a/x-pack/plugins/ingest_manager/common/types/index.ts b/x-pack/plugins/ingest_manager/common/types/index.ts
index cafd0f03f66e29..d62f4fbb023dc0 100644
--- a/x-pack/plugins/ingest_manager/common/types/index.ts
+++ b/x-pack/plugins/ingest_manager/common/types/index.ts
@@ -15,7 +15,7 @@ export interface IngestManagerConfigType {
     pollingRequestTimeout: number;
     maxConcurrentConnections: number;
     kibana: {
-      host?: string;
+      host?: string[] | string;
       ca_sha256?: string;
     };
     elasticsearch: {
diff --git a/x-pack/plugins/ingest_manager/common/types/models/agent_policy.ts b/x-pack/plugins/ingest_manager/common/types/models/agent_policy.ts
index c626c85d3fb24f..b3b3004f4fc5d6 100644
--- a/x-pack/plugins/ingest_manager/common/types/models/agent_policy.ts
+++ b/x-pack/plugins/ingest_manager/common/types/models/agent_policy.ts
@@ -42,6 +42,7 @@ export interface FullAgentPolicyInputStream {
 export interface FullAgentPolicyInput {
   id: string;
   name: string;
+  revision: number;
   type: string;
   data_stream: { namespace: string };
   use_output: string;
@@ -60,6 +61,11 @@ export interface FullAgentPolicy {
       [key: string]: any;
     };
   };
+  fleet?: {
+    kibana: {
+      hosts: string[];
+    };
+  };
   inputs: FullAgentPolicyInput[];
   revision?: number;
   agent?: {
diff --git a/x-pack/plugins/ingest_manager/common/types/models/settings.ts b/x-pack/plugins/ingest_manager/common/types/models/settings.ts
index 98d99911f1b3fc..f554f4b392ad6e 100644
--- a/x-pack/plugins/ingest_manager/common/types/models/settings.ts
+++ b/x-pack/plugins/ingest_manager/common/types/models/settings.ts
@@ -5,10 +5,10 @@
  */
 import { SavedObjectAttributes } from 'src/core/public';
 
-interface BaseSettings {
-  agent_auto_upgrade?: boolean;
-  package_auto_upgrade?: boolean;
-  kibana_url?: string;
+export interface BaseSettings {
+  agent_auto_upgrade: boolean;
+  package_auto_upgrade: boolean;
+  kibana_urls: string[];
   kibana_ca_sha256?: string;
   has_seen_add_data_notice?: boolean;
 }
diff --git a/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts b/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts
index 4a50938049a7b2..cf8d3ab1c908ac 100644
--- a/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts
+++ b/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts
@@ -28,7 +28,6 @@ export interface GetAgentsResponse {
   total: number;
   page: number;
   perPage: number;
-  success: boolean;
 }
 
 export interface GetOneAgentRequest {
@@ -39,7 +38,6 @@ export interface GetOneAgentRequest {
 
 export interface GetOneAgentResponse {
   item: Agent;
-  success: boolean;
 }
 
 export interface PostAgentCheckinRequest {
@@ -55,7 +53,7 @@ export interface PostAgentCheckinRequest {
 
 export interface PostAgentCheckinResponse {
   action: string;
-  success: boolean;
+
   actions: AgentAction[];
 }
 
@@ -72,7 +70,7 @@ export interface PostAgentEnrollRequest {
 
 export interface PostAgentEnrollResponse {
   action: string;
-  success: boolean;
+
   item: Agent & { status: AgentStatus };
 }
 
@@ -87,7 +85,6 @@ export interface PostAgentAcksRequest {
 
 export interface PostAgentAcksResponse {
   action: string;
-  success: boolean;
 }
 
 export interface PostNewAgentActionRequest {
@@ -100,7 +97,6 @@ export interface PostNewAgentActionRequest {
 }
 
 export interface PostNewAgentActionResponse {
-  success: boolean;
   item: AgentAction;
 }
 
@@ -110,9 +106,8 @@ export interface PostAgentUnenrollRequest {
   };
 }
 
-export interface PostAgentUnenrollResponse {
-  success: boolean;
-}
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface PostAgentUnenrollResponse {}
 
 export interface PutAgentReassignRequest {
   params: {
@@ -121,9 +116,8 @@ export interface PutAgentReassignRequest {
   body: { policy_id: string };
 }
 
-export interface PutAgentReassignResponse {
-  success: boolean;
-}
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface PutAgentReassignResponse {}
 
 export interface GetOneAgentEventsRequest {
   params: {
@@ -141,7 +135,6 @@ export interface GetOneAgentEventsResponse {
   total: number;
   page: number;
   perPage: number;
-  success: boolean;
 }
 
 export interface DeleteAgentRequest {
@@ -166,7 +159,6 @@ export interface GetAgentStatusRequest {
 }
 
 export interface GetAgentStatusResponse {
-  success: boolean;
   results: {
     events: number;
     total: number;
diff --git a/x-pack/plugins/ingest_manager/common/types/rest_spec/agent_policy.ts b/x-pack/plugins/ingest_manager/common/types/rest_spec/agent_policy.ts
index 4683727ed51ac3..aa9fbc20fc0b03 100644
--- a/x-pack/plugins/ingest_manager/common/types/rest_spec/agent_policy.ts
+++ b/x-pack/plugins/ingest_manager/common/types/rest_spec/agent_policy.ts
@@ -19,7 +19,6 @@ export interface GetAgentPoliciesResponse {
   total: number;
   page: number;
   perPage: number;
-  success: boolean;
 }
 
 export interface GetOneAgentPolicyRequest {
@@ -30,7 +29,6 @@ export interface GetOneAgentPolicyRequest {
 
 export interface GetOneAgentPolicyResponse {
   item: AgentPolicy;
-  success: boolean;
 }
 
 export interface CreateAgentPolicyRequest {
@@ -39,7 +37,6 @@ export interface CreateAgentPolicyRequest {
 
 export interface CreateAgentPolicyResponse {
   item: AgentPolicy;
-  success: boolean;
 }
 
 export type UpdateAgentPolicyRequest = GetOneAgentPolicyRequest & {
@@ -48,7 +45,6 @@ export type UpdateAgentPolicyRequest = GetOneAgentPolicyRequest & {
 
 export interface UpdateAgentPolicyResponse {
   item: AgentPolicy;
-  success: boolean;
 }
 
 export interface CopyAgentPolicyRequest {
@@ -57,7 +53,6 @@ export interface CopyAgentPolicyRequest {
 
 export interface CopyAgentPolicyResponse {
   item: AgentPolicy;
-  success: boolean;
 }
 
 export interface DeleteAgentPolicyRequest {
@@ -68,7 +63,6 @@ export interface DeleteAgentPolicyRequest {
 
 export interface DeleteAgentPolicyResponse {
   id: string;
-  success: boolean;
 }
 
 export interface GetFullAgentPolicyRequest {
@@ -79,5 +73,4 @@ export interface GetFullAgentPolicyRequest {
 
 export interface GetFullAgentPolicyResponse {
   item: FullAgentPolicy;
-  success: boolean;
 }
diff --git a/x-pack/plugins/ingest_manager/common/types/rest_spec/enrollment_api_key.ts b/x-pack/plugins/ingest_manager/common/types/rest_spec/enrollment_api_key.ts
index 1929955cac84c9..1d1c2f79bf6cb7 100644
--- a/x-pack/plugins/ingest_manager/common/types/rest_spec/enrollment_api_key.ts
+++ b/x-pack/plugins/ingest_manager/common/types/rest_spec/enrollment_api_key.ts
@@ -19,7 +19,6 @@ export interface GetEnrollmentAPIKeysResponse {
   total: number;
   page: number;
   perPage: number;
-  success: boolean;
 }
 
 export interface GetOneEnrollmentAPIKeyRequest {
@@ -30,7 +29,6 @@ export interface GetOneEnrollmentAPIKeyRequest {
 
 export interface GetOneEnrollmentAPIKeyResponse {
   item: EnrollmentAPIKey;
-  success: boolean;
 }
 
 export interface DeleteEnrollmentAPIKeyRequest {
@@ -41,7 +39,6 @@ export interface DeleteEnrollmentAPIKeyRequest {
 
 export interface DeleteEnrollmentAPIKeyResponse {
   action: string;
-  success: boolean;
 }
 
 export interface PostEnrollmentAPIKeyRequest {
@@ -55,5 +52,4 @@ export interface PostEnrollmentAPIKeyRequest {
 export interface PostEnrollmentAPIKeyResponse {
   action: string;
   item: EnrollmentAPIKey;
-  success: boolean;
 }
diff --git a/x-pack/plugins/ingest_manager/common/types/rest_spec/epm.ts b/x-pack/plugins/ingest_manager/common/types/rest_spec/epm.ts
index 1901b8c0c70394..5fb718f91b8762 100644
--- a/x-pack/plugins/ingest_manager/common/types/rest_spec/epm.ts
+++ b/x-pack/plugins/ingest_manager/common/types/rest_spec/epm.ts
@@ -20,7 +20,6 @@ export interface GetCategoriesRequest {
 
 export interface GetCategoriesResponse {
   response: CategorySummaryList;
-  success: boolean;
 }
 
 export interface GetPackagesRequest {
@@ -39,12 +38,10 @@ export interface GetPackagesResponse {
       >
     >
   >;
-  success: boolean;
 }
 
 export interface GetLimitedPackagesResponse {
   response: string[];
-  success: boolean;
 }
 
 export interface GetFileRequest {
@@ -62,7 +59,6 @@ export interface GetInfoRequest {
 
 export interface GetInfoResponse {
   response: PackageInfo;
-  success: boolean;
 }
 
 export interface InstallPackageRequest {
@@ -73,7 +69,6 @@ export interface InstallPackageRequest {
 
 export interface InstallPackageResponse {
   response: AssetReference[];
-  success: boolean;
 }
 
 export interface DeletePackageRequest {
@@ -84,5 +79,4 @@ export interface DeletePackageRequest {
 
 export interface DeletePackageResponse {
   response: AssetReference[];
-  success: boolean;
 }
diff --git a/x-pack/plugins/ingest_manager/common/types/rest_spec/output.ts b/x-pack/plugins/ingest_manager/common/types/rest_spec/output.ts
index 41620603633818..87e8a0977e3ba7 100644
--- a/x-pack/plugins/ingest_manager/common/types/rest_spec/output.ts
+++ b/x-pack/plugins/ingest_manager/common/types/rest_spec/output.ts
@@ -7,7 +7,6 @@ import { Output } from '../models';
 
 export interface GetOneOutputResponse {
   item: Output;
-  success: boolean;
 }
 
 export interface GetOneOutputRequest {
@@ -28,7 +27,6 @@ export interface PutOutputRequest {
 
 export interface PutOutputResponse {
   item: Output;
-  success: boolean;
 }
 
 export interface GetOutputsResponse {
@@ -36,5 +34,4 @@ export interface GetOutputsResponse {
   total: number;
   page: number;
   perPage: number;
-  success: boolean;
 }
diff --git a/x-pack/plugins/ingest_manager/common/types/rest_spec/package_policy.ts b/x-pack/plugins/ingest_manager/common/types/rest_spec/package_policy.ts
index e5bba3d6deab3e..61669ab876d802 100644
--- a/x-pack/plugins/ingest_manager/common/types/rest_spec/package_policy.ts
+++ b/x-pack/plugins/ingest_manager/common/types/rest_spec/package_policy.ts
@@ -18,7 +18,6 @@ export interface GetPackagePoliciesResponse {
   total: number;
   page: number;
   perPage: number;
-  success: boolean;
 }
 
 export interface GetOnePackagePolicyRequest {
@@ -29,7 +28,6 @@ export interface GetOnePackagePolicyRequest {
 
 export interface GetOnePackagePolicyResponse {
   item: PackagePolicy;
-  success: boolean;
 }
 
 export interface CreatePackagePolicyRequest {
@@ -38,7 +36,6 @@ export interface CreatePackagePolicyRequest {
 
 export interface CreatePackagePolicyResponse {
   item: PackagePolicy;
-  success: boolean;
 }
 
 export type UpdatePackagePolicyRequest = GetOnePackagePolicyRequest & {
diff --git a/x-pack/plugins/ingest_manager/common/types/rest_spec/settings.ts b/x-pack/plugins/ingest_manager/common/types/rest_spec/settings.ts
index c02a5e5878ee91..90d623b8a4be94 100644
--- a/x-pack/plugins/ingest_manager/common/types/rest_spec/settings.ts
+++ b/x-pack/plugins/ingest_manager/common/types/rest_spec/settings.ts
@@ -7,7 +7,6 @@ import { Settings } from '../models';
 
 export interface GetSettingsResponse {
   item: Settings;
-  success: boolean;
 }
 
 export interface PutSettingsRequest {
@@ -16,5 +15,4 @@ export interface PutSettingsRequest {
 
 export interface PutSettingsResponse {
   item: Settings;
-  success: boolean;
 }
diff --git a/x-pack/plugins/ingest_manager/package.json b/x-pack/plugins/ingest_manager/package.json
index 8826ed57ab1067..871972729b9f35 100644
--- a/x-pack/plugins/ingest_manager/package.json
+++ b/x-pack/plugins/ingest_manager/package.json
@@ -5,6 +5,7 @@
   "private": true,
   "license": "Elastic-License",
   "dependencies": {
-    "abort-controller": "^3.0.0"
+    "abort-controller": "^3.0.0",
+    "ajv": "^6.12.4"
   }
 }
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/settings_flyout.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/settings_flyout.tsx
index 9a9557f77c40c3..e0d843ad773b86 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/settings_flyout.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/settings_flyout.tsx
@@ -18,14 +18,14 @@ import {
   EuiFlyoutFooter,
   EuiForm,
   EuiFormRow,
-  EuiFieldText,
   EuiRadioGroup,
   EuiComboBox,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiText } from '@elastic/eui';
-import { useInput, useComboInput, useCore, useGetSettings, sendPutSettings } from '../hooks';
+import { useComboInput, useCore, useGetSettings, sendPutSettings } from '../hooks';
 import { useGetOutputs, sendPutOutput } from '../hooks/use_request/outputs';
+import { isDiffPathProtocol } from '../../../../common/';
 
 const URL_REGEX = /^(https?):\/\/[^\s$.?#].[^\s]*$/gm;
 
@@ -36,14 +36,28 @@ interface Props {
 function useSettingsForm(outputId: string | undefined, onSuccess: () => void) {
   const [isLoading, setIsloading] = React.useState(false);
   const { notifications } = useCore();
-  const kibanaUrlInput = useInput('', (value) => {
-    if (!value.match(URL_REGEX)) {
+  const kibanaUrlsInput = useComboInput([], (value) => {
+    if (value.length === 0) {
+      return [
+        i18n.translate('xpack.ingestManager.settings.kibanaUrlEmptyError', {
+          defaultMessage: 'At least one URL is required',
+        }),
+      ];
+    }
+    if (value.some((v) => !v.match(URL_REGEX))) {
       return [
         i18n.translate('xpack.ingestManager.settings.kibanaUrlError', {
           defaultMessage: 'Invalid URL',
         }),
       ];
     }
+    if (isDiffPathProtocol(value)) {
+      return [
+        i18n.translate('xpack.ingestManager.settings.kibanaUrlDifferentPathOrProtocolError', {
+          defaultMessage: 'Protocol and path must be the same for each URL',
+        }),
+      ];
+    }
   });
   const elasticsearchUrlInput = useComboInput([], (value) => {
     if (value.some((v) => !v.match(URL_REGEX))) {
@@ -58,7 +72,7 @@ function useSettingsForm(outputId: string | undefined, onSuccess: () => void) {
   return {
     isLoading,
     onSubmit: async () => {
-      if (!kibanaUrlInput.validate() || !elasticsearchUrlInput.validate()) {
+      if (!kibanaUrlsInput.validate() || !elasticsearchUrlInput.validate()) {
         return;
       }
 
@@ -74,7 +88,7 @@ function useSettingsForm(outputId: string | undefined, onSuccess: () => void) {
           throw outputResponse.error;
         }
         const settingsResponse = await sendPutSettings({
-          kibana_url: kibanaUrlInput.value,
+          kibana_urls: kibanaUrlsInput.value,
         });
         if (settingsResponse.error) {
           throw settingsResponse.error;
@@ -94,14 +108,13 @@ function useSettingsForm(outputId: string | undefined, onSuccess: () => void) {
       }
     },
     inputs: {
-      kibanaUrl: kibanaUrlInput,
+      kibanaUrls: kibanaUrlsInput,
       elasticsearchUrl: elasticsearchUrlInput,
     },
   };
 }
 
 export const SettingFlyout: React.FunctionComponent<Props> = ({ onClose }) => {
-  const core = useCore();
   const settingsRequest = useGetSettings();
   const settings = settingsRequest?.data?.item;
   const outputsRequest = useGetOutputs();
@@ -117,9 +130,7 @@ export const SettingFlyout: React.FunctionComponent<Props> = ({ onClose }) => {
 
   useEffect(() => {
     if (settings) {
-      inputs.kibanaUrl.setValue(
-        settings.kibana_url || `${window.location.origin}${core.http.basePath.get()}`
-      );
+      inputs.kibanaUrls.setValue(settings.kibana_urls);
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [settings]);
@@ -220,9 +231,9 @@ export const SettingFlyout: React.FunctionComponent<Props> = ({ onClose }) => {
           label={i18n.translate('xpack.ingestManager.settings.kibanaUrlLabel', {
             defaultMessage: 'Kibana URL',
           })}
-          {...inputs.kibanaUrl.formRowProps}
+          {...inputs.kibanaUrls.formRowProps}
         >
-          <EuiFieldText required={true} {...inputs.kibanaUrl.props} name="kibanaUrl" />
+          <EuiComboBox noSuggestions {...inputs.kibanaUrls.props} />
         </EuiFormRow>
       </EuiFormRow>
       <EuiSpacer size="m" />
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_copy_provider.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_copy_provider.tsx
index 8a91cabe78d00f..fefbe1fa82a0c5 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_copy_provider.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_copy_provider.tsx
@@ -61,7 +61,7 @@ export const AgentPolicyCopyProvider: React.FunctionComponent<Props> = ({ childr
     try {
       const { data } = await sendCopyAgentPolicy(agentPolicy!.id, newAgentPolicy!);
 
-      if (data?.success) {
+      if (data) {
         notifications.toasts.addSuccess(
           i18n.translate('xpack.ingestManager.copyAgentPolicy.successNotificationTitle', {
             defaultMessage: 'Agent policy copied',
@@ -70,9 +70,7 @@ export const AgentPolicyCopyProvider: React.FunctionComponent<Props> = ({ childr
         if (onSuccessCallback.current) {
           onSuccessCallback.current(data.item);
         }
-      }
-
-      if (!data?.success) {
+      } else {
         notifications.toasts.addDanger(
           i18n.translate('xpack.ingestManager.copyAgentPolicy.failureNotificationTitle', {
             defaultMessage: "Error copying agent policy '{id}'",
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_delete_provider.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_delete_provider.tsx
index 08367bf2a97bfc..15f71689ecdfa1 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_delete_provider.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_delete_provider.tsx
@@ -59,7 +59,7 @@ export const AgentPolicyDeleteProvider: React.FunctionComponent<Props> = ({ chil
         agentPolicyId: agentPolicy!,
       });
 
-      if (data?.success) {
+      if (data) {
         notifications.toasts.addSuccess(
           i18n.translate('xpack.ingestManager.deleteAgentPolicy.successSingleNotificationTitle', {
             defaultMessage: "Deleted agent policy '{id}'",
@@ -69,9 +69,7 @@ export const AgentPolicyDeleteProvider: React.FunctionComponent<Props> = ({ chil
         if (onSuccessCallback.current) {
           onSuccessCallback.current(agentPolicy!);
         }
-      }
-
-      if (!data?.success) {
+      } else {
         notifications.toasts.addDanger(
           i18n.translate('xpack.ingestManager.deleteAgentPolicy.failureSingleNotificationTitle', {
             defaultMessage: "Error deleting agent policy '{id}'",
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_yaml_flyout.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_yaml_flyout.tsx
index 919bb49f69aaee..5d485a6e210865 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_yaml_flyout.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/components/agent_policy_yaml_flyout.tsx
@@ -18,6 +18,7 @@ import {
   EuiFlyoutFooter,
   EuiButtonEmpty,
   EuiButton,
+  EuiCallOut,
 } from '@elastic/eui';
 import { useGetOneAgentPolicyFull, useGetOneAgentPolicy, useCore } from '../../../hooks';
 import { Loading } from '../../../components';
@@ -32,17 +33,28 @@ const FlyoutBody = styled(EuiFlyoutBody)`
 export const AgentPolicyYamlFlyout = memo<{ policyId: string; onClose: () => void }>(
   ({ policyId, onClose }) => {
     const core = useCore();
-    const { isLoading: isLoadingYaml, data: yamlData } = useGetOneAgentPolicyFull(policyId);
+    const { isLoading: isLoadingYaml, data: yamlData, error } = useGetOneAgentPolicyFull(policyId);
     const { data: agentPolicyData } = useGetOneAgentPolicy(policyId);
-
-    const body =
-      isLoadingYaml && !yamlData ? (
-        <Loading />
-      ) : (
-        <EuiCodeBlock language="yaml" isCopyable fontSize="m">
-          {fullAgentPolicyToYaml(yamlData!.item)}
-        </EuiCodeBlock>
-      );
+    const body = isLoadingYaml ? (
+      <Loading />
+    ) : error ? (
+      <EuiCallOut
+        title={
+          <FormattedMessage
+            id="xpack.ingestManager.policyDetails.ErrorGettingFullAgentPolicy"
+            defaultMessage="Error loading agent policy"
+          />
+        }
+        color="danger"
+        iconType="alert"
+      >
+        {error.message}
+      </EuiCallOut>
+    ) : (
+      <EuiCodeBlock language="yaml" isCopyable fontSize="m">
+        {fullAgentPolicyToYaml(yamlData!.item)}
+      </EuiCodeBlock>
+    );
 
     const downloadLink = core.http.basePath.prepend(
       agentPolicyRouteService.getInfoFullDownloadPath(policyId)
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/details_page/components/settings/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/details_page/components/settings/index.tsx
index 766bdc2e2c1930..b8fbb4f1835a6a 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/details_page/components/settings/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/details_page/components/settings/index.tsx
@@ -82,7 +82,7 @@ export const SettingsView = memo<{ agentPolicy: AgentPolicy }>(
           namespace,
           monitoring_enabled,
         });
-        if (data?.success) {
+        if (data) {
           notifications.toasts.addSuccess(
             i18n.translate('xpack.ingestManager.editAgentPolicy.successNotificationTitle', {
               defaultMessage: "Successfully updated '{name}' settings",
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/list_page/components/create_agent_policy.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/list_page/components/create_agent_policy.tsx
index b072990727e3cc..e3e2975777e17b 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/list_page/components/create_agent_policy.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/list_page/components/create_agent_policy.tsx
@@ -116,7 +116,7 @@ export const CreateAgentPolicyFlyout: React.FunctionComponent<Props> = ({
               try {
                 const { data, error } = await createAgentPolicy();
                 setIsLoading(false);
-                if (data?.success) {
+                if (data) {
                   notifications.toasts.addSuccess(
                     i18n.translate(
                       'xpack.ingestManager.createAgentPolicy.successNotificationTitle',
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/index.tsx
index 414c4e0d7ad2ce..05817f28f92925 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/index.tsx
@@ -8,6 +8,8 @@ import {
   EuiFlyout,
   EuiFlyoutBody,
   EuiFlyoutHeader,
+  EuiSpacer,
+  EuiText,
   EuiTitle,
   EuiFlexGroup,
   EuiFlexItem,
@@ -44,6 +46,14 @@ export const AgentEnrollmentFlyout: React.FunctionComponent<Props> = ({
             />
           </h2>
         </EuiTitle>
+        <EuiSpacer size="l" />
+        <EuiText>
+          <FormattedMessage
+            id="xpack.ingestManager.agentEnrollment.agentDescription"
+            defaultMessage="Add Elastic Agents to your hosts to collect data and send it to the Elastic Stack."
+          />
+        </EuiText>
+        <EuiSpacer size="l" />
         <EuiTabs style={{ marginBottom: '-25px' }}>
           <EuiTab isSelected={mode === 'managed'} onClick={() => setMode('managed')}>
             <FormattedMessage
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/managed_instructions.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/managed_instructions.tsx
index b02893057c9c33..7db9d72eb50e4f 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/managed_instructions.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/managed_instructions.tsx
@@ -34,8 +34,11 @@ export const ManagedInstructions: React.FunctionComponent<Props> = ({ agentPolic
   const settings = useGetSettings();
   const apiKey = useGetOneEnrollmentAPIKey(selectedAPIKeyId);
 
-  const kibanaUrl =
-    settings.data?.item?.kibana_url ?? `${window.location.origin}${core.http.basePath.get()}`;
+  const kibanaUrlsSettings = settings.data?.item?.kibana_urls;
+  const kibanaUrl = kibanaUrlsSettings
+    ? kibanaUrlsSettings[0]
+    : `${window.location.origin}${core.http.basePath.get()}`;
+
   const kibanaCASha256 = settings.data?.item?.kibana_ca_sha256;
 
   const steps: EuiContainedStepProps[] = [
@@ -72,13 +75,13 @@ export const ManagedInstructions: React.FunctionComponent<Props> = ({ agentPolic
         <>
           <FormattedMessage
             id="xpack.ingestManager.agentEnrollment.fleetNotInitializedText"
-            defaultMessage="Before enrolling agents, set up Fleet. {link}"
+            defaultMessage="Before enrolling agents, {link}."
             values={{
               link: (
                 <EuiLink href={getHref('fleet')}>
                   <FormattedMessage
-                    id="xpack.ingestManager.agentEnrollment.goToFleetButton"
-                    defaultMessage="Go to Fleet."
+                    id="xpack.ingestManager.agentEnrollment.setUpFleetLink"
+                    defaultMessage="set up Fleet"
                   />
                 </EuiLink>
               ),
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/standalone_instructions.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/standalone_instructions.tsx
index 049ceca82b309b..9262cc2cb42ac0 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/standalone_instructions.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_enrollment_flyout/standalone_instructions.tsx
@@ -15,12 +15,13 @@ import {
   EuiFlexGroup,
   EuiCodeBlock,
   EuiCopy,
+  EuiLink,
 } from '@elastic/eui';
 import { EuiContainedStepProps } from '@elastic/eui/src/components/steps/steps';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { AgentPolicy } from '../../../../types';
-import { useCore, sendGetOneAgentPolicyFull } from '../../../../hooks';
+import { useCore, useLink, sendGetOneAgentPolicyFull } from '../../../../hooks';
 import { DownloadStep, AgentPolicySelectionStep } from './steps';
 import { fullAgentPolicyToYaml, agentPolicyRouteService } from '../../../../services';
 
@@ -31,6 +32,7 @@ interface Props {
 const RUN_INSTRUCTIONS = './elastic-agent run';
 
 export const StandaloneInstructions: React.FunctionComponent<Props> = ({ agentPolicies }) => {
+  const { getHref } = useLink();
   const core = useCore();
   const { notifications } = core;
 
@@ -157,7 +159,17 @@ export const StandaloneInstructions: React.FunctionComponent<Props> = ({ agentPo
           <EuiText>
             <FormattedMessage
               id="xpack.ingestManager.agentEnrollment.stepCheckForDataDescription"
-              defaultMessage="The agent should begin sending data. Go to data streams to view your data."
+              defaultMessage="The agent should begin sending data. Go to {link} to view your data."
+              values={{
+                link: (
+                  <EuiLink href={getHref('data_streams')}>
+                    <FormattedMessage
+                      id="xpack.ingestManager.agentEnrollment.goToDataStreamsLink"
+                      defaultMessage="data streams"
+                    />
+                  </EuiLink>
+                ),
+              }}
             />
           </EuiText>
         </>
diff --git a/x-pack/plugins/ingest_manager/scripts/dev_agent/script.ts b/x-pack/plugins/ingest_manager/scripts/dev_agent/script.ts
index c7b8edd0c332ef..65375a076e9a48 100644
--- a/x-pack/plugins/ingest_manager/scripts/dev_agent/script.ts
+++ b/x-pack/plugins/ingest_manager/scripts/dev_agent/script.ts
@@ -122,7 +122,7 @@ async function enroll(kibanaURL: string, apiKey: string, log: ToolingLog): Promi
   });
   const obj: PostAgentEnrollResponse = await res.json();
 
-  if (!obj.success) {
+  if (!res.ok) {
     log.error(JSON.stringify(obj, null, 2));
     throw new Error('unable to enroll');
   }
diff --git a/x-pack/plugins/ingest_manager/server/errors.test.ts b/x-pack/plugins/ingest_manager/server/errors.test.ts
new file mode 100644
index 00000000000000..70e3a3b4150ade
--- /dev/null
+++ b/x-pack/plugins/ingest_manager/server/errors.test.ts
@@ -0,0 +1,191 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Boom from 'boom';
+import { httpServerMock } from 'src/core/server/mocks';
+import { createAppContextStartContractMock } from './mocks';
+
+import {
+  IngestManagerError,
+  RegistryError,
+  PackageNotFoundError,
+  defaultIngestErrorHandler,
+} from './errors';
+import { appContextService } from './services';
+
+describe('defaultIngestErrorHandler', () => {
+  let mockContract: ReturnType<typeof createAppContextStartContractMock>;
+  beforeEach(async () => {
+    // prevents `Logger not set.` and other appContext errors
+    mockContract = createAppContextStartContractMock();
+    appContextService.start(mockContract);
+  });
+
+  afterEach(async () => {
+    jest.clearAllMocks();
+    appContextService.stop();
+  });
+
+  describe('IngestManagerError', () => {
+    it('502: RegistryError', async () => {
+      const error = new RegistryError('xyz');
+      const response = httpServerMock.createResponseFactory();
+
+      await defaultIngestErrorHandler({ error, response });
+
+      // response
+      expect(response.ok).toHaveBeenCalledTimes(0);
+      expect(response.customError).toHaveBeenCalledTimes(1);
+      expect(response.customError).toHaveBeenCalledWith({
+        statusCode: 502,
+        body: { message: error.message },
+      });
+
+      // logging
+      expect(mockContract.logger?.error).toHaveBeenCalledTimes(1);
+      expect(mockContract.logger?.error).toHaveBeenCalledWith(error.message);
+    });
+
+    it('404: PackageNotFoundError', async () => {
+      const error = new PackageNotFoundError('123');
+      const response = httpServerMock.createResponseFactory();
+
+      await defaultIngestErrorHandler({ error, response });
+
+      // response
+      expect(response.ok).toHaveBeenCalledTimes(0);
+      expect(response.customError).toHaveBeenCalledTimes(1);
+      expect(response.customError).toHaveBeenCalledWith({
+        statusCode: 404,
+        body: { message: error.message },
+      });
+
+      // logging
+      expect(mockContract.logger?.error).toHaveBeenCalledTimes(1);
+      expect(mockContract.logger?.error).toHaveBeenCalledWith(error.message);
+    });
+
+    it('400: IngestManagerError', async () => {
+      const error = new IngestManagerError('123');
+      const response = httpServerMock.createResponseFactory();
+
+      await defaultIngestErrorHandler({ error, response });
+
+      // response
+      expect(response.ok).toHaveBeenCalledTimes(0);
+      expect(response.customError).toHaveBeenCalledTimes(1);
+      expect(response.customError).toHaveBeenCalledWith({
+        statusCode: 400,
+        body: { message: error.message },
+      });
+
+      // logging
+      expect(mockContract.logger?.error).toHaveBeenCalledTimes(1);
+      expect(mockContract.logger?.error).toHaveBeenCalledWith(error.message);
+    });
+  });
+
+  describe('Boom', () => {
+    it('500: constructor - one arg', async () => {
+      const error = new Boom('bam');
+      const response = httpServerMock.createResponseFactory();
+
+      await defaultIngestErrorHandler({ error, response });
+
+      // response
+      expect(response.ok).toHaveBeenCalledTimes(0);
+      expect(response.customError).toHaveBeenCalledTimes(1);
+      expect(response.customError).toHaveBeenCalledWith({
+        statusCode: 500,
+        body: { message: 'An internal server error occurred' },
+      });
+
+      // logging
+      expect(mockContract.logger?.error).toHaveBeenCalledTimes(1);
+      expect(mockContract.logger?.error).toHaveBeenCalledWith('An internal server error occurred');
+    });
+
+    it('custom: constructor - 2 args', async () => {
+      const error = new Boom('Problem doing something', {
+        statusCode: 456,
+      });
+      const response = httpServerMock.createResponseFactory();
+
+      await defaultIngestErrorHandler({ error, response });
+
+      // response
+      expect(response.ok).toHaveBeenCalledTimes(0);
+      expect(response.customError).toHaveBeenCalledTimes(1);
+      expect(response.customError).toHaveBeenCalledWith({
+        statusCode: 456,
+        body: { message: error.message },
+      });
+
+      // logging
+      expect(mockContract.logger?.error).toHaveBeenCalledTimes(1);
+      expect(mockContract.logger?.error).toHaveBeenCalledWith('Problem doing something');
+    });
+
+    it('400: Boom.badRequest', async () => {
+      const error = Boom.badRequest('nope');
+      const response = httpServerMock.createResponseFactory();
+
+      await defaultIngestErrorHandler({ error, response });
+
+      // response
+      expect(response.ok).toHaveBeenCalledTimes(0);
+      expect(response.customError).toHaveBeenCalledTimes(1);
+      expect(response.customError).toHaveBeenCalledWith({
+        statusCode: 400,
+        body: { message: error.message },
+      });
+
+      // logging
+      expect(mockContract.logger?.error).toHaveBeenCalledTimes(1);
+      expect(mockContract.logger?.error).toHaveBeenCalledWith('nope');
+    });
+
+    it('404: Boom.notFound', async () => {
+      const error = Boom.notFound('sorry');
+      const response = httpServerMock.createResponseFactory();
+
+      await defaultIngestErrorHandler({ error, response });
+
+      // response
+      expect(response.ok).toHaveBeenCalledTimes(0);
+      expect(response.customError).toHaveBeenCalledTimes(1);
+      expect(response.customError).toHaveBeenCalledWith({
+        statusCode: 404,
+        body: { message: error.message },
+      });
+
+      // logging
+      expect(mockContract.logger?.error).toHaveBeenCalledTimes(1);
+      expect(mockContract.logger?.error).toHaveBeenCalledWith('sorry');
+    });
+  });
+
+  describe('all other errors', () => {
+    it('500', async () => {
+      const error = new Error('something');
+      const response = httpServerMock.createResponseFactory();
+
+      await defaultIngestErrorHandler({ error, response });
+
+      // response
+      expect(response.ok).toHaveBeenCalledTimes(0);
+      expect(response.customError).toHaveBeenCalledTimes(1);
+      expect(response.customError).toHaveBeenCalledWith({
+        statusCode: 500,
+        body: { message: error.message },
+      });
+
+      // logging
+      expect(mockContract.logger?.error).toHaveBeenCalledTimes(1);
+      expect(mockContract.logger?.error).toHaveBeenCalledWith(error);
+    });
+  });
+});
diff --git a/x-pack/plugins/ingest_manager/server/errors.ts b/x-pack/plugins/ingest_manager/server/errors.ts
index 401211409ebf75..9829a4de23d7be 100644
--- a/x-pack/plugins/ingest_manager/server/errors.ts
+++ b/x-pack/plugins/ingest_manager/server/errors.ts
@@ -5,6 +5,26 @@
  */
 
 /* eslint-disable max-classes-per-file */
+import Boom, { isBoom } from 'boom';
+import {
+  RequestHandlerContext,
+  KibanaRequest,
+  IKibanaResponse,
+  KibanaResponseFactory,
+} from 'src/core/server';
+import { appContextService } from './services';
+
+type IngestErrorHandler = (
+  params: IngestErrorHandlerParams
+) => IKibanaResponse | Promise<IKibanaResponse>;
+
+interface IngestErrorHandlerParams {
+  error: IngestManagerError | Boom | Error;
+  response: KibanaResponseFactory;
+  request?: KibanaRequest;
+  context?: RequestHandlerContext;
+}
+
 export class IngestManagerError extends Error {
   constructor(message?: string) {
     super(message);
@@ -12,20 +32,53 @@ export class IngestManagerError extends Error {
   }
 }
 
-export const getHTTPResponseCode = (error: IngestManagerError): number => {
+const getHTTPResponseCode = (error: IngestManagerError): number => {
   if (error instanceof RegistryError) {
     return 502; // Bad Gateway
   }
   if (error instanceof PackageNotFoundError) {
-    return 404;
+    return 404; // Not Found
   }
-  if (error instanceof PackageOutdatedError) {
-    return 400;
-  } else {
-    return 400; // Bad Request
+
+  return 400; // Bad Request
+};
+
+export const defaultIngestErrorHandler: IngestErrorHandler = async ({
+  error,
+  response,
+}: IngestErrorHandlerParams): Promise<IKibanaResponse> => {
+  const logger = appContextService.getLogger();
+
+  // our "expected" errors
+  if (error instanceof IngestManagerError) {
+    // only log the message
+    logger.error(error.message);
+    return response.customError({
+      statusCode: getHTTPResponseCode(error),
+      body: { message: error.message },
+    });
   }
+
+  // handle any older Boom-based errors or the few places our app uses them
+  if (isBoom(error)) {
+    // only log the message
+    logger.error(error.output.payload.message);
+    return response.customError({
+      statusCode: error.output.statusCode,
+      body: { message: error.output.payload.message },
+    });
+  }
+
+  // not sure what type of error this is. log as much as possible
+  logger.error(error);
+  return response.customError({
+    statusCode: 500,
+    body: { message: error.message },
+  });
 };
 
 export class RegistryError extends IngestManagerError {}
+export class RegistryConnectionError extends RegistryError {}
+export class RegistryResponseError extends RegistryError {}
 export class PackageNotFoundError extends IngestManagerError {}
 export class PackageOutdatedError extends IngestManagerError {}
diff --git a/x-pack/plugins/ingest_manager/server/index.ts b/x-pack/plugins/ingest_manager/server/index.ts
index 962cddb2e411e6..e8ea886cbf9f53 100644
--- a/x-pack/plugins/ingest_manager/server/index.ts
+++ b/x-pack/plugins/ingest_manager/server/index.ts
@@ -9,6 +9,7 @@ import { IngestManagerPlugin } from './plugin';
 import {
   AGENT_POLICY_ROLLOUT_RATE_LIMIT_INTERVAL_MS,
   AGENT_POLICY_ROLLOUT_RATE_LIMIT_REQUEST_PER_INTERVAL,
+  AGENT_POLLING_REQUEST_TIMEOUT_MS,
 } from '../common';
 export { AgentService, ESIndexPatternService, getRegistryUrl } from './services';
 export {
@@ -29,10 +30,18 @@ export const config = {
     fleet: schema.object({
       enabled: schema.boolean({ defaultValue: true }),
       tlsCheckDisabled: schema.boolean({ defaultValue: false }),
-      pollingRequestTimeout: schema.number({ defaultValue: 60000 }),
+      pollingRequestTimeout: schema.number({
+        defaultValue: AGENT_POLLING_REQUEST_TIMEOUT_MS,
+        min: 5000,
+      }),
       maxConcurrentConnections: schema.number({ defaultValue: 0 }),
       kibana: schema.object({
-        host: schema.maybe(schema.string()),
+        host: schema.maybe(
+          schema.oneOf([
+            schema.uri({ scheme: ['http', 'https'] }),
+            schema.arrayOf(schema.uri({ scheme: ['http', 'https'] }), { minSize: 1 }),
+          ])
+        ),
         ca_sha256: schema.maybe(schema.string()),
       }),
       elasticsearch: schema.object({
diff --git a/x-pack/plugins/ingest_manager/server/plugin.ts b/x-pack/plugins/ingest_manager/server/plugin.ts
index 4321dca7102a13..4a7677d69d6e73 100644
--- a/x-pack/plugins/ingest_manager/server/plugin.ts
+++ b/x-pack/plugins/ingest_manager/server/plugin.ts
@@ -238,7 +238,7 @@ export class IngestManagerPlugin
           // we currently only use this global interceptor if fleet is enabled
           // since it would run this func on *every* req (other plugins, CSS, etc)
           registerLimitedConcurrencyRoutes(core, config);
-          registerAgentRoutes(router);
+          registerAgentRoutes(router, config);
           registerEnrollmentApiKeyRoutes(router);
           registerInstallScriptRoutes({
             router,
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/acks_handlers.test.ts b/x-pack/plugins/ingest_manager/server/routes/agent/acks_handlers.test.ts
index aaed189ae3dddf..33b9dc617075b3 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/acks_handlers.test.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/acks_handlers.test.ts
@@ -88,7 +88,6 @@ describe('test acks handlers', () => {
     await postAgentAcksHandler(({} as unknown) as RequestHandlerContext, mockRequest, mockResponse);
     expect(mockResponse.ok.mock.calls[0][0]?.body as PostAgentAcksResponse).toEqual({
       action: 'acks',
-      success: true,
     });
   });
 });
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/acks_handlers.ts b/x-pack/plugins/ingest_manager/server/routes/agent/acks_handlers.ts
index 0b719d8a67df74..b0439b30e8973b 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/acks_handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/acks_handlers.ts
@@ -7,19 +7,13 @@
 // handlers that handle events from agents in response to actions received
 
 import { RequestHandler } from 'kibana/server';
-import { TypeOf } from '@kbn/config-schema';
-import { PostAgentAcksRequestSchema } from '../../types/rest_spec';
 import { AcksService } from '../../services/agents';
 import { AgentEvent } from '../../../common/types/models';
-import { PostAgentAcksResponse } from '../../../common/types/rest_spec';
+import { PostAgentAcksRequest, PostAgentAcksResponse } from '../../../common/types/rest_spec';
 
 export const postAgentAcksHandlerBuilder = function (
   ackService: AcksService
-): RequestHandler<
-  TypeOf<typeof PostAgentAcksRequestSchema.params>,
-  undefined,
-  TypeOf<typeof PostAgentAcksRequestSchema.body>
-> {
+): RequestHandler<PostAgentAcksRequest['params'], undefined, PostAgentAcksRequest['body']> {
   return async (context, request, response) => {
     try {
       const soClient = ackService.getSavedObjectsClientContract(request);
@@ -46,7 +40,6 @@ export const postAgentAcksHandlerBuilder = function (
 
       const body: PostAgentAcksResponse = {
         action: 'acks',
-        success: true,
       };
 
       return response.ok({ body });
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.test.ts b/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.test.ts
index bcb9a7797f26ab..5445a46fbe2b47 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.test.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.test.ts
@@ -97,6 +97,5 @@ describe('test actions handlers', () => {
       ?.body as unknown) as PostNewAgentActionResponse;
 
     expect(expectedAgentActionResponse.item).toEqual(agentAction);
-    expect(expectedAgentActionResponse.success).toEqual(true);
   });
 });
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts b/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts
index 81893b1e78338c..b81d44c40f8eb8 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts
@@ -35,7 +35,6 @@ export const postNewAgentActionHandlerBuilder = function (
       });
 
       const body: PostNewAgentActionResponse = {
-        success: true,
         item: savedAgentAction,
       };
 
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts b/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
index 3e80a74dc2b11f..605e4db230ce59 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
@@ -15,6 +15,7 @@ import {
   PostAgentEnrollResponse,
   GetAgentStatusResponse,
   PutAgentReassignResponse,
+  PostAgentEnrollRequest,
 } from '../../../common/types';
 import {
   GetAgentsRequestSchema,
@@ -22,8 +23,7 @@ import {
   UpdateAgentRequestSchema,
   DeleteAgentRequestSchema,
   GetOneAgentEventsRequestSchema,
-  PostAgentCheckinRequestSchema,
-  PostAgentEnrollRequestSchema,
+  PostAgentCheckinRequest,
   GetAgentStatusRequestSchema,
   PutAgentReassignRequestSchema,
 } from '../../types';
@@ -43,7 +43,6 @@ export const getAgentHandler: RequestHandler<TypeOf<
         ...agent,
         status: AgentService.getAgentStatus(agent),
       },
-      success: true,
     };
 
     return response.ok({ body });
@@ -77,7 +76,6 @@ export const getAgentEventsHandler: RequestHandler<
     const body: GetOneAgentEventsResponse = {
       list: items,
       total,
-      success: true,
       page,
       perPage,
     };
@@ -107,7 +105,6 @@ export const deleteAgentHandler: RequestHandler<TypeOf<
     await AgentService.deleteAgent(soClient, request.params.agentId);
 
     const body = {
-      success: true,
       action: 'deleted',
     };
 
@@ -144,7 +141,6 @@ export const updateAgentHandler: RequestHandler<
         ...agent,
         status: AgentService.getAgentStatus(agent),
       },
-      success: true,
     };
 
     return response.ok({ body });
@@ -163,9 +159,9 @@ export const updateAgentHandler: RequestHandler<
 };
 
 export const postAgentCheckinHandler: RequestHandler<
-  TypeOf<typeof PostAgentCheckinRequestSchema.params>,
+  PostAgentCheckinRequest['params'],
   undefined,
-  TypeOf<typeof PostAgentCheckinRequestSchema.body>
+  PostAgentCheckinRequest['body']
 > = async (context, request, response) => {
   try {
     const soClient = appContextService.getInternalUserSOClient(request);
@@ -187,7 +183,6 @@ export const postAgentCheckinHandler: RequestHandler<
     );
     const body: PostAgentCheckinResponse = {
       action: 'checkin',
-      success: true,
       actions: actions.map((a) => ({
         agent_id: agent.id,
         type: a.type,
@@ -223,7 +218,7 @@ export const postAgentCheckinHandler: RequestHandler<
 export const postAgentEnrollHandler: RequestHandler<
   undefined,
   undefined,
-  TypeOf<typeof PostAgentEnrollRequestSchema.body>
+  PostAgentEnrollRequest['body']
 > = async (context, request, response) => {
   try {
     const soClient = appContextService.getInternalUserSOClient(request);
@@ -248,7 +243,6 @@ export const postAgentEnrollHandler: RequestHandler<
     );
     const body: PostAgentEnrollResponse = {
       action: 'created',
-      success: true,
       item: {
         ...agent,
         status: AgentService.getAgentStatus(agent),
@@ -289,7 +283,6 @@ export const getAgentsHandler: RequestHandler<
         ...agent,
         status: AgentService.getAgentStatus(agent),
       })),
-      success: true,
       total,
       page,
       perPage,
@@ -312,9 +305,7 @@ export const putAgentsReassignHandler: RequestHandler<
   try {
     await AgentService.reassignAgent(soClient, request.params.agentId, request.body.policy_id);
 
-    const body: PutAgentReassignResponse = {
-      success: true,
-    };
+    const body: PutAgentReassignResponse = {};
     return response.ok({ body });
   } catch (e) {
     return response.customError({
@@ -336,7 +327,7 @@ export const getAgentStatusForAgentPolicyHandler: RequestHandler<
       request.query.policyId
     );
 
-    const body: GetAgentStatusResponse = { results, success: true };
+    const body: GetAgentStatusResponse = { results };
 
     return response.ok({ body });
   } catch (e) {
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/index.ts b/x-pack/plugins/ingest_manager/server/routes/agent/index.ts
index 7c98ad31e5cdba..a2e5c742ad6b5f 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/index.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/index.ts
@@ -9,7 +9,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IRouter } from 'src/core/server';
+import { IRouter, RouteValidationResultFactory } from 'src/core/server';
+import Ajv from 'ajv';
 import { PLUGIN_ID, AGENT_API_ROUTES, LIMITED_CONCURRENCY_ROUTE_TAG } from '../../constants';
 import {
   GetAgentsRequestSchema,
@@ -17,13 +18,15 @@ import {
   GetOneAgentEventsRequestSchema,
   UpdateAgentRequestSchema,
   DeleteAgentRequestSchema,
-  PostAgentCheckinRequestSchema,
-  PostAgentEnrollRequestSchema,
-  PostAgentAcksRequestSchema,
+  PostAgentCheckinRequestBodyJSONSchema,
+  PostAgentCheckinRequestParamsJSONSchema,
+  PostAgentAcksRequestParamsJSONSchema,
+  PostAgentAcksRequestBodyJSONSchema,
   PostAgentUnenrollRequestSchema,
   GetAgentStatusRequestSchema,
   PostNewAgentActionRequestSchema,
   PutAgentReassignRequestSchema,
+  PostAgentEnrollRequestBodyJSONSchema,
 } from '../../types';
 import {
   getAgentsHandler,
@@ -41,8 +44,32 @@ import * as AgentService from '../../services/agents';
 import { postNewAgentActionHandlerBuilder } from './actions_handlers';
 import { appContextService } from '../../services';
 import { postAgentsUnenrollHandler } from './unenroll_handler';
+import { IngestManagerConfigType } from '../..';
 
-export const registerRoutes = (router: IRouter) => {
+const ajv = new Ajv({
+  coerceTypes: true,
+  useDefaults: true,
+  removeAdditional: true,
+  allErrors: false,
+  nullable: true,
+});
+
+function schemaErrorsText(errors: Ajv.ErrorObject[], dataVar: any) {
+  return errors.map((e) => `${dataVar + (e.dataPath || '')} ${e.message}`).join(', ');
+}
+
+function makeValidator(jsonSchema: any) {
+  const validator = ajv.compile(jsonSchema);
+  return function validateWithAJV(data: any, r: RouteValidationResultFactory) {
+    if (validator(data)) {
+      return r.ok(data);
+    }
+
+    return r.badRequest(schemaErrorsText(validator.errors || [], data));
+  };
+}
+
+export const registerRoutes = (router: IRouter, config: IngestManagerConfigType) => {
   // Get one
   router.get(
     {
@@ -80,12 +107,25 @@ export const registerRoutes = (router: IRouter) => {
     getAgentsHandler
   );
 
+  const pollingRequestTimeout = config.fleet.pollingRequestTimeout;
   // Agent checkin
   router.post(
     {
       path: AGENT_API_ROUTES.CHECKIN_PATTERN,
-      validate: PostAgentCheckinRequestSchema,
-      options: { tags: [] },
+      validate: {
+        params: makeValidator(PostAgentCheckinRequestParamsJSONSchema),
+        body: makeValidator(PostAgentCheckinRequestBodyJSONSchema),
+      },
+      options: {
+        tags: [],
+        ...(pollingRequestTimeout
+          ? {
+              timeout: {
+                idleSocket: pollingRequestTimeout,
+              },
+            }
+          : {}),
+      },
     },
     postAgentCheckinHandler
   );
@@ -94,7 +134,9 @@ export const registerRoutes = (router: IRouter) => {
   router.post(
     {
       path: AGENT_API_ROUTES.ENROLL_PATTERN,
-      validate: PostAgentEnrollRequestSchema,
+      validate: {
+        body: makeValidator(PostAgentEnrollRequestBodyJSONSchema),
+      },
       options: { tags: [LIMITED_CONCURRENCY_ROUTE_TAG] },
     },
     postAgentEnrollHandler
@@ -104,7 +146,10 @@ export const registerRoutes = (router: IRouter) => {
   router.post(
     {
       path: AGENT_API_ROUTES.ACKS_PATTERN,
-      validate: PostAgentAcksRequestSchema,
+      validate: {
+        params: makeValidator(PostAgentAcksRequestParamsJSONSchema),
+        body: makeValidator(PostAgentAcksRequestBodyJSONSchema),
+      },
       options: { tags: [LIMITED_CONCURRENCY_ROUTE_TAG] },
     },
     postAgentAcksHandlerBuilder({
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/unenroll_handler.ts b/x-pack/plugins/ingest_manager/server/routes/agent/unenroll_handler.ts
index d1e54fe4fb3a17..5df695d248f5b6 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/unenroll_handler.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/unenroll_handler.ts
@@ -23,9 +23,7 @@ export const postAgentsUnenrollHandler: RequestHandler<
       await AgentService.unenrollAgent(soClient, request.params.agentId);
     }
 
-    const body: PostAgentUnenrollResponse = {
-      success: true,
-    };
+    const body: PostAgentUnenrollResponse = {};
     return response.ok({ body });
   } catch (e) {
     return response.customError({
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent_policy/handlers.ts b/x-pack/plugins/ingest_manager/server/routes/agent_policy/handlers.ts
index cc178e1038e2ea..7eb3df23461068 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent_policy/handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent_policy/handlers.ts
@@ -49,7 +49,6 @@ export const getAgentPoliciesHandler: RequestHandler<
       total,
       page,
       perPage,
-      success: true,
     };
 
     await bluebird.map(
@@ -82,7 +81,6 @@ export const getOneAgentPolicyHandler: RequestHandler<TypeOf<
     if (agentPolicy) {
       const body: GetOneAgentPolicyResponse = {
         item: agentPolicy,
-        success: true,
       };
       return response.ok({
         body,
@@ -141,7 +139,6 @@ export const createAgentPolicyHandler: RequestHandler<
 
     const body: CreateAgentPolicyResponse = {
       item: agentPolicy,
-      success: true,
     };
 
     return response.ok({
@@ -171,7 +168,7 @@ export const updateAgentPolicyHandler: RequestHandler<
         user: user || undefined,
       }
     );
-    const body: UpdateAgentPolicyResponse = { item: agentPolicy, success: true };
+    const body: UpdateAgentPolicyResponse = { item: agentPolicy };
     return response.ok({
       body,
     });
@@ -199,7 +196,7 @@ export const copyAgentPolicyHandler: RequestHandler<
         user: user || undefined,
       }
     );
-    const body: CopyAgentPolicyResponse = { item: agentPolicy, success: true };
+    const body: CopyAgentPolicyResponse = { item: agentPolicy };
     return response.ok({
       body,
     });
@@ -248,7 +245,6 @@ export const getFullAgentPolicy: RequestHandler<
     if (fullAgentPolicy) {
       const body: GetFullAgentPolicyResponse = {
         item: fullAgentPolicy,
-        success: true,
       };
       return response.ok({
         body,
diff --git a/x-pack/plugins/ingest_manager/server/routes/enrollment_api_key/handler.ts b/x-pack/plugins/ingest_manager/server/routes/enrollment_api_key/handler.ts
index 2d6e2f67225e33..7c04acf4798f95 100644
--- a/x-pack/plugins/ingest_manager/server/routes/enrollment_api_key/handler.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/enrollment_api_key/handler.ts
@@ -31,7 +31,7 @@ export const getEnrollmentApiKeysHandler: RequestHandler<
       perPage: request.query.perPage,
       kuery: request.query.kuery,
     });
-    const body: GetEnrollmentAPIKeysResponse = { list: items, success: true, total, page, perPage };
+    const body: GetEnrollmentAPIKeysResponse = { list: items, total, page, perPage };
 
     return response.ok({ body });
   } catch (e) {
@@ -54,7 +54,7 @@ export const postEnrollmentApiKeyHandler: RequestHandler<
       agentPolicyId: request.body.policy_id,
     });
 
-    const body: PostEnrollmentAPIKeyResponse = { item: apiKey, success: true, action: 'created' };
+    const body: PostEnrollmentAPIKeyResponse = { item: apiKey, action: 'created' };
 
     return response.ok({ body });
   } catch (e) {
@@ -78,7 +78,7 @@ export const deleteEnrollmentApiKeyHandler: RequestHandler<TypeOf<
   try {
     await APIKeyService.deleteEnrollmentApiKey(soClient, request.params.keyId);
 
-    const body: DeleteEnrollmentAPIKeyResponse = { action: 'deleted', success: true };
+    const body: DeleteEnrollmentAPIKeyResponse = { action: 'deleted' };
 
     return response.ok({ body });
   } catch (e) {
@@ -100,7 +100,7 @@ export const getOneEnrollmentApiKeyHandler: RequestHandler<TypeOf<
   const soClient = context.core.savedObjects.client;
   try {
     const apiKey = await APIKeyService.getEnrollmentAPIKey(soClient, request.params.keyId);
-    const body: GetOneEnrollmentAPIKeyResponse = { item: apiKey, success: true };
+    const body: GetOneEnrollmentAPIKeyResponse = { item: apiKey };
 
     return response.ok({ body });
   } catch (e) {
diff --git a/x-pack/plugins/ingest_manager/server/routes/epm/handlers.ts b/x-pack/plugins/ingest_manager/server/routes/epm/handlers.ts
index bbd91b97a86c98..6d7252ffec41a6 100644
--- a/x-pack/plugins/ingest_manager/server/routes/epm/handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/epm/handlers.ts
@@ -32,7 +32,7 @@ import {
   getLimitedPackages,
   getInstallationObject,
 } from '../../services/epm/packages';
-import { IngestManagerError, getHTTPResponseCode } from '../../errors';
+import { IngestManagerError, defaultIngestErrorHandler } from '../../errors';
 import { splitPkgKey } from '../../services/epm/registry';
 
 export const getCategoriesHandler: RequestHandler<
@@ -43,14 +43,10 @@ export const getCategoriesHandler: RequestHandler<
     const res = await getCategories(request.query);
     const body: GetCategoriesResponse = {
       response: res,
-      success: true,
     };
     return response.ok({ body });
-  } catch (e) {
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+  } catch (error) {
+    return defaultIngestErrorHandler({ error, response });
   }
 };
 
@@ -66,16 +62,12 @@ export const getListHandler: RequestHandler<
     });
     const body: GetPackagesResponse = {
       response: res,
-      success: true,
     };
     return response.ok({
       body,
     });
-  } catch (e) {
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+  } catch (error) {
+    return defaultIngestErrorHandler({ error, response });
   }
 };
 
@@ -85,16 +77,12 @@ export const getLimitedListHandler: RequestHandler = async (context, request, re
     const res = await getLimitedPackages({ savedObjectsClient });
     const body: GetLimitedPackagesResponse = {
       response: res,
-      success: true,
     };
     return response.ok({
       body,
     });
-  } catch (e) {
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+  } catch (error) {
+    return defaultIngestErrorHandler({ error, response });
   }
 };
 
@@ -115,11 +103,8 @@ export const getFileHandler: RequestHandler<TypeOf<typeof GetFileRequestSchema.p
       customResponseObj.headers = { 'Content-Type': contentType };
     }
     return response.custom(customResponseObj);
-  } catch (e) {
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+  } catch (error) {
+    return defaultIngestErrorHandler({ error, response });
   }
 };
 
@@ -136,14 +121,10 @@ export const getInfoHandler: RequestHandler<TypeOf<typeof GetInfoRequestSchema.p
     const res = await getPackageInfo({ savedObjectsClient, pkgName, pkgVersion });
     const body: GetInfoResponse = {
       response: res,
-      success: true,
     };
     return response.ok({ body });
-  } catch (e) {
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+  } catch (error) {
+    return defaultIngestErrorHandler({ error, response });
   }
 };
 
@@ -166,18 +147,15 @@ export const installPackageHandler: RequestHandler<
     });
     const body: InstallPackageResponse = {
       response: res,
-      success: true,
     };
     return response.ok({ body });
   } catch (e) {
+    // could have also done `return defaultIngestErrorHandler({ error: e, response })` at each of the returns,
+    // but doing it this way will log the outer/install errors before any inner/rollback errors
+    const defaultResult = await defaultIngestErrorHandler({ error: e, response });
     if (e instanceof IngestManagerError) {
-      logger.error(e);
-      return response.customError({
-        statusCode: getHTTPResponseCode(e),
-        body: { message: e.message },
-      });
+      return defaultResult;
     }
-
     // if there is an unknown server error, uninstall any package assets
     try {
       const installedPkg = await getInstallationObject({ savedObjectsClient, pkgName });
@@ -188,11 +166,7 @@ export const installPackageHandler: RequestHandler<
     } catch (error) {
       logger.error(`could not remove failed installation ${error}`);
     }
-    logger.error(e);
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+    return defaultResult;
   }
 };
 
@@ -206,19 +180,9 @@ export const deletePackageHandler: RequestHandler<TypeOf<
     const res = await removeInstallation({ savedObjectsClient, pkgkey, callCluster });
     const body: DeletePackageResponse = {
       response: res,
-      success: true,
     };
     return response.ok({ body });
-  } catch (e) {
-    if (e.isBoom) {
-      return response.customError({
-        statusCode: e.output.statusCode,
-        body: { message: e.output.payload.message },
-      });
-    }
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+  } catch (error) {
+    return defaultIngestErrorHandler({ error, response });
   }
 };
diff --git a/x-pack/plugins/ingest_manager/server/routes/install_script/index.ts b/x-pack/plugins/ingest_manager/server/routes/install_script/index.ts
index c2a5d77a39eb16..c767d3e80d2b7d 100644
--- a/x-pack/plugins/ingest_manager/server/routes/install_script/index.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/install_script/index.ts
@@ -38,16 +38,16 @@ export const registerRoutes = ({
       const http = appContextService.getHttpSetup();
       const serverInfo = http.getServerInfo();
       const basePath = http.basePath;
-      const kibanaUrl =
-        (await settingsService.getSettings(soClient)).kibana_url ||
+      const kibanaUrls = (await settingsService.getSettings(soClient)).kibana_urls || [
         url.format({
           protocol: serverInfo.protocol,
           hostname: serverInfo.hostname,
           port: serverInfo.port,
           pathname: basePath.serverBasePath,
-        });
+        }),
+      ];
 
-      const script = getScript(request.params.osType, kibanaUrl);
+      const script = getScript(request.params.osType, kibanaUrls[0]);
 
       return response.ok({ body: script });
     }
diff --git a/x-pack/plugins/ingest_manager/server/routes/output/handler.ts b/x-pack/plugins/ingest_manager/server/routes/output/handler.ts
index cd35b2a43426ca..d920ad4e6cb714 100644
--- a/x-pack/plugins/ingest_manager/server/routes/output/handler.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/output/handler.ts
@@ -20,7 +20,6 @@ export const getOutputsHandler: RequestHandler = async (context, request, respon
       page: outputs.page,
       perPage: outputs.perPage,
       total: outputs.total,
-      success: true,
     };
 
     return response.ok({ body });
@@ -41,7 +40,6 @@ export const getOneOuputHandler: RequestHandler<TypeOf<
 
     const body: GetOneOutputResponse = {
       item: output,
-      success: true,
     };
 
     return response.ok({ body });
@@ -71,7 +69,6 @@ export const putOuputHandler: RequestHandler<
 
     const body: GetOneOutputResponse = {
       item: output,
-      success: true,
     };
 
     return response.ok({ body });
diff --git a/x-pack/plugins/ingest_manager/server/routes/package_policy/handlers.ts b/x-pack/plugins/ingest_manager/server/routes/package_policy/handlers.ts
index d19a73604b4f06..04e3c453da94c5 100644
--- a/x-pack/plugins/ingest_manager/server/routes/package_policy/handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/package_policy/handlers.ts
@@ -34,7 +34,6 @@ export const getPackagePoliciesHandler: RequestHandler<
         total,
         page,
         perPage,
-        success: true,
       },
     });
   } catch (e) {
@@ -59,7 +58,6 @@ export const getOnePackagePolicyHandler: RequestHandler<TypeOf<
       return response.ok({
         body: {
           item: packagePolicy,
-          success: true,
         },
       });
     } else {
@@ -115,7 +113,7 @@ export const createPackagePolicyHandler: RequestHandler<
     const packagePolicy = await packagePolicyService.create(soClient, callCluster, newData, {
       user,
     });
-    const body: CreatePackagePolicyResponse = { item: packagePolicy, success: true };
+    const body: CreatePackagePolicyResponse = { item: packagePolicy };
     return response.ok({
       body,
     });
@@ -163,7 +161,7 @@ export const updatePackagePolicyHandler: RequestHandler<
       { user }
     );
     return response.ok({
-      body: { item: updatedPackagePolicy, success: true },
+      body: { item: updatedPackagePolicy },
     });
   } catch (e) {
     return response.customError({
diff --git a/x-pack/plugins/ingest_manager/server/routes/settings/index.ts b/x-pack/plugins/ingest_manager/server/routes/settings/index.ts
index 56e666056e8d0a..dcba42af6d7889 100644
--- a/x-pack/plugins/ingest_manager/server/routes/settings/index.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/settings/index.ts
@@ -8,7 +8,7 @@ import { TypeOf } from '@kbn/config-schema';
 import { PLUGIN_ID, SETTINGS_API_ROUTES } from '../../constants';
 import { PutSettingsRequestSchema, GetSettingsRequestSchema } from '../../types';
 
-import { settingsService } from '../../services';
+import { settingsService, agentPolicyService, appContextService } from '../../services';
 
 export const getSettingsHandler: RequestHandler = async (context, request, response) => {
   const soClient = context.core.savedObjects.client;
@@ -16,7 +16,6 @@ export const getSettingsHandler: RequestHandler = async (context, request, respo
   try {
     const settings = await settingsService.getSettings(soClient);
     const body = {
-      success: true,
       item: settings,
     };
     return response.ok({ body });
@@ -40,10 +39,13 @@ export const putSettingsHandler: RequestHandler<
   TypeOf<typeof PutSettingsRequestSchema.body>
 > = async (context, request, response) => {
   const soClient = context.core.savedObjects.client;
+  const user = await appContextService.getSecurity()?.authc.getCurrentUser(request);
   try {
     const settings = await settingsService.saveSettings(soClient, request.body);
+    await agentPolicyService.bumpAllAgentPolicies(soClient, {
+      user: user || undefined,
+    });
     const body = {
-      success: true,
       item: settings,
     };
     return response.ok({ body });
diff --git a/x-pack/plugins/ingest_manager/server/routes/setup/handlers.ts b/x-pack/plugins/ingest_manager/server/routes/setup/handlers.ts
index 1daa63800f4ee5..ee7dab6ef1a8b7 100644
--- a/x-pack/plugins/ingest_manager/server/routes/setup/handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/setup/handlers.ts
@@ -9,7 +9,7 @@ import { outputService, appContextService } from '../../services';
 import { GetFleetStatusResponse, PostIngestSetupResponse } from '../../../common';
 import { setupIngestManager, setupFleet } from '../../services/setup';
 import { PostFleetSetupRequestSchema } from '../../types';
-import { IngestManagerError, getHTTPResponseCode } from '../../errors';
+import { defaultIngestErrorHandler } from '../../errors';
 
 export const getFleetStatusHandler: RequestHandler = async (context, request, response) => {
   const soClient = context.core.savedObjects.client;
@@ -46,11 +46,8 @@ export const getFleetStatusHandler: RequestHandler = async (context, request, re
     return response.ok({
       body,
     });
-  } catch (e) {
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+  } catch (error) {
+    return defaultIngestErrorHandler({ error, response });
   }
 };
 
@@ -70,44 +67,22 @@ export const createFleetSetupHandler: RequestHandler<
     return response.ok({
       body: { isInitialized: true },
     });
-  } catch (e) {
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+  } catch (error) {
+    return defaultIngestErrorHandler({ error, response });
   }
 };
 
 export const ingestManagerSetupHandler: RequestHandler = async (context, request, response) => {
   const soClient = context.core.savedObjects.client;
   const callCluster = context.core.elasticsearch.legacy.client.callAsCurrentUser;
-  const logger = appContextService.getLogger();
+
   try {
     const body: PostIngestSetupResponse = { isInitialized: true };
     await setupIngestManager(soClient, callCluster);
     return response.ok({
       body,
     });
-  } catch (e) {
-    if (e instanceof IngestManagerError) {
-      logger.error(e.message);
-      return response.customError({
-        statusCode: getHTTPResponseCode(e),
-        body: { message: e.message },
-      });
-    }
-    if (e.isBoom) {
-      logger.error(e.output.payload.message);
-      return response.customError({
-        statusCode: e.output.statusCode,
-        body: { message: e.output.payload.message },
-      });
-    }
-    logger.error(e.message);
-    logger.error(e.stack);
-    return response.customError({
-      statusCode: 500,
-      body: { message: e.message },
-    });
+  } catch (error) {
+    return defaultIngestErrorHandler({ error, response });
   }
 };
diff --git a/x-pack/plugins/ingest_manager/server/saved_objects/index.ts b/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
index 1bbe3b71bf9191..aff8e607622d47 100644
--- a/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
+++ b/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
@@ -23,6 +23,7 @@ import {
   migrateAgentPolicyToV7100,
   migrateEnrollmentApiKeysToV7100,
   migratePackagePolicyToV7100,
+  migrateSettingsToV7100,
 } from './migrations/to_v7_10_0';
 
 /*
@@ -43,11 +44,14 @@ const savedObjectTypes: { [key: string]: SavedObjectsType } = {
       properties: {
         agent_auto_upgrade: { type: 'keyword' },
         package_auto_upgrade: { type: 'keyword' },
-        kibana_url: { type: 'keyword' },
+        kibana_urls: { type: 'keyword' },
         kibana_ca_sha256: { type: 'keyword' },
         has_seen_add_data_notice: { type: 'boolean', index: false },
       },
     },
+    migrations: {
+      '7.10.0': migrateSettingsToV7100,
+    },
   },
   [AGENT_SAVED_OBJECT_TYPE]: {
     name: AGENT_SAVED_OBJECT_TYPE,
diff --git a/x-pack/plugins/ingest_manager/server/saved_objects/migrations/to_v7_10_0.ts b/x-pack/plugins/ingest_manager/server/saved_objects/migrations/to_v7_10_0.ts
index b60903dbd2bd06..5e36ce46c099be 100644
--- a/x-pack/plugins/ingest_manager/server/saved_objects/migrations/to_v7_10_0.ts
+++ b/x-pack/plugins/ingest_manager/server/saved_objects/migrations/to_v7_10_0.ts
@@ -5,7 +5,14 @@
  */
 
 import { SavedObjectMigrationFn } from 'kibana/server';
-import { Agent, AgentEvent, AgentPolicy, PackagePolicy, EnrollmentAPIKey } from '../../types';
+import {
+  Agent,
+  AgentEvent,
+  AgentPolicy,
+  PackagePolicy,
+  EnrollmentAPIKey,
+  Settings,
+} from '../../types';
 
 export const migrateAgentToV7100: SavedObjectMigrationFn<
   Exclude<Agent, 'policy_id' | 'policy_revision'> & {
@@ -72,3 +79,16 @@ export const migratePackagePolicyToV7100: SavedObjectMigrationFn<
 
   return packagePolicyDoc;
 };
+
+export const migrateSettingsToV7100: SavedObjectMigrationFn<
+  Exclude<Settings, 'kibana_urls'> & {
+    kibana_url: string;
+  },
+  Settings
+> = (settingsDoc) => {
+  settingsDoc.attributes.kibana_urls = [settingsDoc.attributes.kibana_url];
+  // @ts-expect-error
+  delete settingsDoc.attributes.kibana_url;
+
+  return settingsDoc;
+};
diff --git a/x-pack/plugins/ingest_manager/server/services/agent_policy.test.ts b/x-pack/plugins/ingest_manager/server/services/agent_policy.test.ts
index dc2a89c661ac3d..d9dffa03b2290f 100644
--- a/x-pack/plugins/ingest_manager/server/services/agent_policy.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agent_policy.test.ts
@@ -19,6 +19,24 @@ function getSavedObjectMock(agentPolicyAttributes: any) {
       attributes: agentPolicyAttributes,
     };
   });
+  mock.find.mockImplementation(async (options) => {
+    return {
+      saved_objects: [
+        {
+          id: '93f74c0-e876-11ea-b7d3-8b2acec6f75c',
+          attributes: {
+            kibana_urls: ['http://localhost:5603'],
+          },
+          type: 'ingest_manager_settings',
+          score: 1,
+          references: [],
+        },
+      ],
+      total: 1,
+      page: 1,
+      per_page: 1,
+    };
+  });
 
   return mock;
 }
@@ -43,7 +61,7 @@ jest.mock('./output', () => {
 
 describe('agent policy', () => {
   describe('getFullAgentPolicy', () => {
-    it('should return a policy without monitoring if not monitoring is not enabled', async () => {
+    it('should return a policy without monitoring if monitoring is not enabled', async () => {
       const soClient = getSavedObjectMock({
         revision: 1,
       });
@@ -61,6 +79,11 @@ describe('agent policy', () => {
         },
         inputs: [],
         revision: 1,
+        fleet: {
+          kibana: {
+            hosts: ['http://localhost:5603'],
+          },
+        },
         agent: {
           monitoring: {
             enabled: false,
@@ -90,6 +113,11 @@ describe('agent policy', () => {
         },
         inputs: [],
         revision: 1,
+        fleet: {
+          kibana: {
+            hosts: ['http://localhost:5603'],
+          },
+        },
         agent: {
           monitoring: {
             use_output: 'default',
@@ -120,6 +148,11 @@ describe('agent policy', () => {
         },
         inputs: [],
         revision: 1,
+        fleet: {
+          kibana: {
+            hosts: ['http://localhost:5603'],
+          },
+        },
         agent: {
           monitoring: {
             use_output: 'default',
diff --git a/x-pack/plugins/ingest_manager/server/services/agent_policy.ts b/x-pack/plugins/ingest_manager/server/services/agent_policy.ts
index 21bc7b021e83a2..a03a3b7f59fba3 100644
--- a/x-pack/plugins/ingest_manager/server/services/agent_policy.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agent_policy.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { uniq } from 'lodash';
-import { SavedObjectsClientContract } from 'src/core/server';
+import { SavedObjectsClientContract, SavedObjectsBulkUpdateResponse } from 'src/core/server';
 import { AuthenticatedUser } from '../../../security/server';
 import {
   DEFAULT_AGENT_POLICY,
@@ -25,6 +25,7 @@ import { listAgents } from './agents';
 import { packagePolicyService } from './package_policy';
 import { outputService } from './output';
 import { agentPolicyUpdateEventHandler } from './agent_policy_update';
+import { getSettings } from './settings';
 
 const SAVED_OBJECT_TYPE = AGENT_POLICY_SAVED_OBJECT_TYPE;
 
@@ -260,6 +261,25 @@ class AgentPolicyService {
   ): Promise<AgentPolicy> {
     return this._update(soClient, id, {}, options?.user);
   }
+  public async bumpAllAgentPolicies(
+    soClient: SavedObjectsClientContract,
+    options?: { user?: AuthenticatedUser }
+  ): Promise<Promise<SavedObjectsBulkUpdateResponse<AgentPolicy>>> {
+    const currentPolicies = await soClient.find<AgentPolicySOAttributes>({
+      type: SAVED_OBJECT_TYPE,
+      fields: ['revision'],
+    });
+    const bumpedPolicies = currentPolicies.saved_objects.map((policy) => {
+      policy.attributes = {
+        ...policy.attributes,
+        revision: policy.attributes.revision + 1,
+        updated_at: new Date().toISOString(),
+        updated_by: options?.user ? options.user.username : 'system',
+      };
+      return policy;
+    });
+    return soClient.bulkUpdate<AgentPolicySOAttributes>(bumpedPolicies);
+  }
 
   public async assignPackagePolicies(
     soClient: SavedObjectsClientContract,
@@ -360,7 +380,6 @@ class AgentPolicyService {
     await this.triggerAgentPolicyUpdatedEvent(soClient, 'deleted', id);
     return {
       id,
-      success: true,
     };
   }
 
@@ -370,6 +389,7 @@ class AgentPolicyService {
     options?: { standalone: boolean }
   ): Promise<FullAgentPolicy | null> {
     let agentPolicy;
+    const standalone = options?.standalone;
 
     try {
       agentPolicy = await this.get(soClient, id);
@@ -435,6 +455,22 @@ class AgentPolicyService {
           }),
     };
 
+    // only add settings if not in standalone
+    if (!standalone) {
+      let settings;
+      try {
+        settings = await getSettings(soClient);
+      } catch (error) {
+        throw new Error('Default settings is not setup');
+      }
+      if (!settings.kibana_urls) throw new Error('kibana_urls is missing');
+      fullAgentPolicy.fleet = {
+        kibana: {
+          hosts: settings.kibana_urls,
+        },
+      };
+    }
+
     return fullAgentPolicy;
   }
 }
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/actions.ts b/x-pack/plugins/ingest_manager/server/services/agents/actions.ts
index 8d1b320c89ae62..cd0dd921312306 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/actions.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/actions.ts
@@ -9,6 +9,7 @@ import { Agent, AgentAction, AgentActionSOAttributes } from '../../../common/typ
 import { AGENT_ACTION_SAVED_OBJECT_TYPE } from '../../../common/constants';
 import { savedObjectToAgentAction } from './saved_objects';
 import { appContextService } from '../app_context';
+import { nodeTypes } from '../../../../../../src/plugins/data/common';
 
 export async function createAgentAction(
   soClient: SavedObjectsClientContract,
@@ -29,9 +30,24 @@ export async function getAgentActionsForCheckin(
   soClient: SavedObjectsClientContract,
   agentId: string
 ): Promise<AgentAction[]> {
+  const filter = nodeTypes.function.buildNode('and', [
+    nodeTypes.function.buildNode(
+      'not',
+      nodeTypes.function.buildNode(
+        'is',
+        `${AGENT_ACTION_SAVED_OBJECT_TYPE}.attributes.sent_at`,
+        '*'
+      )
+    ),
+    nodeTypes.function.buildNode(
+      'is',
+      `${AGENT_ACTION_SAVED_OBJECT_TYPE}.attributes.agent_id`,
+      agentId
+    ),
+  ]);
   const res = await soClient.find<AgentActionSOAttributes>({
     type: AGENT_ACTION_SAVED_OBJECT_TYPE,
-    filter: `not ${AGENT_ACTION_SAVED_OBJECT_TYPE}.attributes.sent_at: * and ${AGENT_ACTION_SAVED_OBJECT_TYPE}.attributes.agent_id:${agentId}`,
+    filter,
   });
 
   return Promise.all(
@@ -78,9 +94,26 @@ export async function getAgentActionByIds(
 }
 
 export async function getNewActionsSince(soClient: SavedObjectsClientContract, timestamp: string) {
+  const filter = nodeTypes.function.buildNode('and', [
+    nodeTypes.function.buildNode(
+      'not',
+      nodeTypes.function.buildNode(
+        'is',
+        `${AGENT_ACTION_SAVED_OBJECT_TYPE}.attributes.sent_at`,
+        '*'
+      )
+    ),
+    nodeTypes.function.buildNode(
+      'range',
+      `${AGENT_ACTION_SAVED_OBJECT_TYPE}.attributes.created_at`,
+      {
+        gte: timestamp,
+      }
+    ),
+  ]);
   const res = await soClient.find<AgentActionSOAttributes>({
     type: AGENT_ACTION_SAVED_OBJECT_TYPE,
-    filter: `not ${AGENT_ACTION_SAVED_OBJECT_TYPE}.attributes.sent_at: * AND ${AGENT_ACTION_SAVED_OBJECT_TYPE}.attributes.created_at >= "${timestamp}"`,
+    filter,
   });
 
   return res.saved_objects.map(savedObjectToAgentAction);
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/checkin/state_new_actions.ts b/x-pack/plugins/ingest_manager/server/services/agents/checkin/state_new_actions.ts
index e10d013fe84a96..eddfb0e64b84b2 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/checkin/state_new_actions.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/checkin/state_new_actions.ts
@@ -170,7 +170,10 @@ export function agentCheckinStateNewActionsFactory() {
     }
 
     const stream$ = agentPolicy$.pipe(
-      timeout(appContextService.getConfig()?.fleet.pollingRequestTimeout || 0),
+      timeout(
+        // Set a timeout 3s before the real timeout to have a chance to respond an empty response before socket timeout
+        Math.max((appContextService.getConfig()?.fleet.pollingRequestTimeout ?? 0) - 3000, 3000)
+      ),
       filter((agentPolicy) => shouldCreateAgentPolicyAction(agent, agentPolicy)),
       rateLimiter(),
       mergeMap((agentPolicy) => createAgentActionFromAgentPolicy(soClient, agent, agentPolicy)),
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/enroll.test.ts b/x-pack/plugins/ingest_manager/server/services/agents/enroll.test.ts
index 764564cfa49f5b..44473bf2d8d793 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/enroll.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/enroll.test.ts
@@ -5,62 +5,52 @@
  */
 
 import { validateAgentVersion } from './enroll';
-import { appContextService } from '../app_context';
-import { IngestManagerAppContext } from '../../plugin';
 
 describe('validateAgentVersion', () => {
   it('should throw with agent > kibana version', () => {
-    appContextService.start(({
-      kibanaVersion: '8.0.0',
-    } as unknown) as IngestManagerAppContext);
-    expect(() =>
-      validateAgentVersion({
-        local: { elastic: { agent: { version: '8.8.0' } } },
-        userProvided: {},
-      })
-    ).toThrowError(/Agent version is not compatible with kibana version/);
+    expect(() => validateAgentVersion('8.8.0', '8.0.0')).toThrowError('not compatible');
   });
   it('should work with agent < kibana version', () => {
-    appContextService.start(({
-      kibanaVersion: '8.0.0',
-    } as unknown) as IngestManagerAppContext);
-    validateAgentVersion({ local: { elastic: { agent: { version: '7.8.0' } } }, userProvided: {} });
+    validateAgentVersion('7.8.0', '8.0.0');
   });
 
   it('should work with agent = kibana version', () => {
-    appContextService.start(({
-      kibanaVersion: '8.0.0',
-    } as unknown) as IngestManagerAppContext);
-    validateAgentVersion({ local: { elastic: { agent: { version: '8.0.0' } } }, userProvided: {} });
+    validateAgentVersion('8.0.0', '8.0.0');
   });
 
   it('should work with SNAPSHOT version', () => {
-    appContextService.start(({
-      kibanaVersion: '8.0.0-SNAPSHOT',
-    } as unknown) as IngestManagerAppContext);
-    validateAgentVersion({
-      local: { elastic: { agent: { version: '8.0.0-SNAPSHOT' } } },
-      userProvided: {},
-    });
+    validateAgentVersion('8.0.0-SNAPSHOT', '8.0.0-SNAPSHOT');
   });
 
   it('should work with a agent using SNAPSHOT version', () => {
-    appContextService.start(({
-      kibanaVersion: '7.8.0',
-    } as unknown) as IngestManagerAppContext);
-    validateAgentVersion({
-      local: { elastic: { agent: { version: '7.8.0-SNAPSHOT' } } },
-      userProvided: {},
-    });
+    validateAgentVersion('7.8.0-SNAPSHOT', '7.8.0');
   });
 
   it('should work with a kibana using SNAPSHOT version', () => {
-    appContextService.start(({
-      kibanaVersion: '7.8.0-SNAPSHOT',
-    } as unknown) as IngestManagerAppContext);
-    validateAgentVersion({
-      local: { elastic: { agent: { version: '7.8.0' } } },
-      userProvided: {},
-    });
+    validateAgentVersion('7.8.0', '7.8.0-SNAPSHOT');
+  });
+
+  it('very close versions, e.g. patch/prerelease - all combos should work', () => {
+    validateAgentVersion('7.9.1', '7.9.2');
+    validateAgentVersion('7.8.1', '7.8.2');
+    validateAgentVersion('7.6.99', '7.6.2');
+    validateAgentVersion('7.6.2', '7.6.99');
+    validateAgentVersion('5.94.3', '5.94.1234-SNAPSHOT');
+    validateAgentVersion('5.94.3-SNAPSHOT', '5.94.1');
+  });
+
+  it('somewhat close versions, minor release is 1 or 2 versions back and is older than the stack', () => {
+    validateAgentVersion('7.9.1', '7.10.2');
+    validateAgentVersion('7.9.9', '7.11.1');
+    validateAgentVersion('7.6.99', '7.6.2');
+    validateAgentVersion('7.6.2', '7.6.99');
+    expect(() => validateAgentVersion('5.94.3-SNAPSHOT', '5.93.1')).toThrowError('not compatible');
+    expect(() => validateAgentVersion('5.94.3', '5.92.99-SNAPSHOT')).toThrowError('not compatible');
+  });
+
+  it('versions where Agent is a minor version or major version greater (newer) than the stack should not work', () => {
+    expect(() => validateAgentVersion('7.10.1', '7.9.99')).toThrowError('not compatible');
+    expect(() => validateAgentVersion('7.9.9', '6.11.1')).toThrowError('not compatible');
+    expect(() => validateAgentVersion('5.94.3', '5.92.99-SNAPSHOT')).toThrowError('not compatible');
   });
 });
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/enroll.ts b/x-pack/plugins/ingest_manager/server/services/agents/enroll.ts
index 606d5c4dcbb90a..3c5850c722e971 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/enroll.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/enroll.ts
@@ -20,7 +20,8 @@ export async function enroll(
   metadata?: { local: any; userProvided: any },
   sharedId?: string
 ): Promise<Agent> {
-  validateAgentVersion(metadata);
+  const agentVersion = metadata?.local?.elastic?.agent?.version;
+  validateAgentVersion(agentVersion);
 
   const existingAgent = sharedId ? await getAgentBySharedId(soClient, sharedId) : null;
 
@@ -89,24 +90,50 @@ async function getAgentBySharedId(soClient: SavedObjectsClientContract, sharedId
   return null;
 }
 
-export function validateAgentVersion(metadata?: { local: any; userProvided: any }) {
-  const kibanaVersion = semver.parse(appContextService.getKibanaVersion());
-  if (!kibanaVersion) {
-    throw Boom.badRequest('Kibana version is not set');
-  }
-  const version = semver.parse(metadata?.local?.elastic?.agent?.version);
-  if (!version) {
-    throw Boom.badRequest('Agent version not provided in metadata.');
+export function validateAgentVersion(
+  agentVersion: string,
+  kibanaVersion = appContextService.getKibanaVersion()
+) {
+  const agentVersionParsed = semver.parse(agentVersion);
+  if (!agentVersionParsed) {
+    throw Boom.badRequest('Agent version not provided');
   }
 
-  if (!version || !semver.lte(formatVersion(version), formatVersion(kibanaVersion))) {
-    throw Boom.badRequest('Agent version is not compatible with kibana version');
+  const kibanaVersionParsed = semver.parse(kibanaVersion);
+  if (!kibanaVersionParsed) {
+    throw Boom.badRequest('Kibana version is not set or provided');
   }
-}
 
-/**
- * used to remove prelease from version as includePrerelease in not working as expected
- */
-function formatVersion(version: semver.SemVer) {
-  return `${version.major}.${version.minor}.${version.patch}`;
+  const diff = semver.diff(agentVersion, kibanaVersion);
+  switch (diff) {
+    // section 1) very close versions, only patch release differences - all combos should work
+    // Agent a.b.1 < Kibana a.b.2
+    // Agent a.b.2 > Kibana a.b.1
+    case null:
+    case 'prerelease':
+    case 'prepatch':
+    case 'patch':
+      return; // OK
+
+    // section 2) somewhat close versions, Agent minor release is 1 or 2 versions back and is older than the stack:
+    // Agent a.9.x < Kibana a.10.x
+    // Agent a.9.x < Kibana a.11.x
+    case 'preminor':
+    case 'minor':
+      if (
+        agentVersionParsed.minor < kibanaVersionParsed.minor &&
+        kibanaVersionParsed.minor - agentVersionParsed.minor <= 2
+      )
+        return;
+
+    // section 3) versions where Agent is a minor version or major version greater (newer) than the stack should not work:
+    // Agent 7.10.x > Kibana 7.9.x
+    // Agent 8.0.x > Kibana 7.9.x
+    default:
+      if (semver.lte(agentVersionParsed, kibanaVersionParsed)) return;
+      else
+        throw Boom.badRequest(
+          `Agent version ${agentVersion} is not compatible with Kibana version ${kibanaVersion}`
+        );
+  }
 }
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/packages/remove.ts b/x-pack/plugins/ingest_manager/server/services/epm/packages/remove.ts
index bc71ead34c3d4d..71eee1ee82c901 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/packages/remove.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/packages/remove.ts
@@ -13,7 +13,7 @@ import { getInstallation, savedObjectTypes } from './index';
 import { deletePipeline } from '../elasticsearch/ingest_pipeline/';
 import { installIndexPatterns } from '../kibana/index_pattern/install';
 import { packagePolicyService, appContextService } from '../..';
-import { splitPkgKey } from '../registry';
+import { splitPkgKey, deletePackageCache, getArchiveInfo } from '../registry';
 
 export async function removeInstallation(options: {
   savedObjectsClient: SavedObjectsClientContract;
@@ -22,7 +22,7 @@ export async function removeInstallation(options: {
 }): Promise<AssetReference[]> {
   const { savedObjectsClient, pkgkey, callCluster } = options;
   // TODO:  the epm api should change to /name/version so we don't need to do this
-  const { pkgName } = splitPkgKey(pkgkey);
+  const { pkgName, pkgVersion } = splitPkgKey(pkgkey);
   const installation = await getInstallation({ savedObjectsClient, pkgName });
   if (!installation) throw Boom.badRequest(`${pkgName} is not installed`);
   if (installation.removable === false)
@@ -50,6 +50,11 @@ export async function removeInstallation(options: {
   // could also update with [] or some other state
   await savedObjectsClient.delete(PACKAGES_SAVED_OBJECT_TYPE, pkgName);
 
+  // remove the package archive and its contents from the cache so that a reinstall fetches
+  // a fresh copy from the registry
+  const paths = await getArchiveInfo(pkgName, pkgVersion);
+  deletePackageCache(pkgName, pkgVersion, paths);
+
   // successful delete's in SO client return {}. return something more useful
   return installedAssets;
 }
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/registry/cache.ts b/x-pack/plugins/ingest_manager/server/services/epm/registry/cache.ts
index d2a14fcf04dff7..b7c1e8c2069d68 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/registry/cache.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/registry/cache.ts
@@ -3,9 +3,21 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { pkgToPkgKey } from './index';
 
 const cache: Map<string, Buffer> = new Map();
 export const cacheGet = (key: string) => cache.get(key);
 export const cacheSet = (key: string, value: Buffer) => cache.set(key, value);
 export const cacheHas = (key: string) => cache.has(key);
-export const getCacheKey = (key: string) => key + '.tar.gz';
+export const cacheClear = () => cache.clear();
+export const cacheDelete = (key: string) => cache.delete(key);
+
+const archiveLocationCache: Map<string, string> = new Map();
+export const getArchiveLocation = (name: string, version: string) =>
+  archiveLocationCache.get(pkgToPkgKey({ name, version }));
+
+export const setArchiveLocation = (name: string, version: string, location: string) =>
+  archiveLocationCache.set(pkgToPkgKey({ name, version }), location);
+
+export const deleteArchiveLocation = (name: string, version: string) =>
+  archiveLocationCache.delete(pkgToPkgKey({ name, version }));
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/registry/extract.ts b/x-pack/plugins/ingest_manager/server/services/epm/registry/extract.ts
index 1f708c5edbcc7f..6d029b54a63171 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/registry/extract.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/registry/extract.ts
@@ -5,6 +5,7 @@
  */
 
 import tar from 'tar';
+import yauzl from 'yauzl';
 import { bufferToStream, streamToBuffer } from './streams';
 
 export interface ArchiveEntry {
@@ -30,3 +31,40 @@ export async function untarBuffer(
     deflatedStream.pipe(inflateStream);
   });
 }
+
+export async function unzipBuffer(
+  buffer: Buffer,
+  filter = (entry: ArchiveEntry): boolean => true,
+  onEntry = (entry: ArchiveEntry): void => {}
+): Promise<void> {
+  const zipfile = await yauzlFromBuffer(buffer, { lazyEntries: true });
+  zipfile.readEntry();
+  zipfile.on('entry', async (entry: yauzl.Entry) => {
+    const path = entry.fileName;
+    if (!filter({ path })) return zipfile.readEntry();
+
+    const entryBuffer = await getZipReadStream(zipfile, entry).then(streamToBuffer);
+    onEntry({ buffer: entryBuffer, path });
+    zipfile.readEntry();
+  });
+  return new Promise((resolve, reject) => zipfile.on('end', resolve).on('error', reject));
+}
+
+function yauzlFromBuffer(buffer: Buffer, opts: yauzl.Options): Promise<yauzl.ZipFile> {
+  return new Promise((resolve, reject) =>
+    yauzl.fromBuffer(buffer, opts, (err?: Error, handle?: yauzl.ZipFile) =>
+      err ? reject(err) : resolve(handle)
+    )
+  );
+}
+
+function getZipReadStream(
+  zipfile: yauzl.ZipFile,
+  entry: yauzl.Entry
+): Promise<NodeJS.ReadableStream> {
+  return new Promise((resolve, reject) =>
+    zipfile.openReadStream(entry, (err?: Error, readStream?: NodeJS.ReadableStream) =>
+      err ? reject(err) : resolve(readStream)
+    )
+  );
+}
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/registry/index.test.ts b/x-pack/plugins/ingest_manager/server/services/epm/registry/index.test.ts
index 085dc990fa376e..b40638eefbae2f 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/registry/index.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/registry/index.test.ts
@@ -5,7 +5,17 @@
  */
 
 import { AssetParts } from '../../../types';
-import { pathParts, splitPkgKey } from './index';
+import { getBufferExtractor, pathParts, splitPkgKey } from './index';
+import { getArchiveLocation } from './cache';
+import { untarBuffer, unzipBuffer } from './extract';
+
+jest.mock('./cache', () => {
+  return {
+    getArchiveLocation: jest.fn(),
+  };
+});
+
+const mockedGetArchiveLocation = getArchiveLocation as jest.Mock;
 
 const testPaths = [
   {
@@ -80,3 +90,21 @@ describe('splitPkgKey tests', () => {
     expect(pkgVersion).toBe('0.13.0-alpha.1+abcd');
   });
 });
+
+describe('getBufferExtractor', () => {
+  it('throws if the archive has not been downloaded/cached yet', () => {
+    expect(() => getBufferExtractor('missing', '1.2.3')).toThrow('no archive location');
+  });
+
+  it('returns unzipBuffer if the archive key ends in .zip', () => {
+    mockedGetArchiveLocation.mockImplementation(() => '.zip');
+    const extractor = getBufferExtractor('will-use-mocked-key', 'a.b.c');
+    expect(extractor).toBe(unzipBuffer);
+  });
+
+  it('returns untarBuffer if the key ends in anything else', () => {
+    mockedGetArchiveLocation.mockImplementation(() => 'xyz');
+    const extractor = getBufferExtractor('will-use-mocked-key', 'a.b.c');
+    expect(extractor).toBe(untarBuffer);
+  });
+});
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/registry/index.ts b/x-pack/plugins/ingest_manager/server/services/epm/registry/index.ts
index b6353789604689..96f75306413905 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/registry/index.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/registry/index.ts
@@ -17,8 +17,16 @@ import {
   RegistrySearchResults,
   RegistrySearchResult,
 } from '../../../types';
-import { cacheGet, cacheSet, getCacheKey, cacheHas } from './cache';
-import { ArchiveEntry, untarBuffer } from './extract';
+import {
+  cacheGet,
+  cacheSet,
+  cacheDelete,
+  cacheHas,
+  getArchiveLocation,
+  setArchiveLocation,
+  deleteArchiveLocation,
+} from './cache';
+import { ArchiveEntry, untarBuffer, unzipBuffer } from './extract';
 import { fetchUrl, getResponse, getResponseStream } from './requests';
 import { streamToBuffer } from './streams';
 import { getRegistryUrl } from './registry_url';
@@ -130,7 +138,9 @@ export async function getArchiveInfo(
   filter = (entry: ArchiveEntry): boolean => true
 ): Promise<string[]> {
   const paths: string[] = [];
-  const onEntry = (entry: ArchiveEntry) => {
+  const archiveBuffer = await getOrFetchArchiveBuffer(pkgName, pkgVersion);
+  const bufferExtractor = getBufferExtractor(pkgName, pkgVersion);
+  await bufferExtractor(archiveBuffer, filter, (entry: ArchiveEntry) => {
     const { path, buffer } = entry;
     const { file } = pathParts(path);
     if (!file) return;
@@ -138,9 +148,7 @@ export async function getArchiveInfo(
       cacheSet(path, buffer);
       paths.push(path);
     }
-  };
-
-  await extract(pkgName, pkgVersion, filter, onEntry);
+  });
 
   return paths;
 }
@@ -175,24 +183,20 @@ export function pathParts(path: string): AssetParts {
   } as AssetParts;
 }
 
-async function extract(
-  pkgName: string,
-  pkgVersion: string,
-  filter = (entry: ArchiveEntry): boolean => true,
-  onEntry: (entry: ArchiveEntry) => void
-) {
-  const archiveBuffer = await getOrFetchArchiveBuffer(pkgName, pkgVersion);
+export function getBufferExtractor(pkgName: string, pkgVersion: string) {
+  const archiveLocation = getArchiveLocation(pkgName, pkgVersion);
+  if (!archiveLocation) throw new Error(`no archive location for ${pkgName} ${pkgVersion}`);
+  const isZip = archiveLocation.endsWith('.zip');
+  const bufferExtractor = isZip ? unzipBuffer : untarBuffer;
 
-  return untarBuffer(archiveBuffer, filter, onEntry);
+  return bufferExtractor;
 }
 
 async function getOrFetchArchiveBuffer(pkgName: string, pkgVersion: string): Promise<Buffer> {
-  // assume .tar.gz for now. add support for .zip if/when we need it
-  const key = getCacheKey(`${pkgName}-${pkgVersion}`);
-  let buffer = cacheGet(key);
+  const key = getArchiveLocation(pkgName, pkgVersion);
+  let buffer = key && cacheGet(key);
   if (!buffer) {
     buffer = await fetchArchiveBuffer(pkgName, pkgVersion);
-    cacheSet(key, buffer);
   }
 
   if (buffer) {
@@ -203,16 +207,21 @@ async function getOrFetchArchiveBuffer(pkgName: string, pkgVersion: string): Pro
 }
 
 export async function ensureCachedArchiveInfo(name: string, version: string) {
-  const pkgkey = getCacheKey(`${name}-${version}`);
-  if (!cacheHas(pkgkey)) {
+  const pkgkey = getArchiveLocation(name, version);
+  if (!pkgkey || !cacheHas(pkgkey)) {
     await getArchiveInfo(name, version);
   }
 }
 
 async function fetchArchiveBuffer(pkgName: string, pkgVersion: string): Promise<Buffer> {
   const { download: archivePath } = await fetchInfo(pkgName, pkgVersion);
-  const registryUrl = getRegistryUrl();
-  return getResponseStream(`${registryUrl}${archivePath}`).then(streamToBuffer);
+  const archiveUrl = `${getRegistryUrl()}${archivePath}`;
+  const buffer = await getResponseStream(archiveUrl).then(streamToBuffer);
+
+  setArchiveLocation(pkgName, pkgVersion, archivePath);
+  cacheSet(archivePath, buffer);
+
+  return buffer;
 }
 
 export function getAsset(key: string) {
@@ -240,3 +249,17 @@ export function groupPathsByService(paths: string[]): AssetsGroupedByServiceByTy
     // elasticsearch: assets.elasticsearch,
   };
 }
+
+export const deletePackageCache = (name: string, version: string, paths: string[]) => {
+  const archiveLocation = getArchiveLocation(name, version);
+  if (archiveLocation) {
+    // delete cached archive
+    cacheDelete(archiveLocation);
+
+    // delete cached archive location
+    deleteArchiveLocation(name, version);
+  }
+  // delete cached archive contents
+  // this has been populated in Registry.getArchiveInfo()
+  paths.forEach((path) => cacheDelete(path));
+};
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/registry/requests.test.ts b/x-pack/plugins/ingest_manager/server/services/epm/registry/requests.test.ts
index f836a133a78a01..2f1d4000187407 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/registry/requests.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/registry/requests.test.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { fetchUrl } from './requests';
-import { RegistryError } from '../../../errors';
+import { RegistryError, RegistryConnectionError, RegistryResponseError } from '../../../errors';
 jest.mock('node-fetch');
 
 const { Response, FetchError } = jest.requireActual('node-fetch');
@@ -53,13 +53,7 @@ describe('setupIngestManager', () => {
             throw new FetchError('message 3', 'system', { code: 'ESOMETHING' });
           })
           // this one succeeds
-          .mockImplementationOnce(() => Promise.resolve(new Response(successValue)))
-          .mockImplementationOnce(() => {
-            throw new FetchError('message 5', 'system', { code: 'ESOMETHING' });
-          })
-          .mockImplementationOnce(() => {
-            throw new FetchError('message 6', 'system', { code: 'ESOMETHING' });
-          });
+          .mockImplementationOnce(() => Promise.resolve(new Response(successValue)));
 
         const promise = fetchUrl('');
         await expect(promise).resolves.toEqual(successValue);
@@ -69,7 +63,7 @@ describe('setupIngestManager', () => {
         expect(actualResultsOrder).toEqual(['throw', 'throw', 'throw', 'return']);
       });
 
-      it('or error after 1 failure & 5 retries with RegistryError', async () => {
+      it('or error after 1 failure & 5 retries with RegistryConnectionError', async () => {
         fetchMock
           .mockImplementationOnce(() => {
             throw new FetchError('message 1', 'system', { code: 'ESOMETHING' });
@@ -88,21 +82,93 @@ describe('setupIngestManager', () => {
           })
           .mockImplementationOnce(() => {
             throw new FetchError('message 6', 'system', { code: 'ESOMETHING' });
-          })
-          .mockImplementationOnce(() => {
-            throw new FetchError('message 7', 'system', { code: 'ESOMETHING' });
-          })
-          .mockImplementationOnce(() => {
-            throw new FetchError('message 8', 'system', { code: 'ESOMETHING' });
           });
 
         const promise = fetchUrl('');
-        await expect(promise).rejects.toThrow(RegistryError);
+        await expect(promise).rejects.toThrow(RegistryConnectionError);
         // doesn't retry after 1 failure & 5 failed retries
         expect(fetchMock).toHaveBeenCalledTimes(6);
         const actualResultsOrder = fetchMock.mock.results.map(({ type }: { type: string }) => type);
         expect(actualResultsOrder).toEqual(['throw', 'throw', 'throw', 'throw', 'throw', 'throw']);
       });
     });
+
+    describe('4xx or 5xx from Registry become RegistryResponseError', () => {
+      it('404', async () => {
+        fetchMock.mockImplementationOnce(() => ({
+          ok: false,
+          status: 404,
+          statusText: 'Not Found',
+          url: 'https://example.com',
+        }));
+        const promise = fetchUrl('');
+        await expect(promise).rejects.toThrow(RegistryResponseError);
+        await expect(promise).rejects.toThrow(
+          `'404 Not Found' error response from package registry at https://example.com`
+        );
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+      });
+
+      it('429', async () => {
+        fetchMock.mockImplementationOnce(() => ({
+          ok: false,
+          status: 429,
+          statusText: 'Too Many Requests',
+          url: 'https://example.com',
+        }));
+        const promise = fetchUrl('');
+        await expect(promise).rejects.toThrow(RegistryResponseError);
+        await expect(promise).rejects.toThrow(
+          `'429 Too Many Requests' error response from package registry at https://example.com`
+        );
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+      });
+
+      it('500', async () => {
+        fetchMock.mockImplementationOnce(() => ({
+          ok: false,
+          status: 500,
+          statusText: 'Internal Server Error',
+          url: 'https://example.com',
+        }));
+        const promise = fetchUrl('');
+        await expect(promise).rejects.toThrow(RegistryResponseError);
+        await expect(promise).rejects.toThrow(
+          `'500 Internal Server Error' error response from package registry at https://example.com`
+        );
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+      });
+    });
+
+    describe('url in RegistryResponseError message is response.url || requested_url', () => {
+      it('given response.url, use that', async () => {
+        fetchMock.mockImplementationOnce(() => ({
+          ok: false,
+          status: 404,
+          statusText: 'Not Found',
+          url: 'https://example.com/?from_response=true',
+        }));
+        const promise = fetchUrl('https://example.com/?requested=true');
+        await expect(promise).rejects.toThrow(RegistryResponseError);
+        await expect(promise).rejects.toThrow(
+          `'404 Not Found' error response from package registry at https://example.com/?from_response=true`
+        );
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+      });
+
+      it('no response.url, use requested url', async () => {
+        fetchMock.mockImplementationOnce(() => ({
+          ok: false,
+          status: 404,
+          statusText: 'Not Found',
+        }));
+        const promise = fetchUrl('https://example.com/?requested=true');
+        await expect(promise).rejects.toThrow(RegistryResponseError);
+        await expect(promise).rejects.toThrow(
+          `'404 Not Found' error response from package registry at https://example.com/?requested=true`
+        );
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+      });
+    });
   });
 });
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/registry/requests.ts b/x-pack/plugins/ingest_manager/server/services/epm/registry/requests.ts
index 5939dc204aae66..e549d6b1f71aa1 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/registry/requests.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/registry/requests.ts
@@ -7,7 +7,7 @@
 import fetch, { FetchError, Response } from 'node-fetch';
 import pRetry from 'p-retry';
 import { streamToString } from './streams';
-import { RegistryError } from '../../../errors';
+import { RegistryError, RegistryConnectionError, RegistryResponseError } from '../../../errors';
 
 type FailedAttemptErrors = pRetry.FailedAttemptError | FetchError | Error;
 
@@ -19,10 +19,13 @@ async function registryFetch(url: string) {
     return response;
   } else {
     // 4xx & 5xx responses
-    // exit without retry & throw RegistryError
-    throw new pRetry.AbortError(
-      new RegistryError(`Error connecting to package registry at ${url}: ${response.statusText}`)
-    );
+    const { status, statusText, url: resUrl } = response;
+    const message = `'${status} ${statusText}' error response from package registry at ${
+      resUrl || url
+    }`;
+    const responseError = new RegistryResponseError(message);
+
+    throw new pRetry.AbortError(responseError);
   }
 }
 
@@ -38,17 +41,24 @@ export async function getResponse(url: string): Promise<Response> {
         // and let the others through without retrying
         //
         // throwing in onFailedAttempt will abandon all retries & fail the request
-        // we only want to retry system errors, so throw a RegistryError for everything else
+        // we only want to retry system errors, so re-throw for everything else
         if (!isSystemError(error)) {
-          throw new RegistryError(
-            `Error connecting to package registry at ${url}: ${error.message}`
-          );
+          throw error;
         }
       },
     });
     return response;
-  } catch (e) {
-    throw new RegistryError(`Error connecting to package registry at ${url}: ${e.message}`);
+  } catch (error) {
+    // isSystemError here means we didn't succeed after max retries
+    if (isSystemError(error)) {
+      throw new RegistryConnectionError(`Error connecting to package registry: ${error.message}`);
+    }
+    // don't wrap our own errors
+    if (error instanceof RegistryError) {
+      throw error;
+    } else {
+      throw new RegistryError(error);
+    }
   }
 }
 
diff --git a/x-pack/plugins/ingest_manager/server/services/settings.ts b/x-pack/plugins/ingest_manager/server/services/settings.ts
index f1c09746d9abd1..25223fbc08535a 100644
--- a/x-pack/plugins/ingest_manager/server/services/settings.ts
+++ b/x-pack/plugins/ingest_manager/server/services/settings.ts
@@ -5,7 +5,15 @@
  */
 import Boom from 'boom';
 import { SavedObjectsClientContract } from 'kibana/server';
-import { GLOBAL_SETTINGS_SAVED_OBJECT_TYPE, SettingsSOAttributes, Settings } from '../../common';
+import url from 'url';
+import {
+  GLOBAL_SETTINGS_SAVED_OBJECT_TYPE,
+  SettingsSOAttributes,
+  Settings,
+  decodeCloudId,
+  BaseSettings,
+} from '../../common';
+import { appContextService } from './app_context';
 
 export async function getSettings(soClient: SavedObjectsClientContract): Promise<Settings> {
   const res = await soClient.find<SettingsSOAttributes>({
@@ -25,7 +33,7 @@ export async function getSettings(soClient: SavedObjectsClientContract): Promise
 export async function saveSettings(
   soClient: SavedObjectsClientContract,
   newData: Partial<Omit<Settings, 'id'>>
-): Promise<Settings> {
+): Promise<Partial<Settings> & Pick<Settings, 'id'>> {
   try {
     const settings = await getSettings(soClient);
 
@@ -41,10 +49,11 @@ export async function saveSettings(
     };
   } catch (e) {
     if (e.isBoom && e.output.statusCode === 404) {
-      const res = await soClient.create<SettingsSOAttributes>(
-        GLOBAL_SETTINGS_SAVED_OBJECT_TYPE,
-        newData
-      );
+      const defaultSettings = createDefaultSettings();
+      const res = await soClient.create<SettingsSOAttributes>(GLOBAL_SETTINGS_SAVED_OBJECT_TYPE, {
+        ...defaultSettings,
+        ...newData,
+      });
 
       return {
         id: res.id,
@@ -55,3 +64,26 @@ export async function saveSettings(
     throw e;
   }
 }
+
+export function createDefaultSettings(): BaseSettings {
+  const http = appContextService.getHttpSetup();
+  const serverInfo = http.getServerInfo();
+  const basePath = http.basePath;
+
+  const cloud = appContextService.getCloud();
+  const cloudId = cloud?.isCloudEnabled && cloud.cloudId;
+  const cloudUrl = cloudId && decodeCloudId(cloudId)?.kibanaUrl;
+  const flagsUrl = appContextService.getConfig()?.fleet?.kibana?.host;
+  const defaultUrl = url.format({
+    protocol: serverInfo.protocol,
+    hostname: serverInfo.hostname,
+    port: serverInfo.port,
+    pathname: basePath.serverBasePath,
+  });
+
+  return {
+    agent_auto_upgrade: true,
+    package_auto_upgrade: true,
+    kibana_urls: [cloudUrl || flagsUrl || defaultUrl].flat(),
+  };
+}
diff --git a/x-pack/plugins/ingest_manager/server/services/setup.ts b/x-pack/plugins/ingest_manager/server/services/setup.ts
index fd5d94a71d672c..ec3a05a4fa390d 100644
--- a/x-pack/plugins/ingest_manager/server/services/setup.ts
+++ b/x-pack/plugins/ingest_manager/server/services/setup.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import url from 'url';
 import uuid from 'uuid';
 import { SavedObjectsClientContract } from 'src/core/server';
 import { CallESAsCurrentUser } from '../types';
@@ -22,14 +21,13 @@ import {
   Installation,
   Output,
   DEFAULT_AGENT_POLICIES_PACKAGES,
-  decodeCloudId,
 } from '../../common';
 import { getPackageInfo } from './epm/packages';
 import { packagePolicyService } from './package_policy';
 import { generateEnrollmentAPIKey } from './api_keys';
 import { settingsService } from '.';
-import { appContextService } from './app_context';
 import { awaitIfPending } from './setup_utils';
+import { createDefaultSettings } from './settings';
 
 const FLEET_ENROLL_USERNAME = 'fleet_enroll';
 const FLEET_ENROLL_ROLE = 'fleet_enroll';
@@ -58,26 +56,8 @@ async function createSetupSideEffects(
     ensureDefaultIndices(callCluster),
     settingsService.getSettings(soClient).catch((e: any) => {
       if (e.isBoom && e.output.statusCode === 404) {
-        const http = appContextService.getHttpSetup();
-        const serverInfo = http.getServerInfo();
-        const basePath = http.basePath;
-
-        const cloud = appContextService.getCloud();
-        const cloudId = cloud?.isCloudEnabled && cloud.cloudId;
-        const cloudUrl = cloudId && decodeCloudId(cloudId)?.kibanaUrl;
-        const flagsUrl = appContextService.getConfig()?.fleet?.kibana?.host;
-        const defaultUrl = url.format({
-          protocol: serverInfo.protocol,
-          hostname: serverInfo.hostname,
-          port: serverInfo.port,
-          pathname: basePath.serverBasePath,
-        });
-
-        return settingsService.saveSettings(soClient, {
-          agent_auto_upgrade: true,
-          package_auto_upgrade: true,
-          kibana_url: cloudUrl || flagsUrl || defaultUrl,
-        });
+        const defaultSettings = createDefaultSettings();
+        return settingsService.saveSettings(soClient, defaultSettings);
       }
 
       return Promise.reject(e);
diff --git a/x-pack/plugins/ingest_manager/server/types/index.tsx b/x-pack/plugins/ingest_manager/server/types/index.tsx
index aabe4bd3e35975..e01568cfbb3c99 100644
--- a/x-pack/plugins/ingest_manager/server/types/index.tsx
+++ b/x-pack/plugins/ingest_manager/server/types/index.tsx
@@ -63,6 +63,9 @@ export {
   IndexTemplateMappings,
   Settings,
   SettingsSOAttributes,
+  // Agent Request types
+  PostAgentEnrollRequest,
+  PostAgentCheckinRequest,
 } from '../../common';
 
 export type CallESAsCurrentUser = LegacyScopedClusterClient['callAsCurrentUser'];
diff --git a/x-pack/plugins/ingest_manager/server/types/rest_spec/agent.ts b/x-pack/plugins/ingest_manager/server/types/rest_spec/agent.ts
index 3302b0ab84ba88..43ee0c89126e9e 100644
--- a/x-pack/plugins/ingest_manager/server/types/rest_spec/agent.ts
+++ b/x-pack/plugins/ingest_manager/server/types/rest_spec/agent.ts
@@ -5,12 +5,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import {
-  AckEventSchema,
-  NewAgentEventSchema,
-  AgentTypeSchema,
-  NewAgentActionSchema,
-} from '../models';
+import { NewAgentActionSchema } from '../models';
 
 export const GetAgentsRequestSchema = {
   query: schema.object({
@@ -27,37 +22,134 @@ export const GetOneAgentRequestSchema = {
   }),
 };
 
-export const PostAgentCheckinRequestSchema = {
-  params: schema.object({
-    agentId: schema.string(),
-  }),
-  body: schema.object({
-    status: schema.maybe(
-      schema.oneOf([schema.literal('online'), schema.literal('error'), schema.literal('degraded')])
-    ),
-    local_metadata: schema.maybe(schema.recordOf(schema.string(), schema.any())),
-    events: schema.maybe(schema.arrayOf(NewAgentEventSchema)),
-  }),
+export const PostAgentCheckinRequestParamsJSONSchema = {
+  type: 'object',
+  properties: {
+    agentId: { type: 'string' },
+  },
+  required: ['agentId'],
 };
 
-export const PostAgentEnrollRequestSchema = {
-  body: schema.object({
-    type: AgentTypeSchema,
-    shared_id: schema.maybe(schema.string()),
-    metadata: schema.object({
-      local: schema.recordOf(schema.string(), schema.any()),
-      user_provided: schema.recordOf(schema.string(), schema.any()),
-    }),
-  }),
+export const PostAgentCheckinRequestBodyJSONSchema = {
+  type: 'object',
+  properties: {
+    status: { type: 'string', enum: ['online', 'error', 'degraded'] },
+    local_metadata: {
+      additionalProperties: {
+        anyOf: [{ type: 'string' }, { type: 'number' }, { type: 'object' }],
+      },
+    },
+    events: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          type: { type: 'string', enum: ['STATE', 'ERROR', 'ACTION_RESULT', 'ACTION'] },
+          subtype: {
+            type: 'string',
+            enum: [
+              'RUNNING',
+              'STARTING',
+              'IN_PROGRESS',
+              'CONFIG',
+              'FAILED',
+              'STOPPING',
+              'STOPPED',
+              'DEGRADED',
+              'DATA_DUMP',
+              'ACKNOWLEDGED',
+              'UNKNOWN',
+            ],
+          },
+          timestamp: { type: 'string' },
+          message: { type: 'string' },
+          payload: { type: 'object', additionalProperties: true },
+          agent_id: { type: 'string' },
+          action_id: { type: 'string' },
+          policy_id: { type: 'string' },
+          stream_id: { type: 'string' },
+        },
+        required: ['type', 'subtype', 'timestamp', 'message', 'agent_id'],
+        additionalProperties: false,
+      },
+    },
+  },
+  additionalProperties: false,
 };
 
-export const PostAgentAcksRequestSchema = {
-  body: schema.object({
-    events: schema.arrayOf(AckEventSchema),
-  }),
-  params: schema.object({
-    agentId: schema.string(),
-  }),
+export const PostAgentEnrollRequestBodyJSONSchema = {
+  type: 'object',
+  properties: {
+    type: { type: 'string', enum: ['EPHEMERAL', 'PERMANENT', 'TEMPORARY'] },
+    shared_id: { type: 'string' },
+    metadata: {
+      type: 'object',
+      properties: {
+        local: {
+          type: 'object',
+          additionalProperties: true,
+        },
+        user_provided: {
+          type: 'object',
+          additionalProperties: true,
+        },
+      },
+      additionalProperties: false,
+      required: ['local', 'user_provided'],
+    },
+  },
+  additionalProperties: false,
+  required: ['type', 'metadata'],
+};
+
+export const PostAgentAcksRequestParamsJSONSchema = {
+  type: 'object',
+  properties: {
+    agentId: { type: 'string' },
+  },
+  required: ['agentId'],
+};
+
+export const PostAgentAcksRequestBodyJSONSchema = {
+  type: 'object',
+  properties: {
+    events: {
+      type: 'array',
+      item: {
+        type: 'object',
+        properties: {
+          type: { type: 'string', enum: ['STATE', 'ERROR', 'ACTION_RESULT', 'ACTION'] },
+          subtype: {
+            type: 'string',
+            enum: [
+              'RUNNING',
+              'STARTING',
+              'IN_PROGRESS',
+              'CONFIG',
+              'FAILED',
+              'STOPPING',
+              'STOPPED',
+              'DEGRADED',
+              'DATA_DUMP',
+              'ACKNOWLEDGED',
+              'UNKNOWN',
+            ],
+          },
+          timestamp: { type: 'string' },
+          message: { type: 'string' },
+          payload: { type: 'object', additionalProperties: true },
+          agent_id: { type: 'string' },
+          action_id: { type: 'string' },
+          policy_id: { type: 'string' },
+          stream_id: { type: 'string' },
+        },
+        required: ['type', 'subtype', 'timestamp', 'message', 'agent_id', 'action_id'],
+        additionalProperties: false,
+      },
+    },
+  },
+  additionalProperties: false,
+  required: ['events'],
 };
 
 export const PostNewAgentActionRequestSchema = {
diff --git a/x-pack/plugins/ingest_manager/server/types/rest_spec/settings.ts b/x-pack/plugins/ingest_manager/server/types/rest_spec/settings.ts
index baee9f79d9317d..35718491c92247 100644
--- a/x-pack/plugins/ingest_manager/server/types/rest_spec/settings.ts
+++ b/x-pack/plugins/ingest_manager/server/types/rest_spec/settings.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { schema } from '@kbn/config-schema';
+import { isDiffPathProtocol } from '../../../common';
 
 export const GetSettingsRequestSchema = {};
 
@@ -11,7 +12,15 @@ export const PutSettingsRequestSchema = {
   body: schema.object({
     agent_auto_upgrade: schema.maybe(schema.boolean()),
     package_auto_upgrade: schema.maybe(schema.boolean()),
-    kibana_url: schema.maybe(schema.uri({ scheme: ['http', 'https'] })),
+    kibana_urls: schema.maybe(
+      schema.arrayOf(schema.uri({ scheme: ['http', 'https'] }), {
+        validate: (value) => {
+          if (isDiffPathProtocol(value)) {
+            return 'Protocol and path must be the same for each URL';
+          }
+        },
+      })
+    ),
     kibana_ca_sha256: schema.maybe(schema.string()),
     has_seen_add_data_notice: schema.maybe(schema.boolean()),
   }),
diff --git a/x-pack/plugins/ingest_pipelines/__jest__/client_integration/ingest_pipelines_list.test.ts b/x-pack/plugins/ingest_pipelines/__jest__/client_integration/ingest_pipelines_list.test.ts
index 8d6a83a625651a..c0acc39ca35a1c 100644
--- a/x-pack/plugins/ingest_pipelines/__jest__/client_integration/ingest_pipelines_list.test.ts
+++ b/x-pack/plugins/ingest_pipelines/__jest__/client_integration/ingest_pipelines_list.test.ts
@@ -13,11 +13,6 @@ import { PipelineListTestBed } from './helpers/pipelines_list.helpers';
 
 const { setup } = pageHelpers.pipelinesList;
 
-jest.mock('ui/i18n', () => {
-  const I18nContext = ({ children }: any) => children;
-  return { I18nContext };
-});
-
 describe('<PipelinesList />', () => {
   const { server, httpRequestsMockHelpers } = setupEnvironment();
   let testBed: PipelineListTestBed;
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/load_from_json/modal_provider.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/load_from_json/modal_provider.tsx
index f183386d5927de..9e777de0e2edf4 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/load_from_json/modal_provider.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/load_from_json/modal_provider.tsx
@@ -5,7 +5,7 @@
  */
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import React, { FunctionComponent, useRef, useState } from 'react';
+import React, { FunctionComponent, useRef, useState, useCallback } from 'react';
 import { EuiConfirmModal, EuiOverlayMask, EuiSpacer, EuiText, EuiCallOut } from '@elastic/eui';
 
 import { JsonEditor, OnJsonEditorUpdateHandler } from '../../../../../shared_imports';
@@ -66,10 +66,12 @@ export const ModalProvider: FunctionComponent<Props> = ({ onDone, children }) =>
       raw: defaultValueRaw,
     },
   });
-  const onJsonUpdate: OnJsonEditorUpdateHandler = (jsonUpdateData) => {
+
+  const onJsonUpdate: OnJsonEditorUpdateHandler = useCallback((jsonUpdateData) => {
     setIsValidJson(jsonUpdateData.validate());
     jsonContent.current = jsonUpdateData;
-  };
+  }, []);
+
   return (
     <>
       {children(() => setIsModalVisible(true))}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/field_components/xjson_editor.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/field_components/xjson_editor.tsx
index 7fb92e89c9f685..e00f9c002e5bc6 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/field_components/xjson_editor.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/field_components/xjson_editor.tsx
@@ -14,6 +14,11 @@ interface Props {
   editorProps: { [key: string]: any };
 }
 
+const defaultEditorOptions = {
+  minimap: { enabled: false },
+  lineNumbers: 'off',
+};
+
 export const XJsonEditor: FunctionComponent<Props> = ({ field, editorProps }) => {
   const { value, setValue } = field;
   const { xJson, setXJson, convertToJson } = Monaco.useXJsonMode(value);
@@ -31,7 +36,7 @@ export const XJsonEditor: FunctionComponent<Props> = ({ field, editorProps }) =>
       editorProps={{
         value: xJson,
         languageId: XJsonLang.ID,
-        options: { minimap: { enabled: false } },
+        options: defaultEditorOptions,
         onChange,
         ...editorProps,
       }}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processor_settings_fields.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processor_settings_fields.tsx
index 9adb3957ea9f45..bda64c0a756126 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processor_settings_fields.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processor_settings_fields.tsx
@@ -33,10 +33,22 @@ export const ProcessorSettingsFields: FunctionComponent<Props> = ({ processor })
             const formDescriptor = getProcessorDescriptor(type as any);
 
             if (formDescriptor?.FieldsComponent) {
+              const renderedFields = (
+                <formDescriptor.FieldsComponent
+                  key={type}
+                  initialFieldValues={processor?.options}
+                />
+              );
               return (
                 <>
-                  <formDescriptor.FieldsComponent key={type} />
-                  <EuiHorizontalRule />
+                  {renderedFields ? (
+                    <>
+                      {renderedFields}
+                      <EuiHorizontalRule />
+                    </>
+                  ) : (
+                    renderedFields
+                  )}
                   <CommonProcessorFields />
                 </>
               );
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/append.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/append.tsx
index 23425297f34208..52750529684b0c 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/append.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/append.tsx
@@ -28,13 +28,13 @@ const fieldsConfig: FieldsConfig = {
       defaultMessage: 'Value',
     }),
     helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.appendForm.valueFieldHelpText', {
-      defaultMessage: 'The value to be appended by this processor.',
+      defaultMessage: 'Values to append.',
     }),
     validations: [
       {
         validator: emptyField(
           i18n.translate('xpack.ingestPipelines.pipelineEditor.appendForm.valueRequiredError', {
-            defaultMessage: 'A value to set is required.',
+            defaultMessage: 'A value is required.',
           })
         ),
       },
@@ -47,7 +47,7 @@ export const Append: FunctionComponent = () => {
     <>
       <FieldNameField
         helpText={i18n.translate('xpack.ingestPipelines.pipelineEditor.appendForm.fieldHelpText', {
-          defaultMessage: 'The field to be appended to.',
+          defaultMessage: 'Field to append values to.',
         })}
       />
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/bytes.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/bytes.tsx
index a76e1a6f3ce9a4..6633f9e5de94bc 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/bytes.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/bytes.tsx
@@ -17,7 +17,10 @@ export const Bytes: FunctionComponent = () => {
       <FieldNameField
         helpText={i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.bytesForm.fieldNameHelpText',
-          { defaultMessage: 'The field to convert.' }
+          {
+            defaultMessage:
+              'Field to convert. If the field contains an array, each array value is converted.',
+          }
         )}
       />
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/circle.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/circle.tsx
index 599d2fdbfd413d..70df18acfd0a9f 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/circle.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/circle.tsx
@@ -5,7 +5,9 @@
  */
 
 import React, { FunctionComponent } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
+import { EuiCode } from '@elastic/eui';
 
 import {
   FIELD_TYPES,
@@ -34,12 +36,15 @@ const fieldsConfig: FieldsConfig = {
         defaultMessage: 'Error distance',
       }
     ),
-    helpText: i18n.translate(
-      'xpack.ingestPipelines.pipelineEditor.circleForm.errorDistanceHelpText',
-      {
-        defaultMessage:
-          'The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for geo_shape, unit-less for shape).',
-      }
+    helpText: () => (
+      <FormattedMessage
+        id="xpack.ingestPipelines.pipelineEditor.circleForm.errorDistanceHelpText"
+        defaultMessage="Difference between the side of the inscribed shape to the encompassing circle. Determines the accuracy of the output polygon. Measured in meters for {geo_shape}, but uses no units for {shape}."
+        values={{
+          geo_shape: <EuiCode>{'geo_shape'}</EuiCode>,
+          shape: <EuiCode>{'shape'}</EuiCode>,
+        }}
+      />
     ),
     validations: [
       {
@@ -66,7 +71,7 @@ const fieldsConfig: FieldsConfig = {
     }),
     helpText: i18n.translate(
       'xpack.ingestPipelines.pipelineEditor.circleForm.shapeTypeFieldHelpText',
-      { defaultMessage: 'Which field mapping type is to be used.' }
+      { defaultMessage: 'Field mapping type to use when processing the output polygon.' }
     ),
     validations: [
       {
@@ -86,7 +91,7 @@ export const Circle: FunctionComponent = () => {
       <FieldNameField
         helpText={i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.circleForm.fieldNameHelpText',
-          { defaultMessage: 'The string-valued field to trim whitespace from.' }
+          { defaultMessage: 'Field to convert.' }
         )}
       />
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/common_processor_fields.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/common_processor_fields.tsx
index 8089b8e7dfad34..1777cac2a5615c 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/common_processor_fields.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/common_processor_fields.tsx
@@ -16,12 +16,12 @@ import {
 } from '../../../../../../../shared_imports';
 
 import { TextEditor } from '../../field_components';
-import { to, from } from '../shared';
+import { to, from, EDITOR_PX_HEIGHT } from '../shared';
 
 const ignoreFailureConfig: FieldConfig = {
   defaultValue: false,
   deserializer: to.booleanOrUndef,
-  serializer: from.defaultBoolToUndef(false),
+  serializer: from.undefinedIfValue(false),
   label: i18n.translate(
     'xpack.ingestPipelines.pipelineEditor.commonFields.ignoreFailureFieldLabel',
     {
@@ -40,7 +40,7 @@ const ifConfig: FieldConfig = {
     defaultMessage: 'Condition (optional)',
   }),
   helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.commonFields.ifFieldHelpText', {
-    defaultMessage: 'Conditionally execute this processor.',
+    defaultMessage: 'Conditionally run this processor.',
   }),
   type: FIELD_TYPES.TEXT,
 };
@@ -50,7 +50,7 @@ const tagConfig: FieldConfig = {
     defaultMessage: 'Tag (optional)',
   }),
   helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.commonFields.tagFieldHelpText', {
-    defaultMessage: 'An identifier for this processor. Useful for debugging and metrics.',
+    defaultMessage: 'Identifier for the processor. Useful for debugging and metrics.',
   }),
   type: FIELD_TYPES.TEXT,
 };
@@ -64,8 +64,11 @@ export const CommonProcessorFields: FunctionComponent = () => {
         componentProps={{
           editorProps: {
             languageId: 'painless',
-            height: 75,
-            options: { minimap: { enabled: false } },
+            height: EDITOR_PX_HEIGHT.extraSmall,
+            options: {
+              lineNumbers: 'off',
+              minimap: { enabled: false },
+            },
           },
         }}
         path="fields.if"
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/ignore_missing_field.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/ignore_missing_field.tsx
index 63ebb47dfc5734..3d38f9238cdd14 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/ignore_missing_field.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/ignore_missing_field.tsx
@@ -22,7 +22,7 @@ export const fieldsConfig: FieldsConfig = {
     type: FIELD_TYPES.TOGGLE,
     defaultValue: false,
     deserializer: to.booleanOrUndef,
-    serializer: from.defaultBoolToUndef(false),
+    serializer: from.undefinedIfValue(false),
     label: i18n.translate(
       'xpack.ingestPipelines.pipelineEditor.commonFields.ignoreMissingFieldLabel',
       {
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/processor_type_field.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/processor_type_field.tsx
index e4ad90f61af0a1..32649234428866 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/processor_type_field.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/processor_type_field.tsx
@@ -5,7 +5,7 @@
  */
 import { EuiComboBox, EuiComboBoxOptionOption, EuiFormRow } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import React, { FunctionComponent } from 'react';
+import React, { FunctionComponent, ReactNode } from 'react';
 import { flow } from 'fp-ts/lib/function';
 import { map } from 'fp-ts/lib/Array';
 
@@ -68,13 +68,18 @@ export const ProcessorTypeField: FunctionComponent<Props> = ({ initialType }) =>
     <UseField<string> config={typeConfig} defaultValue={initialType} path="type">
       {(typeField) => {
         let selectedOptions: ProcessorTypeAndLabel[];
+        let description: string | ReactNode = '';
+
         if (typeField.value?.length) {
           const type = typeField.value;
-          const descriptor = getProcessorDescriptor(type);
-          selectedOptions = descriptor
-            ? [{ label: descriptor.label, value: type }]
-            : // If there is no label for this processor type, just use the type as the label
-              [{ label: type, value: type }];
+          const processorDescriptor = getProcessorDescriptor(type);
+          if (processorDescriptor) {
+            description = processorDescriptor.description || '';
+            selectedOptions = [{ label: processorDescriptor.label, value: type }];
+          } else {
+            // If there is no label for this processor type, just use the type as the label
+            selectedOptions = [{ label: type, value: type }];
+          }
         } else {
           selectedOptions = [];
         }
@@ -102,9 +107,7 @@ export const ProcessorTypeField: FunctionComponent<Props> = ({ initialType }) =>
           <EuiFormRow
             label={typeField.label}
             labelAppend={typeField.labelAppend}
-            helpText={
-              typeof typeField.helpText === 'function' ? typeField.helpText() : typeField.helpText
-            }
+            helpText={typeof description === 'function' ? description() : description}
             error={error}
             isInvalid={isInvalid}
             fullWidth
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/target_field.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/target_field.tsx
index 9bf44425a7c5d1..69ce01777b6165 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/target_field.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/target_field.tsx
@@ -21,8 +21,7 @@ const fieldsConfig: FieldsConfig = {
     helpText: i18n.translate(
       'xpack.ingestPipelines.pipelineEditor.commonFields.targetFieldHelpText',
       {
-        defaultMessage:
-          'The field to assign the joined value to. If empty, the field is updated in-place.',
+        defaultMessage: 'Output field. If empty, the input field is updated in place.',
       }
     ),
   },
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/convert.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/convert.tsx
index 2bf642dd9b5187..7284bd6c627519 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/convert.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/convert.tsx
@@ -30,7 +30,7 @@ const fieldsConfig: FieldsConfig = {
       defaultMessage: 'Type',
     }),
     helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.convertForm.typeFieldHelpText', {
-      defaultMessage: 'The type to convert the existing value to.',
+      defaultMessage: 'Field data type for the output.',
     }),
     validations: [
       {
@@ -50,7 +50,7 @@ export const Convert: FunctionComponent = () => {
       <FieldNameField
         helpText={i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.convertForm.fieldNameHelpText',
-          { defaultMessage: 'The field whose value is to be converted.' }
+          { defaultMessage: 'Field to convert.' }
         )}
       />
 
@@ -115,14 +115,7 @@ export const Convert: FunctionComponent = () => {
         path="fields.type"
       />
 
-      <TargetField
-        helpText={i18n.translate(
-          'xpack.ingestPipelines.pipelineEditor.convertForm.targetFieldHelpText',
-          {
-            defaultMessage: 'The field to assign the converted value to.',
-          }
-        )}
-      />
+      <TargetField />
 
       <IgnoreMissingField />
     </>
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/csv.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/csv.tsx
index 835177dd861d56..471efaa56dea0f 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/csv.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/csv.tsx
@@ -36,7 +36,7 @@ const isStringLengthOne: ValidationFunc = ({ value }) => {
         message: i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.convertForm.separatorLengthError',
           {
-            defaultMessage: 'A separator value must be 1 character.',
+            defaultMessage: 'Must be a single character.',
           }
         ),
       }
@@ -52,7 +52,7 @@ const fieldsConfig: FieldsConfig = {
       defaultMessage: 'Target fields',
     }),
     helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.csvForm.targetFieldsHelpText', {
-      defaultMessage: 'The array of fields to assign extracted values to.',
+      defaultMessage: 'Output fields. Extracted values are mapped to these fields.',
     }),
     validations: [
       {
@@ -83,7 +83,7 @@ const fieldsConfig: FieldsConfig = {
     helpText: (
       <FormattedMessage
         id="xpack.ingestPipelines.pipelineEditor.convertForm.separatorHelpText"
-        defaultMessage="Separator used in CSV, has to be single character string. Default value is {value}."
+        defaultMessage="Delimiter used in the CSV data. Defaults to {value}."
         values={{ value: <EuiCode inline>{','}</EuiCode> }}
       />
     ),
@@ -102,7 +102,7 @@ const fieldsConfig: FieldsConfig = {
     helpText: (
       <FormattedMessage
         id="xpack.ingestPipelines.pipelineEditor.convertForm.quoteHelpText"
-        defaultMessage="Quote used in CSV, has to be single character string. Default value is {value}."
+        defaultMessage="Escape character used in the CSV data. Defaults to {value}."
         values={{ value: <EuiCode inline>{'"'}</EuiCode> }}
       />
     ),
@@ -115,7 +115,7 @@ const fieldsConfig: FieldsConfig = {
       defaultMessage: 'Trim',
     }),
     helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.csvForm.trimFieldHelpText', {
-      defaultMessage: 'Trim whitespaces in unquoted fields',
+      defaultMessage: 'Remove whitespaces in unquoted CSV data.',
     }),
   },
   empty_value: {
@@ -127,7 +127,7 @@ const fieldsConfig: FieldsConfig = {
       'xpack.ingestPipelines.pipelineEditor.convertForm.emptyValueFieldHelpText',
       {
         defaultMessage:
-          'Value used to fill empty fields, empty fields will be skipped if this is not provided.',
+          'Used to fill empty fields. If no value is provided, empty fields are skipped.',
       }
     ),
   },
@@ -138,7 +138,7 @@ export const CSV: FunctionComponent = () => {
     <>
       <FieldNameField
         helpText={i18n.translate('xpack.ingestPipelines.pipelineEditor.csvForm.fieldNameHelpText', {
-          defaultMessage: 'The field to extract data from.',
+          defaultMessage: 'Field containing CSV data.',
         })}
       />
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/custom.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/custom.tsx
index 82fdc81e0a843e..c2aab62cf8933f 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/custom.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/custom.tsx
@@ -17,6 +17,7 @@ import {
 const { emptyField, isJsonField } = fieldValidators;
 
 import { XJsonEditor } from '../field_components';
+import { EDITOR_PX_HEIGHT } from './shared';
 
 const customConfig: FieldConfig = {
   type: FIELD_TYPES.TEXT,
@@ -78,7 +79,7 @@ export const Custom: FunctionComponent<Props> = ({ defaultOptions }) => {
       componentProps={{
         editorProps: {
           'data-test-subj': 'processorOptionsEditor',
-          height: 300,
+          height: EDITOR_PX_HEIGHT.large,
           'aria-label': i18n.translate(
             'xpack.ingestPipelines.pipelineEditor.customForm.optionsFieldAriaLabel',
             {
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date.tsx
index 7e3f8e0d7cd701..8d6d88d2b06623 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date.tsx
@@ -33,7 +33,7 @@ const fieldsConfig: FieldsConfig = {
     }),
     helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.dateForm.formatsFieldHelpText', {
       defaultMessage:
-        'An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.',
+        'Expected date formats. Provided formats are applied sequentially. Accepts a Java time pattern, ISO8601, UNIX, UNIX_MS, or TAI64N formats.',
     }),
     validations: [
       {
@@ -59,7 +59,7 @@ const fieldsConfig: FieldsConfig = {
     helpText: (
       <FormattedMessage
         id="xpack.ingestPipelines.pipelineEditor.dateForm.timezoneHelpText"
-        defaultMessage="The timezone to use when parsing the date. Default value is {timezone}."
+        defaultMessage="Timezone for the date. Defaults to {timezone}."
         values={{ timezone: <EuiCode inline>{'UTC'}</EuiCode> }}
       />
     ),
@@ -73,7 +73,7 @@ const fieldsConfig: FieldsConfig = {
     helpText: (
       <FormattedMessage
         id="xpack.ingestPipelines.pipelineEditor.dateForm.localeHelpText"
-        defaultMessage="The locale to use when parsing the date, relevant when parsing month names or week days. Default value is {timezone}."
+        defaultMessage="Locale for the date. Useful when parsing month or day names. Defaults to {timezone}."
         values={{ timezone: <EuiCode inline>{'ENGLISH'}</EuiCode> }}
       />
     ),
@@ -89,7 +89,7 @@ export const DateProcessor: FunctionComponent = () => {
       <FieldNameField
         helpText={i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.dateForm.fieldNameHelpText',
-          { defaultMessage: 'The field to get the date from.' }
+          { defaultMessage: 'Field to convert.' }
         )}
       />
 
@@ -99,7 +99,7 @@ export const DateProcessor: FunctionComponent = () => {
         helpText={
           <FormattedMessage
             id="xpack.ingestPipelines.pipelineEditor.dateForm.targetFieldHelpText"
-            defaultMessage="The field that will hold the parsed date. Default field is {defaultField}."
+            defaultMessage="Output field. If empty, the input field is updated in place. Defaults to {defaultField}."
             values={{
               defaultField: <EuiCode inline>{'@timestamp'}</EuiCode>,
             }}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date_index_name.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date_index_name.tsx
index 8cbc064c1c90ce..73fa54429734f0 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date_index_name.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date_index_name.tsx
@@ -36,7 +36,8 @@ const fieldsConfig: FieldsConfig = {
     helpText: i18n.translate(
       'xpack.ingestPipelines.pipelineEditor.dateIndexNameForm.dateRoundingFieldHelpText',
       {
-        defaultMessage: 'How to round the date when formatting the date into the index name.',
+        defaultMessage:
+          'Time period used to round the date when formatting the date into the index name.',
       }
     ),
     validations: [
@@ -64,7 +65,7 @@ const fieldsConfig: FieldsConfig = {
     ),
     helpText: i18n.translate(
       'xpack.ingestPipelines.pipelineEditor.dateIndexNameForm.indexNamePrefixFieldHelpText',
-      { defaultMessage: 'A prefix of the index name to be prepended before the printed date.' }
+      { defaultMessage: 'Prefix to add before the printed date in the index name.' }
     ),
   },
   index_name_format: {
@@ -79,7 +80,7 @@ const fieldsConfig: FieldsConfig = {
     helpText: (
       <FormattedMessage
         id="xpack.ingestPipelines.pipelineEditor.dateIndexNameForm.indexNameFormatFieldHelpText"
-        defaultMessage="The format to be used when printing the parsed date into the index name. Default value is {value}."
+        defaultMessage="Date format used to print the parsed date into the index name. Defaults to {value}."
         values={{ value: <EuiCode inline>{'yyyy-MM-dd'}</EuiCode> }}
       />
     ),
@@ -99,7 +100,7 @@ const fieldsConfig: FieldsConfig = {
     helpText: (
       <FormattedMessage
         id="xpack.ingestPipelines.pipelineEditor.dateIndexNameForm.dateFormatsHelpText"
-        defaultMessage="An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N. Default value is {value}."
+        defaultMessage="Expected date formats. Provided formats are applied sequentially. Accepts a Java time pattern, ISO8601, UNIX, UNIX_MS, or TAI64N formats. Defaults to {value}."
         values={{ value: <EuiCode inline>{"yyyy-MM-dd'T'HH:mm:ss.SSSXX"}</EuiCode> }}
       />
     ),
@@ -116,7 +117,7 @@ const fieldsConfig: FieldsConfig = {
     helpText: (
       <FormattedMessage
         id="xpack.ingestPipelines.pipelineEditor.dateIndexNameForm.timezoneHelpText"
-        defaultMessage="The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names. Default value is {timezone}."
+        defaultMessage="Timezone used when parsing the date and constructing the index name expression. Defaults to {timezone}."
         values={{ timezone: <EuiCode inline>{'UTC'}</EuiCode> }}
       />
     ),
@@ -133,7 +134,7 @@ const fieldsConfig: FieldsConfig = {
     helpText: (
       <FormattedMessage
         id="xpack.ingestPipelines.pipelineEditor.dateIndexForm.localeHelpText"
-        defaultMessage="The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days. Default value is {locale}."
+        defaultMessage="Locale to use when parsing the date. Useful when parsing month or day names. Defaults to {locale}."
         values={{ locale: <EuiCode inline>{'ENGLISH'}</EuiCode> }}
       />
     ),
@@ -149,7 +150,7 @@ export const DateIndexName: FunctionComponent = () => {
       <FieldNameField
         helpText={i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.dateIndexNameForm.fieldNameHelpText',
-          { defaultMessage: 'The field to get the date or timestamp from.' }
+          { defaultMessage: 'Field containing the date or timestamp.' }
         )}
       />
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dissect.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dissect.tsx
index 5f9f55ced1a256..51bc54c5b372c6 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dissect.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dissect.tsx
@@ -5,7 +5,7 @@
  */
 
 import React, { FunctionComponent } from 'react';
-import { EuiCode } from '@elastic/eui';
+import { EuiCode, EuiLink } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { TextEditor } from '../field_components';
@@ -16,62 +16,88 @@ import {
   fieldValidators,
   UseField,
   Field,
+  useKibana,
 } from '../../../../../../shared_imports';
 
 import { FieldNameField } from './common_fields/field_name_field';
 import { IgnoreMissingField } from './common_fields/ignore_missing_field';
+import { EDITOR_PX_HEIGHT } from './shared';
 
 const { emptyField } = fieldValidators;
 
-const fieldsConfig: Record<string, FieldConfig> = {
-  /* Required field config */
-  pattern: {
-    type: FIELD_TYPES.TEXT,
-    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.dissectForm.patternFieldLabel', {
-      defaultMessage: 'Pattern',
-    }),
-    helpText: i18n.translate(
-      'xpack.ingestPipelines.pipelineEditor.dissectForm.patternFieldHelpText',
-      {
-        defaultMessage: 'The pattern to apply to the field.',
-      }
-    ),
-    validations: [
-      {
-        validator: emptyField(
-          i18n.translate('xpack.ingestPipelines.pipelineEditor.dissectForm.patternRequiredError', {
-            defaultMessage: 'A pattern value is required.',
-          })
-        ),
-      },
-    ],
-  },
-  /* Optional field config */
-  append_separator: {
-    type: FIELD_TYPES.TEXT,
-    label: i18n.translate(
-      'xpack.ingestPipelines.pipelineEditor.dissectForm.appendSeparatorparaotrFieldLabel',
-      {
-        defaultMessage: 'Append separator (optional)',
-      }
-    ),
-    helpText: (
-      <FormattedMessage
-        id="xpack.ingestPipelines.pipelineEditor.dissectForm.appendSeparatorHelpText"
-        defaultMessage="The character(s) that separate the appended fields. Default value is {value} (an empty string)."
-        values={{ value: <EuiCode inline>{'""'}</EuiCode> }}
-      />
-    ),
-  },
+const getFieldsConfig = (esDocUrl: string): Record<string, FieldConfig> => {
+  return {
+    /* Required field config */
+    pattern: {
+      type: FIELD_TYPES.TEXT,
+      label: i18n.translate('xpack.ingestPipelines.pipelineEditor.dissectForm.patternFieldLabel', {
+        defaultMessage: 'Pattern',
+      }),
+      helpText: (
+        <FormattedMessage
+          id="xpack.ingestPipelines.pipelineEditor.dissectForm.patternFieldHelpText"
+          defaultMessage="Pattern used to dissect the specified field. The pattern is defined by the parts of the string to discard. Use a {keyModifier} to alter the dissection behavior."
+          values={{
+            keyModifier: (
+              <EuiLink
+                target="_blank"
+                external
+                href={esDocUrl + '/dissect-processor.html#dissect-key-modifiers'}
+              >
+                {i18n.translate(
+                  'xpack.ingestPipelines.pipelineEditor.dissectForm.patternFieldHelpText.dissectProcessorLink',
+                  {
+                    defaultMessage: 'key modifier',
+                  }
+                )}
+              </EuiLink>
+            ),
+          }}
+        />
+      ),
+      validations: [
+        {
+          validator: emptyField(
+            i18n.translate(
+              'xpack.ingestPipelines.pipelineEditor.dissectForm.patternRequiredError',
+              {
+                defaultMessage: 'A pattern value is required.',
+              }
+            )
+          ),
+        },
+      ],
+    },
+    /* Optional field config */
+    append_separator: {
+      type: FIELD_TYPES.TEXT,
+      label: i18n.translate(
+        'xpack.ingestPipelines.pipelineEditor.dissectForm.appendSeparatorparaotrFieldLabel',
+        {
+          defaultMessage: 'Append separator (optional)',
+        }
+      ),
+      helpText: (
+        <FormattedMessage
+          id="xpack.ingestPipelines.pipelineEditor.dissectForm.appendSeparatorHelpText"
+          defaultMessage="If you specify a key modifier, this character separates the fields when appending results. Defaults to {value}."
+          values={{ value: <EuiCode inline>{'""'}</EuiCode> }}
+        />
+      ),
+    },
+  };
 };
 
 export const Dissect: FunctionComponent = () => {
+  const { services } = useKibana();
+  const fieldsConfig = getFieldsConfig(services.documentation.getEsDocsBasePath());
+
   return (
     <>
       <FieldNameField
         helpText={i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.dissectForm.fieldNameHelpText',
-          { defaultMessage: 'The field to dissect.' }
+          { defaultMessage: 'Field to dissect.' }
         )}
       />
 
@@ -80,7 +106,7 @@ export const Dissect: FunctionComponent = () => {
         component={TextEditor}
         componentProps={{
           editorProps: {
-            height: 75,
+            height: EDITOR_PX_HEIGHT.extraSmall,
             options: { minimap: { enabled: false } },
           },
         }}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dot_expander.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dot_expander.tsx
index 4e50c61ac930c3..4f2aa2915fdeca 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dot_expander.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dot_expander.tsx
@@ -18,7 +18,8 @@ const fieldsConfig: Record<string, FieldConfig> = {
       defaultMessage: 'Path',
     }),
     helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.dotExpanderForm.pathHelpText', {
-      defaultMessage: 'Only required if the field to expand is part another object field.',
+      defaultMessage:
+        'Output field. Only required if the field to expand is part another object field.',
     }),
   },
 };
@@ -29,7 +30,7 @@ export const DotExpander: FunctionComponent = () => {
       <FieldNameField
         helpText={i18n.translate(
           'xpack.ingestPipelines.pipelineEditor.dotExpanderForm.fieldNameHelpText',
-          { defaultMessage: 'The field to expand into an object field.' }
+          { defaultMessage: 'Field containing dot notation.' }
         )}
         additionalValidations={[
           {
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/enrich.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/enrich.tsx
index 5986374b338cfe..ba1c55b731cc97 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/enrich.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/enrich.tsx
@@ -81,7 +81,7 @@ const fieldsConfig: FieldsConfig = {
     type: FIELD_TYPES.TOGGLE,
     defaultValue: true,
     deserializer: to.booleanOrUndef,
-    serializer: from.defaultBoolToUndef,
+    serializer: from.undefinedIfValue,
     label: i18n.translate('xpack.ingestPipelines.pipelineEditor.enrichForm.overrideFieldLabel', {
       defaultMessage: 'Override',
     }),
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/foreach.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/foreach.tsx
index ce606af086893c..c32a85310d21f9 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/foreach.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/foreach.tsx
@@ -12,7 +12,7 @@ import { FIELD_TYPES, fieldValidators, UseField } from '../../../../../../shared
 import { XJsonEditor } from '../field_components';
 
 import { FieldNameField } from './common_fields/field_name_field';
-import { FieldsConfig, to } from './shared';
+import { FieldsConfig, to, EDITOR_PX_HEIGHT } from './shared';
 
 const { emptyField, isJsonField } = fieldValidators;
 
@@ -31,15 +31,18 @@ const fieldsConfig: FieldsConfig = {
     validations: [
       {
         validator: emptyField(
-          i18n.translate('xpack.ingestPipelines.pipelineEditor.failForm.processorRequiredError', {
-            defaultMessage: 'A processor is required.',
-          })
+          i18n.translate(
+            'xpack.ingestPipelines.pipelineEditor.foreachForm.processorRequiredError',
+            {
+              defaultMessage: 'A processor is required.',
+            }
+          )
         ),
       },
       {
         validator: isJsonField(
           i18n.translate(
-            'xpack.ingestPipelines.pipelineEditor.failForm.processorInvalidJsonError',
+            'xpack.ingestPipelines.pipelineEditor.foreachForm.processorInvalidJsonError',
             {
               defaultMessage: 'Invalid JSON',
             }
@@ -64,9 +67,9 @@ export const Foreach: FunctionComponent = () => {
         component={XJsonEditor}
         componentProps={{
           editorProps: {
-            height: 200,
+            height: EDITOR_PX_HEIGHT.medium,
             'aria-label': i18n.translate(
-              'xpack.ingestPipelines.pipelineEditor.customForm.optionsFieldAriaLabel',
+              'xpack.ingestPipelines.pipelineEditor.foreachForm.optionsFieldAriaLabel',
               {
                 defaultMessage: 'Configuration JSON editor',
               }
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/geoip.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/geoip.tsx
index 9bb1d679938edf..c0624c988061ce 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/geoip.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/geoip.tsx
@@ -61,7 +61,7 @@ const fieldsConfig: FieldsConfig = {
     type: FIELD_TYPES.TOGGLE,
     defaultValue: true,
     deserializer: to.booleanOrUndef,
-    serializer: from.defaultBoolToUndef(true),
+    serializer: from.undefinedIfValue(true),
     label: i18n.translate('xpack.ingestPipelines.pipelineEditor.geoIPForm.firstOnlyFieldLabel', {
       defaultMessage: 'First only',
     }),
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/grok.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/grok.tsx
index d021038fda94fb..c5c6adbe2a7a85 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/grok.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/grok.tsx
@@ -19,7 +19,7 @@ import { XJsonEditor } from '../field_components';
 
 import { FieldNameField } from './common_fields/field_name_field';
 import { IgnoreMissingField } from './common_fields/ignore_missing_field';
-import { FieldsConfig, to, from } from './shared';
+import { FieldsConfig, to, from, EDITOR_PX_HEIGHT } from './shared';
 
 const { emptyField, isJsonField } = fieldValidators;
 
@@ -80,7 +80,7 @@ const fieldsConfig: FieldsConfig = {
     type: FIELD_TYPES.TOGGLE,
     defaultValue: false,
     deserializer: to.booleanOrUndef,
-    serializer: from.defaultBoolToUndef(false),
+    serializer: from.undefinedIfValue(false),
     label: i18n.translate('xpack.ingestPipelines.pipelineEditor.grokForm.traceMatchFieldLabel', {
       defaultMessage: 'Trace match',
     }),
@@ -110,7 +110,7 @@ export const Grok: FunctionComponent = () => {
         config={fieldsConfig.pattern_definitions}
         componentProps={{
           editorProps: {
-            height: 200,
+            height: EDITOR_PX_HEIGHT.medium,
             'aria-label': i18n.translate(
               'xpack.ingestPipelines.pipelineEditor.grokForm.patternDefinitionsAriaLabel',
               {
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/gsub.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/gsub.tsx
index a0bda245d667b5..a42df6873d57b1 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/gsub.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/gsub.tsx
@@ -13,7 +13,7 @@ import { FIELD_TYPES, fieldValidators, UseField, Field } from '../../../../../..
 
 import { TextEditor } from '../field_components';
 
-import { FieldsConfig } from './shared';
+import { EDITOR_PX_HEIGHT, FieldsConfig } from './shared';
 import { FieldNameField } from './common_fields/field_name_field';
 import { IgnoreMissingField } from './common_fields/ignore_missing_field';
 import { TargetField } from './common_fields/target_field';
@@ -78,7 +78,7 @@ export const Gsub: FunctionComponent = () => {
         component={TextEditor}
         componentProps={{
           editorProps: {
-            height: 75,
+            height: EDITOR_PX_HEIGHT.extraSmall,
             options: { minimap: { enabled: false } },
           },
         }}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/index.ts
index 4974361bf04106..e83560b4a44ce5 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/index.ts
@@ -24,3 +24,15 @@ export { HtmlStrip } from './html_strip';
 export { Inference } from './inference';
 export { Join } from './join';
 export { Json } from './json';
+export { Kv } from './kv';
+export { Lowercase } from './lowercase';
+export { Pipeline } from './pipeline';
+export { Remove } from './remove';
+export { Rename } from './rename';
+export { Script } from './script';
+export { SetProcessor } from './set';
+export { SetSecurityUser } from './set_security_user';
+export { Split } from './split';
+export { Sort } from './sort';
+
+export { FormFieldsComponent } from './shared';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/inference.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/inference.tsx
index 68281fc11f3402..85f995fa77cea5 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/inference.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/inference.tsx
@@ -21,7 +21,7 @@ import { XJsonEditor } from '../field_components';
 
 import { TargetField } from './common_fields/target_field';
 
-import { FieldsConfig, to, from } from './shared';
+import { FieldsConfig, to, from, EDITOR_PX_HEIGHT } from './shared';
 
 const { emptyField, isJsonField } = fieldValidators;
 
@@ -177,7 +177,7 @@ export const Inference: FunctionComponent = () => {
         component={XJsonEditor}
         componentProps={{
           editorProps: {
-            height: 200,
+            height: EDITOR_PX_HEIGHT.medium,
             options: { minimap: { enabled: false } },
           },
         }}
@@ -192,7 +192,7 @@ export const Inference: FunctionComponent = () => {
         component={XJsonEditor}
         componentProps={{
           editorProps: {
-            height: 200,
+            height: EDITOR_PX_HEIGHT.medium,
             options: { minimap: { enabled: false } },
           },
         }}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/join.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/join.tsx
index c35a5b463f5732..ab077d3337f632 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/join.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/join.tsx
@@ -35,7 +35,7 @@ const fieldsConfig: FieldsConfig = {
       {
         validator: emptyField(
           i18n.translate('xpack.ingestPipelines.pipelineEditor.joinForm.separatorRequiredError', {
-            defaultMessage: 'A separator value is required.',
+            defaultMessage: 'A value is required.',
           })
         ),
       },
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/json.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/json.tsx
index 5c4c53b65b6dc2..b68b398325085f 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/json.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/json.tsx
@@ -29,7 +29,7 @@ const fieldsConfig: FieldsConfig = {
       defaultMessage: 'Add to root',
     }),
     deserializer: to.booleanOrUndef,
-    serializer: from.defaultBoolToUndef(false),
+    serializer: from.undefinedIfValue(false),
     helpText: i18n.translate(
       'xpack.ingestPipelines.pipelineEditor.jsonForm.addToRootFieldHelpText',
       {
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/kv.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/kv.tsx
new file mode 100644
index 00000000000000..f51bf19ad180a1
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/kv.tsx
@@ -0,0 +1,202 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiCode } from '@elastic/eui';
+
+import {
+  FIELD_TYPES,
+  fieldValidators,
+  UseField,
+  Field,
+  ComboBoxField,
+  ToggleField,
+} from '../../../../../../shared_imports';
+
+import { FieldsConfig, from, to } from './shared';
+import { FieldNameField } from './common_fields/field_name_field';
+import { TargetField } from './common_fields/target_field';
+import { IgnoreMissingField } from './common_fields/ignore_missing_field';
+
+const { emptyField } = fieldValidators;
+
+const fieldsConfig: FieldsConfig = {
+  /* Required fields config */
+  field_split: {
+    type: FIELD_TYPES.TEXT,
+    deserializer: String,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.fieldSplitFieldLabel', {
+      defaultMessage: 'Field split',
+    }),
+    helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.fieldSplitHelpText', {
+      defaultMessage: 'Regex pattern for splitting key-value pairs.',
+    }),
+    validations: [
+      {
+        validator: emptyField(
+          i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.fieldSplitRequiredError', {
+            defaultMessage: 'A value is required.',
+          })
+        ),
+      },
+    ],
+  },
+  value_split: {
+    type: FIELD_TYPES.TEXT,
+    deserializer: String,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.valueSplitFieldLabel', {
+      defaultMessage: 'Value split',
+    }),
+    helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.valueSplitHelpText', {
+      defaultMessage: 'Regex pattern for splitting the key from the value within a key-value pair.',
+    }),
+    validations: [
+      {
+        validator: emptyField(
+          i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.valueSplitRequiredError', {
+            defaultMessage: 'A value is required.',
+          })
+        ),
+      },
+    ],
+  },
+
+  /* Optional fields config */
+  include_keys: {
+    type: FIELD_TYPES.COMBO_BOX,
+    deserializer: to.arrayOfStrings,
+    serializer: from.optionalArrayOfStrings,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.includeKeysFieldLabel', {
+      defaultMessage: 'Include keys',
+    }),
+    helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.includeKeysHelpText', {
+      defaultMessage:
+        'List of keys to filter and insert into document. Defaults to including all keys.',
+    }),
+  },
+
+  exclude_keys: {
+    type: FIELD_TYPES.COMBO_BOX,
+    deserializer: to.arrayOfStrings,
+    serializer: from.optionalArrayOfStrings,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.excludeKeysFieldLabel', {
+      defaultMessage: 'Exclude keys',
+    }),
+    helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.excludeKeysHelpText', {
+      defaultMessage: 'List of keys to exclude from document.',
+    }),
+  },
+
+  prefix: {
+    type: FIELD_TYPES.TEXT,
+    deserializer: String,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.prefixFieldLabel', {
+      defaultMessage: 'Prefix',
+    }),
+    helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.prefixHelpText', {
+      defaultMessage: 'Prefix to be added to extracted keys.',
+    }),
+  },
+
+  trim_key: {
+    type: FIELD_TYPES.TEXT,
+    deserializer: String,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.trimKeyFieldLabel', {
+      defaultMessage: 'Trim key',
+    }),
+    helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.trimKeyHelpText', {
+      defaultMessage: 'Characters to trim from extracted keys.',
+    }),
+  },
+
+  trim_value: {
+    type: FIELD_TYPES.TEXT,
+    deserializer: String,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.trimValueFieldLabel', {
+      defaultMessage: 'Trim value',
+    }),
+    helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.trimValueHelpText', {
+      defaultMessage: 'Characters to trim from extracted values.',
+    }),
+  },
+
+  strip_brackets: {
+    type: FIELD_TYPES.TOGGLE,
+    defaultValue: false,
+    deserializer: to.booleanOrUndef,
+    serializer: from.undefinedIfValue(false),
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.stripBracketsFieldLabel', {
+      defaultMessage: 'Strip brackets',
+    }),
+    helpText: (
+      <FormattedMessage
+        id="xpack.ingestPipelines.pipelineEditor.kvForm.stripBracketsHelpText"
+        defaultMessage="If true, strip brackets {paren}, {angle}, {square} as well as quotes {singleQuote} and {doubleQuote} from extracted values."
+        values={{
+          paren: <EuiCode>{'()'}</EuiCode>,
+          angle: <EuiCode>&lt;&gt;</EuiCode>,
+          square: <EuiCode>{'[]'}</EuiCode>,
+          singleQuote: <EuiCode>{"'"}</EuiCode>,
+          doubleQuote: <EuiCode>{'"'}</EuiCode>,
+        }}
+      />
+    ),
+  },
+};
+
+export const Kv: FunctionComponent = () => {
+  return (
+    <>
+      <FieldNameField
+        helpText={i18n.translate('xpack.ingestPipelines.pipelineEditor.kvForm.fieldNameHelpText', {
+          defaultMessage: 'Field to be parsed.',
+        })}
+      />
+
+      <UseField component={Field} config={fieldsConfig.field_split} path="fields.field_split" />
+
+      <UseField component={Field} config={fieldsConfig.value_split} path="fields.value_split" />
+
+      <TargetField
+        helpText={i18n.translate(
+          'xpack.ingestPipelines.pipelineEditor.kvForm.targetFieldHelpText',
+          {
+            defaultMessage:
+              'Field to insert the extracted keys into. Defaults to the root of the document.',
+          }
+        )}
+      />
+
+      <UseField
+        component={ComboBoxField}
+        config={fieldsConfig.include_keys}
+        path="fields.include_keys"
+      />
+
+      <UseField
+        component={ComboBoxField}
+        config={fieldsConfig.exclude_keys}
+        path="fields.exclude_keys"
+      />
+
+      <IgnoreMissingField />
+
+      <UseField component={Field} config={fieldsConfig.prefix} path="fields.prefix" />
+
+      <UseField component={Field} config={fieldsConfig.trim_key} path="fields.trim_key" />
+
+      <UseField component={Field} config={fieldsConfig.trim_value} path="fields.trim_value" />
+
+      <UseField
+        component={ToggleField}
+        config={fieldsConfig.strip_brackets}
+        path="fields.strip_brackets"
+      />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/lowercase.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/lowercase.tsx
new file mode 100644
index 00000000000000..9db313a05007f2
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/lowercase.tsx
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiCode } from '@elastic/eui';
+
+import { FieldNameField } from './common_fields/field_name_field';
+import { TargetField } from './common_fields/target_field';
+import { IgnoreMissingField } from './common_fields/ignore_missing_field';
+
+export const Lowercase: FunctionComponent = () => {
+  return (
+    <>
+      <FieldNameField
+        helpText={i18n.translate(
+          'xpack.ingestPipelines.pipelineEditor.lowerCaseForm.fieldNameHelpText',
+          { defaultMessage: 'Field to lowercase.' }
+        )}
+      />
+
+      <TargetField
+        helpText={
+          <FormattedMessage
+            id="xpack.ingestPipelines.pipelineEditor.lowerCaseForm.targetFieldHelpText"
+            defaultMessage="Field to assign the converted value to. Defaults to {field}."
+            values={{
+              field: <EuiCode>{'field'}</EuiCode>,
+            }}
+          />
+        }
+      />
+
+      <IgnoreMissingField />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/pipeline.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/pipeline.tsx
new file mode 100644
index 00000000000000..c785cf935833d2
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/pipeline.tsx
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+
+import { FIELD_TYPES, fieldValidators, UseField, Field } from '../../../../../../shared_imports';
+
+import { FieldsConfig } from './shared';
+
+const { emptyField } = fieldValidators;
+
+const fieldsConfig: FieldsConfig = {
+  /* Required fields config */
+  name: {
+    type: FIELD_TYPES.TEXT,
+    label: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.pipelineForm.pipelineNameFieldLabel',
+      {
+        defaultMessage: 'Pipeline name',
+      }
+    ),
+    deserializer: String,
+    helpText: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.pipelineForm.pipelineNameFieldHelpText',
+      {
+        defaultMessage: 'Name of the pipeline to execute.',
+      }
+    ),
+    validations: [
+      {
+        validator: emptyField(
+          i18n.translate(
+            'xpack.ingestPipelines.pipelineEditor.pipelineForm.pipelineNameRequiredError',
+            {
+              defaultMessage: 'A value is required.',
+            }
+          )
+        ),
+      },
+    ],
+  },
+};
+
+export const Pipeline: FunctionComponent = () => {
+  return <UseField config={fieldsConfig.name} component={Field} path="fields.name" />;
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/remove.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/remove.tsx
new file mode 100644
index 00000000000000..3e90ce2b76f7b2
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/remove.tsx
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+
+import {
+  FIELD_TYPES,
+  UseField,
+  ComboBoxField,
+  fieldValidators,
+} from '../../../../../../shared_imports';
+
+import { FieldsConfig, to } from './shared';
+
+import { IgnoreMissingField } from './common_fields/ignore_missing_field';
+
+const { emptyField } = fieldValidators;
+
+const fieldsConfig: FieldsConfig = {
+  field: {
+    type: FIELD_TYPES.COMBO_BOX,
+    deserializer: to.arrayOfStrings,
+    serializer: (v: string[]) => (v.length === 1 ? v[0] : v),
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.removeForm.fieldNameField', {
+      defaultMessage: 'Fields',
+    }),
+    helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.removeForm.fieldNameHelpText', {
+      defaultMessage: 'Fields to be removed.',
+    }),
+    validations: [
+      {
+        validator: emptyField(
+          i18n.translate('xpack.ingestPipelines.pipelineEditor.removeForm.fieldNameRequiredError', {
+            defaultMessage: 'A value is required.',
+          })
+        ),
+      },
+    ],
+  },
+};
+
+export const Remove: FunctionComponent = () => {
+  return (
+    <>
+      <UseField config={fieldsConfig.field} component={ComboBoxField} path="fields.field" />
+
+      <IgnoreMissingField />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/rename.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/rename.tsx
new file mode 100644
index 00000000000000..8b796d9664586f
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/rename.tsx
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+
+import { fieldValidators } from '../../../../../../shared_imports';
+
+import { FieldNameField } from './common_fields/field_name_field';
+import { TargetField } from './common_fields/target_field';
+import { IgnoreMissingField } from './common_fields/ignore_missing_field';
+
+const { emptyField } = fieldValidators;
+
+export const Rename: FunctionComponent = () => {
+  return (
+    <>
+      <FieldNameField
+        helpText={i18n.translate(
+          'xpack.ingestPipelines.pipelineEditor.renameForm.fieldNameHelpText',
+          { defaultMessage: 'Field to be renamed.' }
+        )}
+      />
+
+      <TargetField
+        label={i18n.translate('xpack.ingestPipelines.pipelineEditor.renameForm.targetFieldLabel', {
+          defaultMessage: 'Target field',
+        })}
+        helpText={i18n.translate(
+          'xpack.ingestPipelines.pipelineEditor.renameForm.targetFieldHelpText',
+          { defaultMessage: 'Name of the new field.' }
+        )}
+        validations={[
+          {
+            validator: emptyField(
+              i18n.translate(
+                'xpack.ingestPipelines.pipelineEditor.renameForm.targetFieldRequiredError',
+                { defaultMessage: 'A value is required.' }
+              )
+            ),
+          },
+        ]}
+      />
+
+      <IgnoreMissingField />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/script.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/script.tsx
new file mode 100644
index 00000000000000..ae0bbbb490ae98
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/script.tsx
@@ -0,0 +1,186 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiCode, EuiSwitch, EuiFormRow } from '@elastic/eui';
+
+import { FIELD_TYPES, fieldValidators, UseField, Field } from '../../../../../../shared_imports';
+
+import { XJsonEditor, TextEditor } from '../field_components';
+
+import { FieldsConfig, to, from, FormFieldsComponent, EDITOR_PX_HEIGHT } from './shared';
+
+const { isJsonField, emptyField } = fieldValidators;
+
+const fieldsConfig: FieldsConfig = {
+  /* Required fields config */
+
+  id: {
+    type: FIELD_TYPES.TEXT,
+    deserializer: String,
+    label: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.scriptForm.storedScriptIDFieldLabel',
+      {
+        defaultMessage: 'Stored script ID',
+      }
+    ),
+    helpText: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.scriptForm.storedScriptIDFieldHelpText',
+      {
+        defaultMessage: 'Stored script reference.',
+      }
+    ),
+    validations: [
+      {
+        validator: emptyField(
+          i18n.translate('xpack.ingestPipelines.pipelineEditor.scriptForm.idRequiredError', {
+            defaultMessage: 'A value is required.',
+          })
+        ),
+      },
+    ],
+  },
+
+  source: {
+    type: FIELD_TYPES.TEXT,
+    deserializer: String,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.scriptForm.sourceFieldLabel', {
+      defaultMessage: 'Source',
+    }),
+    helpText: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.scriptForm.sourceFieldHelpText',
+      {
+        defaultMessage: 'Script to be executed.',
+      }
+    ),
+    validations: [
+      {
+        validator: emptyField(
+          i18n.translate('xpack.ingestPipelines.pipelineEditor.scriptForm.sourceRequiredError', {
+            defaultMessage: 'A value is required.',
+          })
+        ),
+      },
+    ],
+  },
+
+  /* Optional fields config */
+  lang: {
+    type: FIELD_TYPES.TEXT,
+    deserializer: String,
+    serializer: from.undefinedIfValue('painless'),
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.scriptForm.langFieldLabel', {
+      defaultMessage: 'Language (optional)',
+    }),
+    helpText: (
+      <FormattedMessage
+        id="xpack.ingestPipelines.pipelineEditor.scriptForm.langFieldHelpText"
+        defaultMessage="Script language. Defaults to {lang}."
+        values={{
+          lang: <EuiCode>{'painless'}</EuiCode>,
+        }}
+      />
+    ),
+  },
+
+  params: {
+    type: FIELD_TYPES.TEXT,
+    deserializer: to.jsonString,
+    serializer: from.optionalJson,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.scriptForm.paramsFieldLabel', {
+      defaultMessage: 'Parameters',
+    }),
+    helpText: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.scriptForm.paramsFieldHelpText',
+      {
+        defaultMessage: 'Script parameters.',
+      }
+    ),
+    validations: [
+      {
+        validator: (value) => {
+          if (value.value) {
+            return isJsonField(
+              i18n.translate(
+                'xpack.ingestPipelines.pipelineEditor.scriptForm.processorInvalidJsonError',
+                {
+                  defaultMessage: 'Invalid JSON',
+                }
+              )
+            )(value);
+          }
+        },
+      },
+    ],
+  },
+};
+
+export const Script: FormFieldsComponent = ({ initialFieldValues }) => {
+  const [showId, setShowId] = useState(() => !!initialFieldValues?.id);
+  return (
+    <>
+      <EuiFormRow>
+        <EuiSwitch
+          label={i18n.translate(
+            'xpack.ingestPipelines.pipelineEditor.scriptForm.useScriptIdToggleLabel',
+            { defaultMessage: 'Use stored script' }
+          )}
+          checked={showId}
+          onChange={() => setShowId((v) => !v)}
+        />
+      </EuiFormRow>
+
+      {showId ? (
+        <UseField key="fields.id" path="fields.id" component={Field} config={fieldsConfig.id} />
+      ) : (
+        <>
+          <UseField component={Field} config={fieldsConfig.lang} path="fields.lang" />
+
+          <UseField
+            key="fields.source"
+            path="fields.source"
+            component={TextEditor}
+            componentProps={{
+              editorProps: {
+                height: EDITOR_PX_HEIGHT.medium,
+                'aria-label': i18n.translate(
+                  'xpack.ingestPipelines.pipelineEditor.scriptForm.sourceFieldAriaLabel',
+                  {
+                    defaultMessage: 'Source script JSON editor',
+                  }
+                ),
+                options: {
+                  minimap: { enabled: false },
+                  lineNumbers: 'off',
+                },
+              },
+            }}
+            config={fieldsConfig.source}
+          />
+        </>
+      )}
+
+      <UseField
+        component={XJsonEditor}
+        componentProps={{
+          editorProps: {
+            height: EDITOR_PX_HEIGHT.medium,
+            'aria-label': i18n.translate(
+              'xpack.ingestPipelines.pipelineEditor.scriptForm.paramsFieldAriaLabel',
+              {
+                defaultMessage: 'Parameters JSON editor',
+              }
+            ),
+          },
+        }}
+        config={fieldsConfig.params}
+        path="fields.params"
+      />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/set.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/set.tsx
index 88cea620ae804e..c282be35e5071f 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/set.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/set.tsx
@@ -6,9 +6,10 @@
 
 import React, { FunctionComponent } from 'react';
 import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiCode } from '@elastic/eui';
 
 import {
-  FieldConfig,
   FIELD_TYPES,
   fieldValidators,
   ToggleField,
@@ -16,46 +17,68 @@ import {
   Field,
 } from '../../../../../../shared_imports';
 
-const { emptyField } = fieldValidators;
+import { FieldsConfig, to, from } from './shared';
 
-const fieldConfig: FieldConfig = {
-  type: FIELD_TYPES.TEXT,
-  label: i18n.translate('xpack.ingestPipelines.pipelineEditor.setForm.fieldFieldLabel', {
-    defaultMessage: 'Field',
-  }),
-  validations: [
-    {
-      validator: emptyField(
-        i18n.translate('xpack.ingestPipelines.pipelineEditor.setForm.fieldRequiredError', {
-          defaultMessage: 'A field value is required.',
-        })
-      ),
-    },
-  ],
-};
+import { FieldNameField } from './common_fields/field_name_field';
 
-const valueConfig: FieldConfig = {
-  type: FIELD_TYPES.TEXT,
-  label: i18n.translate('xpack.ingestPipelines.pipelineEditor.setForm.valueFieldLabel', {
-    defaultMessage: 'Value',
-  }),
-  validations: [
-    {
-      validator: emptyField(
-        i18n.translate('xpack.ingestPipelines.pipelineEditor.setForm.valueRequiredError', {
-          defaultMessage: 'A value to set is required.',
-        })
-      ),
-    },
-  ],
-};
+const { emptyField } = fieldValidators;
 
-const overrideConfig: FieldConfig = {
-  defaultValue: false,
-  label: i18n.translate('xpack.ingestPipelines.pipelineEditor.setForm.overrideFieldLabel', {
-    defaultMessage: 'Override',
-  }),
-  type: FIELD_TYPES.TOGGLE,
+const fieldsConfig: FieldsConfig = {
+  /* Required fields config */
+  value: {
+    type: FIELD_TYPES.TEXT,
+    deserializer: String,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.setForm.valueFieldLabel', {
+      defaultMessage: 'Value',
+    }),
+    helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.setForm.valueFieldHelpText', {
+      defaultMessage: 'Value to be set for the field',
+    }),
+    validations: [
+      {
+        validator: emptyField(
+          i18n.translate('xpack.ingestPipelines.pipelineEditor.setForm.valueRequiredError', {
+            defaultMessage: 'A value is required',
+          })
+        ),
+      },
+    ],
+  },
+  /* Optional fields config */
+  override: {
+    type: FIELD_TYPES.TOGGLE,
+    defaultValue: true,
+    deserializer: to.booleanOrUndef,
+    serializer: from.undefinedIfValue(true),
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.setForm.overrideFieldLabel', {
+      defaultMessage: 'Override',
+    }),
+    helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.setForm.overrideFieldHelpText', {
+      defaultMessage: 'If disabled, fields containing non-null values will not be updated.',
+    }),
+  },
+  ignore_empty_value: {
+    type: FIELD_TYPES.TOGGLE,
+    defaultValue: false,
+    deserializer: to.booleanOrUndef,
+    serializer: from.undefinedIfValue(false),
+    label: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.setForm.ignoreEmptyValueFieldLabel',
+      {
+        defaultMessage: 'Ignore empty value',
+      }
+    ),
+    helpText: (
+      <FormattedMessage
+        id="xpack.ingestPipelines.pipelineEditor.setForm.ignoreEmptyValueFieldHelpText"
+        defaultMessage="If enabled and {valueField} is a template snippet that evaluates to {nullValue} or an empty string, quietly exit without modifying the document."
+        values={{
+          valueField: <EuiCode>{'value'}</EuiCode>,
+          nullValue: <EuiCode>{'null'}</EuiCode>,
+        }}
+      />
+    ),
+  },
 };
 
 /**
@@ -64,11 +87,21 @@ const overrideConfig: FieldConfig = {
 export const SetProcessor: FunctionComponent = () => {
   return (
     <>
-      <UseField config={fieldConfig} component={Field} path="fields.field" />
+      <FieldNameField
+        helpText={i18n.translate('xpack.ingestPipelines.pipelineEditor.setForm.fieldNameField', {
+          defaultMessage: 'Field to insert or update',
+        })}
+      />
+
+      <UseField config={fieldsConfig.value} component={Field} path="fields.value" />
 
-      <UseField config={valueConfig} component={Field} path="fields.value" />
+      <UseField config={fieldsConfig.override} component={ToggleField} path="fields.override" />
 
-      <UseField config={overrideConfig} component={ToggleField} path="fields.override" />
+      <UseField
+        config={fieldsConfig.ignore_empty_value}
+        component={ToggleField}
+        path="fields.ignore_empty_value"
+      />
     </>
   );
 };
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/set_security_user.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/set_security_user.tsx
new file mode 100644
index 00000000000000..78128b3d54c75f
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/set_security_user.tsx
@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiCode } from '@elastic/eui';
+
+import { FIELD_TYPES, UseField, ComboBoxField } from '../../../../../../shared_imports';
+
+import { FieldsConfig, to, from } from './shared';
+
+import { FieldNameField } from './common_fields/field_name_field';
+
+const userProperties: string[] = [
+  'username',
+  'roles',
+  'email',
+  'full_name',
+  'metadata',
+  'api_key',
+  'realm',
+  'authentication_type',
+];
+
+const comboBoxOptions = userProperties.map((prop) => ({ label: prop }));
+const helpTextValues = userProperties.join(', ');
+
+const fieldsConfig: FieldsConfig = {
+  /* Optional fields config */
+  properties: {
+    type: FIELD_TYPES.COMBO_BOX,
+    deserializer: to.arrayOfStrings,
+    serializer: from.optionalArrayOfStrings,
+    label: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.setSecurityUserForm.propertiesFieldLabel',
+      {
+        defaultMessage: 'Properties (optional)',
+      }
+    ),
+    helpText: (
+      <FormattedMessage
+        id="xpack.ingestPipelines.pipelineEditor.setForm.propertiesFieldHelpText"
+        defaultMessage="User properties to add. Defaults to {value}."
+        values={{
+          value: <EuiCode>[{helpTextValues}]</EuiCode>,
+        }}
+      />
+    ),
+  },
+};
+
+export const SetSecurityUser: FunctionComponent = () => {
+  return (
+    <>
+      <FieldNameField
+        helpText={i18n.translate(
+          'xpack.ingestPipelines.pipelineEditor.setSecurityUserForm.fieldNameField',
+          {
+            defaultMessage: 'Field to store the user information',
+          }
+        )}
+      />
+
+      <UseField
+        config={fieldsConfig.properties}
+        component={ComboBoxField}
+        componentProps={{
+          euiFieldProps: {
+            options: comboBoxOptions,
+            noSuggestions: false,
+          },
+        }}
+        path="fields.properties"
+      />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/shared.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/shared.ts
index 84b308dd9cd7ab..e45469e23e8a09 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/shared.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/shared.ts
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
+import { FunctionComponent } from 'react';
 import * as rt from 'io-ts';
 import { isRight } from 'fp-ts/lib/Either';
 
@@ -31,7 +31,8 @@ export function isArrayOfStrings(v: unknown): v is string[] {
  */
 export const to = {
   booleanOrUndef: (v: unknown): boolean | undefined => (typeof v === 'boolean' ? v : undefined),
-  arrayOfStrings: (v: unknown): string[] => (isArrayOfStrings(v) ? v : []),
+  arrayOfStrings: (v: unknown): string[] =>
+    isArrayOfStrings(v) ? v : typeof v === 'string' && v.length ? [v] : [],
   jsonString: (v: unknown) => (v ? JSON.stringify(v, null, 2) : '{}'),
 };
 
@@ -62,7 +63,17 @@ export const from = {
       }
     }
   },
-  defaultBoolToUndef: (defaultBool: boolean) => (v: boolean) => (v === defaultBool ? undefined : v),
+  optionalArrayOfStrings: (v: string[]) => (v.length ? v : undefined),
+  undefinedIfValue: (value: any) => (v: boolean) => (v === value ? undefined : v),
+};
+
+export const EDITOR_PX_HEIGHT = {
+  extraSmall: 75,
+  small: 100,
+  medium: 200,
+  large: 300,
 };
 
 export type FieldsConfig = Record<string, FieldConfig>;
+
+export type FormFieldsComponent = FunctionComponent<{ initialFieldValues?: Record<string, any> }>;
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/sort.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/sort.tsx
new file mode 100644
index 00000000000000..cdd0ff888accff
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/sort.tsx
@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+
+import { FIELD_TYPES, UseField, SelectField } from '../../../../../../shared_imports';
+
+import { FieldNameField } from './common_fields/field_name_field';
+import { TargetField } from './common_fields/target_field';
+import { FieldsConfig, from } from './shared';
+
+const fieldsConfig: FieldsConfig = {
+  /* Optional fields config */
+  order: {
+    type: FIELD_TYPES.SELECT,
+    defaultValue: 'asc',
+    deserializer: (v) => (v === 'asc' || v === 'desc' ? v : 'asc'),
+    serializer: from.undefinedIfValue('asc'),
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.sortForm.orderFieldLabel', {
+      defaultMessage: 'Order',
+    }),
+    helpText: i18n.translate('xpack.ingestPipelines.pipelineEditor.sortForm.orderFieldHelpText', {
+      defaultMessage: 'Sort order to use',
+    }),
+  },
+};
+
+export const Sort: FunctionComponent = () => {
+  return (
+    <>
+      <FieldNameField
+        helpText={i18n.translate(
+          'xpack.ingestPipelines.pipelineEditor.sortForm.fieldNameHelpText',
+          { defaultMessage: 'Field to sort' }
+        )}
+      />
+
+      <UseField
+        config={fieldsConfig.order}
+        component={SelectField}
+        componentProps={{
+          euiFieldProps: {
+            options: [
+              {
+                value: 'asc',
+                text: i18n.translate(
+                  'xpack.ingestPipelines.pipelineEditor.sortForm.orderField.ascendingOption',
+                  { defaultMessage: 'Ascending' }
+                ),
+              },
+              {
+                value: 'desc',
+                text: i18n.translate(
+                  'xpack.ingestPipelines.pipelineEditor.sortForm.orderField.descendingOption',
+                  { defaultMessage: 'Descending' }
+                ),
+              },
+            ],
+          },
+        }}
+        path="fields.order"
+      />
+
+      <TargetField />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/split.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/split.tsx
new file mode 100644
index 00000000000000..b48ce74110b397
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/split.tsx
@@ -0,0 +1,91 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+
+import {
+  FIELD_TYPES,
+  fieldValidators,
+  UseField,
+  Field,
+  ToggleField,
+} from '../../../../../../shared_imports';
+
+import { FieldNameField } from './common_fields/field_name_field';
+import { TargetField } from './common_fields/target_field';
+import { IgnoreMissingField } from './common_fields/ignore_missing_field';
+import { FieldsConfig, to, from } from './shared';
+
+const { emptyField } = fieldValidators;
+
+const fieldsConfig: FieldsConfig = {
+  /* Required fields config */
+  separator: {
+    type: FIELD_TYPES.TEXT,
+    label: i18n.translate('xpack.ingestPipelines.pipelineEditor.splitForm.separatorFieldLabel', {
+      defaultMessage: 'Separator',
+    }),
+    deserializer: String,
+    helpText: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.splitForm.separatorFieldHelpText',
+      {
+        defaultMessage: 'Regex to match a separator',
+      }
+    ),
+    validations: [
+      {
+        validator: emptyField(
+          i18n.translate('xpack.ingestPipelines.pipelineEditor.splitForm.separatorRequiredError', {
+            defaultMessage: 'A value is required.',
+          })
+        ),
+      },
+    ],
+  },
+  /* Optional fields config */
+  preserve_trailing: {
+    type: FIELD_TYPES.TOGGLE,
+    defaultValue: false,
+    deserializer: to.booleanOrUndef,
+    serializer: from.undefinedIfValue(false),
+    label: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.splitForm.preserveTrailingFieldLabel',
+      {
+        defaultMessage: 'Preserve trailing',
+      }
+    ),
+    helpText: i18n.translate(
+      'xpack.ingestPipelines.pipelineEditor.splitForm.preserveTrailingFieldHelpText',
+      { defaultMessage: 'If enabled, preserve any trailing space.' }
+    ),
+  },
+};
+
+export const Split: FunctionComponent = () => {
+  return (
+    <>
+      <FieldNameField
+        helpText={i18n.translate(
+          'xpack.ingestPipelines.pipelineEditor.splitForm.fieldNameHelpText',
+          { defaultMessage: 'Field to split' }
+        )}
+      />
+
+      <UseField config={fieldsConfig.separator} component={Field} path="fields.separator" />
+
+      <TargetField />
+
+      <UseField
+        config={fieldsConfig.preserve_trailing}
+        component={ToggleField}
+        path="fields.preserve_trailing"
+      />
+
+      <IgnoreMissingField />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx
index 854c6632ab94ad..799551b296bab9 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx
@@ -5,7 +5,9 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { FunctionComponent } from 'react';
+import React, { ReactNode } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiCode } from '@elastic/eui';
 
 import {
   Append,
@@ -28,18 +30,27 @@ import {
   Inference,
   Join,
   Json,
+  Kv,
+  Lowercase,
+  Pipeline,
+  Remove,
+  Rename,
+  Script,
+  SetProcessor,
+  SetSecurityUser,
+  Split,
+  Sort,
+  FormFieldsComponent,
 } from '../manage_processor_form/processors';
 
-// import { SetProcessor } from './processors/set';
-// import { Gsub } from './processors/gsub';
-
 interface FieldDescriptor {
-  FieldsComponent?: FunctionComponent;
+  FieldsComponent?: FormFieldsComponent;
   docLinkPath: string;
   /**
    * A sentence case label that can be displayed to users
    */
   label: string;
+  description?: string | ReactNode;
 }
 
 type MapProcessorTypeToDescriptor = Record<string, FieldDescriptor>;
@@ -51,6 +62,10 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.append', {
       defaultMessage: 'Append',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.append', {
+      defaultMessage:
+        "Appends values to a field's array. If the field contains a single value, the processor first converts it to an array. If the field doesn't exist, the processor creates an array containing the appended values.",
+    }),
   },
   bytes: {
     FieldsComponent: Bytes,
@@ -58,6 +73,10 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.bytes', {
       defaultMessage: 'Bytes',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.bytes', {
+      defaultMessage:
+        'Converts digital storage units to bytes. For example, 1KB becomes 1024 bytes.',
+    }),
   },
   circle: {
     FieldsComponent: Circle,
@@ -65,6 +84,9 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.circle', {
       defaultMessage: 'Circle',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.circle', {
+      defaultMessage: 'Converts a circle definition into an approximate polygon.',
+    }),
   },
   convert: {
     FieldsComponent: Convert,
@@ -72,6 +94,10 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.convert', {
       defaultMessage: 'Convert',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.convert', {
+      defaultMessage:
+        'Converts a field to a different data type. For example, you can convert a string to an long.',
+    }),
   },
   csv: {
     FieldsComponent: CSV,
@@ -79,6 +105,9 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.csv', {
       defaultMessage: 'CSV',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.csv', {
+      defaultMessage: 'Extracts fields values from CSV data.',
+    }),
   },
   date: {
     FieldsComponent: DateProcessor,
@@ -86,6 +115,9 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.date', {
       defaultMessage: 'Date',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.date', {
+      defaultMessage: 'Converts a date to a document timestamp.',
+    }),
   },
   date_index_name: {
     FieldsComponent: DateIndexName,
@@ -93,6 +125,13 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.dateIndexName', {
       defaultMessage: 'Date index name',
     }),
+    description: () => (
+      <FormattedMessage
+        id="xpack.ingestPipelines.processors.description.dateIndexName"
+        defaultMessage="Uses a date or timestamp to add documents to the correct time-based index. Index names must use a date math pattern, such as {value}."
+        values={{ value: <EuiCode inline>{'my-index-yyyy-MM-dd'}</EuiCode> }}
+      />
+    ),
   },
   dissect: {
     FieldsComponent: Dissect,
@@ -100,6 +139,9 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.dissect', {
       defaultMessage: 'Dissect',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.dissect', {
+      defaultMessage: 'Uses dissect patterns to extract matches from a field.',
+    }),
   },
   dot_expander: {
     FieldsComponent: DotExpander,
@@ -107,6 +149,10 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.dotExpander', {
       defaultMessage: 'Dot expander',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.dotExpander', {
+      defaultMessage:
+        'Expands a field containing dot notation into an object field. The object field is then accessible by other processors in the pipeline.',
+    }),
   },
   drop: {
     FieldsComponent: Drop,
@@ -114,6 +160,10 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     label: i18n.translate('xpack.ingestPipelines.processors.label.drop', {
       defaultMessage: 'Drop',
     }),
+    description: i18n.translate('xpack.ingestPipelines.processors.description.drop', {
+      defaultMessage:
+        'Drops documents without returning an error. Used to only index documents that meet specified conditions.',
+    }),
   },
   enrich: {
     FieldsComponent: Enrich,
@@ -186,63 +236,70 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
     }),
   },
   kv: {
-    FieldsComponent: undefined, // TODO: Implement
+    FieldsComponent: Kv,
     docLinkPath: '/kv-processor.html',
     label: i18n.translate('xpack.ingestPipelines.processors.label.kv', {
       defaultMessage: 'KV',
     }),
   },
   lowercase: {
-    FieldsComponent: undefined, // TODO: Implement
+    FieldsComponent: Lowercase,
     docLinkPath: '/lowercase-processor.html',
     label: i18n.translate('xpack.ingestPipelines.processors.label.lowercase', {
       defaultMessage: 'Lowercase',
     }),
   },
   pipeline: {
-    FieldsComponent: undefined, // TODO: Implement
+    FieldsComponent: Pipeline,
     docLinkPath: '/pipeline-processor.html',
     label: i18n.translate('xpack.ingestPipelines.processors.label.pipeline', {
       defaultMessage: 'Pipeline',
     }),
   },
   remove: {
-    FieldsComponent: undefined, // TODO: Implement
+    FieldsComponent: Remove,
     docLinkPath: '/remove-processor.html',
     label: i18n.translate('xpack.ingestPipelines.processors.label.remove', {
       defaultMessage: 'Remove',
     }),
   },
   rename: {
-    FieldsComponent: undefined, // TODO: Implement
+    FieldsComponent: Rename,
     docLinkPath: '/rename-processor.html',
     label: i18n.translate('xpack.ingestPipelines.processors.label.rename', {
       defaultMessage: 'Rename',
     }),
   },
   script: {
-    FieldsComponent: undefined, // TODO: Implement
+    FieldsComponent: Script,
     docLinkPath: '/script-processor.html',
     label: i18n.translate('xpack.ingestPipelines.processors.label.script', {
       defaultMessage: 'Script',
     }),
   },
+  set: {
+    FieldsComponent: SetProcessor,
+    docLinkPath: '/set-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.set', {
+      defaultMessage: 'Set',
+    }),
+  },
   set_security_user: {
-    FieldsComponent: undefined, // TODO: Implement
+    FieldsComponent: SetSecurityUser,
     docLinkPath: '/ingest-node-set-security-user-processor.html',
     label: i18n.translate('xpack.ingestPipelines.processors.label.setSecurityUser', {
       defaultMessage: 'Set security user',
     }),
   },
   split: {
-    FieldsComponent: undefined, // TODO: Implement
+    FieldsComponent: Split,
     docLinkPath: '/split-processor.html',
     label: i18n.translate('xpack.ingestPipelines.processors.label.split', {
       defaultMessage: 'Split',
     }),
   },
   sort: {
-    FieldsComponent: undefined, // TODO: Implement
+    FieldsComponent: Sort,
     docLinkPath: '/sort-processor.html',
     label: i18n.translate('xpack.ingestPipelines.processors.label.sort', {
       defaultMessage: 'Sort',
@@ -276,15 +333,6 @@ export const mapProcessorTypeToDescriptor: MapProcessorTypeToDescriptor = {
       defaultMessage: 'User agent',
     }),
   },
-
-  // --- The below processor descriptors have components implemented ---
-  set: {
-    FieldsComponent: undefined,
-    docLinkPath: '/set-processor.html',
-    label: i18n.translate('xpack.ingestPipelines.processors.label.set', {
-      defaultMessage: 'Set',
-    }),
-  },
 };
 
 export type ProcessorType = keyof typeof mapProcessorTypeToDescriptor;
diff --git a/x-pack/plugins/ingest_pipelines/public/shared_imports.ts b/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
index 936db37f0c6292..abdbdf21404009 100644
--- a/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
+++ b/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
@@ -62,6 +62,7 @@ export {
   RadioGroupField,
   NumericField,
   SelectField,
+  CheckBoxField,
 } from '../../../../src/plugins/es_ui_shared/static/forms/components';
 
 export {
diff --git a/x-pack/plugins/lens/public/datatable_visualization/visualization.test.tsx b/x-pack/plugins/lens/public/datatable_visualization/visualization.test.tsx
index 194f12cf9291b6..0db456e0760ec3 100644
--- a/x-pack/plugins/lens/public/datatable_visualization/visualization.test.tsx
+++ b/x-pack/plugins/lens/public/datatable_visualization/visualization.test.tsx
@@ -205,10 +205,10 @@ describe('Datatable Visualization', () => {
           },
           frame,
         }).groups
-      ).toHaveLength(1);
+      ).toHaveLength(2);
     });
 
-    it('allows all kinds of operations', () => {
+    it('allows only bucket operations one category', () => {
       const datasource = createMockDatasource('test');
       const frame = mockFrame();
       frame.datasourceLayers = { first: datasource.publicAPIMock };
@@ -232,6 +232,40 @@ describe('Datatable Visualization', () => {
       expect(filterOperations({ ...baseOperation, dataType: 'boolean' })).toEqual(true);
       expect(filterOperations({ ...baseOperation, dataType: 'other' as DataType })).toEqual(true);
       expect(filterOperations({ ...baseOperation, dataType: 'date', isBucketed: false })).toEqual(
+        false
+      );
+      expect(filterOperations({ ...baseOperation, dataType: 'number', isBucketed: false })).toEqual(
+        false
+      );
+    });
+
+    it('allows only metric operations in one category', () => {
+      const datasource = createMockDatasource('test');
+      const frame = mockFrame();
+      frame.datasourceLayers = { first: datasource.publicAPIMock };
+
+      const filterOperations = datatableVisualization.getConfiguration({
+        layerId: 'first',
+        state: {
+          layers: [{ layerId: 'first', columns: [] }],
+        },
+        frame,
+      }).groups[1].filterOperations;
+
+      const baseOperation: Operation = {
+        dataType: 'string',
+        isBucketed: true,
+        label: '',
+      };
+      expect(filterOperations({ ...baseOperation })).toEqual(false);
+      expect(filterOperations({ ...baseOperation, dataType: 'number' })).toEqual(false);
+      expect(filterOperations({ ...baseOperation, dataType: 'date' })).toEqual(false);
+      expect(filterOperations({ ...baseOperation, dataType: 'boolean' })).toEqual(false);
+      expect(filterOperations({ ...baseOperation, dataType: 'other' as DataType })).toEqual(false);
+      expect(filterOperations({ ...baseOperation, dataType: 'date', isBucketed: false })).toEqual(
+        true
+      );
+      expect(filterOperations({ ...baseOperation, dataType: 'number', isBucketed: false })).toEqual(
         true
       );
     });
@@ -248,7 +282,7 @@ describe('Datatable Visualization', () => {
           layerId: 'a',
           state: { layers: [layer] },
           frame,
-        }).groups[0].accessors
+        }).groups[1].accessors
       ).toEqual(['c', 'b']);
     });
   });
diff --git a/x-pack/plugins/lens/public/datatable_visualization/visualization.tsx b/x-pack/plugins/lens/public/datatable_visualization/visualization.tsx
index 5aff4e14b17f2b..836ffcb15cfa10 100644
--- a/x-pack/plugins/lens/public/datatable_visualization/visualization.tsx
+++ b/x-pack/plugins/lens/public/datatable_visualization/visualization.tsx
@@ -143,15 +143,29 @@ export const datatableVisualization: Visualization<DatatableVisualizationState>
       groups: [
         {
           groupId: 'columns',
-          groupLabel: i18n.translate('xpack.lens.datatable.columns', {
-            defaultMessage: 'Columns',
+          groupLabel: i18n.translate('xpack.lens.datatable.breakdown', {
+            defaultMessage: 'Break down by',
           }),
           layerId: state.layers[0].layerId,
-          accessors: sortedColumns,
+          accessors: sortedColumns.filter((c) => datasource.getOperationForColumnId(c)?.isBucketed),
           supportsMoreColumns: true,
-          filterOperations: () => true,
+          filterOperations: (op) => op.isBucketed,
           dataTestSubj: 'lnsDatatable_column',
         },
+        {
+          groupId: 'metrics',
+          groupLabel: i18n.translate('xpack.lens.datatable.metrics', {
+            defaultMessage: 'Metrics',
+          }),
+          layerId: state.layers[0].layerId,
+          accessors: sortedColumns.filter(
+            (c) => !datasource.getOperationForColumnId(c)?.isBucketed
+          ),
+          supportsMoreColumns: true,
+          filterOperations: (op) => !op.isBucketed,
+          required: true,
+          dataTestSubj: 'lnsDatatable_metrics',
+        },
       ],
     };
   },
diff --git a/x-pack/plugins/lens/public/drag_drop/__snapshots__/drag_drop.test.tsx.snap b/x-pack/plugins/lens/public/drag_drop/__snapshots__/drag_drop.test.tsx.snap
index d18a2db614f550..3581151dd5f768 100644
--- a/x-pack/plugins/lens/public/drag_drop/__snapshots__/drag_drop.test.tsx.snap
+++ b/x-pack/plugins/lens/public/drag_drop/__snapshots__/drag_drop.test.tsx.snap
@@ -9,6 +9,20 @@ exports[`DragDrop droppable is reflected in the className 1`] = `
 </div>
 `;
 
+exports[`DragDrop items that have droppable=false get special styling when another item is dragged 1`] = `
+<div
+  className="lnsDragDrop lnsDragDrop-isNotDroppable"
+  data-test-subj="lnsDragDrop"
+  onDragEnd={[Function]}
+  onDragLeave={[Function]}
+  onDragOver={[Function]}
+  onDragStart={[Function]}
+  onDrop={[Function]}
+>
+  Hello!
+</div>
+`;
+
 exports[`DragDrop renders if nothing is being dragged 1`] = `
 <div
   class="lnsDragDrop"
diff --git a/x-pack/plugins/lens/public/drag_drop/_drag_drop.scss b/x-pack/plugins/lens/public/drag_drop/_drag_drop.scss
index 5a4fb4e95ad0d2..c971540e165c11 100644
--- a/x-pack/plugins/lens/public/drag_drop/_drag_drop.scss
+++ b/x-pack/plugins/lens/public/drag_drop/_drag_drop.scss
@@ -1,3 +1,7 @@
+.lnsDragDrop-isNotDroppable {
+  opacity: .5;
+}
+
 // Fix specificity by chaining classes
 
 .lnsDragDrop.lnsDragDrop-isDropTarget {
diff --git a/x-pack/plugins/lens/public/drag_drop/drag_drop.test.tsx b/x-pack/plugins/lens/public/drag_drop/drag_drop.test.tsx
index 765522067eaf09..3240357c254eac 100644
--- a/x-pack/plugins/lens/public/drag_drop/drag_drop.test.tsx
+++ b/x-pack/plugins/lens/public/drag_drop/drag_drop.test.tsx
@@ -49,7 +49,7 @@ describe('DragDrop', () => {
     const value = {};
 
     const component = mount(
-      <ChildDragDropProvider dragging={undefined} setDragging={setDragging}>
+      <ChildDragDropProvider dragging={value} setDragging={setDragging}>
         <DragDrop value={value} draggable={true} label="drag label">
           Hello!
         </DragDrop>
@@ -127,4 +127,63 @@ describe('DragDrop', () => {
 
     expect(component).toMatchSnapshot();
   });
+
+  test('items that have droppable=false get special styling when another item is dragged', () => {
+    const component = mount(
+      <ChildDragDropProvider dragging={'ignored'} setDragging={() => {}}>
+        <DragDrop value="ignored" draggable={true} label="a">
+          Ignored
+        </DragDrop>
+        <DragDrop onDrop={(x: unknown) => {}} droppable={false}>
+          Hello!
+        </DragDrop>
+      </ChildDragDropProvider>
+    );
+
+    expect(component.find('[data-test-subj="lnsDragDrop"]').at(1)).toMatchSnapshot();
+  });
+
+  test('additional styles are reflected in the className until drop', () => {
+    let dragging: string | undefined;
+    const getAdditionalClasses = jest.fn().mockReturnValue('additional');
+    const component = mount(
+      <ChildDragDropProvider
+        dragging={dragging}
+        setDragging={() => {
+          dragging = 'hello';
+        }}
+      >
+        <DragDrop value="ignored" draggable={true} label="a">
+          Ignored
+        </DragDrop>
+        <DragDrop
+          onDrop={(x: unknown) => {}}
+          droppable
+          getAdditionalClassesOnEnter={getAdditionalClasses}
+        >
+          Hello!
+        </DragDrop>
+      </ChildDragDropProvider>
+    );
+
+    const dataTransfer = {
+      setData: jest.fn(),
+      getData: jest.fn(),
+    };
+    component
+      .find('[data-test-subj="lnsDragDrop"]')
+      .first()
+      .simulate('dragstart', { dataTransfer });
+    jest.runAllTimers();
+
+    component.find('[data-test-subj="lnsDragDrop"]').at(1).simulate('dragover');
+    expect(component.find('.additional')).toHaveLength(1);
+
+    component.find('[data-test-subj="lnsDragDrop"]').at(1).simulate('dragleave');
+    expect(component.find('.additional')).toHaveLength(0);
+
+    component.find('[data-test-subj="lnsDragDrop"]').at(1).simulate('dragover');
+    component.find('[data-test-subj="lnsDragDrop"]').at(1).simulate('drop');
+    expect(component.find('.additional')).toHaveLength(0);
+  });
 });
diff --git a/x-pack/plugins/lens/public/drag_drop/drag_drop.tsx b/x-pack/plugins/lens/public/drag_drop/drag_drop.tsx
index 5a0fc3b3839f72..85bdd24bd4f804 100644
--- a/x-pack/plugins/lens/public/drag_drop/drag_drop.tsx
+++ b/x-pack/plugins/lens/public/drag_drop/drag_drop.tsx
@@ -49,6 +49,11 @@ interface BaseProps {
    */
   droppable?: boolean;
 
+  /**
+   * Additional class names to apply when another element is over the drop target
+   */
+  getAdditionalClassesOnEnter?: () => string;
+
   /**
    * The optional test subject associated with this DOM element.
    */
@@ -97,6 +102,12 @@ export const DragDrop = (props: Props) => {
       {...props}
       dragging={droppable ? dragging : undefined}
       isDragging={!!(draggable && value === dragging)}
+      isNotDroppable={
+        // If the configuration has provided a droppable flag, but this particular item is not
+        // droppable, then it should be less prominent. Ignores items that are both
+        // draggable and drop targets
+        droppable === false && Boolean(dragging) && value !== dragging
+      }
       setDragging={setDragging}
     />
   );
@@ -107,9 +118,13 @@ const DragDropInner = React.memo(function DragDropInner(
     dragging: unknown;
     setDragging: (dragging: unknown) => void;
     isDragging: boolean;
+    isNotDroppable: boolean;
   }
 ) {
-  const [state, setState] = useState({ isActive: false });
+  const [state, setState] = useState({
+    isActive: false,
+    dragEnterClassNames: '',
+  });
   const {
     className,
     onDrop,
@@ -120,13 +135,20 @@ const DragDropInner = React.memo(function DragDropInner(
     dragging,
     setDragging,
     isDragging,
+    isNotDroppable,
   } = props;
 
-  const classes = classNames('lnsDragDrop', className, {
-    'lnsDragDrop-isDropTarget': droppable,
-    'lnsDragDrop-isActiveDropTarget': droppable && state.isActive,
-    'lnsDragDrop-isDragging': isDragging,
-  });
+  const classes = classNames(
+    'lnsDragDrop',
+    className,
+    {
+      'lnsDragDrop-isDropTarget': droppable,
+      'lnsDragDrop-isActiveDropTarget': droppable && state.isActive,
+      'lnsDragDrop-isDragging': isDragging,
+      'lnsDragDrop-isNotDroppable': isNotDroppable,
+    },
+    state.dragEnterClassNames
+  );
 
   const dragStart = (e: DroppableEvent) => {
     // Setting stopPropgagation causes Chrome failures, so
@@ -159,19 +181,25 @@ const DragDropInner = React.memo(function DragDropInner(
 
     // An optimization to prevent a bunch of React churn.
     if (!state.isActive) {
-      setState({ ...state, isActive: true });
+      setState({
+        ...state,
+        isActive: true,
+        dragEnterClassNames: props.getAdditionalClassesOnEnter
+          ? props.getAdditionalClassesOnEnter()
+          : '',
+      });
     }
   };
 
   const dragLeave = () => {
-    setState({ ...state, isActive: false });
+    setState({ ...state, isActive: false, dragEnterClassNames: '' });
   };
 
   const drop = (e: DroppableEvent) => {
     e.preventDefault();
     e.stopPropagation();
 
-    setState({ ...state, isActive: false });
+    setState({ ...state, isActive: false, dragEnterClassNames: '' });
     setDragging(undefined);
 
     if (onDrop && droppable) {
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_layer_panel.scss b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_layer_panel.scss
index 4e13fd95d19618..62bc6d7ed7cc8a 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_layer_panel.scss
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_layer_panel.scss
@@ -27,6 +27,14 @@
   overflow: hidden;
 }
 
+.lnsLayerPanel__dimension-isHidden {
+  opacity: 0;
+}
+
+.lnsLayerPanel__dimension-isReplacing {
+  text-decoration: line-through;
+}
+
 .lnsLayerPanel__triggerLink {
   padding: $euiSizeS;
   width: 100%;
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.test.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.test.tsx
index b3ad03b71770c2..85dbee6de524f8 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.test.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.test.tsx
@@ -12,6 +12,7 @@ import {
   createMockDatasource,
   DatasourceMock,
 } from '../../mocks';
+import { ChildDragDropProvider } from '../../../drag_drop';
 import { EuiFormRow, EuiPopover } from '@elastic/eui';
 import { mount } from 'enzyme';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
@@ -272,6 +273,7 @@ describe('LayerPanel', () => {
 
       expect(component.find(EuiPopover).prop('isOpen')).toBe(true);
     });
+
     it('should close the popover when the active visualization changes', () => {
       /**
        * The ID generation system for new dimensions has been messy before, so
@@ -324,4 +326,151 @@ describe('LayerPanel', () => {
       expect(component.find(EuiPopover).prop('isOpen')).toBe(false);
     });
   });
+
+  // This test is more like an integration test, since the layer panel owns all
+  // the coordination between drag and drop
+  describe('drag and drop behavior', () => {
+    it('should determine if the datasource supports dropping of a field onto empty dimension', () => {
+      mockVisualization.getConfiguration.mockReturnValue({
+        groups: [
+          {
+            groupLabel: 'A',
+            groupId: 'a',
+            accessors: [],
+            filterOperations: () => true,
+            supportsMoreColumns: true,
+            dataTestSubj: 'lnsGroup',
+          },
+        ],
+      });
+
+      mockDatasource.canHandleDrop.mockReturnValue(true);
+
+      const draggingField = { field: { name: 'dragged' }, indexPatternId: 'a' };
+
+      const component = mountWithIntl(
+        <ChildDragDropProvider dragging={draggingField} setDragging={jest.fn()}>
+          <LayerPanel {...getDefaultProps()} />
+        </ChildDragDropProvider>
+      );
+
+      expect(mockDatasource.canHandleDrop).toHaveBeenCalledWith(
+        expect.objectContaining({
+          dragDropContext: expect.objectContaining({
+            dragging: draggingField,
+          }),
+        })
+      );
+
+      component.find('DragDrop[data-test-subj="lnsGroup"]').first().simulate('drop');
+
+      expect(mockDatasource.onDrop).toHaveBeenCalledWith(
+        expect.objectContaining({
+          dragDropContext: expect.objectContaining({
+            dragging: draggingField,
+          }),
+        })
+      );
+    });
+
+    it('should allow drag to move between groups', () => {
+      (generateId as jest.Mock).mockReturnValue(`newid`);
+
+      mockVisualization.getConfiguration.mockReturnValue({
+        groups: [
+          {
+            groupLabel: 'A',
+            groupId: 'a',
+            accessors: ['a'],
+            filterOperations: () => true,
+            supportsMoreColumns: false,
+            dataTestSubj: 'lnsGroupA',
+          },
+          {
+            groupLabel: 'B',
+            groupId: 'b',
+            accessors: ['b'],
+            filterOperations: () => true,
+            supportsMoreColumns: true,
+            dataTestSubj: 'lnsGroupB',
+          },
+        ],
+      });
+
+      mockDatasource.canHandleDrop.mockReturnValue(true);
+
+      const draggingOperation = { layerId: 'first', columnId: 'a', groupId: 'a' };
+
+      const component = mountWithIntl(
+        <ChildDragDropProvider dragging={draggingOperation} setDragging={jest.fn()}>
+          <LayerPanel {...getDefaultProps()} />
+        </ChildDragDropProvider>
+      );
+
+      expect(mockDatasource.canHandleDrop).toHaveBeenCalledTimes(2);
+      expect(mockDatasource.canHandleDrop).toHaveBeenCalledWith(
+        expect.objectContaining({
+          dragDropContext: expect.objectContaining({
+            dragging: draggingOperation,
+          }),
+        })
+      );
+
+      // Simulate drop on the pre-populated dimension
+      component.find('DragDrop[data-test-subj="lnsGroupB"]').at(0).simulate('drop');
+      expect(mockDatasource.onDrop).toHaveBeenCalledWith(
+        expect.objectContaining({
+          columnId: 'b',
+          dragDropContext: expect.objectContaining({
+            dragging: draggingOperation,
+          }),
+        })
+      );
+
+      // Simulate drop on the empty dimension
+      component.find('DragDrop[data-test-subj="lnsGroupB"]').at(1).simulate('drop');
+      expect(mockDatasource.onDrop).toHaveBeenCalledWith(
+        expect.objectContaining({
+          columnId: 'newid',
+          dragDropContext: expect.objectContaining({
+            dragging: draggingOperation,
+          }),
+        })
+      );
+    });
+
+    it('should prevent dropping in the same group', () => {
+      mockVisualization.getConfiguration.mockReturnValue({
+        groups: [
+          {
+            groupLabel: 'A',
+            groupId: 'a',
+            accessors: ['a', 'b'],
+            filterOperations: () => true,
+            supportsMoreColumns: true,
+            dataTestSubj: 'lnsGroup',
+          },
+        ],
+      });
+
+      const draggingOperation = { layerId: 'first', columnId: 'a', groupId: 'a' };
+
+      const component = mountWithIntl(
+        <ChildDragDropProvider dragging={draggingOperation} setDragging={jest.fn()}>
+          <LayerPanel {...getDefaultProps()} />
+        </ChildDragDropProvider>
+      );
+
+      expect(mockDatasource.canHandleDrop).not.toHaveBeenCalled();
+
+      component.find('DragDrop[data-test-subj="lnsGroup"]').at(0).simulate('drop');
+      expect(mockDatasource.onDrop).not.toHaveBeenCalled();
+
+      component.find('DragDrop[data-test-subj="lnsGroup"]').at(1).simulate('drop');
+      expect(mockDatasource.onDrop).not.toHaveBeenCalled();
+
+      component.find('DragDrop[data-test-subj="lnsGroup"]').at(2).simulate('drop');
+      expect(mockDatasource.onDrop).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx
index b2804cfddba58c..b45dd13bfa4fd6 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx
@@ -17,8 +17,9 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
+import classNames from 'classnames';
 import { NativeRenderer } from '../../../native_renderer';
-import { StateSetter } from '../../../types';
+import { StateSetter, isDraggedOperation } from '../../../types';
 import { DragContext, DragDrop, ChildDragDropProvider } from '../../../drag_drop';
 import { LayerSettings } from './layer_settings';
 import { trackUiEvent } from '../../../lens_ui_telemetry';
@@ -154,6 +155,7 @@ export function LayerPanel(
         {groups.map((group, index) => {
           const newId = generateId();
           const isMissing = !isEmptyLayer && group.required && group.accessors.length === 0;
+
           return (
             <EuiFormRow
               className="lnsLayerPanel__row"
@@ -215,10 +217,32 @@ export function LayerPanel(
                   return (
                     <DragDrop
                       key={accessor}
-                      className="lnsLayerPanel__dimension"
+                      className={classNames('lnsLayerPanel__dimension', {
+                        // eslint-disable-next-line @typescript-eslint/naming-convention
+                        'lnsLayerPanel__dimension-isHidden':
+                          isDraggedOperation(dragDropContext.dragging) &&
+                          accessor === dragDropContext.dragging.columnId,
+                      })}
+                      getAdditionalClassesOnEnter={() => {
+                        // If we are dragging another column, add an indication that the behavior will be a replacement'
+                        if (
+                          isDraggedOperation(dragDropContext.dragging) &&
+                          group.groupId !== dragDropContext.dragging.groupId
+                        ) {
+                          return 'lnsLayerPanel__dimension-isReplacing';
+                        }
+                        return '';
+                      }}
                       data-test-subj={group.dataTestSubj}
+                      draggable={true}
+                      value={{ columnId: accessor, groupId: group.groupId, layerId }}
+                      label={group.groupLabel}
                       droppable={
-                        dragDropContext.dragging &&
+                        Boolean(dragDropContext.dragging) &&
+                        // Verify that the dragged item is not coming from the same group
+                        // since this would be a reorder
+                        (!isDraggedOperation(dragDropContext.dragging) ||
+                          dragDropContext.dragging.groupId !== group.groupId) &&
                         layerDatasource.canHandleDrop({
                           ...layerDatasourceDropProps,
                           columnId: accessor,
@@ -226,12 +250,22 @@ export function LayerPanel(
                         })
                       }
                       onDrop={(droppedItem) => {
-                        layerDatasource.onDrop({
+                        const dropResult = layerDatasource.onDrop({
                           ...layerDatasourceDropProps,
                           droppedItem,
                           columnId: accessor,
                           filterOperations: group.filterOperations,
                         });
+                        if (typeof dropResult === 'object') {
+                          // When a column is moved, we delete the reference to the old
+                          props.updateVisualization(
+                            activeVisualization.removeDimension({
+                              layerId,
+                              columnId: dropResult.deleted,
+                              prevState: props.visualizationState,
+                            })
+                          );
+                        }
                       }}
                     >
                       <DimensionPopover
@@ -315,7 +349,11 @@ export function LayerPanel(
                     className="lnsLayerPanel__dimension"
                     data-test-subj={group.dataTestSubj}
                     droppable={
-                      dragDropContext.dragging &&
+                      Boolean(dragDropContext.dragging) &&
+                      // Verify that the dragged item is not coming from the same group
+                      // since this would be a reorder
+                      (!isDraggedOperation(dragDropContext.dragging) ||
+                        dragDropContext.dragging.groupId !== group.groupId) &&
                       layerDatasource.canHandleDrop({
                         ...layerDatasourceDropProps,
                         columnId: newId,
@@ -323,13 +361,13 @@ export function LayerPanel(
                       })
                     }
                     onDrop={(droppedItem) => {
-                      const dropSuccess = layerDatasource.onDrop({
+                      const dropResult = layerDatasource.onDrop({
                         ...layerDatasourceDropProps,
                         droppedItem,
                         columnId: newId,
                         filterOperations: group.filterOperations,
                       });
-                      if (dropSuccess) {
+                      if (dropResult) {
                         props.updateVisualization(
                           activeVisualization.setDimension({
                             layerId,
@@ -338,6 +376,17 @@ export function LayerPanel(
                             prevState: props.visualizationState,
                           })
                         );
+
+                        if (typeof dropResult === 'object') {
+                          // When a column is moved, we delete the reference to the old
+                          props.updateVisualization(
+                            activeVisualization.removeDimension({
+                              layerId,
+                              columnId: dropResult.deleted,
+                              prevState: props.visualizationState,
+                            })
+                          );
+                        }
                       }
                     }}
                   >
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
index 3ee109376d975b..f184d5628ab1c1 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
@@ -1378,6 +1378,66 @@ describe('IndexPatternDimensionEditorPanel', () => {
       ).toBe(false);
     });
 
+    it('is droppable if the dragged column is compatible', () => {
+      expect(
+        canHandleDrop({
+          ...defaultProps,
+          dragDropContext: {
+            ...dragDropContext,
+            dragging: {
+              columnId: 'col1',
+              groupId: 'a',
+              layerId: 'myLayer',
+            },
+          },
+          state: dragDropState(),
+          columnId: 'col2',
+          filterOperations: (op: OperationMetadata) => true,
+          layerId: 'myLayer',
+        })
+      ).toBe(true);
+    });
+
+    it('is not droppable if the dragged column is the same as the current column', () => {
+      expect(
+        canHandleDrop({
+          ...defaultProps,
+          dragDropContext: {
+            ...dragDropContext,
+            dragging: {
+              columnId: 'col1',
+              groupId: 'a',
+              layerId: 'myLayer',
+            },
+          },
+          state: dragDropState(),
+          columnId: 'col1',
+          filterOperations: (op: OperationMetadata) => true,
+          layerId: 'myLayer',
+        })
+      ).toBe(false);
+    });
+
+    it('is not droppable if the dragged column is incompatible', () => {
+      expect(
+        canHandleDrop({
+          ...defaultProps,
+          dragDropContext: {
+            ...dragDropContext,
+            dragging: {
+              columnId: 'col1',
+              groupId: 'a',
+              layerId: 'myLayer',
+            },
+          },
+          state: dragDropState(),
+          columnId: 'col2',
+          filterOperations: (op: OperationMetadata) => op.dataType === 'number',
+          layerId: 'myLayer',
+        })
+      ).toBe(false);
+    });
+
     it('appends the dropped column when a field is dropped', () => {
       const dragging = {
         field: { type: 'number', name: 'bar', aggregatable: true },
@@ -1526,5 +1586,109 @@ describe('IndexPatternDimensionEditorPanel', () => {
         },
       });
     });
+
+    it('updates the column id when moving an operation to an empty dimension', () => {
+      const dragging = {
+        columnId: 'col1',
+        groupId: 'a',
+        layerId: 'myLayer',
+      };
+      const testState = dragDropState();
+
+      onDrop({
+        ...defaultProps,
+        dragDropContext: {
+          ...dragDropContext,
+          dragging,
+        },
+        droppedItem: dragging,
+        state: testState,
+        columnId: 'col2',
+        filterOperations: (op: OperationMetadata) => true,
+        layerId: 'myLayer',
+      });
+
+      expect(setState).toBeCalledTimes(1);
+      expect(setState).toHaveBeenCalledWith({
+        ...testState,
+        layers: {
+          myLayer: {
+            ...testState.layers.myLayer,
+            columnOrder: ['col2'],
+            columns: {
+              col2: testState.layers.myLayer.columns.col1,
+            },
+          },
+        },
+      });
+    });
+
+    it('replaces an operation when moving to a populated dimension', () => {
+      const dragging = {
+        columnId: 'col2',
+        groupId: 'a',
+        layerId: 'myLayer',
+      };
+      const testState = dragDropState();
+      testState.layers.myLayer = {
+        indexPatternId: 'foo',
+        columnOrder: ['col1', 'col2', 'col3'],
+        columns: {
+          col1: testState.layers.myLayer.columns.col1,
+
+          col2: {
+            label: 'Top values of src',
+            dataType: 'string',
+            isBucketed: true,
+
+            // Private
+            operationType: 'terms',
+            params: {
+              orderBy: { type: 'column', columnId: 'col3' },
+              orderDirection: 'desc',
+              size: 10,
+            },
+            sourceField: 'src',
+          },
+          col3: {
+            label: 'Count',
+            dataType: 'number',
+            isBucketed: false,
+
+            // Private
+            operationType: 'count',
+            sourceField: 'Records',
+          },
+        },
+      };
+
+      onDrop({
+        ...defaultProps,
+        dragDropContext: {
+          ...dragDropContext,
+          dragging,
+        },
+        droppedItem: dragging,
+        state: testState,
+        columnId: 'col1',
+        filterOperations: (op: OperationMetadata) => true,
+        layerId: 'myLayer',
+      });
+
+      expect(setState).toBeCalledTimes(1);
+      expect(setState).toHaveBeenCalledWith({
+        ...testState,
+        layers: {
+          myLayer: {
+            ...testState.layers.myLayer,
+            columnOrder: ['col1', 'col3'],
+            columns: {
+              col1: testState.layers.myLayer.columns.col2,
+              col3: testState.layers.myLayer.columns.col3,
+            },
+          },
+        },
+      });
+    });
   });
 });
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.tsx
index 1e8f73b19a3b09..1fbbefd8f1117b 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.tsx
@@ -15,6 +15,7 @@ import {
   DatasourceDimensionEditorProps,
   DatasourceDimensionDropProps,
   DatasourceDimensionDropHandlerProps,
+  isDraggedOperation,
 } from '../../types';
 import { DataPublicPluginStart } from '../../../../../../src/plugins/data/public';
 import { IndexPatternColumn, OperationType } from '../indexpattern';
@@ -99,16 +100,25 @@ export function canHandleDrop(props: DatasourceDimensionDropProps<IndexPatternPr
     return Boolean(operationFieldSupportMatrix.operationByField[field.name]);
   }
 
-  return (
-    isDraggedField(dragging) &&
-    layerIndexPatternId === dragging.indexPatternId &&
-    Boolean(hasOperationForField(dragging.field))
-  );
+  if (isDraggedField(dragging)) {
+    return (
+      layerIndexPatternId === dragging.indexPatternId &&
+      Boolean(hasOperationForField(dragging.field))
+    );
+  }
+
+  if (
+    isDraggedOperation(dragging) &&
+    dragging.layerId === props.layerId &&
+    props.columnId !== dragging.columnId
+  ) {
+    const op = props.state.layers[props.layerId].columns[dragging.columnId];
+    return props.filterOperations(op);
+  }
+  return false;
 }
 
-export function onDrop(
-  props: DatasourceDimensionDropHandlerProps<IndexPatternPrivateState>
-): boolean {
+export function onDrop(props: DatasourceDimensionDropHandlerProps<IndexPatternPrivateState>) {
   const operationFieldSupportMatrix = getOperationFieldSupportMatrix(props);
   const droppedItem = props.droppedItem;
 
@@ -116,6 +126,42 @@ export function onDrop(
     return Boolean(operationFieldSupportMatrix.operationByField[field.name]);
   }
 
+  if (isDraggedOperation(droppedItem) && droppedItem.layerId === props.layerId) {
+    const layer = props.state.layers[props.layerId];
+    const op = { ...layer.columns[droppedItem.columnId] };
+    if (!props.filterOperations(op)) {
+      return false;
+    }
+
+    const newColumns = { ...layer.columns };
+    delete newColumns[droppedItem.columnId];
+    newColumns[props.columnId] = op;
+
+    const newColumnOrder = [...layer.columnOrder];
+    const oldIndex = newColumnOrder.findIndex((c) => c === droppedItem.columnId);
+    const newIndex = newColumnOrder.findIndex((c) => c === props.columnId);
+
+    if (newIndex === -1) {
+      newColumnOrder[oldIndex] = props.columnId;
+    } else {
+      newColumnOrder.splice(oldIndex, 1);
+    }
+
+    // Time to replace
+    props.setState({
+      ...props.state,
+      layers: {
+        ...props.state.layers,
+        [props.layerId]: {
+          ...layer,
+          columnOrder: newColumnOrder,
+          columns: newColumns,
+        },
+      },
+    });
+    return { deleted: droppedItem.columnId };
+  }
+
   if (!isDraggedField(droppedItem) || !hasOperationForField(droppedItem.field)) {
     // TODO: What do we do if we couldn't find a column?
     return false;
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/utils.ts b/x-pack/plugins/lens/public/indexpattern_datasource/utils.ts
index 0cd92fd96c952f..374dbe77b4ca37 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/utils.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/utils.ts
@@ -4,12 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { DataType } from '../types';
 import { DraggedField } from './indexpattern';
 import {
   BaseIndexPatternColumn,
   FieldBasedIndexPatternColumn,
 } from './operations/definitions/column_types';
-import { DataType } from '../types';
 
 /**
  * Normalizes the specified operation type. (e.g. document operations
diff --git a/x-pack/plugins/lens/public/pie_visualization/render_function.tsx b/x-pack/plugins/lens/public/pie_visualization/render_function.tsx
index 79986986b217dc..4e813494d7d329 100644
--- a/x-pack/plugins/lens/public/pie_visualization/render_function.tsx
+++ b/x-pack/plugins/lens/public/pie_visualization/render_function.tsx
@@ -161,7 +161,7 @@ export function PieComponent(
       // to account for in outer labels
       // This does not handle non-dashboard embeddables, which are allowed to
       // have different backgrounds.
-      textColor: chartTheme.axes?.axisTitleStyle?.fill,
+      textColor: chartTheme.axes?.axisTitle?.fill,
     },
     sectorLineStroke: chartTheme.lineSeriesStyle?.point?.fill,
     sectorLineWidth: 1.5,
diff --git a/x-pack/plugins/lens/public/types.ts b/x-pack/plugins/lens/public/types.ts
index 729daed7223fe3..d8b77afdfe004b 100644
--- a/x-pack/plugins/lens/public/types.ts
+++ b/x-pack/plugins/lens/public/types.ts
@@ -157,7 +157,7 @@ export interface Datasource<T = unknown, P = unknown> {
   renderDimensionEditor: (domElement: Element, props: DatasourceDimensionEditorProps<T>) => void;
   renderLayerPanel: (domElement: Element, props: DatasourceLayerPanelProps<T>) => void;
   canHandleDrop: (props: DatasourceDimensionDropProps<T>) => boolean;
-  onDrop: (props: DatasourceDimensionDropHandlerProps<T>) => boolean;
+  onDrop: (props: DatasourceDimensionDropHandlerProps<T>) => false | true | { deleted: string };
 
   toExpression: (state: T, layerId: string) => Ast | string | null;
 
@@ -230,6 +230,22 @@ export interface DatasourceLayerPanelProps<T> {
   setState: StateSetter<T>;
 }
 
+export interface DraggedOperation {
+  layerId: string;
+  groupId: string;
+  columnId: string;
+}
+
+export function isDraggedOperation(
+  operationCandidate: unknown
+): operationCandidate is DraggedOperation {
+  return (
+    typeof operationCandidate === 'object' &&
+    operationCandidate !== null &&
+    'columnId' in operationCandidate
+  );
+}
+
 export type DatasourceDimensionDropProps<T> = SharedDimensionProps & {
   layerId: string;
   columnId: string;
diff --git a/x-pack/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap b/x-pack/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap
index f0c233b44a2851..79d3528eef4c49 100644
--- a/x-pack/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap
+++ b/x-pack/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap
@@ -20,23 +20,47 @@ exports[`xy_expression XYChart component it renders area 1`] = `
     }
   />
   <Connect(SpecInstance)
-    gridLineStyle={
+    gridLine={
       Object {
         "strokeWidth": 2,
+        "visible": true,
       }
     }
     id="x"
     position="bottom"
-    showGridLines={true}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": true,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="c"
   />
   <Connect(SpecInstance)
+    gridLine={
+      Object {
+        "visible": false,
+      }
+    }
     groupId="left"
     id="left"
     key="left"
     position="left"
-    showGridLines={false}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": false,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="a"
   />
@@ -151,23 +175,47 @@ exports[`xy_expression XYChart component it renders bar 1`] = `
     }
   />
   <Connect(SpecInstance)
-    gridLineStyle={
+    gridLine={
       Object {
         "strokeWidth": 2,
+        "visible": true,
       }
     }
     id="x"
     position="bottom"
-    showGridLines={true}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": true,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="c"
   />
   <Connect(SpecInstance)
+    gridLine={
+      Object {
+        "visible": false,
+      }
+    }
     groupId="left"
     id="left"
     key="left"
     position="left"
-    showGridLines={false}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": false,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="a"
   />
@@ -272,23 +320,47 @@ exports[`xy_expression XYChart component it renders horizontal bar 1`] = `
     }
   />
   <Connect(SpecInstance)
-    gridLineStyle={
+    gridLine={
       Object {
         "strokeWidth": 2,
+        "visible": true,
       }
     }
     id="x"
     position="left"
-    showGridLines={true}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": true,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="c"
   />
   <Connect(SpecInstance)
+    gridLine={
+      Object {
+        "visible": false,
+      }
+    }
     groupId="left"
     id="left"
     key="left"
     position="bottom"
-    showGridLines={false}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": false,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="a"
   />
@@ -393,23 +465,47 @@ exports[`xy_expression XYChart component it renders line 1`] = `
     }
   />
   <Connect(SpecInstance)
-    gridLineStyle={
+    gridLine={
       Object {
         "strokeWidth": 2,
+        "visible": true,
       }
     }
     id="x"
     position="bottom"
-    showGridLines={true}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": true,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="c"
   />
   <Connect(SpecInstance)
+    gridLine={
+      Object {
+        "visible": false,
+      }
+    }
     groupId="left"
     id="left"
     key="left"
     position="left"
-    showGridLines={false}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": false,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="a"
   />
@@ -524,23 +620,47 @@ exports[`xy_expression XYChart component it renders stacked area 1`] = `
     }
   />
   <Connect(SpecInstance)
-    gridLineStyle={
+    gridLine={
       Object {
         "strokeWidth": 2,
+        "visible": true,
       }
     }
     id="x"
     position="bottom"
-    showGridLines={true}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": true,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="c"
   />
   <Connect(SpecInstance)
+    gridLine={
+      Object {
+        "visible": false,
+      }
+    }
     groupId="left"
     id="left"
     key="left"
     position="left"
-    showGridLines={false}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": false,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="a"
   />
@@ -563,6 +683,11 @@ exports[`xy_expression XYChart component it renders stacked area 1`] = `
       ]
     }
     enableHistogramMode={false}
+    fit={
+      Object {
+        "type": "none",
+      }
+    }
     groupId="left"
     id="d-a"
     key="0-0"
@@ -606,6 +731,11 @@ exports[`xy_expression XYChart component it renders stacked area 1`] = `
       ]
     }
     enableHistogramMode={false}
+    fit={
+      Object {
+        "type": "none",
+      }
+    }
     groupId="left"
     id="d-b"
     key="0-1"
@@ -653,23 +783,47 @@ exports[`xy_expression XYChart component it renders stacked bar 1`] = `
     }
   />
   <Connect(SpecInstance)
-    gridLineStyle={
+    gridLine={
       Object {
         "strokeWidth": 2,
+        "visible": true,
       }
     }
     id="x"
     position="bottom"
-    showGridLines={true}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": true,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="c"
   />
   <Connect(SpecInstance)
+    gridLine={
+      Object {
+        "visible": false,
+      }
+    }
     groupId="left"
     id="left"
     key="left"
     position="left"
-    showGridLines={false}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": false,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="a"
   />
@@ -782,23 +936,47 @@ exports[`xy_expression XYChart component it renders stacked horizontal bar 1`] =
     }
   />
   <Connect(SpecInstance)
-    gridLineStyle={
+    gridLine={
       Object {
         "strokeWidth": 2,
+        "visible": true,
       }
     }
     id="x"
     position="left"
-    showGridLines={true}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": true,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="c"
   />
   <Connect(SpecInstance)
+    gridLine={
+      Object {
+        "visible": false,
+      }
+    }
     groupId="left"
     id="left"
     key="left"
     position="bottom"
-    showGridLines={false}
+    style={
+      Object {
+        "axisTitle": Object {
+          "visible": true,
+        },
+        "tickLabel": Object {
+          "visible": false,
+        },
+      }
+    }
     tickFormat={[Function]}
     title="a"
   />
diff --git a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx
index 31ba1bc83d970c..e80bb22c04a697 100644
--- a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx
@@ -107,7 +107,7 @@ describe('XY Config panels', () => {
       expect(component.find(EuiSuperSelect).prop('valueOfSelected')).toEqual('Carry');
     });
 
-    it('should disable the select if there is no unstacked area or line series', () => {
+    it('should disable the select if there is no area or line series', () => {
       const state = testState();
       const component = shallow(
         <XyToolbar
@@ -115,10 +115,7 @@ describe('XY Config panels', () => {
           setState={jest.fn()}
           state={{
             ...state,
-            layers: [
-              { ...state.layers[0], seriesType: 'bar' },
-              { ...state.layers[0], seriesType: 'area_stacked' },
-            ],
+            layers: [{ ...state.layers[0], seriesType: 'bar' }],
             fittingFunction: 'Carry',
           }}
         />
diff --git a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
index d64eb9451a50ee..a2488d123e13a1 100644
--- a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
@@ -135,8 +135,8 @@ export function XyToolbar(props: VisualizationToolbarProps<State>) {
   const { frame, state, setState } = props;
 
   const [open, setOpen] = useState(false);
-  const hasNonBarSeries = state?.layers.some(
-    (layer) => layer.seriesType === 'line' || layer.seriesType === 'area'
+  const hasNonBarSeries = state?.layers.some(({ seriesType }) =>
+    ['area_stacked', 'area', 'line'].includes(seriesType)
   );
 
   const [xAxisTitle, setXAxisTitle] = useState(state?.xTitle);
@@ -261,8 +261,7 @@ export function XyToolbar(props: VisualizationToolbarProps<State>) {
             content={
               !hasNonBarSeries &&
               i18n.translate('xpack.lens.xyChart.fittingDisabledHelpText', {
-                defaultMessage:
-                  'This setting only applies to line charts and unstacked area charts.',
+                defaultMessage: 'This setting only applies to line and area charts.',
               })
             }
           >
diff --git a/x-pack/plugins/lens/public/xy_visualization/xy_expression.test.tsx b/x-pack/plugins/lens/public/xy_visualization/xy_expression.test.tsx
index ba1ff6a1df030c..c9c27193c437e1 100644
--- a/x-pack/plugins/lens/public/xy_visualization/xy_expression.test.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/xy_expression.test.tsx
@@ -1414,7 +1414,7 @@ describe('xy_expression', () => {
       expect(convertSpy).toHaveBeenCalledWith('I');
     });
 
-    test('it should not pass the formatter function to the x axis if the visibility of the tick labels is off', () => {
+    test('it should set the tickLabel visibility on the x axis if the tick labels is hidden', () => {
       const { data, args } = sampleArgs();
 
       args.tickLabelsVisibilitySettings = { x: false, y: true, type: 'lens_xy_tickLabelsConfig' };
@@ -1432,15 +1432,94 @@ describe('xy_expression', () => {
         />
       );
 
-      const tickFormatter = instance.find(Axis).first().prop('tickFormat');
+      const axisStyle = instance.find(Axis).first().prop('style');
 
-      if (!tickFormatter) {
-        throw new Error('tickFormatter prop not found');
-      }
+      expect(axisStyle).toMatchObject({
+        tickLabel: {
+          visible: false,
+        },
+      });
+    });
 
-      tickFormatter('I');
+    test('it should set the tickLabel visibility on the y axis if the tick labels is hidden', () => {
+      const { data, args } = sampleArgs();
+
+      args.tickLabelsVisibilitySettings = { x: true, y: false, type: 'lens_xy_tickLabelsConfig' };
 
-      expect(convertSpy).toHaveBeenCalledTimes(0);
+      const instance = shallow(
+        <XYChart
+          data={{ ...data }}
+          args={{ ...args }}
+          formatFactory={getFormatSpy}
+          timeZone="UTC"
+          chartsThemeService={chartsThemeService}
+          histogramBarTarget={50}
+          onClickValue={onClickValue}
+          onSelectRange={onSelectRange}
+        />
+      );
+
+      const axisStyle = instance.find(Axis).at(1).prop('style');
+
+      expect(axisStyle).toMatchObject({
+        tickLabel: {
+          visible: false,
+        },
+      });
+    });
+
+    test('it should set the tickLabel visibility on the x axis if the tick labels is shown', () => {
+      const { data, args } = sampleArgs();
+
+      args.tickLabelsVisibilitySettings = { x: true, y: true, type: 'lens_xy_tickLabelsConfig' };
+
+      const instance = shallow(
+        <XYChart
+          data={{ ...data }}
+          args={{ ...args }}
+          formatFactory={getFormatSpy}
+          timeZone="UTC"
+          chartsThemeService={chartsThemeService}
+          histogramBarTarget={50}
+          onClickValue={onClickValue}
+          onSelectRange={onSelectRange}
+        />
+      );
+
+      const axisStyle = instance.find(Axis).first().prop('style');
+
+      expect(axisStyle).toMatchObject({
+        tickLabel: {
+          visible: true,
+        },
+      });
+    });
+
+    test('it should set the tickLabel visibility on the y axis if the tick labels is shown', () => {
+      const { data, args } = sampleArgs();
+
+      args.tickLabelsVisibilitySettings = { x: false, y: true, type: 'lens_xy_tickLabelsConfig' };
+
+      const instance = shallow(
+        <XYChart
+          data={{ ...data }}
+          args={{ ...args }}
+          formatFactory={getFormatSpy}
+          timeZone="UTC"
+          chartsThemeService={chartsThemeService}
+          histogramBarTarget={50}
+          onClickValue={onClickValue}
+          onSelectRange={onSelectRange}
+        />
+      );
+
+      const axisStyle = instance.find(Axis).at(1).prop('style');
+
+      expect(axisStyle).toMatchObject({
+        tickLabel: {
+          visible: true,
+        },
+      });
     });
 
     test('it should remove invalid rows', () => {
@@ -1766,8 +1845,7 @@ describe('xy_expression', () => {
       expect(component.find(BarSeries).prop('fit')).toEqual(undefined);
       expect(component.find(AreaSeries).at(0).prop('fit')).toEqual({ type: Fit.Carry });
       expect(component.find(AreaSeries).at(0).prop('stackAccessors')).toEqual([]);
-      // stacked area series doesn't get the fit prop
-      expect(component.find(AreaSeries).at(1).prop('fit')).toEqual(undefined);
+      expect(component.find(AreaSeries).at(1).prop('fit')).toEqual({ type: Fit.Carry });
       expect(component.find(AreaSeries).at(1).prop('stackAccessors')).toEqual(['c']);
     });
 
@@ -1831,7 +1909,13 @@ describe('xy_expression', () => {
         />
       );
 
-      expect(component.find(Axis).at(0).prop('title')).toEqual(undefined);
+      const axisStyle = component.find(Axis).first().prop('style');
+
+      expect(axisStyle).toMatchObject({
+        axisTitle: {
+          visible: false,
+        },
+      });
     });
 
     test('it should show the X axis gridlines if the setting is on', () => {
@@ -1852,7 +1936,9 @@ describe('xy_expression', () => {
         />
       );
 
-      expect(component.find(Axis).at(0).prop('showGridLines')).toBeTruthy();
+      expect(component.find(Axis).at(0).prop('gridLine')).toMatchObject({
+        visible: true,
+      });
     });
   });
 });
diff --git a/x-pack/plugins/lens/public/xy_visualization/xy_expression.tsx b/x-pack/plugins/lens/public/xy_visualization/xy_expression.tsx
index 2037a3dbe6623b..31873228fb3948 100644
--- a/x-pack/plugins/lens/public/xy_visualization/xy_expression.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/xy_expression.tsx
@@ -420,11 +420,21 @@ export function XYChart({
       <Axis
         id="x"
         position={shouldRotate ? Position.Left : Position.Bottom}
-        title={showXAxisTitle ? xTitle : undefined}
-        showGridLines={gridlinesVisibilitySettings?.x}
-        gridLineStyle={{ strokeWidth: 2 }}
+        title={xTitle}
+        gridLine={{
+          visible: gridlinesVisibilitySettings?.x,
+          strokeWidth: 2,
+        }}
         hide={filteredLayers[0].hide}
-        tickFormat={tickLabelsVisibilitySettings?.x ? (d) => xAxisFormatter.convert(d) : () => ''}
+        tickFormat={(d) => xAxisFormatter.convert(d)}
+        style={{
+          tickLabel: {
+            visible: tickLabelsVisibilitySettings?.x,
+          },
+          axisTitle: {
+            visible: showXAxisTitle,
+          },
+        }}
       />
 
       {yAxesConfiguration.map((axis, index) => (
@@ -433,10 +443,20 @@ export function XYChart({
           id={axis.groupId}
           groupId={axis.groupId}
           position={axis.position}
-          title={showYAxisTitle ? getYAxesTitles(axis.series, index) : undefined}
-          showGridLines={gridlinesVisibilitySettings?.y}
+          title={getYAxesTitles(axis.series, index)}
+          gridLine={{
+            visible: gridlinesVisibilitySettings?.y,
+          }}
           hide={filteredLayers[0].hide}
-          tickFormat={tickLabelsVisibilitySettings?.y ? (d) => axis.formatter.convert(d) : () => ''}
+          tickFormat={(d) => axis.formatter.convert(d)}
+          style={{
+            tickLabel: {
+              visible: tickLabelsVisibilitySettings?.y,
+            },
+            axisTitle: {
+              visible: showYAxisTitle,
+            },
+          }}
         />
       ))}
 
@@ -529,7 +549,9 @@ export function XYChart({
             case 'bar_horizontal_stacked':
               return <BarSeries key={index} {...seriesProps} />;
             case 'area_stacked':
-              return <AreaSeries key={index} {...seriesProps} />;
+              return (
+                <AreaSeries key={index} {...seriesProps} fit={getFitOptions(fittingFunction)} />
+              );
             case 'area':
               return (
                 <AreaSeries key={index} {...seriesProps} fit={getFitOptions(fittingFunction)} />
diff --git a/x-pack/plugins/licensing/public/services/feature_usage_service.mock.ts b/x-pack/plugins/licensing/public/services/feature_usage_service.mock.ts
index fc9d4f9381151a..b2390ea35c1407 100644
--- a/x-pack/plugins/licensing/public/services/feature_usage_service.mock.ts
+++ b/x-pack/plugins/licensing/public/services/feature_usage_service.mock.ts
@@ -15,6 +15,8 @@ const createSetupMock = (): jest.Mocked<FeatureUsageServiceSetup> => {
     register: jest.fn(),
   };
 
+  mock.register.mockImplementation(() => Promise.resolve());
+
   return mock;
 };
 
@@ -23,6 +25,8 @@ const createStartMock = (): jest.Mocked<FeatureUsageServiceStart> => {
     notifyUsage: jest.fn(),
   };
 
+  mock.notifyUsage.mockImplementation(() => Promise.resolve());
+
   return mock;
 };
 
diff --git a/x-pack/plugins/licensing/server/services/feature_usage_service.test.ts b/x-pack/plugins/licensing/server/services/feature_usage_service.test.ts
index 39f7aa6503b35e..943516dc0409a0 100644
--- a/x-pack/plugins/licensing/server/services/feature_usage_service.test.ts
+++ b/x-pack/plugins/licensing/server/services/feature_usage_service.test.ts
@@ -19,12 +19,22 @@ describe('FeatureUsageService', () => {
 
   describe('#setup', () => {
     describe('#register', () => {
-      it('throws when registering the same feature twice', () => {
+      it('does not throw when registering the same feature twice with the same license', () => {
         const setup = service.setup();
         setup.register('foo', 'basic');
         expect(() => {
           setup.register('foo', 'basic');
-        }).toThrowErrorMatchingInlineSnapshot(`"Feature 'foo' has already been registered."`);
+        }).not.toThrow();
+      });
+
+      it('throws when registering the same feature again with a different license', () => {
+        const setup = service.setup();
+        setup.register('foo', 'basic');
+        expect(() => {
+          setup.register('foo', 'enterprise');
+        }).toThrowErrorMatchingInlineSnapshot(
+          `"Feature 'foo' has already been registered with another license type. (current: basic, new: enterprise)"`
+        );
       });
     });
   });
diff --git a/x-pack/plugins/licensing/server/services/feature_usage_service.ts b/x-pack/plugins/licensing/server/services/feature_usage_service.ts
index 9bfcb28f36b2a9..75a0c7fa781087 100644
--- a/x-pack/plugins/licensing/server/services/feature_usage_service.ts
+++ b/x-pack/plugins/licensing/server/services/feature_usage_service.ts
@@ -43,14 +43,20 @@ export class FeatureUsageService {
   public setup(): FeatureUsageServiceSetup {
     return {
       register: (featureName, licenseType) => {
-        if (this.lastUsages.has(featureName)) {
-          throw new Error(`Feature '${featureName}' has already been registered.`);
+        const registered = this.lastUsages.get(featureName);
+        if (registered) {
+          if (registered.licenseType !== licenseType) {
+            throw new Error(
+              `Feature '${featureName}' has already been registered with another license type. (current: ${registered.licenseType}, new: ${licenseType})`
+            );
+          }
+        } else {
+          this.lastUsages.set(featureName, {
+            name: featureName,
+            lastUsed: null,
+            licenseType,
+          });
         }
-        this.lastUsages.set(featureName, {
-          name: featureName,
-          lastUsed: null,
-          licenseType,
-        });
       },
     };
   }
diff --git a/x-pack/plugins/lists/common/schemas/common/schemas.test.ts b/x-pack/plugins/lists/common/schemas/common/schemas.test.ts
index fad8ecc86277bd..ec3871b6738883 100644
--- a/x-pack/plugins/lists/common/schemas/common/schemas.test.ts
+++ b/x-pack/plugins/lists/common/schemas/common/schemas.test.ts
@@ -16,6 +16,8 @@ import {
   EsDataTypeRangeTerm,
   EsDataTypeSingle,
   EsDataTypeUnion,
+  ExceptionListTypeEnum,
+  OperatorEnum,
   Type,
   esDataTypeGeoPoint,
   esDataTypeGeoPointRange,
@@ -25,60 +27,10 @@ import {
   esDataTypeUnion,
   exceptionListType,
   operator,
-  operator_type as operatorType,
   type,
 } from './schemas';
 
 describe('Common schemas', () => {
-  describe('operatorType', () => {
-    test('it should validate for "match"', () => {
-      const payload = 'match';
-      const decoded = operatorType.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([]);
-      expect(message.schema).toEqual(payload);
-    });
-
-    test('it should validate for "match_any"', () => {
-      const payload = 'match_any';
-      const decoded = operatorType.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([]);
-      expect(message.schema).toEqual(payload);
-    });
-
-    test('it should validate for "list"', () => {
-      const payload = 'list';
-      const decoded = operatorType.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([]);
-      expect(message.schema).toEqual(payload);
-    });
-
-    test('it should validate for "exists"', () => {
-      const payload = 'exists';
-      const decoded = operatorType.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([]);
-      expect(message.schema).toEqual(payload);
-    });
-
-    test('it should contain 4 keys', () => {
-      // Might seem like a weird test, but its meant to
-      // ensure that if operatorType is updated, you
-      // also update the OperatorTypeEnum, a workaround
-      // for io-ts not yet supporting enums
-      // https://github.com/gcanti/io-ts/issues/67
-      const keys = Object.keys(operatorType.keys);
-
-      expect(keys.length).toEqual(4);
-    });
-  });
-
   describe('operator', () => {
     test('it should validate for "included"', () => {
       const payload = 'included';
@@ -98,15 +50,16 @@ describe('Common schemas', () => {
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should contain 2 keys', () => {
+    test('it should contain same amount of keys as enum', () => {
       // Might seem like a weird test, but its meant to
       // ensure that if operator is updated, you
       // also update the operatorEnum, a workaround
       // for io-ts not yet supporting enums
       // https://github.com/gcanti/io-ts/issues/67
-      const keys = Object.keys(operator.keys);
+      const keys = Object.keys(operator.keys).sort().join(',').toLowerCase();
+      const enumKeys = Object.keys(OperatorEnum).sort().join(',').toLowerCase();
 
-      expect(keys.length).toEqual(2);
+      expect(keys).toEqual(enumKeys);
     });
   });
 
@@ -129,15 +82,16 @@ describe('Common schemas', () => {
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should contain 2 keys', () => {
+    test('it should contain same amount of keys as enum', () => {
       // Might seem like a weird test, but its meant to
       // ensure that if exceptionListType is updated, you
       // also update the ExceptionListTypeEnum, a workaround
       // for io-ts not yet supporting enums
       // https://github.com/gcanti/io-ts/issues/67
-      const keys = Object.keys(exceptionListType.keys);
+      const keys = Object.keys(exceptionListType.keys).sort().join(',').toLowerCase();
+      const enumKeys = Object.keys(ExceptionListTypeEnum).sort().join(',').toLowerCase();
 
-      expect(keys.length).toEqual(2);
+      expect(keys).toEqual(enumKeys);
     });
   });
 
diff --git a/x-pack/plugins/lists/common/schemas/common/schemas.ts b/x-pack/plugins/lists/common/schemas/common/schemas.ts
index 1556ef5a5dab9d..37da5fbcd1a1b0 100644
--- a/x-pack/plugins/lists/common/schemas/common/schemas.ts
+++ b/x-pack/plugins/lists/common/schemas/common/schemas.ts
@@ -282,13 +282,6 @@ export enum OperatorEnum {
   EXCLUDED = 'excluded',
 }
 
-export const operator_type = t.keyof({
-  exists: null,
-  list: null,
-  match: null,
-  match_any: null,
-});
-export type OperatorType = t.TypeOf<typeof operator_type>;
 export enum OperatorTypeEnum {
   NESTED = 'nested',
   MATCH = 'match',
diff --git a/x-pack/plugins/lists/common/shared_exports.ts b/x-pack/plugins/lists/common/shared_exports.ts
index 1f6c65919b063a..361837bdef2291 100644
--- a/x-pack/plugins/lists/common/shared_exports.ts
+++ b/x-pack/plugins/lists/common/shared_exports.ts
@@ -25,7 +25,6 @@ export {
   NamespaceType,
   Operator,
   OperatorEnum,
-  OperatorType,
   OperatorTypeEnum,
   ExceptionListTypeEnum,
   comment,
diff --git a/x-pack/plugins/lists/public/exceptions/api.test.ts b/x-pack/plugins/lists/public/exceptions/api.test.ts
index 7e79b212f69cb8..0c31015fc9f5e0 100644
--- a/x-pack/plugins/lists/public/exceptions/api.test.ts
+++ b/x-pack/plugins/lists/public/exceptions/api.test.ts
@@ -375,6 +375,8 @@ describe('Exceptions Lists API', () => {
           namespace_type: 'single,single',
           page: '1',
           per_page: '20',
+          sort_field: 'exception-list.created_at',
+          sort_order: 'desc',
         },
         signal: abortCtrl.signal,
       });
@@ -406,6 +408,8 @@ describe('Exceptions Lists API', () => {
           namespace_type: 'single',
           page: '1',
           per_page: '20',
+          sort_field: 'exception-list.created_at',
+          sort_order: 'desc',
         },
         signal: abortCtrl.signal,
       });
@@ -437,6 +441,8 @@ describe('Exceptions Lists API', () => {
           namespace_type: 'agnostic',
           page: '1',
           per_page: '20',
+          sort_field: 'exception-list.created_at',
+          sort_order: 'desc',
         },
         signal: abortCtrl.signal,
       });
@@ -468,6 +474,8 @@ describe('Exceptions Lists API', () => {
           namespace_type: 'agnostic',
           page: '1',
           per_page: '20',
+          sort_field: 'exception-list.created_at',
+          sort_order: 'desc',
         },
         signal: abortCtrl.signal,
       });
@@ -500,6 +508,8 @@ describe('Exceptions Lists API', () => {
           namespace_type: 'agnostic',
           page: '1',
           per_page: '20',
+          sort_field: 'exception-list.created_at',
+          sort_order: 'desc',
         },
         signal: abortCtrl.signal,
       });
diff --git a/x-pack/plugins/lists/public/exceptions/api.ts b/x-pack/plugins/lists/public/exceptions/api.ts
index 203c84b2943fd5..824a25296260f0 100644
--- a/x-pack/plugins/lists/public/exceptions/api.ts
+++ b/x-pack/plugins/lists/public/exceptions/api.ts
@@ -288,6 +288,8 @@ export const fetchExceptionListsItemsByListIds = async ({
     namespace_type: namespaceTypes.join(','),
     page: pagination.page ? `${pagination.page}` : '1',
     per_page: pagination.perPage ? `${pagination.perPage}` : '20',
+    sort_field: 'exception-list.created_at',
+    sort_order: 'desc',
     ...(filters.trim() !== '' ? { filter: filters } : {}),
   };
   const [validatedRequest, errorsRequest] = validate(query, findExceptionListItemSchema);
diff --git a/x-pack/plugins/lists/server/scripts/exception_lists/new/trusted_app_list_item_agnostic.json b/x-pack/plugins/lists/server/scripts/exception_lists/new/trusted_app_list_item_agnostic.json
new file mode 100644
index 00000000000000..9f0c306a408f0d
--- /dev/null
+++ b/x-pack/plugins/lists/server/scripts/exception_lists/new/trusted_app_list_item_agnostic.json
@@ -0,0 +1,18 @@
+{
+  "list_id": "endpoint_trusted_apps",
+  "item_id": "endpoint_trusted_apps_item",
+  "_tags": ["endpoint",  "os:linux", "os:windows", "os:macos", "trusted-app"],
+  "tags": ["user added string for a tag", "malware"],
+  "type": "simple",
+  "description": "This is a sample agnostic endpoint trusted app entry",
+  "name": "Sample Endpoint Trusted App Entry",
+  "namespace_type": "agnostic",
+  "entries": [
+    {
+      "field": "actingProcess.file.signer",
+      "operator": "included",
+      "type": "match",
+      "value": "Elastic, N.V."
+    }
+  ]
+}
diff --git a/x-pack/plugins/logstash/public/application/components/pipeline_editor/pipeline_editor.js b/x-pack/plugins/logstash/public/application/components/pipeline_editor/pipeline_editor.js
index 694e50cfe3e366..6cb1f87648da15 100644
--- a/x-pack/plugins/logstash/public/application/components/pipeline_editor/pipeline_editor.js
+++ b/x-pack/plugins/logstash/public/application/components/pipeline_editor/pipeline_editor.js
@@ -125,11 +125,11 @@ class PipelineEditorUi extends React.Component {
 
   onPipelineSave = () => {
     const { pipelineService, toastNotifications, intl } = this.props;
-    const { id } = this.state.pipeline;
+    const { id, ...pipelineToStore } = this.state.pipeline;
     return pipelineService
       .savePipeline({
         id,
-        upstreamJSON: this.state.pipeline,
+        upstreamJSON: pipelineToStore,
       })
       .then(() => {
         toastNotifications.addSuccess(
diff --git a/x-pack/plugins/logstash/server/models/pipeline/pipeline.ts b/x-pack/plugins/logstash/server/models/pipeline/pipeline.ts
index 8ce04c83afdbf3..0b7c3888b6f03c 100755
--- a/x-pack/plugins/logstash/server/models/pipeline/pipeline.ts
+++ b/x-pack/plugins/logstash/server/models/pipeline/pipeline.ts
@@ -11,14 +11,14 @@ import { i18n } from '@kbn/i18n';
 
 interface PipelineOptions {
   id: string;
-  description: string;
+  description?: string;
   pipeline: string;
   username?: string;
   settings?: Record<string, any>;
 }
 
 interface DownstreamPipeline {
-  description: string;
+  description?: string;
   pipeline: string;
   settings?: Record<string, any>;
 }
@@ -27,7 +27,7 @@ interface DownstreamPipeline {
  */
 export class Pipeline {
   public readonly id: string;
-  public readonly description: string;
+  public readonly description?: string;
   public readonly username?: string;
   public readonly pipeline: string;
   private readonly settings: Record<string, any>;
diff --git a/x-pack/plugins/logstash/server/routes/pipeline/save.ts b/x-pack/plugins/logstash/server/routes/pipeline/save.ts
index e484d0e221b6d1..755a82e670a2a7 100644
--- a/x-pack/plugins/logstash/server/routes/pipeline/save.ts
+++ b/x-pack/plugins/logstash/server/routes/pipeline/save.ts
@@ -22,8 +22,7 @@ export function registerPipelineSaveRoute(router: IRouter, security?: SecurityPl
           id: schema.string(),
         }),
         body: schema.object({
-          id: schema.string(),
-          description: schema.string(),
+          description: schema.maybe(schema.string()),
           pipeline: schema.string(),
           settings: schema.maybe(schema.object({}, { unknowns: 'allow' })),
         }),
diff --git a/x-pack/plugins/maps/common/constants.ts b/x-pack/plugins/maps/common/constants.ts
index 363122ac62212a..a4f20caedfc9bd 100644
--- a/x-pack/plugins/maps/common/constants.ts
+++ b/x-pack/plugins/maps/common/constants.ts
@@ -33,6 +33,12 @@ export const MAP_PATH = 'map';
 export const GIS_API_PATH = `api/${APP_ID}`;
 export const INDEX_SETTINGS_API_PATH = `${GIS_API_PATH}/indexSettings`;
 export const FONTS_API_PATH = `${GIS_API_PATH}/fonts`;
+export const API_ROOT_PATH = `/${GIS_API_PATH}`;
+
+export const MVT_GETTILE_API_PATH = 'mvt/getTile';
+export const MVT_SOURCE_LAYER_NAME = 'source_layer';
+export const KBN_TOO_MANY_FEATURES_PROPERTY = '__kbn_too_many_features__';
+export const KBN_TOO_MANY_FEATURES_IMAGE_ID = '__kbn_too_many_features_image_id__';
 
 const MAP_BASE_URL = `/${MAPS_APP_PATH}/${MAP_PATH}`;
 export function getNewMapPath() {
@@ -220,6 +226,7 @@ export enum SCALING_TYPES {
   LIMIT = 'LIMIT',
   CLUSTERS = 'CLUSTERS',
   TOP_HITS = 'TOP_HITS',
+  MVT = 'MVT',
 }
 
 export const RGBA_0000 = 'rgba(0,0,0,0)';
diff --git a/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts b/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
index cd7d2d5d0f461f..f3521cca2e456f 100644
--- a/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
+++ b/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
@@ -18,7 +18,6 @@ export type MapFilters = {
   refreshTimerLastTriggeredAt?: string;
   timeFilters: TimeRange;
   zoom: number;
-  geogridPrecision?: number;
 };
 
 type ESSearchSourceSyncMeta = {
diff --git a/x-pack/plugins/maps/common/elasticsearch_geo_utils.d.ts b/x-pack/plugins/maps/common/elasticsearch_geo_utils.d.ts
index 44250360e9d00a..e57efca94d95e7 100644
--- a/x-pack/plugins/maps/common/elasticsearch_geo_utils.d.ts
+++ b/x-pack/plugins/maps/common/elasticsearch_geo_utils.d.ts
@@ -4,7 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { FeatureCollection, GeoJsonProperties } from 'geojson';
 import { MapExtent } from './descriptor_types';
+import { ES_GEO_FIELD_TYPE } from './constants';
 
 export function scaleBounds(bounds: MapExtent, scaleFactor: number): MapExtent;
 
@@ -13,3 +15,11 @@ export function turfBboxToBounds(turfBbox: unknown): MapExtent;
 export function clampToLatBounds(lat: number): number;
 
 export function clampToLonBounds(lon: number): number;
+
+export function hitsToGeoJson(
+  hits: Array<Record<string, unknown>>,
+  flattenHit: (elasticSearchHit: Record<string, unknown>) => GeoJsonProperties,
+  geoFieldName: string,
+  geoFieldType: ES_GEO_FIELD_TYPE,
+  epochMillisFields: string[]
+): FeatureCollection;
diff --git a/x-pack/plugins/maps/public/actions/map_actions.ts b/x-pack/plugins/maps/public/actions/map_actions.ts
index f4088968531558..b00594cb7fb23f 100644
--- a/x-pack/plugins/maps/public/actions/map_actions.ts
+++ b/x-pack/plugins/maps/public/actions/map_actions.ts
@@ -271,7 +271,7 @@ export function triggerRefreshTimer() {
   };
 }
 
-export function updateDrawState(drawState: DrawState) {
+export function updateDrawState(drawState: DrawState | null) {
   return (dispatch: Dispatch) => {
     if (drawState !== null) {
       dispatch({ type: SET_OPEN_TOOLTIPS, openTooltips: [] }); // tooltips just get in the way
diff --git a/x-pack/plugins/maps/public/classes/fields/es_doc_field.ts b/x-pack/plugins/maps/public/classes/fields/es_doc_field.ts
index 9faa33fae5a431..543dbf6d87039c 100644
--- a/x-pack/plugins/maps/public/classes/fields/es_doc_field.ts
+++ b/x-pack/plugins/maps/public/classes/fields/es_doc_field.ts
@@ -15,18 +15,22 @@ import { IVectorSource } from '../sources/vector_source';
 
 export class ESDocField extends AbstractField implements IField {
   private readonly _source: IESSource;
+  private readonly _canReadFromGeoJson: boolean;
 
   constructor({
     fieldName,
     source,
     origin,
+    canReadFromGeoJson = true,
   }: {
     fieldName: string;
     source: IESSource;
     origin: FIELD_ORIGIN;
+    canReadFromGeoJson?: boolean;
   }) {
     super({ fieldName, origin });
     this._source = source;
+    this._canReadFromGeoJson = canReadFromGeoJson;
   }
 
   canValueBeFormatted(): boolean {
@@ -60,6 +64,10 @@ export class ESDocField extends AbstractField implements IField {
     return true;
   }
 
+  canReadFromGeoJson(): boolean {
+    return this._canReadFromGeoJson;
+  }
+
   async getOrdinalFieldMetaRequest(): Promise<unknown> {
     const indexPatternField = await this._getIndexPatternField();
 
diff --git a/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.test.tsx b/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.test.tsx
index faae26cac08e71..822b78aa0deffa 100644
--- a/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.test.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.test.tsx
@@ -128,32 +128,41 @@ describe('syncData', () => {
     sinon.assert.notCalled(syncContext2.stopLoading);
   });
 
-  it('Should resync when changes to source params', async () => {
-    const layer1: TiledVectorLayer = createLayer({}, {});
-    const syncContext1 = new MockSyncContext({ dataFilters: {} });
-
-    await layer1.syncData(syncContext1);
-
-    const dataRequestDescriptor: DataRequestDescriptor = {
-      data: defaultConfig,
-      dataId: 'source',
-    };
-    const layer2: TiledVectorLayer = createLayer(
-      {
-        __dataRequests: [dataRequestDescriptor],
-      },
-      { layerName: 'barfoo' }
-    );
-    const syncContext2 = new MockSyncContext({ dataFilters: {} });
-    await layer2.syncData(syncContext2);
-
-    // @ts-expect-error
-    sinon.assert.calledOnce(syncContext2.startLoading);
-    // @ts-expect-error
-    sinon.assert.calledOnce(syncContext2.stopLoading);
-
-    // @ts-expect-error
-    const call = syncContext2.stopLoading.getCall(0);
-    expect(call.args[2]).toEqual({ ...defaultConfig, layerName: 'barfoo' });
+  describe('Should resync when changes to source params: ', () => {
+    [
+      { layerName: 'barfoo' },
+      { urlTemplate: 'https://sub.example.com/{z}/{x}/{y}.pbf' },
+      { minSourceZoom: 1 },
+      { maxSourceZoom: 12 },
+    ].forEach((changes) => {
+      it(`change in ${Object.keys(changes).join(',')}`, async () => {
+        const layer1: TiledVectorLayer = createLayer({}, {});
+        const syncContext1 = new MockSyncContext({ dataFilters: {} });
+
+        await layer1.syncData(syncContext1);
+
+        const dataRequestDescriptor: DataRequestDescriptor = {
+          data: defaultConfig,
+          dataId: 'source',
+        };
+        const layer2: TiledVectorLayer = createLayer(
+          {
+            __dataRequests: [dataRequestDescriptor],
+          },
+          changes
+        );
+        const syncContext2 = new MockSyncContext({ dataFilters: {} });
+        await layer2.syncData(syncContext2);
+
+        // @ts-expect-error
+        sinon.assert.calledOnce(syncContext2.startLoading);
+        // @ts-expect-error
+        sinon.assert.calledOnce(syncContext2.stopLoading);
+
+        // @ts-expect-error
+        const call = syncContext2.stopLoading.getCall(0);
+        expect(call.args[2]).toEqual({ ...defaultConfig, ...changes });
+      });
+    });
   });
 });
diff --git a/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.tsx b/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.tsx
index c9ae1c805fa306..70bf8ea3883b72 100644
--- a/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/tiled_vector_layer/tiled_vector_layer.tsx
@@ -63,21 +63,24 @@ export class TiledVectorLayer extends VectorLayer {
     );
     const prevDataRequest = this.getSourceDataRequest();
 
+    const templateWithMeta = await this._source.getUrlTemplateWithMeta(searchFilters);
     if (prevDataRequest) {
       const data: MVTSingleLayerVectorSourceConfig = prevDataRequest.getData() as MVTSingleLayerVectorSourceConfig;
-      const canSkipBecauseNoChanges =
-        data.layerName === this._source.getLayerName() &&
-        data.minSourceZoom === this._source.getMinZoom() &&
-        data.maxSourceZoom === this._source.getMaxZoom();
-
-      if (canSkipBecauseNoChanges) {
-        return null;
+      if (data) {
+        const canSkipBecauseNoChanges =
+          data.layerName === this._source.getLayerName() &&
+          data.minSourceZoom === this._source.getMinZoom() &&
+          data.maxSourceZoom === this._source.getMaxZoom() &&
+          data.urlTemplate === templateWithMeta.urlTemplate;
+
+        if (canSkipBecauseNoChanges) {
+          return null;
+        }
       }
     }
 
     startLoading(SOURCE_DATA_REQUEST_ID, requestToken, searchFilters);
     try {
-      const templateWithMeta = await this._source.getUrlTemplateWithMeta();
       stopLoading(SOURCE_DATA_REQUEST_ID, requestToken, templateWithMeta, {});
     } catch (error) {
       onLoadError(SOURCE_DATA_REQUEST_ID, requestToken, error.message);
@@ -160,6 +163,11 @@ export class TiledVectorLayer extends VectorLayer {
       return false;
     }
 
+    if (!mbTileSource.tiles) {
+      // Expected source is not compatible, so remove.
+      return true;
+    }
+
     const isSourceDifferent =
       mbTileSource.tiles[0] !== tiledSourceMeta.urlTemplate ||
       mbTileSource.minzoom !== tiledSourceMeta.minSourceZoom ||
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.js b/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.js
index 2ba7f750e9b409..c49d0044e6ad60 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.js
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.js
@@ -15,9 +15,11 @@ import {
   SOURCE_BOUNDS_DATA_REQUEST_ID,
   FEATURE_VISIBLE_PROPERTY_NAME,
   EMPTY_FEATURE_COLLECTION,
+  KBN_TOO_MANY_FEATURES_PROPERTY,
   LAYER_TYPE,
   FIELD_ORIGIN,
   LAYER_STYLE_TYPE,
+  KBN_TOO_MANY_FEATURES_IMAGE_ID,
 } from '../../../../common/constants';
 import _ from 'lodash';
 import { JoinTooltipProperty } from '../../tooltips/join_tooltip_property';
@@ -777,6 +779,8 @@ export class VectorLayer extends AbstractLayer {
     const sourceId = this.getId();
     const fillLayerId = this._getMbPolygonLayerId();
     const lineLayerId = this._getMbLineLayerId();
+    const tooManyFeaturesLayerId = this._getMbTooManyFeaturesLayerId();
+
     const hasJoins = this.hasJoins();
     if (!mbMap.getLayer(fillLayerId)) {
       const mbLayer = {
@@ -802,6 +806,30 @@ export class VectorLayer extends AbstractLayer {
       }
       mbMap.addLayer(mbLayer);
     }
+    if (!mbMap.getLayer(tooManyFeaturesLayerId)) {
+      const mbLayer = {
+        id: tooManyFeaturesLayerId,
+        type: 'fill',
+        source: sourceId,
+        paint: {},
+      };
+      if (mvtSourceLayer) {
+        mbLayer['source-layer'] = mvtSourceLayer;
+      }
+      mbMap.addLayer(mbLayer);
+      mbMap.setFilter(tooManyFeaturesLayerId, [
+        '==',
+        ['get', KBN_TOO_MANY_FEATURES_PROPERTY],
+        true,
+      ]);
+      mbMap.setPaintProperty(
+        tooManyFeaturesLayerId,
+        'fill-pattern',
+        KBN_TOO_MANY_FEATURES_IMAGE_ID
+      );
+      mbMap.setPaintProperty(tooManyFeaturesLayerId, 'fill-opacity', this.getAlpha());
+    }
+
     this.getCurrentStyle().setMBPaintProperties({
       alpha: this.getAlpha(),
       mbMap,
@@ -822,6 +850,9 @@ export class VectorLayer extends AbstractLayer {
     if (lineFilterExpr !== mbMap.getFilter(lineLayerId)) {
       mbMap.setFilter(lineLayerId, lineFilterExpr);
     }
+
+    this.syncVisibilityWithMb(mbMap, tooManyFeaturesLayerId);
+    mbMap.setLayerZoomRange(tooManyFeaturesLayerId, this.getMinZoom(), this.getMaxZoom());
   }
 
   _syncStylePropertiesWithMb(mbMap) {
@@ -836,6 +867,19 @@ export class VectorLayer extends AbstractLayer {
         type: 'geojson',
         data: EMPTY_FEATURE_COLLECTION,
       });
+    } else if (mbSource.type !== 'geojson') {
+      // Recreate source when existing source is not geojson. This can occur when layer changes from tile layer to vector layer.
+      this.getMbLayerIds().forEach((mbLayerId) => {
+        if (mbMap.getLayer(mbLayerId)) {
+          mbMap.removeLayer(mbLayerId);
+        }
+      });
+
+      mbMap.removeSource(this._getMbSourceId());
+      mbMap.addSource(this._getMbSourceId(), {
+        type: 'geojson',
+        data: EMPTY_FEATURE_COLLECTION,
+      });
     }
   }
 
@@ -865,6 +909,10 @@ export class VectorLayer extends AbstractLayer {
     return this.makeMbLayerId('fill');
   }
 
+  _getMbTooManyFeaturesLayerId() {
+    return this.makeMbLayerId('toomanyfeatures');
+  }
+
   getMbLayerIds() {
     return [
       this._getMbPointLayerId(),
@@ -872,6 +920,7 @@ export class VectorLayer extends AbstractLayer {
       this._getMbSymbolLayerId(),
       this._getMbLineLayerId(),
       this._getMbPolygonLayerId(),
+      this._getMbTooManyFeaturesLayerId(),
     ];
   }
 
diff --git a/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.test.tsx b/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.test.tsx
index 52524d0c9a5fae..c5d6ced76b5c01 100644
--- a/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.test.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.test.tsx
@@ -6,7 +6,6 @@
 
 import { EMSFileSource } from './ems_file_source';
 
-jest.mock('ui/new_platform');
 jest.mock('../../layers/vector_layer/vector_layer', () => {});
 
 function makeEMSFileSource(tooltipProperties: string[]) {
diff --git a/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.test.ts b/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.test.ts
index 87abbedfdf50e2..cf0170ab7f1bdd 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.test.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.test.ts
@@ -11,8 +11,6 @@ import _ from 'lodash';
 import { AGG_TYPE } from '../../../../common/constants';
 import { AggDescriptor } from '../../../../common/descriptor_types';
 
-jest.mock('ui/new_platform');
-
 const sumFieldName = 'myFieldGettingSummed';
 const metricExamples = [
   {
diff --git a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts
index 37193e148bdc7f..2e0ba7cf3efee0 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts
@@ -3,10 +3,9 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { MapExtent, MapFilters } from '../../../../common/descriptor_types';
+import { MapExtent, VectorSourceRequestMeta } from '../../../../common/descriptor_types';
 
 jest.mock('../../../kibana_services');
-jest.mock('ui/new_platform');
 
 import { getIndexPatternService, getSearchService } from '../../../kibana_services';
 import { ESGeoGridSource } from './es_geo_grid_source';
@@ -20,6 +19,7 @@ import { SearchSource } from '../../../../../../../src/plugins/data/public/searc
 
 export class MockSearchSource {
   setField = jest.fn();
+  setParent() {}
 }
 
 describe('ESGeoGridSource', () => {
@@ -105,6 +105,9 @@ describe('ESGeoGridSource', () => {
           async create() {
             return mockSearchSource as SearchSource;
           },
+          createEmpty() {
+            return mockSearchSource as SearchSource;
+          },
         },
       };
 
@@ -121,7 +124,7 @@ describe('ESGeoGridSource', () => {
       maxLat: 80,
     };
 
-    const mapFilters: MapFilters = {
+    const mapFilters: VectorSourceRequestMeta = {
       geogridPrecision: 4,
       filters: [],
       timeFilters: {
@@ -129,8 +132,16 @@ describe('ESGeoGridSource', () => {
         to: '15m',
         mode: 'relative',
       },
-      // extent,
+      extent,
+      applyGlobalQuery: true,
+      fieldNames: [],
       buffer: extent,
+      sourceQuery: {
+        query: '',
+        language: 'KQL',
+        queryLastTriggeredAt: '2019-04-25T20:53:22.331Z',
+      },
+      sourceMeta: null,
       zoom: 0,
     };
 
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/__snapshots__/scaling_form.test.tsx.snap b/x-pack/plugins/maps/public/classes/sources/es_search_source/__snapshots__/scaling_form.test.tsx.snap
index 8ebb389472f74c..dd62be11c679db 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/__snapshots__/scaling_form.test.tsx.snap
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/__snapshots__/scaling_form.test.tsx.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`should disable clusters option when clustering is not supported 1`] = `
+exports[`scaling form should disable clusters option when clustering is not supported 1`] = `
 <Fragment>
   <EuiTitle
     size="xs"
@@ -50,6 +50,106 @@ exports[`should disable clusters option when clustering is not supported 1`] = `
           onChange={[Function]}
         />
       </EuiToolTip>
+      <EuiToolTip
+        content={
+          <React.Fragment>
+            <EuiBetaBadge
+              label="beta"
+            />
+            <EuiHorizontalRule
+              margin="xs"
+            />
+            Use vector tiles for faster display of large datasets.
+          </React.Fragment>
+        }
+        delay="regular"
+        position="left"
+      >
+        <EuiRadio
+          checked={false}
+          disabled={false}
+          id="MVT"
+          label="Use vector tiles"
+          onChange={[Function]}
+        />
+      </EuiToolTip>
+    </div>
+  </EuiFormRow>
+  <EuiFormRow
+    describedByIds={Array []}
+    display="row"
+    fullWidth={false}
+    hasChildLabel={true}
+    hasEmptyLabelSpace={false}
+    labelType="label"
+  >
+    <EuiSwitch
+      checked={true}
+      compressed={true}
+      label="Dynamically filter for data in the visible map area"
+      onChange={[Function]}
+    />
+  </EuiFormRow>
+</Fragment>
+`;
+
+exports[`scaling form should disable mvt option when mvt is not supported 1`] = `
+<Fragment>
+  <EuiTitle
+    size="xs"
+  >
+    <h5>
+      <FormattedMessage
+        defaultMessage="Scaling"
+        id="xpack.maps.esSearch.scaleTitle"
+        values={Object {}}
+      />
+    </h5>
+  </EuiTitle>
+  <EuiSpacer
+    size="m"
+  />
+  <EuiFormRow
+    describedByIds={Array []}
+    display="row"
+    fullWidth={false}
+    hasChildLabel={true}
+    hasEmptyLabelSpace={false}
+    labelType="label"
+  >
+    <div>
+      <EuiRadio
+        checked={true}
+        id="LIMIT"
+        label="Limit results to 10000."
+        onChange={[Function]}
+      />
+      <EuiRadio
+        checked={false}
+        id="TOP_HITS"
+        label="Show top hits per entity."
+        onChange={[Function]}
+      />
+      <EuiRadio
+        checked={false}
+        disabled={false}
+        id="CLUSTERS"
+        label="Show clusters when results exceed 10000."
+        onChange={[Function]}
+      />
+      <EuiToolTip
+        content="Simulated mvt disabled"
+        delay="regular"
+        position="left"
+      >
+        <EuiRadio
+          checked={false}
+          disabled={true}
+          id="MVT"
+          label="Use vector tiles"
+          onChange={[Function]}
+        />
+      </EuiToolTip>
     </div>
   </EuiFormRow>
   <EuiFormRow
@@ -70,7 +170,7 @@ exports[`should disable clusters option when clustering is not supported 1`] = `
 </Fragment>
 `;
 
-exports[`should render 1`] = `
+exports[`scaling form should render 1`] = `
 <Fragment>
   <EuiTitle
     size="xs"
@@ -114,6 +214,29 @@ exports[`should render 1`] = `
         label="Show clusters when results exceed 10000."
         onChange={[Function]}
       />
+      <EuiToolTip
+        content={
+          <React.Fragment>
+            <EuiBetaBadge
+              label="beta"
+            />
+            <EuiHorizontalRule
+              margin="xs"
+            />
+            Use vector tiles for faster display of large datasets.
+          </React.Fragment>
+        }
+        delay="regular"
+        position="left"
+      >
+        <EuiRadio
+          checked={false}
+          disabled={false}
+          id="MVT"
+          label="Use vector tiles"
+          onChange={[Function]}
+        />
+      </EuiToolTip>
     </div>
   </EuiFormRow>
   <EuiFormRow
@@ -134,7 +257,7 @@ exports[`should render 1`] = `
 </Fragment>
 `;
 
-exports[`should render top hits form when scaling type is TOP_HITS 1`] = `
+exports[`scaling form should render top hits form when scaling type is TOP_HITS 1`] = `
 <Fragment>
   <EuiTitle
     size="xs"
@@ -178,6 +301,29 @@ exports[`should render top hits form when scaling type is TOP_HITS 1`] = `
         label="Show clusters when results exceed 10000."
         onChange={[Function]}
       />
+      <EuiToolTip
+        content={
+          <React.Fragment>
+            <EuiBetaBadge
+              label="beta"
+            />
+            <EuiHorizontalRule
+              margin="xs"
+            />
+            Use vector tiles for faster display of large datasets.
+          </React.Fragment>
+        }
+        delay="regular"
+        position="left"
+      >
+        <EuiRadio
+          checked={false}
+          disabled={false}
+          id="MVT"
+          label="Use vector tiles"
+          onChange={[Function]}
+        />
+      </EuiToolTip>
     </div>
   </EuiFormRow>
   <EuiFormRow
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap b/x-pack/plugins/maps/public/classes/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap
index 0cb7f67fb9c92b..8eb8067368d630 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap
@@ -92,11 +92,14 @@ exports[`should enable sort order select when sort field provided 1`] = `
   />
   <EuiPanel>
     <ScalingForm
+      clusteringDisabledReason={null}
       filterByMapBounds={true}
       indexPatternId="indexPattern1"
+      mvtDisabledReason={null}
       onChange={[Function]}
       scalingType="LIMIT"
       supportsClustering={false}
+      supportsMvt={false}
       termFields={null}
       topHitsSize={1}
       topHitsSplitField="trackId"
@@ -199,11 +202,14 @@ exports[`should render update source editor 1`] = `
   />
   <EuiPanel>
     <ScalingForm
+      clusteringDisabledReason={null}
       filterByMapBounds={true}
       indexPatternId="indexPattern1"
+      mvtDisabledReason={null}
       onChange={[Function]}
       scalingType="LIMIT"
       supportsClustering={false}
+      supportsMvt={false}
       termFields={null}
       topHitsSize={1}
       topHitsSplitField="trackId"
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/create_source_editor.js b/x-pack/plugins/maps/public/classes/sources/es_search_source/create_source_editor.js
index 0423d70b3f4276..29cac809799e9b 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/create_source_editor.js
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/create_source_editor.js
@@ -19,6 +19,8 @@ import {
   getTermsFields,
   getGeoTileAggNotSupportedReason,
   supportsGeoTileAgg,
+  supportsMvt,
+  getMvtDisabledReason,
 } from '../../../index_pattern_util';
 
 function doesGeoFieldSupportGeoTileAgg(indexPattern, geoFieldName) {
@@ -147,6 +149,7 @@ export class CreateSourceEditor extends Component {
       return null;
     }
 
+    const mvtSupported = supportsMvt(this.state.indexPattern, this.state.geoFieldName);
     return (
       <Fragment>
         <EuiSpacer size="m" />
@@ -159,6 +162,8 @@ export class CreateSourceEditor extends Component {
             this.state.indexPattern,
             this.state.geoFieldName
           )}
+          supportsMvt={mvtSupported}
+          mvtDisabledReason={mvtSupported ? null : getMvtDisabledReason()}
           clusteringDisabledReason={
             this.state.indexPattern
               ? getGeoTileAggNotSupportedReason(
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_documents_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_documents_layer_wizard.tsx
index 1ec6d2a1ff6716..249b9a2454d7d5 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_documents_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_documents_layer_wizard.tsx
@@ -14,13 +14,18 @@ import { ESSearchSource, sourceTitle } from './es_search_source';
 import { BlendedVectorLayer } from '../../layers/blended_vector_layer/blended_vector_layer';
 import { VectorLayer } from '../../layers/vector_layer/vector_layer';
 import { LAYER_WIZARD_CATEGORY, SCALING_TYPES } from '../../../../common/constants';
+import { TiledVectorLayer } from '../../layers/tiled_vector_layer/tiled_vector_layer';
 
 export function createDefaultLayerDescriptor(sourceConfig: unknown, mapColors: string[]) {
   const sourceDescriptor = ESSearchSource.createDescriptor(sourceConfig);
 
-  return sourceDescriptor.scalingType === SCALING_TYPES.CLUSTERS
-    ? BlendedVectorLayer.createDescriptor({ sourceDescriptor }, mapColors)
-    : VectorLayer.createDescriptor({ sourceDescriptor }, mapColors);
+  if (sourceDescriptor.scalingType === SCALING_TYPES.CLUSTERS) {
+    return BlendedVectorLayer.createDescriptor({ sourceDescriptor }, mapColors);
+  } else if (sourceDescriptor.scalingType === SCALING_TYPES.MVT) {
+    return TiledVectorLayer.createDescriptor({ sourceDescriptor }, mapColors);
+  } else {
+    return VectorLayer.createDescriptor({ sourceDescriptor }, mapColors);
+  }
 }
 
 export const esDocumentsLayerWizardConfig: LayerWizard = {
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.d.ts b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.d.ts
index 23e3c759d73c39..67d68dc065b006 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.d.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.d.ts
@@ -5,11 +5,22 @@
  */
 
 import { AbstractESSource } from '../es_source';
-import { ESSearchSourceDescriptor } from '../../../../common/descriptor_types';
+import { ESSearchSourceDescriptor, MapFilters } from '../../../../common/descriptor_types';
+import { ITiledSingleLayerVectorSource } from '../vector_source';
 
-export class ESSearchSource extends AbstractESSource {
+export class ESSearchSource extends AbstractESSource implements ITiledSingleLayerVectorSource {
   static createDescriptor(sourceConfig: unknown): ESSearchSourceDescriptor;
 
   constructor(sourceDescriptor: Partial<ESSearchSourceDescriptor>, inspectorAdapters: unknown);
   getFieldNames(): string[];
+
+  getUrlTemplateWithMeta(
+    searchFilters: MapFilters
+  ): Promise<{
+    layerName: string;
+    urlTemplate: string;
+    minSourceZoom: number;
+    maxSourceZoom: number;
+  }>;
+  getLayerName(): string;
 }
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.js b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.js
index 6d61c4a7455b21..7ac2738eaeb51f 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.js
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.js
@@ -6,9 +6,10 @@
 
 import _ from 'lodash';
 import React from 'react';
+import rison from 'rison-node';
 
 import { AbstractESSource } from '../es_source';
-import { getSearchService } from '../../../kibana_services';
+import { getSearchService, getHttp } from '../../../kibana_services';
 import { hitsToGeoJson } from '../../../../common/elasticsearch_geo_utils';
 import { UpdateSourceEditor } from './update_source_editor';
 import {
@@ -18,6 +19,9 @@ import {
   SORT_ORDER,
   SCALING_TYPES,
   VECTOR_SHAPE_TYPE,
+  MVT_SOURCE_LAYER_NAME,
+  GIS_API_PATH,
+  MVT_GETTILE_API_PATH,
 } from '../../../../common/constants';
 import { i18n } from '@kbn/i18n';
 import { getDataSourceLabel } from '../../../../common/i18n_getters';
@@ -96,6 +100,7 @@ export class ESSearchSource extends AbstractESSource {
     return new ESDocField({
       fieldName,
       source: this,
+      canReadFromGeoJson: this._descriptor.scalingType !== SCALING_TYPES.MVT,
     });
   }
 
@@ -448,9 +453,13 @@ export class ESSearchSource extends AbstractESSource {
   }
 
   isFilterByMapBounds() {
-    return this._descriptor.scalingType === SCALING_TYPES.CLUSTER
-      ? true
-      : this._descriptor.filterByMapBounds;
+    if (this._descriptor.scalingType === SCALING_TYPES.CLUSTER) {
+      return true;
+    } else if (this._descriptor.scalingType === SCALING_TYPES.MVT) {
+      return false;
+    } else {
+      return this._descriptor.filterByMapBounds;
+    }
   }
 
   async getLeftJoinFields() {
@@ -553,11 +562,65 @@ export class ESSearchSource extends AbstractESSource {
   }
 
   getJoinsDisabledReason() {
-    return this._descriptor.scalingType === SCALING_TYPES.CLUSTERS
-      ? i18n.translate('xpack.maps.source.esSearch.joinsDisabledReason', {
-          defaultMessage: 'Joins are not supported when scaling by clusters',
-        })
-      : null;
+    let reason;
+    if (this._descriptor.scalingType === SCALING_TYPES.CLUSTERS) {
+      reason = i18n.translate('xpack.maps.source.esSearch.joinsDisabledReason', {
+        defaultMessage: 'Joins are not supported when scaling by clusters',
+      });
+    } else if (this._descriptor.scalingType === SCALING_TYPES.MVT) {
+      reason = i18n.translate('xpack.maps.source.esSearch.joinsDisabledReasonMvt', {
+        defaultMessage: 'Joins are not supported when scaling by mvt vector tiles',
+      });
+    } else {
+      reason = null;
+    }
+    return reason;
+  }
+
+  getLayerName() {
+    return MVT_SOURCE_LAYER_NAME;
+  }
+
+  async getUrlTemplateWithMeta(searchFilters) {
+    const indexPattern = await this.getIndexPattern();
+    const indexSettings = await loadIndexSettings(indexPattern.title);
+
+    const { docValueFields, sourceOnlyFields } = getDocValueAndSourceFields(
+      indexPattern,
+      searchFilters.fieldNames
+    );
+
+    const initialSearchContext = { docvalue_fields: docValueFields }; // Request fields in docvalue_fields insted of _source
+
+    const searchSource = await this.makeSearchSource(
+      searchFilters,
+      indexSettings.maxResultWindow,
+      initialSearchContext
+    );
+    searchSource.setField('fields', searchFilters.fieldNames); // Setting "fields" filters out unused scripted fields
+    if (sourceOnlyFields.length === 0) {
+      searchSource.setField('source', false); // do not need anything from _source
+    } else {
+      searchSource.setField('source', sourceOnlyFields);
+    }
+    if (this._hasSort()) {
+      searchSource.setField('sort', this._buildEsSort());
+    }
+
+    const dsl = await searchSource.getSearchRequestBody();
+    const risonDsl = rison.encode(dsl);
+
+    const mvtUrlServicePath = getHttp().basePath.prepend(
+      `/${GIS_API_PATH}/${MVT_GETTILE_API_PATH}`
+    );
+
+    const urlTemplate = `${mvtUrlServicePath}?x={x}&y={y}&z={z}&geometryFieldName=${this._descriptor.geoField}&index=${indexPattern.title}&requestBody=${risonDsl}`;
+    return {
+      layerName: this.getLayerName(),
+      minSourceZoom: this.getMinZoom(),
+      maxSourceZoom: this.getMaxZoom(),
+      urlTemplate: urlTemplate,
+    };
   }
 }
 
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.test.ts b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.test.ts
new file mode 100644
index 00000000000000..3223d0c94178ff
--- /dev/null
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.test.ts
@@ -0,0 +1,155 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { ES_GEO_FIELD_TYPE, SCALING_TYPES } from '../../../../common/constants';
+
+jest.mock('../../../kibana_services');
+jest.mock('./load_index_settings');
+
+import { getIndexPatternService, getSearchService, getHttp } from '../../../kibana_services';
+import { SearchSource } from '../../../../../../../src/plugins/data/public/search/search_source';
+
+// @ts-expect-error
+import { loadIndexSettings } from './load_index_settings';
+
+import { ESSearchSource } from './es_search_source';
+import { VectorSourceRequestMeta } from '../../../../common/descriptor_types';
+
+describe('ESSearchSource', () => {
+  it('constructor', () => {
+    const esSearchSource = new ESSearchSource({}, null);
+    expect(esSearchSource instanceof ESSearchSource).toBe(true);
+  });
+
+  describe('ITiledSingleLayerVectorSource', () => {
+    it('mb-source params', () => {
+      const esSearchSource = new ESSearchSource({}, null);
+      expect(esSearchSource.getMinZoom()).toBe(0);
+      expect(esSearchSource.getMaxZoom()).toBe(24);
+      expect(esSearchSource.getLayerName()).toBe('source_layer');
+    });
+
+    describe('getUrlTemplateWithMeta', () => {
+      const geoFieldName = 'bar';
+      const mockIndexPatternService = {
+        get() {
+          return {
+            title: 'foobar-title-*',
+            fields: {
+              getByName() {
+                return {
+                  name: geoFieldName,
+                  type: ES_GEO_FIELD_TYPE.GEO_SHAPE,
+                };
+              },
+            },
+          };
+        },
+      };
+
+      beforeEach(async () => {
+        const mockSearchSource = {
+          setField: jest.fn(),
+          getSearchRequestBody() {
+            return { foobar: 'ES_DSL_PLACEHOLDER', params: this.setField.mock.calls };
+          },
+          setParent() {},
+        };
+        const mockSearchService = {
+          searchSource: {
+            async create() {
+              return (mockSearchSource as unknown) as SearchSource;
+            },
+            createEmpty() {
+              return (mockSearchSource as unknown) as SearchSource;
+            },
+          },
+        };
+
+        // @ts-expect-error
+        getIndexPatternService.mockReturnValue(mockIndexPatternService);
+        // @ts-expect-error
+        getSearchService.mockReturnValue(mockSearchService);
+        loadIndexSettings.mockReturnValue({
+          maxResultWindow: 1000,
+        });
+        // @ts-expect-error
+        getHttp.mockReturnValue({
+          basePath: {
+            prepend(path: string) {
+              return `rootdir${path};`;
+            },
+          },
+        });
+      });
+
+      const searchFilters: VectorSourceRequestMeta = {
+        filters: [],
+        zoom: 0,
+        fieldNames: ['tooltipField', 'styleField'],
+        timeFilters: {
+          from: 'now',
+          to: '15m',
+          mode: 'relative',
+        },
+        sourceQuery: {
+          query: 'tooltipField: foobar',
+          language: 'KQL',
+          queryLastTriggeredAt: '2019-04-25T20:53:22.331Z',
+        },
+        sourceMeta: null,
+        applyGlobalQuery: true,
+      };
+
+      it('Should only include required props', async () => {
+        const esSearchSource = new ESSearchSource(
+          { geoField: geoFieldName, indexPatternId: 'ipId' },
+          null
+        );
+        const urlTemplateWithMeta = await esSearchSource.getUrlTemplateWithMeta(searchFilters);
+        expect(urlTemplateWithMeta.urlTemplate).toBe(
+          `rootdir/api/maps/mvt/getTile;?x={x}&y={y}&z={z}&geometryFieldName=bar&index=foobar-title-*&requestBody=(foobar:ES_DSL_PLACEHOLDER,params:('0':('0':index,'1':(fields:(),title:'foobar-title-*')),'1':('0':size,'1':1000),'2':('0':filter,'1':!()),'3':('0':query),'4':('0':index,'1':(fields:(),title:'foobar-title-*')),'5':('0':query,'1':(language:KQL,query:'tooltipField: foobar',queryLastTriggeredAt:'2019-04-25T20:53:22.331Z')),'6':('0':fields,'1':!(tooltipField,styleField)),'7':('0':source,'1':!(tooltipField,styleField))))`
+        );
+      });
+    });
+  });
+
+  describe('isFilterByMapBounds', () => {
+    it('default', () => {
+      const esSearchSource = new ESSearchSource({}, null);
+      expect(esSearchSource.isFilterByMapBounds()).toBe(true);
+    });
+    it('mvt', () => {
+      const esSearchSource = new ESSearchSource({ scalingType: SCALING_TYPES.MVT }, null);
+      expect(esSearchSource.isFilterByMapBounds()).toBe(false);
+    });
+  });
+
+  describe('getJoinsDisabledReason', () => {
+    it('default', () => {
+      const esSearchSource = new ESSearchSource({}, null);
+      expect(esSearchSource.getJoinsDisabledReason()).toBe(null);
+    });
+    it('mvt', () => {
+      const esSearchSource = new ESSearchSource({ scalingType: SCALING_TYPES.MVT }, null);
+      expect(esSearchSource.getJoinsDisabledReason()).toBe(
+        'Joins are not supported when scaling by mvt vector tiles'
+      );
+    });
+  });
+
+  describe('getFields', () => {
+    it('default', () => {
+      const esSearchSource = new ESSearchSource({}, null);
+      const docField = esSearchSource.createField({ fieldName: 'prop1' });
+      expect(docField.canReadFromGeoJson()).toBe(true);
+    });
+    it('mvt', () => {
+      const esSearchSource = new ESSearchSource({ scalingType: SCALING_TYPES.MVT }, null);
+      const docField = esSearchSource.createField({ fieldName: 'prop1' });
+      expect(docField.canReadFromGeoJson()).toBe(false);
+    });
+  });
+});
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/scaling_form.test.tsx b/x-pack/plugins/maps/public/classes/sources/es_search_source/scaling_form.test.tsx
index 6e56c179b4ead2..f57335db14c629 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/scaling_form.test.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/scaling_form.test.tsx
@@ -27,28 +27,46 @@ const defaultProps = {
   termFields: [],
   topHitsSplitField: null,
   topHitsSize: 1,
+  supportsMvt: true,
+  mvtDisabledReason: null,
 };
 
-test('should render', async () => {
-  const component = shallow(<ScalingForm {...defaultProps} />);
+describe('scaling form', () => {
+  test('should render', async () => {
+    const component = shallow(<ScalingForm {...defaultProps} />);
 
-  expect(component).toMatchSnapshot();
-});
+    expect(component).toMatchSnapshot();
+  });
 
-test('should disable clusters option when clustering is not supported', async () => {
-  const component = shallow(
-    <ScalingForm
-      {...defaultProps}
-      supportsClustering={false}
-      clusteringDisabledReason="Simulated clustering disabled"
-    />
-  );
+  test('should disable clusters option when clustering is not supported', async () => {
+    const component = shallow(
+      <ScalingForm
+        {...defaultProps}
+        supportsClustering={false}
+        clusteringDisabledReason="Simulated clustering disabled"
+      />
+    );
 
-  expect(component).toMatchSnapshot();
-});
+    expect(component).toMatchSnapshot();
+  });
+
+  test('should render top hits form when scaling type is TOP_HITS', async () => {
+    const component = shallow(
+      <ScalingForm {...defaultProps} scalingType={SCALING_TYPES.TOP_HITS} />
+    );
+
+    expect(component).toMatchSnapshot();
+  });
 
-test('should render top hits form when scaling type is TOP_HITS', async () => {
-  const component = shallow(<ScalingForm {...defaultProps} scalingType={SCALING_TYPES.TOP_HITS} />);
+  test('should disable mvt option when mvt is not supported', async () => {
+    const component = shallow(
+      <ScalingForm
+        {...defaultProps}
+        supportsMvt={false}
+        mvtDisabledReason={'Simulated mvt disabled'}
+      />
+    );
 
-  expect(component).toMatchSnapshot();
+    expect(component).toMatchSnapshot();
+  });
 });
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/scaling_form.tsx b/x-pack/plugins/maps/public/classes/sources/es_search_source/scaling_form.tsx
index 816db6a98d593b..cc2d4d059a3a8f 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/scaling_form.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/scaling_form.tsx
@@ -4,16 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { Fragment, Component } from 'react';
+import React, { Component, Fragment } from 'react';
 import {
   EuiFormRow,
+  EuiHorizontalRule,
+  EuiRadio,
+  EuiSpacer,
   EuiSwitch,
   EuiSwitchEvent,
   EuiTitle,
-  EuiSpacer,
-  EuiHorizontalRule,
-  EuiRadio,
   EuiToolTip,
+  EuiBetaBadge,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -24,8 +25,8 @@ import { ValidatedRange } from '../../../components/validated_range';
 import {
   DEFAULT_MAX_INNER_RESULT_WINDOW,
   DEFAULT_MAX_RESULT_WINDOW,
-  SCALING_TYPES,
   LAYER_TYPE,
+  SCALING_TYPES,
 } from '../../../../common/constants';
 // @ts-ignore
 import { loadIndexSettings } from './load_index_settings';
@@ -38,7 +39,9 @@ interface Props {
   onChange: (args: OnSourceChangeArgs) => void;
   scalingType: SCALING_TYPES;
   supportsClustering: boolean;
+  supportsMvt: boolean;
   clusteringDisabledReason?: string | null;
+  mvtDisabledReason?: string | null;
   termFields: IFieldType[];
   topHitsSplitField: string | null;
   topHitsSize: number;
@@ -80,8 +83,15 @@ export class ScalingForm extends Component<Props, State> {
   }
 
   _onScalingTypeChange = (optionId: string): void => {
-    const layerType =
-      optionId === SCALING_TYPES.CLUSTERS ? LAYER_TYPE.BLENDED_VECTOR : LAYER_TYPE.VECTOR;
+    let layerType;
+    if (optionId === SCALING_TYPES.CLUSTERS) {
+      layerType = LAYER_TYPE.BLENDED_VECTOR;
+    } else if (optionId === SCALING_TYPES.MVT) {
+      layerType = LAYER_TYPE.TILED_VECTOR;
+    } else {
+      layerType = LAYER_TYPE.VECTOR;
+    }
+
     this.props.onChange({ propName: 'scalingType', value: optionId, newLayerType: layerType });
   };
 
@@ -177,9 +187,47 @@ export class ScalingForm extends Component<Props, State> {
     );
   }
 
+  _renderMVTRadio() {
+    const labelText = i18n.translate('xpack.maps.source.esSearch.useMVTVectorTiles', {
+      defaultMessage: 'Use vector tiles',
+    });
+    const mvtRadio = (
+      <EuiRadio
+        id={SCALING_TYPES.MVT}
+        label={labelText}
+        checked={this.props.scalingType === SCALING_TYPES.MVT}
+        onChange={() => this._onScalingTypeChange(SCALING_TYPES.MVT)}
+        disabled={!this.props.supportsMvt}
+      />
+    );
+
+    const enabledInfo = (
+      <>
+        <EuiBetaBadge label={'beta'} />
+        <EuiHorizontalRule margin="xs" />
+        {i18n.translate('xpack.maps.source.esSearch.mvtDescription', {
+          defaultMessage: 'Use vector tiles for faster display of large datasets.',
+        })}
+      </>
+    );
+
+    return !this.props.supportsMvt ? (
+      <EuiToolTip position="left" content={this.props.mvtDisabledReason}>
+        {mvtRadio}
+      </EuiToolTip>
+    ) : (
+      <EuiToolTip position="left" content={enabledInfo}>
+        {mvtRadio}
+      </EuiToolTip>
+    );
+  }
+
   render() {
     let filterByBoundsSwitch;
-    if (this.props.scalingType !== SCALING_TYPES.CLUSTERS) {
+    if (
+      this.props.scalingType === SCALING_TYPES.TOP_HITS ||
+      this.props.scalingType === SCALING_TYPES.LIMIT
+    ) {
       filterByBoundsSwitch = (
         <EuiFormRow>
           <EuiSwitch
@@ -194,9 +242,9 @@ export class ScalingForm extends Component<Props, State> {
       );
     }
 
-    let scalingForm = null;
+    let topHitsOptionsForm = null;
     if (this.props.scalingType === SCALING_TYPES.TOP_HITS) {
-      scalingForm = (
+      topHitsOptionsForm = (
         <Fragment>
           <EuiHorizontalRule margin="xs" />
           {this._renderTopHitsForm()}
@@ -234,12 +282,12 @@ export class ScalingForm extends Component<Props, State> {
               onChange={() => this._onScalingTypeChange(SCALING_TYPES.TOP_HITS)}
             />
             {this._renderClusteringRadio()}
+            {this._renderMVTRadio()}
           </div>
         </EuiFormRow>
 
         {filterByBoundsSwitch}
-
-        {scalingForm}
+        {topHitsOptionsForm}
       </Fragment>
     );
   }
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/update_source_editor.js b/x-pack/plugins/maps/public/classes/sources/es_search_source/update_source_editor.js
index 0701dbbaecdd56..c123c307c4895b 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/update_source_editor.js
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/update_source_editor.js
@@ -17,6 +17,8 @@ import {
   getTermsFields,
   getSourceFields,
   supportsGeoTileAgg,
+  supportsMvt,
+  getMvtDisabledReason,
 } from '../../../index_pattern_util';
 import { SORT_ORDER } from '../../../../common/constants';
 import { ESDocField } from '../../fields/es_doc_field';
@@ -42,6 +44,9 @@ export class UpdateSourceEditor extends Component {
     termFields: null,
     sortFields: null,
     supportsClustering: false,
+    supportsMvt: false,
+    mvtDisabledReason: null,
+    clusteringDisabledReason: null,
   };
 
   componentDidMount() {
@@ -94,9 +99,12 @@ export class UpdateSourceEditor extends Component {
       });
     });
 
+    const mvtSupported = supportsMvt(indexPattern, geoField.name);
     this.setState({
       supportsClustering: supportsGeoTileAgg(geoField),
+      supportsMvt: mvtSupported,
       clusteringDisabledReason: getGeoTileAggNotSupportedReason(geoField),
+      mvtDisabledReason: mvtSupported ? null : getMvtDisabledReason(),
       sourceFields: sourceFields,
       termFields: getTermsFields(indexPattern.fields), //todo change term fields to use fields
       sortFields: indexPattern.fields.filter(
@@ -207,7 +215,9 @@ export class UpdateSourceEditor extends Component {
           onChange={this.props.onChange}
           scalingType={this.props.scalingType}
           supportsClustering={this.state.supportsClustering}
+          supportsMvt={this.state.supportsMvt}
           clusteringDisabledReason={this.state.clusteringDisabledReason}
+          mvtDisabledReason={this.state.mvtDisabledReason}
           termFields={this.state.termFields}
           topHitsSplitField={this.props.topHitsSplitField}
           topHitsSize={this.props.topHitsSize}
diff --git a/x-pack/plugins/maps/public/classes/sources/es_source/es_source.js b/x-pack/plugins/maps/public/classes/sources/es_source/es_source.js
index 8cc2aa018979b5..d51ca46fd98fff 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_source/es_source.js
+++ b/x-pack/plugins/maps/public/classes/sources/es_source/es_source.js
@@ -184,7 +184,7 @@ export class AbstractESSource extends AbstractVectorSource {
     const minLon = esBounds.top_left.lon;
     const maxLon = esBounds.bottom_right.lon;
     return {
-      minLon: minLon > maxLon ? minLon - 360 : minLon,
+      minLon: minLon > maxLon ? minLon - 360 : minLon, //fixes an ES bbox to straddle dateline
       maxLon,
       minLat: esBounds.bottom_right.lat,
       maxLat: esBounds.top_left.lat,
@@ -281,7 +281,7 @@ export class AbstractESSource extends AbstractVectorSource {
       return null;
     }
 
-    return fieldFromIndexPattern.format.getConverterFor('text');
+    return indexPattern.getFormatterForField(fieldFromIndexPattern).getConverterFor('text');
   }
 
   async loadStylePropsMeta(
diff --git a/x-pack/plugins/maps/public/classes/sources/es_term_source/es_term_source.test.js b/x-pack/plugins/maps/public/classes/sources/es_term_source/es_term_source.test.js
index f6779206868a59..060096157f5781 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_term_source/es_term_source.test.js
+++ b/x-pack/plugins/maps/public/classes/sources/es_term_source/es_term_source.test.js
@@ -6,7 +6,6 @@
 
 import { ESTermSource, extractPropertiesMap } from './es_term_source';
 
-jest.mock('ui/new_platform');
 jest.mock('../../layers/vector_layer/vector_layer', () => {});
 
 const indexPatternTitle = 'myIndex';
diff --git a/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts b/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
index 271505010f36a8..fd9c1792754448 100644
--- a/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
+++ b/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
@@ -14,6 +14,7 @@ import {
   MapExtent,
   MapFilters,
   MapQuery,
+  VectorSourceRequestMeta,
   VectorSourceSyncMeta,
 } from '../../../../common/descriptor_types';
 import { VECTOR_SHAPE_TYPE } from '../../../../common/constants';
@@ -64,7 +65,7 @@ export class AbstractVectorSource extends AbstractSource implements IVectorSourc
   ): MapExtent | null;
   getGeoJsonWithMeta(
     layerName: string,
-    searchFilters: MapFilters,
+    searchFilters: VectorSourceRequestMeta,
     registerCancelCallback: (callback: () => void) => void
   ): Promise<GeoJsonWithMeta>;
 
@@ -79,7 +80,9 @@ export class AbstractVectorSource extends AbstractSource implements IVectorSourc
 }
 
 export interface ITiledSingleLayerVectorSource extends IVectorSource {
-  getUrlTemplateWithMeta(): Promise<{
+  getUrlTemplateWithMeta(
+    searchFilters: VectorSourceRequestMeta
+  ): Promise<{
     layerName: string;
     urlTemplate: string;
     minSourceZoom: number;
diff --git a/x-pack/plugins/maps/public/classes/styles/heatmap/components/heatmap_style_editor.test.tsx b/x-pack/plugins/maps/public/classes/styles/heatmap/components/heatmap_style_editor.test.tsx
index aa4dbc67e8e4de..f082e67512099a 100644
--- a/x-pack/plugins/maps/public/classes/styles/heatmap/components/heatmap_style_editor.test.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/heatmap/components/heatmap_style_editor.test.tsx
@@ -9,8 +9,6 @@ import { shallow } from 'enzyme';
 
 import { HeatmapStyleEditor } from './heatmap_style_editor';
 
-jest.mock('ui/new_platform');
-
 describe('HeatmapStyleEditor', () => {
   test('is rendered', () => {
     const component = shallow(
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/categorical_field_meta_popover.tsx b/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/categorical_field_meta_popover.tsx
index e49c15c68b8db9..2a544b94d760ab 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/categorical_field_meta_popover.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/categorical_field_meta_popover.tsx
@@ -14,6 +14,7 @@ import { FieldMetaOptions } from '../../../../../../common/descriptor_types';
 type Props = {
   fieldMetaOptions: FieldMetaOptions;
   onChange: (fieldMetaOptions: FieldMetaOptions) => void;
+  switchDisabled: boolean;
 };
 
 export function CategoricalFieldMetaPopover(props: Props) {
@@ -34,6 +35,7 @@ export function CategoricalFieldMetaPopover(props: Props) {
           checked={props.fieldMetaOptions.isEnabled}
           onChange={onIsEnabledChange}
           compressed
+          disabled={props.switchDisabled}
         />
       </EuiFormRow>
     </FieldMetaPopover>
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx b/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx
index 9086c4df315967..09be9d72af9704 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx
@@ -40,6 +40,7 @@ type Props = {
   fieldMetaOptions: FieldMetaOptions;
   styleName: VECTOR_STYLES;
   onChange: (fieldMetaOptions: FieldMetaOptions) => void;
+  switchDisabled: boolean;
 };
 
 export function OrdinalFieldMetaPopover(props: Props) {
@@ -66,6 +67,7 @@ export function OrdinalFieldMetaPopover(props: Props) {
             checked={props.fieldMetaOptions.isEnabled}
             onChange={onIsEnabledChange}
             compressed
+            disabled={props.switchDisabled}
           />
         </EuiFormRow>
 
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/__snapshots__/dynamic_color_property.test.tsx.snap b/x-pack/plugins/maps/public/classes/styles/vector/properties/__snapshots__/dynamic_color_property.test.tsx.snap
index c722e86512e528..34d2d7fb0cbbf6 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/__snapshots__/dynamic_color_property.test.tsx.snap
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/__snapshots__/dynamic_color_property.test.tsx.snap
@@ -325,3 +325,29 @@ exports[`ordinal Should render ordinal legend as bands 1`] = `
   </EuiFlexGroup>
 </div>
 `;
+
+exports[`renderFieldMetaPopover Should disable toggle when field is not backed by geojson source 1`] = `
+<OrdinalFieldMetaPopover
+  fieldMetaOptions={
+    Object {
+      "isEnabled": true,
+    }
+  }
+  onChange={[Function]}
+  styleName="lineColor"
+  switchDisabled={true}
+/>
+`;
+
+exports[`renderFieldMetaPopover Should enable toggle when field is backed by geojson-source 1`] = `
+<OrdinalFieldMetaPopover
+  fieldMetaOptions={
+    Object {
+      "isEnabled": true,
+    }
+  }
+  onChange={[Function]}
+  styleName="lineColor"
+  switchDisabled={false}
+/>
+`;
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.tsx
index 62a6a59dd091ba..de8f3b5c09175f 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.tsx
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-jest.mock('ui/new_platform');
 jest.mock('../components/vector_style_editor', () => ({
   VectorStyleEditor: () => {
     return <div>mockVectorStyleEditor</div>;
@@ -578,3 +577,39 @@ test('Should read out ordinal type correctly', async () => {
   expect(ordinalColorStyle2.isOrdinal()).toEqual(true);
   expect(ordinalColorStyle2.isCategorical()).toEqual(false);
 });
+
+describe('renderFieldMetaPopover', () => {
+  test('Should enable toggle when field is backed by geojson-source', () => {
+    const colorStyle = makeProperty(
+      {
+        color: 'Blues',
+        type: undefined,
+        fieldMetaOptions,
+      },
+      undefined,
+      mockField
+    );
+
+    const legendRow = colorStyle.renderFieldMetaPopover(() => {});
+    expect(legendRow).toMatchSnapshot();
+  });
+
+  test('Should disable toggle when field is not backed by geojson source', () => {
+    const nonGeoJsonField = Object.create(mockField);
+    nonGeoJsonField.canReadFromGeoJson = () => {
+      return false;
+    };
+    const colorStyle = makeProperty(
+      {
+        color: 'Blues',
+        type: undefined,
+        fieldMetaOptions,
+      },
+      undefined,
+      nonGeoJsonField
+    );
+
+    const legendRow = colorStyle.renderFieldMetaPopover(() => {});
+    expect(legendRow).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx
index af93c8e0c9d6db..06987ab8bcc48f 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx
@@ -6,7 +6,6 @@
 
 import { shallow } from 'enzyme';
 
-jest.mock('ui/new_platform');
 jest.mock('../components/vector_style_editor', () => ({
   VectorStyleEditor: () => {
     return <div>mockVectorStyleEditor</div>;
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.test.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.test.tsx
index db44ae0da562d4..c5298067f6cbe7 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.test.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.test.tsx
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-jest.mock('ui/new_platform');
 jest.mock('../components/vector_style_editor', () => ({
   VectorStyleEditor: () => {
     return <div>mockVectorStyleEditor</div>;
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
index b16755e69f92de..f6ab052497723e 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
@@ -328,16 +328,20 @@ export class DynamicStyleProperty<T>
       return null;
     }
 
+    const switchDisabled = !!this._field && !this._field.canReadFromGeoJson();
+
     return this.isCategorical() ? (
       <CategoricalFieldMetaPopover
         fieldMetaOptions={this.getFieldMetaOptions()}
         onChange={onFieldMetaOptionsChange}
+        switchDisabled={switchDisabled}
       />
     ) : (
       <OrdinalFieldMetaPopover
         fieldMetaOptions={this.getFieldMetaOptions()}
         styleName={this.getStyleName()}
         onChange={onFieldMetaOptionsChange}
+        switchDisabled={switchDisabled}
       />
     );
   }
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.test.js b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.test.js
index a85cd0cc864075..28801a402ca14d 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.test.js
+++ b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.test.js
@@ -14,7 +14,6 @@ import {
 } from '../../../../common/constants';
 
 jest.mock('../../../kibana_services');
-jest.mock('ui/new_platform');
 
 class MockField {
   constructor({ fieldName }) {
diff --git a/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.ts b/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.ts
index 516ad25f933f66..348cd5e5522582 100644
--- a/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.ts
+++ b/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.ts
@@ -10,8 +10,8 @@ import { IField } from '../fields/field';
 import {
   esFilters,
   Filter,
-  IFieldType,
   IndexPattern,
+  IndexPatternField,
 } from '../../../../../../src/plugins/data/public';
 
 export class ESTooltipProperty implements ITooltipProperty {
@@ -37,7 +37,7 @@ export class ESTooltipProperty implements ITooltipProperty {
     return this._tooltipProperty.getRawValue();
   }
 
-  _getIndexPatternField(): IFieldType | undefined {
+  _getIndexPatternField(): IndexPatternField | undefined {
     return this._indexPattern.fields.getByName(this._field.getRootName());
   }
 
@@ -56,10 +56,11 @@ export class ESTooltipProperty implements ITooltipProperty {
       }
     }
 
-    const htmlConverter = indexPatternField.format.getConverterFor('html');
+    const formatter = this._indexPattern.getFormatterForField(indexPatternField);
+    const htmlConverter = formatter.getConverterFor('html');
     return htmlConverter
       ? htmlConverter(this.getRawValue())
-      : indexPatternField.format.convert(this.getRawValue());
+      : formatter.convert(this.getRawValue());
   }
 
   isFilterable(): boolean {
diff --git a/x-pack/plugins/maps/public/classes/util/mb_filter_expressions.ts b/x-pack/plugins/maps/public/classes/util/mb_filter_expressions.ts
index 8da6fa2318de96..0da6f632eb4a84 100644
--- a/x-pack/plugins/maps/public/classes/util/mb_filter_expressions.ts
+++ b/x-pack/plugins/maps/public/classes/util/mb_filter_expressions.ts
@@ -4,32 +4,48 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { GEO_JSON_TYPE, FEATURE_VISIBLE_PROPERTY_NAME } from '../../../common/constants';
+import {
+  GEO_JSON_TYPE,
+  FEATURE_VISIBLE_PROPERTY_NAME,
+  KBN_TOO_MANY_FEATURES_PROPERTY,
+} from '../../../common/constants';
+
+export const EXCLUDE_TOO_MANY_FEATURES_BOX = ['!=', ['get', KBN_TOO_MANY_FEATURES_PROPERTY], true];
 
 const VISIBILITY_FILTER_CLAUSE = ['all', ['==', ['get', FEATURE_VISIBLE_PROPERTY_NAME], true]];
+const TOO_MANY_FEATURES_FILTER = ['all', EXCLUDE_TOO_MANY_FEATURES_BOX];
 
 const CLOSED_SHAPE_MB_FILTER = [
-  'any',
-  ['==', ['geometry-type'], GEO_JSON_TYPE.POLYGON],
-  ['==', ['geometry-type'], GEO_JSON_TYPE.MULTI_POLYGON],
+  ...TOO_MANY_FEATURES_FILTER,
+  [
+    'any',
+    ['==', ['geometry-type'], GEO_JSON_TYPE.POLYGON],
+    ['==', ['geometry-type'], GEO_JSON_TYPE.MULTI_POLYGON],
+  ],
 ];
 
 const VISIBLE_CLOSED_SHAPE_MB_FILTER = [...VISIBILITY_FILTER_CLAUSE, CLOSED_SHAPE_MB_FILTER];
 
 const ALL_SHAPE_MB_FILTER = [
-  'any',
-  ['==', ['geometry-type'], GEO_JSON_TYPE.POLYGON],
-  ['==', ['geometry-type'], GEO_JSON_TYPE.MULTI_POLYGON],
-  ['==', ['geometry-type'], GEO_JSON_TYPE.LINE_STRING],
-  ['==', ['geometry-type'], GEO_JSON_TYPE.MULTI_LINE_STRING],
+  ...TOO_MANY_FEATURES_FILTER,
+  [
+    'any',
+    ['==', ['geometry-type'], GEO_JSON_TYPE.POLYGON],
+    ['==', ['geometry-type'], GEO_JSON_TYPE.MULTI_POLYGON],
+    ['==', ['geometry-type'], GEO_JSON_TYPE.LINE_STRING],
+    ['==', ['geometry-type'], GEO_JSON_TYPE.MULTI_LINE_STRING],
+  ],
 ];
 
 const VISIBLE_ALL_SHAPE_MB_FILTER = [...VISIBILITY_FILTER_CLAUSE, ALL_SHAPE_MB_FILTER];
 
 const POINT_MB_FILTER = [
-  'any',
-  ['==', ['geometry-type'], GEO_JSON_TYPE.POINT],
-  ['==', ['geometry-type'], GEO_JSON_TYPE.MULTI_POINT],
+  ...TOO_MANY_FEATURES_FILTER,
+  [
+    'any',
+    ['==', ['geometry-type'], GEO_JSON_TYPE.POINT],
+    ['==', ['geometry-type'], GEO_JSON_TYPE.MULTI_POINT],
+  ],
 ];
 
 const VISIBLE_POINT_MB_FILTER = [...VISIBILITY_FILTER_CLAUSE, POINT_MB_FILTER];
diff --git a/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx b/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx
index cbeb4e79a38d74..7e180884441297 100644
--- a/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx
+++ b/x-pack/plugins/maps/public/components/tooltip_selector/add_tooltip_field_popover.tsx
@@ -27,6 +27,8 @@ export type FieldProps = {
   name: string;
 };
 
+type FieldOptions = Array<EuiSelectableOption<{ value: string }>>;
+
 function sortByLabel(a: EuiSelectableOption, b: EuiSelectableOption): number {
   return a.label.localeCompare(b.label);
 }
@@ -66,7 +68,7 @@ interface Props {
 interface State {
   isPopoverOpen: boolean;
   checkedFields: string[];
-  options?: EuiSelectableOption[];
+  options?: FieldOptions;
   prevFields?: FieldProps[];
   prevSelectedFields?: FieldProps[];
 }
@@ -105,13 +107,15 @@ export class AddTooltipFieldPopover extends Component<Props, State> {
     });
   };
 
-  _onSelect = (options: EuiSelectableOption[]) => {
+  _onSelect = (selectableOptions: EuiSelectableOption[]) => {
+    // EUI team to remove casting: https://github.com/elastic/eui/issues/3966
+    const options = selectableOptions as FieldOptions;
     const checkedFields: string[] = options
       .filter((option) => {
         return option.checked === 'on';
       })
       .map((option) => {
-        return option.value as string;
+        return option.value!;
       });
 
     this.setState({
diff --git a/x-pack/plugins/maps/public/connected_components/layer_panel/__snapshots__/view.test.js.snap b/x-pack/plugins/maps/public/connected_components/layer_panel/__snapshots__/view.test.js.snap
index b005e3ca6b17dc..99cad61d6b2b4d 100644
--- a/x-pack/plugins/maps/public/connected_components/layer_panel/__snapshots__/view.test.js.snap
+++ b/x-pack/plugins/maps/public/connected_components/layer_panel/__snapshots__/view.test.js.snap
@@ -57,6 +57,8 @@ exports[`LayerPanel is rendered 1`] = `
           buttonContent="Source details"
           id="accordion1"
           initialIsOpen={false}
+          isLoading={false}
+          isLoadingMessage={false}
           paddingSize="none"
         >
           <EuiText
diff --git a/x-pack/plugins/maps/public/connected_components/map/mb/tooltip_control/tooltip_control.js b/x-pack/plugins/maps/public/connected_components/map/mb/tooltip_control/tooltip_control.js
index 87d6f8e1d8e716..edfeb3c76b1046 100644
--- a/x-pack/plugins/maps/public/connected_components/map/mb/tooltip_control/tooltip_control.js
+++ b/x-pack/plugins/maps/public/connected_components/map/mb/tooltip_control/tooltip_control.js
@@ -8,6 +8,7 @@ import _ from 'lodash';
 import React from 'react';
 import { FEATURE_ID_PROPERTY_NAME, LON_INDEX } from '../../../../../common/constants';
 import { TooltipPopover } from './tooltip_popover';
+import { EXCLUDE_TOO_MANY_FEATURES_BOX } from '../../../../classes/util/mb_filter_expressions';
 
 function justifyAnchorLocation(mbLngLat, targetFeature) {
   let popupAnchorLocation = [mbLngLat.lng, mbLngLat.lat]; // default popup location to mouse location
@@ -79,7 +80,7 @@ export class TooltipControl extends React.Component {
         // - As empty object literal
         // To avoid ambiguity, normalize properties to empty object literal.
         const mbProperties = mbFeature.properties ? mbFeature.properties : {};
-        //This keeps track of first properties (assuming these will be identical for features in different tiles
+        //This keeps track of first properties (assuming these will be identical for features in different tiles)
         uniqueFeatures.push({
           id: featureId,
           layerId: layerId,
@@ -175,7 +176,10 @@ export class TooltipControl extends React.Component {
         y: mbLngLatPoint.y + PADDING,
       },
     ];
-    return this.props.mbMap.queryRenderedFeatures(mbBbox, { layers: mbLayerIds });
+    return this.props.mbMap.queryRenderedFeatures(mbBbox, {
+      layers: mbLayerIds,
+      filter: EXCLUDE_TOO_MANY_FEATURES_BOX,
+    });
   }
 
   render() {
diff --git a/x-pack/plugins/maps/public/connected_components/map/mb/view.js b/x-pack/plugins/maps/public/connected_components/map/mb/view.js
index 22c374aceedd5d..eede1edf40cc4f 100644
--- a/x-pack/plugins/maps/public/connected_components/map/mb/view.js
+++ b/x-pack/plugins/maps/public/connected_components/map/mb/view.js
@@ -10,7 +10,11 @@ import { ResizeChecker } from '../../../../../../../src/plugins/kibana_utils/pub
 import { removeOrphanedSourcesAndLayers, addSpritesheetToMap } from './utils';
 import { syncLayerOrder } from './sort_layers';
 import { getGlyphUrl, isRetina } from '../../../meta';
-import { DECIMAL_DEGREES_PRECISION, ZOOM_PRECISION } from '../../../../common/constants';
+import {
+  DECIMAL_DEGREES_PRECISION,
+  KBN_TOO_MANY_FEATURES_IMAGE_ID,
+  ZOOM_PRECISION,
+} from '../../../../common/constants';
 import mapboxgl from 'mapbox-gl/dist/mapbox-gl-csp';
 import mbWorkerUrl from '!!file-loader!mapbox-gl/dist/mapbox-gl-csp-worker';
 import mbRtlPlugin from '!!file-loader!@mapbox/mapbox-gl-rtl-text/mapbox-gl-rtl-text.min.js';
@@ -143,6 +147,14 @@ export class MBMap extends React.Component {
         mbMap.addControl(new mapboxgl.NavigationControl({ showCompass: false }), 'top-left');
       }
 
+      const tooManyFeaturesImageSrc =
+        'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAA7DgAAOw4BzLahgwAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAARLSURBVHic7ZnPbxRVAMe/7735sWO3293ZlUItJsivCxEE0oTYRgu1FqTQoFSwKTYx8SAH/wHjj4vRozGGi56sMcW2UfqTEuOhppE0KJc2GIuKQFDY7qzdtrudX88D3YTUdFuQN8+k87ltZt7uZz958/bNLAGwBWsYKltANmEA2QKyCQPIFpBNGEC2gGzCALIFZBMGkC0gmzCAbAHZhAFkC8gmDCBbQDZhANkCslnzARQZH6oDpNs0D5UDSUIInePcOpPLfdfnODNBuwQWIAWwNOABwHZN0x8npE6hNLJ4DPWRyFSf40wE5VOEQPBjcR0g3YlE4ybGmtK+/1NzJtOZA/xSYwZMs3nG962T2ez3It2AANaA/kSidYuivOQBs5WM1fUnk6f0u+GXJUqIuUtVXx00zRbRfkIDfBqL7a1WlIYbjvNtTTr99jXXHVpH6dMjK0R4cXq6c9rzxjcx9sKX8XitSEdhAToMI7VP10/97fsTh7PZrgWAN1lW72KE2vOm2b5chDTgtWQyn93x/bEEIetEOQIC14CxVOr1CkKefH929t0v8vn0vcdGEoljGxXl4C3PGz2YyXy+AHARDqtByAxoUdWKBKV70r4/vvTLA0CjZfX+5nkDGxirKzUTgkBIgNaysh3gnF627R+XO+dQJvP1ddcdrmSsbtA020pF+CAW21qrqmUiXIUEqGRsIwD0FQq/lzqv0bJ6rrvucBVjzwyb5ivLRTiiaW+8VV7eIEBVTAANiIIQd9RxZlc6t9Gyem647vn1jD07ZJonl4sQASoevqmgABzwwHnJzc69PGdZ3X+47sgGxuqHTPPE0ggeVtg5/QeEBMhxPg1Aa1DV2GrHPG9ZXy1G2D+wNALn9jyQEeHKAJgP+033Kgrdqij7AFwZtu3bqx3XWShMHtV1o1pRGo4YxiNd+fyEB2DKdX/4aG5u0hbwcylkBryTy/3scT6zW9Nq7ndso2Wdvea6Q1WUHuiPx1/WAXLBcWZXun94UMRcAoD/p+ddTFK6u8MwUvc7vsmyem+67oVqVT0wkEgcF+FYRNhW+L25uX6f84XThtHxIBudE5bVY/t++jFVrU/dvVSFICzAqG3PX/S8rihj2/61qK1AOUB7ksl2jdLUL7Z9rvgcQQRCFsEi5wqFmw26XnhCUQ63GcZmCly95Lrzpca0G0byk3j8tEnpU1c975tmyxoU5QcE8EAEAM5WVOzfoarHAeC2749dcpzxMwsLv07Ztg0AOzVNf03Ttu/S9T2PMlbjc25fdpyutmx2TLRbIAEA4M1otKo1EjmaoHQn4ZwBgA/kAVAK6MXXdzxv/ONcrq/HcbJBeAUWoEizqsaORaPbKglZrxMSZZyrM76f/ovzWx/m85PFWREUgQf4v7Hm/xcIA8gWkE0YQLaAbMIAsgVkEwaQLSCbMIBsAdmEAWQLyCYMIFtANmEA2QKyCQPIFpDNmg/wD3OFdEybUvJjAAAAAElFTkSuQmCC';
+      const tooManyFeaturesImage = new Image();
+      tooManyFeaturesImage.onload = () => {
+        mbMap.addImage(KBN_TOO_MANY_FEATURES_IMAGE_ID, tooManyFeaturesImage);
+      };
+      tooManyFeaturesImage.src = tooManyFeaturesImageSrc;
+
       let emptyImage;
       mbMap.on('styleimagemissing', (e) => {
         if (emptyImage) {
diff --git a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/__snapshots__/tools_control.test.js.snap b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/__snapshots__/tools_control.test.js.snap
deleted file mode 100644
index d7fa099fe9dbe9..00000000000000
--- a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/__snapshots__/tools_control.test.js.snap
+++ /dev/null
@@ -1,242 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`Should render cancel button when drawing 1`] = `
-<EuiFlexGroup
-  gutterSize="s"
->
-  <EuiFlexItem>
-    <EuiPopover
-      anchorPosition="leftUp"
-      button={
-        <EuiButtonIcon
-          aria-label="Tools"
-          className="mapToolbarOverlay__button"
-          color="text"
-          iconType="wrench"
-          onClick={[Function]}
-          title="Tools"
-        />
-      }
-      closePopover={[Function]}
-      display="inlineBlock"
-      hasArrow={true}
-      id="contextMenu"
-      isOpen={false}
-      ownFocus={false}
-      panelPaddingSize="none"
-      withTitle={true}
-    >
-      <EuiContextMenu
-        initialPanelId={0}
-        panels={
-          Array [
-            Object {
-              "id": 0,
-              "items": Array [
-                Object {
-                  "name": "Draw shape to filter data",
-                  "panel": 1,
-                },
-                Object {
-                  "name": "Draw bounds to filter data",
-                  "panel": 2,
-                },
-                Object {
-                  "name": "Draw distance to filter data",
-                  "panel": 3,
-                },
-              ],
-              "title": "Tools",
-            },
-            Object {
-              "content": <GeometryFilterForm
-                buttonLabel="Draw shape"
-                className="mapDrawControl__geometryFilterForm"
-                geoFields={
-                  Array [
-                    Object {
-                      "geoFieldName": "location",
-                      "geoFieldType": "geo_point",
-                      "indexPatternId": "1",
-                      "indexPatternTitle": "my_index",
-                    },
-                  ]
-                }
-                intitialGeometryLabel="shape"
-                isFilterGeometryClosed={true}
-                onSubmit={[Function]}
-              />,
-              "id": 1,
-              "title": "Draw shape",
-            },
-            Object {
-              "content": <GeometryFilterForm
-                buttonLabel="Draw bounds"
-                className="mapDrawControl__geometryFilterForm"
-                geoFields={
-                  Array [
-                    Object {
-                      "geoFieldName": "location",
-                      "geoFieldType": "geo_point",
-                      "indexPatternId": "1",
-                      "indexPatternTitle": "my_index",
-                    },
-                  ]
-                }
-                intitialGeometryLabel="bounds"
-                isFilterGeometryClosed={true}
-                onSubmit={[Function]}
-              />,
-              "id": 2,
-              "title": "Draw bounds",
-            },
-            Object {
-              "content": <DistanceFilterForm
-                buttonLabel="Draw distance"
-                className="mapDrawControl__geometryFilterForm"
-                geoFields={
-                  Array [
-                    Object {
-                      "geoFieldName": "location",
-                      "geoFieldType": "geo_point",
-                      "indexPatternId": "1",
-                      "indexPatternTitle": "my_index",
-                    },
-                  ]
-                }
-                onSubmit={[Function]}
-              />,
-              "id": 3,
-              "title": "Draw distance",
-            },
-          ]
-        }
-      />
-    </EuiPopover>
-  </EuiFlexItem>
-  <EuiFlexItem>
-    <EuiButton
-      fill={true}
-      onClick={[Function]}
-      size="s"
-    >
-      <FormattedMessage
-        defaultMessage="Cancel"
-        id="xpack.maps.tooltip.toolsControl.cancelDrawButtonLabel"
-        values={Object {}}
-      />
-    </EuiButton>
-  </EuiFlexItem>
-</EuiFlexGroup>
-`;
-
-exports[`renders 1`] = `
-<EuiPopover
-  anchorPosition="leftUp"
-  button={
-    <EuiButtonIcon
-      aria-label="Tools"
-      className="mapToolbarOverlay__button"
-      color="text"
-      iconType="wrench"
-      onClick={[Function]}
-      title="Tools"
-    />
-  }
-  closePopover={[Function]}
-  display="inlineBlock"
-  hasArrow={true}
-  id="contextMenu"
-  isOpen={false}
-  ownFocus={false}
-  panelPaddingSize="none"
-  withTitle={true}
->
-  <EuiContextMenu
-    initialPanelId={0}
-    panels={
-      Array [
-        Object {
-          "id": 0,
-          "items": Array [
-            Object {
-              "name": "Draw shape to filter data",
-              "panel": 1,
-            },
-            Object {
-              "name": "Draw bounds to filter data",
-              "panel": 2,
-            },
-            Object {
-              "name": "Draw distance to filter data",
-              "panel": 3,
-            },
-          ],
-          "title": "Tools",
-        },
-        Object {
-          "content": <GeometryFilterForm
-            buttonLabel="Draw shape"
-            className="mapDrawControl__geometryFilterForm"
-            geoFields={
-              Array [
-                Object {
-                  "geoFieldName": "location",
-                  "geoFieldType": "geo_point",
-                  "indexPatternId": "1",
-                  "indexPatternTitle": "my_index",
-                },
-              ]
-            }
-            intitialGeometryLabel="shape"
-            isFilterGeometryClosed={true}
-            onSubmit={[Function]}
-          />,
-          "id": 1,
-          "title": "Draw shape",
-        },
-        Object {
-          "content": <GeometryFilterForm
-            buttonLabel="Draw bounds"
-            className="mapDrawControl__geometryFilterForm"
-            geoFields={
-              Array [
-                Object {
-                  "geoFieldName": "location",
-                  "geoFieldType": "geo_point",
-                  "indexPatternId": "1",
-                  "indexPatternTitle": "my_index",
-                },
-              ]
-            }
-            intitialGeometryLabel="bounds"
-            isFilterGeometryClosed={true}
-            onSubmit={[Function]}
-          />,
-          "id": 2,
-          "title": "Draw bounds",
-        },
-        Object {
-          "content": <DistanceFilterForm
-            buttonLabel="Draw distance"
-            className="mapDrawControl__geometryFilterForm"
-            geoFields={
-              Array [
-                Object {
-                  "geoFieldName": "location",
-                  "geoFieldType": "geo_point",
-                  "indexPatternId": "1",
-                  "indexPatternTitle": "my_index",
-                },
-              ]
-            }
-            onSubmit={[Function]}
-          />,
-          "id": 3,
-          "title": "Draw distance",
-        },
-      ]
-    }
-  />
-</EuiPopover>
-`;
diff --git a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/__snapshots__/tools_control.test.tsx.snap b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/__snapshots__/tools_control.test.tsx.snap
new file mode 100644
index 00000000000000..afeee04358e157
--- /dev/null
+++ b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/__snapshots__/tools_control.test.tsx.snap
@@ -0,0 +1,242 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Should render cancel button when drawing 1`] = `
+<EuiFlexGroup
+  gutterSize="s"
+>
+  <EuiFlexItem>
+    <EuiPopover
+      anchorPosition="leftUp"
+      button={
+        <EuiButtonIcon
+          aria-label="Tools"
+          className="mapToolbarOverlay__button"
+          color="text"
+          iconType="wrench"
+          onClick={[Function]}
+          title="Tools"
+        />
+      }
+      closePopover={[Function]}
+      display="inlineBlock"
+      hasArrow={true}
+      id="toolsControlPopover"
+      isOpen={false}
+      ownFocus={false}
+      panelPaddingSize="none"
+      withTitle={true}
+    >
+      <EuiContextMenu
+        initialPanelId={0}
+        panels={
+          Array [
+            Object {
+              "id": 0,
+              "items": Array [
+                Object {
+                  "name": "Draw shape to filter data",
+                  "panel": 1,
+                },
+                Object {
+                  "name": "Draw bounds to filter data",
+                  "panel": 2,
+                },
+                Object {
+                  "name": "Draw distance to filter data",
+                  "panel": 3,
+                },
+              ],
+              "title": "Tools",
+            },
+            Object {
+              "content": <GeometryFilterForm
+                buttonLabel="Draw shape"
+                className="mapDrawControl__geometryFilterForm"
+                geoFields={
+                  Array [
+                    Object {
+                      "geoFieldName": "location",
+                      "geoFieldType": "geo_point",
+                      "indexPatternId": "1",
+                      "indexPatternTitle": "my_index",
+                    },
+                  ]
+                }
+                intitialGeometryLabel="shape"
+                isFilterGeometryClosed={true}
+                onSubmit={[Function]}
+              />,
+              "id": 1,
+              "title": "Draw shape",
+            },
+            Object {
+              "content": <GeometryFilterForm
+                buttonLabel="Draw bounds"
+                className="mapDrawControl__geometryFilterForm"
+                geoFields={
+                  Array [
+                    Object {
+                      "geoFieldName": "location",
+                      "geoFieldType": "geo_point",
+                      "indexPatternId": "1",
+                      "indexPatternTitle": "my_index",
+                    },
+                  ]
+                }
+                intitialGeometryLabel="bounds"
+                isFilterGeometryClosed={true}
+                onSubmit={[Function]}
+              />,
+              "id": 2,
+              "title": "Draw bounds",
+            },
+            Object {
+              "content": <DistanceFilterForm
+                buttonLabel="Draw distance"
+                className="mapDrawControl__geometryFilterForm"
+                geoFields={
+                  Array [
+                    Object {
+                      "geoFieldName": "location",
+                      "geoFieldType": "geo_point",
+                      "indexPatternId": "1",
+                      "indexPatternTitle": "my_index",
+                    },
+                  ]
+                }
+                onSubmit={[Function]}
+              />,
+              "id": 3,
+              "title": "Draw distance",
+            },
+          ]
+        }
+      />
+    </EuiPopover>
+  </EuiFlexItem>
+  <EuiFlexItem>
+    <EuiButton
+      fill={true}
+      onClick={[Function]}
+      size="s"
+    >
+      <FormattedMessage
+        defaultMessage="Cancel"
+        id="xpack.maps.tooltip.toolsControl.cancelDrawButtonLabel"
+        values={Object {}}
+      />
+    </EuiButton>
+  </EuiFlexItem>
+</EuiFlexGroup>
+`;
+
+exports[`renders 1`] = `
+<EuiPopover
+  anchorPosition="leftUp"
+  button={
+    <EuiButtonIcon
+      aria-label="Tools"
+      className="mapToolbarOverlay__button"
+      color="text"
+      iconType="wrench"
+      onClick={[Function]}
+      title="Tools"
+    />
+  }
+  closePopover={[Function]}
+  display="inlineBlock"
+  hasArrow={true}
+  id="toolsControlPopover"
+  isOpen={false}
+  ownFocus={false}
+  panelPaddingSize="none"
+  withTitle={true}
+>
+  <EuiContextMenu
+    initialPanelId={0}
+    panels={
+      Array [
+        Object {
+          "id": 0,
+          "items": Array [
+            Object {
+              "name": "Draw shape to filter data",
+              "panel": 1,
+            },
+            Object {
+              "name": "Draw bounds to filter data",
+              "panel": 2,
+            },
+            Object {
+              "name": "Draw distance to filter data",
+              "panel": 3,
+            },
+          ],
+          "title": "Tools",
+        },
+        Object {
+          "content": <GeometryFilterForm
+            buttonLabel="Draw shape"
+            className="mapDrawControl__geometryFilterForm"
+            geoFields={
+              Array [
+                Object {
+                  "geoFieldName": "location",
+                  "geoFieldType": "geo_point",
+                  "indexPatternId": "1",
+                  "indexPatternTitle": "my_index",
+                },
+              ]
+            }
+            intitialGeometryLabel="shape"
+            isFilterGeometryClosed={true}
+            onSubmit={[Function]}
+          />,
+          "id": 1,
+          "title": "Draw shape",
+        },
+        Object {
+          "content": <GeometryFilterForm
+            buttonLabel="Draw bounds"
+            className="mapDrawControl__geometryFilterForm"
+            geoFields={
+              Array [
+                Object {
+                  "geoFieldName": "location",
+                  "geoFieldType": "geo_point",
+                  "indexPatternId": "1",
+                  "indexPatternTitle": "my_index",
+                },
+              ]
+            }
+            intitialGeometryLabel="bounds"
+            isFilterGeometryClosed={true}
+            onSubmit={[Function]}
+          />,
+          "id": 2,
+          "title": "Draw bounds",
+        },
+        Object {
+          "content": <DistanceFilterForm
+            buttonLabel="Draw distance"
+            className="mapDrawControl__geometryFilterForm"
+            geoFields={
+              Array [
+                Object {
+                  "geoFieldName": "location",
+                  "geoFieldType": "geo_point",
+                  "indexPatternId": "1",
+                  "indexPatternTitle": "my_index",
+                },
+              ]
+            }
+            onSubmit={[Function]}
+          />,
+          "id": 3,
+          "title": "Draw distance",
+        },
+      ]
+    }
+  />
+</EuiPopover>
+`;
diff --git a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/index.js b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/index.js
deleted file mode 100644
index 5812604a91b87f..00000000000000
--- a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/index.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { connect } from 'react-redux';
-import { ToolsControl } from './tools_control';
-import { isDrawingFilter } from '../../../selectors/map_selectors';
-import { updateDrawState } from '../../../actions';
-
-function mapStateToProps(state = {}) {
-  return {
-    isDrawingFilter: isDrawingFilter(state),
-  };
-}
-
-function mapDispatchToProps(dispatch) {
-  return {
-    initiateDraw: (options) => {
-      dispatch(updateDrawState(options));
-    },
-    cancelDraw: () => {
-      dispatch(updateDrawState(null));
-    },
-  };
-}
-
-const connectedToolsControl = connect(mapStateToProps, mapDispatchToProps)(ToolsControl);
-export { connectedToolsControl as ToolsControl };
diff --git a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/index.ts b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/index.ts
new file mode 100644
index 00000000000000..70101f1ce6eba2
--- /dev/null
+++ b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/index.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AnyAction, Dispatch } from 'redux';
+import { connect } from 'react-redux';
+import { ToolsControl } from './tools_control';
+import { isDrawingFilter } from '../../../selectors/map_selectors';
+import { updateDrawState } from '../../../actions';
+import { MapStoreState } from '../../../reducers/store';
+import { DrawState } from '../../../../common/descriptor_types';
+
+function mapStateToProps(state: MapStoreState) {
+  return {
+    isDrawingFilter: isDrawingFilter(state),
+  };
+}
+
+function mapDispatchToProps(dispatch: Dispatch<AnyAction>) {
+  return {
+    initiateDraw: (drawState: DrawState) => {
+      dispatch<any>(updateDrawState(drawState));
+    },
+    cancelDraw: () => {
+      dispatch<any>(updateDrawState(null));
+    },
+  };
+}
+
+const connectedToolsControl = connect(mapStateToProps, mapDispatchToProps)(ToolsControl);
+export { connectedToolsControl as ToolsControl };
diff --git a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.js b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.js
deleted file mode 100644
index 017f0369e0b73d..00000000000000
--- a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.js
+++ /dev/null
@@ -1,227 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { Component } from 'react';
-import {
-  EuiButtonIcon,
-  EuiPopover,
-  EuiContextMenu,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiButton,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { DRAW_TYPE, ES_GEO_FIELD_TYPE } from '../../../../common/constants';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { GeometryFilterForm } from '../../../components/geometry_filter_form';
-import { DistanceFilterForm } from '../../../components/distance_filter_form';
-
-const DRAW_SHAPE_LABEL = i18n.translate('xpack.maps.toolbarOverlay.drawShapeLabel', {
-  defaultMessage: 'Draw shape to filter data',
-});
-
-const DRAW_BOUNDS_LABEL = i18n.translate('xpack.maps.toolbarOverlay.drawBoundsLabel', {
-  defaultMessage: 'Draw bounds to filter data',
-});
-
-const DRAW_DISTANCE_LABEL = i18n.translate('xpack.maps.toolbarOverlay.drawDistanceLabel', {
-  defaultMessage: 'Draw distance to filter data',
-});
-
-const DRAW_SHAPE_LABEL_SHORT = i18n.translate('xpack.maps.toolbarOverlay.drawShapeLabelShort', {
-  defaultMessage: 'Draw shape',
-});
-
-const DRAW_BOUNDS_LABEL_SHORT = i18n.translate('xpack.maps.toolbarOverlay.drawBoundsLabelShort', {
-  defaultMessage: 'Draw bounds',
-});
-
-const DRAW_DISTANCE_LABEL_SHORT = i18n.translate(
-  'xpack.maps.toolbarOverlay.drawDistanceLabelShort',
-  {
-    defaultMessage: 'Draw distance',
-  }
-);
-
-export class ToolsControl extends Component {
-  state = {
-    isPopoverOpen: false,
-  };
-
-  _togglePopover = () => {
-    this.setState((prevState) => ({
-      isPopoverOpen: !prevState.isPopoverOpen,
-    }));
-  };
-
-  _closePopover = () => {
-    this.setState({ isPopoverOpen: false });
-  };
-
-  _initiateShapeDraw = (options) => {
-    this.props.initiateDraw({
-      drawType: DRAW_TYPE.POLYGON,
-      ...options,
-    });
-    this._closePopover();
-  };
-
-  _initiateBoundsDraw = (options) => {
-    this.props.initiateDraw({
-      drawType: DRAW_TYPE.BOUNDS,
-      ...options,
-    });
-    this._closePopover();
-  };
-
-  _initiateDistanceDraw = (options) => {
-    this.props.initiateDraw({
-      drawType: DRAW_TYPE.DISTANCE,
-      ...options,
-    });
-    this._closePopover();
-  };
-
-  _getDrawPanels() {
-    const tools = [
-      {
-        name: DRAW_SHAPE_LABEL,
-        panel: 1,
-      },
-      {
-        name: DRAW_BOUNDS_LABEL,
-        panel: 2,
-      },
-    ];
-
-    const hasGeoPoints = this.props.geoFields.some(({ geoFieldType }) => {
-      return geoFieldType === ES_GEO_FIELD_TYPE.GEO_POINT;
-    });
-    if (hasGeoPoints) {
-      tools.push({
-        name: DRAW_DISTANCE_LABEL,
-        panel: 3,
-      });
-    }
-
-    return [
-      {
-        id: 0,
-        title: i18n.translate('xpack.maps.toolbarOverlay.tools.toolbarTitle', {
-          defaultMessage: 'Tools',
-        }),
-        items: tools,
-      },
-      {
-        id: 1,
-        title: DRAW_SHAPE_LABEL_SHORT,
-        content: (
-          <GeometryFilterForm
-            className="mapDrawControl__geometryFilterForm"
-            buttonLabel={DRAW_SHAPE_LABEL_SHORT}
-            geoFields={this.props.geoFields}
-            getFilterActions={this.props.getFilterActions}
-            getActionContext={this.props.getActionContext}
-            intitialGeometryLabel={i18n.translate(
-              'xpack.maps.toolbarOverlay.drawShape.initialGeometryLabel',
-              {
-                defaultMessage: 'shape',
-              }
-            )}
-            onSubmit={this._initiateShapeDraw}
-          />
-        ),
-      },
-      {
-        id: 2,
-        title: DRAW_BOUNDS_LABEL_SHORT,
-        content: (
-          <GeometryFilterForm
-            className="mapDrawControl__geometryFilterForm"
-            buttonLabel={DRAW_BOUNDS_LABEL_SHORT}
-            geoFields={this.props.geoFields}
-            getFilterActions={this.props.getFilterActions}
-            getActionContext={this.props.getActionContext}
-            intitialGeometryLabel={i18n.translate(
-              'xpack.maps.toolbarOverlay.drawBounds.initialGeometryLabel',
-              {
-                defaultMessage: 'bounds',
-              }
-            )}
-            onSubmit={this._initiateBoundsDraw}
-          />
-        ),
-      },
-      {
-        id: 3,
-        title: DRAW_DISTANCE_LABEL_SHORT,
-        content: (
-          <DistanceFilterForm
-            className="mapDrawControl__geometryFilterForm"
-            buttonLabel={DRAW_DISTANCE_LABEL_SHORT}
-            geoFields={this.props.geoFields.filter(({ geoFieldType }) => {
-              return geoFieldType === ES_GEO_FIELD_TYPE.GEO_POINT;
-            })}
-            getFilterActions={this.props.getFilterActions}
-            getActionContext={this.props.getActionContext}
-            onSubmit={this._initiateDistanceDraw}
-          />
-        ),
-      },
-    ];
-  }
-
-  _renderToolsButton() {
-    return (
-      <EuiButtonIcon
-        className="mapToolbarOverlay__button"
-        color="text"
-        iconType="wrench"
-        onClick={this._togglePopover}
-        aria-label={i18n.translate('xpack.maps.toolbarOverlay.toolsControlTitle', {
-          defaultMessage: 'Tools',
-        })}
-        title={i18n.translate('xpack.maps.toolbarOverlay.toolsControlTitle', {
-          defaultMessage: 'Tools',
-        })}
-      />
-    );
-  }
-
-  render() {
-    const toolsPopoverButton = (
-      <EuiPopover
-        id="contextMenu"
-        button={this._renderToolsButton()}
-        isOpen={this.state.isPopoverOpen}
-        closePopover={this._closePopover}
-        panelPaddingSize="none"
-        withTitle
-        anchorPosition="leftUp"
-      >
-        <EuiContextMenu initialPanelId={0} panels={this._getDrawPanels()} />
-      </EuiPopover>
-    );
-
-    if (!this.props.isDrawingFilter) {
-      return toolsPopoverButton;
-    }
-
-    return (
-      <EuiFlexGroup gutterSize="s">
-        <EuiFlexItem>{toolsPopoverButton}</EuiFlexItem>
-        <EuiFlexItem>
-          <EuiButton size="s" fill onClick={this.props.cancelDraw}>
-            <FormattedMessage
-              id="xpack.maps.tooltip.toolsControl.cancelDrawButtonLabel"
-              defaultMessage="Cancel"
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    );
-  }
-}
diff --git a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.test.js b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.test.js
deleted file mode 100644
index f0e6dd43e68a10..00000000000000
--- a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.test.js
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { shallow } from 'enzyme';
-import { ToolsControl } from './tools_control';
-
-const defaultProps = {
-  initiateDraw: () => {},
-  cancelDraw: () => {},
-  geoFields: [
-    {
-      geoFieldName: 'location',
-      geoFieldType: 'geo_point',
-      indexPatternTitle: 'my_index',
-      indexPatternId: '1',
-    },
-  ],
-};
-
-test('renders', async () => {
-  const component = shallow(<ToolsControl {...defaultProps} />);
-
-  expect(component).toMatchSnapshot();
-});
-
-test('Should render cancel button when drawing', async () => {
-  const component = shallow(<ToolsControl {...defaultProps} isDrawingFilter />);
-
-  expect(component).toMatchSnapshot();
-});
diff --git a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.test.tsx b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.test.tsx
new file mode 100644
index 00000000000000..544d789468e896
--- /dev/null
+++ b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.test.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow } from 'enzyme';
+import { ToolsControl } from './tools_control';
+
+const defaultProps = {
+  initiateDraw: () => {},
+  cancelDraw: () => {},
+  geoFields: [
+    {
+      geoFieldName: 'location',
+      geoFieldType: 'geo_point',
+      indexPatternTitle: 'my_index',
+      indexPatternId: '1',
+    },
+  ],
+  isDrawingFilter: false,
+};
+
+test('renders', async () => {
+  const component = shallow(<ToolsControl {...defaultProps} />);
+
+  expect(component).toMatchSnapshot();
+});
+
+test('Should render cancel button when drawing', async () => {
+  const component = shallow(<ToolsControl {...defaultProps} isDrawingFilter />);
+
+  expect(component).toMatchSnapshot();
+});
diff --git a/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.tsx b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.tsx
new file mode 100644
index 00000000000000..fa0864ce680a24
--- /dev/null
+++ b/x-pack/plugins/maps/public/connected_components/toolbar_overlay/tools_control/tools_control.tsx
@@ -0,0 +1,263 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { Component } from 'react';
+import {
+  EuiButtonIcon,
+  EuiPopover,
+  EuiContextMenu,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButton,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { ActionExecutionContext, Action } from 'src/plugins/ui_actions/public';
+import { DRAW_TYPE, ES_GEO_FIELD_TYPE, ES_SPATIAL_RELATIONS } from '../../../../common/constants';
+// @ts-expect-error
+import { GeometryFilterForm } from '../../../components/geometry_filter_form';
+import { DistanceFilterForm } from '../../../components/distance_filter_form';
+import { GeoFieldWithIndex } from '../../../components/geo_field_with_index';
+import { DrawState } from '../../../../common/descriptor_types';
+
+const DRAW_SHAPE_LABEL = i18n.translate('xpack.maps.toolbarOverlay.drawShapeLabel', {
+  defaultMessage: 'Draw shape to filter data',
+});
+
+const DRAW_BOUNDS_LABEL = i18n.translate('xpack.maps.toolbarOverlay.drawBoundsLabel', {
+  defaultMessage: 'Draw bounds to filter data',
+});
+
+const DRAW_DISTANCE_LABEL = i18n.translate('xpack.maps.toolbarOverlay.drawDistanceLabel', {
+  defaultMessage: 'Draw distance to filter data',
+});
+
+const DRAW_SHAPE_LABEL_SHORT = i18n.translate('xpack.maps.toolbarOverlay.drawShapeLabelShort', {
+  defaultMessage: 'Draw shape',
+});
+
+const DRAW_BOUNDS_LABEL_SHORT = i18n.translate('xpack.maps.toolbarOverlay.drawBoundsLabelShort', {
+  defaultMessage: 'Draw bounds',
+});
+
+const DRAW_DISTANCE_LABEL_SHORT = i18n.translate(
+  'xpack.maps.toolbarOverlay.drawDistanceLabelShort',
+  {
+    defaultMessage: 'Draw distance',
+  }
+);
+
+interface Props {
+  cancelDraw: () => void;
+  geoFields: GeoFieldWithIndex[];
+  initiateDraw: (drawState: DrawState) => void;
+  isDrawingFilter: boolean;
+  getFilterActions?: () => Promise<Action[]>;
+  getActionContext?: () => ActionExecutionContext;
+}
+
+interface State {
+  isPopoverOpen: boolean;
+}
+
+export class ToolsControl extends Component<Props, State> {
+  state: State = {
+    isPopoverOpen: false,
+  };
+
+  _togglePopover = () => {
+    this.setState((prevState) => ({
+      isPopoverOpen: !prevState.isPopoverOpen,
+    }));
+  };
+
+  _closePopover = () => {
+    this.setState({ isPopoverOpen: false });
+  };
+
+  _initiateShapeDraw = (options: {
+    actionId: string;
+    geometryLabel: string;
+    indexPatternId: string;
+    geoFieldName: string;
+    geoFieldType: ES_GEO_FIELD_TYPE;
+    relation: ES_SPATIAL_RELATIONS;
+  }) => {
+    this.props.initiateDraw({
+      drawType: DRAW_TYPE.POLYGON,
+      ...options,
+    });
+    this._closePopover();
+  };
+
+  _initiateBoundsDraw = (options: {
+    actionId: string;
+    geometryLabel: string;
+    indexPatternId: string;
+    geoFieldName: string;
+    geoFieldType: ES_GEO_FIELD_TYPE;
+    relation: ES_SPATIAL_RELATIONS;
+  }) => {
+    this.props.initiateDraw({
+      drawType: DRAW_TYPE.BOUNDS,
+      ...options,
+    });
+    this._closePopover();
+  };
+
+  _initiateDistanceDraw = (options: {
+    actionId: string;
+    filterLabel: string;
+    indexPatternId: string;
+    geoFieldName: string;
+  }) => {
+    this.props.initiateDraw({
+      drawType: DRAW_TYPE.DISTANCE,
+      ...options,
+    });
+    this._closePopover();
+  };
+
+  _getDrawPanels() {
+    const tools = [
+      {
+        name: DRAW_SHAPE_LABEL,
+        panel: 1,
+      },
+      {
+        name: DRAW_BOUNDS_LABEL,
+        panel: 2,
+      },
+    ];
+
+    const hasGeoPoints = this.props.geoFields.some(({ geoFieldType }) => {
+      return geoFieldType === ES_GEO_FIELD_TYPE.GEO_POINT;
+    });
+    if (hasGeoPoints) {
+      tools.push({
+        name: DRAW_DISTANCE_LABEL,
+        panel: 3,
+      });
+    }
+
+    return [
+      {
+        id: 0,
+        title: i18n.translate('xpack.maps.toolbarOverlay.tools.toolbarTitle', {
+          defaultMessage: 'Tools',
+        }),
+        items: tools,
+      },
+      {
+        id: 1,
+        title: DRAW_SHAPE_LABEL_SHORT,
+        content: (
+          <GeometryFilterForm
+            className="mapDrawControl__geometryFilterForm"
+            buttonLabel={DRAW_SHAPE_LABEL_SHORT}
+            geoFields={this.props.geoFields}
+            getFilterActions={this.props.getFilterActions}
+            getActionContext={this.props.getActionContext}
+            intitialGeometryLabel={i18n.translate(
+              'xpack.maps.toolbarOverlay.drawShape.initialGeometryLabel',
+              {
+                defaultMessage: 'shape',
+              }
+            )}
+            onSubmit={this._initiateShapeDraw}
+          />
+        ),
+      },
+      {
+        id: 2,
+        title: DRAW_BOUNDS_LABEL_SHORT,
+        content: (
+          <GeometryFilterForm
+            className="mapDrawControl__geometryFilterForm"
+            buttonLabel={DRAW_BOUNDS_LABEL_SHORT}
+            geoFields={this.props.geoFields}
+            getFilterActions={this.props.getFilterActions}
+            getActionContext={this.props.getActionContext}
+            intitialGeometryLabel={i18n.translate(
+              'xpack.maps.toolbarOverlay.drawBounds.initialGeometryLabel',
+              {
+                defaultMessage: 'bounds',
+              }
+            )}
+            onSubmit={this._initiateBoundsDraw}
+          />
+        ),
+      },
+      {
+        id: 3,
+        title: DRAW_DISTANCE_LABEL_SHORT,
+        content: (
+          <DistanceFilterForm
+            className="mapDrawControl__geometryFilterForm"
+            buttonLabel={DRAW_DISTANCE_LABEL_SHORT}
+            geoFields={this.props.geoFields.filter(({ geoFieldType }) => {
+              return geoFieldType === ES_GEO_FIELD_TYPE.GEO_POINT;
+            })}
+            getFilterActions={this.props.getFilterActions}
+            getActionContext={this.props.getActionContext}
+            onSubmit={this._initiateDistanceDraw}
+          />
+        ),
+      },
+    ];
+  }
+
+  _renderToolsButton() {
+    return (
+      <EuiButtonIcon
+        className="mapToolbarOverlay__button"
+        color="text"
+        iconType="wrench"
+        onClick={this._togglePopover}
+        aria-label={i18n.translate('xpack.maps.toolbarOverlay.toolsControlTitle', {
+          defaultMessage: 'Tools',
+        })}
+        title={i18n.translate('xpack.maps.toolbarOverlay.toolsControlTitle', {
+          defaultMessage: 'Tools',
+        })}
+      />
+    );
+  }
+
+  render() {
+    const toolsPopoverButton = (
+      <EuiPopover
+        id="toolsControlPopover"
+        button={this._renderToolsButton()}
+        isOpen={this.state.isPopoverOpen}
+        closePopover={this._closePopover}
+        panelPaddingSize="none"
+        withTitle
+        anchorPosition="leftUp"
+      >
+        <EuiContextMenu initialPanelId={0} panels={this._getDrawPanels()} />
+      </EuiPopover>
+    );
+
+    if (!this.props.isDrawingFilter) {
+      return toolsPopoverButton;
+    }
+
+    return (
+      <EuiFlexGroup gutterSize="s">
+        <EuiFlexItem>{toolsPopoverButton}</EuiFlexItem>
+        <EuiFlexItem>
+          <EuiButton size="s" fill onClick={this.props.cancelDraw}>
+            <FormattedMessage
+              id="xpack.maps.tooltip.toolsControl.cancelDrawButtonLabel"
+              defaultMessage="Cancel"
+            />
+          </EuiButton>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    );
+  }
+}
diff --git a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/__snapshots__/toc_entry_actions_popover.test.tsx.snap b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/__snapshots__/toc_entry_actions_popover.test.tsx.snap
index 8a5b7cf9186a8a..0f620bdeb1c0e1 100644
--- a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/__snapshots__/toc_entry_actions_popover.test.tsx.snap
+++ b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/__snapshots__/toc_entry_actions_popover.test.tsx.snap
@@ -53,7 +53,7 @@ exports[`TOCEntryActionsPopover is rendered 1`] = `
   closePopover={[Function]}
   display="inlineBlock"
   hasArrow={true}
-  id="contextMenu"
+  id="testLayer"
   isOpen={false}
   ownFocus={false}
   panelPaddingSize="none"
@@ -181,7 +181,7 @@ exports[`TOCEntryActionsPopover should disable fit to data when supportsFitToBou
   closePopover={[Function]}
   display="inlineBlock"
   hasArrow={true}
-  id="contextMenu"
+  id="testLayer"
   isOpen={false}
   ownFocus={false}
   panelPaddingSize="none"
@@ -309,7 +309,7 @@ exports[`TOCEntryActionsPopover should have "show layer" action when layer is no
   closePopover={[Function]}
   display="inlineBlock"
   hasArrow={true}
-  id="contextMenu"
+  id="testLayer"
   isOpen={false}
   ownFocus={false}
   panelPaddingSize="none"
@@ -437,7 +437,7 @@ exports[`TOCEntryActionsPopover should not show edit actions in read only mode 1
   closePopover={[Function]}
   display="inlineBlock"
   hasArrow={true}
-  id="contextMenu"
+  id="testLayer"
   isOpen={false}
   ownFocus={false}
   panelPaddingSize="none"
diff --git a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx
index a1b9026fc57da7..8e021461880ed4 100644
--- a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx
+++ b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx
@@ -220,7 +220,7 @@ export class TOCEntryActionsPopover extends Component<Props, State> {
   render() {
     return (
       <EuiPopover
-        id="contextMenu"
+        id={this.props.layer.getId()}
         className="mapLayTocActions"
         button={this._renderPopoverToggleButton()}
         isOpen={this.state.isPopoverOpen}
diff --git a/x-pack/plugins/maps/public/index_pattern_util.ts b/x-pack/plugins/maps/public/index_pattern_util.ts
index 4b4bfb41990b92..bd2a14619ac419 100644
--- a/x-pack/plugins/maps/public/index_pattern_util.ts
+++ b/x-pack/plugins/maps/public/index_pattern_util.ts
@@ -81,6 +81,16 @@ export function supportsGeoTileAgg(field?: IFieldType): boolean {
   );
 }
 
+export function supportsMvt(indexPattern: IndexPattern, geoFieldName: string): boolean {
+  const field = indexPattern.fields.getByName(geoFieldName);
+  return !!field && field.type === ES_GEO_FIELD_TYPE.GEO_SHAPE;
+}
+
+export function getMvtDisabledReason() {
+  return i18n.translate('xpack.maps.mbt.disabled', {
+    defaultMessage: 'Display as vector tiles is only supported for geo_shape field-types.',
+  });
+}
 // Returns filtered fields list containing only fields that exist in _source.
 export function getSourceFields(fields: IFieldType[]): IFieldType[] {
   return fields.filter((field) => {
diff --git a/x-pack/plugins/maps/public/kibana_services.ts b/x-pack/plugins/maps/public/kibana_services.ts
index 239a2898a06fcf..c1dfb61e9f3b62 100644
--- a/x-pack/plugins/maps/public/kibana_services.ts
+++ b/x-pack/plugins/maps/public/kibana_services.ts
@@ -5,7 +5,7 @@
  */
 
 import _ from 'lodash';
-import { MapsLegacyConfigType } from '../../../../src/plugins/maps_legacy/public';
+import { MapsLegacyConfig } from '../../../../src/plugins/maps_legacy/config';
 import { MapsConfigType } from '../config';
 import { MapsPluginStartDependencies } from './plugin';
 import { CoreStart } from '../../../../src/core/public';
@@ -64,9 +64,8 @@ export const getShowMapsInspectorAdapter = () => getMapAppConfig().showMapsInspe
 export const getPreserveDrawingBuffer = () => getMapAppConfig().preserveDrawingBuffer;
 
 // map.* kibana.yml settings from maps_legacy plugin that are shared between OSS map visualizations and maps app
-let kibanaCommonConfig: MapsLegacyConfigType;
-export const setKibanaCommonConfig = (config: MapsLegacyConfigType) =>
-  (kibanaCommonConfig = config);
+let kibanaCommonConfig: MapsLegacyConfig;
+export const setKibanaCommonConfig = (config: MapsLegacyConfig) => (kibanaCommonConfig = config);
 export const getKibanaCommonConfig = () => kibanaCommonConfig;
 
 export const getIsEmsEnabled = () => getKibanaCommonConfig().includeElasticMapsService;
diff --git a/x-pack/plugins/maps/public/plugin.ts b/x-pack/plugins/maps/public/plugin.ts
index e03a085e9bc885..b08135b4e486cb 100644
--- a/x-pack/plugins/maps/public/plugin.ts
+++ b/x-pack/plugins/maps/public/plugin.ts
@@ -44,7 +44,7 @@ import { MapsStartApi } from './api';
 import { createSecurityLayerDescriptors, registerLayerWizard, registerSource } from './api';
 import { SharePluginSetup, SharePluginStart } from '../../../../src/plugins/share/public';
 import { EmbeddableStart } from '../../../../src/plugins/embeddable/public';
-import { MapsLegacyConfigType } from '../../../../src/plugins/maps_legacy/public';
+import { MapsLegacyConfig } from '../../../../src/plugins/maps_legacy/config';
 import { DataPublicPluginStart } from '../../../../src/plugins/data/public';
 import { LicensingPluginStart } from '../../licensing/public';
 import { StartContract as FileUploadStartContract } from '../../file_upload/public';
@@ -54,7 +54,7 @@ export interface MapsPluginSetupDependencies {
   home?: HomePublicPluginSetup;
   visualizations: VisualizationsSetup;
   embeddable: EmbeddableSetup;
-  mapsLegacy: { config: MapsLegacyConfigType };
+  mapsLegacy: { config: MapsLegacyConfig };
   share: SharePluginSetup;
 }
 
diff --git a/x-pack/plugins/maps/public/routing/bootstrap/services/gis_map_saved_object_loader.js b/x-pack/plugins/maps/public/routing/bootstrap/services/gis_map_saved_object_loader.js
index 6c7e141c2ab5a7..66af92c7a687ba 100644
--- a/x-pack/plugins/maps/public/routing/bootstrap/services/gis_map_saved_object_loader.js
+++ b/x-pack/plugins/maps/public/routing/bootstrap/services/gis_map_saved_object_loader.js
@@ -25,5 +25,5 @@ export const getMapsSavedObjectLoader = _.once(function () {
   };
   const SavedGisMap = createSavedGisMapClass(services);
 
-  return new SavedObjectLoader(SavedGisMap, getSavedObjectsClient(), getCoreChrome());
+  return new SavedObjectLoader(SavedGisMap, getSavedObjectsClient());
 });
diff --git a/x-pack/plugins/maps/public/routing/routes/list/maps_list_view.js b/x-pack/plugins/maps/public/routing/routes/list/maps_list_view.js
index e9229883d708d2..8fe6866cd78348 100644
--- a/x-pack/plugins/maps/public/routing/routes/list/maps_list_view.js
+++ b/x-pack/plugins/maps/public/routing/routes/list/maps_list_view.js
@@ -12,6 +12,7 @@ import {
   getUiSettings,
   getToasts,
   getCoreChrome,
+  getNavigateToApp,
 } from '../../../kibana_services';
 import {
   EuiTitle,
@@ -32,11 +33,18 @@ import {
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { addHelpMenuToAppChrome } from '../../../help_menu_util';
-import { Link } from 'react-router-dom';
 import { goToSpecifiedPath } from '../../maps_router';
+import { APP_ID, MAP_PATH } from '../../../../common/constants';
 
 export const EMPTY_FILTER = '';
 
+function navigateToNewMap() {
+  const navigateToApp = getNavigateToApp();
+  navigateToApp(APP_ID, {
+    path: MAP_PATH,
+  });
+}
+
 export class MapsListView extends React.Component {
   state = {
     hasInitialFetchReturned: false,
@@ -388,14 +396,12 @@ export class MapsListView extends React.Component {
     let createButton;
     if (!this.state.readOnly) {
       createButton = (
-        <Link to={'/map'}>
-          <EuiButton data-test-subj="newMapLink" fill>
-            <FormattedMessage
-              id="xpack.maps.mapListing.createMapButtonLabel"
-              defaultMessage="Create map"
-            />
-          </EuiButton>
-        </Link>
+        <EuiButton data-test-subj="newMapLink" fill onClick={navigateToNewMap}>
+          <FormattedMessage
+            id="xpack.maps.mapListing.createMapButtonLabel"
+            defaultMessage="Create map"
+          />
+        </EuiButton>
       );
     }
     return (
diff --git a/x-pack/plugins/maps/server/mvt/__tests__/json/0_0_0_search.json b/x-pack/plugins/maps/server/mvt/__tests__/json/0_0_0_search.json
new file mode 100644
index 00000000000000..0fc99ffd811f71
--- /dev/null
+++ b/x-pack/plugins/maps/server/mvt/__tests__/json/0_0_0_search.json
@@ -0,0 +1 @@
+{"took":0,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{"value":1,"relation":"eq"},"max_score":0,"hits":[{"_index":"poly","_id":"G7PRMXQBgyyZ-h5iYibj","_score":0,"_source":{"coordinates":{"coordinates":[[[-106.171875,36.59788913307022],[-50.625,-22.91792293614603],[4.921875,42.8115217450979],[-33.046875,63.54855223203644],[-66.796875,63.860035895395306],[-106.171875,36.59788913307022]]],"type":"polygon"}}}]}}
diff --git a/x-pack/plugins/maps/server/mvt/__tests__/pbf/0_0_0.pbf b/x-pack/plugins/maps/server/mvt/__tests__/pbf/0_0_0.pbf
new file mode 100644
index 00000000000000..9a9296e2ece3f9
Binary files /dev/null and b/x-pack/plugins/maps/server/mvt/__tests__/pbf/0_0_0.pbf differ
diff --git a/x-pack/plugins/maps/server/mvt/__tests__/tile_searches.ts b/x-pack/plugins/maps/server/mvt/__tests__/tile_searches.ts
new file mode 100644
index 00000000000000..317d6434cf81ef
--- /dev/null
+++ b/x-pack/plugins/maps/server/mvt/__tests__/tile_searches.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as path from 'path';
+import * as fs from 'fs';
+
+const search000path = path.resolve(__dirname, './json/0_0_0_search.json');
+const search000raw = fs.readFileSync(search000path);
+const search000json = JSON.parse((search000raw as unknown) as string);
+
+export const TILE_SEARCHES = {
+  '0.0.0': {
+    countResponse: {
+      count: 1,
+      _shards: {
+        total: 1,
+        successful: 1,
+        skipped: 0,
+        failed: 0,
+      },
+    },
+    searchResponse: search000json,
+  },
+  '1.1.0': {},
+};
diff --git a/x-pack/plugins/maps/server/mvt/get_tile.test.ts b/x-pack/plugins/maps/server/mvt/get_tile.test.ts
new file mode 100644
index 00000000000000..b9c928d594539c
--- /dev/null
+++ b/x-pack/plugins/maps/server/mvt/get_tile.test.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getTile } from './get_tile';
+import { TILE_SEARCHES } from './__tests__/tile_searches';
+import { Logger } from 'src/core/server';
+import * as path from 'path';
+import * as fs from 'fs';
+
+describe('getTile', () => {
+  const mockCallElasticsearch = jest.fn();
+
+  const requestBody = {
+    _source: { excludes: [] },
+    docvalue_fields: [],
+    query: { bool: { filter: [{ match_all: {} }], must: [], must_not: [], should: [] } },
+    script_fields: {},
+    size: 10000,
+    stored_fields: ['*'],
+  };
+  const geometryFieldName = 'coordinates';
+
+  beforeEach(() => {
+    mockCallElasticsearch.mockReset();
+  });
+
+  test('0.0.0 - under limit', async () => {
+    mockCallElasticsearch.mockImplementation((type) => {
+      if (type === 'count') {
+        return TILE_SEARCHES['0.0.0'].countResponse;
+      } else if (type === 'search') {
+        return TILE_SEARCHES['0.0.0'].searchResponse;
+      } else {
+        throw new Error(`${type} not recognized`);
+      }
+    });
+
+    const tile = await getTile({
+      x: 0,
+      y: 0,
+      z: 0,
+      index: 'world_countries',
+      requestBody,
+      geometryFieldName,
+      logger: ({
+        info: () => {},
+      } as unknown) as Logger,
+      callElasticsearch: mockCallElasticsearch,
+    });
+
+    if (tile === null) {
+      throw new Error('Tile should be created');
+    }
+
+    const expectedPath = path.resolve(__dirname, './__tests__/pbf/0_0_0.pbf');
+    const expectedBin = fs.readFileSync(expectedPath, 'binary');
+    const expectedTile = Buffer.from(expectedBin, 'binary');
+    expect(expectedTile.equals(tile)).toBe(true);
+  });
+});
diff --git a/x-pack/plugins/maps/server/mvt/get_tile.ts b/x-pack/plugins/maps/server/mvt/get_tile.ts
new file mode 100644
index 00000000000000..9621f7f174a306
--- /dev/null
+++ b/x-pack/plugins/maps/server/mvt/get_tile.ts
@@ -0,0 +1,226 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+// @ts-expect-error
+import geojsonvt from 'geojson-vt';
+// @ts-expect-error
+import vtpbf from 'vt-pbf';
+import { Logger } from 'src/core/server';
+import { Feature, FeatureCollection, Polygon } from 'geojson';
+import {
+  ES_GEO_FIELD_TYPE,
+  FEATURE_ID_PROPERTY_NAME,
+  KBN_TOO_MANY_FEATURES_PROPERTY,
+  MVT_SOURCE_LAYER_NAME,
+} from '../../common/constants';
+
+import { hitsToGeoJson } from '../../common/elasticsearch_geo_utils';
+import { flattenHit } from './util';
+
+interface ESBounds {
+  top_left: {
+    lon: number;
+    lat: number;
+  };
+  bottom_right: {
+    lon: number;
+    lat: number;
+  };
+}
+
+export async function getTile({
+  logger,
+  callElasticsearch,
+  index,
+  geometryFieldName,
+  x,
+  y,
+  z,
+  requestBody = {},
+}: {
+  x: number;
+  y: number;
+  z: number;
+  geometryFieldName: string;
+  index: string;
+  callElasticsearch: (type: string, ...args: any[]) => Promise<unknown>;
+  logger: Logger;
+  requestBody: any;
+}): Promise<Buffer | null> {
+  const geojsonBbox = tileToGeoJsonPolygon(x, y, z);
+
+  let resultFeatures: Feature[];
+  try {
+    let result;
+    try {
+      const geoShapeFilter = {
+        geo_shape: {
+          [geometryFieldName]: {
+            shape: geojsonBbox,
+            relation: 'INTERSECTS',
+          },
+        },
+      };
+      requestBody.query.bool.filter.push(geoShapeFilter);
+
+      const esSearchQuery = {
+        index,
+        body: requestBody,
+      };
+
+      const esCountQuery = {
+        index,
+        body: {
+          query: requestBody.query,
+        },
+      };
+
+      const countResult = await callElasticsearch('count', esCountQuery);
+
+      // @ts-expect-error
+      if (countResult.count > requestBody.size) {
+        // Generate "too many features"-bounds
+        const bboxAggName = 'data_bounds';
+        const bboxQuery = {
+          index,
+          body: {
+            size: 0,
+            query: requestBody.query,
+            aggs: {
+              [bboxAggName]: {
+                geo_bounds: {
+                  field: geometryFieldName,
+                },
+              },
+            },
+          },
+        };
+
+        const bboxResult = await callElasticsearch('search', bboxQuery);
+
+        // @ts-expect-error
+        const bboxForData = esBboxToGeoJsonPolygon(bboxResult.aggregations[bboxAggName].bounds);
+
+        resultFeatures = [
+          {
+            type: 'Feature',
+            properties: {
+              [KBN_TOO_MANY_FEATURES_PROPERTY]: true,
+            },
+            geometry: bboxForData,
+          },
+        ];
+      } else {
+        // Perform actual search
+        result = await callElasticsearch('search', esSearchQuery);
+
+        // Todo: pass in epochMillies-fields
+        const featureCollection = hitsToGeoJson(
+          // @ts-expect-error
+          result.hits.hits,
+          (hit: Record<string, unknown>) => {
+            return flattenHit(geometryFieldName, hit);
+          },
+          geometryFieldName,
+          ES_GEO_FIELD_TYPE.GEO_SHAPE,
+          []
+        );
+
+        resultFeatures = featureCollection.features;
+
+        // Correct system-fields.
+        for (let i = 0; i < resultFeatures.length; i++) {
+          const props = resultFeatures[i].properties;
+          if (props !== null) {
+            props[FEATURE_ID_PROPERTY_NAME] = resultFeatures[i].id;
+          }
+        }
+      }
+    } catch (e) {
+      logger.warn(e.message);
+      throw e;
+    }
+
+    const featureCollection: FeatureCollection = {
+      features: resultFeatures,
+      type: 'FeatureCollection',
+    };
+
+    const tileIndex = geojsonvt(featureCollection, {
+      maxZoom: 24, // max zoom to preserve detail on; can't be higher than 24
+      tolerance: 3, // simplification tolerance (higher means simpler)
+      extent: 4096, // tile extent (both width and height)
+      buffer: 64, // tile buffer on each side
+      debug: 0, // logging level (0 to disable, 1 or 2)
+      lineMetrics: false, // whether to enable line metrics tracking for LineString/MultiLineString features
+      promoteId: null, // name of a feature property to promote to feature.id. Cannot be used with `generateId`
+      generateId: false, // whether to generate feature ids. Cannot be used with `promoteId`
+      indexMaxZoom: 5, // max zoom in the initial tile index
+      indexMaxPoints: 100000, // max number of points per tile in the index
+    });
+    const tile = tileIndex.getTile(z, x, y);
+
+    if (tile) {
+      const pbf = vtpbf.fromGeojsonVt({ [MVT_SOURCE_LAYER_NAME]: tile }, { version: 2 });
+      return Buffer.from(pbf);
+    } else {
+      return null;
+    }
+  } catch (e) {
+    logger.warn(`Cannot generate tile for ${z}/${x}/${y}: ${e.message}`);
+    return null;
+  }
+}
+
+function tileToGeoJsonPolygon(x: number, y: number, z: number): Polygon {
+  const wLon = tile2long(x, z);
+  const sLat = tile2lat(y + 1, z);
+  const eLon = tile2long(x + 1, z);
+  const nLat = tile2lat(y, z);
+
+  return {
+    type: 'Polygon',
+    coordinates: [
+      [
+        [wLon, sLat],
+        [wLon, nLat],
+        [eLon, nLat],
+        [eLon, sLat],
+        [wLon, sLat],
+      ],
+    ],
+  };
+}
+
+function tile2long(x: number, z: number): number {
+  return (x / Math.pow(2, z)) * 360 - 180;
+}
+
+function tile2lat(y: number, z: number): number {
+  const n = Math.PI - (2 * Math.PI * y) / Math.pow(2, z);
+  return (180 / Math.PI) * Math.atan(0.5 * (Math.exp(n) - Math.exp(-n)));
+}
+
+function esBboxToGeoJsonPolygon(esBounds: ESBounds): Polygon {
+  let minLon = esBounds.top_left.lon;
+  const maxLon = esBounds.bottom_right.lon;
+  minLon = minLon > maxLon ? minLon - 360 : minLon; // fixes an ES bbox to straddle dateline
+  const minLat = esBounds.bottom_right.lat;
+  const maxLat = esBounds.top_left.lat;
+
+  return {
+    type: 'Polygon',
+    coordinates: [
+      [
+        [minLon, minLat],
+        [minLon, maxLat],
+        [maxLon, maxLat],
+        [maxLon, minLat],
+        [minLon, minLat],
+      ],
+    ],
+  };
+}
diff --git a/x-pack/plugins/maps/server/mvt/mvt_routes.ts b/x-pack/plugins/maps/server/mvt/mvt_routes.ts
new file mode 100644
index 00000000000000..32c14a355ba2a1
--- /dev/null
+++ b/x-pack/plugins/maps/server/mvt/mvt_routes.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import rison from 'rison-node';
+import { schema } from '@kbn/config-schema';
+import { Logger } from 'src/core/server';
+import { IRouter } from 'src/core/server';
+import { MVT_GETTILE_API_PATH, API_ROOT_PATH } from '../../common/constants';
+import { getTile } from './get_tile';
+
+const CACHE_TIMEOUT = 0; // Todo. determine good value. Unsure about full-implications (e.g. wrt. time-based data).
+
+export function initMVTRoutes({ router, logger }: { logger: Logger; router: IRouter }) {
+  router.get(
+    {
+      path: `${API_ROOT_PATH}/${MVT_GETTILE_API_PATH}`,
+      validate: {
+        query: schema.object({
+          x: schema.number(),
+          y: schema.number(),
+          z: schema.number(),
+          geometryFieldName: schema.string(),
+          requestBody: schema.string(),
+          index: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      const { query } = request;
+
+      const callElasticsearch = async (type: string, ...args: any[]): Promise<unknown> => {
+        return await context.core.elasticsearch.legacy.client.callAsCurrentUser(type, ...args);
+      };
+
+      const requestBodyDSL = rison.decode(query.requestBody);
+
+      const tile = await getTile({
+        logger,
+        callElasticsearch,
+        geometryFieldName: query.geometryFieldName,
+        x: query.x,
+        y: query.y,
+        z: query.z,
+        index: query.index,
+        requestBody: requestBodyDSL,
+      });
+
+      if (tile) {
+        return response.ok({
+          body: tile,
+          headers: {
+            'content-disposition': 'inline',
+            'content-length': `${tile.length}`,
+            'Content-Type': 'application/x-protobuf',
+            'Cache-Control': `max-age=${CACHE_TIMEOUT}`,
+          },
+        });
+      } else {
+        return response.ok({
+          headers: {
+            'content-disposition': 'inline',
+            'content-length': '0',
+            'Content-Type': 'application/x-protobuf',
+            'Cache-Control': `max-age=${CACHE_TIMEOUT}`,
+          },
+        });
+      }
+    }
+  );
+}
diff --git a/x-pack/plugins/maps/server/mvt/util.ts b/x-pack/plugins/maps/server/mvt/util.ts
new file mode 100644
index 00000000000000..eb85468dd770dc
--- /dev/null
+++ b/x-pack/plugins/maps/server/mvt/util.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+// This implementation:
+// - does not include meta-fields
+// - does not validate the schema against the index-pattern (e.g. nested fields)
+// In the context of .mvt this is sufficient:
+// - only fields from the response are packed in the tile (more efficient)
+// - query-dsl submitted from the client, which was generated by the IndexPattern
+// todo: Ideally, this should adapt/reuse from https://github.com/elastic/kibana/blob/52b42a81faa9dd5c102b9fbb9a645748c3623121/src/plugins/data/common/index_patterns/index_patterns/flatten_hit.ts#L26
+import { GeoJsonProperties } from 'geojson';
+
+export function flattenHit(geometryField: string, hit: Record<string, unknown>): GeoJsonProperties {
+  const flat: GeoJsonProperties = {};
+  if (hit) {
+    flattenSource(flat, '', hit._source as Record<string, unknown>, geometryField);
+    if (hit.fields) {
+      flattenFields(flat, hit.fields as Array<Record<string, unknown>>);
+    }
+
+    // Attach meta fields
+    flat._index = hit._index;
+    flat._id = hit._id;
+  }
+  return flat;
+}
+
+function flattenSource(
+  accum: GeoJsonProperties,
+  path: string,
+  properties: Record<string, unknown> = {},
+  geometryField: string
+): GeoJsonProperties {
+  accum = accum || {};
+  for (const key in properties) {
+    if (properties.hasOwnProperty(key)) {
+      const newKey = path ? path + '.' + key : key;
+      let value;
+      if (geometryField === newKey) {
+        value = properties[key]; // do not deep-copy the geometry
+      } else if (properties[key] !== null && typeof value === 'object' && !Array.isArray(value)) {
+        value = flattenSource(
+          accum,
+          newKey,
+          properties[key] as Record<string, unknown>,
+          geometryField
+        );
+      } else {
+        value = properties[key];
+      }
+      accum[newKey] = value;
+    }
+  }
+  return accum;
+}
+
+function flattenFields(accum: GeoJsonProperties = {}, fields: Array<Record<string, unknown>>) {
+  accum = accum || {};
+  for (const key in fields) {
+    if (fields.hasOwnProperty(key)) {
+      const value = fields[key];
+      if (Array.isArray(value)) {
+        accum[key] = value[0];
+      } else {
+        accum[key] = value;
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/maps/server/plugin.ts b/x-pack/plugins/maps/server/plugin.ts
index 7d091099c1aaa8..6862e7536b07ff 100644
--- a/x-pack/plugins/maps/server/plugin.ts
+++ b/x-pack/plugins/maps/server/plugin.ts
@@ -27,6 +27,7 @@ import { ILicense } from '../../licensing/common/types';
 import { LicensingPluginSetup } from '../../licensing/server';
 import { HomeServerPluginSetup } from '../../../../src/plugins/home/server';
 import { MapsLegacyPluginSetup } from '../../../../src/plugins/maps_legacy/server';
+import { MapsLegacyConfig } from '../../../../src/plugins/maps_legacy/config';
 
 interface SetupDeps {
   features: FeaturesPluginSetupContract;
@@ -50,7 +51,7 @@ export class MapsPlugin implements Plugin {
   _initHomeData(
     home: HomeServerPluginSetup,
     prependBasePath: (path: string) => string,
-    mapConfig: any
+    mapsLegacyConfig: MapsLegacyConfig
   ) {
     const sampleDataLinkLabel = i18n.translate('xpack.maps.sampleDataLinkLabel', {
       defaultMessage: 'Map',
@@ -123,7 +124,7 @@ export class MapsPlugin implements Plugin {
       home.tutorials.registerTutorial(
         emsBoundariesSpecProvider({
           prependBasePath,
-          emsLandingPageUrl: mapConfig.emsLandingPageUrl,
+          emsLandingPageUrl: mapsLegacyConfig.emsLandingPageUrl,
         })
       );
     }
@@ -160,7 +161,7 @@ export class MapsPlugin implements Plugin {
       }
     });
 
-    this._initHomeData(home, core.http.basePath.prepend, currentConfig);
+    this._initHomeData(home, core.http.basePath.prepend, mapsLegacyConfig);
 
     features.registerFeature({
       id: APP_ID,
diff --git a/x-pack/plugins/maps/server/routes.js b/x-pack/plugins/maps/server/routes.js
index 1876c0de19c560..6b19103b597228 100644
--- a/x-pack/plugins/maps/server/routes.js
+++ b/x-pack/plugins/maps/server/routes.js
@@ -22,6 +22,7 @@ import {
   EMS_SPRITES_PATH,
   INDEX_SETTINGS_API_PATH,
   FONTS_API_PATH,
+  API_ROOT_PATH,
 } from '../common/constants';
 import { EMSClient } from '@elastic/ems-client';
 import fetch from 'node-fetch';
@@ -30,8 +31,7 @@ import { getIndexPatternSettings } from './lib/get_index_pattern_settings';
 import { schema } from '@kbn/config-schema';
 import fs from 'fs';
 import path from 'path';
-
-const ROOT = `/${GIS_API_PATH}`;
+import { initMVTRoutes } from './mvt/mvt_routes';
 
 export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
   let emsClient;
@@ -69,7 +69,7 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
 
   router.get(
     {
-      path: `${ROOT}/${EMS_FILES_API_PATH}/${EMS_FILES_DEFAULT_JSON_PATH}`,
+      path: `${API_ROOT_PATH}/${EMS_FILES_API_PATH}/${EMS_FILES_DEFAULT_JSON_PATH}`,
       validate: {
         query: schema.object({
           id: schema.maybe(schema.string()),
@@ -109,7 +109,7 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
 
   router.get(
     {
-      path: `${ROOT}/${EMS_TILES_API_PATH}/${EMS_TILES_RASTER_TILE_PATH}`,
+      path: `${API_ROOT_PATH}/${EMS_TILES_API_PATH}/${EMS_TILES_RASTER_TILE_PATH}`,
       validate: false,
     },
     async (context, request, response) => {
@@ -145,7 +145,7 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
 
   router.get(
     {
-      path: `${ROOT}/${EMS_CATALOGUE_PATH}`,
+      path: `${API_ROOT_PATH}/${EMS_CATALOGUE_PATH}`,
       validate: false,
     },
     async (context, request, { ok, badRequest }) => {
@@ -181,7 +181,7 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
 
   router.get(
     {
-      path: `${ROOT}/${EMS_FILES_CATALOGUE_PATH}/{emsVersion}/manifest`,
+      path: `${API_ROOT_PATH}/${EMS_FILES_CATALOGUE_PATH}/{emsVersion}/manifest`,
       validate: false,
     },
     async (context, request, { ok, badRequest }) => {
@@ -213,7 +213,7 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
 
   router.get(
     {
-      path: `${ROOT}/${EMS_TILES_CATALOGUE_PATH}/{emsVersion}/manifest`,
+      path: `${API_ROOT_PATH}/${EMS_TILES_CATALOGUE_PATH}/{emsVersion}/manifest`,
       validate: false,
     },
     async (context, request, { ok, badRequest }) => {
@@ -257,7 +257,7 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
 
   router.get(
     {
-      path: `${ROOT}/${EMS_TILES_API_PATH}/${EMS_TILES_RASTER_STYLE_PATH}`,
+      path: `${API_ROOT_PATH}/${EMS_TILES_API_PATH}/${EMS_TILES_RASTER_STYLE_PATH}`,
       validate: {
         query: schema.object({
           id: schema.maybe(schema.string()),
@@ -293,7 +293,7 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
 
   router.get(
     {
-      path: `${ROOT}/${EMS_TILES_API_PATH}/${EMS_TILES_VECTOR_STYLE_PATH}`,
+      path: `${API_ROOT_PATH}/${EMS_TILES_API_PATH}/${EMS_TILES_VECTOR_STYLE_PATH}`,
       validate: {
         query: schema.object({
           id: schema.string(),
@@ -341,7 +341,7 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
 
   router.get(
     {
-      path: `${ROOT}/${EMS_TILES_API_PATH}/${EMS_TILES_VECTOR_SOURCE_PATH}`,
+      path: `${API_ROOT_PATH}/${EMS_TILES_API_PATH}/${EMS_TILES_VECTOR_SOURCE_PATH}`,
       validate: {
         query: schema.object({
           id: schema.string(),
@@ -379,7 +379,7 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
 
   router.get(
     {
-      path: `${ROOT}/${EMS_TILES_API_PATH}/${EMS_TILES_VECTOR_TILE_PATH}`,
+      path: `${API_ROOT_PATH}/${EMS_TILES_API_PATH}/${EMS_TILES_VECTOR_TILE_PATH}`,
       validate: {
         query: schema.object({
           id: schema.string(),
@@ -417,7 +417,7 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
 
   router.get(
     {
-      path: `${ROOT}/${EMS_TILES_API_PATH}/${EMS_GLYPHS_PATH}/{fontstack}/{range}`,
+      path: `${API_ROOT_PATH}/${EMS_TILES_API_PATH}/${EMS_GLYPHS_PATH}/{fontstack}/{range}`,
       validate: {
         params: schema.object({
           fontstack: schema.string(),
@@ -439,7 +439,7 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
 
   router.get(
     {
-      path: `${ROOT}/${EMS_TILES_API_PATH}/${EMS_SPRITES_PATH}/{id}/sprite{scaling?}.{extension}`,
+      path: `${API_ROOT_PATH}/${EMS_TILES_API_PATH}/${EMS_SPRITES_PATH}/{id}/sprite{scaling?}.{extension}`,
       validate: {
         query: schema.object({
           elastic_tile_service_tos: schema.maybe(schema.string()),
@@ -591,4 +591,6 @@ export function initRoutes(router, licenseUid, mapConfig, kbnVersion, logger) {
       return response.badRequest(`Cannot connect to EMS`);
     }
   }
+
+  initMVTRoutes({ router, logger });
 }
diff --git a/x-pack/plugins/maps/server/tutorials/ems/index.ts b/x-pack/plugins/maps/server/tutorials/ems/index.ts
index be15120cb19e14..867daddfd7b03a 100644
--- a/x-pack/plugins/maps/server/tutorials/ems/index.ts
+++ b/x-pack/plugins/maps/server/tutorials/ems/index.ts
@@ -60,7 +60,7 @@ Indexing EMS administrative boundaries in Elasticsearch allows for search on bou
                   }),
                   textPre: i18n.translate('xpack.maps.tutorials.ems.uploadStepText', {
                     defaultMessage:
-                      '1. Open [Elastic Maps]({newMapUrl}).\n\
+                      '1. Open [Maps]({newMapUrl}).\n\
 2. Click `Add layer`, then select `Upload GeoJSON`.\n\
 3. Upload the GeoJSON file and click `Import file`.',
                     values: {
diff --git a/x-pack/plugins/ml/common/constants/ml_url_generator.ts b/x-pack/plugins/ml/common/constants/ml_url_generator.ts
new file mode 100644
index 00000000000000..44f33aa329e7ae
--- /dev/null
+++ b/x-pack/plugins/ml/common/constants/ml_url_generator.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const ML_APP_URL_GENERATOR = 'ML_APP_URL_GENERATOR';
+
+export const ML_PAGES = {
+  ANOMALY_DETECTION_JOBS_MANAGE: 'jobs',
+  ANOMALY_EXPLORER: 'explorer',
+  SINGLE_METRIC_VIEWER: 'timeseriesexplorer',
+  DATA_FRAME_ANALYTICS_JOBS_MANAGE: 'data_frame_analytics',
+  DATA_FRAME_ANALYTICS_EXPLORATION: 'data_frame_analytics/exploration',
+  /**
+   * Page: Data Visualizer
+   */
+  DATA_VISUALIZER: 'datavisualizer',
+  /**
+   * Page: Data Visualizer
+   * Open data visualizer by selecting a Kibana index pattern or saved search
+   */
+  DATA_VISUALIZER_INDEX_SELECT: 'datavisualizer_index_select',
+  /**
+   * Page: Data Visualizer
+   * Open data visualizer by importing data from a log file
+   */
+  DATA_VISUALIZER_FILE: 'filedatavisualizer',
+  /**
+   * Page: Data Visualizer
+   * Open index data visualizer viewer page
+   */
+  DATA_VISUALIZER_INDEX_VIEWER: 'jobs/new_job/datavisualizer',
+  ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE: `jobs/new_job/step/job_type`,
+  SETTINGS: 'settings',
+  CALENDARS_MANAGE: 'settings/calendars_list',
+  FILTER_LISTS_MANAGE: 'settings/filter_lists',
+} as const;
diff --git a/x-pack/plugins/ml/common/constants/settings.ts b/x-pack/plugins/ml/common/constants/settings.ts
index 2df2ecd22e0788..bab2aa2f2a0aed 100644
--- a/x-pack/plugins/ml/common/constants/settings.ts
+++ b/x-pack/plugins/ml/common/constants/settings.ts
@@ -5,3 +5,11 @@
  */
 
 export const FILE_DATA_VISUALIZER_MAX_FILE_SIZE = 'ml:fileDataVisualizerMaxFileSize';
+export const ANOMALY_DETECTION_ENABLE_TIME_RANGE = 'ml:anomalyDetection:results:enableTimeDefaults';
+export const ANOMALY_DETECTION_DEFAULT_TIME_RANGE = 'ml:anomalyDetection:results:timeDefaults';
+
+export const DEFAULT_AD_RESULTS_TIME_FILTER = {
+  from: 'now-15m',
+  to: 'now',
+};
+export const DEFAULT_ENABLE_AD_RESULTS_TIME_FILTER = false;
diff --git a/x-pack/plugins/ml/common/types/ml_url_generator.ts b/x-pack/plugins/ml/common/types/ml_url_generator.ts
new file mode 100644
index 00000000000000..234be8b6faf909
--- /dev/null
+++ b/x-pack/plugins/ml/common/types/ml_url_generator.ts
@@ -0,0 +1,187 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RefreshInterval, TimeRange } from '../../../../../src/plugins/data/common/query';
+import { JobId } from '../../../reporting/common/types';
+import { ML_PAGES } from '../constants/ml_url_generator';
+
+type OptionalPageState = object | undefined;
+
+export type MLPageState<PageType, PageState> = PageState extends OptionalPageState
+  ? { page: PageType; pageState?: PageState }
+  : PageState extends object
+  ? { page: PageType; pageState: PageState }
+  : { page: PageType };
+
+export const ANALYSIS_CONFIG_TYPE = {
+  OUTLIER_DETECTION: 'outlier_detection',
+  REGRESSION: 'regression',
+  CLASSIFICATION: 'classification',
+} as const;
+
+type DataFrameAnalyticsType = typeof ANALYSIS_CONFIG_TYPE[keyof typeof ANALYSIS_CONFIG_TYPE];
+
+export interface MlCommonGlobalState {
+  time?: TimeRange;
+}
+export interface MlCommonAppState {
+  [key: string]: any;
+}
+
+export interface MlIndexBasedSearchState {
+  index?: string;
+  savedSearchId?: string;
+}
+
+export interface MlGenericUrlPageState extends MlIndexBasedSearchState {
+  globalState?: MlCommonGlobalState;
+  appState?: MlCommonAppState;
+  [key: string]: any;
+}
+
+export interface MlGenericUrlState {
+  page:
+    | typeof ML_PAGES.DATA_VISUALIZER_INDEX_VIEWER
+    | typeof ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE;
+  pageState: MlGenericUrlPageState;
+}
+
+export interface AnomalyDetectionQueryState {
+  jobId?: JobId;
+  groupIds?: string[];
+}
+
+export type AnomalyDetectionUrlState = MLPageState<
+  typeof ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE,
+  AnomalyDetectionQueryState | undefined
+>;
+export interface ExplorerAppState {
+  mlExplorerSwimlane: {
+    selectedType?: string;
+    selectedLanes?: string[];
+    selectedTimes?: number[];
+    showTopFieldValues?: boolean;
+    viewByFieldName?: string;
+    viewByPerPage?: number;
+    viewByFromPage?: number;
+  };
+  mlExplorerFilter: {
+    influencersFilterQuery?: unknown;
+    filterActive?: boolean;
+    filteredFields?: string[];
+    queryString?: string;
+  };
+  query?: any;
+}
+export interface ExplorerGlobalState {
+  ml: { jobIds: JobId[] };
+  time?: TimeRange;
+  refreshInterval?: RefreshInterval;
+}
+
+export interface ExplorerUrlPageState {
+  /**
+   * Job IDs
+   */
+  jobIds: JobId[];
+  /**
+   * Optionally set the time range in the time picker.
+   */
+  timeRange?: TimeRange;
+  /**
+   * Optionally set the refresh interval.
+   */
+  refreshInterval?: RefreshInterval;
+  /**
+   * Optionally set the query.
+   */
+  query?: any;
+  /**
+   * Optional state for the swim lane
+   */
+  mlExplorerSwimlane?: ExplorerAppState['mlExplorerSwimlane'];
+  mlExplorerFilter?: ExplorerAppState['mlExplorerFilter'];
+}
+
+export type ExplorerUrlState = MLPageState<typeof ML_PAGES.ANOMALY_EXPLORER, ExplorerUrlPageState>;
+
+export interface TimeSeriesExplorerGlobalState {
+  ml: {
+    jobIds: JobId[];
+  };
+  time?: TimeRange;
+  refreshInterval?: RefreshInterval;
+}
+
+export interface TimeSeriesExplorerAppState {
+  zoom?: {
+    from?: string;
+    to?: string;
+  };
+  mlTimeSeriesExplorer?: {
+    detectorIndex?: number;
+    entities?: Record<string, string>;
+  };
+  query?: any;
+}
+
+export interface TimeSeriesExplorerPageState
+  extends Pick<TimeSeriesExplorerAppState, 'zoom' | 'query'>,
+    Pick<TimeSeriesExplorerGlobalState, 'refreshInterval'> {
+  jobIds: JobId[];
+  timeRange?: TimeRange;
+  detectorIndex?: number;
+  entities?: Record<string, string>;
+}
+
+export type TimeSeriesExplorerUrlState = MLPageState<
+  typeof ML_PAGES.SINGLE_METRIC_VIEWER,
+  TimeSeriesExplorerPageState
+>;
+
+export interface DataFrameAnalyticsQueryState {
+  jobId?: JobId | JobId[];
+  groupIds?: string[];
+}
+
+export type DataFrameAnalyticsUrlState = MLPageState<
+  typeof ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE,
+  DataFrameAnalyticsQueryState | undefined
+>;
+
+export interface DataVisualizerUrlState {
+  page:
+    | typeof ML_PAGES.DATA_VISUALIZER
+    | typeof ML_PAGES.DATA_VISUALIZER_FILE
+    | typeof ML_PAGES.DATA_VISUALIZER_INDEX_SELECT;
+}
+
+export interface DataFrameAnalyticsExplorationQueryState {
+  ml: {
+    jobId: JobId;
+    analysisType: DataFrameAnalyticsType;
+  };
+}
+
+export type DataFrameAnalyticsExplorationUrlState = MLPageState<
+  typeof ML_PAGES.DATA_FRAME_ANALYTICS_EXPLORATION,
+  {
+    jobId: JobId;
+    analysisType: DataFrameAnalyticsType;
+  }
+>;
+
+/**
+ * Union type of ML URL state based on page
+ */
+export type MlUrlGeneratorState =
+  | AnomalyDetectionUrlState
+  | ExplorerUrlState
+  | TimeSeriesExplorerUrlState
+  | DataFrameAnalyticsUrlState
+  | DataFrameAnalyticsExplorationUrlState
+  | DataVisualizerUrlState
+  | MlGenericUrlState;
diff --git a/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.js b/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.js
index 5a7d2a9c3ddaa4..fdeab0c49e32b4 100644
--- a/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.js
+++ b/x-pack/plugins/ml/public/application/components/anomalies_table/links_menu.js
@@ -390,6 +390,7 @@ class LinksMenuUI extends Component {
           defaultMessage: 'Select action for anomaly at {time}',
           values: { time: formatHumanReadableDateTimeSeconds(anomaly.time) },
         })}
+        data-test-subj="mlAnomaliesListRowActionsButton"
       />
     );
 
@@ -404,6 +405,7 @@ class LinksMenuUI extends Component {
               this.closePopover();
               this.openCustomUrl(customUrl);
             }}
+            data-test-subj={`mlAnomaliesListRowActionCustomUrlButton_${index}`}
           >
             {customUrl.url_name}
           </EuiContextMenuItem>
@@ -420,6 +422,7 @@ class LinksMenuUI extends Component {
             this.closePopover();
             this.viewSeries();
           }}
+          data-test-subj="mlAnomaliesListRowActionViewSeriesButton"
         >
           <FormattedMessage
             id="xpack.ml.anomaliesTable.linksMenu.viewSeriesLabel"
@@ -438,6 +441,7 @@ class LinksMenuUI extends Component {
             this.closePopover();
             this.viewExamples();
           }}
+          data-test-subj="mlAnomaliesListRowActionViewExamplesButton"
         >
           <FormattedMessage
             id="xpack.ml.anomaliesTable.linksMenu.viewExamplesLabel"
@@ -456,6 +460,7 @@ class LinksMenuUI extends Component {
             this.closePopover();
             this.props.showRuleEditorFlyout(anomaly);
           }}
+          data-test-subj="mlAnomaliesListRowActionConfigureRulesButton"
         >
           <FormattedMessage
             id="xpack.ml.anomaliesTable.linksMenu.configureRulesLabel"
@@ -473,7 +478,7 @@ class LinksMenuUI extends Component {
         panelPaddingSize="none"
         anchorPosition="downLeft"
       >
-        <EuiContextMenuPanel items={items} />
+        <EuiContextMenuPanel items={items} data-test-subj="mlAnomaliesListRowActionsMenu" />
       </EuiPopover>
     );
   }
diff --git a/x-pack/plugins/ml/public/application/components/custom_hooks/use_create_ad_links.ts b/x-pack/plugins/ml/public/application/components/custom_hooks/use_create_ad_links.ts
new file mode 100644
index 00000000000000..368e758a027c49
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/components/custom_hooks/use_create_ad_links.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { useCallback } from 'react';
+import { useMlKibana, useUiSettings } from '../../contexts/kibana';
+import {
+  ANOMALY_DETECTION_DEFAULT_TIME_RANGE,
+  ANOMALY_DETECTION_ENABLE_TIME_RANGE,
+} from '../../../../common/constants/settings';
+import { mlJobService } from '../../services/job_service';
+
+export const useCreateADLinks = () => {
+  const {
+    services: {
+      http: { basePath },
+    },
+  } = useMlKibana();
+
+  const useUserTimeSettings = useUiSettings().get(ANOMALY_DETECTION_ENABLE_TIME_RANGE);
+  const userTimeSettings = useUiSettings().get(ANOMALY_DETECTION_DEFAULT_TIME_RANGE);
+  const createLinkWithUserDefaults = useCallback(
+    (location, jobList) => {
+      const resultsPageUrl = mlJobService.createResultsUrlForJobs(
+        jobList,
+        location,
+        useUserTimeSettings === true && userTimeSettings !== undefined
+          ? userTimeSettings
+          : undefined
+      );
+      return `${basePath.get()}/app/ml${resultsPageUrl}`;
+    },
+    [basePath]
+  );
+  return { createLinkWithUserDefaults };
+};
diff --git a/x-pack/plugins/ml/public/application/components/data_recognizer/recognized_result.js b/x-pack/plugins/ml/public/application/components/data_recognizer/recognized_result.js
index a710ce18856f09..1f03dbe1347569 100644
--- a/x-pack/plugins/ml/public/application/components/data_recognizer/recognized_result.js
+++ b/x-pack/plugins/ml/public/application/components/data_recognizer/recognized_result.js
@@ -29,7 +29,7 @@ export const RecognizedResult = ({ config, indexPattern, savedSearch }) => {
   return (
     <EuiFlexItem>
       <CreateJobLinkCard
-        data-test-subj={id}
+        data-test-subj={`mlRecognizerCard ${config.id}`}
         href={href}
         title={config.title}
         description={config.description}
diff --git a/x-pack/plugins/ml/public/application/components/items_grid/items_grid.js b/x-pack/plugins/ml/public/application/components/items_grid/items_grid.js
index 0d3a586485f98a..58b4caf5ce6f2e 100644
--- a/x-pack/plugins/ml/public/application/components/items_grid/items_grid.js
+++ b/x-pack/plugins/ml/public/application/components/items_grid/items_grid.js
@@ -57,7 +57,7 @@ export function ItemsGrid({
   const pageItems = items.slice(startIndex, startIndex + itemsPerPage);
   const gridItems = pageItems.map((item, index) => {
     return (
-      <EuiFlexItem key={`ml_grid_item_${index}`}>
+      <EuiFlexItem key={`ml_grid_item_${index}`} data-test-subj={`mlGridItem ${item}`}>
         <EuiCheckbox
           id={`ml_grid_item_${index}`}
           label={item}
@@ -65,6 +65,7 @@ export function ItemsGrid({
           onChange={(e) => {
             setItemSelected(item, e.target.checked);
           }}
+          data-test-subj={`mlGridItemCheckbox`}
         />
       </EuiFlexItem>
     );
diff --git a/x-pack/plugins/ml/public/application/components/job_selector/job_selector_flyout.tsx b/x-pack/plugins/ml/public/application/components/job_selector/job_selector_flyout.tsx
index 62a74ed142ccf0..6c57b3d08180d2 100644
--- a/x-pack/plugins/ml/public/application/components/job_selector/job_selector_flyout.tsx
+++ b/x-pack/plugins/ml/public/application/components/job_selector/job_selector_flyout.tsx
@@ -237,7 +237,7 @@ export const JobSelectorFlyout: FC<JobSelectorFlyoutProps> = ({
                 <EuiFlexItem grow={false}>
                   <EuiSwitch
                     label={i18n.translate('xpack.ml.jobSelector.applyTimerangeSwitchLabel', {
-                      defaultMessage: 'Apply timerange',
+                      defaultMessage: 'Apply time range',
                     })}
                     checked={applyTimeRange}
                     onChange={toggleTimerangeSwitch}
diff --git a/x-pack/plugins/ml/public/application/components/job_selector/job_selector_table/job_selector_table.js b/x-pack/plugins/ml/public/application/components/job_selector/job_selector_table/job_selector_table.js
index 7b104ea372ae56..1136487485f17b 100644
--- a/x-pack/plugins/ml/public/application/components/job_selector/job_selector_table/job_selector_table.js
+++ b/x-pack/plugins/ml/public/application/components/job_selector/job_selector_table/job_selector_table.js
@@ -174,7 +174,7 @@ export function JobSelectorTable({
         id: 'checkbox',
         isCheckbox: true,
         textOnly: false,
-        width: '24px',
+        width: '32px',
       },
       {
         label: 'group ID',
diff --git a/x-pack/plugins/ml/public/application/components/rule_editor/select_rule_action/__snapshots__/delete_rule_modal.test.js.snap b/x-pack/plugins/ml/public/application/components/rule_editor/select_rule_action/__snapshots__/delete_rule_modal.test.js.snap
index 708bddd1453930..a132e6682ee250 100644
--- a/x-pack/plugins/ml/public/application/components/rule_editor/select_rule_action/__snapshots__/delete_rule_modal.test.js.snap
+++ b/x-pack/plugins/ml/public/application/components/rule_editor/select_rule_action/__snapshots__/delete_rule_modal.test.js.snap
@@ -64,20 +64,12 @@ exports[`DeleteRuleModal renders modal after clicking delete rule link 1`] = `
       onConfirm={[Function]}
       title={
         <FormattedMessage
-          defaultMessage="Delete rule"
+          defaultMessage="Delete rule?"
           id="xpack.ml.ruleEditor.deleteRuleModal.deleteRuleTitle"
           values={Object {}}
         />
       }
-    >
-      <p>
-        <FormattedMessage
-          defaultMessage="Are you sure you want to delete this rule?"
-          id="xpack.ml.ruleEditor.deleteRuleModal.deleteRuleDescription"
-          values={Object {}}
-        />
-      </p>
-    </EuiConfirmModal>
+    />
   </EuiOverlayMask>
 </Fragment>
 `;
diff --git a/x-pack/plugins/ml/public/application/components/rule_editor/select_rule_action/delete_rule_modal.js b/x-pack/plugins/ml/public/application/components/rule_editor/select_rule_action/delete_rule_modal.js
index 9fcd457df008f0..5140fe77ff9792 100644
--- a/x-pack/plugins/ml/public/application/components/rule_editor/select_rule_action/delete_rule_modal.js
+++ b/x-pack/plugins/ml/public/application/components/rule_editor/select_rule_action/delete_rule_modal.js
@@ -47,7 +47,7 @@ export class DeleteRuleModal extends Component {
             title={
               <FormattedMessage
                 id="xpack.ml.ruleEditor.deleteRuleModal.deleteRuleTitle"
-                defaultMessage="Delete rule"
+                defaultMessage="Delete rule?"
               />
             }
             onCancel={this.closeModal}
@@ -66,14 +66,7 @@ export class DeleteRuleModal extends Component {
               />
             }
             defaultFocusedButton={EUI_MODAL_CONFIRM_BUTTON}
-          >
-            <p>
-              <FormattedMessage
-                id="xpack.ml.ruleEditor.deleteRuleModal.deleteRuleDescription"
-                defaultMessage="Are you sure you want to delete this rule?"
-              />
-            </p>
-          </EuiConfirmModal>
+          />
         </EuiOverlayMask>
       );
     }
diff --git a/x-pack/plugins/ml/public/application/contexts/kibana/index.ts b/x-pack/plugins/ml/public/application/contexts/kibana/index.ts
index 8a43ae12deb21c..44979a1b9c60ae 100644
--- a/x-pack/plugins/ml/public/application/contexts/kibana/index.ts
+++ b/x-pack/plugins/ml/public/application/contexts/kibana/index.ts
@@ -9,3 +9,4 @@ export { useNavigateToPath, NavigateToPath } from './use_navigate_to_path';
 export { useUiSettings } from './use_ui_settings_context';
 export { useTimefilter } from './use_timefilter';
 export { useNotifications } from './use_notifications_context';
+export { useMlUrlGenerator } from './use_create_url';
diff --git a/x-pack/plugins/ml/public/application/contexts/kibana/use_create_url.ts b/x-pack/plugins/ml/public/application/contexts/kibana/use_create_url.ts
new file mode 100644
index 00000000000000..48385ad3ae6a82
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/contexts/kibana/use_create_url.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useMlKibana } from './kibana_context';
+import { ML_APP_URL_GENERATOR } from '../../../../common/constants/ml_url_generator';
+
+export const useMlUrlGenerator = () => {
+  const {
+    services: {
+      share: {
+        urlGenerators: { getUrlGenerator },
+      },
+    },
+  } = useMlKibana();
+
+  return getUrlGenerator(ML_APP_URL_GENERATOR);
+};
diff --git a/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts b/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts
index f2db970bf5057e..96d41be03a142e 100644
--- a/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts
+++ b/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts
@@ -21,14 +21,19 @@ export const useNavigateToPath = () => {
 
   const location = useLocation();
 
-  return useMemo(
-    () => (path: string | undefined, preserveSearch = false) => {
-      navigateToUrl(
-        getUrlForApp(PLUGIN_ID, {
-          path: `${path}${preserveSearch === true ? location.search : ''}`,
-        })
-      );
-    },
-    [location]
-  );
+  return useMemo(() => {
+    return (path: string | undefined, preserveSearch = false) => {
+      if (path === undefined) return;
+      const modifiedPath = `${path}${preserveSearch === true ? location.search : ''}`;
+      /**
+       * Handle urls generated by MlUrlGenerator where '/app/ml' is automatically prepended
+       */
+      const url = modifiedPath.includes('/app/ml')
+        ? modifiedPath
+        : getUrlForApp(PLUGIN_ID, {
+            path: modifiedPath,
+          });
+      navigateToUrl(url);
+    };
+  }, [location]);
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/back_to_list_panel/back_to_list_panel.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/back_to_list_panel/back_to_list_panel.tsx
index babb5571052702..0560c3150a424c 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/back_to_list_panel/back_to_list_panel.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/back_to_list_panel/back_to_list_panel.tsx
@@ -7,13 +7,20 @@
 import React, { FC, Fragment } from 'react';
 import { EuiCard, EuiIcon } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { useNavigateToPath } from '../../../../../contexts/kibana';
+import { useMlKibana, useMlUrlGenerator } from '../../../../../contexts/kibana';
+import { ML_PAGES } from '../../../../../../../common/constants/ml_url_generator';
 
 export const BackToListPanel: FC = () => {
-  const navigateToPath = useNavigateToPath();
+  const urlGenerator = useMlUrlGenerator();
+  const {
+    services: {
+      application: { navigateToUrl },
+    },
+  } = useMlKibana();
 
   const redirectToAnalyticsManagementPage = async () => {
-    await navigateToPath('/data_frame_analytics');
+    const url = await urlGenerator.createUrl({ page: ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE });
+    await navigateToUrl(url);
   };
 
   return (
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/view_results_panel/view_results_panel.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/view_results_panel/view_results_panel.tsx
index 23a16ba84ef923..b832bfb2549c6d 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/view_results_panel/view_results_panel.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/view_results_panel/view_results_panel.tsx
@@ -7,20 +7,27 @@
 import React, { FC, Fragment } from 'react';
 import { EuiCard, EuiIcon } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { useNavigateToPath } from '../../../../../contexts/kibana';
-import { getResultsUrl } from '../../../analytics_management/components/analytics_list/common';
+import { useMlUrlGenerator } from '../../../../../contexts/kibana';
 import { ANALYSIS_CONFIG_TYPE } from '../../../../common/analytics';
-
+import { ML_PAGES } from '../../../../../../../common/constants/ml_url_generator';
+import { useNavigateToPath } from '../../../../../contexts/kibana';
 interface Props {
   jobId: string;
   analysisType: ANALYSIS_CONFIG_TYPE;
 }
 
 export const ViewResultsPanel: FC<Props> = ({ jobId, analysisType }) => {
+  const urlGenerator = useMlUrlGenerator();
   const navigateToPath = useNavigateToPath();
 
-  const redirectToAnalyticsManagementPage = async () => {
-    const path = getResultsUrl(jobId, analysisType);
+  const redirectToAnalyticsExplorationPage = async () => {
+    const path = await urlGenerator.createUrl({
+      page: ML_PAGES.DATA_FRAME_ANALYTICS_EXPLORATION,
+      pageState: {
+        jobId,
+        analysisType,
+      },
+    });
     await navigateToPath(path);
   };
 
@@ -38,7 +45,7 @@ export const ViewResultsPanel: FC<Props> = ({ jobId, analysisType }) => {
             defaultMessage: 'View results for the analytics job.',
           }
         )}
-        onClick={redirectToAnalyticsManagementPage}
+        onClick={redirectToAnalyticsExplorationPage}
         data-test-subj="analyticsWizardViewResultsCard"
       />
     </Fragment>
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_action_modal.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_action_modal.tsx
index 5ffa5e304b9968..5db8446dec32f7 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_action_modal.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_action_modal.tsx
@@ -14,7 +14,6 @@ import {
   EuiFlexItem,
   EUI_MODAL_CONFIRM_BUTTON,
 } from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
 
 import { DeleteAction } from './use_delete_action';
 
@@ -40,7 +39,7 @@ export const DeleteActionModal: FC<DeleteAction> = ({
       <EuiConfirmModal
         data-test-subj="mlAnalyticsJobDeleteModal"
         title={i18n.translate('xpack.ml.dataframe.analyticsList.deleteModalTitle', {
-          defaultMessage: 'Delete {analyticsId}',
+          defaultMessage: 'Delete {analyticsId}?',
           values: { analyticsId: item.config.id },
         })}
         onCancel={closeModal}
@@ -60,13 +59,6 @@ export const DeleteActionModal: FC<DeleteAction> = ({
         defaultFocusedButton={EUI_MODAL_CONFIRM_BUTTON}
         buttonColor="danger"
       >
-        <p>
-          <FormattedMessage
-            id="xpack.ml.dataframe.analyticsList.deleteModalBody"
-            defaultMessage="Are you sure you want to delete this analytics job?"
-          />
-        </p>
-
         <EuiFlexGroup direction="column" gutterSize="none">
           <EuiFlexItem>
             {userCanDeleteIndex && (
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_action_modal.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_action_modal.tsx
index fa559e807f5ea5..2048d1144952d7 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_action_modal.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_action_modal.tsx
@@ -17,7 +17,7 @@ export const StartActionModal: FC<StartAction> = ({ closeModal, item, startAndCl
         <EuiOverlayMask>
           <EuiConfirmModal
             title={i18n.translate('xpack.ml.dataframe.analyticsList.startModalTitle', {
-              defaultMessage: 'Start {analyticsId}',
+              defaultMessage: 'Start {analyticsId}?',
               values: { analyticsId: item.config.id },
             })}
             onCancel={closeModal}
@@ -40,7 +40,7 @@ export const StartActionModal: FC<StartAction> = ({ closeModal, item, startAndCl
             <p>
               {i18n.translate('xpack.ml.dataframe.analyticsList.startModalBody', {
                 defaultMessage:
-                  'A data frame analytics job will increase search and indexing load in your cluster. Please stop the analytics job if excessive load is experienced. Are you sure you want to start this analytics job?',
+                  'A data frame analytics job increases search and indexing load in your cluster. If excessive load occurs, stop the job.',
               })}
             </p>
           </EuiConfirmModal>
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
index c4c7a8a4ca11a8..6d73340cc396a7 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
@@ -5,17 +5,13 @@
  */
 
 import React, { FC, useCallback, useState, useEffect } from 'react';
-
 import { i18n } from '@kbn/i18n';
-
 import {
-  Direction,
-  EuiButton,
   EuiCallOut,
-  EuiEmptyPrompt,
   EuiFlexGroup,
   EuiFlexItem,
-  EuiInMemoryTable,
+  EuiBasicTable,
+  EuiSearchBar,
   EuiSearchBarProps,
   EuiSpacer,
 } from '@elastic/eui';
@@ -43,6 +39,39 @@ import {
   getGroupQueryText,
 } from '../../../../../jobs/jobs_list/components/utils';
 import { SourceSelection } from '../source_selection';
+import { filterAnalytics, AnalyticsSearchBar } from '../analytics_search_bar';
+import { AnalyticsEmptyPrompt } from './empty_prompt';
+import { useTableSettings } from './use_table_settings';
+import { RefreshAnalyticsListButton } from '../refresh_analytics_list_button';
+
+const filters: EuiSearchBarProps['filters'] = [
+  {
+    type: 'field_value_selection',
+    field: 'job_type',
+    name: i18n.translate('xpack.ml.dataframe.analyticsList.typeFilter', {
+      defaultMessage: 'Type',
+    }),
+    multiSelect: 'or',
+    options: Object.values(ANALYSIS_CONFIG_TYPE).map((val) => ({
+      value: val,
+      name: val,
+      view: getJobTypeBadge(val),
+    })),
+  },
+  {
+    type: 'field_value_selection',
+    field: 'state',
+    name: i18n.translate('xpack.ml.dataframe.analyticsList.statusFilter', {
+      defaultMessage: 'Status',
+    }),
+    multiSelect: 'or',
+    options: Object.values(DATA_FRAME_TASK_STATE).map((val) => ({
+      value: val,
+      name: val,
+      view: getTaskStateBadge(val),
+    })),
+  },
+];
 
 function getItemIdToExpandedRowMap(
   itemIds: DataFrameAnalyticsId[],
@@ -70,23 +99,23 @@ export const DataFrameAnalyticsList: FC<Props> = ({
   const [isInitialized, setIsInitialized] = useState(false);
   const [isSourceIndexModalVisible, setIsSourceIndexModalVisible] = useState(false);
   const [isLoading, setIsLoading] = useState(false);
-
+  const [filteredAnalytics, setFilteredAnalytics] = useState<{
+    active: boolean;
+    items: DataFrameAnalyticsListRow[];
+  }>({
+    active: false,
+    items: [],
+  });
   const [searchQueryText, setSearchQueryText] = useState('');
-
   const [analytics, setAnalytics] = useState<DataFrameAnalyticsListRow[]>([]);
   const [analyticsStats, setAnalyticsStats] = useState<AnalyticStatsBarStats | undefined>(
     undefined
   );
   const [expandedRowItemIds, setExpandedRowItemIds] = useState<DataFrameAnalyticsId[]>([]);
-
   const [errorMessage, setErrorMessage] = useState<any>(undefined);
-  const [searchError, setSearchError] = useState<any>(undefined);
-
-  const [pageIndex, setPageIndex] = useState(0);
-  const [pageSize, setPageSize] = useState(10);
-
-  const [sortField, setSortField] = useState<string>(DataFrameAnalyticsListColumn.id);
-  const [sortDirection, setSortDirection] = useState<Direction>('asc');
+  // Query text/job_id based on url but only after getAnalytics is done first
+  // selectedJobIdFromUrlInitialized makes sure the query is only run once since analytics is being refreshed constantly
+  const [selectedIdFromUrlInitialized, setSelectedIdFromUrlInitialized] = useState(false);
 
   const disabled =
     !checkPermission('canCreateDataFrameAnalytics') ||
@@ -100,9 +129,29 @@ export const DataFrameAnalyticsList: FC<Props> = ({
     blockRefresh
   );
 
-  // Query text/job_id based on url but only after getAnalytics is done first
-  // selectedJobIdFromUrlInitialized makes sure the query is only run once since analytics is being refreshed constantly
-  const [selectedIdFromUrlInitialized, setSelectedIdFromUrlInitialized] = useState(false);
+  const setQueryClauses = (queryClauses: any) => {
+    if (queryClauses.length) {
+      const filtered = filterAnalytics(analytics, queryClauses);
+      setFilteredAnalytics({ active: true, items: filtered });
+    } else {
+      setFilteredAnalytics({ active: false, items: [] });
+    }
+  };
+
+  const filterList = () => {
+    if (searchQueryText !== '' && selectedIdFromUrlInitialized === true) {
+      // trigger table filtering with query for job id to trigger table filter
+      const query = EuiSearchBar.Query.parse(searchQueryText);
+      let clauses: any = [];
+      if (query && query.ast !== undefined && query.ast.clauses !== undefined) {
+        clauses = query.ast.clauses;
+      }
+      setQueryClauses(clauses);
+    } else {
+      setQueryClauses([]);
+    }
+  };
+
   useEffect(() => {
     if (selectedIdFromUrlInitialized === false && analytics.length > 0) {
       const { jobId, groupIds } = getSelectedIdFromUrl(window.location.href);
@@ -116,9 +165,15 @@ export const DataFrameAnalyticsList: FC<Props> = ({
 
       setSelectedIdFromUrlInitialized(true);
       setSearchQueryText(queryText);
+    } else {
+      filterList();
     }
   }, [selectedIdFromUrlInitialized, analytics]);
 
+  useEffect(() => {
+    filterList();
+  }, [selectedIdFromUrlInitialized, searchQueryText]);
+
   const getAnalyticsCallback = useCallback(() => getAnalytics(true), []);
 
   // Subscribe to the refresh observable to trigger reloading the analytics list.
@@ -137,6 +192,10 @@ export const DataFrameAnalyticsList: FC<Props> = ({
     isMlEnabledInSpace
   );
 
+  const { onTableChange, pageOfItems, pagination, sorting } = useTableSettings(
+    filteredAnalytics.active ? filteredAnalytics.items : analytics
+  );
+
   // Before the analytics have been loaded for the first time, display the loading indicator only.
   // Otherwise a user would see 'No data frame analytics found' during the initial loading.
   if (!isInitialized) {
@@ -159,132 +218,45 @@ export const DataFrameAnalyticsList: FC<Props> = ({
 
   if (analytics.length === 0) {
     return (
-      <>
-        <EuiEmptyPrompt
-          iconType="createAdvancedJob"
-          title={
-            <h2>
-              {i18n.translate('xpack.ml.dataFrame.analyticsList.emptyPromptTitle', {
-                defaultMessage: 'Create your first data frame analytics job',
-              })}
-            </h2>
-          }
-          actions={
-            !isManagementTable
-              ? [
-                  <EuiButton
-                    onClick={() => setIsSourceIndexModalVisible(true)}
-                    isDisabled={disabled}
-                    color="primary"
-                    iconType="plusInCircle"
-                    fill
-                    data-test-subj="mlAnalyticsCreateFirstButton"
-                  >
-                    {i18n.translate('xpack.ml.dataFrame.analyticsList.emptyPromptButtonText', {
-                      defaultMessage: 'Create job',
-                    })}
-                  </EuiButton>,
-                ]
-              : []
-          }
-          data-test-subj="mlNoDataFrameAnalyticsFound"
+      <div data-test-subj="mlAnalyticsJobList">
+        <AnalyticsEmptyPrompt
+          isManagementTable={isManagementTable}
+          disabled={disabled}
+          onCreateFirstJobClick={() => setIsSourceIndexModalVisible(true)}
         />
         {isSourceIndexModalVisible === true && (
           <SourceSelection onClose={() => setIsSourceIndexModalVisible(false)} />
         )}
-      </>
+      </div>
     );
   }
 
-  const sorting = {
-    sort: {
-      field: sortField,
-      direction: sortDirection,
-    },
-  };
-
   const itemIdToExpandedRowMap = getItemIdToExpandedRowMap(expandedRowItemIds, analytics);
 
-  const pagination = {
-    initialPageIndex: pageIndex,
-    initialPageSize: pageSize,
-    totalItemCount: analytics.length,
-    pageSizeOptions: [10, 20, 50],
-    hidePerPageOptions: false,
-  };
-
-  const handleSearchOnChange: EuiSearchBarProps['onChange'] = (search) => {
-    if (search.error !== null) {
-      setSearchError(search.error.message);
-      return false;
-    }
-
-    setSearchError(undefined);
-    setSearchQueryText(search.queryText);
-    return true;
-  };
-
-  const search: EuiSearchBarProps = {
-    query: searchQueryText,
-    onChange: handleSearchOnChange,
-    box: {
-      incremental: true,
-    },
-    filters: [
-      {
-        type: 'field_value_selection',
-        field: 'job_type',
-        name: i18n.translate('xpack.ml.dataframe.analyticsList.typeFilter', {
-          defaultMessage: 'Type',
-        }),
-        multiSelect: 'or',
-        options: Object.values(ANALYSIS_CONFIG_TYPE).map((val) => ({
-          value: val,
-          name: val,
-          view: getJobTypeBadge(val),
-        })),
-      },
-      {
-        type: 'field_value_selection',
-        field: 'state',
-        name: i18n.translate('xpack.ml.dataframe.analyticsList.statusFilter', {
-          defaultMessage: 'Status',
-        }),
-        multiSelect: 'or',
-        options: Object.values(DATA_FRAME_TASK_STATE).map((val) => ({
-          value: val,
-          name: val,
-          view: getTaskStateBadge(val),
-        })),
-      },
-    ],
-  };
-
-  const onTableChange: EuiInMemoryTable<DataFrameAnalyticsListRow>['onTableChange'] = ({
-    page = { index: 0, size: 10 },
-    sort = { field: DataFrameAnalyticsListColumn.id, direction: 'asc' },
-  }) => {
-    const { index, size } = page;
-    setPageIndex(index);
-    setPageSize(size);
+  const stats = analyticsStats && (
+    <EuiFlexItem grow={false}>
+      <StatsBar stats={analyticsStats} dataTestSub={'mlAnalyticsStatsBar'} />
+    </EuiFlexItem>
+  );
 
-    const { field, direction } = sort;
-    setSortField(field);
-    setSortDirection(direction);
-  };
+  const managementStats = (
+    <EuiFlexItem>
+      <EuiFlexGroup justifyContent="spaceBetween">
+        {stats}
+        <EuiFlexItem grow={false}>
+          <RefreshAnalyticsListButton />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiFlexItem>
+  );
 
   return (
-    <>
+    <div data-test-subj="mlAnalyticsJobList">
       {modals}
-      <EuiSpacer size="m" />
+      {!isManagementTable && <EuiSpacer size="m" />}
       <EuiFlexGroup justifyContent="spaceBetween">
-        <EuiFlexItem grow={false}>
-          {analyticsStats && (
-            <EuiFlexItem grow={false}>
-              <StatsBar stats={analyticsStats} dataTestSub={'mlAnalyticsStatsBar'} />
-            </EuiFlexItem>
-          )}
-        </EuiFlexItem>
+        {!isManagementTable && stats}
+        {isManagementTable && managementStats}
         <EuiFlexItem grow={false}>
           <EuiFlexGroup alignItems="center" gutterSize="s">
             {!isManagementTable && (
@@ -300,22 +272,25 @@ export const DataFrameAnalyticsList: FC<Props> = ({
       </EuiFlexGroup>
       <EuiSpacer size="m" />
       <div data-test-subj="mlAnalyticsTableContainer">
-        <EuiInMemoryTable
-          allowNeutralSort={false}
+        <AnalyticsSearchBar
+          filters={filters}
+          searchQueryText={searchQueryText}
+          setSearchQueryText={setSearchQueryText}
+        />
+        <EuiSpacer size="l" />
+        <EuiBasicTable<DataFrameAnalyticsListRow>
           className="mlAnalyticsTable"
           columns={columns}
-          error={searchError}
           hasActions={false}
           isExpandable={true}
           isSelectable={false}
-          items={analytics}
+          items={pageOfItems}
           itemId={DataFrameAnalyticsListColumn.id}
           itemIdToExpandedRowMap={itemIdToExpandedRowMap}
           loading={isLoading}
-          onTableChange={onTableChange}
-          pagination={pagination}
+          onChange={onTableChange}
+          pagination={pagination!}
           sorting={sorting}
-          search={search}
           data-test-subj={isLoading ? 'mlAnalyticsTable loading' : 'mlAnalyticsTable loaded'}
           rowProps={(item) => ({
             'data-test-subj': `mlAnalyticsTableRow row-${item.id}`,
@@ -326,6 +301,6 @@ export const DataFrameAnalyticsList: FC<Props> = ({
       {isSourceIndexModalVisible === true && (
         <SourceSelection onClose={() => setIsSourceIndexModalVisible(false)} />
       )}
-    </>
+    </div>
   );
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
index 774864ae964a8e..994357412510df 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
@@ -26,6 +26,7 @@ export type Clause = Parameters<typeof Query['isMust']>[0];
 type ExtractClauseType<T> = T extends (x: any) => x is infer Type ? Type : never;
 export type TermClause = ExtractClauseType<typeof Ast['Term']['isInstance']>;
 export type FieldClause = ExtractClauseType<typeof Ast['Field']['isInstance']>;
+export type Value = Parameters<typeof Ast['Term']['must']>[0];
 
 interface ProgressSection {
   phase: string;
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/empty_prompt.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/empty_prompt.tsx
new file mode 100644
index 00000000000000..fb173697b45726
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/empty_prompt.tsx
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FC } from 'react';
+import { EuiButton, EuiEmptyPrompt } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+interface Props {
+  disabled: boolean;
+  isManagementTable: boolean;
+  onCreateFirstJobClick: () => void;
+}
+
+export const AnalyticsEmptyPrompt: FC<Props> = ({
+  disabled,
+  isManagementTable,
+  onCreateFirstJobClick,
+}) => (
+  <EuiEmptyPrompt
+    iconType="createAdvancedJob"
+    title={
+      <h2>
+        {i18n.translate('xpack.ml.dataFrame.analyticsList.emptyPromptTitle', {
+          defaultMessage: 'Create your first data frame analytics job',
+        })}
+      </h2>
+    }
+    actions={
+      !isManagementTable
+        ? [
+            <EuiButton
+              onClick={onCreateFirstJobClick}
+              isDisabled={disabled}
+              color="primary"
+              iconType="plusInCircle"
+              fill
+              data-test-subj="mlAnalyticsCreateFirstButton"
+            >
+              {i18n.translate('xpack.ml.dataFrame.analyticsList.emptyPromptButtonText', {
+                defaultMessage: 'Create job',
+              })}
+            </EuiButton>,
+          ]
+        : []
+    }
+    data-test-subj="mlNoDataFrameAnalyticsFound"
+  />
+);
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/expanded_row.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/expanded_row.tsx
index 645c6c276a6f9f..95204f9ba09fcd 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/expanded_row.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/expanded_row.tsx
@@ -14,7 +14,7 @@ import { i18n } from '@kbn/i18n';
 import { formatHumanReadableDateTimeSeconds } from '../../../../../util/date_utils';
 
 import { DataFrameAnalyticsListRow } from './common';
-import { ExpandedRowDetailsPane, SectionConfig } from './expanded_row_details_pane';
+import { ExpandedRowDetailsPane, SectionConfig, SectionItem } from './expanded_row_details_pane';
 import { ExpandedRowJsonPane } from './expanded_row_json_pane';
 import { ProgressBar } from './progress_bar';
 import {
@@ -28,6 +28,7 @@ import { getTaskStateBadge } from './use_columns';
 import { getDataFrameAnalyticsProgressPhase, isCompletedAnalyticsJob } from './common';
 import {
   isRegressionAnalysis,
+  getAnalysisType,
   ANALYSIS_CONFIG_TYPE,
   REGRESSION_STATS,
   isRegressionEvaluateResponse,
@@ -76,6 +77,7 @@ export const ExpandedRow: FC<Props> = ({ item }) => {
   const resultsField = item.config.dest.results_field;
   const jobIsCompleted = isCompletedAnalyticsJob(item.stats);
   const isRegressionJob = isRegressionAnalysis(item.config.analysis);
+  const analysisType = getAnalysisType(item.config.analysis);
 
   const loadData = async () => {
     setIsLoadingGeneralization(true);
@@ -160,25 +162,34 @@ export const ExpandedRow: FC<Props> = ({ item }) => {
 
   const stateValues: any = { ...item.stats };
 
+  const analysisStatsValues = stateValues.analysis_stats
+    ? stateValues.analysis_stats[`${analysisType}_stats`]
+    : undefined;
+
   if (item.config?.description) {
     stateValues.description = item.config.description;
   }
   delete stateValues.progress;
 
-  const state: SectionConfig = {
-    title: i18n.translate('xpack.ml.dataframe.analyticsList.expandedRow.tabs.jobSettings.state', {
-      defaultMessage: 'State',
-    }),
-    items: Object.entries(stateValues).map(([stateKey, stateValue]) => {
+  const stateItems = Object.entries(stateValues)
+    .map(([stateKey, stateValue]) => {
       const title = stateKey.toString();
       if (title === 'state') {
         return {
           title,
           description: getTaskStateBadge(getItemDescription(stateValue)),
         };
+      } else if (title !== 'analysis_stats') {
+        return { title, description: getItemDescription(stateValue) };
       }
-      return { title, description: getItemDescription(stateValue) };
+    })
+    .filter((stateItem) => stateItem !== undefined);
+
+  const state: SectionConfig = {
+    title: i18n.translate('xpack.ml.dataframe.analyticsList.expandedRow.tabs.jobSettings.state', {
+      defaultMessage: 'State',
     }),
+    items: stateItems as SectionItem[],
     position: 'left',
   };
 
@@ -204,7 +215,7 @@ export const ExpandedRow: FC<Props> = ({ item }) => {
         };
       }),
     ],
-    position: 'left',
+    position: 'right',
   };
 
   const stats: SectionConfig = {
@@ -221,9 +232,39 @@ export const ExpandedRow: FC<Props> = ({ item }) => {
       { title: 'model_memory_limit', description: item.config.model_memory_limit },
       { title: 'version', description: item.config.version },
     ],
-    position: 'right',
+    position: 'left',
   };
 
+  const analysisStats: SectionConfig | undefined = analysisStatsValues
+    ? {
+        title: i18n.translate(
+          'xpack.ml.dataframe.analyticsList.expandedRow.tabs.jobSettings.analysisStats',
+          {
+            defaultMessage: 'Analysis stats',
+          }
+        ),
+        items: [
+          {
+            title: 'timestamp',
+            description: formatHumanReadableDateTimeSeconds(
+              moment(analysisStatsValues.timestamp).unix() * 1000
+            ),
+          },
+          {
+            title: 'timing_stats',
+            description: getItemDescription(analysisStatsValues.timing_stats),
+          },
+          ...Object.entries(
+            analysisStatsValues.parameters || analysisStatsValues.hyperparameters || {}
+          ).map(([stateKey, stateValue]) => {
+            const title = stateKey.toString();
+            return { title, description: getItemDescription(stateValue) };
+          }),
+        ],
+        position: 'right',
+      }
+    : undefined;
+
   if (jobIsCompleted && isRegressionJob) {
     stats.items.push(
       {
@@ -309,13 +350,30 @@ export const ExpandedRow: FC<Props> = ({ item }) => {
     );
   }
 
+  const detailsSections: SectionConfig[] = [state, progress];
+  const statsSections: SectionConfig[] = [stats];
+
+  if (analysisStats !== undefined) {
+    statsSections.push(analysisStats);
+  }
+
   const tabs = [
     {
       id: 'ml-analytics-job-details',
       name: i18n.translate('xpack.ml.dataframe.analyticsList.expandedRow.tabs.jobSettingsLabel', {
         defaultMessage: 'Job details',
       }),
-      content: <ExpandedRowDetailsPane sections={[state, progress, stats]} />,
+      content: <ExpandedRowDetailsPane sections={detailsSections} />,
+    },
+    {
+      id: 'ml-analytics-job-stats',
+      name: i18n.translate(
+        'xpack.ml.dataframe.analyticsList.analyticsDetails.tabs.analyticsStatsLabel',
+        {
+          defaultMessage: 'Job stats',
+        }
+      ),
+      content: <ExpandedRowDetailsPane sections={statsSections} />,
     },
     {
       id: 'ml-analytics-job-json',
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
index 7001681b6917aa..ef1d373a55a124 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
@@ -23,7 +23,6 @@ import { getJobIdUrl, TAB_IDS } from '../../../../../util/get_selected_ids_url';
 
 import { getAnalysisType, DataFrameAnalyticsId } from '../../../../common';
 import {
-  getDataFrameAnalyticsProgress,
   getDataFrameAnalyticsProgressPhase,
   isDataFrameAnalyticsFailed,
   isDataFrameAnalyticsRunning,
@@ -76,7 +75,6 @@ export const progressColumn = {
   name: i18n.translate('xpack.ml.dataframe.analyticsList.progress', {
     defaultMessage: 'Progress',
   }),
-  sortable: (item: DataFrameAnalyticsListRow) => getDataFrameAnalyticsProgress(item.stats),
   truncateText: true,
   render(item: DataFrameAnalyticsListRow) {
     const { currentPhase, progress, totalPhases } = getDataFrameAnalyticsProgressPhase(item.stats);
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_table_settings.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_table_settings.ts
new file mode 100644
index 00000000000000..57eb9f6857053f
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_table_settings.ts
@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useState } from 'react';
+import { Direction, EuiBasicTableProps, EuiTableSortingType } from '@elastic/eui';
+import sortBy from 'lodash/sortBy';
+import get from 'lodash/get';
+import { DataFrameAnalyticsListColumn, DataFrameAnalyticsListRow } from './common';
+
+const PAGE_SIZE = 10;
+const PAGE_SIZE_OPTIONS = [10, 25, 50];
+
+const jobPropertyMap = {
+  ID: 'id',
+  Status: 'state',
+  Type: 'job_type',
+};
+
+interface AnalyticsBasicTableSettings {
+  pageIndex: number;
+  pageSize: number;
+  totalItemCount: number;
+  hidePerPageOptions: boolean;
+  sortField: string;
+  sortDirection: Direction;
+}
+
+interface UseTableSettingsReturnValue {
+  onTableChange: EuiBasicTableProps<DataFrameAnalyticsListRow>['onChange'];
+  pageOfItems: DataFrameAnalyticsListRow[];
+  pagination: EuiBasicTableProps<DataFrameAnalyticsListRow>['pagination'];
+  sorting: EuiTableSortingType<any>;
+}
+
+export function useTableSettings(items: DataFrameAnalyticsListRow[]): UseTableSettingsReturnValue {
+  const [tableSettings, setTableSettings] = useState<AnalyticsBasicTableSettings>({
+    pageIndex: 0,
+    pageSize: PAGE_SIZE,
+    totalItemCount: 0,
+    hidePerPageOptions: false,
+    sortField: DataFrameAnalyticsListColumn.id,
+    sortDirection: 'asc',
+  });
+
+  const getPageOfItems = (
+    list: any[],
+    index: number,
+    size: number,
+    sortField: string,
+    sortDirection: Direction
+  ) => {
+    list = sortBy(list, (item) =>
+      get(item, jobPropertyMap[sortField as keyof typeof jobPropertyMap] || sortField)
+    );
+    list = sortDirection === 'asc' ? list : list.reverse();
+    const listLength = list.length;
+
+    let pageStart = index * size;
+    if (pageStart >= listLength && listLength !== 0) {
+      // if the page start is larger than the number of items due to
+      // filters being applied or items being deleted, calculate a new page start
+      pageStart = Math.floor((listLength - 1) / size) * size;
+
+      setTableSettings({ ...tableSettings, pageIndex: pageStart / size });
+    }
+    return {
+      pageOfItems: list.slice(pageStart, pageStart + size),
+      totalItemCount: listLength,
+    };
+  };
+
+  const onTableChange = ({
+    page = { index: 0, size: PAGE_SIZE },
+    sort = { field: DataFrameAnalyticsListColumn.id, direction: 'asc' },
+  }: {
+    page?: { index: number; size: number };
+    sort?: { field: string; direction: Direction };
+  }) => {
+    const { index, size } = page;
+    const { field, direction } = sort;
+
+    setTableSettings({
+      ...tableSettings,
+      pageIndex: index,
+      pageSize: size,
+      sortField: field,
+      sortDirection: direction,
+    });
+  };
+
+  const { pageIndex, pageSize, sortField, sortDirection } = tableSettings;
+
+  const { pageOfItems, totalItemCount } = getPageOfItems(
+    items,
+    pageIndex,
+    pageSize,
+    sortField,
+    sortDirection
+  );
+
+  const pagination = {
+    pageIndex,
+    pageSize,
+    totalItemCount,
+    pageSizeOptions: PAGE_SIZE_OPTIONS,
+  };
+
+  const sorting = {
+    sort: {
+      field: sortField,
+      direction: sortDirection,
+    },
+  };
+
+  return { onTableChange, pageOfItems, pagination, sorting };
+}
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_search_bar/analytics_search_bar.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_search_bar/analytics_search_bar.tsx
new file mode 100644
index 00000000000000..44a6572a3766c8
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_search_bar/analytics_search_bar.tsx
@@ -0,0 +1,157 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { Dispatch, SetStateAction, FC, Fragment, useState } from 'react';
+import {
+  EuiSearchBar,
+  EuiSearchBarProps,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { stringMatch } from '../../../../../util/string_utils';
+import {
+  TermClause,
+  FieldClause,
+  Value,
+  DataFrameAnalyticsListRow,
+} from '../analytics_list/common';
+
+export function filterAnalytics(
+  items: DataFrameAnalyticsListRow[],
+  clauses: Array<TermClause | FieldClause>
+) {
+  if (clauses.length === 0) {
+    return items;
+  }
+
+  // keep count of the number of matches we make as we're looping over the clauses
+  // we only want to return items which match all clauses, i.e. each search term is ANDed
+  const matches: Record<string, any> = items.reduce((p: Record<string, any>, c) => {
+    p[c.id] = {
+      job: c,
+      count: 0,
+    };
+    return p;
+  }, {});
+
+  clauses.forEach((c) => {
+    // the search term could be negated with a minus, e.g. -bananas
+    const bool = c.match === 'must';
+    let js = [];
+
+    if (c.type === 'term') {
+      // filter term based clauses, e.g. bananas
+      // match on id, description and memory_status
+      // if the term has been negated, AND the matches
+      if (bool === true) {
+        js = items.filter(
+          (item) =>
+            stringMatch(item.id, c.value) === bool ||
+            stringMatch(item.config.description, c.value) === bool ||
+            stringMatch(item.stats?.memory_usage?.status, c.value) === bool
+        );
+      } else {
+        js = items.filter(
+          (item) =>
+            stringMatch(item.id, c.value) === bool &&
+            stringMatch(item.config.description, c.value) === bool &&
+            stringMatch(item.stats?.memory_usage?.status, c.value) === bool
+        );
+      }
+    } else {
+      // filter other clauses, i.e. the filters for type and status
+      if (Array.isArray(c.value)) {
+        // job type value and status value are an array of string(s) e.g. c.value => ['failed', 'stopped']
+        js = items.filter((item) =>
+          (c.value as Value[]).includes(
+            item[c.field as keyof Pick<typeof item, 'job_type' | 'state'>]
+          )
+        );
+      } else {
+        js = items.filter(
+          (item) => item[c.field as keyof Pick<typeof item, 'job_type' | 'state'>] === c.value
+        );
+      }
+    }
+
+    js.forEach((j) => matches[j.id].count++);
+  });
+
+  // loop through the matches and return only those items which have match all the clauses
+  const filtered = Object.values(matches)
+    .filter((m) => (m && m.count) >= clauses.length)
+    .map((m) => m.job);
+
+  return filtered;
+}
+
+function getError(errorMessage: string | null) {
+  if (errorMessage) {
+    return i18n.translate('xpack.ml.analyticList.searchBar.invalidSearchErrorMessage', {
+      defaultMessage: 'Invalid search: {errorMessage}',
+      values: { errorMessage },
+    });
+  }
+
+  return '';
+}
+
+interface Props {
+  filters: EuiSearchBarProps['filters'];
+  searchQueryText: string;
+  setSearchQueryText: Dispatch<SetStateAction<string>>;
+}
+
+export const AnalyticsSearchBar: FC<Props> = ({ filters, searchQueryText, setSearchQueryText }) => {
+  const [errorMessage, setErrorMessage] = useState<null | string>(null);
+
+  const onChange: EuiSearchBarProps['onChange'] = ({ query, error }) => {
+    if (error) {
+      setErrorMessage(error.message);
+    } else if (query !== null && query.text !== undefined) {
+      setSearchQueryText(query.text);
+      setErrorMessage(null);
+    }
+  };
+
+  return (
+    <EuiFlexGroup direction="column">
+      <EuiFlexItem data-test-subj="mlAnalyticsSearchBar" grow={false}>
+        {searchQueryText === undefined && (
+          <EuiSearchBar
+            box={{
+              incremental: true,
+            }}
+            filters={filters}
+            onChange={onChange}
+            className="mlAnalyitcsSearchBar"
+          />
+        )}
+        {searchQueryText !== undefined && (
+          <EuiSearchBar
+            box={{
+              incremental: true,
+            }}
+            defaultQuery={searchQueryText}
+            filters={filters}
+            onChange={onChange}
+            className="mlAnalyitcsSearchBar"
+          />
+        )}
+        <EuiFormRow
+          fullWidth
+          isInvalid={errorMessage !== null}
+          error={getError(errorMessage)}
+          style={{ maxHeight: '0px' }}
+        >
+          <Fragment />
+        </EuiFormRow>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_search_bar/index.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_search_bar/index.ts
new file mode 100644
index 00000000000000..3b901f5063eb1e
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_search_bar/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { AnalyticsSearchBar, filterAnalytics } from './analytics_search_bar';
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/models_management/delete_models_modal.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/models_management/delete_models_modal.tsx
index 83010c684473e6..3c2ba13a1db26e 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/models_management/delete_models_modal.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/models_management/delete_models_modal.tsx
@@ -15,7 +15,6 @@ import {
   EuiModalFooter,
   EuiButtonEmpty,
   EuiButton,
-  EuiSpacer,
   EuiCallOut,
 } from '@elastic/eui';
 import { ModelItemFull } from './models_list';
@@ -37,7 +36,7 @@ export const DeleteModelsModal: FC<DeleteModelsModalProps> = ({ models, onClose
           <EuiModalHeaderTitle>
             <FormattedMessage
               id="xpack.ml.inference.modelsList.deleteModal.header"
-              defaultMessage="Delete {modelsCount, plural, one {{modelId}} other {# models}}"
+              defaultMessage="Delete {modelsCount, plural, one {{modelId}} other {# models}}?"
               values={{
                 modelId: models[0].model_id,
                 modelsCount: models.length,
@@ -47,12 +46,6 @@ export const DeleteModelsModal: FC<DeleteModelsModalProps> = ({ models, onClose
         </EuiModalHeader>
 
         <EuiModalBody>
-          <FormattedMessage
-            id="xpack.ml.inference.modelsList.deleteModal.warningMessage"
-            defaultMessage="Are you sure you want to delete {modelsCount, plural, one{this model} other {these models}}?"
-            values={{ modelsCount: models.length }}
-          />
-          <EuiSpacer size="m" />
           {modelsWithPipelines.length > 0 && (
             <EuiCallOut
               data-test-subj="modelsWithPipelinesWarning"
diff --git a/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/import_errors/errors.tsx b/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/import_errors/errors.tsx
index f723ad1a752bf4..bcbba67e9cc60c 100644
--- a/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/import_errors/errors.tsx
+++ b/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/import_errors/errors.tsx
@@ -93,11 +93,11 @@ function title(statuses: Statuses) {
   }
 }
 
-function ImportError(error: any, key: number) {
+const ImportError: FC<{ error: any }> = ({ error }) => {
   const errorObj = toString(error);
   return (
-    <React.Fragment>
-      <p key={key}>{errorObj.msg}</p>
+    <>
+      <p>{errorObj.msg}</p>
 
       {errorObj.more !== undefined && (
         <EuiAccordion
@@ -113,9 +113,9 @@ function ImportError(error: any, key: number) {
           {errorObj.more}
         </EuiAccordion>
       )}
-    </React.Fragment>
+    </>
   );
-}
+};
 
 function toString(error: any): ImportError {
   if (typeof error === 'string') {
@@ -127,11 +127,11 @@ function toString(error: any): ImportError {
       return { msg: error.msg };
     } else if (error.error !== undefined) {
       if (typeof error.error === 'object') {
-        if (error.error.msg !== undefined) {
+        if (error.error.reason !== undefined) {
           // this will catch a bulk ingest failure
-          const errorObj: ImportError = { msg: error.error.msg };
-          if (error.error.body !== undefined) {
-            errorObj.more = error.error.response;
+          const errorObj: ImportError = { msg: error.error.reason };
+          if (error.error.root_cause !== undefined) {
+            errorObj.more = JSON.stringify(error.error.root_cause);
           }
           return errorObj;
         }
diff --git a/x-pack/plugins/ml/public/application/datavisualizer/index_based/components/actions_panel/actions_panel.tsx b/x-pack/plugins/ml/public/application/datavisualizer/index_based/components/actions_panel/actions_panel.tsx
index 16d9e0c5418fa4..1f2c97b128e3f8 100644
--- a/x-pack/plugins/ml/public/application/datavisualizer/index_based/components/actions_panel/actions_panel.tsx
+++ b/x-pack/plugins/ml/public/application/datavisualizer/index_based/components/actions_panel/actions_panel.tsx
@@ -13,6 +13,7 @@ import { EuiSpacer, EuiText, EuiTitle, EuiFlexGroup } from '@elastic/eui';
 import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
 import { CreateJobLinkCard } from '../../../../components/create_job_link_card';
 import { DataRecognizer } from '../../../../components/data_recognizer';
+import { getBasePath } from '../../../../util/dependency_cache';
 
 interface Props {
   indexPattern: IndexPattern;
@@ -20,6 +21,7 @@ interface Props {
 
 export const ActionsPanel: FC<Props> = ({ indexPattern }) => {
   const [recognizerResultsCount, setRecognizerResultsCount] = useState(0);
+  const basePath = getBasePath();
 
   const recognizerResults = {
     count: 0,
@@ -31,7 +33,7 @@ export const ActionsPanel: FC<Props> = ({ indexPattern }) => {
   function openAdvancedJobWizard() {
     // TODO - pass the search string to the advanced job page as well as the index pattern
     //       (add in with new advanced job wizard?)
-    window.open(`#/jobs/new_job/advanced?index=${indexPattern}`, '_self');
+    window.open(`${basePath.get()}/app/ml/jobs/new_job/advanced?index=${indexPattern.id}`, '_self');
   }
 
   // Note we use display:none for the DataRecognizer section as it needs to be
@@ -86,7 +88,7 @@ export const ActionsPanel: FC<Props> = ({ indexPattern }) => {
             'Use the full range of options to create a job for more advanced use cases',
         })}
         onClick={openAdvancedJobWizard}
-        href={`#/jobs/new_job/advanced?index=${indexPattern}`}
+        href={`${basePath.get()}/app/ml/jobs/new_job/advanced?index=${indexPattern.id}`}
         data-test-subj="mlDataVisualizerCreateAdvancedJobCard"
       />
     </div>
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer.js b/x-pack/plugins/ml/public/application/explorer/explorer.js
index d78df80fad94e9..cea1159ebc14a2 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer.js
+++ b/x-pack/plugins/ml/public/application/explorer/explorer.js
@@ -68,6 +68,7 @@ import { ExplorerChartsContainer } from './explorer_charts/explorer_charts_conta
 import { AnomaliesTable } from '../components/anomalies_table/anomalies_table';
 
 import { getTimefilter, getToastNotifications } from '../util/dependency_cache';
+import { ANOMALY_DETECTION_DEFAULT_TIME_RANGE } from '../../../common/constants/settings';
 
 const ExplorerPage = ({
   children,
@@ -145,6 +146,22 @@ export class Explorer extends React.Component {
   state = { filterIconTriggeredQuery: undefined, language: DEFAULT_QUERY_LANG };
   htmlIdGen = htmlIdGenerator();
 
+  componentDidMount() {
+    const { invalidTimeRangeError } = this.props;
+    if (invalidTimeRangeError) {
+      const toastNotifications = getToastNotifications();
+      toastNotifications.addWarning(
+        i18n.translate('xpack.ml.explorer.invalidTimeRangeInUrlCallout', {
+          defaultMessage:
+            'The time filter was changed to the full range due to an invalid default time filter. Check the advanced settings for {field}.',
+          values: {
+            field: ANOMALY_DETECTION_DEFAULT_TIME_RANGE,
+          },
+        })
+      );
+    }
+  }
+
   // Escape regular parens from fieldName as that portion of the query is not wrapped in double quotes
   // and will cause a syntax error when called with getKqlQueryValues
   applyFilter = (fieldName, fieldValue, action) => {
@@ -298,7 +315,6 @@ export class Explorer extends React.Component {
 
           <div className={mainColumnClasses}>
             <EuiSpacer size="m" />
-
             {stoppedPartitions && (
               <EuiCallOut
                 size={'s'}
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer_dashboard_service.ts b/x-pack/plugins/ml/public/application/explorer/explorer_dashboard_service.ts
index 4d697bcda1a065..e0ed2ea6cf5e08 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer_dashboard_service.ts
+++ b/x-pack/plugins/ml/public/application/explorer/explorer_dashboard_service.ts
@@ -21,6 +21,7 @@ import { ExplorerChartsData } from './explorer_charts/explorer_charts_container_
 import { EXPLORER_ACTION } from './explorer_constants';
 import { AppStateSelectedCells, TimeRangeBounds } from './explorer_utils';
 import { explorerReducer, getExplorerDefaultState, ExplorerState } from './reducers';
+import { ExplorerAppState } from '../../../common/types/ml_url_generator';
 
 export const ALLOW_CELL_RANGE_SELECTION = true;
 
@@ -49,24 +50,6 @@ const explorerState$: Observable<ExplorerState> = explorerFilteredAction$.pipe(
   shareReplay(1)
 );
 
-export interface ExplorerAppState {
-  mlExplorerSwimlane: {
-    selectedType?: string;
-    selectedLanes?: string[];
-    selectedTimes?: number[];
-    showTopFieldValues?: boolean;
-    viewByFieldName?: string;
-    viewByPerPage?: number;
-    viewByFromPage?: number;
-  };
-  mlExplorerFilter: {
-    influencersFilterQuery?: unknown;
-    filterActive?: boolean;
-    filteredFields?: string[];
-    queryString?: string;
-  };
-}
-
 const explorerAppState$: Observable<ExplorerAppState> = explorerState$.pipe(
   map(
     (state: ExplorerState): ExplorerAppState => {
diff --git a/x-pack/plugins/ml/public/application/explorer/swimlane_container.tsx b/x-pack/plugins/ml/public/application/explorer/swimlane_container.tsx
index 0fefa71dea48b4..235e5d0f20f87a 100644
--- a/x-pack/plugins/ml/public/application/explorer/swimlane_container.tsx
+++ b/x-pack/plugins/ml/public/application/explorer/swimlane_container.tsx
@@ -19,7 +19,6 @@ import { ExplorerSwimlane, ExplorerSwimlaneProps } from './explorer_swimlane';
 
 import { MlTooltipComponent } from '../components/chart_tooltip';
 import { SwimLanePagination } from './swimlane_pagination';
-import { SWIMLANE_TYPE } from './explorer_constants';
 import { ViewBySwimLaneData } from './explorer_utils';
 
 /**
@@ -91,7 +90,6 @@ export const SwimlaneContainer: FC<
     (showSwimlane || isLoading) &&
     swimlaneLimit !== undefined &&
     onPaginationChange &&
-    props.swimlaneType === SWIMLANE_TYPE.VIEW_BY &&
     fromPage &&
     perPage;
 
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/delete_job_modal/delete_job_modal.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/delete_job_modal/delete_job_modal.js
index 1e3ec6241311bc..f80578cb18341c 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/delete_job_modal/delete_job_modal.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/delete_job_modal/delete_job_modal.js
@@ -98,7 +98,7 @@ export class DeleteJobModal extends Component {
       const title = (
         <FormattedMessage
           id="xpack.ml.jobsList.deleteJobModal.deleteJobsTitle"
-          defaultMessage="Delete {jobsCount, plural, one {{jobId}} other {# jobs}}"
+          defaultMessage="Delete {jobsCount, plural, one {{jobId}} other {# jobs}}?"
           values={{
             jobsCount: this.state.jobs.length,
             jobId: this.state.jobs[0].id,
@@ -144,21 +144,12 @@ export class DeleteJobModal extends Component {
 
             {this.state.deleting === false && (
               <React.Fragment>
-                <p>
-                  <FormattedMessage
-                    id="xpack.ml.jobsList.deleteJobModal.deleteJobsDescription"
-                    defaultMessage="Are you sure you want to delete {jobsCount, plural, one {this job} other {these jobs}}?"
-                    values={{
-                      jobsCount: this.state.jobs.length,
-                    }}
-                  />
-                </p>
                 <p>
                   <FormattedMessage
                     id="xpack.ml.jobsList.deleteJobModal.deleteMultipleJobsDescription"
                     defaultMessage="Deleting {jobsCount, plural, one {a job} other {multiple jobs}} can be time consuming.
                     {jobsCount, plural, one {It} other {They}} will be deleted in the background
-                    and may not disappear from the jobs list instantly"
+                    and may not disappear from the jobs list instantly."
                     values={{
                       jobsCount: this.state.jobs.length,
                     }}
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_actions/results.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_actions/results.js
index 74072aa7e96380..d0d0442dd4aeed 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_actions/results.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/job_actions/results.js
@@ -8,16 +8,8 @@ import PropTypes from 'prop-types';
 import React from 'react';
 
 import { EuiButtonIcon, EuiToolTip } from '@elastic/eui';
-
-import { mlJobService } from '../../../../services/job_service';
 import { i18n } from '@kbn/i18n';
-import { getBasePath } from '../../../../util/dependency_cache';
-
-export function getLink(location, jobs) {
-  const basePath = getBasePath();
-  const resultsPageUrl = mlJobService.createResultsUrlForJobs(jobs, location);
-  return `${basePath.get()}/app/ml${resultsPageUrl}`;
-}
+import { useCreateADLinks } from '../../../../components/custom_hooks/use_create_ad_links';
 
 export function ResultLinks({ jobs }) {
   const openJobsInSingleMetricViewerText = i18n.translate(
@@ -44,29 +36,29 @@ export function ResultLinks({ jobs }) {
   const singleMetricVisible = jobs.length < 2;
   const singleMetricEnabled = jobs.length === 1 && jobs[0].isSingleMetricViewerJob;
   const jobActionsDisabled = jobs.length === 1 && jobs[0].deleting === true;
-
+  const { createLinkWithUserDefaults } = useCreateADLinks();
   return (
     <React.Fragment>
       {singleMetricVisible && (
         <EuiToolTip position="bottom" content={openJobsInSingleMetricViewerText}>
           <EuiButtonIcon
-            href={getLink('timeseriesexplorer', jobs)}
+            href={createLinkWithUserDefaults('timeseriesexplorer', jobs)}
             iconType="visLine"
             aria-label={openJobsInSingleMetricViewerText}
             className="results-button"
             isDisabled={singleMetricEnabled === false || jobActionsDisabled === true}
-            data-test-subj={`openJobsInSingleMetricViewer openJobsInSingleMetricViewer-${jobs[0].id}`}
+            data-test-subj="mlOpenJobsInSingleMetricViewerButton"
           />
         </EuiToolTip>
       )}
       <EuiToolTip position="bottom" content={openJobsInAnomalyExplorerText}>
         <EuiButtonIcon
-          href={getLink('explorer', jobs)}
+          href={createLinkWithUserDefaults('explorer', jobs)}
           iconType="visTable"
           aria-label={openJobsInAnomalyExplorerText}
           className="results-button"
           isDisabled={jobActionsDisabled === true}
-          data-test-subj={`openJobsInAnomalyExplorer openJobsInSingleAnomalyExplorer-${jobs[0].id}`}
+          data-test-subj="mlOpenJobsInAnomalyExplorerButton"
         />
       </EuiToolTip>
       <div className="actions-border" />
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/jobs_list.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/jobs_list.js
index f90bbf3cf3fe6a..fa4ea09b89ff91 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/jobs_list.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/jobs_list/jobs_list.js
@@ -7,7 +7,7 @@
 import PropTypes from 'prop-types';
 import React, { Component } from 'react';
 
-import { sortBy } from 'lodash';
+import sortBy from 'lodash/sortBy';
 import moment from 'moment';
 
 import { toLocaleString } from '../../../../util/string_utils';
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/actions_menu.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/actions_menu.js
index a011f21fddfefb..44460c0fb81394 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/actions_menu.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/actions_menu.js
@@ -57,6 +57,7 @@ class MultiJobActionsMenuUI extends Component {
         disabled={
           anyJobsDeleting || (this.canDeleteJob === false && this.canStartStopDatafeed === false)
         }
+        data-test-subj="mlADJobListMultiSelectManagementActionsButton"
       />
     );
 
@@ -69,6 +70,7 @@ class MultiJobActionsMenuUI extends Component {
           this.props.showDeleteJobModal(this.props.jobs);
           this.closePopover();
         }}
+        data-test-subj="mlADJobListMultiSelectDeleteJobActionButton"
       >
         <FormattedMessage
           id="xpack.ml.jobsList.multiJobsActions.deleteJobsLabel"
@@ -88,6 +90,7 @@ class MultiJobActionsMenuUI extends Component {
             closeJobs(this.props.jobs);
             this.closePopover();
           }}
+          data-test-subj="mlADJobListMultiSelectCloseJobActionButton"
         >
           <FormattedMessage
             id="xpack.ml.jobsList.multiJobsActions.closeJobsLabel"
@@ -108,6 +111,7 @@ class MultiJobActionsMenuUI extends Component {
             stopDatafeeds(this.props.jobs, this.props.refreshJobs);
             this.closePopover();
           }}
+          data-test-subj="mlADJobListMultiSelectStopDatafeedActionButton"
         >
           <FormattedMessage
             id="xpack.ml.jobsList.multiJobsActions.stopDatafeedsLabel"
@@ -128,6 +132,7 @@ class MultiJobActionsMenuUI extends Component {
             this.props.showStartDatafeedModal(this.props.jobs);
             this.closePopover();
           }}
+          data-test-subj="mlADJobListMultiSelectStartDatafeedActionButton"
         >
           <FormattedMessage
             id="xpack.ml.jobsList.multiJobsActions.startDatafeedsLabel"
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/group_selector/group_selector.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/group_selector/group_selector.js
index 7792893305326f..f73dde69a3d4c7 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/group_selector/group_selector.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/group_selector/group_selector.js
@@ -219,6 +219,7 @@ export class GroupSelector extends Component {
           )}
           onClick={() => this.togglePopover()}
           disabled={this.canUpdateJob === false}
+          data-test-subj="mlADJobListMultiSelectEditJobGroupsButton"
         />
       </EuiToolTip>
     );
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/multi_job_actions.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/multi_job_actions.js
index 82563b083b8ccf..b9ea18b5d2ed87 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/multi_job_actions.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/multi_job_actions.js
@@ -24,7 +24,10 @@ export class MultiJobActions extends Component {
   render() {
     const jobsSelected = this.props.selectedJobs.length > 0;
     return (
-      <div className={`multi-select-actions${jobsSelected ? '' : '-no-display'}`}>
+      <div
+        className={`multi-select-actions${jobsSelected ? '' : '-no-display'}`}
+        data-test-subj={`mlADJobListMultiSelectActionsArea ${jobsSelected ? 'active' : 'inactive'}`}
+      >
         {jobsSelected && (
           <Fragment>
             <EuiTitle size="s" style={{ display: 'inline' }}>
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts
index 328cd1a5ef8d7d..d61e75fd21b5a6 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/chart_loader.ts
@@ -71,9 +71,7 @@ export class ChartLoader {
         splitFieldName,
         splitFieldValue
       );
-      if (resp.error !== undefined) {
-        throw resp.error;
-      }
+
       return resp.results;
     }
     return {};
@@ -105,9 +103,7 @@ export class ChartLoader {
         aggFieldPairNames,
         splitFieldName
       );
-      if (resp.error !== undefined) {
-        throw resp.error;
-      }
+
       return resp.results;
     }
     return {};
diff --git a/x-pack/plugins/ml/public/application/management/jobs_list/components/access_denied_page.tsx b/x-pack/plugins/ml/public/application/management/jobs_list/components/access_denied_page.tsx
index 1a30b1637fb8d8..6a9c66eec83bc7 100644
--- a/x-pack/plugins/ml/public/application/management/jobs_list/components/access_denied_page.tsx
+++ b/x-pack/plugins/ml/public/application/management/jobs_list/components/access_denied_page.tsx
@@ -23,7 +23,7 @@ import {
 
 export const AccessDeniedPage = () => (
   <Fragment>
-    <EuiPage>
+    <EuiPage data-test-subj="mlPageAccessDenied">
       <EuiPageBody>
         <EuiPageContentHeader>
           <EuiPageContentHeaderSection>
diff --git a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/actions.tsx b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/actions.tsx
index c4508a8c19c5bd..395a570083c0de 100644
--- a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/actions.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/actions.tsx
@@ -48,7 +48,7 @@ export const ViewLink: FC<Props> = ({ item }) => {
         iconType="visTable"
         aria-label={viewJobResultsButtonText}
         className="results-button"
-        data-test-subj="mlAnalyticsJobViewButton"
+        data-test-subj="mlOverviewAnalyticsJobViewButton"
         isDisabled={disabled}
       >
         {i18n.translate('xpack.ml.overview.analytics.viewActionName', {
diff --git a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/analytics_panel.tsx b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/analytics_panel.tsx
index 65e7ba9e8ab52e..be8038cc5049d2 100644
--- a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/analytics_panel.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/analytics_panel.tsx
@@ -100,6 +100,7 @@ export const AnalyticsPanel: FC<Props> = ({ jobCreationDisabled }) => {
               fill
               iconType="plusInCircle"
               isDisabled={jobCreationDisabled}
+              data-test-subj="mlOverviewCreateDFAJobButton"
             >
               {i18n.translate('xpack.ml.overview.analyticsList.createJobButtonText', {
                 defaultMessage: 'Create job',
diff --git a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/actions.tsx b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/actions.tsx
index 07a555c13dbf55..a71141d0356d07 100644
--- a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/actions.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/actions.tsx
@@ -7,9 +7,8 @@
 import React, { FC } from 'react';
 import { EuiToolTip, EuiButtonEmpty } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-// @ts-ignore no module file
-import { getLink } from '../../../jobs/jobs_list/components/job_actions/results';
 import { MlSummaryJobs } from '../../../../../common/types/anomaly_detection_jobs';
+import { useCreateADLinks } from '../../../components/custom_hooks/use_create_ad_links';
 
 interface Props {
   jobsList: MlSummaryJobs;
@@ -23,13 +22,14 @@ export const ExplorerLink: FC<Props> = ({ jobsList }) => {
       values: { jobsCount: jobsList.length, jobId: jobsList[0] && jobsList[0].id },
     }
   );
+  const { createLinkWithUserDefaults } = useCreateADLinks();
 
   return (
     <EuiToolTip position="bottom" content={openJobsInAnomalyExplorerText}>
       <EuiButtonEmpty
         color="text"
         size="xs"
-        href={getLink('explorer', jobsList)}
+        href={createLinkWithUserDefaults('explorer', jobsList)}
         iconType="visTable"
         aria-label={openJobsInAnomalyExplorerText}
         className="results-button"
diff --git a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx
index 03b66f5c369c1c..0bfd2c2e492323 100644
--- a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/anomaly_detection_panel.tsx
@@ -184,6 +184,7 @@ export const AnomalyDetectionPanel: FC<Props> = ({ jobCreationDisabled }) => {
               fill
               iconType="plusInCircle"
               isDisabled={jobCreationDisabled}
+              data-test-subj="mlOverviewCreateADJobButton"
             >
               {i18n.translate('xpack.ml.overview.anomalyDetection.createJobButtonText', {
                 defaultMessage: 'Create job',
diff --git a/x-pack/plugins/ml/public/application/routing/router.tsx b/x-pack/plugins/ml/public/application/routing/router.tsx
index 56c9a19723fba1..22a17c4ea089a9 100644
--- a/x-pack/plugins/ml/public/application/routing/router.tsx
+++ b/x-pack/plugins/ml/public/application/routing/router.tsx
@@ -75,7 +75,6 @@ const MlRoutes: FC<{
   pageDeps: PageDependencies;
 }> = ({ pageDeps }) => {
   const navigateToPath = useNavigateToPath();
-
   return (
     <>
       {Object.entries(routes).map(([name, routeFactory]) => {
diff --git a/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx b/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
index 62d7e82a214b57..30b9bc2af219f7 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/explorer.tsx
@@ -22,7 +22,8 @@ import { useSelectedCells } from '../../explorer/hooks/use_selected_cells';
 import { mlJobService } from '../../services/job_service';
 import { ml } from '../../services/ml_api_service';
 import { useExplorerData } from '../../explorer/actions';
-import { ExplorerAppState, explorerService } from '../../explorer/explorer_dashboard_service';
+import { ExplorerAppState } from '../../../../common/types/ml_url_generator';
+import { explorerService } from '../../explorer/explorer_dashboard_service';
 import { getDateFormatTz } from '../../explorer/explorer_utils';
 import { useJobSelection } from '../../components/job_selector/use_job_selection';
 import { useShowCharts } from '../../components/controls/checkbox_showcharts';
@@ -72,7 +73,7 @@ const ExplorerUrlStateManager: FC<ExplorerUrlStateManagerProps> = ({ jobsWithTim
   const [globalState, setGlobalState] = useUrlState('_g');
   const [lastRefresh, setLastRefresh] = useState(0);
   const [stoppedPartitions, setStoppedPartitions] = useState<string[] | undefined>();
-
+  const [invalidTimeRangeError, setInValidTimeRangeError] = useState<boolean>(false);
   const timefilter = useTimefilter({ timeRangeSelector: true, autoRefreshSelector: true });
 
   const { jobIds } = useJobSelection(jobsWithTimeRange);
@@ -98,6 +99,9 @@ const ExplorerUrlStateManager: FC<ExplorerUrlStateManagerProps> = ({ jobsWithTim
   // `timefilter.getBounds()` to update `bounds` in this component's state.
   useEffect(() => {
     if (globalState?.time !== undefined) {
+      if (globalState.time.mode === 'invalid') {
+        setInValidTimeRangeError(true);
+      }
       timefilter.setTime({
         from: globalState.time.from,
         to: globalState.time.to,
@@ -214,10 +218,8 @@ const ExplorerUrlStateManager: FC<ExplorerUrlStateManagerProps> = ({ jobsWithTim
       loadExplorerData({
         ...loadExplorerDataConfig,
         swimlaneLimit:
-          explorerState?.viewBySwimlaneData &&
-          isViewBySwimLaneData(explorerState?.viewBySwimlaneData)
-            ? explorerState?.viewBySwimlaneData.cardinality
-            : undefined,
+          isViewBySwimLaneData(explorerState?.viewBySwimlaneData) &&
+          explorerState?.viewBySwimlaneData.cardinality,
       });
     }
   }, [JSON.stringify(loadExplorerDataConfig)]);
@@ -235,6 +237,7 @@ const ExplorerUrlStateManager: FC<ExplorerUrlStateManagerProps> = ({ jobsWithTim
           showCharts,
           severity: tableSeverity.val,
           stoppedPartitions,
+          invalidTimeRangeError,
         }}
       />
     </div>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
index 1f122ed18a8512..817c9754159971 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
@@ -91,6 +91,7 @@ export const TimeSeriesExplorerUrlStateManager: FC<TimeSeriesExplorerUrlStateMan
   const previousRefresh = usePrevious(lastRefresh);
   const [selectedJobId, setSelectedJobId] = useState<string>();
   const timefilter = useTimefilter({ timeRangeSelector: true, autoRefreshSelector: true });
+  const [invalidTimeRangeError, setInValidTimeRangeError] = useState<boolean>(false);
 
   const refresh = useRefresh();
   useEffect(() => {
@@ -114,6 +115,9 @@ export const TimeSeriesExplorerUrlStateManager: FC<TimeSeriesExplorerUrlStateMan
   const [bounds, setBounds] = useState<TimeRangeBounds | undefined>(undefined);
   useEffect(() => {
     if (globalState?.time !== undefined) {
+      if (globalState.time.mode === 'invalid') {
+        setInValidTimeRangeError(true);
+      }
       timefilter.setTime({
         from: globalState.time.from,
         to: globalState.time.to,
@@ -300,6 +304,7 @@ export const TimeSeriesExplorerUrlStateManager: FC<TimeSeriesExplorerUrlStateMan
         tableSeverity: tableSeverity.val,
         timefilter,
         zoom: zoomProp,
+        invalidTimeRangeError,
       }}
     />
   );
diff --git a/x-pack/plugins/ml/public/application/services/field_format_service.ts b/x-pack/plugins/ml/public/application/services/field_format_service.ts
index 1a5d22e7320a58..b66dac15b13647 100644
--- a/x-pack/plugins/ml/public/application/services/field_format_service.ts
+++ b/x-pack/plugins/ml/public/application/services/field_format_service.ts
@@ -77,7 +77,7 @@ class FieldFormatService {
       const fieldList = fullIndexPattern.fields;
       const field = fieldList.getByName(fieldName);
       if (field !== undefined) {
-        fieldFormat = field.format;
+        fieldFormat = fullIndexPattern.getFormatterForField(field);
       }
     }
 
@@ -104,7 +104,9 @@ class FieldFormatService {
               if (dtr.field_name !== undefined && esAgg !== 'cardinality') {
                 const field = fieldList.getByName(dtr.field_name);
                 if (field !== undefined) {
-                  formatsByDetector[dtr.detector_index!] = field.format;
+                  formatsByDetector[dtr.detector_index!] = indexPatternData.getFormatterForField(
+                    field
+                  );
                 }
               }
             });
diff --git a/x-pack/plugins/ml/public/application/services/job_service.d.ts b/x-pack/plugins/ml/public/application/services/job_service.d.ts
index 2134d157e1baae..30b2ec044285a2 100644
--- a/x-pack/plugins/ml/public/application/services/job_service.d.ts
+++ b/x-pack/plugins/ml/public/application/services/job_service.d.ts
@@ -5,6 +5,7 @@
  */
 
 import { SearchResponse } from 'elasticsearch';
+import { TimeRange } from 'src/plugins/data/common/query/timefilter/types';
 import { CombinedJob } from '../../../common/types/anomaly_detection_jobs';
 import { Calendar } from '../../../common/types/calendars';
 
@@ -15,7 +16,7 @@ export interface ExistingJobsAndGroups {
 
 declare interface JobService {
   jobs: CombinedJob[];
-  createResultsUrlForJobs: (jobs: any[], target: string) => string;
+  createResultsUrlForJobs: (jobs: any[], target: string, timeRange?: TimeRange) => string;
   tempJobCloningObjects: {
     job: any;
     skipTimeRangeStep: boolean;
diff --git a/x-pack/plugins/ml/public/application/services/job_service.js b/x-pack/plugins/ml/public/application/services/job_service.js
index 704d76059f75cc..640f63617b7d4a 100644
--- a/x-pack/plugins/ml/public/application/services/job_service.js
+++ b/x-pack/plugins/ml/public/application/services/job_service.js
@@ -21,7 +21,7 @@ import { ML_DATA_PREVIEW_COUNT } from '../../../common/util/job_utils';
 import { TIME_FORMAT } from '../../../common/constants/time_format';
 import { parseInterval } from '../../../common/util/parse_interval';
 import { toastNotificationServiceProvider } from '../services/toast_notification_service';
-
+import { validateTimeRange } from '../util/date_utils';
 const msgs = mlMessageBarService;
 let jobs = [];
 let datafeedIds = {};
@@ -790,8 +790,8 @@ class JobService {
     return groups;
   }
 
-  createResultsUrlForJobs(jobsList, resultsPage) {
-    return createResultsUrlForJobs(jobsList, resultsPage);
+  createResultsUrlForJobs(jobsList, resultsPage, timeRange) {
+    return createResultsUrlForJobs(jobsList, resultsPage, timeRange);
   }
 
   createResultsUrl(jobIds, from, to, resultsPage) {
@@ -932,31 +932,54 @@ function createJobStats(jobsList, jobStats) {
   jobStats.activeNodes.value = Object.keys(mlNodes).length;
 }
 
-function createResultsUrlForJobs(jobsList, resultsPage) {
+function createResultsUrlForJobs(jobsList, resultsPage, userTimeRange) {
   let from = undefined;
   let to = undefined;
-  if (jobsList.length === 1) {
-    from = jobsList[0].earliestTimestampMs;
-    to = jobsList[0].latestResultsTimestampMs; // Will be max(latest source data, latest bucket results)
+  let mode = 'absolute';
+  const jobIds = jobsList.map((j) => j.id);
+
+  // if the custom default time filter is set and enabled in advanced settings
+  // if time is either absolute date or proper datemath format
+  if (validateTimeRange(userTimeRange)) {
+    from = userTimeRange.from;
+    to = userTimeRange.to;
+    // if both pass datemath's checks but are not technically absolute dates, use 'quick'
+    // e.g. "now-15m" "now+1d"
+    const fromFieldAValidDate = moment(userTimeRange.from).isValid();
+    const toFieldAValidDate = moment(userTimeRange.to).isValid();
+    if (!fromFieldAValidDate && !toFieldAValidDate) {
+      return createResultsUrl(jobIds, from, to, resultsPage, 'quick');
+    }
   } else {
-    const jobsWithData = jobsList.filter((j) => j.earliestTimestampMs !== undefined);
-    if (jobsWithData.length > 0) {
-      from = Math.min(...jobsWithData.map((j) => j.earliestTimestampMs));
-      to = Math.max(...jobsWithData.map((j) => j.latestResultsTimestampMs));
+    // if time range is specified but with incorrect format
+    // change back to the default time range but alert the user
+    // that the advanced setting config is invalid
+    if (userTimeRange) {
+      mode = 'invalid';
+    }
+
+    if (jobsList.length === 1) {
+      from = jobsList[0].earliestTimestampMs;
+      to = jobsList[0].latestResultsTimestampMs; // Will be max(latest source data, latest bucket results)
+    } else {
+      const jobsWithData = jobsList.filter((j) => j.earliestTimestampMs !== undefined);
+      if (jobsWithData.length > 0) {
+        from = Math.min(...jobsWithData.map((j) => j.earliestTimestampMs));
+        to = Math.max(...jobsWithData.map((j) => j.latestResultsTimestampMs));
+      }
     }
   }
 
   const fromString = moment(from).format(TIME_FORMAT); // Defaults to 'now' if 'from' is undefined
   const toString = moment(to).format(TIME_FORMAT); // Defaults to 'now' if 'to' is undefined
 
-  const jobIds = jobsList.map((j) => j.id);
-  return createResultsUrl(jobIds, fromString, toString, resultsPage);
+  return createResultsUrl(jobIds, fromString, toString, resultsPage, mode);
 }
 
-function createResultsUrl(jobIds, start, end, resultsPage) {
+function createResultsUrl(jobIds, start, end, resultsPage, mode = 'absolute') {
   const idString = jobIds.map((j) => `'${j}'`).join(',');
-  const from = moment(start).toISOString();
-  const to = moment(end).toISOString();
+  let from;
+  let to;
   let path = '';
 
   if (resultsPage !== undefined) {
@@ -964,9 +987,20 @@ function createResultsUrl(jobIds, start, end, resultsPage) {
     path += resultsPage;
   }
 
+  if (mode === 'quick') {
+    from = start;
+    to = end;
+  } else {
+    from = moment(start).toISOString();
+    to = moment(end).toISOString();
+  }
+
   path += `?_g=(ml:(jobIds:!(${idString}))`;
   path += `,refreshInterval:(display:Off,pause:!f,value:0),time:(from:'${from}'`;
-  path += `,mode:absolute,to:'${to}'`;
+  path += `,to:'${to}'`;
+  if (mode === 'invalid') {
+    path += `,mode:invalid`;
+  }
   path += "))&_a=(query:(query_string:(analyze_wildcard:!t,query:'*')))";
 
   return path;
diff --git a/x-pack/plugins/ml/public/application/services/results_service/results_service.js b/x-pack/plugins/ml/public/application/services/results_service/results_service.js
index 0c3b2e40c8e261..ef00c9025763ee 100644
--- a/x-pack/plugins/ml/public/application/services/results_service/results_service.js
+++ b/x-pack/plugins/ml/public/application/services/results_service/results_service.js
@@ -88,6 +88,11 @@ export function resultsServiceProvider(mlApiServices) {
                 },
               },
               aggs: {
+                jobsCardinality: {
+                  cardinality: {
+                    field: 'job_id',
+                  },
+                },
                 jobId: {
                   terms: {
                     field: 'job_id',
@@ -148,6 +153,7 @@ export function resultsServiceProvider(mlApiServices) {
               });
               obj.results[jobId] = resultsForTime;
             });
+            obj.cardinality = resp.aggregations?.jobsCardinality?.value ?? 0;
 
             resolve(obj);
           })
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/__snapshots__/new_calendar.test.js.snap b/x-pack/plugins/ml/public/application/settings/calendars/edit/__snapshots__/new_calendar.test.js.snap
index 21f505cff9aec6..34ee304b8bd41b 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/__snapshots__/new_calendar.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/__snapshots__/new_calendar.test.js.snap
@@ -7,6 +7,7 @@ exports[`NewCalendar Renders new calendar form 1`] = `
   />
   <EuiPage
     className="mlCalendarEditForm"
+    data-test-subj="mlPageCalendarEdit"
   >
     <EuiPageBody>
       <EuiPageContent
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/__snapshots__/calendar_form.test.js.snap b/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/__snapshots__/calendar_form.test.js.snap
index c17dc6c7db06a1..96ca77e91279b4 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/__snapshots__/calendar_form.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/__snapshots__/calendar_form.test.js.snap
@@ -88,6 +88,7 @@ exports[`CalendarForm Renders calendar form 1`] = `
     size="xl"
   />
   <EuiSwitch
+    data-test-subj="mlCalendarApplyToAllJobsSwitch"
     disabled={false}
     label={
       <FormattedMessage
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.js b/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.js
index f1b122fdea54dc..7644346e26383f 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/calendar_form/calendar_form.js
@@ -147,6 +147,7 @@ export const CalendarForm = ({
         checked={isGlobalCalendar}
         onChange={onGlobalCalendarChange}
         disabled={saving === true || canCreateCalendar === false}
+        data-test-subj="mlCalendarApplyToAllJobsSwitch"
       />
 
       {isGlobalCalendar === false && (
@@ -166,6 +167,7 @@ export const CalendarForm = ({
               selectedOptions={selectedJobOptions}
               onChange={onJobSelection}
               isDisabled={saving === true || canCreateCalendar === false}
+              data-test-subj="mlCalendarJobSelection"
             />
           </EuiFormRow>
 
@@ -183,6 +185,7 @@ export const CalendarForm = ({
               selectedOptions={selectedGroupOptions}
               onChange={onGroupSelection}
               isDisabled={saving === true || canCreateCalendar === false}
+              data-test-subj="mlCalendarJobGroupSelection"
             />
           </EuiFormRow>
         </>
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/events_table/__snapshots__/events_table.test.js.snap b/x-pack/plugins/ml/public/application/settings/calendars/edit/events_table/__snapshots__/events_table.test.js.snap
index df22f1a08ff42d..e3edc563e7c3e4 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/events_table/__snapshots__/events_table.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/events_table/__snapshots__/events_table.test.js.snap
@@ -34,6 +34,7 @@ exports[`EventsTable Renders events table with no search bar 1`] = `
         },
       ]
     }
+    data-test-subj="mlCalendarEventsTable"
     itemId="event_id"
     items={
       Array [
@@ -56,6 +57,7 @@ exports[`EventsTable Renders events table with no search bar 1`] = `
       }
     }
     responsive={true}
+    rowProps={[Function]}
     sorting={
       Object {
         "sort": Object {
@@ -103,6 +105,7 @@ exports[`EventsTable Renders events table with search bar 1`] = `
         },
       ]
     }
+    data-test-subj="mlCalendarEventsTable"
     itemId="event_id"
     items={
       Array [
@@ -125,6 +128,7 @@ exports[`EventsTable Renders events table with search bar 1`] = `
       }
     }
     responsive={true}
+    rowProps={[Function]}
     search={
       Object {
         "box": Object {
@@ -133,7 +137,7 @@ exports[`EventsTable Renders events table with search bar 1`] = `
         "filters": Array [],
         "toolsRight": Array [
           <EuiButton
-            data-test-subj="mlNewEvent"
+            data-test-subj="mlCalendarNewEventButton"
             iconType="plusInCircle"
             isDisabled={false}
             onClick={[MockFunction]}
@@ -146,7 +150,7 @@ exports[`EventsTable Renders events table with search bar 1`] = `
             />
           </EuiButton>,
           <EuiButton
-            data-test-subj="mlImportEvents"
+            data-test-subj="mlCalendarImportEventsButton"
             iconType="importAction"
             isDisabled={false}
             onClick={[MockFunction]}
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/events_table/events_table.js b/x-pack/plugins/ml/public/application/settings/calendars/edit/events_table/events_table.js
index 9069e8078fca63..6461d3546124de 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/events_table/events_table.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/events_table/events_table.js
@@ -14,7 +14,7 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { TIME_FORMAT } from '../../../../../../common/constants/time_format';
 
-function DeleteButton({ onClick, canDeleteCalendar }) {
+function DeleteButton({ onClick, canDeleteCalendar, testSubj }) {
   return (
     <Fragment>
       <EuiButtonEmpty
@@ -22,6 +22,7 @@ function DeleteButton({ onClick, canDeleteCalendar }) {
         color="danger"
         onClick={onClick}
         isDisabled={canDeleteCalendar === false}
+        data-test-subj={testSubj}
       >
         <FormattedMessage
           id="xpack.ml.calendarsEdit.eventsTable.deleteButtonLabel"
@@ -90,7 +91,7 @@ export const EventsTable = ({
       name: '',
       render: (event) => (
         <DeleteButton
-          data-test-subj="mlEventDelete"
+          testSubj="mlCalendarEventDeleteButton"
           canDeleteCalendar={canDeleteCalendar}
           onClick={() => {
             onDeleteClick(event.event_id);
@@ -105,7 +106,7 @@ export const EventsTable = ({
       <EuiButton
         isDisabled={canCreateCalendar === false}
         key="ml_new_event"
-        data-test-subj="mlNewEvent"
+        data-test-subj="mlCalendarNewEventButton"
         size="s"
         iconType="plusInCircle"
         onClick={showNewEventModal}
@@ -118,7 +119,7 @@ export const EventsTable = ({
       <EuiButton
         isDisabled={canCreateCalendar === false}
         key="ml_import_event"
-        data-test-subj="mlImportEvents"
+        data-test-subj="mlCalendarImportEventsButton"
         size="s"
         iconType="importAction"
         onClick={showImportModal}
@@ -145,6 +146,10 @@ export const EventsTable = ({
         pagination={pagination}
         sorting={sorting}
         search={showSearchBar ? search : undefined}
+        data-test-subj="mlCalendarEventsTable"
+        rowProps={(item) => ({
+          'data-test-subj': `mlCalendarEventListRow row-${item.description}`,
+        })}
       />
     </Fragment>
   );
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/import_modal/import_modal.test.js b/x-pack/plugins/ml/public/application/settings/calendars/edit/import_modal/import_modal.test.js
index 0c8e1f07eb3557..2faac7d850fa90 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/import_modal/import_modal.test.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/import_modal/import_modal.test.js
@@ -51,7 +51,7 @@ describe('ImportModal', () => {
     instance.setState(testState);
     wrapper.update();
     expect(wrapper.state('selectedEvents').length).toBe(2);
-    const deleteButton = wrapper.find('[data-test-subj="mlEventDelete"]');
+    const deleteButton = wrapper.find('[data-test-subj="mlCalendarEventDeleteButton"]');
     const button = deleteButton.find('EuiButtonEmpty').first();
     button.simulate('click');
 
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.js b/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.js
index 7efc37d4bf8ce9..1fe16e4588bd76 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.js
@@ -339,7 +339,7 @@ class NewCalendarUI extends Component {
     return (
       <Fragment>
         <NavigationMenu tabId="settings" />
-        <EuiPage className="mlCalendarEditForm">
+        <EuiPage className="mlCalendarEditForm" data-test-subj="mlPageCalendarEdit">
           <EuiPageBody>
             <EuiPageContent
               className="mlCalendarEditForm__content"
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.test.js b/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.test.js
index 3e64d7ea3d367e..2cff255bd1ce3a 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.test.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/edit/new_calendar.test.js
@@ -117,7 +117,7 @@ describe('NewCalendar', () => {
   test('Import modal shown on Import Events button click', () => {
     const wrapper = mountWithIntl(<NewCalendar {...props} />);
 
-    const importButton = wrapper.find('[data-test-subj="mlImportEvents"]');
+    const importButton = wrapper.find('[data-test-subj="mlCalendarImportEventsButton"]');
     const button = importButton.find('EuiButton');
     button.simulate('click');
 
@@ -127,7 +127,7 @@ describe('NewCalendar', () => {
   test('New event modal shown on New event button click', () => {
     const wrapper = mountWithIntl(<NewCalendar {...props} />);
 
-    const importButton = wrapper.find('[data-test-subj="mlNewEvent"]');
+    const importButton = wrapper.find('[data-test-subj="mlCalendarNewEventButton"]');
     const button = importButton.find('EuiButton');
     button.simulate('click');
 
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/list/__snapshots__/calendars_list.test.js.snap b/x-pack/plugins/ml/public/application/settings/calendars/list/__snapshots__/calendars_list.test.js.snap
index aeeeeef63a71e1..0f7585e3a9fa69 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/list/__snapshots__/calendars_list.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/calendars/list/__snapshots__/calendars_list.test.js.snap
@@ -7,6 +7,7 @@ exports[`CalendarsList Renders calendar list with calendars 1`] = `
   />
   <EuiPage
     className="mlCalendarList"
+    data-test-subj="mlPageCalendarManagement"
   >
     <EuiPageBody>
       <EuiPageContent
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/list/__snapshots__/header.test.js.snap b/x-pack/plugins/ml/public/application/settings/calendars/list/__snapshots__/header.test.js.snap
index c31ddc173f9099..2925b2c3d1c38c 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/list/__snapshots__/header.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/calendars/list/__snapshots__/header.test.js.snap
@@ -60,6 +60,7 @@ exports[`CalendarListsHeader renders header 1`] = `
           grow={false}
         >
           <EuiButtonEmpty
+            data-test-subj="mlCalendarListRefreshButton"
             iconType="refresh"
             onClick={[MockFunction]}
             size="s"
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/list/calendars_list.js b/x-pack/plugins/ml/public/application/settings/calendars/list/calendars_list.js
index c1c00bb022f204..12e0b2fb2984a2 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/list/calendars_list.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/list/calendars_list.js
@@ -149,7 +149,7 @@ export class CalendarsListUI extends Component {
     return (
       <Fragment>
         <NavigationMenu tabId="settings" />
-        <EuiPage className="mlCalendarList">
+        <EuiPage className="mlCalendarList" data-test-subj="mlPageCalendarManagement">
           <EuiPageBody>
             <EuiPageContent
               className="mlCalendarList__content"
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/list/header.js b/x-pack/plugins/ml/public/application/settings/calendars/list/header.js
index 53d769aa81abaf..bf4bc48b34720b 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/list/header.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/list/header.js
@@ -62,7 +62,12 @@ function CalendarsListHeaderUI({ totalCount, refreshCalendars, kibana }) {
         <EuiFlexItem grow={false}>
           <EuiFlexGroup alignItems="baseline" gutterSize="m" responsive={false}>
             <EuiFlexItem grow={false}>
-              <EuiButtonEmpty size="s" iconType="refresh" onClick={refreshCalendars}>
+              <EuiButtonEmpty
+                size="s"
+                iconType="refresh"
+                onClick={refreshCalendars}
+                data-test-subj="mlCalendarListRefreshButton"
+              >
                 <FormattedMessage
                   id="xpack.ml.settings.calendars.listHeader.refreshButtonLabel"
                   defaultMessage="Refresh"
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/list/table/__snapshots__/table.test.js.snap b/x-pack/plugins/ml/public/application/settings/calendars/list/table/__snapshots__/table.test.js.snap
index 14b65a04ce599d..cc1c524c19b57b 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/list/table/__snapshots__/table.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/calendars/list/table/__snapshots__/table.test.js.snap
@@ -1,11 +1,14 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`CalendarsListTable renders the table with all calendars 1`] = `
-<Fragment>
+<div
+  data-test-subj="mlCalendarTableContainer"
+>
   <EuiInMemoryTable
     columns={
       Array [
         Object {
+          "data-test-subj": "mlCalendarListColumnId",
           "field": "calendar_id",
           "name": "ID",
           "render": [Function],
@@ -14,6 +17,7 @@ exports[`CalendarsListTable renders the table with all calendars 1`] = `
           "truncateText": true,
         },
         Object {
+          "data-test-subj": "mlCalendarListColumnJobs",
           "field": "job_ids_string",
           "name": "Jobs",
           "render": [Function],
@@ -21,6 +25,7 @@ exports[`CalendarsListTable renders the table with all calendars 1`] = `
           "truncateText": true,
         },
         Object {
+          "data-test-subj": "mlCalendarListColumnEvents",
           "field": "events_length",
           "name": "Events",
           "render": [Function],
@@ -62,6 +67,7 @@ exports[`CalendarsListTable renders the table with all calendars 1`] = `
       }
     }
     responsive={true}
+    rowProps={[Function]}
     search={
       Object {
         "box": Object {
@@ -83,6 +89,7 @@ exports[`CalendarsListTable renders the table with all calendars 1`] = `
           </EuiButton>,
           <EuiButton
             color="danger"
+            data-test-subj="mlCalendarButtonDelete"
             iconType="trash"
             isDisabled={true}
             onClick={[Function]}
@@ -112,5 +119,5 @@ exports[`CalendarsListTable renders the table with all calendars 1`] = `
     }
     tableLayout="fixed"
   />
-</Fragment>
+</div>
 `;
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.js b/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.js
index b81cc6fbb4c301..77331c4a987dca 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/list/table/table.js
@@ -46,8 +46,14 @@ export const CalendarsListTable = ({
       truncateText: true,
       scope: 'row',
       render: (id) => (
-        <EuiLink href={`#/settings/calendars_list/edit_calendar/${id}`}>{id}</EuiLink>
+        <EuiLink
+          href={`#/settings/calendars_list/edit_calendar/${id}`}
+          data-test-subj="mlEditCalendarLink"
+        >
+          {id}
+        </EuiLink>
       ),
+      'data-test-subj': 'mlCalendarListColumnId',
     },
     {
       field: 'job_ids_string',
@@ -68,6 +74,7 @@ export const CalendarsListTable = ({
           jobList
         );
       },
+      'data-test-subj': 'mlCalendarListColumnJobs',
     },
     {
       field: 'events_length',
@@ -80,6 +87,7 @@ export const CalendarsListTable = ({
           defaultMessage: '{eventsLength, plural, one {# event} other {# events}}',
           values: { eventsLength },
         }),
+      'data-test-subj': 'mlCalendarListColumnEvents',
     },
   ];
 
@@ -106,6 +114,7 @@ export const CalendarsListTable = ({
         isDisabled={
           canDeleteCalendar === false || mlNodesAvailable === false || itemsSelected === false
         }
+        data-test-subj="mlCalendarButtonDelete"
       >
         <FormattedMessage
           id="xpack.ml.calendarsList.table.deleteButtonLabel"
@@ -120,7 +129,7 @@ export const CalendarsListTable = ({
   };
 
   return (
-    <React.Fragment>
+    <div data-test-subj="mlCalendarTableContainer">
       <EuiInMemoryTable
         items={calendarsList}
         itemId="calendar_id"
@@ -132,8 +141,11 @@ export const CalendarsListTable = ({
         selection={tableSelection}
         isSelectable={true}
         data-test-subj="mlCalendarTable"
+        rowProps={(item) => ({
+          'data-test-subj': `mlCalendarListRow row-${item.calendar_id}`,
+        })}
       />
-    </React.Fragment>
+    </div>
   );
 };
 
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/components/add_item_popover/__snapshots__/add_item_popover.test.js.snap b/x-pack/plugins/ml/public/application/settings/filter_lists/components/add_item_popover/__snapshots__/add_item_popover.test.js.snap
index 0ce19b8fa3d578..6e9cd17deabee8 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/components/add_item_popover/__snapshots__/add_item_popover.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/components/add_item_popover/__snapshots__/add_item_popover.test.js.snap
@@ -7,6 +7,7 @@ exports[`AddItemPopover calls addItems with multiple items on clicking Add butto
     button={
       <EuiButton
         color="primary"
+        data-test-subj="mlFilterListAddItemButton"
         iconSide="right"
         iconType="arrowDown"
         isDisabled={false}
@@ -92,6 +93,7 @@ exports[`AddItemPopover opens the popover onButtonClick 1`] = `
     button={
       <EuiButton
         color="primary"
+        data-test-subj="mlFilterListAddItemButton"
         iconSide="right"
         iconType="arrowDown"
         isDisabled={false}
@@ -177,6 +179,7 @@ exports[`AddItemPopover renders the popover 1`] = `
     button={
       <EuiButton
         color="primary"
+        data-test-subj="mlFilterListAddItemButton"
         iconSide="right"
         iconType="arrowDown"
         isDisabled={false}
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/components/add_item_popover/add_item_popover.js b/x-pack/plugins/ml/public/application/settings/filter_lists/components/add_item_popover/add_item_popover.js
index 816eea39059a83..07e060d87b36a4 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/components/add_item_popover/add_item_popover.js
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/components/add_item_popover/add_item_popover.js
@@ -84,6 +84,7 @@ export class AddItemPopover extends Component {
         iconSide="right"
         onClick={this.onButtonClick}
         isDisabled={this.props.canCreateFilter === false}
+        data-test-subj="mlFilterListAddItemButton"
       >
         <FormattedMessage
           id="xpack.ml.settings.filterLists.addItemPopover.addItemButtonLabel"
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/components/delete_filter_list_modal/__snapshots__/delete_filter_list_modal.test.js.snap b/x-pack/plugins/ml/public/application/settings/filter_lists/components/delete_filter_list_modal/__snapshots__/delete_filter_list_modal.test.js.snap
index c7c7b7dd9858be..bf4ee8dc5b7fc6 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/components/delete_filter_list_modal/__snapshots__/delete_filter_list_modal.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/components/delete_filter_list_modal/__snapshots__/delete_filter_list_modal.test.js.snap
@@ -4,6 +4,7 @@ exports[`DeleteFilterListModal false canDeleteFilter privilege renders as disabl
 <div>
   <EuiButton
     color="danger"
+    data-test-subj="mlFilterListsDeleteButton"
     iconType="trash"
     isDisabled={false}
     key="delete_filter_list"
@@ -22,6 +23,7 @@ exports[`DeleteFilterListModal renders as delete button after opening and closin
 <div>
   <EuiButton
     color="danger"
+    data-test-subj="mlFilterListsDeleteButton"
     iconType="trash"
     isDisabled={false}
     key="delete_filter_list"
@@ -40,6 +42,7 @@ exports[`DeleteFilterListModal renders as disabled delete button when no lists s
 <div>
   <EuiButton
     color="danger"
+    data-test-subj="mlFilterListsDeleteButton"
     iconType="trash"
     isDisabled={false}
     key="delete_filter_list"
@@ -58,6 +61,7 @@ exports[`DeleteFilterListModal renders as enabled delete button when a list is s
 <div>
   <EuiButton
     color="danger"
+    data-test-subj="mlFilterListsDeleteButton"
     iconType="trash"
     isDisabled={false}
     key="delete_filter_list"
@@ -76,6 +80,7 @@ exports[`DeleteFilterListModal renders modal after clicking delete button 1`] =
 <div>
   <EuiButton
     color="danger"
+    data-test-subj="mlFilterListsDeleteButton"
     iconType="trash"
     isDisabled={false}
     key="delete_filter_list"
@@ -110,7 +115,7 @@ exports[`DeleteFilterListModal renders modal after clicking delete button 1`] =
       onConfirm={[Function]}
       title={
         <FormattedMessage
-          defaultMessage="Delete {selectedFilterListsLength, plural, one {{selectedFilterId}} other {# filter lists}}"
+          defaultMessage="Delete {selectedFilterListsLength, plural, one {{selectedFilterId}} other {# filter lists}}?"
           id="xpack.ml.settings.filterLists.deleteFilterListModal.modalTitle"
           values={
             Object {
@@ -120,20 +125,7 @@ exports[`DeleteFilterListModal renders modal after clicking delete button 1`] =
           }
         />
       }
-    >
-      <p>
-        <FormattedMessage
-          defaultMessage="Are you sure you want to delete
-{selectedFilterListsLength, plural, one {this filter list} other {these filter lists}}"
-          id="xpack.ml.settings.filterLists.deleteFilterListModal.deleteWarningMessage"
-          values={
-            Object {
-              "selectedFilterListsLength": 2,
-            }
-          }
-        />
-      </p>
-    </EuiConfirmModal>
+    />
   </EuiOverlayMask>
 </div>
 `;
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/components/delete_filter_list_modal/delete_filter_list_modal.js b/x-pack/plugins/ml/public/application/settings/filter_lists/components/delete_filter_list_modal/delete_filter_list_modal.js
index 7f8bf06ecb8a36..75fdce8e2bac80 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/components/delete_filter_list_modal/delete_filter_list_modal.js
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/components/delete_filter_list_modal/delete_filter_list_modal.js
@@ -58,7 +58,7 @@ export class DeleteFilterListModal extends Component {
       const title = (
         <FormattedMessage
           id="xpack.ml.settings.filterLists.deleteFilterListModal.modalTitle"
-          defaultMessage="Delete {selectedFilterListsLength, plural, one {{selectedFilterId}} other {# filter lists}}"
+          defaultMessage="Delete {selectedFilterListsLength, plural, one {{selectedFilterId}} other {# filter lists}}?"
           values={{
             selectedFilterListsLength: selectedFilterLists.length,
             selectedFilterId: !!selectedFilterLists.length && selectedFilterLists[0].filter_id,
@@ -86,18 +86,7 @@ export class DeleteFilterListModal extends Component {
             }
             buttonColor="danger"
             defaultFocusedButton={EUI_MODAL_CONFIRM_BUTTON}
-          >
-            <p>
-              <FormattedMessage
-                id="xpack.ml.settings.filterLists.deleteFilterListModal.deleteWarningMessage"
-                defaultMessage="Are you sure you want to delete
-{selectedFilterListsLength, plural, one {this filter list} other {these filter lists}}"
-                values={{
-                  selectedFilterListsLength: selectedFilterLists.length,
-                }}
-              />
-            </p>
-          </EuiConfirmModal>
+          />
         </EuiOverlayMask>
       );
     }
@@ -114,6 +103,7 @@ export class DeleteFilterListModal extends Component {
             selectedFilterLists.length === 0 ||
             canDeleteFilter === false
           }
+          data-test-subj="mlFilterListsDeleteButton"
         >
           <FormattedMessage
             id="xpack.ml.settings.filterLists.deleteFilterListModal.deleteButtonLabel"
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/components/edit_description_popover/__snapshots__/edit_description_popover.test.js.snap b/x-pack/plugins/ml/public/application/settings/filter_lists/components/edit_description_popover/__snapshots__/edit_description_popover.test.js.snap
index f4fb2734a5e82c..9904e90a5afae9 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/components/edit_description_popover/__snapshots__/edit_description_popover.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/components/edit_description_popover/__snapshots__/edit_description_popover.test.js.snap
@@ -8,6 +8,7 @@ exports[`FilterListUsagePopover opens the popover onButtonClick 1`] = `
       <EuiButtonIcon
         aria-label="Edit description"
         color="primary"
+        data-test-subj="mlFilterListEditDescriptionButton"
         iconType="pencil"
         isDisabled={false}
         onClick={[Function]}
@@ -65,6 +66,7 @@ exports[`FilterListUsagePopover renders the popover with a description 1`] = `
       <EuiButtonIcon
         aria-label="Edit description"
         color="primary"
+        data-test-subj="mlFilterListEditDescriptionButton"
         iconType="pencil"
         isDisabled={false}
         onClick={[Function]}
@@ -122,6 +124,7 @@ exports[`FilterListUsagePopover renders the popover with no description 1`] = `
       <EuiButtonIcon
         aria-label="Edit description"
         color="primary"
+        data-test-subj="mlFilterListEditDescriptionButton"
         iconType="pencil"
         isDisabled={false}
         onClick={[Function]}
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/components/edit_description_popover/edit_description_popover.js b/x-pack/plugins/ml/public/application/settings/filter_lists/components/edit_description_popover/edit_description_popover.js
index e7846cb546852f..06ace034ca8193 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/components/edit_description_popover/edit_description_popover.js
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/components/edit_description_popover/edit_description_popover.js
@@ -75,6 +75,7 @@ export class EditDescriptionPopover extends Component {
           }
         )}
         isDisabled={this.props.canCreateFilter === false}
+        data-test-subj="mlFilterListEditDescriptionButton"
       />
     );
 
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/edit_filter_list.test.js.snap b/x-pack/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/edit_filter_list.test.js.snap
index 447d79ffff32ae..c2fab64473228c 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/edit_filter_list.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/edit_filter_list.test.js.snap
@@ -7,6 +7,7 @@ exports[`EditFilterList adds new items to filter list 1`] = `
   />
   <EuiPage
     className="ml-edit-filter-lists"
+    data-test-subj="mlPageFilterListEdit"
   >
     <EuiPageBody>
       <EuiPageContent
@@ -117,6 +118,7 @@ exports[`EditFilterList renders after selecting an item and deleting it 1`] = `
   />
   <EuiPage
     className="ml-edit-filter-lists"
+    data-test-subj="mlPageFilterListEdit"
   >
     <EuiPageBody>
       <EuiPageContent
@@ -229,6 +231,7 @@ exports[`EditFilterList renders after selecting an item and deleting it 2`] = `
   />
   <EuiPage
     className="ml-edit-filter-lists"
+    data-test-subj="mlPageFilterListEdit"
   >
     <EuiPageBody>
       <EuiPageContent
@@ -336,6 +339,7 @@ exports[`EditFilterList renders the edit page for a new filter list and updates
   />
   <EuiPage
     className="ml-edit-filter-lists"
+    data-test-subj="mlPageFilterListEdit"
   >
     <EuiPageBody>
       <EuiPageContent
@@ -427,6 +431,7 @@ exports[`EditFilterList renders the edit page for a new filter list and updates
   />
   <EuiPage
     className="ml-edit-filter-lists"
+    data-test-subj="mlPageFilterListEdit"
   >
     <EuiPageBody>
       <EuiPageContent
@@ -518,6 +523,7 @@ exports[`EditFilterList renders the edit page for an existing filter list and up
   />
   <EuiPage
     className="ml-edit-filter-lists"
+    data-test-subj="mlPageFilterListEdit"
   >
     <EuiPageBody>
       <EuiPageContent
@@ -626,6 +632,7 @@ exports[`EditFilterList renders the edit page for an existing filter list and up
   />
   <EuiPage
     className="ml-edit-filter-lists"
+    data-test-subj="mlPageFilterListEdit"
   >
     <EuiPageBody>
       <EuiPageContent
@@ -734,6 +741,7 @@ exports[`EditFilterList updates the items per page 1`] = `
   />
   <EuiPage
     className="ml-edit-filter-lists"
+    data-test-subj="mlPageFilterListEdit"
   >
     <EuiPageBody>
       <EuiPageContent
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/toolbar.test.js.snap b/x-pack/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/toolbar.test.js.snap
index 9a6e8c756fb852..d3a926c483cd04 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/toolbar.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/toolbar.test.js.snap
@@ -18,6 +18,7 @@ exports[`EditFilterListToolbar renders the toolbar with no items selected 1`] =
             />,
             <EuiButton
               color="danger"
+              data-test-subj="mlFilterListDeleteItemButton"
               disabled={true}
               onClick={[MockFunction]}
               size="s"
@@ -54,6 +55,7 @@ exports[`EditFilterListToolbar renders the toolbar with one item selected 1`] =
             />,
             <EuiButton
               color="danger"
+              data-test-subj="mlFilterListDeleteItemButton"
               disabled={false}
               onClick={[MockFunction]}
               size="s"
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js b/x-pack/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js
index 6437e819db04fe..41b7aa63f55ef5 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js
@@ -316,7 +316,7 @@ export class EditFilterListUI extends Component {
     return (
       <Fragment>
         <NavigationMenu tabId="settings" />
-        <EuiPage className="ml-edit-filter-lists">
+        <EuiPage className="ml-edit-filter-lists" data-test-subj="mlPageFilterListEdit">
           <EuiPageBody>
             <EuiPageContent
               className="ml-edit-filter-lists-content"
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/edit/toolbar.js b/x-pack/plugins/ml/public/application/settings/filter_lists/edit/toolbar.js
index 13b57c8733518c..7a4c698ac37159 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/edit/toolbar.js
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/edit/toolbar.js
@@ -33,6 +33,7 @@ function renderToolsRight(
       disabled={selectedItemCount === 0 || canDeleteFilter === false}
       onClick={deleteSelectedItems}
       key="delete_item_btn"
+      data-test-subj="mlFilterListDeleteItemButton"
     >
       <FormattedMessage
         id="xpack.ml.settings.filterLists.toolbar.deleteItemButtonLabel"
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/filter_lists.test.js.snap b/x-pack/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/filter_lists.test.js.snap
index 5f0cc22fce8b07..3a78a46369c1b8 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/filter_lists.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/filter_lists.test.js.snap
@@ -7,6 +7,7 @@ exports[`Filter Lists renders a list of filters 1`] = `
   />
   <EuiPage
     className="ml-list-filter-lists"
+    data-test-subj="mlPageFilterListManagement"
   >
     <EuiPageBody>
       <EuiPageContent
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/table.test.js.snap b/x-pack/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/table.test.js.snap
index 8985469a807af9..d41ad89d73a5d2 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/table.test.js.snap
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/table.test.js.snap
@@ -2,204 +2,222 @@
 
 exports[`Filter Lists Table renders with filter lists and selection supplied 1`] = `
 <Fragment>
-  <EuiInMemoryTable
-    className="ml-filter-lists-table"
-    columns={
-      Array [
-        Object {
-          "field": "filter_id",
-          "name": "ID",
-          "render": [Function],
-          "scope": "row",
-          "sortable": true,
-        },
-        Object {
-          "field": "description",
-          "name": "Description",
-          "sortable": true,
-        },
-        Object {
-          "field": "item_count",
-          "name": "Item count",
-          "sortable": true,
-        },
-        Object {
-          "field": "used_by",
-          "name": "In use",
-          "render": [Function],
-          "sortable": true,
-        },
-      ]
-    }
-    data-test-subj="mlFilterListsTable"
-    isSelectable={true}
-    itemId="filter_id"
-    items={
-      Array [
-        Object {
-          "description": "List of known safe domains",
-          "filter_id": "safe_domains",
-          "item_count": 500,
-          "used_by": Object {
-            "jobs": Array [
-              "dns_exfiltration",
-            ],
-          },
-        },
+  <div
+    data-test-subj="mlFilterListTableContainer"
+  >
+    <EuiInMemoryTable
+      className="ml-filter-lists-table"
+      columns={
+        Array [
+          Object {
+            "data-test-subj": "mlFilterListColumnId",
+            "field": "filter_id",
+            "name": "ID",
+            "render": [Function],
+            "scope": "row",
+            "sortable": true,
+          },
+          Object {
+            "data-test-subj": "mlFilterListColumnDescription",
+            "field": "description",
+            "name": "Description",
+            "sortable": true,
+          },
+          Object {
+            "data-test-subj": "mlFilterListColumnItemCount",
+            "field": "item_count",
+            "name": "Item count",
+            "sortable": true,
+          },
+          Object {
+            "data-test-subj": "mlFilterListColumnInUse",
+            "field": "used_by",
+            "name": "In use",
+            "render": [Function],
+            "sortable": true,
+          },
+        ]
+      }
+      data-test-subj="mlFilterListsTable"
+      isSelectable={true}
+      itemId="filter_id"
+      items={
+        Array [
+          Object {
+            "description": "List of known safe domains",
+            "filter_id": "safe_domains",
+            "item_count": 500,
+            "used_by": Object {
+              "jobs": Array [
+                "dns_exfiltration",
+              ],
+            },
+          },
+          Object {
+            "description": "US East AWS instances",
+            "filter_id": "us_east_instances",
+            "item_count": 20,
+            "used_by": Object {
+              "jobs": Array [],
+            },
+          },
+        ]
+      }
+      pagination={true}
+      responsive={true}
+      rowProps={[Function]}
+      search={
         Object {
-          "description": "US East AWS instances",
-          "filter_id": "us_east_instances",
-          "item_count": 20,
-          "used_by": Object {
-            "jobs": Array [],
-          },
-        },
-      ]
-    }
-    pagination={true}
-    responsive={true}
-    search={
-      Object {
-        "box": Object {
-          "incremental": true,
-        },
-        "filters": Array [],
-        "toolsRight": Array [
-          <NewFilterButton
-            canCreateFilter={true}
-          />,
-          <DeleteFilterListModal
-            canDeleteFilter={true}
-            refreshFilterLists={[MockFunction]}
-            selectedFilterLists={
-              Array [
-                Object {
-                  "description": "List of known safe domains",
-                  "filter_id": "safe_domains",
-                  "item_count": 500,
-                  "used_by": Object {
-                    "jobs": Array [
-                      "dns_exfiltration",
-                    ],
+          "box": Object {
+            "incremental": true,
+          },
+          "filters": Array [],
+          "toolsRight": Array [
+            <NewFilterButton
+              canCreateFilter={true}
+            />,
+            <DeleteFilterListModal
+              canDeleteFilter={true}
+              refreshFilterLists={[MockFunction]}
+              selectedFilterLists={
+                Array [
+                  Object {
+                    "description": "List of known safe domains",
+                    "filter_id": "safe_domains",
+                    "item_count": 500,
+                    "used_by": Object {
+                      "jobs": Array [
+                        "dns_exfiltration",
+                      ],
+                    },
                   },
-                },
-              ]
-            }
-          />,
-        ],
+                ]
+              }
+            />,
+          ],
+        }
       }
-    }
-    selection={
-      Object {
-        "onSelectionChange": [Function],
-        "selectable": [Function],
-        "selectableMessage": [Function],
+      selection={
+        Object {
+          "onSelectionChange": [Function],
+          "selectable": [Function],
+          "selectableMessage": [Function],
+        }
       }
-    }
-    sorting={
-      Object {
-        "sort": Object {
-          "direction": "asc",
-          "field": "filter_id",
-        },
+      sorting={
+        Object {
+          "sort": Object {
+            "direction": "asc",
+            "field": "filter_id",
+          },
+        }
       }
-    }
-    tableLayout="fixed"
-  />
+      tableLayout="fixed"
+    />
+  </div>
 </Fragment>
 `;
 
 exports[`Filter Lists Table renders with filter lists supplied 1`] = `
 <Fragment>
-  <EuiInMemoryTable
-    className="ml-filter-lists-table"
-    columns={
-      Array [
-        Object {
-          "field": "filter_id",
-          "name": "ID",
-          "render": [Function],
-          "scope": "row",
-          "sortable": true,
-        },
-        Object {
-          "field": "description",
-          "name": "Description",
-          "sortable": true,
-        },
-        Object {
-          "field": "item_count",
-          "name": "Item count",
-          "sortable": true,
-        },
-        Object {
-          "field": "used_by",
-          "name": "In use",
-          "render": [Function],
-          "sortable": true,
-        },
-      ]
-    }
-    data-test-subj="mlFilterListsTable"
-    isSelectable={true}
-    itemId="filter_id"
-    items={
-      Array [
-        Object {
-          "description": "List of known safe domains",
-          "filter_id": "safe_domains",
-          "item_count": 500,
-          "used_by": Object {
-            "jobs": Array [
-              "dns_exfiltration",
-            ],
-          },
-        },
+  <div
+    data-test-subj="mlFilterListTableContainer"
+  >
+    <EuiInMemoryTable
+      className="ml-filter-lists-table"
+      columns={
+        Array [
+          Object {
+            "data-test-subj": "mlFilterListColumnId",
+            "field": "filter_id",
+            "name": "ID",
+            "render": [Function],
+            "scope": "row",
+            "sortable": true,
+          },
+          Object {
+            "data-test-subj": "mlFilterListColumnDescription",
+            "field": "description",
+            "name": "Description",
+            "sortable": true,
+          },
+          Object {
+            "data-test-subj": "mlFilterListColumnItemCount",
+            "field": "item_count",
+            "name": "Item count",
+            "sortable": true,
+          },
+          Object {
+            "data-test-subj": "mlFilterListColumnInUse",
+            "field": "used_by",
+            "name": "In use",
+            "render": [Function],
+            "sortable": true,
+          },
+        ]
+      }
+      data-test-subj="mlFilterListsTable"
+      isSelectable={true}
+      itemId="filter_id"
+      items={
+        Array [
+          Object {
+            "description": "List of known safe domains",
+            "filter_id": "safe_domains",
+            "item_count": 500,
+            "used_by": Object {
+              "jobs": Array [
+                "dns_exfiltration",
+              ],
+            },
+          },
+          Object {
+            "description": "US East AWS instances",
+            "filter_id": "us_east_instances",
+            "item_count": 20,
+            "used_by": Object {
+              "jobs": Array [],
+            },
+          },
+        ]
+      }
+      pagination={true}
+      responsive={true}
+      rowProps={[Function]}
+      search={
         Object {
-          "description": "US East AWS instances",
-          "filter_id": "us_east_instances",
-          "item_count": 20,
-          "used_by": Object {
-            "jobs": Array [],
-          },
-        },
-      ]
-    }
-    pagination={true}
-    responsive={true}
-    search={
-      Object {
-        "box": Object {
-          "incremental": true,
-        },
-        "filters": Array [],
-        "toolsRight": Array [
-          <NewFilterButton
-            canCreateFilter={true}
-          />,
-          <DeleteFilterListModal
-            canDeleteFilter={true}
-            refreshFilterLists={[MockFunction]}
-          />,
-        ],
+          "box": Object {
+            "incremental": true,
+          },
+          "filters": Array [],
+          "toolsRight": Array [
+            <NewFilterButton
+              canCreateFilter={true}
+            />,
+            <DeleteFilterListModal
+              canDeleteFilter={true}
+              refreshFilterLists={[MockFunction]}
+            />,
+          ],
+        }
       }
-    }
-    selection={
-      Object {
-        "onSelectionChange": [Function],
-        "selectable": [Function],
-        "selectableMessage": [Function],
+      selection={
+        Object {
+          "onSelectionChange": [Function],
+          "selectable": [Function],
+          "selectableMessage": [Function],
+        }
       }
-    }
-    sorting={
-      Object {
-        "sort": Object {
-          "direction": "asc",
-          "field": "filter_id",
-        },
+      sorting={
+        Object {
+          "sort": Object {
+            "direction": "asc",
+            "field": "filter_id",
+          },
+        }
       }
-    }
-    tableLayout="fixed"
-  />
+      tableLayout="fixed"
+    />
+  </div>
 </Fragment>
 `;
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/list/filter_lists.js b/x-pack/plugins/ml/public/application/settings/filter_lists/list/filter_lists.js
index 270d5fa350cae0..75c72fdab73079 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/list/filter_lists.js
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/list/filter_lists.js
@@ -89,7 +89,7 @@ export class FilterListsUI extends Component {
     return (
       <Fragment>
         <NavigationMenu tabId="settings" />
-        <EuiPage className="ml-list-filter-lists">
+        <EuiPage className="ml-list-filter-lists" data-test-subj="mlPageFilterListManagement">
           <EuiPageBody>
             <EuiPageContent
               className="ml-list-filter-lists-content"
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/list/header.js b/x-pack/plugins/ml/public/application/settings/filter_lists/list/header.js
index 0d33dc48883924..1d300e3ae63011 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/list/header.js
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/list/header.js
@@ -61,7 +61,12 @@ function FilterListsHeaderUI({ totalCount, refreshFilterLists, kibana }) {
         <EuiFlexItem grow={false}>
           <EuiFlexGroup alignItems="baseline" gutterSize="m" responsive={false}>
             <EuiFlexItem grow={false}>
-              <EuiButtonEmpty size="s" iconType="refresh" onClick={() => refreshFilterLists()}>
+              <EuiButtonEmpty
+                size="s"
+                iconType="refresh"
+                onClick={() => refreshFilterLists()}
+                data-test-subj="mlFilterListRefreshButton"
+              >
                 <FormattedMessage
                   id="xpack.ml.settings.filterLists.listHeader.refreshButtonLabel"
                   defaultMessage="Refresh"
diff --git a/x-pack/plugins/ml/public/application/settings/filter_lists/list/table.js b/x-pack/plugins/ml/public/application/settings/filter_lists/list/table.js
index 7f94f1f2534fbb..9b6fb2b3572a57 100644
--- a/x-pack/plugins/ml/public/application/settings/filter_lists/list/table.js
+++ b/x-pack/plugins/ml/public/application/settings/filter_lists/list/table.js
@@ -38,6 +38,7 @@ function UsedByIcon({ usedBy }) {
         aria-label={i18n.translate('xpack.ml.settings.filterLists.table.inUseAriaLabel', {
           defaultMessage: 'In use',
         })}
+        data-test-subj="mlFilterListUsedByIcon inUse"
       />
     );
   } else {
@@ -47,6 +48,7 @@ function UsedByIcon({ usedBy }) {
         aria-label={i18n.translate('xpack.ml.settings.filterLists.table.notInUseAriaLabel', {
           defaultMessage: 'Not in use',
         })}
+        data-test-subj="mlFilterListUsedByIcon notInUse"
       />
     );
   }
@@ -82,10 +84,16 @@ function getColumns() {
         defaultMessage: 'ID',
       }),
       render: (id) => (
-        <EuiLink href={`#/settings/filter_lists/edit_filter_list/${id}`}>{id}</EuiLink>
+        <EuiLink
+          href={`#/settings/filter_lists/edit_filter_list/${id}`}
+          data-test-subj="mlEditFilterListLink"
+        >
+          {id}
+        </EuiLink>
       ),
       sortable: true,
       scope: 'row',
+      'data-test-subj': 'mlFilterListColumnId',
     },
     {
       field: 'description',
@@ -93,6 +101,7 @@ function getColumns() {
         defaultMessage: 'Description',
       }),
       sortable: true,
+      'data-test-subj': 'mlFilterListColumnDescription',
     },
     {
       field: 'item_count',
@@ -100,6 +109,7 @@ function getColumns() {
         defaultMessage: 'Item count',
       }),
       sortable: true,
+      'data-test-subj': 'mlFilterListColumnItemCount',
     },
     {
       field: 'used_by',
@@ -108,6 +118,7 @@ function getColumns() {
       }),
       render: (usedBy) => <UsedByIcon usedBy={usedBy} />,
       sortable: true,
+      'data-test-subj': 'mlFilterListColumnInUse',
     },
   ];
 
@@ -189,7 +200,7 @@ export function FilterListsTable({
           </EuiFlexGroup>
         </React.Fragment>
       ) : (
-        <React.Fragment>
+        <div data-test-subj="mlFilterListTableContainer">
           <EuiInMemoryTable
             className="ml-filter-lists-table"
             items={filterLists}
@@ -201,8 +212,11 @@ export function FilterListsTable({
             selection={tableSelection}
             isSelectable={true}
             data-test-subj="mlFilterListsTable"
+            rowProps={(item) => ({
+              'data-test-subj': `mlCalendarListRow row-${item.filter_id}`,
+            })}
           />
-        </React.Fragment>
+        </div>
       )}
     </React.Fragment>
   );
diff --git a/x-pack/plugins/ml/public/application/timeseriesexplorer/components/entity_control/entity_control.tsx b/x-pack/plugins/ml/public/application/timeseriesexplorer/components/entity_control/entity_control.tsx
index 93bb62fa1fc58e..9d2c49a95fec45 100644
--- a/x-pack/plugins/ml/public/application/timeseriesexplorer/components/entity_control/entity_control.tsx
+++ b/x-pack/plugins/ml/public/application/timeseriesexplorer/components/entity_control/entity_control.tsx
@@ -141,6 +141,7 @@ export class EntityControl extends Component<EntityControlProps, EntityControlSt
         onSearchChange={this.onSearchChange}
         isClearable={false}
         renderOption={this.renderOption}
+        data-test-subj={`mlSingleMetricViewerEntitySelection ${entity.fieldName}`}
       />
     );
 
diff --git a/x-pack/plugins/ml/public/application/timeseriesexplorer/components/forecasting_modal/modal.js b/x-pack/plugins/ml/public/application/timeseriesexplorer/components/forecasting_modal/modal.js
index 6527aa3801da9c..4fec8b01530f33 100644
--- a/x-pack/plugins/ml/public/application/timeseriesexplorer/components/forecasting_modal/modal.js
+++ b/x-pack/plugins/ml/public/application/timeseriesexplorer/components/forecasting_modal/modal.js
@@ -31,7 +31,7 @@ import { FormattedMessage } from '@kbn/i18n/react';
 export function Modal(props) {
   return (
     <EuiOverlayMask>
-      <EuiModal onClose={props.close} maxWidth={860}>
+      <EuiModal onClose={props.close} maxWidth={860} data-test-subj="mlModalForecast">
         <EuiModalHeader>
           <EuiModalHeaderTitle>
             <FormattedMessage
diff --git a/x-pack/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js b/x-pack/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js
index 83a789074d353c..0e99d64cf202f8 100644
--- a/x-pack/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js
+++ b/x-pack/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js
@@ -83,6 +83,7 @@ import {
   getFocusData,
 } from './timeseriesexplorer_utils';
 import { EMPTY_FIELD_VALUE_LABEL } from './components/entity_control/entity_control';
+import { ANOMALY_DETECTION_DEFAULT_TIME_RANGE } from '../../../common/constants/settings';
 
 // Used to indicate the chart is being plotted across
 // all partition field values, where the cardinality of the field cannot be
@@ -833,6 +834,22 @@ export class TimeSeriesExplorer extends React.Component {
   }
 
   componentDidMount() {
+    // if timeRange used in the url is incorrect
+    // perhaps due to user's advanced setting using incorrect date-maths
+    const { invalidTimeRangeError } = this.props;
+    if (invalidTimeRangeError) {
+      const toastNotifications = getToastNotifications();
+      toastNotifications.addWarning(
+        i18n.translate('xpack.ml.timeSeriesExplorer.invalidTimeRangeInUrlCallout', {
+          defaultMessage:
+            'The time filter was changed to the full range for this job due to an invalid default time filter. Check the advanced settings for {field}.',
+          values: {
+            field: ANOMALY_DETECTION_DEFAULT_TIME_RANGE,
+          },
+        })
+      );
+    }
+
     // Required to redraw the time series chart when the container is resized.
     this.resizeChecker = new ResizeChecker(this.resizeRef.current);
     this.resizeChecker.on('resize', () => {
diff --git a/x-pack/plugins/ml/public/application/util/date_utils.ts b/x-pack/plugins/ml/public/application/util/date_utils.ts
index 8f3215b6cd211f..21adc0b4b9c66a 100644
--- a/x-pack/plugins/ml/public/application/util/date_utils.ts
+++ b/x-pack/plugins/ml/public/application/util/date_utils.ts
@@ -8,7 +8,8 @@
 
 // @ts-ignore
 import { formatDate } from '@elastic/eui/lib/services/format';
-
+import dateMath from '@elastic/datemath';
+import { TimeRange } from '../../../../../../src/plugins/data/common';
 export function formatHumanReadableDate(ts: number) {
   return formatDate(ts, 'MMMM Do YYYY');
 }
@@ -20,3 +21,10 @@ export function formatHumanReadableDateTime(ts: number): string {
 export function formatHumanReadableDateTimeSeconds(ts: number) {
   return formatDate(ts, 'MMMM Do YYYY, HH:mm:ss');
 }
+
+export function validateTimeRange(time?: TimeRange): boolean {
+  if (!time) return false;
+  const momentDateFrom = dateMath.parse(time.from);
+  const momentDateTo = dateMath.parse(time.to);
+  return !!(momentDateFrom && momentDateFrom.isValid() && momentDateTo && momentDateTo.isValid());
+}
diff --git a/x-pack/plugins/ml/public/ml_url_generator/anomaly_detection_urls_generator.ts b/x-pack/plugins/ml/public/ml_url_generator/anomaly_detection_urls_generator.ts
new file mode 100644
index 00000000000000..c4aebb108e7b92
--- /dev/null
+++ b/x-pack/plugins/ml/public/ml_url_generator/anomaly_detection_urls_generator.ts
@@ -0,0 +1,163 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import isEmpty from 'lodash/isEmpty';
+import {
+  AnomalyDetectionQueryState,
+  AnomalyDetectionUrlState,
+  ExplorerAppState,
+  ExplorerGlobalState,
+  ExplorerUrlState,
+  MlGenericUrlState,
+  TimeSeriesExplorerAppState,
+  TimeSeriesExplorerGlobalState,
+  TimeSeriesExplorerUrlState,
+} from '../../common/types/ml_url_generator';
+import { ML_PAGES } from '../../common/constants/ml_url_generator';
+import { createIndexBasedMlUrl } from './common';
+import { setStateToKbnUrl } from '../../../../../src/plugins/kibana_utils/public';
+/**
+ * Creates URL to the Anomaly Detection Job management page
+ */
+export function createAnomalyDetectionJobManagementUrl(
+  appBasePath: string,
+  params: AnomalyDetectionUrlState['pageState']
+): string {
+  let url = `${appBasePath}/${ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE}`;
+  if (!params || isEmpty(params)) {
+    return url;
+  }
+  const { jobId, groupIds } = params;
+  const queryState: AnomalyDetectionQueryState = {
+    jobId,
+    groupIds,
+  };
+
+  url = setStateToKbnUrl<AnomalyDetectionQueryState>(
+    'mlManagement',
+    queryState,
+    { useHash: false, storeInHashQuery: false },
+    url
+  );
+  return url;
+}
+
+export function createAnomalyDetectionCreateJobSelectType(
+  appBasePath: string,
+  pageState: MlGenericUrlState['pageState']
+): string {
+  return createIndexBasedMlUrl(
+    appBasePath,
+    ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE,
+    pageState
+  );
+}
+
+/**
+ * Creates URL to the Anomaly Explorer page
+ */
+export function createExplorerUrl(
+  appBasePath: string,
+  params: ExplorerUrlState['pageState']
+): string {
+  let url = `${appBasePath}/${ML_PAGES.ANOMALY_EXPLORER}`;
+
+  if (!params) {
+    return url;
+  }
+  const {
+    refreshInterval,
+    timeRange,
+    jobIds,
+    query,
+    mlExplorerSwimlane = {},
+    mlExplorerFilter = {},
+  } = params;
+  const appState: Partial<ExplorerAppState> = {
+    mlExplorerSwimlane,
+    mlExplorerFilter,
+  };
+  if (query) appState.query = query;
+
+  if (jobIds) {
+    const queryState: Partial<ExplorerGlobalState> = {
+      ml: {
+        jobIds,
+      },
+    };
+
+    if (timeRange) queryState.time = timeRange;
+    if (refreshInterval) queryState.refreshInterval = refreshInterval;
+
+    url = setStateToKbnUrl<Partial<ExplorerGlobalState>>(
+      '_g',
+      queryState,
+      { useHash: false, storeInHashQuery: false },
+      url
+    );
+    url = setStateToKbnUrl<Partial<ExplorerAppState>>(
+      '_a',
+      appState,
+      { useHash: false, storeInHashQuery: false },
+      url
+    );
+  }
+
+  return url;
+}
+
+/**
+ * Creates URL to the SingleMetricViewer page
+ */
+export function createSingleMetricViewerUrl(
+  appBasePath: string,
+  params: TimeSeriesExplorerUrlState['pageState']
+): string {
+  let url = `${appBasePath}/${ML_PAGES.SINGLE_METRIC_VIEWER}`;
+  if (!params) {
+    return url;
+  }
+  const { timeRange, jobIds, refreshInterval, zoom, query, detectorIndex, entities } = params;
+
+  const queryState: TimeSeriesExplorerGlobalState = {
+    ml: {
+      jobIds,
+    },
+    refreshInterval,
+    time: timeRange,
+  };
+
+  const appState: Partial<TimeSeriesExplorerAppState> = {};
+  const mlTimeSeriesExplorer: Partial<TimeSeriesExplorerAppState['mlTimeSeriesExplorer']> = {};
+
+  if (detectorIndex !== undefined) {
+    mlTimeSeriesExplorer.detectorIndex = detectorIndex;
+  }
+  if (entities !== undefined) {
+    mlTimeSeriesExplorer.entities = entities;
+  }
+  appState.mlTimeSeriesExplorer = mlTimeSeriesExplorer;
+
+  if (zoom) appState.zoom = zoom;
+  if (query)
+    appState.query = {
+      query_string: query,
+    };
+  url = setStateToKbnUrl<TimeSeriesExplorerGlobalState>(
+    '_g',
+    queryState,
+    { useHash: false, storeInHashQuery: false },
+    url
+  );
+  url = setStateToKbnUrl<TimeSeriesExplorerAppState>(
+    '_a',
+    appState,
+    { useHash: false, storeInHashQuery: false },
+    url
+  );
+
+  return url;
+}
diff --git a/x-pack/plugins/ml/public/ml_url_generator/common.ts b/x-pack/plugins/ml/public/ml_url_generator/common.ts
new file mode 100644
index 00000000000000..57cfc52045282b
--- /dev/null
+++ b/x-pack/plugins/ml/public/ml_url_generator/common.ts
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import isEmpty from 'lodash/isEmpty';
+import { MlGenericUrlState } from '../../common/types/ml_url_generator';
+import { setStateToKbnUrl } from '../../../../../src/plugins/kibana_utils/public';
+
+export function extractParams<UrlState>(urlState: UrlState) {
+  // page should be guaranteed to exist here but <UrlState> is unknown
+  // @ts-ignore
+  const { page, ...params } = urlState;
+  return { page, params };
+}
+
+/**
+ * Creates generic index based search ML url
+ * e.g. `jobs/new_job/datavisualizer?index=3da93760-e0af-11ea-9ad3-3bcfc330e42a`
+ */
+export function createIndexBasedMlUrl(
+  appBasePath: string,
+  page: MlGenericUrlState['page'],
+  pageState: MlGenericUrlState['pageState']
+): string {
+  const { globalState, appState, index, savedSearchId, ...restParams } = pageState;
+  let url = `${appBasePath}/${page}`;
+
+  if (index !== undefined && savedSearchId === undefined) {
+    url = `${url}?index=${index}`;
+  }
+  if (index === undefined && savedSearchId !== undefined) {
+    url = `${url}?savedSearchId=${savedSearchId}`;
+  }
+
+  if (!isEmpty(restParams)) {
+    Object.keys(restParams).forEach((key) => {
+      url = setStateToKbnUrl(
+        key,
+        restParams[key],
+        { useHash: false, storeInHashQuery: false },
+        url
+      );
+    });
+  }
+
+  if (globalState) {
+    url = setStateToKbnUrl('_g', globalState, { useHash: false, storeInHashQuery: false }, url);
+  }
+  if (appState) {
+    url = setStateToKbnUrl('_a', appState, { useHash: false, storeInHashQuery: false }, url);
+  }
+  return url;
+}
diff --git a/x-pack/plugins/ml/public/ml_url_generator/data_frame_analytics_urls_generator.ts b/x-pack/plugins/ml/public/ml_url_generator/data_frame_analytics_urls_generator.ts
new file mode 100644
index 00000000000000..8cf10a2acb64f2
--- /dev/null
+++ b/x-pack/plugins/ml/public/ml_url_generator/data_frame_analytics_urls_generator.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/**
+ * Creates URL to the DataFrameAnalytics page
+ */
+import {
+  DataFrameAnalyticsExplorationQueryState,
+  DataFrameAnalyticsExplorationUrlState,
+  DataFrameAnalyticsQueryState,
+  DataFrameAnalyticsUrlState,
+} from '../../common/types/ml_url_generator';
+import { ML_PAGES } from '../../common/constants/ml_url_generator';
+import { setStateToKbnUrl } from '../../../../../src/plugins/kibana_utils/public';
+
+export function createDataFrameAnalyticsJobManagementUrl(
+  appBasePath: string,
+  mlUrlGeneratorState: DataFrameAnalyticsUrlState['pageState']
+): string {
+  let url = `${appBasePath}/${ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE}`;
+
+  if (mlUrlGeneratorState) {
+    const { jobId, groupIds } = mlUrlGeneratorState;
+    const queryState: Partial<DataFrameAnalyticsQueryState> = {
+      jobId,
+      groupIds,
+    };
+
+    url = setStateToKbnUrl<Partial<DataFrameAnalyticsQueryState>>(
+      'mlManagement',
+      queryState,
+      { useHash: false, storeInHashQuery: false },
+      url
+    );
+  }
+
+  return url;
+}
+
+/**
+ * Creates URL to the DataFrameAnalytics Exploration page
+ */
+export function createDataFrameAnalyticsExplorationUrl(
+  appBasePath: string,
+  mlUrlGeneratorState: DataFrameAnalyticsExplorationUrlState['pageState']
+): string {
+  let url = `${appBasePath}/${ML_PAGES.DATA_FRAME_ANALYTICS_EXPLORATION}`;
+
+  if (mlUrlGeneratorState) {
+    const { jobId, analysisType } = mlUrlGeneratorState;
+    const queryState: DataFrameAnalyticsExplorationQueryState = {
+      ml: {
+        jobId,
+        analysisType,
+      },
+    };
+
+    url = setStateToKbnUrl<DataFrameAnalyticsExplorationQueryState>(
+      '_g',
+      queryState,
+      { useHash: false, storeInHashQuery: false },
+      url
+    );
+  }
+
+  return url;
+}
diff --git a/x-pack/plugins/ml/public/ml_url_generator/data_visualizer_urls_generator.ts b/x-pack/plugins/ml/public/ml_url_generator/data_visualizer_urls_generator.ts
new file mode 100644
index 00000000000000..24693df5025d9d
--- /dev/null
+++ b/x-pack/plugins/ml/public/ml_url_generator/data_visualizer_urls_generator.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/**
+ * Creates URL to the Data Visualizer page
+ */
+import { DataVisualizerUrlState, MlGenericUrlState } from '../../common/types/ml_url_generator';
+import { createIndexBasedMlUrl } from './common';
+import { ML_PAGES } from '../../common/constants/ml_url_generator';
+
+export function createDataVisualizerUrl(
+  appBasePath: string,
+  { page }: DataVisualizerUrlState
+): string {
+  return `${appBasePath}/${page}`;
+}
+
+/**
+ * Creates URL to the Index Data Visualizer
+ */
+export function createIndexDataVisualizerUrl(
+  appBasePath: string,
+  pageState: MlGenericUrlState['pageState']
+): string {
+  return createIndexBasedMlUrl(appBasePath, ML_PAGES.DATA_VISUALIZER_INDEX_VIEWER, pageState);
+}
diff --git a/x-pack/plugins/ml/public/ml_url_generator/index.ts b/x-pack/plugins/ml/public/ml_url_generator/index.ts
new file mode 100644
index 00000000000000..1579b187278c4f
--- /dev/null
+++ b/x-pack/plugins/ml/public/ml_url_generator/index.ts
@@ -0,0 +1,6 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+export { MlUrlGenerator, registerUrlGenerator } from './ml_url_generator';
diff --git a/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.test.ts b/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.test.ts
new file mode 100644
index 00000000000000..55bc6d3668de78
--- /dev/null
+++ b/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.test.ts
@@ -0,0 +1,262 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { MlUrlGenerator } from './ml_url_generator';
+import { ML_PAGES } from '../../common/constants/ml_url_generator';
+import { ANALYSIS_CONFIG_TYPE } from '../../common/types/ml_url_generator';
+
+describe('MlUrlGenerator', () => {
+  const urlGenerator = new MlUrlGenerator({
+    appBasePath: '/app/ml',
+    useHash: false,
+  });
+
+  describe('AnomalyDetection', () => {
+    describe('Job Management Page', () => {
+      it('should generate valid URL for the Anomaly Detection job management page', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE,
+        });
+        expect(url).toBe('/app/ml/jobs');
+      });
+
+      it('should generate valid URL for the Anomaly Detection job management page for job', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE,
+          pageState: {
+            jobId: 'fq_single_1',
+          },
+        });
+        expect(url).toBe('/app/ml/jobs?mlManagement=(jobId:fq_single_1)');
+      });
+
+      it('should generate valid URL for the Anomaly Detection job management page for groupIds', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE,
+          pageState: {
+            groupIds: ['farequote', 'categorization'],
+          },
+        });
+        expect(url).toBe('/app/ml/jobs?mlManagement=(groupIds:!(farequote,categorization))');
+      });
+
+      it('should generate valid URL for the page for selecting the type of anomaly detection job to create', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE,
+          pageState: {
+            index: `3da93760-e0af-11ea-9ad3-3bcfc330e42a`,
+            globalState: {
+              time: {
+                from: 'now-30m',
+                to: 'now',
+              },
+            },
+          },
+        });
+        expect(url).toBe(
+          '/app/ml/jobs/new_job/step/job_type?index=3da93760-e0af-11ea-9ad3-3bcfc330e42a&_g=(time:(from:now-30m,to:now))'
+        );
+      });
+    });
+
+    describe('Anomaly Explorer Page', () => {
+      it('should generate valid URL for the Anomaly Explorer page', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.ANOMALY_EXPLORER,
+          pageState: {
+            jobIds: ['fq_single_1'],
+            mlExplorerSwimlane: { viewByFromPage: 2, viewByPerPage: 20 },
+            refreshInterval: {
+              pause: false,
+              value: 0,
+            },
+            timeRange: {
+              from: '2019-02-07T00:00:00.000Z',
+              to: '2020-08-13T17:15:00.000Z',
+              mode: 'absolute',
+            },
+            query: {
+              analyze_wildcard: true,
+              query: '*',
+            },
+          },
+        });
+        expect(url).toBe(
+          "/app/ml/explorer?_g=(ml:(jobIds:!(fq_single_1)),refreshInterval:(pause:!f,value:0),time:(from:'2019-02-07T00:00:00.000Z',mode:absolute,to:'2020-08-13T17:15:00.000Z'))&_a=(mlExplorerFilter:(),mlExplorerSwimlane:(viewByFromPage:2,viewByPerPage:20),query:(analyze_wildcard:!t,query:'*'))"
+        );
+      });
+      it('should generate valid URL for the Anomaly Explorer page for multiple jobIds', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.ANOMALY_EXPLORER,
+          pageState: {
+            jobIds: ['fq_single_1', 'logs_categorization_1'],
+            timeRange: {
+              from: '2019-02-07T00:00:00.000Z',
+              to: '2020-08-13T17:15:00.000Z',
+              mode: 'absolute',
+            },
+          },
+        });
+        expect(url).toBe(
+          "/app/ml/explorer?_g=(ml:(jobIds:!(fq_single_1,logs_categorization_1)),time:(from:'2019-02-07T00:00:00.000Z',mode:absolute,to:'2020-08-13T17:15:00.000Z'))&_a=(mlExplorerFilter:(),mlExplorerSwimlane:())"
+        );
+      });
+    });
+
+    describe('Single Metric Viewer Page', () => {
+      it('should generate valid URL for the Single Metric Viewer page', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.SINGLE_METRIC_VIEWER,
+          pageState: {
+            jobIds: ['logs_categorization_1'],
+            refreshInterval: {
+              pause: false,
+              value: 0,
+            },
+            timeRange: {
+              from: '2020-07-12T00:39:02.912Z',
+              to: '2020-07-22T15:52:18.613Z',
+              mode: 'absolute',
+            },
+            query: {
+              analyze_wildcard: true,
+              query: '*',
+            },
+          },
+        });
+        expect(url).toBe(
+          "/app/ml/timeseriesexplorer?_g=(ml:(jobIds:!(logs_categorization_1)),refreshInterval:(pause:!f,value:0),time:(from:'2020-07-12T00:39:02.912Z',mode:absolute,to:'2020-07-22T15:52:18.613Z'))&_a=(mlTimeSeriesExplorer:(),query:(query_string:(analyze_wildcard:!t,query:'*')))"
+        );
+      });
+
+      it('should generate valid URL for the Single Metric Viewer page with extra settings', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.SINGLE_METRIC_VIEWER,
+          pageState: {
+            jobIds: ['logs_categorization_1'],
+            detectorIndex: 0,
+            entities: { mlcategory: '2' },
+            refreshInterval: {
+              pause: false,
+              value: 0,
+            },
+            timeRange: {
+              from: '2020-07-12T00:39:02.912Z',
+              to: '2020-07-22T15:52:18.613Z',
+              mode: 'absolute',
+            },
+            zoom: {
+              from: '2020-07-20T23:58:29.367Z',
+              to: '2020-07-21T11:00:13.173Z',
+            },
+            query: {
+              analyze_wildcard: true,
+              query: '*',
+            },
+          },
+        });
+        expect(url).toBe(
+          "/app/ml/timeseriesexplorer?_g=(ml:(jobIds:!(logs_categorization_1)),refreshInterval:(pause:!f,value:0),time:(from:'2020-07-12T00:39:02.912Z',mode:absolute,to:'2020-07-22T15:52:18.613Z'))&_a=(mlTimeSeriesExplorer:(detectorIndex:0,entities:(mlcategory:'2')),query:(query_string:(analyze_wildcard:!t,query:'*')),zoom:(from:'2020-07-20T23:58:29.367Z',to:'2020-07-21T11:00:13.173Z'))"
+        );
+      });
+    });
+  });
+
+  describe('DataFrameAnalytics', () => {
+    describe('JobManagement Page', () => {
+      it('should generate valid URL for the Data Frame Analytics job management page', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE,
+        });
+        expect(url).toBe('/app/ml/data_frame_analytics');
+      });
+      it('should generate valid URL for the Data Frame Analytics job management page with jobId', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE,
+          pageState: {
+            jobId: 'grid_regression_1',
+          },
+        });
+        expect(url).toBe('/app/ml/data_frame_analytics?mlManagement=(jobId:grid_regression_1)');
+      });
+
+      it('should generate valid URL for the Data Frame Analytics job management page with groupIds', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE,
+          pageState: {
+            groupIds: ['group_1', 'group_2'],
+          },
+        });
+        expect(url).toBe('/app/ml/data_frame_analytics?mlManagement=(groupIds:!(group_1,group_2))');
+      });
+    });
+
+    describe('ExplorationPage', () => {
+      it('should generate valid URL for the Data Frame Analytics exploration page for job', async () => {
+        const url = await urlGenerator.createUrl({
+          page: ML_PAGES.DATA_FRAME_ANALYTICS_EXPLORATION,
+          pageState: {
+            jobId: 'grid_regression_1',
+            analysisType: ANALYSIS_CONFIG_TYPE.REGRESSION,
+          },
+        });
+        expect(url).toBe(
+          '/app/ml/data_frame_analytics/exploration?_g=(ml:(analysisType:regression,jobId:grid_regression_1))'
+        );
+      });
+    });
+  });
+
+  describe('DataVisualizer', () => {
+    it('should generate valid URL for the Data Visualizer page', async () => {
+      const url = await urlGenerator.createUrl({
+        page: ML_PAGES.DATA_VISUALIZER,
+      });
+      expect(url).toBe('/app/ml/datavisualizer');
+    });
+
+    it('should generate valid URL for the File Data Visualizer import page', async () => {
+      const url = await urlGenerator.createUrl({
+        page: ML_PAGES.DATA_VISUALIZER_FILE,
+      });
+      expect(url).toBe('/app/ml/filedatavisualizer');
+    });
+
+    it('should generate valid URL for the Index Data Visualizer select index pattern or saved search page', async () => {
+      const url = await urlGenerator.createUrl({
+        page: ML_PAGES.DATA_VISUALIZER_INDEX_SELECT,
+      });
+      expect(url).toBe('/app/ml/datavisualizer_index_select');
+    });
+
+    it('should generate valid URL for the Index Data Visualizer Viewer page', async () => {
+      const url = await urlGenerator.createUrl({
+        page: ML_PAGES.DATA_VISUALIZER_INDEX_VIEWER,
+        pageState: {
+          index: '3da93760-e0af-11ea-9ad3-3bcfc330e42a',
+          globalState: {
+            time: {
+              from: 'now-30m',
+              to: 'now',
+            },
+          },
+        },
+      });
+      expect(url).toBe(
+        '/app/ml/jobs/new_job/datavisualizer?index=3da93760-e0af-11ea-9ad3-3bcfc330e42a&_g=(time:(from:now-30m,to:now))'
+      );
+    });
+  });
+
+  it('should throw an error in case the page is not provided', async () => {
+    expect.assertions(1);
+
+    // @ts-ignore
+    await urlGenerator.createUrl({ jobIds: ['test-job'] }).catch((e) => {
+      expect(e.message).toEqual('Page type is not provided or unknown');
+    });
+  });
+});
diff --git a/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.ts b/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.ts
new file mode 100644
index 00000000000000..b69260d8d4157b
--- /dev/null
+++ b/x-pack/plugins/ml/public/ml_url_generator/ml_url_generator.ts
@@ -0,0 +1,91 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CoreSetup } from 'kibana/public';
+import {
+  SharePluginSetup,
+  UrlGeneratorsDefinition,
+  UrlGeneratorState,
+} from '../../../../../src/plugins/share/public';
+import { MlStartDependencies } from '../plugin';
+import { ML_PAGES, ML_APP_URL_GENERATOR } from '../../common/constants/ml_url_generator';
+import { MlUrlGeneratorState } from '../../common/types/ml_url_generator';
+import {
+  createAnomalyDetectionJobManagementUrl,
+  createAnomalyDetectionCreateJobSelectType,
+  createExplorerUrl,
+  createSingleMetricViewerUrl,
+} from './anomaly_detection_urls_generator';
+import {
+  createDataFrameAnalyticsJobManagementUrl,
+  createDataFrameAnalyticsExplorationUrl,
+} from './data_frame_analytics_urls_generator';
+import {
+  createIndexDataVisualizerUrl,
+  createDataVisualizerUrl,
+} from './data_visualizer_urls_generator';
+
+declare module '../../../../../src/plugins/share/public' {
+  export interface UrlGeneratorStateMapping {
+    [ML_APP_URL_GENERATOR]: UrlGeneratorState<MlUrlGeneratorState>;
+  }
+}
+
+interface Params {
+  appBasePath: string;
+  useHash: boolean;
+}
+
+export class MlUrlGenerator implements UrlGeneratorsDefinition<typeof ML_APP_URL_GENERATOR> {
+  constructor(private readonly params: Params) {}
+
+  public readonly id = ML_APP_URL_GENERATOR;
+
+  public readonly createUrl = async (mlUrlGeneratorState: MlUrlGeneratorState): Promise<string> => {
+    const appBasePath = this.params.appBasePath;
+    switch (mlUrlGeneratorState.page) {
+      case ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE:
+        return createAnomalyDetectionJobManagementUrl(appBasePath, mlUrlGeneratorState.pageState);
+      case ML_PAGES.ANOMALY_EXPLORER:
+        return createExplorerUrl(appBasePath, mlUrlGeneratorState.pageState);
+      case ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_TYPE:
+        return createAnomalyDetectionCreateJobSelectType(
+          appBasePath,
+          mlUrlGeneratorState.pageState
+        );
+      case ML_PAGES.SINGLE_METRIC_VIEWER:
+        return createSingleMetricViewerUrl(appBasePath, mlUrlGeneratorState.pageState);
+      case ML_PAGES.DATA_FRAME_ANALYTICS_JOBS_MANAGE:
+        return createDataFrameAnalyticsJobManagementUrl(appBasePath, mlUrlGeneratorState.pageState);
+      case ML_PAGES.DATA_FRAME_ANALYTICS_EXPLORATION:
+        return createDataFrameAnalyticsExplorationUrl(appBasePath, mlUrlGeneratorState.pageState);
+      case ML_PAGES.DATA_VISUALIZER:
+      case ML_PAGES.DATA_VISUALIZER_FILE:
+      case ML_PAGES.DATA_VISUALIZER_INDEX_SELECT:
+        return createDataVisualizerUrl(appBasePath, mlUrlGeneratorState);
+      case ML_PAGES.DATA_VISUALIZER_INDEX_VIEWER:
+        return createIndexDataVisualizerUrl(appBasePath, mlUrlGeneratorState.pageState);
+      default:
+        throw new Error('Page type is not provided or unknown');
+    }
+  };
+}
+
+/**
+ * Registers the URL generator
+ */
+export function registerUrlGenerator(
+  share: SharePluginSetup,
+  core: CoreSetup<MlStartDependencies>
+) {
+  const baseUrl = core.http.basePath.prepend('/app/ml');
+  share.urlGenerators.registerUrlGenerator(
+    new MlUrlGenerator({
+      appBasePath: baseUrl,
+      useHash: core.uiSettings.get('state:storeInSessionStorage'),
+    })
+  );
+}
diff --git a/x-pack/plugins/ml/public/plugin.ts b/x-pack/plugins/ml/public/plugin.ts
index 4f8ceb8effe982..3e8ab99e341ad5 100644
--- a/x-pack/plugins/ml/public/plugin.ts
+++ b/x-pack/plugins/ml/public/plugin.ts
@@ -34,7 +34,7 @@ import { registerFeature } from './register_feature';
 import { UiActionsSetup, UiActionsStart } from '../../../../src/plugins/ui_actions/public';
 import { registerMlUiActions } from './ui_actions';
 import { KibanaLegacyStart } from '../../../../src/plugins/kibana_legacy/public';
-import { registerUrlGenerator } from './url_generator';
+import { registerUrlGenerator } from './ml_url_generator';
 import { isFullLicense, isMlEnabled } from '../common/license';
 import { registerEmbeddables } from './embeddables';
 
@@ -96,12 +96,7 @@ export class MlPlugin implements Plugin<MlPluginSetup, MlPluginStart> {
             uiActions: pluginsStart.uiActions,
             kibanaVersion,
           },
-          {
-            element: params.element,
-            appBasePath: params.appBasePath,
-            onAppLeave: params.onAppLeave,
-            history: params.history,
-          }
+          params
         );
       },
     });
diff --git a/x-pack/plugins/ml/public/ui_actions/open_in_anomaly_explorer_action.tsx b/x-pack/plugins/ml/public/ui_actions/open_in_anomaly_explorer_action.tsx
index e327befcf72938..e4d7cfa32c2cd5 100644
--- a/x-pack/plugins/ml/public/ui_actions/open_in_anomaly_explorer_action.tsx
+++ b/x-pack/plugins/ml/public/ui_actions/open_in_anomaly_explorer_action.tsx
@@ -7,7 +7,7 @@
 import { i18n } from '@kbn/i18n';
 import { ActionContextMapping, createAction } from '../../../../../src/plugins/ui_actions/public';
 import { MlCoreSetup } from '../plugin';
-import { ML_APP_URL_GENERATOR } from '../url_generator';
+import { ML_APP_URL_GENERATOR } from '../../common/constants/ml_url_generator';
 import { ANOMALY_SWIMLANE_EMBEDDABLE_TYPE, SwimLaneDrilldownContext } from '../embeddables';
 
 export const OPEN_IN_ANOMALY_EXPLORER_ACTION = 'openInAnomalyExplorerAction';
@@ -32,19 +32,21 @@ export function createOpenInExplorerAction(getStartServices: MlCoreSetup['getSta
 
       return urlGenerator.createUrl({
         page: 'explorer',
-        jobIds,
-        timeRange,
-        mlExplorerSwimlane: {
-          viewByFromPage: fromPage,
-          viewByPerPage: perPage,
-          viewByFieldName: viewBy,
-          ...(data
-            ? {
-                selectedType: data.type,
-                selectedTimes: data.times,
-                selectedLanes: data.lanes,
-              }
-            : {}),
+        pageState: {
+          jobIds,
+          timeRange,
+          mlExplorerSwimlane: {
+            viewByFromPage: fromPage,
+            viewByPerPage: perPage,
+            viewByFieldName: viewBy,
+            ...(data
+              ? {
+                  selectedType: data.type,
+                  selectedTimes: data.times,
+                  selectedLanes: data.lanes,
+                }
+              : {}),
+          },
         },
       });
     },
diff --git a/x-pack/plugins/ml/public/url_generator.test.ts b/x-pack/plugins/ml/public/url_generator.test.ts
deleted file mode 100644
index 21dde124049577..00000000000000
--- a/x-pack/plugins/ml/public/url_generator.test.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { MlUrlGenerator } from './url_generator';
-
-describe('MlUrlGenerator', () => {
-  const urlGenerator = new MlUrlGenerator({
-    appBasePath: '/app/ml',
-    useHash: false,
-  });
-
-  it('should generate valid URL for the Anomaly Explorer page', async () => {
-    const url = await urlGenerator.createUrl({
-      page: 'explorer',
-      jobIds: ['test-job'],
-      mlExplorerSwimlane: { viewByFromPage: 2, viewByPerPage: 20 },
-    });
-    expect(url).toBe(
-      '/app/ml/explorer#?_g=(ml:(jobIds:!(test-job)))&_a=(mlExplorerFilter:(),mlExplorerSwimlane:(viewByFromPage:2,viewByPerPage:20))'
-    );
-  });
-
-  it('should throw an error in case the page is not provided', async () => {
-    expect.assertions(1);
-
-    // @ts-ignore
-    await urlGenerator.createUrl({ jobIds: ['test-job'] }).catch((e) => {
-      expect(e.message).toEqual('Page type is not provided or unknown');
-    });
-  });
-});
diff --git a/x-pack/plugins/ml/public/url_generator.ts b/x-pack/plugins/ml/public/url_generator.ts
deleted file mode 100644
index 4e08c57c0b2e0b..00000000000000
--- a/x-pack/plugins/ml/public/url_generator.ts
+++ /dev/null
@@ -1,118 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { CoreSetup } from 'kibana/public';
-import {
-  SharePluginSetup,
-  UrlGeneratorsDefinition,
-  UrlGeneratorState,
-} from '../../../../src/plugins/share/public';
-import { TimeRange } from '../../../../src/plugins/data/public';
-import { setStateToKbnUrl } from '../../../../src/plugins/kibana_utils/public';
-import { JobId } from '../../reporting/common/types';
-import { ExplorerAppState } from './application/explorer/explorer_dashboard_service';
-import { MlStartDependencies } from './plugin';
-
-declare module '../../../../src/plugins/share/public' {
-  export interface UrlGeneratorStateMapping {
-    [ML_APP_URL_GENERATOR]: UrlGeneratorState<MlUrlGeneratorState>;
-  }
-}
-
-export const ML_APP_URL_GENERATOR = 'ML_APP_URL_GENERATOR';
-
-export interface ExplorerUrlState {
-  /**
-   * ML App Page
-   */
-  page: 'explorer';
-  /**
-   * Job IDs
-   */
-  jobIds: JobId[];
-  /**
-   * Optionally set the time range in the time picker.
-   */
-  timeRange?: TimeRange;
-  /**
-   * Optional state for the swim lane
-   */
-  mlExplorerSwimlane?: ExplorerAppState['mlExplorerSwimlane'];
-  mlExplorerFilter?: ExplorerAppState['mlExplorerFilter'];
-}
-
-/**
- * Union type of ML URL state based on page
- */
-export type MlUrlGeneratorState = ExplorerUrlState;
-
-export interface ExplorerQueryState {
-  ml: { jobIds: JobId[] };
-  time?: TimeRange;
-}
-
-interface Params {
-  appBasePath: string;
-  useHash: boolean;
-}
-
-export class MlUrlGenerator implements UrlGeneratorsDefinition<typeof ML_APP_URL_GENERATOR> {
-  constructor(private readonly params: Params) {}
-
-  public readonly id = ML_APP_URL_GENERATOR;
-
-  public readonly createUrl = async ({ page, ...params }: MlUrlGeneratorState): Promise<string> => {
-    if (page === 'explorer') {
-      return this.createExplorerUrl(params);
-    }
-    throw new Error('Page type is not provided or unknown');
-  };
-
-  /**
-   * Creates URL to the Anomaly Explorer page
-   */
-  private createExplorerUrl({
-    timeRange,
-    jobIds,
-    mlExplorerSwimlane = {},
-    mlExplorerFilter = {},
-  }: Omit<ExplorerUrlState, 'page'>): string {
-    const appState: ExplorerAppState = {
-      mlExplorerSwimlane,
-      mlExplorerFilter,
-    };
-
-    const queryState: ExplorerQueryState = {
-      ml: {
-        jobIds,
-      },
-    };
-
-    if (timeRange) queryState.time = timeRange;
-
-    let url = `${this.params.appBasePath}/explorer`;
-    url = setStateToKbnUrl<ExplorerQueryState>('_g', queryState, { useHash: false }, url);
-    url = setStateToKbnUrl('_a', appState, { useHash: false }, url);
-
-    return url;
-  }
-}
-
-/**
- * Registers the URL generator
- */
-export function registerUrlGenerator(
-  share: SharePluginSetup,
-  core: CoreSetup<MlStartDependencies>
-) {
-  const baseUrl = core.http.basePath.prepend('/app/ml');
-  share.urlGenerators.registerUrlGenerator(
-    new MlUrlGenerator({
-      appBasePath: baseUrl,
-      useHash: core.uiSettings.get('state:storeInSessionStorage'),
-    })
-  );
-}
diff --git a/x-pack/plugins/ml/server/client/elasticsearch_ml.test.ts b/x-pack/plugins/ml/server/client/elasticsearch_ml.test.ts
deleted file mode 100644
index 5ad0db3c58ce41..00000000000000
--- a/x-pack/plugins/ml/server/client/elasticsearch_ml.test.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { elasticsearchJsPlugin } from './elasticsearch_ml';
-
-interface Endpoint {
-  fmt: string;
-}
-
-interface ClientAction {
-  urls?: Endpoint[];
-  url: Endpoint;
-}
-
-describe('ML - Endpoints', () => {
-  // Check all paths in the ML elasticsearchJsPlugin start with a leading forward slash
-  // so they work if Kibana is run behind a reverse proxy
-  const PATH_START: string = '/';
-  const urls: string[] = [];
-
-  // Stub objects
-  const Client = {
-    prototype: {},
-  };
-
-  const components = {
-    clientAction: {
-      factory(obj: ClientAction) {
-        // add each endpoint URL to a list
-        if (obj.urls) {
-          obj.urls.forEach((url) => {
-            urls.push(url.fmt);
-          });
-        }
-        if (obj.url) {
-          urls.push(obj.url.fmt);
-        }
-      },
-      namespaceFactory() {
-        return {
-          prototype: {},
-        };
-      },
-    },
-  };
-
-  // Stub elasticsearchJsPlugin
-  elasticsearchJsPlugin(Client, null, components);
-
-  describe('paths', () => {
-    it(`should start with ${PATH_START}`, () => {
-      urls.forEach((url) => {
-        expect(url[0]).toEqual(PATH_START);
-      });
-    });
-  });
-});
diff --git a/x-pack/plugins/ml/server/client/elasticsearch_ml.ts b/x-pack/plugins/ml/server/client/elasticsearch_ml.ts
deleted file mode 100644
index 63153d18cb10b9..00000000000000
--- a/x-pack/plugins/ml/server/client/elasticsearch_ml.ts
+++ /dev/null
@@ -1,929 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export const elasticsearchJsPlugin = (Client: any, config: any, components: any) => {
-  const ca = components.clientAction.factory;
-
-  Client.prototype.ml = components.clientAction.namespaceFactory();
-  const ml = Client.prototype.ml.prototype;
-
-  /**
-   * Perform a [ml.authenticate](Retrieve details about the currently authenticated user) request
-   *
-   * @param {Object} params - An object with parameters used to carry out this action
-   */
-  ml.jobs = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>',
-        req: {
-          jobId: {
-            type: 'list',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/anomaly_detectors/',
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.jobStats = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/_stats',
-        req: {
-          jobId: {
-            type: 'list',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/anomaly_detectors/_stats',
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.addJob = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    needBody: true,
-    method: 'PUT',
-  });
-
-  ml.openJob = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/_open',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'POST',
-  });
-
-  ml.closeJob = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/_close?force=<%=force%>',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-          force: {
-            type: 'boolean',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/_close',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'POST',
-  });
-
-  // Currently the endpoint uses a default size of 100 unless a size is supplied.
-  // So until paging is supported in the UI, explicitly supply a size of 1000
-  // to match the max number of docs that the endpoint can return.
-  ml.getDataFrameAnalytics = ca({
-    urls: [
-      {
-        fmt: '/_ml/data_frame/analytics/<%=analyticsId%>',
-        req: {
-          analyticsId: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/data_frame/analytics/_all?size=1000',
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.getDataFrameAnalyticsStats = ca({
-    urls: [
-      {
-        fmt: '/_ml/data_frame/analytics/<%=analyticsId%>/_stats',
-        req: {
-          analyticsId: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        // Currently the endpoint uses a default size of 100 unless a size is supplied.
-        // So until paging is supported in the UI, explicitly supply a size of 1000
-        // to match the max number of docs that the endpoint can return.
-        fmt: '/_ml/data_frame/analytics/_all/_stats?size=1000',
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.createDataFrameAnalytics = ca({
-    urls: [
-      {
-        fmt: '/_ml/data_frame/analytics/<%=analyticsId%>',
-        req: {
-          analyticsId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    needBody: true,
-    method: 'PUT',
-  });
-
-  ml.evaluateDataFrameAnalytics = ca({
-    urls: [
-      {
-        fmt: '/_ml/data_frame/_evaluate',
-      },
-    ],
-    needBody: true,
-    method: 'POST',
-  });
-
-  ml.explainDataFrameAnalytics = ca({
-    urls: [
-      {
-        fmt: '/_ml/data_frame/analytics/_explain',
-      },
-    ],
-    needBody: true,
-    method: 'POST',
-  });
-
-  ml.deleteDataFrameAnalytics = ca({
-    urls: [
-      {
-        fmt: '/_ml/data_frame/analytics/<%=analyticsId%>',
-        req: {
-          analyticsId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'DELETE',
-  });
-
-  ml.startDataFrameAnalytics = ca({
-    urls: [
-      {
-        fmt: '/_ml/data_frame/analytics/<%=analyticsId%>/_start',
-        req: {
-          analyticsId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'POST',
-  });
-
-  ml.stopDataFrameAnalytics = ca({
-    urls: [
-      {
-        fmt: '/_ml/data_frame/analytics/<%=analyticsId%>/_stop?&force=<%=force%>',
-        req: {
-          analyticsId: {
-            type: 'string',
-          },
-          force: {
-            type: 'boolean',
-          },
-        },
-      },
-    ],
-    method: 'POST',
-  });
-
-  ml.updateDataFrameAnalytics = ca({
-    urls: [
-      {
-        fmt: '/_ml/data_frame/analytics/<%=analyticsId%>/_update',
-        req: {
-          analyticsId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    needBody: true,
-    method: 'POST',
-  });
-
-  ml.deleteJob = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>?&force=<%=force%>&wait_for_completion=false',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-          force: {
-            type: 'boolean',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>?&wait_for_completion=false',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'DELETE',
-  });
-
-  ml.updateJob = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/_update',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    needBody: true,
-    method: 'POST',
-  });
-
-  ml.datafeeds = ca({
-    urls: [
-      {
-        fmt: '/_ml/datafeeds/<%=datafeedId%>',
-        req: {
-          datafeedId: {
-            type: 'list',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/datafeeds/',
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.datafeedStats = ca({
-    urls: [
-      {
-        fmt: '/_ml/datafeeds/<%=datafeedId%>/_stats',
-        req: {
-          datafeedId: {
-            type: 'list',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/datafeeds/_stats',
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.addDatafeed = ca({
-    urls: [
-      {
-        fmt: '/_ml/datafeeds/<%=datafeedId%>',
-        req: {
-          datafeedId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    needBody: true,
-    method: 'PUT',
-  });
-
-  ml.updateDatafeed = ca({
-    urls: [
-      {
-        fmt: '/_ml/datafeeds/<%=datafeedId%>/_update',
-        req: {
-          datafeedId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    needBody: true,
-    method: 'POST',
-  });
-
-  ml.deleteDatafeed = ca({
-    urls: [
-      {
-        fmt: '/_ml/datafeeds/<%=datafeedId%>?force=<%=force%>',
-        req: {
-          datafeedId: {
-            type: 'string',
-          },
-          force: {
-            type: 'boolean',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/datafeeds/<%=datafeedId%>',
-        req: {
-          datafeedId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'DELETE',
-  });
-
-  ml.startDatafeed = ca({
-    urls: [
-      {
-        fmt: '/_ml/datafeeds/<%=datafeedId%>/_start?&start=<%=start%>&end=<%=end%>',
-        req: {
-          datafeedId: {
-            type: 'string',
-          },
-          start: {
-            type: 'string',
-          },
-          end: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/datafeeds/<%=datafeedId%>/_start?&start=<%=start%>',
-        req: {
-          datafeedId: {
-            type: 'string',
-          },
-          start: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/datafeeds/<%=datafeedId%>/_start',
-        req: {
-          datafeedId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'POST',
-  });
-
-  ml.stopDatafeed = ca({
-    urls: [
-      {
-        fmt: '/_ml/datafeeds/<%=datafeedId%>/_stop?force=<%=force%>',
-        req: {
-          datafeedId: {
-            type: 'string',
-          },
-          force: {
-            type: 'boolean',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/datafeeds/<%=datafeedId%>/_stop',
-        req: {
-          datafeedId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'POST',
-  });
-
-  ml.validateDetector = ca({
-    url: {
-      fmt: '/_ml/anomaly_detectors/_validate/detector',
-    },
-    needBody: true,
-    method: 'POST',
-  });
-
-  ml.estimateModelMemory = ca({
-    url: {
-      fmt: '/_ml/anomaly_detectors/_estimate_model_memory',
-    },
-    needBody: true,
-    method: 'POST',
-  });
-
-  ml.datafeedPreview = ca({
-    url: {
-      fmt: '/_ml/datafeeds/<%=datafeedId%>/_preview',
-      req: {
-        datafeedId: {
-          type: 'string',
-        },
-      },
-    },
-    method: 'GET',
-  });
-
-  ml.forecast = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/_forecast?&duration=<%=duration%>',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-          duration: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/_forecast',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'POST',
-  });
-
-  ml.records = ca({
-    url: {
-      fmt: '/_ml/anomaly_detectors/<%=jobId%>/results/records',
-      req: {
-        jobId: {
-          type: 'string',
-        },
-      },
-    },
-    method: 'POST',
-  });
-
-  ml.buckets = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/results/buckets',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/results/buckets/<%=timestamp%>',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-          timestamp: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'POST',
-  });
-
-  ml.overallBuckets = ca({
-    url: {
-      fmt: '/_ml/anomaly_detectors/<%=jobId%>/results/overall_buckets',
-      req: {
-        jobId: {
-          type: 'string',
-        },
-      },
-    },
-    method: 'POST',
-  });
-
-  ml.privilegeCheck = ca({
-    url: {
-      fmt: '/_security/user/_has_privileges',
-    },
-    needBody: true,
-    method: 'POST',
-  });
-  // Currently the endpoint uses a default size of 100 unless a size is supplied. So until paging is supported in the UI, explicitly supply a size of 1000
-  ml.calendars = ca({
-    urls: [
-      {
-        fmt: '/_ml/calendars/<%=calendarId%>',
-        req: {
-          calendarId: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/calendars?size=1000',
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.deleteCalendar = ca({
-    url: {
-      fmt: '/_ml/calendars/<%=calendarId%>',
-      req: {
-        calendarId: {
-          type: 'string',
-        },
-      },
-    },
-    method: 'DELETE',
-  });
-
-  ml.addCalendar = ca({
-    url: {
-      fmt: '/_ml/calendars/<%=calendarId%>',
-      req: {
-        calendarId: {
-          type: 'string',
-        },
-      },
-    },
-    needBody: true,
-    method: 'PUT',
-  });
-
-  ml.addJobToCalendar = ca({
-    url: {
-      fmt: '/_ml/calendars/<%=calendarId%>/jobs/<%=jobId%>',
-      req: {
-        calendarId: {
-          type: 'string',
-        },
-        jobId: {
-          type: 'string',
-        },
-      },
-    },
-    method: 'PUT',
-  });
-
-  ml.removeJobFromCalendar = ca({
-    url: {
-      fmt: '/_ml/calendars/<%=calendarId%>/jobs/<%=jobId%>',
-      req: {
-        calendarId: {
-          type: 'string',
-        },
-        jobId: {
-          type: 'string',
-        },
-      },
-    },
-    method: 'DELETE',
-  });
-
-  ml.events = ca({
-    urls: [
-      {
-        fmt: '/_ml/calendars/<%=calendarId%>/events',
-        req: {
-          calendarId: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/calendars/<%=calendarId%>/events?&job_id=<%=jobId%>',
-        req: {
-          calendarId: {
-            type: 'string',
-          },
-          jobId: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/calendars/<%=calendarId%>/events?&after=<%=start%>&before=<%=end%>',
-        req: {
-          calendarId: {
-            type: 'string',
-          },
-          start: {
-            type: 'string',
-          },
-          end: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt:
-          '/_ml/calendars/<%=calendarId%>/events?&after=<%=start%>&before=<%=end%>&job_id=<%=jobId%>',
-        req: {
-          calendarId: {
-            type: 'string',
-          },
-          start: {
-            type: 'string',
-          },
-          end: {
-            type: 'string',
-          },
-          jobId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.addEvent = ca({
-    url: {
-      fmt: '/_ml/calendars/<%=calendarId%>/events',
-      req: {
-        calendarId: {
-          type: 'string',
-        },
-      },
-    },
-    needBody: true,
-    method: 'POST',
-  });
-
-  ml.deleteEvent = ca({
-    url: {
-      fmt: '/_ml/calendars/<%=calendarId%>/events/<%=eventId%>',
-      req: {
-        calendarId: {
-          type: 'string',
-        },
-        eventId: {
-          type: 'string',
-        },
-      },
-    },
-    method: 'DELETE',
-  });
-  // Currently the endpoint uses a default size of 100 unless a size is supplied. So until paging is supported in the UI, explicitly supply a size of 1000
-  ml.filters = ca({
-    urls: [
-      {
-        fmt: '/_ml/filters/<%=filterId%>',
-        req: {
-          filterId: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/filters?size=1000',
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.addFilter = ca({
-    url: {
-      fmt: '/_ml/filters/<%=filterId%>',
-      req: {
-        filterId: {
-          type: 'string',
-        },
-      },
-    },
-    needBody: true,
-    method: 'PUT',
-  });
-
-  ml.updateFilter = ca({
-    urls: [
-      {
-        fmt: '/_ml/filters/<%=filterId%>/_update',
-        req: {
-          filterId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    needBody: true,
-    method: 'POST',
-  });
-
-  ml.deleteFilter = ca({
-    url: {
-      fmt: '/_ml/filters/<%=filterId%>',
-      req: {
-        filterId: {
-          type: 'string',
-        },
-      },
-    },
-    method: 'DELETE',
-  });
-
-  ml.info = ca({
-    url: {
-      fmt: '/_ml/info',
-    },
-    method: 'GET',
-  });
-
-  ml.fileStructure = ca({
-    urls: [
-      {
-        fmt:
-          '/_ml/find_file_structure?&explain=true&charset=<%=charset%>&format=<%=format%>&has_header_row=<%=has_header_row%>&column_names=<%=column_names%>&delimiter=<%=delimiter%>&quote=<%=quote%>&should_trim_fields=<%=should_trim_fields%>&grok_pattern=<%=grok_pattern%>&timestamp_field=<%=timestamp_field%>&timestamp_format=<%=timestamp_format%>&lines_to_sample=<%=lines_to_sample%>',
-        req: {
-          charset: {
-            type: 'string',
-          },
-          format: {
-            type: 'string',
-          },
-          has_header_row: {
-            type: 'string',
-          },
-          column_names: {
-            type: 'string',
-          },
-          delimiter: {
-            type: 'string',
-          },
-          quote: {
-            type: 'string',
-          },
-          should_trim_fields: {
-            type: 'string',
-          },
-          grok_pattern: {
-            type: 'string',
-          },
-          timestamp_field: {
-            type: 'string',
-          },
-          timestamp_format: {
-            type: 'string',
-          },
-          lines_to_sample: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/find_file_structure?&explain=true',
-      },
-    ],
-    needBody: true,
-    method: 'POST',
-  });
-
-  ml.rollupIndexCapabilities = ca({
-    urls: [
-      {
-        fmt: '/<%=indexPattern%>/_rollup/data',
-        req: {
-          indexPattern: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.categories = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/results/categories/<%=categoryId%>',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-          categoryId: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/results/categories',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.modelSnapshots = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/model_snapshots/<%=snapshotId%>',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-          snapshotId: {
-            type: 'string',
-          },
-        },
-      },
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/model_snapshots',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'GET',
-  });
-
-  ml.updateModelSnapshot = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/model_snapshots/<%=snapshotId%>/_update',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-          snapshotId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'POST',
-    needBody: true,
-  });
-
-  ml.deleteModelSnapshot = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/model_snapshots/<%=snapshotId%>',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-          snapshotId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'DELETE',
-  });
-
-  ml.revertModelSnapshot = ca({
-    urls: [
-      {
-        fmt: '/_ml/anomaly_detectors/<%=jobId%>/model_snapshots/<%=snapshotId%>/_revert',
-        req: {
-          jobId: {
-            type: 'string',
-          },
-          snapshotId: {
-            type: 'string',
-          },
-        },
-      },
-    ],
-    method: 'POST',
-  });
-};
diff --git a/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.test.ts b/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.test.ts
index 21d32813c0d511..4dd17f8cf48896 100644
--- a/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.test.ts
+++ b/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.test.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { getAdminCapabilities, getUserCapabilities } from './__mocks__/ml_capabilities';
 import { capabilitiesProvider } from './check_capabilities';
 import { MlLicense } from '../../../common/license';
@@ -24,16 +24,28 @@ const mlIsEnabled = async () => true;
 const mlIsNotEnabled = async () => false;
 
 const mlClusterClientNonUpgrade = ({
-  callAsInternalUser: async () => ({
-    upgrade_mode: false,
-  }),
-} as unknown) as ILegacyScopedClusterClient;
+  asInternalUser: {
+    ml: {
+      info: async () => ({
+        body: {
+          upgrade_mode: false,
+        },
+      }),
+    },
+  },
+} as unknown) as IScopedClusterClient;
 
 const mlClusterClientUpgrade = ({
-  callAsInternalUser: async () => ({
-    upgrade_mode: true,
-  }),
-} as unknown) as ILegacyScopedClusterClient;
+  asInternalUser: {
+    ml: {
+      info: async () => ({
+        body: {
+          upgrade_mode: true,
+        },
+      }),
+    },
+  },
+} as unknown) as IScopedClusterClient;
 
 describe('check_capabilities', () => {
   describe('getCapabilities() - right number of capabilities', () => {
diff --git a/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.ts b/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.ts
index c976ab598b28c6..c591ec07c7c3bd 100644
--- a/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.ts
+++ b/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient, KibanaRequest } from 'kibana/server';
+import { IScopedClusterClient, KibanaRequest } from 'kibana/server';
 import { mlLog } from '../../client/log';
 import {
   MlCapabilities,
@@ -22,12 +22,12 @@ import {
 } from './errors';
 
 export function capabilitiesProvider(
-  mlClusterClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   capabilities: MlCapabilities,
   mlLicense: MlLicense,
   isMlEnabledInSpace: () => Promise<boolean>
 ) {
-  const { isUpgradeInProgress } = upgradeCheckProvider(mlClusterClient);
+  const { isUpgradeInProgress } = upgradeCheckProvider(client);
   async function getCapabilities(): Promise<MlCapabilitiesResponse> {
     const upgradeInProgress = await isUpgradeInProgress();
     const isPlatinumOrTrialLicense = mlLicense.isFullLicense();
diff --git a/x-pack/plugins/ml/server/lib/capabilities/upgrade.ts b/x-pack/plugins/ml/server/lib/capabilities/upgrade.ts
index 6df4d0c87ecf54..defb70429fa0c7 100644
--- a/x-pack/plugins/ml/server/lib/capabilities/upgrade.ts
+++ b/x-pack/plugins/ml/server/lib/capabilities/upgrade.ts
@@ -4,17 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { mlLog } from '../../client/log';
 
-export function upgradeCheckProvider({ callAsInternalUser }: ILegacyScopedClusterClient) {
+export function upgradeCheckProvider({ asInternalUser }: IScopedClusterClient) {
   async function isUpgradeInProgress(): Promise<boolean> {
     let upgradeInProgress = false;
     try {
-      const info = await callAsInternalUser('ml.info');
+      const { body } = await asInternalUser.ml.info();
       // if ml indices are currently being migrated, upgrade_mode will be set to true
       // pass this back with the privileges to allow for the disabling of UI controls.
-      upgradeInProgress = info.upgrade_mode === true;
+      upgradeInProgress = body.upgrade_mode === true;
     } catch (error) {
       // if the ml.info check fails, it could be due to the user having insufficient privileges
       // most likely they do not have the ml_user role and therefore will be blocked from using
diff --git a/x-pack/plugins/ml/server/lib/check_annotations/index.ts b/x-pack/plugins/ml/server/lib/check_annotations/index.ts
index de19f0ead67910..964f9d0b922612 100644
--- a/x-pack/plugins/ml/server/lib/check_annotations/index.ts
+++ b/x-pack/plugins/ml/server/lib/check_annotations/index.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { mlLog } from '../../client/log';
 
 import {
@@ -17,18 +17,16 @@ import {
 // - ML_ANNOTATIONS_INDEX_PATTERN index is present
 // - ML_ANNOTATIONS_INDEX_ALIAS_READ alias is present
 // - ML_ANNOTATIONS_INDEX_ALIAS_WRITE alias is present
-export async function isAnnotationsFeatureAvailable({
-  callAsInternalUser,
-}: ILegacyScopedClusterClient) {
+export async function isAnnotationsFeatureAvailable({ asInternalUser }: IScopedClusterClient) {
   try {
     const indexParams = { index: ML_ANNOTATIONS_INDEX_PATTERN };
 
-    const annotationsIndexExists = await callAsInternalUser('indices.exists', indexParams);
+    const { body: annotationsIndexExists } = await asInternalUser.indices.exists(indexParams);
     if (!annotationsIndexExists) {
       return false;
     }
 
-    const annotationsReadAliasExists = await callAsInternalUser('indices.existsAlias', {
+    const { body: annotationsReadAliasExists } = await asInternalUser.indices.existsAlias({
       index: ML_ANNOTATIONS_INDEX_ALIAS_READ,
       name: ML_ANNOTATIONS_INDEX_ALIAS_READ,
     });
@@ -37,7 +35,7 @@ export async function isAnnotationsFeatureAvailable({
       return false;
     }
 
-    const annotationsWriteAliasExists = await callAsInternalUser('indices.existsAlias', {
+    const { body: annotationsWriteAliasExists } = await asInternalUser.indices.existsAlias({
       index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
       name: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
     });
diff --git a/x-pack/plugins/ml/server/lib/license/ml_server_license.ts b/x-pack/plugins/ml/server/lib/license/ml_server_license.ts
index bd0a29721248a1..6e3019b303b887 100644
--- a/x-pack/plugins/ml/server/lib/license/ml_server_license.ts
+++ b/x-pack/plugins/ml/server/lib/license/ml_server_license.ts
@@ -7,7 +7,6 @@ import {
   KibanaRequest,
   KibanaResponseFactory,
   RequestHandlerContext,
-  ILegacyScopedClusterClient,
   IScopedClusterClient,
   RequestHandler,
 } from 'kibana/server';
@@ -15,7 +14,6 @@ import {
 import { MlLicense } from '../../../common/license';
 
 type Handler = (handlerParams: {
-  legacyClient: ILegacyScopedClusterClient;
   client: IScopedClusterClient;
   request: KibanaRequest<any, any, any, any>;
   response: KibanaResponseFactory;
@@ -42,7 +40,6 @@ function guard(check: () => boolean, handler: Handler) {
     }
 
     return handler({
-      legacyClient: context.ml!.mlClient,
       client: context.core.elasticsearch.client,
       request,
       response,
diff --git a/x-pack/plugins/ml/server/lib/register_settings.ts b/x-pack/plugins/ml/server/lib/register_settings.ts
index 38b1f5e3fc0834..a9ee24fbb5cea9 100644
--- a/x-pack/plugins/ml/server/lib/register_settings.ts
+++ b/x-pack/plugins/ml/server/lib/register_settings.ts
@@ -7,7 +7,13 @@
 import { CoreSetup } from 'kibana/server';
 import { i18n } from '@kbn/i18n';
 import { schema } from '@kbn/config-schema';
-import { FILE_DATA_VISUALIZER_MAX_FILE_SIZE } from '../../common/constants/settings';
+import {
+  FILE_DATA_VISUALIZER_MAX_FILE_SIZE,
+  ANOMALY_DETECTION_DEFAULT_TIME_RANGE,
+  ANOMALY_DETECTION_ENABLE_TIME_RANGE,
+  DEFAULT_AD_RESULTS_TIME_FILTER,
+  DEFAULT_ENABLE_AD_RESULTS_TIME_FILTER,
+} from '../../common/constants/settings';
 import { MAX_FILE_SIZE } from '../../common/constants/file_datavisualizer';
 
 export function registerKibanaSettings(coreSetup: CoreSetup) {
@@ -30,5 +36,40 @@ export function registerKibanaSettings(coreSetup: CoreSetup) {
         }),
       },
     },
+    [ANOMALY_DETECTION_ENABLE_TIME_RANGE]: {
+      name: i18n.translate('xpack.ml.advancedSettings.enableAnomalyDetectionDefaultTimeRangeName', {
+        defaultMessage: 'Enable time filter defaults for anomaly detection results',
+      }),
+      value: DEFAULT_ENABLE_AD_RESULTS_TIME_FILTER,
+      schema: schema.boolean(),
+      description: i18n.translate(
+        'xpack.ml.advancedSettings.enableAnomalyDetectionDefaultTimeRangeDesc',
+        {
+          defaultMessage:
+            'Use the default time filter in the Single Metric Viewer and Anomaly Explorer. If not enabled, the results for the full time range of the job are displayed.',
+        }
+      ),
+      category: ['Machine Learning'],
+    },
+    [ANOMALY_DETECTION_DEFAULT_TIME_RANGE]: {
+      name: i18n.translate('xpack.ml.advancedSettings.anomalyDetectionDefaultTimeRangeName', {
+        defaultMessage: 'Time filter defaults for anomaly detection results',
+      }),
+      type: 'json',
+      value: JSON.stringify(DEFAULT_AD_RESULTS_TIME_FILTER, null, 2),
+      description: i18n.translate(
+        'xpack.ml.advancedSettings.anomalyDetectionDefaultTimeRangeDesc',
+        {
+          defaultMessage:
+            'The time filter selection to use when viewing anomaly detection job results.',
+        }
+      ),
+      schema: schema.object({
+        from: schema.string(),
+        to: schema.string(),
+      }),
+      requiresPageReload: true,
+      category: ['Machine Learning'],
+    },
   });
 }
diff --git a/x-pack/plugins/ml/server/lib/sample_data_sets/sample_data_sets.ts b/x-pack/plugins/ml/server/lib/sample_data_sets/sample_data_sets.ts
index 902cc907a0eff1..28f12ead7924ba 100644
--- a/x-pack/plugins/ml/server/lib/sample_data_sets/sample_data_sets.ts
+++ b/x-pack/plugins/ml/server/lib/sample_data_sets/sample_data_sets.ts
@@ -18,7 +18,7 @@ export function initSampleDataSets(mlLicense: MlLicense, plugins: PluginsSetup)
     addAppLinksToSampleDataset('ecommerce', [
       {
         path:
-          '/app/ml#/modules/check_view_or_create?id=sample_data_ecommerce&index=ff959d40-b880-11e8-a6d9-e546fe2bba5f',
+          '/app/ml/modules/check_view_or_create?id=sample_data_ecommerce&index=ff959d40-b880-11e8-a6d9-e546fe2bba5f',
         label: sampleDataLinkLabel,
         icon: 'machineLearningApp',
       },
@@ -27,7 +27,7 @@ export function initSampleDataSets(mlLicense: MlLicense, plugins: PluginsSetup)
     addAppLinksToSampleDataset('logs', [
       {
         path:
-          '/app/ml#/modules/check_view_or_create?id=sample_data_weblogs&index=90943e30-9a47-11e8-b64d-95841ca0b247',
+          '/app/ml/modules/check_view_or_create?id=sample_data_weblogs&index=90943e30-9a47-11e8-b64d-95841ca0b247',
         label: sampleDataLinkLabel,
         icon: 'machineLearningApp',
       },
diff --git a/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts b/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
index 5be443266ffe1c..4c511b567615de 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
@@ -22,19 +22,15 @@ describe('annotation_service', () => {
   let mlClusterClientSpy = {} as any;
 
   beforeEach(() => {
-    const callAs = jest.fn((action: string) => {
-      switch (action) {
-        case 'delete':
-        case 'index':
-          return Promise.resolve(acknowledgedResponseMock);
-        case 'search':
-          return Promise.resolve(getAnnotationsResponseMock);
-      }
-    });
+    const callAs = {
+      delete: jest.fn(() => Promise.resolve({ body: acknowledgedResponseMock })),
+      index: jest.fn(() => Promise.resolve({ body: acknowledgedResponseMock })),
+      search: jest.fn(() => Promise.resolve({ body: getAnnotationsResponseMock })),
+    };
 
     mlClusterClientSpy = {
-      callAsCurrentUser: callAs,
-      callAsInternalUser: callAs,
+      asCurrentUser: callAs,
+      asInternalUser: callAs,
     };
   });
 
@@ -52,8 +48,7 @@ describe('annotation_service', () => {
 
       const response = await deleteAnnotation(annotationMockId);
 
-      expect(mockFunct.callAsInternalUser.mock.calls[0][0]).toBe('delete');
-      expect(mockFunct.callAsInternalUser.mock.calls[0][1]).toEqual(deleteParamsMock);
+      expect(mockFunct.asInternalUser.delete.mock.calls[0][0]).toStrictEqual(deleteParamsMock);
       expect(response).toBe(acknowledgedResponseMock);
       done();
     });
@@ -73,8 +68,9 @@ describe('annotation_service', () => {
 
       const response: GetResponse = await getAnnotations(indexAnnotationArgsMock);
 
-      expect(mockFunct.callAsInternalUser.mock.calls[0][0]).toBe('search');
-      expect(mockFunct.callAsInternalUser.mock.calls[0][1]).toEqual(getAnnotationsRequestMock);
+      expect(mockFunct.asInternalUser.search.mock.calls[0][0]).toStrictEqual(
+        getAnnotationsRequestMock
+      );
       expect(Object.keys(response.annotations)).toHaveLength(1);
       expect(response.annotations[jobIdMock]).toHaveLength(2);
       expect(isAnnotations(response.annotations[jobIdMock])).toBeTruthy();
@@ -89,9 +85,9 @@ describe('annotation_service', () => {
       };
 
       const mlClusterClientSpyError: any = {
-        callAsInternalUser: jest.fn(() => {
-          return Promise.resolve(mockEsError);
-        }),
+        asInternalUser: {
+          search: jest.fn(() => Promise.resolve({ body: mockEsError })),
+        },
       };
 
       const { getAnnotations } = annotationServiceProvider(mlClusterClientSpyError);
@@ -124,10 +120,8 @@ describe('annotation_service', () => {
 
       const response = await indexAnnotation(annotationMock, usernameMock);
 
-      expect(mockFunct.callAsInternalUser.mock.calls[0][0]).toBe('index');
-
       // test if the annotation has been correctly augmented
-      const indexParamsCheck = mockFunct.callAsInternalUser.mock.calls[0][1];
+      const indexParamsCheck = mockFunct.asInternalUser.index.mock.calls[0][0];
       const annotation = indexParamsCheck.body;
       expect(annotation.create_username).toBe(usernameMock);
       expect(annotation.modified_username).toBe(usernameMock);
@@ -154,10 +148,8 @@ describe('annotation_service', () => {
 
       const response = await indexAnnotation(annotationMock, usernameMock);
 
-      expect(mockFunct.callAsInternalUser.mock.calls[0][0]).toBe('index');
-
       // test if the annotation has been correctly augmented
-      const indexParamsCheck = mockFunct.callAsInternalUser.mock.calls[0][1];
+      const indexParamsCheck = mockFunct.asInternalUser.index.mock.calls[0][0];
       const annotation = indexParamsCheck.body;
       expect(annotation.create_username).toBe(usernameMock);
       expect(annotation.modified_username).toBe(usernameMock);
@@ -196,9 +188,8 @@ describe('annotation_service', () => {
 
       await indexAnnotation(annotation, modifiedUsernameMock);
 
-      expect(mockFunct.callAsInternalUser.mock.calls[1][0]).toBe('index');
       // test if the annotation has been correctly updated
-      const indexParamsCheck = mockFunct.callAsInternalUser.mock.calls[1][1];
+      const indexParamsCheck = mockFunct.asInternalUser.index.mock.calls[0][0];
       const modifiedAnnotation = indexParamsCheck.body;
       expect(modifiedAnnotation.annotation).toBe(modifiedAnnotationText);
       expect(modifiedAnnotation.create_username).toBe(originalUsernameMock);
diff --git a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
index a585449db0a255..24f1d6951c9400 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
@@ -7,7 +7,7 @@
 import Boom from 'boom';
 import each from 'lodash/each';
 import get from 'lodash/get';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 
 import { ANNOTATION_EVENT_USER, ANNOTATION_TYPE } from '../../../common/constants/annotations';
 import { PARTITION_FIELDS } from '../../../common/constants/anomalies';
@@ -67,17 +67,17 @@ export interface GetResponse {
 export interface IndexParams {
   index: string;
   body: Annotation;
-  refresh?: string;
+  refresh: boolean | 'wait_for' | undefined;
   id?: string;
 }
 
 export interface DeleteParams {
   index: string;
-  refresh?: string;
+  refresh: boolean | 'wait_for' | undefined;
   id: string;
 }
 
-export function annotationProvider({ callAsInternalUser }: ILegacyScopedClusterClient) {
+export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
   async function indexAnnotation(annotation: Annotation, username: string) {
     if (isAnnotation(annotation) === false) {
       // No need to translate, this will not be exposed in the UI.
@@ -104,7 +104,8 @@ export function annotationProvider({ callAsInternalUser }: ILegacyScopedClusterC
       delete params.body.key;
     }
 
-    return await callAsInternalUser('index', params);
+    const { body } = await asInternalUser.index(params);
+    return body;
   }
 
   async function getAnnotations({
@@ -287,14 +288,14 @@ export function annotationProvider({ callAsInternalUser }: ILegacyScopedClusterC
     };
 
     try {
-      const resp = await callAsInternalUser('search', params);
+      const { body } = await asInternalUser.search(params);
 
-      if (resp.error !== undefined && resp.message !== undefined) {
+      if (body.error !== undefined && body.message !== undefined) {
         // No need to translate, this will not be exposed in the UI.
         throw new Error(`Annotations couldn't be retrieved from Elasticsearch.`);
       }
 
-      const docs: Annotations = get(resp, ['hits', 'hits'], []).map((d: EsResult) => {
+      const docs: Annotations = get(body, ['hits', 'hits'], []).map((d: EsResult) => {
         // get the original source document and the document id, we need it
         // to identify the annotation when editing/deleting it.
         // if original `event` is undefined then substitute with 'user` by default
@@ -306,7 +307,7 @@ export function annotationProvider({ callAsInternalUser }: ILegacyScopedClusterC
         } as Annotation;
       });
 
-      const aggregations = get(resp, ['aggregations'], {}) as EsAggregationResult;
+      const aggregations = get(body, ['aggregations'], {}) as EsAggregationResult;
       if (fields) {
         obj.aggregations = aggregations;
       }
@@ -330,13 +331,14 @@ export function annotationProvider({ callAsInternalUser }: ILegacyScopedClusterC
   }
 
   async function deleteAnnotation(id: string) {
-    const param: DeleteParams = {
+    const params: DeleteParams = {
       index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
       id,
       refresh: 'wait_for',
     };
 
-    return await callAsInternalUser('delete', param);
+    const { body } = await asInternalUser.delete(params);
+    return body;
   }
 
   return {
diff --git a/x-pack/plugins/ml/server/models/annotation_service/index.ts b/x-pack/plugins/ml/server/models/annotation_service/index.ts
index e17af2a154b876..9fcb84e2938ae3 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/index.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/index.ts
@@ -4,11 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { annotationProvider } from './annotation';
 
-export function annotationServiceProvider(mlClusterClient: ILegacyScopedClusterClient) {
+export function annotationServiceProvider(client: IScopedClusterClient) {
   return {
-    ...annotationProvider(mlClusterClient),
+    ...annotationProvider(client),
   };
 }
diff --git a/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.d.ts b/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.d.ts
index eeabb24d9be3b7..5b52414d6753a2 100644
--- a/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.d.ts
+++ b/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.d.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { ES_AGGREGATION } from '../../../common/constants/aggregation_types';
 
 export interface BucketSpanEstimatorData {
@@ -21,6 +21,6 @@ export interface BucketSpanEstimatorData {
 }
 
 export function estimateBucketSpanFactory({
-  callAsCurrentUser,
-  callAsInternalUser,
-}: ILegacyScopedClusterClient): (config: BucketSpanEstimatorData) => Promise<any>;
+  asCurrentUser,
+  asInternalUser,
+}: IScopedClusterClient): (config: BucketSpanEstimatorData) => Promise<any>;
diff --git a/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.js b/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.js
index 381c615051e3b3..1d59db8fa564f4 100644
--- a/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.js
+++ b/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.js
@@ -16,10 +16,10 @@ import { INTERVALS } from './intervals';
 import { singleSeriesCheckerFactory } from './single_series_checker';
 import { polledDataCheckerFactory } from './polled_data_checker';
 
-export function estimateBucketSpanFactory(mlClusterClient) {
-  const { callAsCurrentUser, callAsInternalUser } = mlClusterClient;
-  const PolledDataChecker = polledDataCheckerFactory(mlClusterClient);
-  const SingleSeriesChecker = singleSeriesCheckerFactory(mlClusterClient);
+export function estimateBucketSpanFactory(client) {
+  const { asCurrentUser, asInternalUser } = client;
+  const PolledDataChecker = polledDataCheckerFactory(client);
+  const SingleSeriesChecker = singleSeriesCheckerFactory(client);
 
   class BucketSpanEstimator {
     constructor(
@@ -246,21 +246,22 @@ export function estimateBucketSpanFactory(mlClusterClient) {
 
   const getFieldCardinality = function (index, field) {
     return new Promise((resolve, reject) => {
-      callAsCurrentUser('search', {
-        index,
-        size: 0,
-        body: {
-          aggs: {
-            field_count: {
-              cardinality: {
-                field,
+      asCurrentUser
+        .search({
+          index,
+          size: 0,
+          body: {
+            aggs: {
+              field_count: {
+                cardinality: {
+                  field,
+                },
               },
             },
           },
-        },
-      })
-        .then((resp) => {
-          const value = get(resp, ['aggregations', 'field_count', 'value'], 0);
+        })
+        .then(({ body }) => {
+          const value = get(body, ['aggregations', 'field_count', 'value'], 0);
           resolve(value);
         })
         .catch((resp) => {
@@ -278,28 +279,29 @@ export function estimateBucketSpanFactory(mlClusterClient) {
       getFieldCardinality(index, field)
         .then((value) => {
           const numPartitions = Math.floor(value / NUM_PARTITIONS) || 1;
-          callAsCurrentUser('search', {
-            index,
-            size: 0,
-            body: {
-              query,
-              aggs: {
-                fields_bucket_counts: {
-                  terms: {
-                    field,
-                    include: {
-                      partition: 0,
-                      num_partitions: numPartitions,
+          asCurrentUser
+            .search({
+              index,
+              size: 0,
+              body: {
+                query,
+                aggs: {
+                  fields_bucket_counts: {
+                    terms: {
+                      field,
+                      include: {
+                        partition: 0,
+                        num_partitions: numPartitions,
+                      },
                     },
                   },
                 },
               },
-            },
-          })
-            .then((partitionResp) => {
+            })
+            .then(({ body }) => {
               // eslint-disable-next-line camelcase
-              if (partitionResp.aggregations?.fields_bucket_counts?.buckets !== undefined) {
-                const buckets = partitionResp.aggregations.fields_bucket_counts.buckets;
+              if (body.aggregations?.fields_bucket_counts?.buckets !== undefined) {
+                const buckets = body.aggregations.fields_bucket_counts.buckets;
                 fieldValues = buckets.map((b) => b.key);
               }
               resolve(fieldValues);
@@ -338,21 +340,21 @@ export function estimateBucketSpanFactory(mlClusterClient) {
     return new Promise((resolve, reject) => {
       // fetch the `search.max_buckets` cluster setting so we're able to
       // adjust aggregations to not exceed that limit.
-      callAsInternalUser('cluster.getSettings', {
-        flatSettings: true,
-        includeDefaults: true,
-        filterPath: '*.*max_buckets',
-      })
-        .then((settings) => {
-          if (typeof settings !== 'object') {
+      asInternalUser.cluster
+        .getSettings({
+          flat_settings: true,
+          include_defaults: true,
+          filter_path: '*.*max_buckets',
+        })
+        .then(({ body }) => {
+          if (typeof body !== 'object') {
             reject('Unable to retrieve cluster settings');
           }
 
           // search.max_buckets could exist in default, persistent or transient cluster settings
-          const maxBucketsSetting = (settings.defaults ||
-            settings.persistent ||
-            settings.transient ||
-            {})['search.max_buckets'];
+          const maxBucketsSetting = (body.defaults || body.persistent || body.transient || {})[
+            'search.max_buckets'
+          ];
 
           if (maxBucketsSetting === undefined) {
             reject('Unable to retrieve cluster setting search.max_buckets');
diff --git a/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.test.ts b/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.test.ts
index f7c7dd8172ea5a..35c4f1a0a741b4 100644
--- a/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.test.ts
+++ b/x-pack/plugins/ml/server/models/bucket_span_estimator/bucket_span_estimator.test.ts
@@ -4,22 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 
 import { ES_AGGREGATION } from '../../../common/constants/aggregation_types';
 
 import { estimateBucketSpanFactory, BucketSpanEstimatorData } from './bucket_span_estimator';
 
-const callAs = () => {
-  return new Promise((resolve) => {
-    resolve({});
-  }) as Promise<any>;
+const callAs = {
+  search: () => Promise.resolve({ body: {} }),
+  cluster: { getSettings: () => Promise.resolve({ body: {} }) },
 };
 
-const mlClusterClient: ILegacyScopedClusterClient = {
-  callAsCurrentUser: callAs,
-  callAsInternalUser: callAs,
-};
+const mlClusterClient = ({
+  asCurrentUser: callAs,
+  asInternalUser: callAs,
+} as unknown) as IScopedClusterClient;
 
 // mock configuration to be passed to the estimator
 const formConfig: BucketSpanEstimatorData = {
diff --git a/x-pack/plugins/ml/server/models/bucket_span_estimator/polled_data_checker.js b/x-pack/plugins/ml/server/models/bucket_span_estimator/polled_data_checker.js
index d3bbd59f3cf9bc..fd0cab7c0625d7 100644
--- a/x-pack/plugins/ml/server/models/bucket_span_estimator/polled_data_checker.js
+++ b/x-pack/plugins/ml/server/models/bucket_span_estimator/polled_data_checker.js
@@ -12,7 +12,7 @@
 
 import get from 'lodash/get';
 
-export function polledDataCheckerFactory({ callAsCurrentUser }) {
+export function polledDataCheckerFactory({ asCurrentUser }) {
   class PolledDataChecker {
     constructor(index, timeField, duration, query) {
       this.index = index;
@@ -65,14 +65,15 @@ export function polledDataCheckerFactory({ callAsCurrentUser }) {
       return search;
     }
 
-    performSearch(intervalMs) {
-      const body = this.createSearch(intervalMs);
+    async performSearch(intervalMs) {
+      const searchBody = this.createSearch(intervalMs);
 
-      return callAsCurrentUser('search', {
+      const { body } = await asCurrentUser.search({
         index: this.index,
         size: 0,
-        body,
+        body: searchBody,
       });
+      return body;
     }
 
     // test that the coefficient of variation of time difference between non-empty buckets is small
diff --git a/x-pack/plugins/ml/server/models/bucket_span_estimator/single_series_checker.js b/x-pack/plugins/ml/server/models/bucket_span_estimator/single_series_checker.js
index a5449395501dcb..750f0cfc0b4a87 100644
--- a/x-pack/plugins/ml/server/models/bucket_span_estimator/single_series_checker.js
+++ b/x-pack/plugins/ml/server/models/bucket_span_estimator/single_series_checker.js
@@ -13,7 +13,7 @@
 import { mlLog } from '../../client/log';
 import { INTERVALS, LONG_INTERVALS } from './intervals';
 
-export function singleSeriesCheckerFactory({ callAsCurrentUser }) {
+export function singleSeriesCheckerFactory({ asCurrentUser }) {
   const REF_DATA_INTERVAL = { name: '1h', ms: 3600000 };
 
   class SingleSeriesChecker {
@@ -184,14 +184,15 @@ export function singleSeriesCheckerFactory({ callAsCurrentUser }) {
       return search;
     }
 
-    performSearch(intervalMs) {
-      const body = this.createSearch(intervalMs);
+    async performSearch(intervalMs) {
+      const searchBody = this.createSearch(intervalMs);
 
-      return callAsCurrentUser('search', {
+      const { body } = await asCurrentUser.search({
         index: this.index,
         size: 0,
-        body,
+        body: searchBody,
       });
+      return body;
     }
 
     getFullBuckets(buckets) {
diff --git a/x-pack/plugins/ml/server/models/calculate_model_memory_limit/calculate_model_memory_limit.ts b/x-pack/plugins/ml/server/models/calculate_model_memory_limit/calculate_model_memory_limit.ts
index bc3c326e7d0705..2a2c30601e2ca7 100644
--- a/x-pack/plugins/ml/server/models/calculate_model_memory_limit/calculate_model_memory_limit.ts
+++ b/x-pack/plugins/ml/server/models/calculate_model_memory_limit/calculate_model_memory_limit.ts
@@ -5,13 +5,13 @@
  */
 
 import numeral from '@elastic/numeral';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { MLCATEGORY } from '../../../common/constants/field_types';
 import { AnalysisConfig } from '../../../common/types/anomaly_detection_jobs';
 import { fieldsServiceProvider } from '../fields_service';
 import { MlInfoResponse } from '../../../common/types/ml_server_info';
 
-interface ModelMemoryEstimationResult {
+export interface ModelMemoryEstimationResult {
   /**
    * Result model memory limit
    */
@@ -29,15 +29,15 @@ interface ModelMemoryEstimationResult {
 /**
  * Response of the _estimate_model_memory endpoint.
  */
-export interface ModelMemoryEstimate {
+export interface ModelMemoryEstimateResponse {
   model_memory_estimate: string;
 }
 
 /**
  * Retrieves overall and max bucket cardinalities.
  */
-const cardinalityCheckProvider = (mlClusterClient: ILegacyScopedClusterClient) => {
-  const fieldsService = fieldsServiceProvider(mlClusterClient);
+const cardinalityCheckProvider = (client: IScopedClusterClient) => {
+  const fieldsService = fieldsServiceProvider(client);
 
   return async (
     analysisConfig: AnalysisConfig,
@@ -123,9 +123,9 @@ const cardinalityCheckProvider = (mlClusterClient: ILegacyScopedClusterClient) =
   };
 };
 
-export function calculateModelMemoryLimitProvider(mlClusterClient: ILegacyScopedClusterClient) {
-  const { callAsInternalUser } = mlClusterClient;
-  const getCardinalities = cardinalityCheckProvider(mlClusterClient);
+export function calculateModelMemoryLimitProvider(client: IScopedClusterClient) {
+  const { asInternalUser } = client;
+  const getCardinalities = cardinalityCheckProvider(client);
 
   /**
    * Retrieves an estimated size of the model memory limit used in the job config
@@ -141,7 +141,7 @@ export function calculateModelMemoryLimitProvider(mlClusterClient: ILegacyScoped
     latestMs: number,
     allowMMLGreaterThanMax = false
   ): Promise<ModelMemoryEstimationResult> {
-    const info = (await callAsInternalUser('ml.info')) as MlInfoResponse;
+    const { body: info } = await asInternalUser.ml.info<MlInfoResponse>();
     const maxModelMemoryLimit = info.limits.max_model_memory_limit?.toUpperCase();
     const effectiveMaxModelMemoryLimit = info.limits.effective_max_model_memory_limit?.toUpperCase();
 
@@ -154,13 +154,14 @@ export function calculateModelMemoryLimitProvider(mlClusterClient: ILegacyScoped
       latestMs
     );
 
-    const estimatedModelMemoryLimit = ((await callAsInternalUser('ml.estimateModelMemory', {
+    const { body } = await asInternalUser.ml.estimateModelMemory<ModelMemoryEstimateResponse>({
       body: {
         analysis_config: analysisConfig,
         overall_cardinality: overallCardinality,
         max_bucket_cardinality: maxBucketCardinality,
       },
-    })) as ModelMemoryEstimate).model_memory_estimate.toUpperCase();
+    });
+    const estimatedModelMemoryLimit = body.model_memory_estimate.toUpperCase();
 
     let modelMemoryLimit = estimatedModelMemoryLimit;
     let mmlCappedAtMax = false;
diff --git a/x-pack/plugins/ml/server/models/calendar/calendar_manager.ts b/x-pack/plugins/ml/server/models/calendar/calendar_manager.ts
index b461e71c006ff0..95684e790636ff 100644
--- a/x-pack/plugins/ml/server/models/calendar/calendar_manager.ts
+++ b/x-pack/plugins/ml/server/models/calendar/calendar_manager.ts
@@ -5,7 +5,7 @@
  */
 
 import { difference } from 'lodash';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { EventManager, CalendarEvent } from './event_manager';
 
 interface BasicCalendar {
@@ -23,30 +23,30 @@ export interface FormCalendar extends BasicCalendar {
 }
 
 export class CalendarManager {
-  private _callAsInternalUser: ILegacyScopedClusterClient['callAsInternalUser'];
+  private _asInternalUser: IScopedClusterClient['asInternalUser'];
   private _eventManager: EventManager;
 
-  constructor(mlClusterClient: ILegacyScopedClusterClient) {
-    this._callAsInternalUser = mlClusterClient.callAsInternalUser;
-    this._eventManager = new EventManager(mlClusterClient);
+  constructor(client: IScopedClusterClient) {
+    this._asInternalUser = client.asInternalUser;
+    this._eventManager = new EventManager(client);
   }
 
   async getCalendar(calendarId: string) {
-    const resp = await this._callAsInternalUser('ml.calendars', {
-      calendarId,
+    const { body } = await this._asInternalUser.ml.getCalendars({
+      calendar_id: calendarId,
     });
 
-    const calendars = resp.calendars;
+    const calendars = body.calendars;
     const calendar = calendars[0]; // Endpoint throws a 404 if calendar is not found.
     calendar.events = await this._eventManager.getCalendarEvents(calendarId);
     return calendar;
   }
 
   async getAllCalendars() {
-    const calendarsResp = await this._callAsInternalUser('ml.calendars');
+    const { body } = await this._asInternalUser.ml.getCalendars({ size: 1000 });
 
     const events: CalendarEvent[] = await this._eventManager.getAllEvents();
-    const calendars: Calendar[] = calendarsResp.calendars;
+    const calendars: Calendar[] = body.calendars;
     calendars.forEach((cal) => (cal.events = []));
 
     // loop events and combine with related calendars
@@ -71,8 +71,8 @@ export class CalendarManager {
 
   async newCalendar(calendar: FormCalendar) {
     const { calendarId, events, ...newCalendar } = calendar;
-    await this._callAsInternalUser('ml.addCalendar', {
-      calendarId,
+    await this._asInternalUser.ml.putCalendar({
+      calendar_id: calendarId,
       body: newCalendar,
     });
 
@@ -106,17 +106,17 @@ export class CalendarManager {
 
     // add all new jobs
     if (jobsToAdd.length) {
-      await this._callAsInternalUser('ml.addJobToCalendar', {
-        calendarId,
-        jobId: jobsToAdd.join(','),
+      await this._asInternalUser.ml.putCalendarJob({
+        calendar_id: calendarId,
+        job_id: jobsToAdd.join(','),
       });
     }
 
     // remove all removed jobs
     if (jobsToRemove.length) {
-      await this._callAsInternalUser('ml.removeJobFromCalendar', {
-        calendarId,
-        jobId: jobsToRemove.join(','),
+      await this._asInternalUser.ml.deleteCalendarJob({
+        calendar_id: calendarId,
+        job_id: jobsToRemove.join(','),
       });
     }
 
@@ -137,6 +137,7 @@ export class CalendarManager {
   }
 
   async deleteCalendar(calendarId: string) {
-    return this._callAsInternalUser('ml.deleteCalendar', { calendarId });
+    const { body } = await this._asInternalUser.ml.deleteCalendar({ calendar_id: calendarId });
+    return body;
   }
 }
diff --git a/x-pack/plugins/ml/server/models/calendar/event_manager.ts b/x-pack/plugins/ml/server/models/calendar/event_manager.ts
index b670bbe187544c..b42068e748394d 100644
--- a/x-pack/plugins/ml/server/models/calendar/event_manager.ts
+++ b/x-pack/plugins/ml/server/models/calendar/event_manager.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { GLOBAL_CALENDAR } from '../../../common/constants/calendars';
 
 export interface CalendarEvent {
@@ -16,39 +16,42 @@ export interface CalendarEvent {
 }
 
 export class EventManager {
-  private _callAsInternalUser: ILegacyScopedClusterClient['callAsInternalUser'];
-  constructor({ callAsInternalUser }: ILegacyScopedClusterClient) {
-    this._callAsInternalUser = callAsInternalUser;
+  private _asInternalUser: IScopedClusterClient['asInternalUser'];
+  constructor({ asInternalUser }: IScopedClusterClient) {
+    this._asInternalUser = asInternalUser;
   }
 
   async getCalendarEvents(calendarId: string) {
-    const resp = await this._callAsInternalUser('ml.events', { calendarId });
+    const { body } = await this._asInternalUser.ml.getCalendarEvents({ calendar_id: calendarId });
 
-    return resp.events;
+    return body.events;
   }
 
   // jobId is optional
   async getAllEvents(jobId?: string) {
     const calendarId = GLOBAL_CALENDAR;
-    const resp = await this._callAsInternalUser('ml.events', {
-      calendarId,
-      jobId,
+    const { body } = await this._asInternalUser.ml.getCalendarEvents({
+      calendar_id: calendarId,
+      job_id: jobId,
     });
 
-    return resp.events;
+    return body.events;
   }
 
   async addEvents(calendarId: string, events: CalendarEvent[]) {
     const body = { events };
 
-    return await this._callAsInternalUser('ml.addEvent', {
-      calendarId,
+    return await this._asInternalUser.ml.postCalendarEvents({
+      calendar_id: calendarId,
       body,
     });
   }
 
   async deleteEvent(calendarId: string, eventId: string) {
-    return this._callAsInternalUser('ml.deleteEvent', { calendarId, eventId });
+    return this._asInternalUser.ml.deleteCalendarEvent({
+      calendar_id: calendarId,
+      event_id: eventId,
+    });
   }
 
   isEqual(ev1: CalendarEvent, ev2: CalendarEvent) {
diff --git a/x-pack/plugins/ml/server/models/data_frame_analytics/analytics_audit_messages.ts b/x-pack/plugins/ml/server/models/data_frame_analytics/analytics_audit_messages.ts
index 1cb0656e88a0bb..0f4cac37d2e8f8 100644
--- a/x-pack/plugins/ml/server/models/data_frame_analytics/analytics_audit_messages.ts
+++ b/x-pack/plugins/ml/server/models/data_frame_analytics/analytics_audit_messages.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { ML_NOTIFICATION_INDEX_PATTERN } from '../../../common/constants/index_patterns';
 import { JobMessage } from '../../../common/types/audit_message';
 
@@ -23,7 +23,7 @@ interface BoolQuery {
   bool: { [key: string]: any };
 }
 
-export function analyticsAuditMessagesProvider({ callAsInternalUser }: ILegacyScopedClusterClient) {
+export function analyticsAuditMessagesProvider({ asInternalUser }: IScopedClusterClient) {
   // search for audit messages,
   // analyticsId is optional. without it, all analytics will be listed.
   async function getAnalyticsAuditMessages(analyticsId: string) {
@@ -68,27 +68,23 @@ export function analyticsAuditMessagesProvider({ callAsInternalUser }: ILegacySc
       });
     }
 
-    try {
-      const resp = await callAsInternalUser('search', {
-        index: ML_NOTIFICATION_INDEX_PATTERN,
-        ignore_unavailable: true,
-        rest_total_hits_as_int: true,
-        size: SIZE,
-        body: {
-          sort: [{ timestamp: { order: 'desc' } }, { job_id: { order: 'asc' } }],
-          query,
-        },
-      });
+    const { body } = await asInternalUser.search({
+      index: ML_NOTIFICATION_INDEX_PATTERN,
+      ignore_unavailable: true,
+      rest_total_hits_as_int: true,
+      size: SIZE,
+      body: {
+        sort: [{ timestamp: { order: 'desc' } }, { job_id: { order: 'asc' } }],
+        query,
+      },
+    });
 
-      let messages = [];
-      if (resp.hits.total !== 0) {
-        messages = resp.hits.hits.map((hit: Message) => hit._source);
-        messages.reverse();
-      }
-      return messages;
-    } catch (e) {
-      throw e;
+    let messages = [];
+    if (body.hits.total !== 0) {
+      messages = body.hits.hits.map((hit: Message) => hit._source);
+      messages.reverse();
     }
+    return messages;
   }
 
   return {
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.test.ts b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.test.ts
index 82d7707464308a..ab879d4c93b292 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.test.ts
+++ b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.test.ts
@@ -4,13 +4,20 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { SavedObjectsClientContract, KibanaRequest } from 'kibana/server';
+import { SavedObjectsClientContract, KibanaRequest, IScopedClusterClient } from 'kibana/server';
 import { Module } from '../../../common/types/modules';
 import { DataRecognizer } from '../data_recognizer';
 
+const callAs = () => Promise.resolve({ body: {} });
+
+const mlClusterClient = ({
+  asCurrentUser: callAs,
+  asInternalUser: callAs,
+} as unknown) as IScopedClusterClient;
+
 describe('ML - data recognizer', () => {
   const dr = new DataRecognizer(
-    { callAsCurrentUser: jest.fn(), callAsInternalUser: jest.fn() },
+    mlClusterClient,
     ({
       find: jest.fn(),
       bulkCreate: jest.fn(),
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
index 206baacd983223..820fcfa9253b63 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
+++ b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
@@ -7,15 +7,11 @@
 import fs from 'fs';
 import Boom from 'boom';
 import numeral from '@elastic/numeral';
-import {
-  KibanaRequest,
-  ILegacyScopedClusterClient,
-  SavedObjectsClientContract,
-} from 'kibana/server';
+import { KibanaRequest, IScopedClusterClient, SavedObjectsClientContract } from 'kibana/server';
 import moment from 'moment';
 import { IndexPatternAttributes } from 'src/plugins/data/server';
 import { merge } from 'lodash';
-import { AnalysisLimits, CombinedJobWithStats } from '../../../common/types/anomaly_detection_jobs';
+import { AnalysisLimits } from '../../../common/types/anomaly_detection_jobs';
 import { getAuthorizationHeader } from '../../lib/request_authorization';
 import { MlInfoResponse } from '../../../common/types/ml_server_info';
 import {
@@ -46,6 +42,7 @@ import { fieldsServiceProvider } from '../fields_service';
 import { jobServiceProvider } from '../job_service';
 import { resultsServiceProvider } from '../results_service';
 import { JobExistResult, JobStat } from '../../../common/types/data_recognizer';
+import { MlJobsStatsResponse } from '../job_service/jobs';
 
 const ML_DIR = 'ml';
 const KIBANA_DIR = 'kibana';
@@ -74,10 +71,6 @@ interface RawModuleConfig {
   };
 }
 
-interface MlJobStats {
-  jobs: CombinedJobWithStats[];
-}
-
 interface Config {
   dirName: any;
   json: RawModuleConfig;
@@ -111,9 +104,9 @@ interface SaveResults {
 }
 
 export class DataRecognizer {
-  private _callAsCurrentUser: ILegacyScopedClusterClient['callAsCurrentUser'];
-  private _callAsInternalUser: ILegacyScopedClusterClient['callAsInternalUser'];
-  private _mlClusterClient: ILegacyScopedClusterClient;
+  private _asCurrentUser: IScopedClusterClient['asCurrentUser'];
+  private _asInternalUser: IScopedClusterClient['asInternalUser'];
+  private _client: IScopedClusterClient;
   private _authorizationHeader: object;
   private _modulesDir = `${__dirname}/modules`;
   private _indexPatternName: string = '';
@@ -124,13 +117,13 @@ export class DataRecognizer {
   jobsForModelMemoryEstimation: Array<{ job: ModuleJob; query: any }> = [];
 
   constructor(
-    mlClusterClient: ILegacyScopedClusterClient,
+    mlClusterClient: IScopedClusterClient,
     private savedObjectsClient: SavedObjectsClientContract,
     request: KibanaRequest
   ) {
-    this._mlClusterClient = mlClusterClient;
-    this._callAsCurrentUser = mlClusterClient.callAsCurrentUser;
-    this._callAsInternalUser = mlClusterClient.callAsInternalUser;
+    this._client = mlClusterClient;
+    this._asCurrentUser = mlClusterClient.asCurrentUser;
+    this._asInternalUser = mlClusterClient.asInternalUser;
     this._authorizationHeader = getAuthorizationHeader(request);
   }
 
@@ -249,18 +242,18 @@ export class DataRecognizer {
 
     const index = indexPattern;
     const size = 0;
-    const body = {
+    const searchBody = {
       query: moduleConfig.query,
     };
 
-    const resp = await this._callAsCurrentUser('search', {
+    const { body } = await this._asCurrentUser.search({
       index,
       rest_total_hits_as_int: true,
       size,
-      body,
+      body: searchBody,
     });
 
-    return resp.hits.total !== 0;
+    return body.hits.total !== 0;
   }
 
   async listModules() {
@@ -518,7 +511,7 @@ export class DataRecognizer {
       // Add a wildcard at the front of each of the job IDs in the module,
       // as a prefix may have been supplied when creating the jobs in the module.
       const jobIds = module.jobs.map((job) => `*${job.id}`);
-      const { jobsExist } = jobServiceProvider(this._mlClusterClient);
+      const { jobsExist } = jobServiceProvider(this._client);
       const jobInfo = await jobsExist(jobIds);
 
       // Check if the value for any of the jobs is false.
@@ -527,16 +520,16 @@ export class DataRecognizer {
 
       if (doJobsExist === true) {
         // Get the IDs of the jobs created from the module, and their earliest / latest timestamps.
-        const jobStats: MlJobStats = await this._callAsInternalUser('ml.jobStats', {
-          jobId: jobIds,
+        const { body } = await this._asInternalUser.ml.getJobStats<MlJobsStatsResponse>({
+          job_id: jobIds.join(),
         });
         const jobStatsJobs: JobStat[] = [];
-        if (jobStats.jobs && jobStats.jobs.length > 0) {
-          const foundJobIds = jobStats.jobs.map((job) => job.job_id);
-          const { getLatestBucketTimestampByJob } = resultsServiceProvider(this._mlClusterClient);
+        if (body.jobs && body.jobs.length > 0) {
+          const foundJobIds = body.jobs.map((job) => job.job_id);
+          const { getLatestBucketTimestampByJob } = resultsServiceProvider(this._client);
           const latestBucketTimestampsByJob = await getLatestBucketTimestampByJob(foundJobIds);
 
-          jobStats.jobs.forEach((job) => {
+          body.jobs.forEach((job) => {
             const jobStat = {
               id: job.job_id,
             } as JobStat;
@@ -704,16 +697,15 @@ export class DataRecognizer {
           job.id = jobId;
           await this.saveJob(job);
           return { id: jobId, success: true };
-        } catch (error) {
-          return { id: jobId, success: false, error };
+        } catch ({ body }) {
+          return { id: jobId, success: false, error: body };
         }
       })
     );
   }
 
   async saveJob(job: ModuleJob) {
-    const { id: jobId, config: body } = job;
-    return this._callAsInternalUser('ml.addJob', { jobId, body });
+    return this._asInternalUser.ml.putJob({ job_id: job.id, body: job.config });
   }
 
   // save the datafeeds.
@@ -725,20 +717,21 @@ export class DataRecognizer {
         try {
           await this.saveDatafeed(datafeed);
           return { id: datafeed.id, success: true, started: false };
-        } catch (error) {
-          return { id: datafeed.id, success: false, started: false, error };
+        } catch ({ body }) {
+          return { id: datafeed.id, success: false, started: false, error: body };
         }
       })
     );
   }
 
   async saveDatafeed(datafeed: ModuleDataFeed) {
-    const { id: datafeedId, config: body } = datafeed;
-    return this._callAsInternalUser('ml.addDatafeed', {
-      datafeedId,
-      body,
-      ...this._authorizationHeader,
-    });
+    return this._asInternalUser.ml.putDatafeed(
+      {
+        datafeed_id: datafeed.id,
+        body: datafeed.config,
+      },
+      this._authorizationHeader
+    );
   }
 
   async startDatafeeds(
@@ -761,10 +754,10 @@ export class DataRecognizer {
     const result = { started: false } as DatafeedResponse;
     let opened = false;
     try {
-      const openResult = await this._callAsInternalUser('ml.openJob', {
-        jobId: datafeed.config.job_id,
+      const { body } = await this._asInternalUser.ml.openJob({
+        job_id: datafeed.config.job_id,
       });
-      opened = openResult.opened;
+      opened = body.opened;
     } catch (error) {
       // if the job is already open, a 409 will be returned.
       if (error.statusCode === 409) {
@@ -772,27 +765,27 @@ export class DataRecognizer {
       } else {
         opened = false;
         result.started = false;
-        result.error = error;
+        result.error = error.body;
       }
     }
     if (opened) {
       try {
-        const duration: { start: number; end?: number } = { start: 0 };
+        const duration: { start: string; end?: string } = { start: '0' };
         if (start !== undefined) {
-          duration.start = start;
+          duration.start = (start as unknown) as string;
         }
         if (end !== undefined) {
-          duration.end = end;
+          duration.end = (end as unknown) as string;
         }
 
-        await this._callAsInternalUser('ml.startDatafeed', {
-          datafeedId: datafeed.id,
+        await this._asInternalUser.ml.startDatafeed({
+          datafeed_id: datafeed.id,
           ...duration,
         });
         result.started = true;
-      } catch (error) {
+      } catch ({ body }) {
         result.started = false;
-        result.error = error;
+        result.error = body;
       }
     }
     return result;
@@ -995,7 +988,7 @@ export class DataRecognizer {
     timeField: string,
     query?: any
   ): Promise<{ start: number; end: number }> {
-    const fieldsService = fieldsServiceProvider(this._mlClusterClient);
+    const fieldsService = fieldsServiceProvider(this._client);
 
     const timeFieldRange = await fieldsService.getTimeFieldRange(
       this._indexPatternName,
@@ -1025,7 +1018,7 @@ export class DataRecognizer {
 
     if (estimateMML && this.jobsForModelMemoryEstimation.length > 0) {
       try {
-        const calculateModelMemoryLimit = calculateModelMemoryLimitProvider(this._mlClusterClient);
+        const calculateModelMemoryLimit = calculateModelMemoryLimitProvider(this._client);
 
         // Checks if all jobs in the module have the same time field configured
         const firstJobTimeField = this.jobsForModelMemoryEstimation[0].job.config.data_description
@@ -1074,11 +1067,13 @@ export class DataRecognizer {
           job.config.analysis_limits.model_memory_limit = modelMemoryLimit;
         }
       } catch (error) {
-        mlLog.warn(`Data recognizer could not estimate model memory limit ${error}`);
+        mlLog.warn(`Data recognizer could not estimate model memory limit ${error.body}`);
       }
     }
 
-    const { limits } = (await this._callAsInternalUser('ml.info')) as MlInfoResponse;
+    const {
+      body: { limits },
+    } = await this._asInternalUser.ml.info<MlInfoResponse>();
     const maxMml = limits.max_model_memory_limit;
 
     if (!maxMml) {
diff --git a/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts b/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts
index 838315d8d272ca..dbfa4b5656e5f9 100644
--- a/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts
+++ b/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import get from 'lodash/get';
 import each from 'lodash/each';
 import last from 'lodash/last';
@@ -183,7 +183,7 @@ type BatchStats =
   | FieldExamples;
 
 const getAggIntervals = async (
-  { callAsCurrentUser }: ILegacyScopedClusterClient,
+  { asCurrentUser }: IScopedClusterClient,
   indexPatternTitle: string,
   query: any,
   fields: HistogramField[],
@@ -207,7 +207,7 @@ const getAggIntervals = async (
     return aggs;
   }, {} as Record<string, object>);
 
-  const respStats = await callAsCurrentUser('search', {
+  const { body } = await asCurrentUser.search({
     index: indexPatternTitle,
     size: 0,
     body: {
@@ -218,8 +218,7 @@ const getAggIntervals = async (
   });
 
   const aggsPath = getSamplerAggregationsResponsePath(samplerShardSize);
-  const aggregations =
-    aggsPath.length > 0 ? get(respStats.aggregations, aggsPath) : respStats.aggregations;
+  const aggregations = aggsPath.length > 0 ? get(body.aggregations, aggsPath) : body.aggregations;
 
   return Object.keys(aggregations).reduce((p, aggName) => {
     const stats = [aggregations[aggName].min, aggregations[aggName].max];
@@ -241,15 +240,15 @@ const getAggIntervals = async (
 
 // export for re-use by transforms plugin
 export const getHistogramsForFields = async (
-  mlClusterClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   indexPatternTitle: string,
   query: any,
   fields: HistogramField[],
   samplerShardSize: number
 ) => {
-  const { callAsCurrentUser } = mlClusterClient;
+  const { asCurrentUser } = client;
   const aggIntervals = await getAggIntervals(
-    mlClusterClient,
+    client,
     indexPatternTitle,
     query,
     fields,
@@ -291,7 +290,7 @@ export const getHistogramsForFields = async (
     return [];
   }
 
-  const respChartsData = await callAsCurrentUser('search', {
+  const { body } = await asCurrentUser.search({
     index: indexPatternTitle,
     size: 0,
     body: {
@@ -302,8 +301,7 @@ export const getHistogramsForFields = async (
   });
 
   const aggsPath = getSamplerAggregationsResponsePath(samplerShardSize);
-  const aggregations =
-    aggsPath.length > 0 ? get(respChartsData.aggregations, aggsPath) : respChartsData.aggregations;
+  const aggregations = aggsPath.length > 0 ? get(body.aggregations, aggsPath) : body.aggregations;
 
   const chartsData: ChartData[] = fields.map(
     (field): ChartData => {
@@ -350,12 +348,12 @@ export const getHistogramsForFields = async (
 };
 
 export class DataVisualizer {
-  private _mlClusterClient: ILegacyScopedClusterClient;
-  private _callAsCurrentUser: ILegacyScopedClusterClient['callAsCurrentUser'];
+  private _client: IScopedClusterClient;
+  private _asCurrentUser: IScopedClusterClient['asCurrentUser'];
 
-  constructor(mlClusterClient: ILegacyScopedClusterClient) {
-    this._callAsCurrentUser = mlClusterClient.callAsCurrentUser;
-    this._mlClusterClient = mlClusterClient;
+  constructor(client: IScopedClusterClient) {
+    this._asCurrentUser = client.asCurrentUser;
+    this._client = client;
   }
 
   // Obtains overall stats on the fields in the supplied index pattern, returning an object
@@ -451,7 +449,7 @@ export class DataVisualizer {
     samplerShardSize: number
   ): Promise<any> {
     return await getHistogramsForFields(
-      this._mlClusterClient,
+      this._client,
       indexPatternTitle,
       query,
       fields,
@@ -621,7 +619,7 @@ export class DataVisualizer {
       };
     });
 
-    const body = {
+    const searchBody = {
       query: {
         bool: {
           filter: filterCriteria,
@@ -630,14 +628,14 @@ export class DataVisualizer {
       aggs: buildSamplerAggregation(aggs, samplerShardSize),
     };
 
-    const resp = await this._callAsCurrentUser('search', {
+    const { body } = await this._asCurrentUser.search({
       index,
       rest_total_hits_as_int: true,
       size,
-      body,
+      body: searchBody,
     });
-    const aggregations = resp.aggregations;
-    const totalCount = get(resp, ['hits', 'total'], 0);
+    const aggregations = body.aggregations;
+    const totalCount = get(body, ['hits', 'total'], 0);
     const stats = {
       totalCount,
       aggregatableExistsFields: [] as FieldData[],
@@ -688,7 +686,7 @@ export class DataVisualizer {
     const size = 0;
     const filterCriteria = buildBaseFilterCriteria(timeFieldName, earliestMs, latestMs, query);
 
-    const body = {
+    const searchBody = {
       query: {
         bool: {
           filter: filterCriteria,
@@ -697,13 +695,13 @@ export class DataVisualizer {
     };
     filterCriteria.push({ exists: { field } });
 
-    const resp = await this._callAsCurrentUser('search', {
+    const { body } = await this._asCurrentUser.search({
       index,
       rest_total_hits_as_int: true,
       size,
-      body,
+      body: searchBody,
     });
-    return resp.hits.total > 0;
+    return body.hits.total > 0;
   }
 
   async getDocumentCountStats(
@@ -730,7 +728,7 @@ export class DataVisualizer {
       },
     };
 
-    const body = {
+    const searchBody = {
       query: {
         bool: {
           filter: filterCriteria,
@@ -739,15 +737,15 @@ export class DataVisualizer {
       aggs,
     };
 
-    const resp = await this._callAsCurrentUser('search', {
+    const { body } = await this._asCurrentUser.search({
       index,
       size,
-      body,
+      body: searchBody,
     });
 
     const buckets: { [key: string]: number } = {};
     const dataByTimeBucket: Array<{ key: string; doc_count: number }> = get(
-      resp,
+      body,
       ['aggregations', 'eventRate', 'buckets'],
       []
     );
@@ -833,7 +831,7 @@ export class DataVisualizer {
       }
     });
 
-    const body = {
+    const searchBody = {
       query: {
         bool: {
           filter: filterCriteria,
@@ -842,12 +840,12 @@ export class DataVisualizer {
       aggs: buildSamplerAggregation(aggs, samplerShardSize),
     };
 
-    const resp = await this._callAsCurrentUser('search', {
+    const { body } = await this._asCurrentUser.search({
       index,
       size,
-      body,
+      body: searchBody,
     });
-    const aggregations = resp.aggregations;
+    const aggregations = body.aggregations;
     const aggsPath = getSamplerAggregationsResponsePath(samplerShardSize);
     const batchStats: NumericFieldStats[] = [];
     fields.forEach((field, i) => {
@@ -954,7 +952,7 @@ export class DataVisualizer {
       }
     });
 
-    const body = {
+    const searchBody = {
       query: {
         bool: {
           filter: filterCriteria,
@@ -963,12 +961,12 @@ export class DataVisualizer {
       aggs: buildSamplerAggregation(aggs, samplerShardSize),
     };
 
-    const resp = await this._callAsCurrentUser('search', {
+    const { body } = await this._asCurrentUser.search({
       index,
       size,
-      body,
+      body: searchBody,
     });
-    const aggregations = resp.aggregations;
+    const aggregations = body.aggregations;
     const aggsPath = getSamplerAggregationsResponsePath(samplerShardSize);
     const batchStats: StringFieldStats[] = [];
     fields.forEach((field, i) => {
@@ -1028,7 +1026,7 @@ export class DataVisualizer {
       };
     });
 
-    const body = {
+    const searchBody = {
       query: {
         bool: {
           filter: filterCriteria,
@@ -1037,12 +1035,12 @@ export class DataVisualizer {
       aggs: buildSamplerAggregation(aggs, samplerShardSize),
     };
 
-    const resp = await this._callAsCurrentUser('search', {
+    const { body } = await this._asCurrentUser.search({
       index,
       size,
-      body,
+      body: searchBody,
     });
-    const aggregations = resp.aggregations;
+    const aggregations = body.aggregations;
     const aggsPath = getSamplerAggregationsResponsePath(samplerShardSize);
     const batchStats: DateFieldStats[] = [];
     fields.forEach((field, i) => {
@@ -1095,7 +1093,7 @@ export class DataVisualizer {
       };
     });
 
-    const body = {
+    const searchBody = {
       query: {
         bool: {
           filter: filterCriteria,
@@ -1104,12 +1102,12 @@ export class DataVisualizer {
       aggs: buildSamplerAggregation(aggs, samplerShardSize),
     };
 
-    const resp = await this._callAsCurrentUser('search', {
+    const { body } = await this._asCurrentUser.search({
       index,
       size,
-      body,
+      body: searchBody,
     });
-    const aggregations = resp.aggregations;
+    const aggregations = body.aggregations;
     const aggsPath = getSamplerAggregationsResponsePath(samplerShardSize);
     const batchStats: BooleanFieldStats[] = [];
     fields.forEach((field, i) => {
@@ -1157,7 +1155,7 @@ export class DataVisualizer {
       exists: { field },
     });
 
-    const body = {
+    const searchBody = {
       _source: field,
       query: {
         bool: {
@@ -1166,18 +1164,18 @@ export class DataVisualizer {
       },
     };
 
-    const resp = await this._callAsCurrentUser('search', {
+    const { body } = await this._asCurrentUser.search({
       index,
       rest_total_hits_as_int: true,
       size,
-      body,
+      body: searchBody,
     });
     const stats = {
       fieldName: field,
       examples: [] as any[],
     };
-    if (resp.hits.total !== 0) {
-      const hits = resp.hits.hits;
+    if (body.hits.total !== 0) {
+      const hits = body.hits.hits;
       for (let i = 0; i < hits.length; i++) {
         // Look in the _source for the field value.
         // If the field is not in the _source (as will happen if the
diff --git a/x-pack/plugins/ml/server/models/fields_service/fields_service.ts b/x-pack/plugins/ml/server/models/fields_service/fields_service.ts
index 43a6876f76c49e..68427e98750ebb 100644
--- a/x-pack/plugins/ml/server/models/fields_service/fields_service.ts
+++ b/x-pack/plugins/ml/server/models/fields_service/fields_service.ts
@@ -5,7 +5,7 @@
  */
 
 import Boom from 'boom';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { duration } from 'moment';
 import { parseInterval } from '../../../common/util/parse_interval';
 import { initCardinalityFieldsCache } from './fields_aggs_cache';
@@ -14,7 +14,7 @@ import { initCardinalityFieldsCache } from './fields_aggs_cache';
  * Service for carrying out queries to obtain data
  * specific to fields in Elasticsearch indices.
  */
-export function fieldsServiceProvider({ callAsCurrentUser }: ILegacyScopedClusterClient) {
+export function fieldsServiceProvider({ asCurrentUser }: IScopedClusterClient) {
   const fieldsAggsCache = initCardinalityFieldsCache();
 
   /**
@@ -37,13 +37,13 @@ export function fieldsServiceProvider({ callAsCurrentUser }: ILegacyScopedCluste
     index: string | string[],
     fieldNames: string[]
   ): Promise<string[]> {
-    const fieldCapsResp = await callAsCurrentUser('fieldCaps', {
+    const { body } = await asCurrentUser.fieldCaps({
       index,
       fields: fieldNames,
     });
     const aggregatableFields: string[] = [];
     fieldNames.forEach((fieldName) => {
-      const fieldInfo = fieldCapsResp.fields[fieldName];
+      const fieldInfo = body.fields[fieldName];
       const typeKeys = fieldInfo !== undefined ? Object.keys(fieldInfo) : [];
       if (typeKeys.length > 0) {
         const fieldType = typeKeys[0];
@@ -130,12 +130,12 @@ export function fieldsServiceProvider({ callAsCurrentUser }: ILegacyScopedCluste
       aggs,
     };
 
-    const aggregations = (
-      await callAsCurrentUser('search', {
-        index,
-        body,
-      })
-    )?.aggregations;
+    const {
+      body: { aggregations },
+    } = await asCurrentUser.search({
+      index,
+      body,
+    });
 
     if (!aggregations) {
       return {};
@@ -170,7 +170,9 @@ export function fieldsServiceProvider({ callAsCurrentUser }: ILegacyScopedCluste
   }> {
     const obj = { success: true, start: { epoch: 0, string: '' }, end: { epoch: 0, string: '' } };
 
-    const resp = await callAsCurrentUser('search', {
+    const {
+      body: { aggregations },
+    } = await asCurrentUser.search({
       index,
       size: 0,
       body: {
@@ -190,12 +192,12 @@ export function fieldsServiceProvider({ callAsCurrentUser }: ILegacyScopedCluste
       },
     });
 
-    if (resp.aggregations && resp.aggregations.earliest && resp.aggregations.latest) {
-      obj.start.epoch = resp.aggregations.earliest.value;
-      obj.start.string = resp.aggregations.earliest.value_as_string;
+    if (aggregations && aggregations.earliest && aggregations.latest) {
+      obj.start.epoch = aggregations.earliest.value;
+      obj.start.string = aggregations.earliest.value_as_string;
 
-      obj.end.epoch = resp.aggregations.latest.value;
-      obj.end.string = resp.aggregations.latest.value_as_string;
+      obj.end.epoch = aggregations.latest.value;
+      obj.end.string = aggregations.latest.value_as_string;
     }
     return obj;
   }
@@ -338,12 +340,12 @@ export function fieldsServiceProvider({ callAsCurrentUser }: ILegacyScopedCluste
       },
     };
 
-    const aggregations = (
-      await callAsCurrentUser('search', {
-        index,
-        body,
-      })
-    )?.aggregations;
+    const {
+      body: { aggregations },
+    } = await asCurrentUser.search({
+      index,
+      body,
+    });
 
     if (!aggregations) {
       return cachedValues;
diff --git a/x-pack/plugins/ml/server/models/file_data_visualizer/file_data_visualizer.ts b/x-pack/plugins/ml/server/models/file_data_visualizer/file_data_visualizer.ts
index 9cd71c046b66c7..9e502c04fbb7ba 100644
--- a/x-pack/plugins/ml/server/models/file_data_visualizer/file_data_visualizer.ts
+++ b/x-pack/plugins/ml/server/models/file_data_visualizer/file_data_visualizer.ts
@@ -4,18 +4,20 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import {
   AnalysisResult,
   FormattedOverrides,
   InputOverrides,
+  FindFileStructureResponse,
 } from '../../../common/types/file_datavisualizer';
 
 export type InputData = any[];
 
-export function fileDataVisualizerProvider({ callAsInternalUser }: ILegacyScopedClusterClient) {
-  async function analyzeFile(data: any, overrides: any): Promise<AnalysisResult> {
-    const results = await callAsInternalUser('ml.fileStructure', {
+export function fileDataVisualizerProvider({ asInternalUser }: IScopedClusterClient) {
+  async function analyzeFile(data: InputData, overrides: InputOverrides): Promise<AnalysisResult> {
+    overrides.explain = overrides.explain === undefined ? 'true' : overrides.explain;
+    const { body } = await asInternalUser.ml.findFileStructure<FindFileStructureResponse>({
       body: data,
       ...overrides,
     });
@@ -24,7 +26,7 @@ export function fileDataVisualizerProvider({ callAsInternalUser }: ILegacyScoped
 
     return {
       ...(hasOverrides && { overrides: reducedOverrides }),
-      results,
+      results: body,
     };
   }
 
diff --git a/x-pack/plugins/ml/server/models/file_data_visualizer/import_data.ts b/x-pack/plugins/ml/server/models/file_data_visualizer/import_data.ts
index fc9b333298c9dd..6108454c08aa75 100644
--- a/x-pack/plugins/ml/server/models/file_data_visualizer/import_data.ts
+++ b/x-pack/plugins/ml/server/models/file_data_visualizer/import_data.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { INDEX_META_DATA_CREATED_BY } from '../../../common/constants/file_datavisualizer';
 import {
   ImportResponse,
@@ -15,7 +15,7 @@ import {
 } from '../../../common/types/file_datavisualizer';
 import { InputData } from './file_data_visualizer';
 
-export function importDataProvider({ callAsCurrentUser }: ILegacyScopedClusterClient) {
+export function importDataProvider({ asCurrentUser }: IScopedClusterClient) {
   async function importData(
     id: string,
     index: string,
@@ -40,9 +40,9 @@ export function importDataProvider({ callAsCurrentUser }: ILegacyScopedClusterCl
 
         // create the pipeline if one has been supplied
         if (pipelineId !== undefined) {
-          const success = await createPipeline(pipelineId, pipeline);
-          if (success.acknowledged !== true) {
-            throw success;
+          const resp = await createPipeline(pipelineId, pipeline);
+          if (resp.acknowledged !== true) {
+            throw resp;
           }
         }
         createdPipelineId = pipelineId;
@@ -80,7 +80,7 @@ export function importDataProvider({ callAsCurrentUser }: ILegacyScopedClusterCl
         id,
         index: createdIndex,
         pipelineId: createdPipelineId,
-        error: error.error !== undefined ? error.error : error,
+        error: error.body !== undefined ? error.body : error,
         docCount,
         ingestError: error.ingestError,
         failures: error.failures || [],
@@ -102,7 +102,7 @@ export function importDataProvider({ callAsCurrentUser }: ILegacyScopedClusterCl
       body.settings = settings;
     }
 
-    await callAsCurrentUser('indices.create', { index, body });
+    await asCurrentUser.indices.create({ index, body });
   }
 
   async function indexData(index: string, pipelineId: string, data: InputData) {
@@ -118,7 +118,7 @@ export function importDataProvider({ callAsCurrentUser }: ILegacyScopedClusterCl
         settings.pipeline = pipelineId;
       }
 
-      const resp = await callAsCurrentUser('bulk', settings);
+      const { body: resp } = await asCurrentUser.bulk(settings);
       if (resp.errors) {
         throw resp;
       } else {
@@ -151,7 +151,8 @@ export function importDataProvider({ callAsCurrentUser }: ILegacyScopedClusterCl
   }
 
   async function createPipeline(id: string, pipeline: any) {
-    return await callAsCurrentUser('ingest.putPipeline', { id, body: pipeline });
+    const { body } = await asCurrentUser.ingest.putPipeline({ id, body: pipeline });
+    return body;
   }
 
   function getFailures(items: any[], data: InputData): ImportFailure[] {
diff --git a/x-pack/plugins/ml/server/models/filter/filter_manager.ts b/x-pack/plugins/ml/server/models/filter/filter_manager.ts
index 768ca1f893b68a..19ba1b76f8a600 100644
--- a/x-pack/plugins/ml/server/models/filter/filter_manager.ts
+++ b/x-pack/plugins/ml/server/models/filter/filter_manager.ts
@@ -5,7 +5,7 @@
  */
 
 import Boom from 'boom';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 
 import { DetectorRule, DetectorRuleScope } from '../../../common/types/detector_rules';
 
@@ -58,26 +58,26 @@ interface PartialJob {
 }
 
 export class FilterManager {
-  private _callAsInternalUser: ILegacyScopedClusterClient['callAsInternalUser'];
-  constructor({ callAsInternalUser }: ILegacyScopedClusterClient) {
-    this._callAsInternalUser = callAsInternalUser;
+  private _asInternalUser: IScopedClusterClient['asInternalUser'];
+  constructor({ asInternalUser }: IScopedClusterClient) {
+    this._asInternalUser = asInternalUser;
   }
 
   async getFilter(filterId: string) {
     try {
       const [JOBS, FILTERS] = [0, 1];
       const results = await Promise.all([
-        this._callAsInternalUser('ml.jobs'),
-        this._callAsInternalUser('ml.filters', { filterId }),
+        this._asInternalUser.ml.getJobs(),
+        this._asInternalUser.ml.getFilters({ filter_id: filterId }),
       ]);
 
-      if (results[FILTERS] && results[FILTERS].filters.length) {
+      if (results[FILTERS] && results[FILTERS].body.filters.length) {
         let filtersInUse: FiltersInUse = {};
-        if (results[JOBS] && results[JOBS].jobs) {
-          filtersInUse = this.buildFiltersInUse(results[JOBS].jobs);
+        if (results[JOBS] && results[JOBS].body.jobs) {
+          filtersInUse = this.buildFiltersInUse(results[JOBS].body.jobs);
         }
 
-        const filter = results[FILTERS].filters[0];
+        const filter = results[FILTERS].body.filters[0];
         filter.used_by = filtersInUse[filter.filter_id];
         return filter;
       } else {
@@ -90,8 +90,8 @@ export class FilterManager {
 
   async getAllFilters() {
     try {
-      const filtersResp = await this._callAsInternalUser('ml.filters');
-      return filtersResp.filters;
+      const { body } = await this._asInternalUser.ml.getFilters({ size: 1000 });
+      return body.filters;
     } catch (error) {
       throw Boom.badRequest(error);
     }
@@ -101,14 +101,14 @@ export class FilterManager {
     try {
       const [JOBS, FILTERS] = [0, 1];
       const results = await Promise.all([
-        this._callAsInternalUser('ml.jobs'),
-        this._callAsInternalUser('ml.filters'),
+        this._asInternalUser.ml.getJobs(),
+        this._asInternalUser.ml.getFilters({ size: 1000 }),
       ]);
 
       // Build a map of filter_ids against jobs and detectors using that filter.
       let filtersInUse: FiltersInUse = {};
-      if (results[JOBS] && results[JOBS].jobs) {
-        filtersInUse = this.buildFiltersInUse(results[JOBS].jobs);
+      if (results[JOBS] && results[JOBS].body.jobs) {
+        filtersInUse = this.buildFiltersInUse(results[JOBS].body.jobs);
       }
 
       // For each filter, return just
@@ -117,8 +117,8 @@ export class FilterManager {
       //  item_count
       //  jobs using the filter
       const filterStats: FilterStats[] = [];
-      if (results[FILTERS] && results[FILTERS].filters) {
-        results[FILTERS].filters.forEach((filter: Filter) => {
+      if (results[FILTERS] && results[FILTERS].body.filters) {
+        results[FILTERS].body.filters.forEach((filter: Filter) => {
           const stats: FilterStats = {
             filter_id: filter.filter_id,
             description: filter.description,
@@ -139,7 +139,8 @@ export class FilterManager {
     const { filterId, ...body } = filter;
     try {
       // Returns the newly created filter.
-      return await this._callAsInternalUser('ml.addFilter', { filterId, body });
+      const { body: resp } = await this._asInternalUser.ml.putFilter({ filter_id: filterId, body });
+      return resp;
     } catch (error) {
       throw Boom.badRequest(error);
     }
@@ -159,17 +160,19 @@ export class FilterManager {
       }
 
       // Returns the newly updated filter.
-      return await this._callAsInternalUser('ml.updateFilter', {
-        filterId,
+      const { body: resp } = await this._asInternalUser.ml.updateFilter({
+        filter_id: filterId,
         body,
       });
+      return resp;
     } catch (error) {
       throw Boom.badRequest(error);
     }
   }
 
   async deleteFilter(filterId: string) {
-    return this._callAsInternalUser('ml.deleteFilter', { filterId });
+    const { body } = await this._asInternalUser.ml.deleteFilter({ filter_id: filterId });
+    return body;
   }
 
   buildFiltersInUse(jobsList: PartialJob[]) {
diff --git a/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.d.ts b/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.d.ts
index d72552b548b827..afdd3e9bb8ce90 100644
--- a/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.d.ts
+++ b/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.d.ts
@@ -4,10 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 
 export function jobAuditMessagesProvider(
-  mlClusterClient: ILegacyScopedClusterClient
+  client: IScopedClusterClient
 ): {
   getJobAuditMessages: (jobId?: string, from?: string) => any;
   getAuditMessagesSummary: (jobIds?: string[]) => any;
diff --git a/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.js b/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.js
index 86d80c394137f8..3fd5ebf3f68f40 100644
--- a/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.js
+++ b/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.js
@@ -34,14 +34,14 @@ const anomalyDetectorTypeFilter = {
   },
 };
 
-export function jobAuditMessagesProvider({ callAsInternalUser }) {
+export function jobAuditMessagesProvider({ asInternalUser }) {
   // search for audit messages,
   // jobId is optional. without it, all jobs will be listed.
   // from is optional and should be a string formatted in ES time units. e.g. 12h, 1d, 7d
   async function getJobAuditMessages(jobId, from) {
     let gte = null;
     if (jobId !== undefined && from === undefined) {
-      const jobs = await callAsInternalUser('ml.jobs', { jobId });
+      const jobs = await asInternalUser.ml.getJobs({ job_id: jobId });
       if (jobs.count > 0 && jobs.jobs !== undefined) {
         gte = moment(jobs.jobs[0].create_time).valueOf();
       }
@@ -99,26 +99,22 @@ export function jobAuditMessagesProvider({ callAsInternalUser }) {
       });
     }
 
-    try {
-      const resp = await callAsInternalUser('search', {
-        index: ML_NOTIFICATION_INDEX_PATTERN,
-        ignore_unavailable: true,
-        rest_total_hits_as_int: true,
-        size: SIZE,
-        body: {
-          sort: [{ timestamp: { order: 'desc' } }, { job_id: { order: 'asc' } }],
-          query,
-        },
-      });
+    const { body } = await asInternalUser.search({
+      index: ML_NOTIFICATION_INDEX_PATTERN,
+      ignore_unavailable: true,
+      rest_total_hits_as_int: true,
+      size: SIZE,
+      body: {
+        sort: [{ timestamp: { order: 'desc' } }, { job_id: { order: 'asc' } }],
+        query,
+      },
+    });
 
-      let messages = [];
-      if (resp.hits.total !== 0) {
-        messages = resp.hits.hits.map((hit) => hit._source);
-      }
-      return messages;
-    } catch (e) {
-      throw e;
+    let messages = [];
+    if (body.hits.total !== 0) {
+      messages = body.hits.hits.map((hit) => hit._source);
     }
+    return messages;
   }
 
   // search highest, most recent audit messages for all jobs for the last 24hrs.
@@ -128,65 +124,63 @@ export function jobAuditMessagesProvider({ callAsInternalUser }) {
     const maxBuckets = 10000;
     let levelsPerJobAggSize = maxBuckets;
 
-    try {
-      const query = {
-        bool: {
-          filter: [
-            {
-              range: {
-                timestamp: {
-                  gte: 'now-1d',
-                },
+    const query = {
+      bool: {
+        filter: [
+          {
+            range: {
+              timestamp: {
+                gte: 'now-1d',
               },
             },
-            anomalyDetectorTypeFilter,
-          ],
-        },
-      };
-
-      // If the jobIds arg is supplied, add a query filter
-      // to only include those jobIds in the aggregations.
-      if (Array.isArray(jobIds) && jobIds.length > 0) {
-        query.bool.filter.push({
-          terms: {
-            job_id: jobIds,
           },
-        });
-        levelsPerJobAggSize = jobIds.length;
-      }
+          anomalyDetectorTypeFilter,
+        ],
+      },
+    };
 
-      const resp = await callAsInternalUser('search', {
-        index: ML_NOTIFICATION_INDEX_PATTERN,
-        ignore_unavailable: true,
-        rest_total_hits_as_int: true,
-        size: 0,
-        body: {
-          query,
-          aggs: {
-            levelsPerJob: {
-              terms: {
-                field: 'job_id',
-                size: levelsPerJobAggSize,
-              },
-              aggs: {
-                levels: {
-                  terms: {
-                    field: 'level',
-                  },
-                  aggs: {
-                    latestMessage: {
-                      terms: {
-                        field: 'message.raw',
-                        size: 1,
-                        order: {
-                          latestMessage: 'desc',
-                        },
+    // If the jobIds arg is supplied, add a query filter
+    // to only include those jobIds in the aggregations.
+    if (Array.isArray(jobIds) && jobIds.length > 0) {
+      query.bool.filter.push({
+        terms: {
+          job_id: jobIds,
+        },
+      });
+      levelsPerJobAggSize = jobIds.length;
+    }
+
+    const { body } = await asInternalUser.search({
+      index: ML_NOTIFICATION_INDEX_PATTERN,
+      ignore_unavailable: true,
+      rest_total_hits_as_int: true,
+      size: 0,
+      body: {
+        query,
+        aggs: {
+          levelsPerJob: {
+            terms: {
+              field: 'job_id',
+              size: levelsPerJobAggSize,
+            },
+            aggs: {
+              levels: {
+                terms: {
+                  field: 'level',
+                },
+                aggs: {
+                  latestMessage: {
+                    terms: {
+                      field: 'message.raw',
+                      size: 1,
+                      order: {
+                        latestMessage: 'desc',
                       },
-                      aggs: {
-                        latestMessage: {
-                          max: {
-                            field: 'timestamp',
-                          },
+                    },
+                    aggs: {
+                      latestMessage: {
+                        max: {
+                          field: 'timestamp',
                         },
                       },
                     },
@@ -196,67 +190,65 @@ export function jobAuditMessagesProvider({ callAsInternalUser }) {
             },
           },
         },
-      });
+      },
+    });
 
-      let messagesPerJob = [];
-      const jobMessages = [];
-      if (
-        resp.hits.total !== 0 &&
-        resp.aggregations &&
-        resp.aggregations.levelsPerJob &&
-        resp.aggregations.levelsPerJob.buckets &&
-        resp.aggregations.levelsPerJob.buckets.length
-      ) {
-        messagesPerJob = resp.aggregations.levelsPerJob.buckets;
-      }
+    let messagesPerJob = [];
+    const jobMessages = [];
+    if (
+      body.hits.total !== 0 &&
+      body.aggregations &&
+      body.aggregations.levelsPerJob &&
+      body.aggregations.levelsPerJob.buckets &&
+      body.aggregations.levelsPerJob.buckets.length
+    ) {
+      messagesPerJob = body.aggregations.levelsPerJob.buckets;
+    }
 
-      messagesPerJob.forEach((job) => {
-        // ignore system messages (id==='')
-        if (job.key !== '' && job.levels && job.levels.buckets && job.levels.buckets.length) {
-          let highestLevel = 0;
-          let highestLevelText = '';
-          let msgTime = 0;
+    messagesPerJob.forEach((job) => {
+      // ignore system messages (id==='')
+      if (job.key !== '' && job.levels && job.levels.buckets && job.levels.buckets.length) {
+        let highestLevel = 0;
+        let highestLevelText = '';
+        let msgTime = 0;
 
-          job.levels.buckets.forEach((level) => {
-            const label = level.key;
-            // note the highest message level
-            if (LEVEL[label] > highestLevel) {
-              highestLevel = LEVEL[label];
-              if (
-                level.latestMessage &&
-                level.latestMessage.buckets &&
-                level.latestMessage.buckets.length
-              ) {
-                level.latestMessage.buckets.forEach((msg) => {
-                  // there should only be one result here.
-                  highestLevelText = msg.key;
+        job.levels.buckets.forEach((level) => {
+          const label = level.key;
+          // note the highest message level
+          if (LEVEL[label] > highestLevel) {
+            highestLevel = LEVEL[label];
+            if (
+              level.latestMessage &&
+              level.latestMessage.buckets &&
+              level.latestMessage.buckets.length
+            ) {
+              level.latestMessage.buckets.forEach((msg) => {
+                // there should only be one result here.
+                highestLevelText = msg.key;
 
-                  // note the time in ms for the highest level
-                  // so we can filter them out later if they're earlier than the
-                  // job's create time.
-                  if (msg.latestMessage && msg.latestMessage.value_as_string) {
-                    const time = moment(msg.latestMessage.value_as_string);
-                    msgTime = time.valueOf();
-                  }
-                });
-              }
+                // note the time in ms for the highest level
+                // so we can filter them out later if they're earlier than the
+                // job's create time.
+                if (msg.latestMessage && msg.latestMessage.value_as_string) {
+                  const time = moment(msg.latestMessage.value_as_string);
+                  msgTime = time.valueOf();
+                }
+              });
             }
-          });
-
-          if (msgTime !== 0 && highestLevel !== 0) {
-            jobMessages.push({
-              job_id: job.key,
-              highestLevelText,
-              highestLevel: levelToText(highestLevel),
-              msgTime,
-            });
           }
+        });
+
+        if (msgTime !== 0 && highestLevel !== 0) {
+          jobMessages.push({
+            job_id: job.key,
+            highestLevelText,
+            highestLevel: levelToText(highestLevel),
+            msgTime,
+          });
         }
-      });
-      return jobMessages;
-    } catch (e) {
-      throw e;
-    }
+      }
+    });
+    return jobMessages;
   }
 
   function levelToText(level) {
diff --git a/x-pack/plugins/ml/server/models/job_service/datafeeds.ts b/x-pack/plugins/ml/server/models/job_service/datafeeds.ts
index 98e1be48bb766e..c0eb1b72825df8 100644
--- a/x-pack/plugins/ml/server/models/job_service/datafeeds.ts
+++ b/x-pack/plugins/ml/server/models/job_service/datafeeds.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { i18n } from '@kbn/i18n';
 import { JOB_STATE, DATAFEED_STATE } from '../../../common/constants/states';
 import { fillResultsWithTimeouts, isRequestTimeout } from './error_utils';
@@ -26,7 +26,7 @@ interface Results {
   };
 }
 
-export function datafeedsProvider({ callAsInternalUser }: ILegacyScopedClusterClient) {
+export function datafeedsProvider({ asInternalUser }: IScopedClusterClient) {
   async function forceStartDatafeeds(datafeedIds: string[], start?: number, end?: number) {
     const jobIds = await getJobIdsByDatafeedId();
     const doStartsCalled = datafeedIds.reduce((acc, cur) => {
@@ -42,8 +42,8 @@ export function datafeedsProvider({ callAsInternalUser }: ILegacyScopedClusterCl
         try {
           await startDatafeed(datafeedId, start, end);
           return { started: true };
-        } catch (error) {
-          return { started: false, error };
+        } catch ({ body }) {
+          return { started: false, error: body };
         }
       } else {
         return { started: true };
@@ -66,7 +66,7 @@ export function datafeedsProvider({ callAsInternalUser }: ILegacyScopedClusterCl
             results[datafeedId] = await doStart(datafeedId);
             return fillResultsWithTimeouts(results, datafeedId, datafeedIds, JOB_STATE.OPENED);
           }
-          results[datafeedId] = { started: false, error };
+          results[datafeedId] = { started: false, error: error.body };
         }
       } else {
         results[datafeedId] = {
@@ -84,8 +84,8 @@ export function datafeedsProvider({ callAsInternalUser }: ILegacyScopedClusterCl
   async function openJob(jobId: string) {
     let opened = false;
     try {
-      const resp = await callAsInternalUser('ml.openJob', { jobId });
-      opened = resp.opened;
+      const { body } = await asInternalUser.ml.openJob({ job_id: jobId });
+      opened = body.opened;
     } catch (error) {
       if (error.statusCode === 409) {
         opened = true;
@@ -97,7 +97,11 @@ export function datafeedsProvider({ callAsInternalUser }: ILegacyScopedClusterCl
   }
 
   async function startDatafeed(datafeedId: string, start?: number, end?: number) {
-    return callAsInternalUser('ml.startDatafeed', { datafeedId, start, end });
+    return asInternalUser.ml.startDatafeed({
+      datafeed_id: datafeedId,
+      start: (start as unknown) as string,
+      end: (end as unknown) as string,
+    });
   }
 
   async function stopDatafeeds(datafeedIds: string[]) {
@@ -105,7 +109,12 @@ export function datafeedsProvider({ callAsInternalUser }: ILegacyScopedClusterCl
 
     for (const datafeedId of datafeedIds) {
       try {
-        results[datafeedId] = await callAsInternalUser('ml.stopDatafeed', { datafeedId });
+        const { body } = await asInternalUser.ml.stopDatafeed<{
+          started: boolean;
+        }>({
+          datafeed_id: datafeedId,
+        });
+        results[datafeedId] = body;
       } catch (error) {
         if (isRequestTimeout(error)) {
           return fillResultsWithTimeouts(results, datafeedId, datafeedIds, DATAFEED_STATE.STOPPED);
@@ -117,11 +126,17 @@ export function datafeedsProvider({ callAsInternalUser }: ILegacyScopedClusterCl
   }
 
   async function forceDeleteDatafeed(datafeedId: string) {
-    return callAsInternalUser('ml.deleteDatafeed', { datafeedId, force: true });
+    const { body } = await asInternalUser.ml.deleteDatafeed({
+      datafeed_id: datafeedId,
+      force: true,
+    });
+    return body;
   }
 
   async function getDatafeedIdsByJobId() {
-    const { datafeeds } = (await callAsInternalUser('ml.datafeeds')) as MlDatafeedsResponse;
+    const {
+      body: { datafeeds },
+    } = await asInternalUser.ml.getDatafeeds<MlDatafeedsResponse>();
     return datafeeds.reduce((acc, cur) => {
       acc[cur.job_id] = cur.datafeed_id;
       return acc;
@@ -129,7 +144,9 @@ export function datafeedsProvider({ callAsInternalUser }: ILegacyScopedClusterCl
   }
 
   async function getJobIdsByDatafeedId() {
-    const { datafeeds } = (await callAsInternalUser('ml.datafeeds')) as MlDatafeedsResponse;
+    const {
+      body: { datafeeds },
+    } = await asInternalUser.ml.getDatafeeds<MlDatafeedsResponse>();
     return datafeeds.reduce((acc, cur) => {
       acc[cur.datafeed_id] = cur.job_id;
       return acc;
diff --git a/x-pack/plugins/ml/server/models/job_service/error_utils.ts b/x-pack/plugins/ml/server/models/job_service/error_utils.ts
index 8a47993546fb85..dc871a9dce8057 100644
--- a/x-pack/plugins/ml/server/models/job_service/error_utils.ts
+++ b/x-pack/plugins/ml/server/models/job_service/error_utils.ts
@@ -7,11 +7,11 @@
 import { i18n } from '@kbn/i18n';
 import { JOB_STATE, DATAFEED_STATE } from '../../../common/constants/states';
 
-const REQUEST_TIMEOUT = 'RequestTimeout';
+const REQUEST_TIMEOUT_NAME = 'RequestTimeout';
 type ACTION_STATE = DATAFEED_STATE | JOB_STATE;
 
-export function isRequestTimeout(error: { displayName: string }) {
-  return error.displayName === REQUEST_TIMEOUT;
+export function isRequestTimeout(error: { name: string }) {
+  return error.name === REQUEST_TIMEOUT_NAME;
 }
 
 interface Results {
diff --git a/x-pack/plugins/ml/server/models/job_service/groups.ts b/x-pack/plugins/ml/server/models/job_service/groups.ts
index c4ea854c14f872..0f53d27f2eddf4 100644
--- a/x-pack/plugins/ml/server/models/job_service/groups.ts
+++ b/x-pack/plugins/ml/server/models/job_service/groups.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { CalendarManager } from '../calendar';
 import { GLOBAL_CALENDAR } from '../../../common/constants/calendars';
 import { Job } from '../../../common/types/anomaly_detection_jobs';
@@ -23,18 +23,19 @@ interface Results {
   };
 }
 
-export function groupsProvider(mlClusterClient: ILegacyScopedClusterClient) {
-  const calMngr = new CalendarManager(mlClusterClient);
-  const { callAsInternalUser } = mlClusterClient;
+export function groupsProvider(client: IScopedClusterClient) {
+  const calMngr = new CalendarManager(client);
+  const { asInternalUser } = client;
 
   async function getAllGroups() {
     const groups: { [id: string]: Group } = {};
     const jobIds: { [id: string]: undefined | null } = {};
-    const [{ jobs }, calendars] = await Promise.all([
-      callAsInternalUser('ml.jobs') as Promise<MlJobsResponse>,
+    const [{ body }, calendars] = await Promise.all([
+      asInternalUser.ml.getJobs<MlJobsResponse>(),
       calMngr.getAllCalendars(),
     ]);
 
+    const { jobs } = body;
     if (jobs) {
       jobs.forEach((job) => {
         jobIds[job.job_id] = null;
@@ -80,10 +81,10 @@ export function groupsProvider(mlClusterClient: ILegacyScopedClusterClient) {
     for (const job of jobs) {
       const { job_id: jobId, groups } = job;
       try {
-        await callAsInternalUser('ml.updateJob', { jobId, body: { groups } });
+        await asInternalUser.ml.updateJob({ job_id: jobId, body: { groups } });
         results[jobId] = { success: true };
-      } catch (error) {
-        results[jobId] = { success: false, error };
+      } catch ({ body }) {
+        results[jobId] = { success: false, error: body };
       }
     }
     return results;
diff --git a/x-pack/plugins/ml/server/models/job_service/index.ts b/x-pack/plugins/ml/server/models/job_service/index.ts
index 1ff33a7b00f0b5..6fea5d3b5a491b 100644
--- a/x-pack/plugins/ml/server/models/job_service/index.ts
+++ b/x-pack/plugins/ml/server/models/job_service/index.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { datafeedsProvider } from './datafeeds';
 import { jobsProvider } from './jobs';
 import { groupsProvider } from './groups';
@@ -12,14 +12,14 @@ import { newJobCapsProvider } from './new_job_caps';
 import { newJobChartsProvider, topCategoriesProvider } from './new_job';
 import { modelSnapshotProvider } from './model_snapshots';
 
-export function jobServiceProvider(mlClusterClient: ILegacyScopedClusterClient) {
+export function jobServiceProvider(client: IScopedClusterClient) {
   return {
-    ...datafeedsProvider(mlClusterClient),
-    ...jobsProvider(mlClusterClient),
-    ...groupsProvider(mlClusterClient),
-    ...newJobCapsProvider(mlClusterClient),
-    ...newJobChartsProvider(mlClusterClient),
-    ...topCategoriesProvider(mlClusterClient),
-    ...modelSnapshotProvider(mlClusterClient),
+    ...datafeedsProvider(client),
+    ...jobsProvider(client),
+    ...groupsProvider(client),
+    ...newJobCapsProvider(client),
+    ...newJobChartsProvider(client),
+    ...topCategoriesProvider(client),
+    ...modelSnapshotProvider(client),
   };
 }
diff --git a/x-pack/plugins/ml/server/models/job_service/jobs.ts b/x-pack/plugins/ml/server/models/job_service/jobs.ts
index 0aa1cfdae13c7f..e047d31ba6eb79 100644
--- a/x-pack/plugins/ml/server/models/job_service/jobs.ts
+++ b/x-pack/plugins/ml/server/models/job_service/jobs.ts
@@ -7,7 +7,7 @@
 import { i18n } from '@kbn/i18n';
 import { uniq } from 'lodash';
 import Boom from 'boom';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { parseTimeIntervalForJob } from '../../../common/util/job_utils';
 import { JOB_STATE, DATAFEED_STATE } from '../../../common/constants/states';
 import {
@@ -22,7 +22,7 @@ import { GLOBAL_CALENDAR } from '../../../common/constants/calendars';
 import { datafeedsProvider, MlDatafeedsResponse, MlDatafeedsStatsResponse } from './datafeeds';
 import { jobAuditMessagesProvider } from '../job_audit_messages';
 import { resultsServiceProvider } from '../results_service';
-import { CalendarManager, Calendar } from '../calendar';
+import { CalendarManager } from '../calendar';
 import { fillResultsWithTimeouts, isRequestTimeout } from './error_utils';
 import {
   getEarliestDatafeedStartTime,
@@ -47,16 +47,16 @@ interface Results {
   };
 }
 
-export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
-  const { callAsInternalUser } = mlClusterClient;
+export function jobsProvider(client: IScopedClusterClient) {
+  const { asInternalUser } = client;
 
-  const { forceDeleteDatafeed, getDatafeedIdsByJobId } = datafeedsProvider(mlClusterClient);
-  const { getAuditMessagesSummary } = jobAuditMessagesProvider(mlClusterClient);
-  const { getLatestBucketTimestampByJob } = resultsServiceProvider(mlClusterClient);
-  const calMngr = new CalendarManager(mlClusterClient);
+  const { forceDeleteDatafeed, getDatafeedIdsByJobId } = datafeedsProvider(client);
+  const { getAuditMessagesSummary } = jobAuditMessagesProvider(client);
+  const { getLatestBucketTimestampByJob } = resultsServiceProvider(client);
+  const calMngr = new CalendarManager(client);
 
   async function forceDeleteJob(jobId: string) {
-    return callAsInternalUser('ml.deleteJob', { jobId, force: true });
+    return asInternalUser.ml.deleteJob({ job_id: jobId, force: true, wait_for_completion: false });
   }
 
   async function deleteJobs(jobIds: string[]) {
@@ -78,7 +78,7 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
             if (isRequestTimeout(error)) {
               return fillResultsWithTimeouts(results, jobId, jobIds, DATAFEED_STATE.DELETED);
             }
-            results[jobId] = { deleted: false, error };
+            results[jobId] = { deleted: false, error: error.body };
           }
         }
       } catch (error) {
@@ -90,7 +90,7 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
             DATAFEED_STATE.DELETED
           );
         }
-        results[jobId] = { deleted: false, error };
+        results[jobId] = { deleted: false, error: error.body };
       }
     }
     return results;
@@ -100,7 +100,7 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
     const results: Results = {};
     for (const jobId of jobIds) {
       try {
-        await callAsInternalUser('ml.closeJob', { jobId });
+        await asInternalUser.ml.closeJob({ job_id: jobId });
         results[jobId] = { closed: true };
       } catch (error) {
         if (isRequestTimeout(error)) {
@@ -109,23 +109,23 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
 
         if (
           error.statusCode === 409 &&
-          error.response &&
-          error.response.includes('datafeed') === false
+          error.body.error?.reason &&
+          error.body.error.reason.includes('datafeed') === false
         ) {
           // the close job request may fail (409) if the job has failed or if the datafeed hasn't been stopped.
           // if the job has failed we want to attempt a force close.
           // however, if we received a 409 due to the datafeed being started we should not attempt a force close.
           try {
-            await callAsInternalUser('ml.closeJob', { jobId, force: true });
+            await asInternalUser.ml.closeJob({ job_id: jobId, force: true });
             results[jobId] = { closed: true };
           } catch (error2) {
-            if (isRequestTimeout(error)) {
+            if (isRequestTimeout(error2)) {
               return fillResultsWithTimeouts(results, jobId, jobIds, JOB_STATE.CLOSED);
             }
-            results[jobId] = { closed: false, error: error2 };
+            results[jobId] = { closed: false, error: error2.body };
           }
         } else {
-          results[jobId] = { closed: false, error };
+          results[jobId] = { closed: false, error: error.body };
         }
       }
     }
@@ -139,12 +139,12 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
       throw Boom.notFound(`Cannot find datafeed for job ${jobId}`);
     }
 
-    const dfResult = await callAsInternalUser('ml.stopDatafeed', { datafeedId, force: true });
-    if (!dfResult || dfResult.stopped !== true) {
+    const { body } = await asInternalUser.ml.stopDatafeed({ datafeed_id: datafeedId, force: true });
+    if (body.stopped !== true) {
       return { success: false };
     }
 
-    await callAsInternalUser('ml.closeJob', { jobId, force: true });
+    await asInternalUser.ml.closeJob({ job_id: jobId, force: true });
 
     return { success: true };
   }
@@ -256,41 +256,26 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
     const calendarsByJobId: { [jobId: string]: string[] } = {};
     const globalCalendars: string[] = [];
 
-    const requests: [
-      Promise<MlJobsResponse>,
-      Promise<MlJobsStatsResponse>,
-      Promise<MlDatafeedsResponse>,
-      Promise<MlDatafeedsStatsResponse>,
-      Promise<Calendar[]>,
-      Promise<{ [id: string]: number | undefined }>
-    ] = [
-      jobIds.length > 0
-        ? (callAsInternalUser('ml.jobs', { jobId: jobIds }) as Promise<MlJobsResponse>) // move length check in  side call
-        : (callAsInternalUser('ml.jobs') as Promise<MlJobsResponse>),
-      jobIds.length > 0
-        ? (callAsInternalUser('ml.jobStats', { jobId: jobIds }) as Promise<MlJobsStatsResponse>)
-        : (callAsInternalUser('ml.jobStats') as Promise<MlJobsStatsResponse>),
-      callAsInternalUser('ml.datafeeds') as Promise<MlDatafeedsResponse>,
-      callAsInternalUser('ml.datafeedStats') as Promise<MlDatafeedsStatsResponse>,
-      calMngr.getAllCalendars(),
-      getLatestBucketTimestampByJob(),
-    ];
-
+    const jobIdsString = jobIds.join();
     const [
-      jobResults,
-      jobStatsResults,
-      datafeedResults,
-      datafeedStatsResults,
+      { body: jobResults },
+      { body: jobStatsResults },
+      { body: datafeedResults },
+      { body: datafeedStatsResults },
       calendarResults,
       latestBucketTimestampByJob,
-    ] = await Promise.all<
-      MlJobsResponse,
-      MlJobsStatsResponse,
-      MlDatafeedsResponse,
-      MlDatafeedsStatsResponse,
-      Calendar[],
-      { [id: string]: number | undefined }
-    >(requests);
+    ] = await Promise.all([
+      asInternalUser.ml.getJobs<MlJobsResponse>(
+        jobIds.length > 0 ? { job_id: jobIdsString } : undefined
+      ),
+      asInternalUser.ml.getJobStats<MlJobsStatsResponse>(
+        jobIds.length > 0 ? { job_id: jobIdsString } : undefined
+      ),
+      asInternalUser.ml.getDatafeeds<MlDatafeedsResponse>(),
+      asInternalUser.ml.getDatafeedStats<MlDatafeedsStatsResponse>(),
+      calMngr.getAllCalendars(),
+      getLatestBucketTimestampByJob(),
+    ]);
 
     if (datafeedResults && datafeedResults.datafeeds) {
       datafeedResults.datafeeds.forEach((datafeed) => {
@@ -400,9 +385,9 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
     const detailed = true;
     const jobIds = [];
     try {
-      const tasksList = await callAsInternalUser('tasks.list', { actions, detailed });
-      Object.keys(tasksList.nodes).forEach((nodeId) => {
-        const tasks = tasksList.nodes[nodeId].tasks;
+      const { body } = await asInternalUser.tasks.list({ actions, detailed });
+      Object.keys(body.nodes).forEach((nodeId) => {
+        const tasks = body.nodes[nodeId].tasks;
         Object.keys(tasks).forEach((taskId) => {
           jobIds.push(tasks[taskId].description.replace(/^delete-job-/, ''));
         });
@@ -410,7 +395,9 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
     } catch (e) {
       // if the user doesn't have permission to load the task list,
       // use the jobs list to get the ids of deleting jobs
-      const { jobs } = (await callAsInternalUser('ml.jobs')) as MlJobsResponse;
+      const {
+        body: { jobs },
+      } = await asInternalUser.ml.getJobs<MlJobsResponse>();
       jobIds.push(...jobs.filter((j) => j.deleting === true).map((j) => j.job_id));
     }
     return { jobIds };
@@ -421,13 +408,13 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
   // e.g. *_low_request_rate_ecs
   async function jobsExist(jobIds: string[] = []) {
     // Get the list of job IDs.
-    const jobsInfo = (await callAsInternalUser('ml.jobs', {
-      jobId: jobIds,
-    })) as MlJobsResponse;
+    const { body } = await asInternalUser.ml.getJobs<MlJobsResponse>({
+      job_id: jobIds.join(),
+    });
 
     const results: { [id: string]: boolean } = {};
-    if (jobsInfo.count > 0) {
-      const allJobIds = jobsInfo.jobs.map((job) => job.job_id);
+    if (body.count > 0) {
+      const allJobIds = body.jobs.map((job) => job.job_id);
 
       // Check if each of the supplied IDs match existing jobs.
       jobIds.forEach((jobId) => {
@@ -446,9 +433,9 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
   }
 
   async function getAllJobAndGroupIds() {
-    const { getAllGroups } = groupsProvider(mlClusterClient);
-    const jobs = (await callAsInternalUser('ml.jobs')) as MlJobsResponse;
-    const jobIds = jobs.jobs.map((job) => job.job_id);
+    const { getAllGroups } = groupsProvider(client);
+    const { body } = await asInternalUser.ml.getJobs<MlJobsResponse>();
+    const jobIds = body.jobs.map((job) => job.job_id);
     const groups = await getAllGroups();
     const groupIds = groups.map((group) => group.id);
 
@@ -460,13 +447,13 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
 
   async function getLookBackProgress(jobId: string, start: number, end: number) {
     const datafeedId = `datafeed-${jobId}`;
-    const [jobStats, isRunning] = await Promise.all([
-      callAsInternalUser('ml.jobStats', { jobId: [jobId] }) as Promise<MlJobsStatsResponse>,
+    const [{ body }, isRunning] = await Promise.all([
+      asInternalUser.ml.getJobStats<MlJobsStatsResponse>({ job_id: jobId }),
       isDatafeedRunning(datafeedId),
     ]);
 
-    if (jobStats.jobs.length) {
-      const statsForJob = jobStats.jobs[0];
+    if (body.jobs.length) {
+      const statsForJob = body.jobs[0];
       const time = statsForJob.data_counts.latest_record_timestamp;
       const progress = (time - start) / (end - start);
       const isJobClosed = statsForJob.state === JOB_STATE.CLOSED;
@@ -480,11 +467,11 @@ export function jobsProvider(mlClusterClient: ILegacyScopedClusterClient) {
   }
 
   async function isDatafeedRunning(datafeedId: string) {
-    const stats = (await callAsInternalUser('ml.datafeedStats', {
-      datafeedId: [datafeedId],
-    })) as MlDatafeedsStatsResponse;
-    if (stats.datafeeds.length) {
-      const state = stats.datafeeds[0].state;
+    const { body } = await asInternalUser.ml.getDatafeedStats<MlDatafeedsStatsResponse>({
+      datafeed_id: datafeedId,
+    });
+    if (body.datafeeds.length) {
+      const state = body.datafeeds[0].state;
       return (
         state === DATAFEED_STATE.STARTED ||
         state === DATAFEED_STATE.STARTING ||
diff --git a/x-pack/plugins/ml/server/models/job_service/model_snapshots.ts b/x-pack/plugins/ml/server/models/job_service/model_snapshots.ts
index 576d6f8cbb1600..34206a68ffeb9e 100644
--- a/x-pack/plugins/ml/server/models/job_service/model_snapshots.ts
+++ b/x-pack/plugins/ml/server/models/job_service/model_snapshots.ts
@@ -6,7 +6,7 @@
 
 import Boom from 'boom';
 import { i18n } from '@kbn/i18n';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { ModelSnapshot } from '../../../common/types/anomaly_detection_jobs';
 import { datafeedsProvider } from './datafeeds';
 import { FormCalendar, CalendarManager } from '../calendar';
@@ -19,9 +19,9 @@ export interface RevertModelSnapshotResponse {
   model: ModelSnapshot;
 }
 
-export function modelSnapshotProvider(mlClusterClient: ILegacyScopedClusterClient) {
-  const { callAsInternalUser } = mlClusterClient;
-  const { forceStartDatafeeds, getDatafeedIdsByJobId } = datafeedsProvider(mlClusterClient);
+export function modelSnapshotProvider(client: IScopedClusterClient) {
+  const { asInternalUser } = client;
+  const { forceStartDatafeeds, getDatafeedIdsByJobId } = datafeedsProvider(client);
 
   async function revertModelSnapshot(
     jobId: string,
@@ -33,13 +33,13 @@ export function modelSnapshotProvider(mlClusterClient: ILegacyScopedClusterClien
   ) {
     let datafeedId = `datafeed-${jobId}`;
     // ensure job exists
-    await callAsInternalUser('ml.jobs', { jobId: [jobId] });
+    await asInternalUser.ml.getJobs({ job_id: jobId });
 
     try {
       // ensure the datafeed exists
       // the datafeed is probably called datafeed-<jobId>
-      await callAsInternalUser('ml.datafeeds', {
-        datafeedId: [datafeedId],
+      await asInternalUser.ml.getDatafeeds({
+        datafeed_id: datafeedId,
       });
     } catch (e) {
       // if the datafeed isn't called datafeed-<jobId>
@@ -52,19 +52,21 @@ export function modelSnapshotProvider(mlClusterClient: ILegacyScopedClusterClien
     }
 
     // ensure the snapshot exists
-    const snapshot = (await callAsInternalUser('ml.modelSnapshots', {
-      jobId,
-      snapshotId,
-    })) as ModelSnapshotsResponse;
+    const { body: snapshot } = await asInternalUser.ml.getModelSnapshots<ModelSnapshotsResponse>({
+      job_id: jobId,
+      snapshot_id: snapshotId,
+    });
 
     // apply the snapshot revert
-    const { model } = (await callAsInternalUser('ml.revertModelSnapshot', {
-      jobId,
-      snapshotId,
+    const {
+      body: { model },
+    } = await asInternalUser.ml.revertModelSnapshot<RevertModelSnapshotResponse>({
+      job_id: jobId,
+      snapshot_id: snapshotId,
       body: {
         delete_intervening_results: deleteInterveningResults,
       },
-    })) as RevertModelSnapshotResponse;
+    });
 
     // create calendar (if specified) and replay datafeed
     if (replay && model.snapshot_id === snapshotId && snapshot.model_snapshots.length) {
@@ -85,7 +87,7 @@ export function modelSnapshotProvider(mlClusterClient: ILegacyScopedClusterClien
             end_time: s.end,
           })),
         };
-        const cm = new CalendarManager(mlClusterClient);
+        const cm = new CalendarManager(client);
         await cm.newCalendar(calendar);
       }
 
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job/categorization/examples.ts b/x-pack/plugins/ml/server/models/job_service/new_job/categorization/examples.ts
index ca3e0cef21049a..6b9f30b2ae00bb 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job/categorization/examples.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job/categorization/examples.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { chunk } from 'lodash';
 import { SearchResponse } from 'elasticsearch';
 import { CATEGORY_EXAMPLES_SAMPLE_SIZE } from '../../../../../common/constants/categorization_job';
@@ -18,9 +18,9 @@ import { ValidationResults } from './validation_results';
 const CHUNK_SIZE = 100;
 
 export function categorizationExamplesProvider({
-  callAsCurrentUser,
-  callAsInternalUser,
-}: ILegacyScopedClusterClient) {
+  asCurrentUser,
+  asInternalUser,
+}: IScopedClusterClient) {
   const validationResults = new ValidationResults();
 
   async function categorizationExamples(
@@ -57,7 +57,7 @@ export function categorizationExamplesProvider({
       }
     }
 
-    const results: SearchResponse<{ [id: string]: string }> = await callAsCurrentUser('search', {
+    const { body } = await asCurrentUser.search<SearchResponse<{ [id: string]: string }>>({
       index: indexPatternTitle,
       size,
       body: {
@@ -67,7 +67,7 @@ export function categorizationExamplesProvider({
       },
     });
 
-    const tempExamples = results.hits.hits.map(({ _source }) => _source[categorizationFieldName]);
+    const tempExamples = body.hits.hits.map(({ _source }) => _source[categorizationFieldName]);
 
     validationResults.createNullValueResult(tempExamples);
 
@@ -112,7 +112,9 @@ export function categorizationExamplesProvider({
   }
 
   async function loadTokens(examples: string[], analyzer: CategorizationAnalyzer) {
-    const { tokens }: { tokens: Token[] } = await callAsInternalUser('indices.analyze', {
+    const {
+      body: { tokens },
+    } = await asInternalUser.indices.analyze<{ tokens: Token[] }>({
       body: {
         ...getAnalyzer(analyzer),
         text: examples,
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job/categorization/top_categories.ts b/x-pack/plugins/ml/server/models/job_service/new_job/categorization/top_categories.ts
index 5ade86806f3839..347afec8ef73cc 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job/categorization/top_categories.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job/categorization/top_categories.ts
@@ -5,13 +5,13 @@
  */
 
 import { SearchResponse } from 'elasticsearch';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { ML_RESULTS_INDEX_PATTERN } from '../../../../../common/constants/index_patterns';
 import { CategoryId, Category } from '../../../../../common/types/categories';
 
-export function topCategoriesProvider({ callAsInternalUser }: ILegacyScopedClusterClient) {
-  async function getTotalCategories(jobId: string): Promise<{ total: number }> {
-    const totalResp = await callAsInternalUser('search', {
+export function topCategoriesProvider({ asInternalUser }: IScopedClusterClient) {
+  async function getTotalCategories(jobId: string): Promise<number> {
+    const { body } = await asInternalUser.search<SearchResponse<any>>({
       index: ML_RESULTS_INDEX_PATTERN,
       size: 0,
       body: {
@@ -33,11 +33,12 @@ export function topCategoriesProvider({ callAsInternalUser }: ILegacyScopedClust
         },
       },
     });
-    return totalResp?.hits?.total?.value ?? 0;
+    // @ts-ignore total is an object here
+    return body?.hits?.total?.value ?? 0;
   }
 
   async function getTopCategoryCounts(jobId: string, numberOfCategories: number) {
-    const top: SearchResponse<any> = await callAsInternalUser('search', {
+    const { body } = await asInternalUser.search<SearchResponse<any>>({
       index: ML_RESULTS_INDEX_PATTERN,
       size: 0,
       body: {
@@ -76,7 +77,7 @@ export function topCategoriesProvider({ callAsInternalUser }: ILegacyScopedClust
     const catCounts: Array<{
       id: CategoryId;
       count: number;
-    }> = top.aggregations?.cat_count?.buckets.map((c: any) => ({
+    }> = body.aggregations?.cat_count?.buckets.map((c: any) => ({
       id: c.key,
       count: c.doc_count,
     }));
@@ -99,7 +100,7 @@ export function topCategoriesProvider({ callAsInternalUser }: ILegacyScopedClust
             field: 'category_id',
           },
         };
-    const result: SearchResponse<any> = await callAsInternalUser('search', {
+    const { body } = await asInternalUser.search<SearchResponse<any>>({
       index: ML_RESULTS_INDEX_PATTERN,
       size,
       body: {
@@ -118,7 +119,7 @@ export function topCategoriesProvider({ callAsInternalUser }: ILegacyScopedClust
       },
     });
 
-    return result.hits.hits?.map((c: { _source: Category }) => c._source) || [];
+    return body.hits.hits?.map((c: { _source: Category }) => c._source) || [];
   }
 
   async function topCategories(jobId: string, numberOfCategories: number) {
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job/categorization/validation_results.ts b/x-pack/plugins/ml/server/models/job_service/new_job/categorization/validation_results.ts
index 4b90283a3a966f..60595ccedff45e 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job/categorization/validation_results.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job/categorization/validation_results.ts
@@ -144,7 +144,7 @@ export class ValidationResults {
       this.createPrivilegesErrorResult(error);
       return;
     }
-    const message: string = error.message;
+    const message: string = error.body.error?.reason;
     if (message) {
       const rxp = /exceeded the allowed maximum of \[(\d+?)\]/;
       const match = rxp.exec(message);
@@ -170,7 +170,7 @@ export class ValidationResults {
   }
 
   public createPrivilegesErrorResult(error: any) {
-    const message: string = error.message;
+    const message: string = error.body.error?.reason;
     if (message) {
       this._results.push({
         id: VALIDATION_RESULT.INSUFFICIENT_PRIVILEGES,
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job/charts.ts b/x-pack/plugins/ml/server/models/job_service/new_job/charts.ts
index 63ae2c624ac381..da7d8d0577e4e6 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job/charts.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job/charts.ts
@@ -4,13 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { newJobLineChartProvider } from './line_chart';
 import { newJobPopulationChartProvider } from './population_chart';
 
-export function newJobChartsProvider(mlClusterClient: ILegacyScopedClusterClient) {
-  const { newJobLineChart } = newJobLineChartProvider(mlClusterClient);
-  const { newJobPopulationChart } = newJobPopulationChartProvider(mlClusterClient);
+export function newJobChartsProvider(client: IScopedClusterClient) {
+  const { newJobLineChart } = newJobLineChartProvider(client);
+  const { newJobPopulationChart } = newJobPopulationChartProvider(client);
 
   return {
     newJobLineChart,
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job/line_chart.ts b/x-pack/plugins/ml/server/models/job_service/new_job/line_chart.ts
index 3080b37867de52..9eea1ea2a28ae9 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job/line_chart.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job/line_chart.ts
@@ -5,7 +5,7 @@
  */
 
 import { get } from 'lodash';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { AggFieldNamePair, EVENT_RATE_FIELD_ID } from '../../../../common/types/fields';
 import { ML_MEDIAN_PERCENTS } from '../../../../common/util/job_utils';
 
@@ -23,7 +23,7 @@ interface ProcessedResults {
   totalResults: number;
 }
 
-export function newJobLineChartProvider({ callAsCurrentUser }: ILegacyScopedClusterClient) {
+export function newJobLineChartProvider({ asCurrentUser }: IScopedClusterClient) {
   async function newJobLineChart(
     indexPatternTitle: string,
     timeField: string,
@@ -47,9 +47,9 @@ export function newJobLineChartProvider({ callAsCurrentUser }: ILegacyScopedClus
       splitFieldValue
     );
 
-    const results = await callAsCurrentUser('search', json);
+    const { body } = await asCurrentUser.search(json);
     return processSearchResults(
-      results,
+      body,
       aggFieldNamePairs.map((af) => af.field)
     );
   }
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job/population_chart.ts b/x-pack/plugins/ml/server/models/job_service/new_job/population_chart.ts
index ab75787a0069f0..567afec8094054 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job/population_chart.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job/population_chart.ts
@@ -5,7 +5,7 @@
  */
 
 import { get } from 'lodash';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { AggFieldNamePair, EVENT_RATE_FIELD_ID } from '../../../../common/types/fields';
 import { ML_MEDIAN_PERCENTS } from '../../../../common/util/job_utils';
 
@@ -29,7 +29,7 @@ interface ProcessedResults {
   totalResults: number;
 }
 
-export function newJobPopulationChartProvider({ callAsCurrentUser }: ILegacyScopedClusterClient) {
+export function newJobPopulationChartProvider({ asCurrentUser }: IScopedClusterClient) {
   async function newJobPopulationChart(
     indexPatternTitle: string,
     timeField: string,
@@ -51,15 +51,11 @@ export function newJobPopulationChartProvider({ callAsCurrentUser }: ILegacyScop
       splitFieldName
     );
 
-    try {
-      const results = await callAsCurrentUser('search', json);
-      return processSearchResults(
-        results,
-        aggFieldNamePairs.map((af) => af.field)
-      );
-    } catch (error) {
-      return { error };
-    }
+    const { body } = await asCurrentUser.search(json);
+    return processSearchResults(
+      body,
+      aggFieldNamePairs.map((af) => af.field)
+    );
   }
 
   return {
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job_caps/field_service.ts b/x-pack/plugins/ml/server/models/job_service/new_job_caps/field_service.ts
index fd20610450cc17..c3b1de64c3eb5e 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job_caps/field_service.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job_caps/field_service.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { cloneDeep } from 'lodash';
 import { SavedObjectsClientContract } from 'kibana/server';
 import {
@@ -40,35 +40,36 @@ const supportedTypes: string[] = [
 export function fieldServiceProvider(
   indexPattern: string,
   isRollup: boolean,
-  mlClusterClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   savedObjectsClient: SavedObjectsClientContract
 ) {
-  return new FieldsService(indexPattern, isRollup, mlClusterClient, savedObjectsClient);
+  return new FieldsService(indexPattern, isRollup, client, savedObjectsClient);
 }
 
 class FieldsService {
   private _indexPattern: string;
   private _isRollup: boolean;
-  private _mlClusterClient: ILegacyScopedClusterClient;
+  private _mlClusterClient: IScopedClusterClient;
   private _savedObjectsClient: SavedObjectsClientContract;
 
   constructor(
     indexPattern: string,
     isRollup: boolean,
-    mlClusterClient: ILegacyScopedClusterClient,
+    client: IScopedClusterClient,
     savedObjectsClient: SavedObjectsClientContract
   ) {
     this._indexPattern = indexPattern;
     this._isRollup = isRollup;
-    this._mlClusterClient = mlClusterClient;
+    this._mlClusterClient = client;
     this._savedObjectsClient = savedObjectsClient;
   }
 
   private async loadFieldCaps(): Promise<any> {
-    return this._mlClusterClient.callAsCurrentUser('fieldCaps', {
+    const { body } = await this._mlClusterClient.asCurrentUser.fieldCaps({
       index: this._indexPattern,
       fields: '*',
     });
+    return body;
   }
 
   // create field object from the results from _field_caps
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.test.ts b/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.test.ts
index 38d6481e02a742..891cb2e0d1e64b 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.test.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.test.ts
@@ -21,28 +21,23 @@ describe('job_service - job_caps', () => {
   let savedObjectsClientMock: any;
 
   beforeEach(() => {
-    const callAsNonRollupMock = jest.fn((action: string) => {
-      switch (action) {
-        case 'fieldCaps':
-          return farequoteFieldCaps;
-      }
-    });
+    const asNonRollupMock = {
+      fieldCaps: jest.fn(() => ({ body: farequoteFieldCaps })),
+    };
+
     mlClusterClientNonRollupMock = {
-      callAsCurrentUser: callAsNonRollupMock,
-      callAsInternalUser: callAsNonRollupMock,
+      asCurrentUser: asNonRollupMock,
+      asInternalUser: asNonRollupMock,
+    };
+
+    const callAsRollupMock = {
+      fieldCaps: jest.fn(() => ({ body: cloudwatchFieldCaps })),
+      rollup: { getRollupIndexCaps: jest.fn(() => Promise.resolve({ body: rollupCaps })) },
     };
 
-    const callAsRollupMock = jest.fn((action: string) => {
-      switch (action) {
-        case 'fieldCaps':
-          return cloudwatchFieldCaps;
-        case 'ml.rollupIndexCapabilities':
-          return Promise.resolve(rollupCaps);
-      }
-    });
     mlClusterClientRollupMock = {
-      callAsCurrentUser: callAsRollupMock,
-      callAsInternalUser: callAsRollupMock,
+      asCurrentUser: callAsRollupMock,
+      asInternalUser: callAsRollupMock,
     };
 
     savedObjectsClientMock = {
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.ts b/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.ts
index 5616dade53a787..7559111d012d0d 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job_caps/new_job_caps.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient, SavedObjectsClientContract } from 'kibana/server';
+import { IScopedClusterClient, SavedObjectsClientContract } from 'kibana/server';
 import { Aggregation, Field, NewJobCaps } from '../../../../common/types/fields';
 import { fieldServiceProvider } from './field_service';
 
@@ -12,18 +12,13 @@ interface NewJobCapsResponse {
   [indexPattern: string]: NewJobCaps;
 }
 
-export function newJobCapsProvider(mlClusterClient: ILegacyScopedClusterClient) {
+export function newJobCapsProvider(client: IScopedClusterClient) {
   async function newJobCaps(
     indexPattern: string,
     isRollup: boolean = false,
     savedObjectsClient: SavedObjectsClientContract
   ): Promise<NewJobCapsResponse> {
-    const fieldService = fieldServiceProvider(
-      indexPattern,
-      isRollup,
-      mlClusterClient,
-      savedObjectsClient
-    );
+    const fieldService = fieldServiceProvider(indexPattern, isRollup, client, savedObjectsClient);
     const { aggs, fields } = await fieldService.getData();
     convertForStringify(aggs, fields);
 
diff --git a/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts b/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts
index f3a9bd49c27d6e..b7f4c8af62283d 100644
--- a/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts
+++ b/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { SavedObject } from 'kibana/server';
 import { IndexPatternAttributes } from 'src/plugins/data/server';
 import { SavedObjectsClientContract } from 'kibana/server';
@@ -22,7 +22,7 @@ export interface RollupJob {
 
 export async function rollupServiceProvider(
   indexPattern: string,
-  { callAsCurrentUser }: ILegacyScopedClusterClient,
+  { asCurrentUser }: IScopedClusterClient,
   savedObjectsClient: SavedObjectsClientContract
 ) {
   const rollupIndexPatternObject = await loadRollupIndexPattern(indexPattern, savedObjectsClient);
@@ -32,8 +32,8 @@ export async function rollupServiceProvider(
     if (rollupIndexPatternObject !== null) {
       const parsedTypeMetaData = JSON.parse(rollupIndexPatternObject.attributes.typeMeta);
       const rollUpIndex: string = parsedTypeMetaData.params.rollup_index;
-      const rollupCaps = await callAsCurrentUser('ml.rollupIndexCapabilities', {
-        indexPattern: rollUpIndex,
+      const { body: rollupCaps } = await asCurrentUser.rollup.getRollupIndexCaps({
+        index: rollUpIndex,
       });
 
       const indexRollupCaps = rollupCaps[rollUpIndex];
diff --git a/x-pack/plugins/ml/server/models/job_validation/job_validation.test.ts b/x-pack/plugins/ml/server/models/job_validation/job_validation.test.ts
index 1c74953e4dda94..810d0ae9dcd871 100644
--- a/x-pack/plugins/ml/server/models/job_validation/job_validation.test.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/job_validation.test.ts
@@ -4,48 +4,31 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 
 import { validateJob, ValidateJobPayload } from './job_validation';
 import { JobValidationMessage } from '../../../common/constants/messages';
 
-const mlClusterClient = ({
-  // mock callAsCurrentUser
-  callAsCurrentUser: (method: string) => {
-    return new Promise((resolve) => {
-      if (method === 'fieldCaps') {
-        resolve({ fields: [] });
-        return;
-      } else if (method === 'ml.info') {
-        resolve({
+const callAs = {
+  fieldCaps: () => Promise.resolve({ body: { fields: [] } }),
+  ml: {
+    info: () =>
+      Promise.resolve({
+        body: {
           limits: {
             effective_max_model_memory_limit: '100MB',
             max_model_memory_limit: '1GB',
           },
-        });
-      }
-      resolve({});
-    }) as Promise<any>;
+        },
+      }),
   },
+  search: () => Promise.resolve({ body: {} }),
+};
 
-  // mock callAsInternalUser
-  callAsInternalUser: (method: string) => {
-    return new Promise((resolve) => {
-      if (method === 'fieldCaps') {
-        resolve({ fields: [] });
-        return;
-      } else if (method === 'ml.info') {
-        resolve({
-          limits: {
-            effective_max_model_memory_limit: '100MB',
-            max_model_memory_limit: '1GB',
-          },
-        });
-      }
-      resolve({});
-    }) as Promise<any>;
-  },
-} as unknown) as ILegacyScopedClusterClient;
+const mlClusterClient = ({
+  asCurrentUser: callAs,
+  asInternalUser: callAs,
+} as unknown) as IScopedClusterClient;
 
 // Note: The tests cast `payload` as any
 // so we can simulate possible runtime payloads
diff --git a/x-pack/plugins/ml/server/models/job_validation/job_validation.ts b/x-pack/plugins/ml/server/models/job_validation/job_validation.ts
index 6692ecb22bd9e6..9e272f1f770fcd 100644
--- a/x-pack/plugins/ml/server/models/job_validation/job_validation.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/job_validation.ts
@@ -6,7 +6,7 @@
 
 import { i18n } from '@kbn/i18n';
 import Boom from 'boom';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { TypeOf } from '@kbn/config-schema';
 import { fieldsServiceProvider } from '../fields_service';
 import { renderTemplate } from '../../../common/util/string_utils';
@@ -34,7 +34,7 @@ export type ValidateJobPayload = TypeOf<typeof validateJobSchema>;
  * @kbn/config-schema has checked the payload {@link validateJobSchema}.
  */
 export async function validateJob(
-  mlClusterClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   payload: ValidateJobPayload,
   kbnVersion = 'current',
   isSecurityDisabled?: boolean
@@ -63,8 +63,8 @@ export async function validateJob(
       // if no duration was part of the request, fall back to finding out
       // the time range of the time field of the index, but also check first
       // if the time field is a valid field of type 'date' using isValidTimeField()
-      if (typeof duration === 'undefined' && (await isValidTimeField(mlClusterClient, job))) {
-        const fs = fieldsServiceProvider(mlClusterClient);
+      if (typeof duration === 'undefined' && (await isValidTimeField(client, job))) {
+        const fs = fieldsServiceProvider(client);
         const index = job.datafeed_config.indices.join(',');
         const timeField = job.data_description.time_field;
         const timeRange = await fs.getTimeFieldRange(index, timeField, job.datafeed_config.query);
@@ -79,24 +79,22 @@ export async function validateJob(
 
       // next run only the cardinality tests to find out if they trigger an error
       // so we can decide later whether certain additional tests should be run
-      const cardinalityMessages = await validateCardinality(mlClusterClient, job);
+      const cardinalityMessages = await validateCardinality(client, job);
       validationMessages.push(...cardinalityMessages);
       const cardinalityError = cardinalityMessages.some((m) => {
         return messages[m.id as MessageId].status === VALIDATION_STATUS.ERROR;
       });
 
       validationMessages.push(
-        ...(await validateBucketSpan(mlClusterClient, job, duration, isSecurityDisabled))
+        ...(await validateBucketSpan(client, job, duration, isSecurityDisabled))
       );
-      validationMessages.push(...(await validateTimeRange(mlClusterClient, job, duration)));
+      validationMessages.push(...(await validateTimeRange(client, job, duration)));
 
       // only run the influencer and model memory limit checks
       // if cardinality checks didn't return a message with an error level
       if (cardinalityError === false) {
         validationMessages.push(...(await validateInfluencers(job)));
-        validationMessages.push(
-          ...(await validateModelMemoryLimit(mlClusterClient, job, duration))
-        );
+        validationMessages.push(...(await validateModelMemoryLimit(client, job, duration)));
       }
     } else {
       validationMessages = basicValidation.messages;
diff --git a/x-pack/plugins/ml/server/models/job_validation/validate_bucket_span.js b/x-pack/plugins/ml/server/models/job_validation/validate_bucket_span.js
index 11f8d8967c4e0b..315ad09176571e 100644
--- a/x-pack/plugins/ml/server/models/job_validation/validate_bucket_span.js
+++ b/x-pack/plugins/ml/server/models/job_validation/validate_bucket_span.js
@@ -45,7 +45,7 @@ const pickBucketSpan = (bucketSpans) => {
   return bucketSpans[i];
 };
 
-export async function validateBucketSpan(mlClusterClient, job, duration) {
+export async function validateBucketSpan(client, job, duration) {
   validateJobObject(job);
 
   // if there is no duration, do not run the estimate test
@@ -117,7 +117,7 @@ export async function validateBucketSpan(mlClusterClient, job, duration) {
   try {
     const estimations = estimatorConfigs.map((data) => {
       return new Promise((resolve) => {
-        estimateBucketSpanFactory(mlClusterClient)(data)
+        estimateBucketSpanFactory(client)(data)
           .then(resolve)
           // this catch gets triggered when the estimation code runs without error
           // but isn't able to come up with a bucket span estimation.
diff --git a/x-pack/plugins/ml/server/models/job_validation/validate_bucket_span.test.ts b/x-pack/plugins/ml/server/models/job_validation/validate_bucket_span.test.ts
index f9145ab576d71e..80418d590af764 100644
--- a/x-pack/plugins/ml/server/models/job_validation/validate_bucket_span.test.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/validate_bucket_span.test.ts
@@ -24,12 +24,12 @@ import mockItSearchResponse from './__mocks__/mock_it_search_response.json';
 const mlClusterClientFactory = (mockSearchResponse: any) => {
   const callAs = () => {
     return new Promise((resolve) => {
-      resolve(mockSearchResponse);
+      resolve({ body: mockSearchResponse });
     });
   };
   return {
-    callAsCurrentUser: callAs,
-    callAsInternalUser: callAs,
+    asCurrentUser: callAs,
+    asInternalUser: callAs,
   };
 };
 
diff --git a/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.test.ts b/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.test.ts
index 16ee70ad9efde6..1be0751e15f227 100644
--- a/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.test.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.test.ts
@@ -6,7 +6,7 @@
 
 import cloneDeep from 'lodash/cloneDeep';
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 
 import { CombinedJob } from '../../../common/types/anomaly_detection_jobs';
 
@@ -24,21 +24,21 @@ const mockResponses = {
 const mlClusterClientFactory = (
   responses: Record<string, any>,
   fail = false
-): ILegacyScopedClusterClient => {
-  const callAs = (requestName: string) => {
-    return new Promise((resolve, reject) => {
-      const response = responses[requestName];
-      if (fail) {
-        reject(response);
-      } else {
-        resolve(response);
-      }
-    }) as Promise<any>;
+): IScopedClusterClient => {
+  const callAs = {
+    search: () => Promise.resolve({ body: responses.search }),
+    fieldCaps: () => Promise.resolve({ body: responses.fieldCaps }),
   };
-  return {
-    callAsCurrentUser: callAs,
-    callAsInternalUser: callAs,
+
+  const callAsFail = {
+    search: () => Promise.reject({ body: {} }),
+    fieldCaps: () => Promise.reject({ body: {} }),
   };
+
+  return ({
+    asCurrentUser: fail === false ? callAs : callAsFail,
+    asInternalUser: fail === false ? callAs : callAsFail,
+  } as unknown) as IScopedClusterClient;
 };
 
 describe('ML - validateCardinality', () => {
diff --git a/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.ts b/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.ts
index 1545c4c0062ec8..c5822b863c83da 100644
--- a/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { DataVisualizer } from '../data_visualizer';
 
 import { validateJobObject } from './validate_job_object';
@@ -43,12 +43,9 @@ type Validator = (obj: {
   messages: Messages;
 }>;
 
-const validateFactory = (
-  mlClusterClient: ILegacyScopedClusterClient,
-  job: CombinedJob
-): Validator => {
-  const { callAsCurrentUser } = mlClusterClient;
-  const dv = new DataVisualizer(mlClusterClient);
+const validateFactory = (client: IScopedClusterClient, job: CombinedJob): Validator => {
+  const { asCurrentUser } = client;
+  const dv = new DataVisualizer(client);
 
   const modelPlotConfigTerms = job?.model_plot_config?.terms ?? '';
   const modelPlotConfigFieldCount =
@@ -77,7 +74,7 @@ const validateFactory = (
         ] as string[];
 
         // use fieldCaps endpoint to get data about whether fields are aggregatable
-        const fieldCaps = await callAsCurrentUser('fieldCaps', {
+        const { body: fieldCaps } = await asCurrentUser.fieldCaps({
           index: job.datafeed_config.indices.join(','),
           fields: uniqueFieldNames,
         });
@@ -154,7 +151,7 @@ const validateFactory = (
 };
 
 export async function validateCardinality(
-  mlClusterClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   job?: CombinedJob
 ): Promise<Messages> | never {
   const messages: Messages = [];
@@ -174,7 +171,7 @@ export async function validateCardinality(
   }
 
   // validate({ type, isInvalid }) asynchronously returns an array of validation messages
-  const validate = validateFactory(mlClusterClient, job);
+  const validate = validateFactory(client, job);
 
   const modelPlotEnabled = job.model_plot_config?.enabled ?? false;
 
diff --git a/x-pack/plugins/ml/server/models/job_validation/validate_model_memory_limit.test.ts b/x-pack/plugins/ml/server/models/job_validation/validate_model_memory_limit.test.ts
index 6ffb0e320982bc..35792c66e66ece 100644
--- a/x-pack/plugins/ml/server/models/job_validation/validate_model_memory_limit.test.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/validate_model_memory_limit.test.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { CombinedJob, Detector } from '../../../common/types/anomaly_detection_jobs';
-import { ModelMemoryEstimate } from '../calculate_model_memory_limit/calculate_model_memory_limit';
+import { ModelMemoryEstimateResponse } from '../calculate_model_memory_limit/calculate_model_memory_limit';
 import { validateModelMemoryLimit } from './validate_model_memory_limit';
 
 describe('ML - validateModelMemoryLimit', () => {
@@ -65,44 +65,36 @@ describe('ML - validateModelMemoryLimit', () => {
   };
 
   // mock estimate model memory
-  const modelMemoryEstimateResponse: ModelMemoryEstimate = {
+  const modelMemoryEstimateResponse: ModelMemoryEstimateResponse = {
     model_memory_estimate: '40mb',
   };
 
   interface MockAPICallResponse {
-    'ml.estimateModelMemory'?: ModelMemoryEstimate;
+    'ml.estimateModelMemory'?: ModelMemoryEstimateResponse;
   }
 
-  // mock callAsCurrentUser
+  // mock asCurrentUser
   // used in three places:
   // - to retrieve the info endpoint
   // - to search for cardinality of split field
   // - to retrieve field capabilities used in search for split field cardinality
   const getMockMlClusterClient = ({
     'ml.estimateModelMemory': estimateModelMemory,
-  }: MockAPICallResponse = {}): ILegacyScopedClusterClient => {
-    const callAs = (call: string) => {
-      if (typeof call === undefined) {
-        return Promise.reject();
-      }
-
-      let response = {};
-      if (call === 'ml.info') {
-        response = mlInfoResponse;
-      } else if (call === 'search') {
-        response = cardinalitySearchResponse;
-      } else if (call === 'fieldCaps') {
-        response = fieldCapsResponse;
-      } else if (call === 'ml.estimateModelMemory') {
-        response = estimateModelMemory || modelMemoryEstimateResponse;
-      }
-      return Promise.resolve(response);
+  }: MockAPICallResponse = {}): IScopedClusterClient => {
+    const callAs = {
+      ml: {
+        info: () => Promise.resolve({ body: mlInfoResponse }),
+        estimateModelMemory: () =>
+          Promise.resolve({ body: estimateModelMemory || modelMemoryEstimateResponse }),
+      },
+      search: () => Promise.resolve({ body: cardinalitySearchResponse }),
+      fieldCaps: () => Promise.resolve({ body: fieldCapsResponse }),
     };
 
-    return {
-      callAsCurrentUser: callAs,
-      callAsInternalUser: callAs,
-    };
+    return ({
+      asCurrentUser: callAs,
+      asInternalUser: callAs,
+    } as unknown) as IScopedClusterClient;
   };
 
   function getJobConfig(influencers: string[] = [], detectors: Detector[] = []) {
diff --git a/x-pack/plugins/ml/server/models/job_validation/validate_model_memory_limit.ts b/x-pack/plugins/ml/server/models/job_validation/validate_model_memory_limit.ts
index 728342294c4247..9733e17e0f379b 100644
--- a/x-pack/plugins/ml/server/models/job_validation/validate_model_memory_limit.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/validate_model_memory_limit.ts
@@ -5,7 +5,7 @@
  */
 
 import numeral from '@elastic/numeral';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { CombinedJob } from '../../../common/types/anomaly_detection_jobs';
 import { validateJobObject } from './validate_job_object';
 import { calculateModelMemoryLimitProvider } from '../calculate_model_memory_limit';
@@ -16,11 +16,11 @@ import { MlInfoResponse } from '../../../common/types/ml_server_info';
 const MODEL_MEMORY_LIMIT_MINIMUM_BYTES = 1048576;
 
 export async function validateModelMemoryLimit(
-  mlClusterClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   job: CombinedJob,
   duration?: { start?: number; end?: number }
 ) {
-  const { callAsInternalUser } = mlClusterClient;
+  const { asInternalUser } = client;
   validateJobObject(job);
 
   // retrieve the model memory limit specified by the user in the job config.
@@ -52,12 +52,12 @@ export async function validateModelMemoryLimit(
 
   // retrieve the max_model_memory_limit value from the server
   // this will be unset unless the user has set this on their cluster
-  const info = (await callAsInternalUser('ml.info')) as MlInfoResponse;
-  const maxModelMemoryLimit = info.limits.max_model_memory_limit?.toUpperCase();
-  const effectiveMaxModelMemoryLimit = info.limits.effective_max_model_memory_limit?.toUpperCase();
+  const { body } = await asInternalUser.ml.info<MlInfoResponse>();
+  const maxModelMemoryLimit = body.limits.max_model_memory_limit?.toUpperCase();
+  const effectiveMaxModelMemoryLimit = body.limits.effective_max_model_memory_limit?.toUpperCase();
 
   if (runCalcModelMemoryTest) {
-    const { modelMemoryLimit } = await calculateModelMemoryLimitProvider(mlClusterClient)(
+    const { modelMemoryLimit } = await calculateModelMemoryLimitProvider(client)(
       job.analysis_config,
       job.datafeed_config.indices.join(','),
       job.datafeed_config.query,
diff --git a/x-pack/plugins/ml/server/models/job_validation/validate_time_range.test.ts b/x-pack/plugins/ml/server/models/job_validation/validate_time_range.test.ts
index a45be189ba3d8f..12458af0521a9a 100644
--- a/x-pack/plugins/ml/server/models/job_validation/validate_time_range.test.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/validate_time_range.test.ts
@@ -6,7 +6,7 @@
 
 import cloneDeep from 'lodash/cloneDeep';
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 
 import { CombinedJob } from '../../../common/types/anomaly_detection_jobs';
 
@@ -21,16 +21,15 @@ const mockSearchResponse = {
   search: mockTimeRange,
 };
 
-const mlClusterClientFactory = (resp: any): ILegacyScopedClusterClient => {
-  const callAs = (path: string) => {
-    return new Promise((resolve) => {
-      resolve(resp[path]);
-    }) as Promise<any>;
-  };
-  return {
-    callAsCurrentUser: callAs,
-    callAsInternalUser: callAs,
+const mlClusterClientFactory = (response: any): IScopedClusterClient => {
+  const callAs = {
+    fieldCaps: () => Promise.resolve({ body: response.fieldCaps }),
+    search: () => Promise.resolve({ body: response.search }),
   };
+  return ({
+    asCurrentUser: callAs,
+    asInternalUser: callAs,
+  } as unknown) as IScopedClusterClient;
 };
 
 function getMinimalValidJob() {
diff --git a/x-pack/plugins/ml/server/models/job_validation/validate_time_range.ts b/x-pack/plugins/ml/server/models/job_validation/validate_time_range.ts
index a94ceffa902732..83d9621898f96e 100644
--- a/x-pack/plugins/ml/server/models/job_validation/validate_time_range.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/validate_time_range.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { ES_FIELD_TYPES } from '../../../../../../src/plugins/data/server';
 import { parseInterval } from '../../../common/util/parse_interval';
 import { CombinedJob } from '../../../common/types/anomaly_detection_jobs';
@@ -26,15 +26,12 @@ const BUCKET_SPAN_COMPARE_FACTOR = 25;
 const MIN_TIME_SPAN_MS = 7200000;
 const MIN_TIME_SPAN_READABLE = '2 hours';
 
-export async function isValidTimeField(
-  { callAsCurrentUser }: ILegacyScopedClusterClient,
-  job: CombinedJob
-) {
+export async function isValidTimeField({ asCurrentUser }: IScopedClusterClient, job: CombinedJob) {
   const index = job.datafeed_config.indices.join(',');
   const timeField = job.data_description.time_field;
 
   // check if time_field is of type 'date' or 'date_nanos'
-  const fieldCaps = await callAsCurrentUser('fieldCaps', {
+  const { body: fieldCaps } = await asCurrentUser.fieldCaps({
     index,
     fields: [timeField],
   });
@@ -47,7 +44,7 @@ export async function isValidTimeField(
 }
 
 export async function validateTimeRange(
-  mlClientCluster: ILegacyScopedClusterClient,
+  mlClientCluster: IScopedClusterClient,
   job: CombinedJob,
   timeRange?: Partial<TimeRange>
 ) {
diff --git a/x-pack/plugins/ml/server/models/results_service/get_partition_fields_values.ts b/x-pack/plugins/ml/server/models/results_service/get_partition_fields_values.ts
index 9c0efe259844c1..76dc68d2b59e3d 100644
--- a/x-pack/plugins/ml/server/models/results_service/get_partition_fields_values.ts
+++ b/x-pack/plugins/ml/server/models/results_service/get_partition_fields_values.ts
@@ -5,7 +5,7 @@
  */
 
 import Boom from 'boom';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { PARTITION_FIELDS } from '../../../common/constants/anomalies';
 import { PartitionFieldsType } from '../../../common/types/anomalies';
 import { ML_RESULTS_INDEX_PATTERN } from '../../../common/constants/index_patterns';
@@ -74,9 +74,7 @@ function getFieldObject(fieldType: PartitionFieldsType, aggs: any) {
     : {};
 }
 
-export const getPartitionFieldsValuesFactory = ({
-  callAsInternalUser,
-}: ILegacyScopedClusterClient) =>
+export const getPartitionFieldsValuesFactory = ({ asInternalUser }: IScopedClusterClient) =>
   /**
    * Gets the record of partition fields with possible values that fit the provided queries.
    * @param jobId - Job ID
@@ -92,7 +90,7 @@ export const getPartitionFieldsValuesFactory = ({
     earliestMs: number,
     latestMs: number
   ) {
-    const jobsResponse = await callAsInternalUser('ml.jobs', { jobId: [jobId] });
+    const { body: jobsResponse } = await asInternalUser.ml.getJobs({ job_id: jobId });
     if (jobsResponse.count === 0 || jobsResponse.jobs === undefined) {
       throw Boom.notFound(`Job with the id "${jobId}" not found`);
     }
@@ -101,7 +99,7 @@ export const getPartitionFieldsValuesFactory = ({
 
     const isModelPlotEnabled = job?.model_plot_config?.enabled;
 
-    const resp = await callAsInternalUser('search', {
+    const { body } = await asInternalUser.search({
       index: ML_RESULTS_INDEX_PATTERN,
       size: 0,
       body: {
@@ -151,7 +149,7 @@ export const getPartitionFieldsValuesFactory = ({
     return PARTITION_FIELDS.reduce((acc, key) => {
       return {
         ...acc,
-        ...getFieldObject(key, resp.aggregations),
+        ...getFieldObject(key, body.aggregations),
       };
     }, {});
   };
diff --git a/x-pack/plugins/ml/server/models/results_service/results_service.ts b/x-pack/plugins/ml/server/models/results_service/results_service.ts
index 7be8bac61e69d1..190b5d99309d7d 100644
--- a/x-pack/plugins/ml/server/models/results_service/results_service.ts
+++ b/x-pack/plugins/ml/server/models/results_service/results_service.ts
@@ -9,7 +9,7 @@ import slice from 'lodash/slice';
 import get from 'lodash/get';
 import moment from 'moment';
 import { SearchResponse } from 'elasticsearch';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import Boom from 'boom';
 import { buildAnomalyTableItems } from './build_anomaly_table_items';
 import { ML_RESULTS_INDEX_PATTERN } from '../../../common/constants/index_patterns';
@@ -40,8 +40,8 @@ interface Influencer {
   fieldValue: any;
 }
 
-export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClient) {
-  const { callAsInternalUser } = mlClusterClient;
+export function resultsServiceProvider(client: IScopedClusterClient) {
+  const { asInternalUser } = client;
   // Obtains data for the anomalies table, aggregating anomalies by day or hour as requested.
   // Return an Object with properties 'anomalies' and 'interval' (interval used to aggregate anomalies,
   // one of day, hour or second. Note 'auto' can be provided as the aggregationInterval in the request,
@@ -144,7 +144,7 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
       });
     }
 
-    const resp: SearchResponse<any> = await callAsInternalUser('search', {
+    const { body } = await asInternalUser.search<SearchResponse<any>>({
       index: ML_RESULTS_INDEX_PATTERN,
       rest_total_hits_as_int: true,
       size: maxRecords,
@@ -178,9 +178,9 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
       anomalies: [],
       interval: 'second',
     };
-    if (resp.hits.total !== 0) {
+    if (body.hits.total !== 0) {
       let records: AnomalyRecordDoc[] = [];
-      resp.hits.hits.forEach((hit) => {
+      body.hits.hits.forEach((hit) => {
         records.push(hit._source);
       });
 
@@ -298,8 +298,8 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
       },
     };
 
-    const resp = await callAsInternalUser('search', query);
-    const maxScore = get(resp, ['aggregations', 'max_score', 'value'], null);
+    const { body } = await asInternalUser.search(query);
+    const maxScore = get(body, ['aggregations', 'max_score', 'value'], null);
 
     return { maxScore };
   }
@@ -336,7 +336,7 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
     // Size of job terms agg, consistent with maximum number of jobs supported by Java endpoints.
     const maxJobs = 10000;
 
-    const resp = await callAsInternalUser('search', {
+    const { body } = await asInternalUser.search({
       index: ML_RESULTS_INDEX_PATTERN,
       size: 0,
       body: {
@@ -364,7 +364,7 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
     });
 
     const bucketsByJobId: Array<{ key: string; maxTimestamp: { value?: number } }> = get(
-      resp,
+      body,
       ['aggregations', 'byJobId', 'buckets'],
       []
     );
@@ -380,7 +380,7 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
   // from the given index and job ID.
   // Returned response consists of a list of examples against category ID.
   async function getCategoryExamples(jobId: string, categoryIds: any, maxExamples: number) {
-    const resp = await callAsInternalUser('search', {
+    const { body } = await asInternalUser.search({
       index: ML_RESULTS_INDEX_PATTERN,
       rest_total_hits_as_int: true,
       size: ANOMALIES_TABLE_DEFAULT_QUERY_SIZE, // Matches size of records in anomaly summary table.
@@ -394,8 +394,8 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
     });
 
     const examplesByCategoryId: { [key: string]: any } = {};
-    if (resp.hits.total !== 0) {
-      resp.hits.hits.forEach((hit: any) => {
+    if (body.hits.total !== 0) {
+      body.hits.hits.forEach((hit: any) => {
         if (maxExamples) {
           examplesByCategoryId[hit._source.category_id] = slice(
             hit._source.examples,
@@ -415,7 +415,7 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
   // Returned response contains four properties - categoryId, regex, examples
   // and terms (space delimited String of the common tokens matched in values of the category).
   async function getCategoryDefinition(jobId: string, categoryId: string) {
-    const resp = await callAsInternalUser('search', {
+    const { body } = await asInternalUser.search({
       index: ML_RESULTS_INDEX_PATTERN,
       rest_total_hits_as_int: true,
       size: 1,
@@ -429,8 +429,8 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
     });
 
     const definition = { categoryId, terms: null, regex: null, examples: [] };
-    if (resp.hits.total !== 0) {
-      const source = resp.hits.hits[0]._source;
+    if (body.hits.total !== 0) {
+      const source = body.hits.hits[0]._source;
       definition.categoryId = source.category_id;
       definition.regex = source.regex;
       definition.terms = source.terms;
@@ -456,7 +456,7 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
         },
       });
     }
-    const results: SearchResponse<AnomalyCategorizerStatsDoc> = await callAsInternalUser('search', {
+    const { body } = await asInternalUser.search<SearchResponse<AnomalyCategorizerStatsDoc>>({
       index: ML_RESULTS_INDEX_PATTERN,
       body: {
         query: {
@@ -473,7 +473,7 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
         },
       },
     });
-    return results ? results.hits.hits.map((r) => r._source) : [];
+    return body ? body.hits.hits.map((r) => r._source) : [];
   }
 
   async function getCategoryStoppedPartitions(
@@ -485,15 +485,15 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
     };
     // first determine from job config if stop_on_warn is true
     // if false return []
-    const jobConfigResponse: MlJobsResponse = await callAsInternalUser('ml.jobs', {
-      jobId: jobIds,
+    const { body } = await asInternalUser.ml.getJobs<MlJobsResponse>({
+      job_id: jobIds.join(),
     });
 
-    if (!jobConfigResponse || jobConfigResponse.jobs.length < 1) {
+    if (!body || body.jobs.length < 1) {
       throw Boom.notFound(`Unable to find anomaly detector jobs ${jobIds.join(', ')}`);
     }
 
-    const jobIdsWithStopOnWarnSet = jobConfigResponse.jobs
+    const jobIdsWithStopOnWarnSet = body.jobs
       .filter(
         (jobConfig) =>
           jobConfig.analysis_config?.per_partition_categorization?.stop_on_warn === true
@@ -543,7 +543,7 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
           },
         },
       ];
-      const results: SearchResponse<any> = await callAsInternalUser('search', {
+      const { body: results } = await asInternalUser.search<SearchResponse<any>>({
         index: ML_RESULTS_INDEX_PATTERN,
         size: 0,
         body: {
@@ -594,7 +594,7 @@ export function resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClie
     getCategoryExamples,
     getLatestBucketTimestampByJob,
     getMaxAnomalyScore,
-    getPartitionFieldsValues: getPartitionFieldsValuesFactory(mlClusterClient),
+    getPartitionFieldsValues: getPartitionFieldsValuesFactory(client),
     getCategorizerStats,
     getCategoryStoppedPartitions,
   };
diff --git a/x-pack/plugins/ml/server/plugin.ts b/x-pack/plugins/ml/server/plugin.ts
index 76128341e6ddc8..39672f5b188bcf 100644
--- a/x-pack/plugins/ml/server/plugin.ts
+++ b/x-pack/plugins/ml/server/plugin.ts
@@ -9,18 +9,16 @@ import {
   CoreSetup,
   CoreStart,
   Plugin,
-  ILegacyScopedClusterClient,
   KibanaRequest,
   Logger,
   PluginInitializerContext,
-  ILegacyCustomClusterClient,
   CapabilitiesStart,
+  IClusterClient,
 } from 'kibana/server';
 import { PluginsSetup, RouteInitialization } from './types';
 import { PLUGIN_ID, PLUGIN_ICON } from '../common/constants/app';
 import { MlCapabilities } from '../common/types/capabilities';
 
-import { elasticsearchJsPlugin } from './client/elasticsearch_ml';
 import { initMlTelemetry } from './lib/telemetry';
 import { initMlServerLog } from './client/log';
 import { initSampleDataSets } from './lib/sample_data_sets';
@@ -50,17 +48,7 @@ import { setupCapabilitiesSwitcher } from './lib/capabilities';
 import { registerKibanaSettings } from './lib/register_settings';
 import { inferenceRoutes } from './routes/inference';
 
-declare module 'kibana/server' {
-  interface RequestHandlerContext {
-    [PLUGIN_ID]?: {
-      mlClient: ILegacyScopedClusterClient;
-    };
-  }
-}
-
-export interface MlPluginSetup extends SharedServices {
-  mlClient: ILegacyCustomClusterClient;
-}
+export type MlPluginSetup = SharedServices;
 export type MlPluginStart = void;
 
 export class MlServerPlugin implements Plugin<MlPluginSetup, MlPluginStart, PluginsSetup> {
@@ -68,6 +56,7 @@ export class MlServerPlugin implements Plugin<MlPluginSetup, MlPluginStart, Plug
   private version: string;
   private mlLicense: MlServerLicense;
   private capabilities: CapabilitiesStart | null = null;
+  private clusterClient: IClusterClient | null = null;
 
   constructor(ctx: PluginInitializerContext) {
     this.log = ctx.logger.get();
@@ -125,17 +114,6 @@ export class MlServerPlugin implements Plugin<MlPluginSetup, MlPluginStart, Plug
     // initialize capabilities switcher to add license filter to ml capabilities
     setupCapabilitiesSwitcher(coreSetup, plugins.licensing.license$, this.log);
 
-    // Can access via router's handler function 'context' parameter - context.ml.mlClient
-    const mlClient = coreSetup.elasticsearch.legacy.createClient(PLUGIN_ID, {
-      plugins: [elasticsearchJsPlugin],
-    });
-
-    coreSetup.http.registerRouteHandlerContext(PLUGIN_ID, (context, request) => {
-      return {
-        mlClient: mlClient.asScoped(request),
-      };
-    });
-
     const routeInit: RouteInitialization = {
       router: coreSetup.http.createRouter(),
       mlLicense: this.mlLicense,
@@ -176,13 +154,19 @@ export class MlServerPlugin implements Plugin<MlPluginSetup, MlPluginStart, Plug
     inferenceRoutes(routeInit);
 
     return {
-      ...createSharedServices(this.mlLicense, plugins.spaces, plugins.cloud, resolveMlCapabilities),
-      mlClient,
+      ...createSharedServices(
+        this.mlLicense,
+        plugins.spaces,
+        plugins.cloud,
+        resolveMlCapabilities,
+        () => this.clusterClient
+      ),
     };
   }
 
   public start(coreStart: CoreStart): MlPluginStart {
     this.capabilities = coreStart.capabilities;
+    this.clusterClient = coreStart.elasticsearch.client;
   }
 
   public stop() {
diff --git a/x-pack/plugins/ml/server/routes/annotations.ts b/x-pack/plugins/ml/server/routes/annotations.ts
index a6de80bb7e5e26..5c4b36164fbb0c 100644
--- a/x-pack/plugins/ml/server/routes/annotations.ts
+++ b/x-pack/plugins/ml/server/routes/annotations.ts
@@ -58,9 +58,9 @@ export function annotationRoutes(
         tags: ['access:ml:canGetAnnotations'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { getAnnotations } = annotationServiceProvider(legacyClient);
+        const { getAnnotations } = annotationServiceProvider(client);
         const resp = await getAnnotations(request.body);
 
         return response.ok({
@@ -91,14 +91,14 @@ export function annotationRoutes(
         tags: ['access:ml:canCreateAnnotation'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const annotationsFeatureAvailable = await isAnnotationsFeatureAvailable(legacyClient);
+        const annotationsFeatureAvailable = await isAnnotationsFeatureAvailable(client);
         if (annotationsFeatureAvailable === false) {
           throw getAnnotationsFeatureUnavailableErrorMessage();
         }
 
-        const { indexAnnotation } = annotationServiceProvider(legacyClient);
+        const { indexAnnotation } = annotationServiceProvider(client);
 
         const currentUser =
           securityPlugin !== undefined ? securityPlugin.authc.getCurrentUser(request) : {};
@@ -134,15 +134,15 @@ export function annotationRoutes(
         tags: ['access:ml:canDeleteAnnotation'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const annotationsFeatureAvailable = await isAnnotationsFeatureAvailable(legacyClient);
+        const annotationsFeatureAvailable = await isAnnotationsFeatureAvailable(client);
         if (annotationsFeatureAvailable === false) {
           throw getAnnotationsFeatureUnavailableErrorMessage();
         }
 
         const annotationId = request.params.annotationId;
-        const { deleteAnnotation } = annotationServiceProvider(legacyClient);
+        const { deleteAnnotation } = annotationServiceProvider(client);
         const resp = await deleteAnnotation(annotationId);
 
         return response.ok({
diff --git a/x-pack/plugins/ml/server/routes/anomaly_detectors.ts b/x-pack/plugins/ml/server/routes/anomaly_detectors.ts
index 0027bec910134d..251e465eafccc8 100644
--- a/x-pack/plugins/ml/server/routes/anomaly_detectors.ts
+++ b/x-pack/plugins/ml/server/routes/anomaly_detectors.ts
@@ -5,6 +5,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import { RequestParams } from '@elastic/elasticsearch';
 import { wrapError } from '../client/error_wrapper';
 import { RouteInitialization } from '../types';
 import {
@@ -20,6 +21,7 @@ import {
   getModelSnapshotsSchema,
   updateModelSnapshotSchema,
 } from './schemas/anomaly_detectors_schema';
+
 /**
  * Routes for the anomaly detectors
  */
@@ -42,11 +44,11 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ response, client }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.jobs');
+        const { body } = await client.asInternalUser.ml.getJobs();
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -73,12 +75,12 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { jobId } = request.params;
-        const results = await legacyClient.callAsInternalUser('ml.jobs', { jobId });
+        const { body } = await client.asInternalUser.ml.getJobs({ job_id: jobId });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -104,11 +106,11 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.jobStats');
+        const { body } = await client.asInternalUser.ml.getJobStats();
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -135,12 +137,12 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { jobId } = request.params;
-        const results = await legacyClient.callAsInternalUser('ml.jobStats', { jobId });
+        const { body } = await client.asInternalUser.ml.getJobStats({ job_id: jobId });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -171,15 +173,15 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { jobId } = request.params;
-        const results = await legacyClient.callAsInternalUser('ml.addJob', {
-          jobId,
+        const { body } = await client.asInternalUser.ml.putJob({
+          job_id: jobId,
           body: request.body,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -208,15 +210,15 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canUpdateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { jobId } = request.params;
-        const results = await legacyClient.callAsInternalUser('ml.updateJob', {
-          jobId,
+        const { body } = await client.asInternalUser.ml.updateJob({
+          job_id: jobId,
           body: request.body,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -243,14 +245,12 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canOpenJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { jobId } = request.params;
-        const results = await legacyClient.callAsInternalUser('ml.openJob', {
-          jobId,
-        });
+        const { body } = await client.asInternalUser.ml.openJob({ job_id: jobId });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -277,18 +277,18 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCloseJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const options: { jobId: string; force?: boolean } = {
-          jobId: request.params.jobId,
+        const options: RequestParams.MlCloseJob = {
+          job_id: request.params.jobId,
         };
         const force = request.query.force;
         if (force !== undefined) {
           options.force = force;
         }
-        const results = await legacyClient.callAsInternalUser('ml.closeJob', options);
+        const { body } = await client.asInternalUser.ml.closeJob(options);
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -315,18 +315,19 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canDeleteJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const options: { jobId: string; force?: boolean } = {
-          jobId: request.params.jobId,
+        const options: RequestParams.MlDeleteJob = {
+          job_id: request.params.jobId,
+          wait_for_completion: false,
         };
         const force = request.query.force;
         if (force !== undefined) {
           options.force = force;
         }
-        const results = await legacyClient.callAsInternalUser('ml.deleteJob', options);
+        const { body } = await client.asInternalUser.ml.deleteJob(options);
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -351,13 +352,11 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.validateDetector', {
-          body: request.body,
-        });
+        const { body } = await client.asInternalUser.ml.validateDetector({ body: request.body });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -386,16 +385,16 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canForecastJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const jobId = request.params.jobId;
         const duration = request.body.duration;
-        const results = await legacyClient.callAsInternalUser('ml.forecast', {
-          jobId,
+        const { body } = await client.asInternalUser.ml.forecast({
+          job_id: jobId,
           duration,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -427,14 +426,14 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.records', {
-          jobId: request.params.jobId,
+        const { body } = await client.asInternalUser.ml.getRecords({
+          job_id: request.params.jobId,
           body: request.body,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -466,15 +465,15 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.buckets', {
-          jobId: request.params.jobId,
+        const { body } = await client.asInternalUser.ml.getBuckets({
+          job_id: request.params.jobId,
           timestamp: request.params.timestamp,
           body: request.body,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -506,17 +505,17 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.overallBuckets', {
-          jobId: request.params.jobId,
+        const { body } = await client.asInternalUser.ml.getOverallBuckets({
+          job_id: request.params.jobId,
           top_n: request.body.topN,
           bucket_span: request.body.bucketSpan,
           start: request.body.start,
           end: request.body.end,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -543,14 +542,14 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.categories', {
-          jobId: request.params.jobId,
-          categoryId: request.params.categoryId,
+        const { body } = await client.asInternalUser.ml.getCategories({
+          job_id: request.params.jobId,
+          category_id: request.params.categoryId,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -577,13 +576,13 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.modelSnapshots', {
-          jobId: request.params.jobId,
+        const { body } = await client.asInternalUser.ml.getModelSnapshots({
+          job_id: request.params.jobId,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -610,14 +609,14 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.modelSnapshots', {
-          jobId: request.params.jobId,
-          snapshotId: request.params.snapshotId,
+        const { body } = await client.asInternalUser.ml.getModelSnapshots({
+          job_id: request.params.jobId,
+          snapshot_id: request.params.snapshotId,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -646,15 +645,15 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.updateModelSnapshot', {
-          jobId: request.params.jobId,
-          snapshotId: request.params.snapshotId,
+        const { body } = await client.asInternalUser.ml.updateModelSnapshot({
+          job_id: request.params.jobId,
+          snapshot_id: request.params.snapshotId,
           body: request.body,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -681,14 +680,14 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.deleteModelSnapshot', {
-          jobId: request.params.jobId,
-          snapshotId: request.params.snapshotId,
+        const { body } = await client.asInternalUser.ml.deleteModelSnapshot({
+          job_id: request.params.jobId,
+          snapshot_id: request.params.snapshotId,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
diff --git a/x-pack/plugins/ml/server/routes/apidoc_scripts/tsconfig.json b/x-pack/plugins/ml/server/routes/apidoc_scripts/tsconfig.json
index e3108b8c759f4d..6d01a853698b8e 100644
--- a/x-pack/plugins/ml/server/routes/apidoc_scripts/tsconfig.json
+++ b/x-pack/plugins/ml/server/routes/apidoc_scripts/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../tsconfig.json",
+  "extends": "../../../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "./target",
     "target": "es6",
diff --git a/x-pack/plugins/ml/server/routes/calendars.ts b/x-pack/plugins/ml/server/routes/calendars.ts
index 3beb6e437b2eed..2c95ce6fb59ece 100644
--- a/x-pack/plugins/ml/server/routes/calendars.ts
+++ b/x-pack/plugins/ml/server/routes/calendars.ts
@@ -4,43 +4,39 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { wrapError } from '../client/error_wrapper';
 import { RouteInitialization } from '../types';
 import { calendarSchema, calendarIdSchema, calendarIdsSchema } from './schemas/calendars_schema';
 import { CalendarManager, Calendar, FormCalendar } from '../models/calendar';
 
-function getAllCalendars(legacyClient: ILegacyScopedClusterClient) {
-  const cal = new CalendarManager(legacyClient);
+function getAllCalendars(client: IScopedClusterClient) {
+  const cal = new CalendarManager(client);
   return cal.getAllCalendars();
 }
 
-function getCalendar(legacyClient: ILegacyScopedClusterClient, calendarId: string) {
-  const cal = new CalendarManager(legacyClient);
+function getCalendar(client: IScopedClusterClient, calendarId: string) {
+  const cal = new CalendarManager(client);
   return cal.getCalendar(calendarId);
 }
 
-function newCalendar(legacyClient: ILegacyScopedClusterClient, calendar: FormCalendar) {
-  const cal = new CalendarManager(legacyClient);
+function newCalendar(client: IScopedClusterClient, calendar: FormCalendar) {
+  const cal = new CalendarManager(client);
   return cal.newCalendar(calendar);
 }
 
-function updateCalendar(
-  legacyClient: ILegacyScopedClusterClient,
-  calendarId: string,
-  calendar: Calendar
-) {
-  const cal = new CalendarManager(legacyClient);
+function updateCalendar(client: IScopedClusterClient, calendarId: string, calendar: Calendar) {
+  const cal = new CalendarManager(client);
   return cal.updateCalendar(calendarId, calendar);
 }
 
-function deleteCalendar(legacyClient: ILegacyScopedClusterClient, calendarId: string) {
-  const cal = new CalendarManager(legacyClient);
+function deleteCalendar(client: IScopedClusterClient, calendarId: string) {
+  const cal = new CalendarManager(client);
   return cal.deleteCalendar(calendarId);
 }
 
-function getCalendarsByIds(legacyClient: ILegacyScopedClusterClient, calendarIds: string) {
-  const cal = new CalendarManager(legacyClient);
+function getCalendarsByIds(client: IScopedClusterClient, calendarIds: string) {
+  const cal = new CalendarManager(client);
   return cal.getCalendarsByIds(calendarIds);
 }
 
@@ -60,9 +56,9 @@ export function calendars({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetCalendars'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const resp = await getAllCalendars(legacyClient);
+        const resp = await getAllCalendars(client);
 
         return response.ok({
           body: resp,
@@ -92,15 +88,15 @@ export function calendars({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetCalendars'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       let returnValue;
       try {
         const calendarIds = request.params.calendarIds.split(',');
 
         if (calendarIds.length === 1) {
-          returnValue = await getCalendar(legacyClient, calendarIds[0]);
+          returnValue = await getCalendar(client, calendarIds[0]);
         } else {
-          returnValue = await getCalendarsByIds(legacyClient, calendarIds);
+          returnValue = await getCalendarsByIds(client, calendarIds);
         }
 
         return response.ok({
@@ -131,10 +127,10 @@ export function calendars({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateCalendar'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const body = request.body;
-        const resp = await newCalendar(legacyClient, body);
+        const resp = await newCalendar(client, body);
 
         return response.ok({
           body: resp,
@@ -166,11 +162,11 @@ export function calendars({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateCalendar'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { calendarId } = request.params;
         const body = request.body;
-        const resp = await updateCalendar(legacyClient, calendarId, body);
+        const resp = await updateCalendar(client, calendarId, body);
 
         return response.ok({
           body: resp,
@@ -200,10 +196,10 @@ export function calendars({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canDeleteCalendar'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { calendarId } = request.params;
-        const resp = await deleteCalendar(legacyClient, calendarId);
+        const resp = await deleteCalendar(client, calendarId);
 
         return response.ok({
           body: resp,
diff --git a/x-pack/plugins/ml/server/routes/data_frame_analytics.ts b/x-pack/plugins/ml/server/routes/data_frame_analytics.ts
index 75d48056cf4584..dea4803e8275e9 100644
--- a/x-pack/plugins/ml/server/routes/data_frame_analytics.ts
+++ b/x-pack/plugins/ml/server/routes/data_frame_analytics.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { RequestHandlerContext, ILegacyScopedClusterClient } from 'kibana/server';
+import { RequestHandlerContext, IScopedClusterClient } from 'kibana/server';
 import { wrapError } from '../client/error_wrapper';
 import { analyticsAuditMessagesProvider } from '../models/data_frame_analytics/analytics_audit_messages';
 import { RouteInitialization } from '../types';
@@ -36,13 +36,14 @@ function deleteDestIndexPatternById(context: RequestHandlerContext, indexPattern
  */
 export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitialization) {
   async function userCanDeleteIndex(
-    legacyClient: ILegacyScopedClusterClient,
+    client: IScopedClusterClient,
     destinationIndex: string
   ): Promise<boolean> {
     if (!mlLicense.isSecurityEnabled()) {
       return true;
     }
-    const privilege = await legacyClient.callAsCurrentUser('ml.privilegeCheck', {
+
+    const { body } = await client.asCurrentUser.security.hasPrivileges({
       body: {
         index: [
           {
@@ -52,10 +53,8 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         ],
       },
     });
-    if (!privilege) {
-      return false;
-    }
-    return privilege.has_all_requested === true;
+
+    return body?.has_all_requested === true;
   }
 
   /**
@@ -76,11 +75,11 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canGetDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.getDataFrameAnalytics');
+        const { body } = await client.asInternalUser.ml.getDataFrameAnalytics({ size: 1000 });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -107,14 +106,14 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canGetDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { analyticsId } = request.params;
-        const results = await legacyClient.callAsInternalUser('ml.getDataFrameAnalytics', {
-          analyticsId,
+        const { body } = await client.asInternalUser.ml.getDataFrameAnalytics({
+          id: analyticsId,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -137,11 +136,11 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canGetDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.getDataFrameAnalyticsStats');
+        const { body } = await client.asInternalUser.ml.getDataFrameAnalyticsStats({ size: 1000 });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -168,14 +167,14 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canGetDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { analyticsId } = request.params;
-        const results = await legacyClient.callAsInternalUser('ml.getDataFrameAnalyticsStats', {
-          analyticsId,
+        const { body } = await client.asInternalUser.ml.getDataFrameAnalyticsStats({
+          id: analyticsId,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -205,16 +204,18 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canCreateDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { analyticsId } = request.params;
-        const results = await legacyClient.callAsInternalUser('ml.createDataFrameAnalytics', {
-          body: request.body,
-          analyticsId,
-          ...getAuthorizationHeader(request),
-        });
+        const { body } = await client.asInternalUser.ml.putDataFrameAnalytics(
+          {
+            id: analyticsId,
+            body: request.body,
+          },
+          getAuthorizationHeader(request)
+        );
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -241,14 +242,16 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canGetDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.evaluateDataFrameAnalytics', {
-          body: request.body,
-          ...getAuthorizationHeader(request),
-        });
+        const { body } = await client.asInternalUser.ml.evaluateDataFrame(
+          {
+            body: request.body,
+          },
+          getAuthorizationHeader(request)
+        );
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -276,13 +279,13 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canCreateDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const results = await legacyClient.callAsInternalUser('ml.explainDataFrameAnalytics', {
+        const { body } = await client.asInternalUser.ml.explainDataFrameAnalytics({
           body: request.body,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -310,7 +313,7 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canDeleteDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response, context }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response, context }) => {
       try {
         const { analyticsId } = request.params;
         const { deleteDestIndex, deleteDestIndexPattern } = request.query;
@@ -324,11 +327,11 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         // Check if analyticsId is valid and get destination index
         if (deleteDestIndex || deleteDestIndexPattern) {
           try {
-            const dfa = await legacyClient.callAsInternalUser('ml.getDataFrameAnalytics', {
-              analyticsId,
+            const { body } = await client.asInternalUser.ml.getDataFrameAnalytics({
+              id: analyticsId,
             });
-            if (Array.isArray(dfa.data_frame_analytics) && dfa.data_frame_analytics.length > 0) {
-              destinationIndex = dfa.data_frame_analytics[0].dest.index;
+            if (Array.isArray(body.data_frame_analytics) && body.data_frame_analytics.length > 0) {
+              destinationIndex = body.data_frame_analytics[0].dest.index;
             }
           } catch (e) {
             return response.customError(wrapError(e));
@@ -337,11 +340,11 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
           // If user checks box to delete the destinationIndex associated with the job
           if (destinationIndex && deleteDestIndex) {
             // Verify if user has privilege to delete the destination index
-            const userCanDeleteDestIndex = await userCanDeleteIndex(legacyClient, destinationIndex);
+            const userCanDeleteDestIndex = await userCanDeleteIndex(client, destinationIndex);
             // If user does have privilege to delete the index, then delete the index
             if (userCanDeleteDestIndex) {
               try {
-                await legacyClient.callAsCurrentUser('indices.delete', {
+                await client.asCurrentUser.indices.delete({
                   index: destinationIndex,
                 });
                 destIndexDeleted.success = true;
@@ -370,8 +373,8 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         // Delete the data frame analytics
 
         try {
-          await legacyClient.callAsInternalUser('ml.deleteDataFrameAnalytics', {
-            analyticsId,
+          await client.asInternalUser.ml.deleteDataFrameAnalytics({
+            id: analyticsId,
           });
           analyticsJobDeleted.success = true;
         } catch (deleteDFAError) {
@@ -413,14 +416,14 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canStartStopDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { analyticsId } = request.params;
-        const results = await legacyClient.callAsInternalUser('ml.startDataFrameAnalytics', {
-          analyticsId,
+        const { body } = await client.asInternalUser.ml.startDataFrameAnalytics({
+          id: analyticsId,
         });
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -449,10 +452,10 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canStartStopDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const options: { analyticsId: string; force?: boolean | undefined } = {
-          analyticsId: request.params.analyticsId,
+        const options: { id: string; force?: boolean | undefined } = {
+          id: request.params.analyticsId,
         };
         // @ts-expect-error TODO: update types
         if (request.url?.query?.force !== undefined) {
@@ -460,9 +463,9 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
           options.force = request.url.query.force;
         }
 
-        const results = await legacyClient.callAsInternalUser('ml.stopDataFrameAnalytics', options);
+        const { body } = await client.asInternalUser.ml.stopDataFrameAnalytics(options);
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -490,16 +493,18 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canCreateDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { analyticsId } = request.params;
-        const results = await legacyClient.callAsInternalUser('ml.updateDataFrameAnalytics', {
-          body: request.body,
-          analyticsId,
-          ...getAuthorizationHeader(request),
-        });
+        const { body } = await client.asInternalUser.ml.updateDataFrameAnalytics(
+          {
+            id: analyticsId,
+            body: request.body,
+          },
+          getAuthorizationHeader(request)
+        );
         return response.ok({
-          body: results,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -526,10 +531,10 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canGetDataFrameAnalytics'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { analyticsId } = request.params;
-        const { getAnalyticsAuditMessages } = analyticsAuditMessagesProvider(legacyClient);
+        const { getAnalyticsAuditMessages } = analyticsAuditMessagesProvider(client);
 
         const results = await getAnalyticsAuditMessages(analyticsId);
         return response.ok({
diff --git a/x-pack/plugins/ml/server/routes/data_visualizer.ts b/x-pack/plugins/ml/server/routes/data_visualizer.ts
index 6355285127f06c..a697fe017f1920 100644
--- a/x-pack/plugins/ml/server/routes/data_visualizer.ts
+++ b/x-pack/plugins/ml/server/routes/data_visualizer.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { wrapError } from '../client/error_wrapper';
 import { DataVisualizer } from '../models/data_visualizer';
 import { Field, HistogramField } from '../models/data_visualizer/data_visualizer';
@@ -17,7 +17,7 @@ import {
 import { RouteInitialization } from '../types';
 
 function getOverallStats(
-  legacyClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   indexPatternTitle: string,
   query: object,
   aggregatableFields: string[],
@@ -27,7 +27,7 @@ function getOverallStats(
   earliestMs: number,
   latestMs: number
 ) {
-  const dv = new DataVisualizer(legacyClient);
+  const dv = new DataVisualizer(client);
   return dv.getOverallStats(
     indexPatternTitle,
     query,
@@ -41,7 +41,7 @@ function getOverallStats(
 }
 
 function getStatsForFields(
-  legacyClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   indexPatternTitle: string,
   query: any,
   fields: Field[],
@@ -52,7 +52,7 @@ function getStatsForFields(
   interval: number,
   maxExamples: number
 ) {
-  const dv = new DataVisualizer(legacyClient);
+  const dv = new DataVisualizer(client);
   return dv.getStatsForFields(
     indexPatternTitle,
     query,
@@ -67,13 +67,13 @@ function getStatsForFields(
 }
 
 function getHistogramsForFields(
-  legacyClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   indexPatternTitle: string,
   query: any,
   fields: HistogramField[],
   samplerShardSize: number
 ) {
-  const dv = new DataVisualizer(legacyClient);
+  const dv = new DataVisualizer(client);
   return dv.getHistogramsForFields(indexPatternTitle, query, fields, samplerShardSize);
 }
 
@@ -104,7 +104,7 @@ export function dataVisualizerRoutes({ router, mlLicense }: RouteInitialization)
         tags: ['access:ml:canAccessML'],
       },
     },
-    mlLicense.basicLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.basicLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const {
           params: { indexPatternTitle },
@@ -112,7 +112,7 @@ export function dataVisualizerRoutes({ router, mlLicense }: RouteInitialization)
         } = request;
 
         const results = await getHistogramsForFields(
-          legacyClient,
+          client,
           indexPatternTitle,
           query,
           fields,
@@ -151,7 +151,7 @@ export function dataVisualizerRoutes({ router, mlLicense }: RouteInitialization)
         tags: ['access:ml:canAccessML'],
       },
     },
-    mlLicense.basicLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.basicLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const {
           params: { indexPatternTitle },
@@ -168,7 +168,7 @@ export function dataVisualizerRoutes({ router, mlLicense }: RouteInitialization)
         } = request;
 
         const results = await getStatsForFields(
-          legacyClient,
+          client,
           indexPatternTitle,
           query,
           fields,
@@ -216,7 +216,7 @@ export function dataVisualizerRoutes({ router, mlLicense }: RouteInitialization)
         tags: ['access:ml:canAccessML'],
       },
     },
-    mlLicense.basicLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.basicLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const {
           params: { indexPatternTitle },
@@ -232,7 +232,7 @@ export function dataVisualizerRoutes({ router, mlLicense }: RouteInitialization)
         } = request;
 
         const results = await getOverallStats(
-          legacyClient,
+          client,
           indexPatternTitle,
           query,
           aggregatableFields,
diff --git a/x-pack/plugins/ml/server/routes/datafeeds.ts b/x-pack/plugins/ml/server/routes/datafeeds.ts
index 47a9afc2244d96..df2aa9e79d71b2 100644
--- a/x-pack/plugins/ml/server/routes/datafeeds.ts
+++ b/x-pack/plugins/ml/server/routes/datafeeds.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { RequestParams } from '@elastic/elasticsearch';
 import { wrapError } from '../client/error_wrapper';
 import { RouteInitialization } from '../types';
 import {
@@ -33,12 +34,12 @@ export function dataFeedRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetDatafeeds'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const resp = await legacyClient.callAsInternalUser('ml.datafeeds');
+        const { body } = await client.asInternalUser.ml.getDatafeeds();
 
         return response.ok({
-          body: resp,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -65,13 +66,13 @@ export function dataFeedRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetDatafeeds'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const datafeedId = request.params.datafeedId;
-        const resp = await legacyClient.callAsInternalUser('ml.datafeeds', { datafeedId });
+        const { body } = await client.asInternalUser.ml.getDatafeeds({ datafeed_id: datafeedId });
 
         return response.ok({
-          body: resp,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -94,12 +95,12 @@ export function dataFeedRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetDatafeeds'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await legacyClient.callAsInternalUser('ml.datafeedStats');
+        const { body } = await client.asInternalUser.ml.getDatafeedStats();
 
         return response.ok({
-          body: resp,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -126,15 +127,15 @@ export function dataFeedRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetDatafeeds'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const datafeedId = request.params.datafeedId;
-        const resp = await legacyClient.callAsInternalUser('ml.datafeedStats', {
-          datafeedId,
+        const { body } = await client.asInternalUser.ml.getDatafeedStats({
+          datafeed_id: datafeedId,
         });
 
         return response.ok({
-          body: resp,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -163,17 +164,19 @@ export function dataFeedRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateDatafeed'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const datafeedId = request.params.datafeedId;
-        const resp = await legacyClient.callAsInternalUser('ml.addDatafeed', {
-          datafeedId,
-          body: request.body,
-          ...getAuthorizationHeader(request),
-        });
+        const { body } = await client.asInternalUser.ml.putDatafeed(
+          {
+            datafeed_id: datafeedId,
+            body: request.body,
+          },
+          getAuthorizationHeader(request)
+        );
 
         return response.ok({
-          body: resp,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -202,17 +205,19 @@ export function dataFeedRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canUpdateDatafeed'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const datafeedId = request.params.datafeedId;
-        const resp = await legacyClient.callAsInternalUser('ml.updateDatafeed', {
-          datafeedId,
-          body: request.body,
-          ...getAuthorizationHeader(request),
-        });
+        const { body } = await client.asInternalUser.ml.updateDatafeed(
+          {
+            datafeed_id: datafeedId,
+            body: request.body,
+          },
+          getAuthorizationHeader(request)
+        );
 
         return response.ok({
-          body: resp,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -241,20 +246,20 @@ export function dataFeedRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canDeleteDatafeed'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const options: { datafeedId: string; force?: boolean } = {
-          datafeedId: request.params.jobId,
+        const options: RequestParams.MlDeleteDatafeed = {
+          datafeed_id: request.params.jobId,
         };
         const force = request.query.force;
         if (force !== undefined) {
           options.force = force;
         }
 
-        const resp = await legacyClient.callAsInternalUser('ml.deleteDatafeed', options);
+        const { body } = await client.asInternalUser.ml.deleteDatafeed(options);
 
         return response.ok({
-          body: resp,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -283,19 +288,19 @@ export function dataFeedRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canStartStopDatafeed'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const datafeedId = request.params.datafeedId;
         const { start, end } = request.body;
 
-        const resp = await legacyClient.callAsInternalUser('ml.startDatafeed', {
-          datafeedId,
+        const { body } = await client.asInternalUser.ml.startDatafeed({
+          datafeed_id: datafeedId,
           start,
           end,
         });
 
         return response.ok({
-          body: resp,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -322,16 +327,16 @@ export function dataFeedRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canStartStopDatafeed'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const datafeedId = request.params.datafeedId;
 
-        const resp = await legacyClient.callAsInternalUser('ml.stopDatafeed', {
-          datafeedId,
+        const { body } = await client.asInternalUser.ml.stopDatafeed({
+          datafeed_id: datafeedId,
         });
 
         return response.ok({
-          body: resp,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -358,16 +363,18 @@ export function dataFeedRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canPreviewDatafeed'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const datafeedId = request.params.datafeedId;
-        const resp = await legacyClient.callAsInternalUser('ml.datafeedPreview', {
-          datafeedId,
-          ...getAuthorizationHeader(request),
-        });
+        const { body } = await client.asInternalUser.ml.previewDatafeed(
+          {
+            datafeed_id: datafeedId,
+          },
+          getAuthorizationHeader(request)
+        );
 
         return response.ok({
-          body: resp,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
diff --git a/x-pack/plugins/ml/server/routes/fields_service.ts b/x-pack/plugins/ml/server/routes/fields_service.ts
index 0595b31d5bbbce..e1bd8a5736d828 100644
--- a/x-pack/plugins/ml/server/routes/fields_service.ts
+++ b/x-pack/plugins/ml/server/routes/fields_service.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { wrapError } from '../client/error_wrapper';
 import { RouteInitialization } from '../types';
 import {
@@ -13,14 +13,14 @@ import {
 } from './schemas/fields_service_schema';
 import { fieldsServiceProvider } from '../models/fields_service';
 
-function getCardinalityOfFields(legacyClient: ILegacyScopedClusterClient, payload: any) {
-  const fs = fieldsServiceProvider(legacyClient);
+function getCardinalityOfFields(client: IScopedClusterClient, payload: any) {
+  const fs = fieldsServiceProvider(client);
   const { index, fieldNames, query, timeFieldName, earliestMs, latestMs } = payload;
   return fs.getCardinalityOfFields(index, fieldNames, query, timeFieldName, earliestMs, latestMs);
 }
 
-function getTimeFieldRange(legacyClient: ILegacyScopedClusterClient, payload: any) {
-  const fs = fieldsServiceProvider(legacyClient);
+function getTimeFieldRange(client: IScopedClusterClient, payload: any) {
+  const fs = fieldsServiceProvider(client);
   const { index, timeFieldName, query } = payload;
   return fs.getTimeFieldRange(index, timeFieldName, query);
 }
@@ -50,9 +50,9 @@ export function fieldsService({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canAccessML'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await getCardinalityOfFields(legacyClient, request.body);
+        const resp = await getCardinalityOfFields(client, request.body);
 
         return response.ok({
           body: resp,
@@ -85,9 +85,9 @@ export function fieldsService({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canAccessML'],
       },
     },
-    mlLicense.basicLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.basicLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await getTimeFieldRange(legacyClient, request.body);
+        const resp = await getTimeFieldRange(client, request.body);
 
         return response.ok({
           body: resp,
diff --git a/x-pack/plugins/ml/server/routes/file_data_visualizer.ts b/x-pack/plugins/ml/server/routes/file_data_visualizer.ts
index 88949fecbc7df5..4c1ee87e96fc56 100644
--- a/x-pack/plugins/ml/server/routes/file_data_visualizer.ts
+++ b/x-pack/plugins/ml/server/routes/file_data_visualizer.ts
@@ -5,7 +5,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { MAX_FILE_SIZE_BYTES } from '../../common/constants/file_datavisualizer';
 import {
   InputOverrides,
@@ -28,17 +28,13 @@ import {
   importFileQuerySchema,
 } from './schemas/file_data_visualizer_schema';
 
-function analyzeFiles(
-  legacyClient: ILegacyScopedClusterClient,
-  data: InputData,
-  overrides: InputOverrides
-) {
-  const { analyzeFile } = fileDataVisualizerProvider(legacyClient);
+function analyzeFiles(client: IScopedClusterClient, data: InputData, overrides: InputOverrides) {
+  const { analyzeFile } = fileDataVisualizerProvider(client);
   return analyzeFile(data, overrides);
 }
 
 function importData(
-  legacyClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   id: string,
   index: string,
   settings: Settings,
@@ -46,7 +42,7 @@ function importData(
   ingestPipeline: IngestPipelineWrapper,
   data: InputData
 ) {
-  const { importData: importDataFunc } = importDataProvider(legacyClient);
+  const { importData: importDataFunc } = importDataProvider(client);
   return importDataFunc(id, index, settings, mappings, ingestPipeline, data);
 }
 
@@ -78,9 +74,9 @@ export function fileDataVisualizerRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canFindFileStructure'],
       },
     },
-    mlLicense.basicLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.basicLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const result = await analyzeFiles(legacyClient, request.body, request.query);
+        const result = await analyzeFiles(client, request.body, request.query);
         return response.ok({ body: result });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -113,7 +109,7 @@ export function fileDataVisualizerRoutes({ router, mlLicense }: RouteInitializat
         tags: ['access:ml:canFindFileStructure'],
       },
     },
-    mlLicense.basicLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.basicLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { id } = request.query;
         const { index, data, settings, mappings, ingestPipeline } = request.body;
@@ -126,7 +122,7 @@ export function fileDataVisualizerRoutes({ router, mlLicense }: RouteInitializat
         }
 
         const result = await importData(
-          legacyClient,
+          client,
           id,
           index,
           settings,
diff --git a/x-pack/plugins/ml/server/routes/filters.ts b/x-pack/plugins/ml/server/routes/filters.ts
index bb4f8a2bebaa98..efb4acfa432f99 100644
--- a/x-pack/plugins/ml/server/routes/filters.ts
+++ b/x-pack/plugins/ml/server/routes/filters.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { wrapError } from '../client/error_wrapper';
 import { RouteInitialization } from '../types';
 import { createFilterSchema, filterIdSchema, updateFilterSchema } from './schemas/filters_schema';
@@ -12,37 +12,33 @@ import { FilterManager, FormFilter } from '../models/filter';
 
 // TODO - add function for returning a list of just the filter IDs.
 // TODO - add function for returning a list of filter IDs plus item count.
-function getAllFilters(legacyClient: ILegacyScopedClusterClient) {
-  const mgr = new FilterManager(legacyClient);
+function getAllFilters(client: IScopedClusterClient) {
+  const mgr = new FilterManager(client);
   return mgr.getAllFilters();
 }
 
-function getAllFilterStats(legacyClient: ILegacyScopedClusterClient) {
-  const mgr = new FilterManager(legacyClient);
+function getAllFilterStats(client: IScopedClusterClient) {
+  const mgr = new FilterManager(client);
   return mgr.getAllFilterStats();
 }
 
-function getFilter(legacyClient: ILegacyScopedClusterClient, filterId: string) {
-  const mgr = new FilterManager(legacyClient);
+function getFilter(client: IScopedClusterClient, filterId: string) {
+  const mgr = new FilterManager(client);
   return mgr.getFilter(filterId);
 }
 
-function newFilter(legacyClient: ILegacyScopedClusterClient, filter: FormFilter) {
-  const mgr = new FilterManager(legacyClient);
+function newFilter(client: IScopedClusterClient, filter: FormFilter) {
+  const mgr = new FilterManager(client);
   return mgr.newFilter(filter);
 }
 
-function updateFilter(
-  legacyClient: ILegacyScopedClusterClient,
-  filterId: string,
-  filter: FormFilter
-) {
-  const mgr = new FilterManager(legacyClient);
+function updateFilter(client: IScopedClusterClient, filterId: string, filter: FormFilter) {
+  const mgr = new FilterManager(client);
   return mgr.updateFilter(filterId, filter);
 }
 
-function deleteFilter(legacyClient: ILegacyScopedClusterClient, filterId: string) {
-  const mgr = new FilterManager(legacyClient);
+function deleteFilter(client: IScopedClusterClient, filterId: string) {
+  const mgr = new FilterManager(client);
   return mgr.deleteFilter(filterId);
 }
 
@@ -65,9 +61,9 @@ export function filtersRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetFilters'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const resp = await getAllFilters(legacyClient);
+        const resp = await getAllFilters(client);
 
         return response.ok({
           body: resp,
@@ -100,9 +96,9 @@ export function filtersRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetFilters'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await getFilter(legacyClient, request.params.filterId);
+        const resp = await getFilter(client, request.params.filterId);
         return response.ok({
           body: resp,
         });
@@ -134,10 +130,10 @@ export function filtersRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateFilter'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const body = request.body;
-        const resp = await newFilter(legacyClient, body);
+        const resp = await newFilter(client, body);
 
         return response.ok({
           body: resp,
@@ -172,11 +168,11 @@ export function filtersRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateFilter'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { filterId } = request.params;
         const body = request.body;
-        const resp = await updateFilter(legacyClient, filterId, body);
+        const resp = await updateFilter(client, filterId, body);
 
         return response.ok({
           body: resp,
@@ -206,10 +202,10 @@ export function filtersRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canDeleteFilter'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { filterId } = request.params;
-        const resp = await deleteFilter(legacyClient, filterId);
+        const resp = await deleteFilter(client, filterId);
 
         return response.ok({
           body: resp,
@@ -239,9 +235,9 @@ export function filtersRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetFilters'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const resp = await getAllFilterStats(legacyClient);
+        const resp = await getAllFilterStats(client);
 
         return response.ok({
           body: resp,
diff --git a/x-pack/plugins/ml/server/routes/indices.ts b/x-pack/plugins/ml/server/routes/indices.ts
index 6a759cb97f3086..ee817c492dbd4e 100644
--- a/x-pack/plugins/ml/server/routes/indices.ts
+++ b/x-pack/plugins/ml/server/routes/indices.ts
@@ -31,7 +31,7 @@ export function indicesRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canAccessML'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const {
           body: { index, fields: requestFields },
@@ -40,8 +40,8 @@ export function indicesRoutes({ router, mlLicense }: RouteInitialization) {
           requestFields !== undefined && Array.isArray(requestFields)
             ? requestFields.join(',')
             : '*';
-        const result = await legacyClient.callAsCurrentUser('fieldCaps', { index, fields });
-        return response.ok({ body: result });
+        const { body } = await client.asInternalUser.fieldCaps({ index, fields });
+        return response.ok({ body });
       } catch (e) {
         return response.customError(wrapError(e));
       }
diff --git a/x-pack/plugins/ml/server/routes/job_audit_messages.ts b/x-pack/plugins/ml/server/routes/job_audit_messages.ts
index 2313decfabd5b9..0c90081f8e755f 100644
--- a/x-pack/plugins/ml/server/routes/job_audit_messages.ts
+++ b/x-pack/plugins/ml/server/routes/job_audit_messages.ts
@@ -37,9 +37,9 @@ export function jobAuditMessagesRoutes({ router, mlLicense }: RouteInitializatio
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { getJobAuditMessages } = jobAuditMessagesProvider(legacyClient);
+        const { getJobAuditMessages } = jobAuditMessagesProvider(client);
         const { jobId } = request.params;
         const { from } = request.query;
         const resp = await getJobAuditMessages(jobId, from);
@@ -72,9 +72,9 @@ export function jobAuditMessagesRoutes({ router, mlLicense }: RouteInitializatio
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { getJobAuditMessages } = jobAuditMessagesProvider(legacyClient);
+        const { getJobAuditMessages } = jobAuditMessagesProvider(client);
         const { from } = request.query;
         const resp = await getJobAuditMessages(undefined, from);
 
diff --git a/x-pack/plugins/ml/server/routes/job_service.ts b/x-pack/plugins/ml/server/routes/job_service.ts
index 3d560fc857e954..3c7f35b871b101 100644
--- a/x-pack/plugins/ml/server/routes/job_service.ts
+++ b/x-pack/plugins/ml/server/routes/job_service.ts
@@ -48,9 +48,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canStartStopDatafeed'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { forceStartDatafeeds } = jobServiceProvider(legacyClient);
+        const { forceStartDatafeeds } = jobServiceProvider(client);
         const { datafeedIds, start, end } = request.body;
         const resp = await forceStartDatafeeds(datafeedIds, start, end);
 
@@ -82,9 +82,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canStartStopDatafeed'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { stopDatafeeds } = jobServiceProvider(legacyClient);
+        const { stopDatafeeds } = jobServiceProvider(client);
         const { datafeedIds } = request.body;
         const resp = await stopDatafeeds(datafeedIds);
 
@@ -116,9 +116,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canDeleteJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { deleteJobs } = jobServiceProvider(legacyClient);
+        const { deleteJobs } = jobServiceProvider(client);
         const { jobIds } = request.body;
         const resp = await deleteJobs(jobIds);
 
@@ -150,9 +150,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCloseJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { closeJobs } = jobServiceProvider(legacyClient);
+        const { closeJobs } = jobServiceProvider(client);
         const { jobIds } = request.body;
         const resp = await closeJobs(jobIds);
 
@@ -184,9 +184,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCloseJob', 'access:ml:canStartStopDatafeed'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { forceStopAndCloseJob } = jobServiceProvider(legacyClient);
+        const { forceStopAndCloseJob } = jobServiceProvider(client);
         const { jobId } = request.body;
         const resp = await forceStopAndCloseJob(jobId);
 
@@ -223,9 +223,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { jobsSummary } = jobServiceProvider(legacyClient);
+        const { jobsSummary } = jobServiceProvider(client);
         const { jobIds } = request.body;
         const resp = await jobsSummary(jobIds);
 
@@ -257,9 +257,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const { jobsWithTimerange } = jobServiceProvider(legacyClient);
+        const { jobsWithTimerange } = jobServiceProvider(client);
         const resp = await jobsWithTimerange();
 
         return response.ok({
@@ -290,9 +290,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { createFullJobsList } = jobServiceProvider(legacyClient);
+        const { createFullJobsList } = jobServiceProvider(client);
         const { jobIds } = request.body;
         const resp = await createFullJobsList(jobIds);
 
@@ -320,9 +320,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const { getAllGroups } = jobServiceProvider(legacyClient);
+        const { getAllGroups } = jobServiceProvider(client);
         const resp = await getAllGroups();
 
         return response.ok({
@@ -353,9 +353,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canUpdateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { updateGroups } = jobServiceProvider(legacyClient);
+        const { updateGroups } = jobServiceProvider(client);
         const { jobs } = request.body;
         const resp = await updateGroups(jobs);
 
@@ -383,9 +383,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const { deletingJobTasks } = jobServiceProvider(legacyClient);
+        const { deletingJobTasks } = jobServiceProvider(client);
         const resp = await deletingJobTasks();
 
         return response.ok({
@@ -416,9 +416,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { jobsExist } = jobServiceProvider(legacyClient);
+        const { jobsExist } = jobServiceProvider(client);
         const { jobIds } = request.body;
         const resp = await jobsExist(jobIds);
 
@@ -449,12 +449,12 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response, context }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response, context }) => {
       try {
         const { indexPattern } = request.params;
         const isRollup = request.query.rollup === 'true';
         const savedObjectsClient = context.core.savedObjects.client;
-        const { newJobCaps } = jobServiceProvider(legacyClient);
+        const { newJobCaps } = jobServiceProvider(client);
         const resp = await newJobCaps(indexPattern, isRollup, savedObjectsClient);
 
         return response.ok({
@@ -485,7 +485,7 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const {
           indexPatternTitle,
@@ -499,7 +499,7 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
           splitFieldValue,
         } = request.body;
 
-        const { newJobLineChart } = jobServiceProvider(legacyClient);
+        const { newJobLineChart } = jobServiceProvider(client);
         const resp = await newJobLineChart(
           indexPatternTitle,
           timeField,
@@ -540,7 +540,7 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const {
           indexPatternTitle,
@@ -553,7 +553,7 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
           splitFieldName,
         } = request.body;
 
-        const { newJobPopulationChart } = jobServiceProvider(legacyClient);
+        const { newJobPopulationChart } = jobServiceProvider(client);
         const resp = await newJobPopulationChart(
           indexPatternTitle,
           timeField,
@@ -589,9 +589,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const { getAllJobAndGroupIds } = jobServiceProvider(legacyClient);
+        const { getAllJobAndGroupIds } = jobServiceProvider(client);
         const resp = await getAllJobAndGroupIds();
 
         return response.ok({
@@ -622,9 +622,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { getLookBackProgress } = jobServiceProvider(legacyClient);
+        const { getLookBackProgress } = jobServiceProvider(client);
         const { jobId, start, end } = request.body;
         const resp = await getLookBackProgress(jobId, start, end);
 
@@ -656,9 +656,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { validateCategoryExamples } = categorizationExamplesProvider(legacyClient);
+        const { validateCategoryExamples } = categorizationExamplesProvider(client);
         const {
           indexPatternTitle,
           timeField,
@@ -709,9 +709,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { topCategories } = jobServiceProvider(legacyClient);
+        const { topCategories } = jobServiceProvider(client);
         const { jobId, count } = request.body;
         const resp = await topCategories(jobId, count);
 
@@ -743,9 +743,9 @@ export function jobServiceRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateJob', 'access:ml:canStartStopDatafeed'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { revertModelSnapshot } = jobServiceProvider(legacyClient);
+        const { revertModelSnapshot } = jobServiceProvider(client);
         const {
           jobId,
           snapshotId,
diff --git a/x-pack/plugins/ml/server/routes/job_validation.ts b/x-pack/plugins/ml/server/routes/job_validation.ts
index 6da052663a002b..b52043595327be 100644
--- a/x-pack/plugins/ml/server/routes/job_validation.ts
+++ b/x-pack/plugins/ml/server/routes/job_validation.ts
@@ -5,7 +5,7 @@
  */
 
 import Boom from 'boom';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { TypeOf } from '@kbn/config-schema';
 import { AnalysisConfig } from '../../common/types/anomaly_detection_jobs';
 import { wrapError } from '../client/error_wrapper';
@@ -27,12 +27,12 @@ type CalculateModelMemoryLimitPayload = TypeOf<typeof modelMemoryLimitSchema>;
  */
 export function jobValidationRoutes({ router, mlLicense }: RouteInitialization, version: string) {
   function calculateModelMemoryLimit(
-    legacyClient: ILegacyScopedClusterClient,
+    client: IScopedClusterClient,
     payload: CalculateModelMemoryLimitPayload
   ) {
     const { analysisConfig, indexPattern, query, timeFieldName, earliestMs, latestMs } = payload;
 
-    return calculateModelMemoryLimitProvider(legacyClient)(
+    return calculateModelMemoryLimitProvider(client)(
       analysisConfig as AnalysisConfig,
       indexPattern,
       query,
@@ -61,10 +61,10 @@ export function jobValidationRoutes({ router, mlLicense }: RouteInitialization,
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         let errorResp;
-        const resp = await estimateBucketSpanFactory(legacyClient)(request.body)
+        const resp = await estimateBucketSpanFactory(client)(request.body)
           // this catch gets triggered when the estimation code runs without error
           // but isn't able to come up with a bucket span estimation.
           // this doesn't return a HTTP error but an object with an error message
@@ -109,9 +109,9 @@ export function jobValidationRoutes({ router, mlLicense }: RouteInitialization,
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await calculateModelMemoryLimit(legacyClient, request.body);
+        const resp = await calculateModelMemoryLimit(client, request.body);
 
         return response.ok({
           body: resp,
@@ -141,9 +141,9 @@ export function jobValidationRoutes({ router, mlLicense }: RouteInitialization,
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await validateCardinality(legacyClient, request.body);
+        const resp = await validateCardinality(client, request.body);
 
         return response.ok({
           body: resp,
@@ -173,11 +173,11 @@ export function jobValidationRoutes({ router, mlLicense }: RouteInitialization,
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         // version corresponds to the version used in documentation links.
         const resp = await validateJob(
-          legacyClient,
+          client,
           request.body,
           version,
           mlLicense.isSecurityEnabled() === false
diff --git a/x-pack/plugins/ml/server/routes/modules.ts b/x-pack/plugins/ml/server/routes/modules.ts
index 23e37d22130292..72a4c5e428c2b8 100644
--- a/x-pack/plugins/ml/server/routes/modules.ts
+++ b/x-pack/plugins/ml/server/routes/modules.ts
@@ -6,11 +6,7 @@
 
 import { TypeOf } from '@kbn/config-schema';
 
-import {
-  ILegacyScopedClusterClient,
-  KibanaRequest,
-  SavedObjectsClientContract,
-} from 'kibana/server';
+import { IScopedClusterClient, KibanaRequest, SavedObjectsClientContract } from 'kibana/server';
 import { DatafeedOverride, JobOverride } from '../../common/types/modules';
 import { wrapError } from '../client/error_wrapper';
 import { DataRecognizer } from '../models/data_recognizer';
@@ -23,22 +19,22 @@ import {
 import { RouteInitialization } from '../types';
 
 function recognize(
-  legacyClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   savedObjectsClient: SavedObjectsClientContract,
   request: KibanaRequest,
   indexPatternTitle: string
 ) {
-  const dr = new DataRecognizer(legacyClient, savedObjectsClient, request);
+  const dr = new DataRecognizer(client, savedObjectsClient, request);
   return dr.findMatches(indexPatternTitle);
 }
 
 function getModule(
-  legacyClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   savedObjectsClient: SavedObjectsClientContract,
   request: KibanaRequest,
   moduleId: string
 ) {
-  const dr = new DataRecognizer(legacyClient, savedObjectsClient, request);
+  const dr = new DataRecognizer(client, savedObjectsClient, request);
   if (moduleId === undefined) {
     return dr.listModules();
   } else {
@@ -47,7 +43,7 @@ function getModule(
 }
 
 function setup(
-  legacyClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   savedObjectsClient: SavedObjectsClientContract,
   request: KibanaRequest,
   moduleId: string,
@@ -63,7 +59,7 @@ function setup(
   datafeedOverrides?: DatafeedOverride | DatafeedOverride[],
   estimateModelMemory?: boolean
 ) {
-  const dr = new DataRecognizer(legacyClient, savedObjectsClient, request);
+  const dr = new DataRecognizer(client, savedObjectsClient, request);
   return dr.setup(
     moduleId,
     prefix,
@@ -81,12 +77,12 @@ function setup(
 }
 
 function dataRecognizerJobsExist(
-  legacyClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   savedObjectsClient: SavedObjectsClientContract,
   request: KibanaRequest,
   moduleId: string
 ) {
-  const dr = new DataRecognizer(legacyClient, savedObjectsClient, request);
+  const dr = new DataRecognizer(client, savedObjectsClient, request);
   return dr.dataRecognizerJobsExist(moduleId);
 }
 
@@ -131,11 +127,11 @@ export function dataRecognizer({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response, context }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response, context }) => {
       try {
         const { indexPatternTitle } = request.params;
         const results = await recognize(
-          legacyClient,
+          client,
           context.core.savedObjects.client,
           request,
           indexPatternTitle
@@ -266,7 +262,7 @@ export function dataRecognizer({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response, context }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response, context }) => {
       try {
         let { moduleId } = request.params;
         if (moduleId === '') {
@@ -275,7 +271,7 @@ export function dataRecognizer({ router, mlLicense }: RouteInitialization) {
           moduleId = undefined;
         }
         const results = await getModule(
-          legacyClient,
+          client,
           context.core.savedObjects.client,
           request,
           moduleId
@@ -439,7 +435,7 @@ export function dataRecognizer({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canCreateJob'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response, context }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response, context }) => {
       try {
         const { moduleId } = request.params;
 
@@ -458,7 +454,7 @@ export function dataRecognizer({ router, mlLicense }: RouteInitialization) {
         } = request.body as TypeOf<typeof setupModuleBodySchema>;
 
         const result = await setup(
-          legacyClient,
+          client,
           context.core.savedObjects.client,
           request,
           moduleId,
@@ -544,11 +540,11 @@ export function dataRecognizer({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response, context }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response, context }) => {
       try {
         const { moduleId } = request.params;
         const result = await dataRecognizerJobsExist(
-          legacyClient,
+          client,
           context.core.savedObjects.client,
           request,
           moduleId
diff --git a/x-pack/plugins/ml/server/routes/notification_settings.ts b/x-pack/plugins/ml/server/routes/notification_settings.ts
index 09c145d6257a85..5bb51bf9e596cc 100644
--- a/x-pack/plugins/ml/server/routes/notification_settings.ts
+++ b/x-pack/plugins/ml/server/routes/notification_settings.ts
@@ -26,16 +26,15 @@ export function notificationRoutes({ router, mlLicense }: RouteInitialization) {
         tags: ['access:ml:canAccessML'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, response }) => {
       try {
-        const params = {
-          includeDefaults: true,
-          filterPath: '**.xpack.notification',
-        };
-        const resp = await legacyClient.callAsCurrentUser('cluster.getSettings', params);
+        const { body } = await client.asCurrentUser.cluster.getSettings({
+          include_defaults: true,
+          filter_path: '**.xpack.notification',
+        });
 
         return response.ok({
-          body: resp,
+          body,
         });
       } catch (e) {
         return response.customError(wrapError(e));
diff --git a/x-pack/plugins/ml/server/routes/results_service.ts b/x-pack/plugins/ml/server/routes/results_service.ts
index 2af37c17f714a1..4e34320d513339 100644
--- a/x-pack/plugins/ml/server/routes/results_service.ts
+++ b/x-pack/plugins/ml/server/routes/results_service.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { schema } from '@kbn/config-schema';
 import { wrapError } from '../client/error_wrapper';
 import { RouteInitialization } from '../types';
@@ -23,8 +23,8 @@ import {
   getCategorizerStoppedPartitionsSchema,
 } from './schemas/results_service_schema';
 
-function getAnomaliesTableData(legacyClient: ILegacyScopedClusterClient, payload: any) {
-  const rs = resultsServiceProvider(legacyClient);
+function getAnomaliesTableData(client: IScopedClusterClient, payload: any) {
+  const rs = resultsServiceProvider(client);
   const {
     jobIds,
     criteriaFields,
@@ -53,39 +53,39 @@ function getAnomaliesTableData(legacyClient: ILegacyScopedClusterClient, payload
   );
 }
 
-function getCategoryDefinition(legacyClient: ILegacyScopedClusterClient, payload: any) {
-  const rs = resultsServiceProvider(legacyClient);
+function getCategoryDefinition(client: IScopedClusterClient, payload: any) {
+  const rs = resultsServiceProvider(client);
   return rs.getCategoryDefinition(payload.jobId, payload.categoryId);
 }
 
-function getCategoryExamples(legacyClient: ILegacyScopedClusterClient, payload: any) {
-  const rs = resultsServiceProvider(legacyClient);
+function getCategoryExamples(client: IScopedClusterClient, payload: any) {
+  const rs = resultsServiceProvider(client);
   const { jobId, categoryIds, maxExamples } = payload;
   return rs.getCategoryExamples(jobId, categoryIds, maxExamples);
 }
 
-function getMaxAnomalyScore(legacyClient: ILegacyScopedClusterClient, payload: any) {
-  const rs = resultsServiceProvider(legacyClient);
+function getMaxAnomalyScore(client: IScopedClusterClient, payload: any) {
+  const rs = resultsServiceProvider(client);
   const { jobIds, earliestMs, latestMs } = payload;
   return rs.getMaxAnomalyScore(jobIds, earliestMs, latestMs);
 }
 
-function getPartitionFieldsValues(legacyClient: ILegacyScopedClusterClient, payload: any) {
-  const rs = resultsServiceProvider(legacyClient);
+function getPartitionFieldsValues(client: IScopedClusterClient, payload: any) {
+  const rs = resultsServiceProvider(client);
   const { jobId, searchTerm, criteriaFields, earliestMs, latestMs } = payload;
   return rs.getPartitionFieldsValues(jobId, searchTerm, criteriaFields, earliestMs, latestMs);
 }
 
-function getCategorizerStats(legacyClient: ILegacyScopedClusterClient, params: any, query: any) {
+function getCategorizerStats(client: IScopedClusterClient, params: any, query: any) {
   const { jobId } = params;
   const { partitionByValue } = query;
-  const rs = resultsServiceProvider(legacyClient);
+  const rs = resultsServiceProvider(client);
   return rs.getCategorizerStats(jobId, partitionByValue);
 }
 
-function getCategoryStoppedPartitions(legacyClient: ILegacyScopedClusterClient, payload: any) {
+function getCategoryStoppedPartitions(client: IScopedClusterClient, payload: any) {
   const { jobIds, fieldToBucket } = payload;
-  const rs = resultsServiceProvider(legacyClient);
+  const rs = resultsServiceProvider(client);
   return rs.getCategoryStoppedPartitions(jobIds, fieldToBucket);
 }
 
@@ -112,9 +112,9 @@ export function resultsServiceRoutes({ router, mlLicense }: RouteInitialization)
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await getAnomaliesTableData(legacyClient, request.body);
+        const resp = await getAnomaliesTableData(client, request.body);
 
         return response.ok({
           body: resp,
@@ -144,9 +144,9 @@ export function resultsServiceRoutes({ router, mlLicense }: RouteInitialization)
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await getCategoryDefinition(legacyClient, request.body);
+        const resp = await getCategoryDefinition(client, request.body);
 
         return response.ok({
           body: resp,
@@ -176,9 +176,9 @@ export function resultsServiceRoutes({ router, mlLicense }: RouteInitialization)
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await getMaxAnomalyScore(legacyClient, request.body);
+        const resp = await getMaxAnomalyScore(client, request.body);
 
         return response.ok({
           body: resp,
@@ -208,9 +208,9 @@ export function resultsServiceRoutes({ router, mlLicense }: RouteInitialization)
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await getCategoryExamples(legacyClient, request.body);
+        const resp = await getCategoryExamples(client, request.body);
 
         return response.ok({
           body: resp,
@@ -240,9 +240,9 @@ export function resultsServiceRoutes({ router, mlLicense }: RouteInitialization)
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await getPartitionFieldsValues(legacyClient, request.body);
+        const resp = await getPartitionFieldsValues(client, request.body);
 
         return response.ok({
           body: resp,
@@ -269,14 +269,14 @@ export function resultsServiceRoutes({ router, mlLicense }: RouteInitialization)
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
-      const body = {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
+      const { body } = await client.asInternalUser.search({
         ...request.body,
         index: ML_RESULTS_INDEX_PATTERN,
-      };
+      });
       try {
         return response.ok({
-          body: await legacyClient.callAsInternalUser('search', body),
+          body,
         });
       } catch (error) {
         return response.customError(wrapError(error));
@@ -304,9 +304,9 @@ export function resultsServiceRoutes({ router, mlLicense }: RouteInitialization)
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await getCategorizerStats(legacyClient, request.params, request.query);
+        const resp = await getCategorizerStats(client, request.params, request.query);
         return response.ok({
           body: resp,
         });
@@ -334,9 +334,9 @@ export function resultsServiceRoutes({ router, mlLicense }: RouteInitialization)
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const resp = await getCategoryStoppedPartitions(legacyClient, request.body);
+        const resp = await getCategoryStoppedPartitions(client, request.body);
         return response.ok({
           body: resp,
         });
diff --git a/x-pack/plugins/ml/server/routes/system.ts b/x-pack/plugins/ml/server/routes/system.ts
index 273b86163245fc..3a66f60943bb39 100644
--- a/x-pack/plugins/ml/server/routes/system.ts
+++ b/x-pack/plugins/ml/server/routes/system.ts
@@ -7,7 +7,7 @@
 import { schema } from '@kbn/config-schema';
 
 import { Request } from 'hapi';
-import { ILegacyScopedClusterClient } from 'kibana/server';
+import { IScopedClusterClient } from 'kibana/server';
 import { wrapError } from '../client/error_wrapper';
 import { mlLog } from '../client/log';
 import { capabilitiesProvider } from '../lib/capabilities';
@@ -21,17 +21,16 @@ export function systemRoutes(
   { router, mlLicense }: RouteInitialization,
   { spaces, cloud, resolveMlCapabilities }: SystemRouteDeps
 ) {
-  async function getNodeCount(legacyClient: ILegacyScopedClusterClient) {
-    const filterPath = 'nodes.*.attributes';
-    const resp = await legacyClient.callAsInternalUser('nodes.info', {
-      filterPath,
+  async function getNodeCount(client: IScopedClusterClient) {
+    const { body } = await client.asInternalUser.nodes.info({
+      filter_path: 'nodes.*.attributes',
     });
 
     let count = 0;
-    if (typeof resp.nodes === 'object') {
-      Object.keys(resp.nodes).forEach((k) => {
-        if (resp.nodes[k].attributes !== undefined) {
-          const maxOpenJobs = resp.nodes[k].attributes['ml.max_open_jobs'];
+    if (typeof body.nodes === 'object') {
+      Object.keys(body.nodes).forEach((k) => {
+        if (body.nodes[k].attributes !== undefined) {
+          const maxOpenJobs = body.nodes[k].attributes['ml.max_open_jobs'];
           if (maxOpenJobs !== null && maxOpenJobs > 0) {
             count++;
           }
@@ -58,15 +57,15 @@ export function systemRoutes(
         tags: ['access:ml:canAccessML'],
       },
     },
-    mlLicense.basicLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.basicLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const { callAsCurrentUser, callAsInternalUser } = legacyClient;
+        const { asCurrentUser, asInternalUser } = client;
         let upgradeInProgress = false;
         try {
-          const info = await callAsInternalUser('ml.info');
+          const { body } = await asInternalUser.ml.info();
           // if ml indices are currently being migrated, upgrade_mode will be set to true
           // pass this back with the privileges to allow for the disabling of UI controls.
-          upgradeInProgress = info.upgrade_mode === true;
+          upgradeInProgress = body.upgrade_mode === true;
         } catch (error) {
           // if the ml.info check fails, it could be due to the user having insufficient privileges
           // most likely they do not have the ml_user role and therefore will be blocked from using
@@ -90,11 +89,12 @@ export function systemRoutes(
             },
           });
         } else {
-          const body = request.body;
-          const resp = await callAsCurrentUser('ml.privilegeCheck', { body });
-          resp.upgradeInProgress = upgradeInProgress;
+          const { body } = await asCurrentUser.security.hasPrivileges({ body: request.body });
           return response.ok({
-            body: resp,
+            body: {
+              ...body,
+              upgradeInProgress,
+            },
           });
         }
       } catch (error) {
@@ -115,7 +115,7 @@ export function systemRoutes(
       path: '/api/ml/ml_capabilities',
       validate: false,
     },
-    mlLicense.basicLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.basicLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         // if spaces is disabled force isMlEnabledInSpace to be true
         const { isMlEnabledInSpace } =
@@ -129,7 +129,7 @@ export function systemRoutes(
         }
 
         const { getCapabilities } = capabilitiesProvider(
-          legacyClient,
+          client,
           mlCapabilities,
           mlLicense,
           isMlEnabledInSpace
@@ -159,10 +159,10 @@ export function systemRoutes(
       },
     },
 
-    mlLicense.basicLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.basicLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         return response.ok({
-          body: await getNodeCount(legacyClient),
+          body: await getNodeCount(client),
         });
       } catch (e) {
         return response.customError(wrapError(e));
@@ -185,12 +185,12 @@ export function systemRoutes(
         tags: ['access:ml:canAccessML'],
       },
     },
-    mlLicense.basicLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.basicLicenseAPIGuard(async ({ client, request, response }) => {
       try {
-        const info = await legacyClient.callAsInternalUser('ml.info');
+        const { body } = await client.asInternalUser.ml.info();
         const cloudId = cloud && cloud.cloudId;
         return response.ok({
-          body: { ...info, cloudId },
+          body: { ...body, cloudId },
         });
       } catch (error) {
         return response.customError(wrapError(error));
@@ -216,10 +216,11 @@ export function systemRoutes(
         tags: ['access:ml:canGetJobs'],
       },
     },
-    mlLicense.fullLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.fullLicenseAPIGuard(async ({ client, request, response }) => {
       try {
+        const { body } = await client.asCurrentUser.search(request.body);
         return response.ok({
-          body: await legacyClient.callAsCurrentUser('search', request.body),
+          body,
         });
       } catch (error) {
         return response.customError(wrapError(error));
@@ -243,22 +244,21 @@ export function systemRoutes(
         tags: ['access:ml:canAccessML'],
       },
     },
-    mlLicense.basicLicenseAPIGuard(async ({ legacyClient, request, response }) => {
+    mlLicense.basicLicenseAPIGuard(async ({ client, request, response }) => {
       try {
         const { index } = request.body;
 
         const options = {
           index: [index],
           fields: ['*'],
-          ignoreUnavailable: true,
-          allowNoIndices: true,
-          ignore: 404,
+          ignore_unavailable: true,
+          allow_no_indices: true,
         };
 
-        const fieldsResult = await legacyClient.callAsCurrentUser('fieldCaps', options);
+        const { body } = await client.asCurrentUser.fieldCaps(options);
         const result = { exists: false };
 
-        if (Array.isArray(fieldsResult.indices) && fieldsResult.indices.length !== 0) {
+        if (Array.isArray(body.indices) && body.indices.length !== 0) {
           result.exists = true;
         }
 
diff --git a/x-pack/plugins/ml/server/shared_services/errors.ts b/x-pack/plugins/ml/server/shared_services/errors.ts
new file mode 100644
index 00000000000000..f15a85a490a460
--- /dev/null
+++ b/x-pack/plugins/ml/server/shared_services/errors.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export class MLClusterClientUninitialized extends Error {
+  constructor(message?: string) {
+    super(message);
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+}
diff --git a/x-pack/plugins/ml/server/shared_services/license_checks.ts b/x-pack/plugins/ml/server/shared_services/license_checks.ts
deleted file mode 100644
index 191124ffa5f3af..00000000000000
--- a/x-pack/plugins/ml/server/shared_services/license_checks.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { MlServerLicense } from '../lib/license';
-
-export type LicenseCheck = () => void;
-
-export function licenseChecks(
-  mlLicense: MlServerLicense
-): { isFullLicense: LicenseCheck; isMinimumLicense: LicenseCheck } {
-  return {
-    isFullLicense() {
-      if (mlLicense.isFullLicense() === false) {
-        throw Error('Platinum, Enterprise or trial license needed');
-      }
-    },
-    isMinimumLicense() {
-      if (mlLicense.isMinimumLicense() === false) {
-        throw Error('Basic license needed');
-      }
-    },
-  };
-}
diff --git a/x-pack/plugins/ml/server/shared_services/license_checks/errors.ts b/x-pack/plugins/ml/server/shared_services/license_checks/errors.ts
new file mode 100644
index 00000000000000..18e7dab43fda7e
--- /dev/null
+++ b/x-pack/plugins/ml/server/shared_services/license_checks/errors.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/* eslint-disable max-classes-per-file */
+
+export class InsufficientFullLicenseError extends Error {
+  constructor(message?: string) {
+    super(message);
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+}
+
+export class InsufficientBasicLicenseError extends Error {
+  constructor(message?: string) {
+    super(message);
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+}
diff --git a/x-pack/plugins/ml/server/shared_services/license_checks/index.ts b/x-pack/plugins/ml/server/shared_services/license_checks/index.ts
new file mode 100644
index 00000000000000..6b837dadf5c0de
--- /dev/null
+++ b/x-pack/plugins/ml/server/shared_services/license_checks/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { LicenseCheck, licenseChecks } from './license_checks';
+export { InsufficientBasicLicenseError, InsufficientFullLicenseError } from './errors';
diff --git a/x-pack/plugins/ml/server/shared_services/license_checks/license_checks.ts b/x-pack/plugins/ml/server/shared_services/license_checks/license_checks.ts
new file mode 100644
index 00000000000000..3d9de1ef70f2d6
--- /dev/null
+++ b/x-pack/plugins/ml/server/shared_services/license_checks/license_checks.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { MlServerLicense } from '../../lib/license';
+import { InsufficientFullLicenseError, InsufficientBasicLicenseError } from './errors';
+
+export type LicenseCheck = () => void;
+
+export function licenseChecks(
+  mlLicense: MlServerLicense
+): { isFullLicense: LicenseCheck; isMinimumLicense: LicenseCheck } {
+  return {
+    isFullLicense() {
+      if (mlLicense.isFullLicense() === false) {
+        throw new InsufficientFullLicenseError('Platinum, Enterprise or trial license needed');
+      }
+    },
+    isMinimumLicense() {
+      if (mlLicense.isMinimumLicense() === false) {
+        throw new InsufficientBasicLicenseError('Basic license needed');
+      }
+    },
+  };
+}
diff --git a/x-pack/plugins/ml/server/shared_services/providers/anomaly_detectors.ts b/x-pack/plugins/ml/server/shared_services/providers/anomaly_detectors.ts
index 603b4fba17adbf..53898cb64d07f6 100644
--- a/x-pack/plugins/ml/server/shared_services/providers/anomaly_detectors.ts
+++ b/x-pack/plugins/ml/server/shared_services/providers/anomaly_detectors.ts
@@ -4,40 +4,33 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient, KibanaRequest } from 'kibana/server';
+import { KibanaRequest } from 'kibana/server';
 import { Job } from '../../../common/types/anomaly_detection_jobs';
-import { SharedServicesChecks } from '../shared_services';
+import { GetGuards } from '../shared_services';
 
 export interface AnomalyDetectorsProvider {
   anomalyDetectorsProvider(
-    mlClusterClient: ILegacyScopedClusterClient,
     request: KibanaRequest
   ): {
     jobs(jobId?: string): Promise<{ count: number; jobs: Job[] }>;
   };
 }
 
-export function getAnomalyDetectorsProvider({
-  isFullLicense,
-  getHasMlCapabilities,
-}: SharedServicesChecks): AnomalyDetectorsProvider {
+export function getAnomalyDetectorsProvider(getGuards: GetGuards): AnomalyDetectorsProvider {
   return {
-    anomalyDetectorsProvider(mlClusterClient: ILegacyScopedClusterClient, request: KibanaRequest) {
-      //  APM is using this service in anomaly alert, kibana alerting doesn't provide request object
-      // So we are adding a dummy request for now
-      // TODO: Remove this once kibana alerting provides request object
-      const hasMlCapabilities =
-        request.params !== 'DummyKibanaRequest'
-          ? getHasMlCapabilities(request)
-          : (_caps: string[]) => Promise.resolve();
+    anomalyDetectorsProvider(request: KibanaRequest) {
       return {
         async jobs(jobId?: string) {
-          isFullLicense();
-          await hasMlCapabilities(['canGetJobs']);
-          return mlClusterClient.callAsInternalUser(
-            'ml.jobs',
-            jobId !== undefined ? { jobId } : {}
-          );
+          return await getGuards(request)
+            .isFullLicense()
+            .hasMlCapabilities(['canGetJobs'])
+            .ok(async ({ scopedClient }) => {
+              const { body } = await scopedClient.asInternalUser.ml.getJobs<{
+                count: number;
+                jobs: Job[];
+              }>(jobId !== undefined ? { job_id: jobId } : undefined);
+              return body;
+            });
         },
       };
     },
diff --git a/x-pack/plugins/ml/server/shared_services/providers/job_service.ts b/x-pack/plugins/ml/server/shared_services/providers/job_service.ts
index c734dcc1583a1b..2897bf08717f85 100644
--- a/x-pack/plugins/ml/server/shared_services/providers/job_service.ts
+++ b/x-pack/plugins/ml/server/shared_services/providers/job_service.ts
@@ -4,38 +4,32 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient, KibanaRequest } from 'kibana/server';
+import { KibanaRequest } from 'kibana/server';
 import { jobServiceProvider } from '../../models/job_service';
-import { SharedServicesChecks } from '../shared_services';
+import { GetGuards } from '../shared_services';
 
 type OrigJobServiceProvider = ReturnType<typeof jobServiceProvider>;
 
 export interface JobServiceProvider {
   jobServiceProvider(
-    mlClusterClient: ILegacyScopedClusterClient,
     request: KibanaRequest
   ): {
     jobsSummary: OrigJobServiceProvider['jobsSummary'];
   };
 }
 
-export function getJobServiceProvider({
-  isFullLicense,
-  getHasMlCapabilities,
-}: SharedServicesChecks): JobServiceProvider {
+export function getJobServiceProvider(getGuards: GetGuards): JobServiceProvider {
   return {
-    jobServiceProvider(mlClusterClient: ILegacyScopedClusterClient, request: KibanaRequest) {
-      // const hasMlCapabilities = getHasMlCapabilities(request);
-      const { jobsSummary } = jobServiceProvider(mlClusterClient);
+    jobServiceProvider(request: KibanaRequest) {
       return {
-        async jobsSummary(...args) {
-          isFullLicense();
-          // Removed while https://github.com/elastic/kibana/issues/64588 exists.
-          // SIEM are calling this endpoint with a dummy request object from their alerting
-          // integration and currently alerting does not supply a request object.
-          // await hasMlCapabilities(['canGetJobs']);
-
-          return jobsSummary(...args);
+        jobsSummary: async (...args) => {
+          return await getGuards(request)
+            .isFullLicense()
+            .hasMlCapabilities(['canGetJobs'])
+            .ok(async ({ scopedClient }) => {
+              const { jobsSummary } = jobServiceProvider(scopedClient);
+              return jobsSummary(...args);
+            });
         },
       };
     },
diff --git a/x-pack/plugins/ml/server/shared_services/providers/modules.ts b/x-pack/plugins/ml/server/shared_services/providers/modules.ts
index fb7d59f9c8218d..a727d96433f1db 100644
--- a/x-pack/plugins/ml/server/shared_services/providers/modules.ts
+++ b/x-pack/plugins/ml/server/shared_services/providers/modules.ts
@@ -4,23 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  ILegacyScopedClusterClient,
-  KibanaRequest,
-  SavedObjectsClientContract,
-} from 'kibana/server';
+import { IScopedClusterClient, KibanaRequest, SavedObjectsClientContract } from 'kibana/server';
 import { TypeOf } from '@kbn/config-schema';
 import { DataRecognizer } from '../../models/data_recognizer';
-import { SharedServicesChecks } from '../shared_services';
+import { GetGuards } from '../shared_services';
 import { moduleIdParamSchema, setupModuleBodySchema } from '../../routes/schemas/modules';
-import { HasMlCapabilities } from '../../lib/capabilities';
 
 export type ModuleSetupPayload = TypeOf<typeof moduleIdParamSchema> &
   TypeOf<typeof setupModuleBodySchema>;
 
 export interface ModulesProvider {
   modulesProvider(
-    mlClusterClient: ILegacyScopedClusterClient,
     request: KibanaRequest,
     savedObjectsClient: SavedObjectsClientContract
   ): {
@@ -31,61 +25,58 @@ export interface ModulesProvider {
   };
 }
 
-export function getModulesProvider({
-  isFullLicense,
-  getHasMlCapabilities,
-}: SharedServicesChecks): ModulesProvider {
+export function getModulesProvider(getGuards: GetGuards): ModulesProvider {
   return {
-    modulesProvider(
-      mlClusterClient: ILegacyScopedClusterClient,
-      request: KibanaRequest,
-      savedObjectsClient: SavedObjectsClientContract
-    ) {
-      let hasMlCapabilities: HasMlCapabilities;
-      if (request.params === 'DummyKibanaRequest') {
-        hasMlCapabilities = () => Promise.resolve();
-      } else {
-        hasMlCapabilities = getHasMlCapabilities(request);
-      }
-      const dr = dataRecognizerFactory(mlClusterClient, savedObjectsClient, request);
-
+    modulesProvider(request: KibanaRequest, savedObjectsClient: SavedObjectsClientContract) {
       return {
         async recognize(...args) {
-          isFullLicense();
-          await hasMlCapabilities(['canCreateJob']);
-
-          return dr.findMatches(...args);
+          return await getGuards(request)
+            .isFullLicense()
+            .hasMlCapabilities(['canGetJobs'])
+            .ok(async ({ scopedClient }) => {
+              const dr = dataRecognizerFactory(scopedClient, savedObjectsClient, request);
+              return dr.findMatches(...args);
+            });
         },
         async getModule(moduleId: string) {
-          isFullLicense();
-          await hasMlCapabilities(['canGetJobs']);
-
-          return dr.getModule(moduleId);
+          return await getGuards(request)
+            .isFullLicense()
+            .hasMlCapabilities(['canGetJobs'])
+            .ok(async ({ scopedClient }) => {
+              const dr = dataRecognizerFactory(scopedClient, savedObjectsClient, request);
+              return dr.getModule(moduleId);
+            });
         },
         async listModules() {
-          isFullLicense();
-          await hasMlCapabilities(['canGetJobs']);
-
-          return dr.listModules();
+          return await getGuards(request)
+            .isFullLicense()
+            .hasMlCapabilities(['canGetJobs'])
+            .ok(async ({ scopedClient }) => {
+              const dr = dataRecognizerFactory(scopedClient, savedObjectsClient, request);
+              return dr.listModules();
+            });
         },
         async setup(payload: ModuleSetupPayload) {
-          isFullLicense();
-          await hasMlCapabilities(['canCreateJob']);
-
-          return dr.setup(
-            payload.moduleId,
-            payload.prefix,
-            payload.groups,
-            payload.indexPatternName,
-            payload.query,
-            payload.useDedicatedIndex,
-            payload.startDatafeed,
-            payload.start,
-            payload.end,
-            payload.jobOverrides,
-            payload.datafeedOverrides,
-            payload.estimateModelMemory
-          );
+          return await getGuards(request)
+            .isFullLicense()
+            .hasMlCapabilities(['canCreateJob'])
+            .ok(async ({ scopedClient }) => {
+              const dr = dataRecognizerFactory(scopedClient, savedObjectsClient, request);
+              return dr.setup(
+                payload.moduleId,
+                payload.prefix,
+                payload.groups,
+                payload.indexPatternName,
+                payload.query,
+                payload.useDedicatedIndex,
+                payload.startDatafeed,
+                payload.start,
+                payload.end,
+                payload.jobOverrides,
+                payload.datafeedOverrides,
+                payload.estimateModelMemory
+              );
+            });
         },
       };
     },
@@ -93,9 +84,9 @@ export function getModulesProvider({
 }
 
 function dataRecognizerFactory(
-  mlClusterClient: ILegacyScopedClusterClient,
+  client: IScopedClusterClient,
   savedObjectsClient: SavedObjectsClientContract,
   request: KibanaRequest
 ) {
-  return new DataRecognizer(mlClusterClient, savedObjectsClient, request);
+  return new DataRecognizer(client, savedObjectsClient, request);
 }
diff --git a/x-pack/plugins/ml/server/shared_services/providers/results_service.ts b/x-pack/plugins/ml/server/shared_services/providers/results_service.ts
index 6af4eb008567ac..5536765cc376a2 100644
--- a/x-pack/plugins/ml/server/shared_services/providers/results_service.ts
+++ b/x-pack/plugins/ml/server/shared_services/providers/results_service.ts
@@ -4,41 +4,32 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient, KibanaRequest } from 'kibana/server';
+import { KibanaRequest } from 'kibana/server';
 import { resultsServiceProvider } from '../../models/results_service';
-import { SharedServicesChecks } from '../shared_services';
+import { GetGuards } from '../shared_services';
 
 type OrigResultsServiceProvider = ReturnType<typeof resultsServiceProvider>;
 
 export interface ResultsServiceProvider {
   resultsServiceProvider(
-    mlClusterClient: ILegacyScopedClusterClient,
     request: KibanaRequest
   ): {
     getAnomaliesTableData: OrigResultsServiceProvider['getAnomaliesTableData'];
   };
 }
 
-export function getResultsServiceProvider({
-  isFullLicense,
-  getHasMlCapabilities,
-}: SharedServicesChecks): ResultsServiceProvider {
+export function getResultsServiceProvider(getGuards: GetGuards): ResultsServiceProvider {
   return {
-    resultsServiceProvider(mlClusterClient: ILegacyScopedClusterClient, request: KibanaRequest) {
-      //  Uptime is using this service in anomaly alert, kibana alerting doesn't provide request object
-      // So we are adding a dummy request for now
-      // TODO: Remove this once kibana alerting provides request object
-      const hasMlCapabilities =
-        request.params !== 'DummyKibanaRequest'
-          ? getHasMlCapabilities(request)
-          : (_caps: string[]) => Promise.resolve();
-
-      const { getAnomaliesTableData } = resultsServiceProvider(mlClusterClient);
+    resultsServiceProvider(request: KibanaRequest) {
       return {
         async getAnomaliesTableData(...args) {
-          isFullLicense();
-          await hasMlCapabilities(['canGetJobs']);
-          return getAnomaliesTableData(...args);
+          return await getGuards(request)
+            .isFullLicense()
+            .hasMlCapabilities(['canGetJobs'])
+            .ok(async ({ scopedClient }) => {
+              const { getAnomaliesTableData } = resultsServiceProvider(scopedClient);
+              return getAnomaliesTableData(...args);
+            });
         },
       };
     },
diff --git a/x-pack/plugins/ml/server/shared_services/providers/system.ts b/x-pack/plugins/ml/server/shared_services/providers/system.ts
index d292abc438a2f3..3217ff13787b00 100644
--- a/x-pack/plugins/ml/server/shared_services/providers/system.ts
+++ b/x-pack/plugins/ml/server/shared_services/providers/system.ts
@@ -4,8 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILegacyScopedClusterClient, KibanaRequest } from 'kibana/server';
-import { SearchResponse, SearchParams } from 'elasticsearch';
+import { KibanaRequest } from 'kibana/server';
+import { SearchResponse } from 'elasticsearch';
+import { RequestParams } from '@elastic/elasticsearch';
 import { MlServerLicense } from '../../lib/license';
 import { CloudSetup } from '../../../../cloud/server';
 import { spacesUtilsProvider } from '../../lib/spaces_utils';
@@ -14,73 +15,79 @@ import { capabilitiesProvider } from '../../lib/capabilities';
 import { MlInfoResponse } from '../../../common/types/ml_server_info';
 import { ML_RESULTS_INDEX_PATTERN } from '../../../common/constants/index_patterns';
 import { MlCapabilitiesResponse, ResolveMlCapabilities } from '../../../common/types/capabilities';
-import { SharedServicesChecks } from '../shared_services';
+import { GetGuards } from '../shared_services';
 
 export interface MlSystemProvider {
   mlSystemProvider(
-    mlClusterClient: ILegacyScopedClusterClient,
     request: KibanaRequest
   ): {
     mlCapabilities(): Promise<MlCapabilitiesResponse>;
     mlInfo(): Promise<MlInfoResponse>;
-    mlAnomalySearch<T>(searchParams: SearchParams): Promise<SearchResponse<T>>;
+    mlAnomalySearch<T>(searchParams: RequestParams.Search<any>): Promise<SearchResponse<T>>;
   };
 }
 
 export function getMlSystemProvider(
-  { isMinimumLicense, isFullLicense, getHasMlCapabilities }: SharedServicesChecks,
+  getGuards: GetGuards,
   mlLicense: MlServerLicense,
   spaces: SpacesPluginSetup | undefined,
   cloud: CloudSetup | undefined,
   resolveMlCapabilities: ResolveMlCapabilities
 ): MlSystemProvider {
   return {
-    mlSystemProvider(mlClusterClient: ILegacyScopedClusterClient, request: KibanaRequest) {
-      // const hasMlCapabilities = getHasMlCapabilities(request);
-      const { callAsInternalUser } = mlClusterClient;
+    mlSystemProvider(request: KibanaRequest) {
       return {
         async mlCapabilities() {
-          isMinimumLicense();
+          return await getGuards(request)
+            .isMinimumLicense()
+            .ok(async ({ scopedClient }) => {
+              const { isMlEnabledInSpace } =
+                spaces !== undefined
+                  ? spacesUtilsProvider(spaces, request)
+                  : { isMlEnabledInSpace: async () => true };
 
-          const { isMlEnabledInSpace } =
-            spaces !== undefined
-              ? spacesUtilsProvider(spaces, request)
-              : { isMlEnabledInSpace: async () => true };
+              const mlCapabilities = await resolveMlCapabilities(request);
+              if (mlCapabilities === null) {
+                throw new Error('mlCapabilities is not defined');
+              }
 
-          const mlCapabilities = await resolveMlCapabilities(request);
-          if (mlCapabilities === null) {
-            throw new Error('mlCapabilities is not defined');
-          }
-
-          const { getCapabilities } = capabilitiesProvider(
-            mlClusterClient,
-            mlCapabilities,
-            mlLicense,
-            isMlEnabledInSpace
-          );
-          return getCapabilities();
+              const { getCapabilities } = capabilitiesProvider(
+                scopedClient,
+                mlCapabilities,
+                mlLicense,
+                isMlEnabledInSpace
+              );
+              return getCapabilities();
+            });
         },
         async mlInfo(): Promise<MlInfoResponse> {
-          isMinimumLicense();
+          return await getGuards(request)
+            .isMinimumLicense()
+            .ok(async ({ scopedClient }) => {
+              const { asInternalUser } = scopedClient;
 
-          const info = await callAsInternalUser('ml.info');
-          const cloudId = cloud && cloud.cloudId;
-          return {
-            ...info,
-            cloudId,
-          };
+              const { body: info } = await asInternalUser.ml.info<MlInfoResponse>();
+              const cloudId = cloud && cloud.cloudId;
+              return {
+                ...info,
+                cloudId,
+              };
+            });
         },
-        async mlAnomalySearch<T>(searchParams: SearchParams): Promise<SearchResponse<T>> {
-          isFullLicense();
-          // Removed while https://github.com/elastic/kibana/issues/64588 exists.
-          // SIEM are calling this endpoint with a dummy request object from their alerting
-          // integration and currently alerting does not supply a request object.
-          // await hasMlCapabilities(['canAccessML']);
-
-          return callAsInternalUser('search', {
-            ...searchParams,
-            index: ML_RESULTS_INDEX_PATTERN,
-          });
+        async mlAnomalySearch<T>(
+          searchParams: RequestParams.Search<any>
+        ): Promise<SearchResponse<T>> {
+          return await getGuards(request)
+            .isFullLicense()
+            .hasMlCapabilities(['canAccessML'])
+            .ok(async ({ scopedClient }) => {
+              const { asInternalUser } = scopedClient;
+              const { body } = await asInternalUser.search<SearchResponse<T>>({
+                ...searchParams,
+                index: ML_RESULTS_INDEX_PATTERN,
+              });
+              return body;
+            });
         },
       };
     },
diff --git a/x-pack/plugins/ml/server/shared_services/shared_services.ts b/x-pack/plugins/ml/server/shared_services/shared_services.ts
index 3345111fad4ae2..4c568e4515a278 100644
--- a/x-pack/plugins/ml/server/shared_services/shared_services.ts
+++ b/x-pack/plugins/ml/server/shared_services/shared_services.ts
@@ -4,7 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { KibanaRequest } from 'kibana/server';
+import { IClusterClient, IScopedClusterClient } from 'kibana/server';
+// including KibanaRequest from 'kibana/server' causes an error
+// when being used with instanceof
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { KibanaRequest } from '../../.././../../src/core/server/http';
 import { MlServerLicense } from '../lib/license';
 
 import { SpacesPluginSetup } from '../../../spaces/server';
@@ -18,8 +22,9 @@ import {
   AnomalyDetectorsProvider,
   getAnomalyDetectorsProvider,
 } from './providers/anomaly_detectors';
-import { ResolveMlCapabilities } from '../../common/types/capabilities';
+import { ResolveMlCapabilities, MlCapabilitiesKey } from '../../common/types/capabilities';
 import { hasMlCapabilitiesProvider, HasMlCapabilities } from '../lib/capabilities';
+import { MLClusterClientUninitialized } from './errors';
 
 export type SharedServices = JobServiceProvider &
   AnomalyDetectorsProvider &
@@ -27,31 +32,97 @@ export type SharedServices = JobServiceProvider &
   ModulesProvider &
   ResultsServiceProvider;
 
+interface Guards {
+  isMinimumLicense(): Guards;
+  isFullLicense(): Guards;
+  hasMlCapabilities: (caps: MlCapabilitiesKey[]) => Guards;
+  ok(callback: OkCallback): any;
+}
+
+export type GetGuards = (request: KibanaRequest) => Guards;
+
 export interface SharedServicesChecks {
-  isFullLicense(): void;
-  isMinimumLicense(): void;
-  getHasMlCapabilities(request: KibanaRequest): HasMlCapabilities;
+  getGuards(request: KibanaRequest): Guards;
 }
 
+interface OkParams {
+  scopedClient: IScopedClusterClient;
+}
+
+type OkCallback = (okParams: OkParams) => any;
+
 export function createSharedServices(
   mlLicense: MlServerLicense,
   spaces: SpacesPluginSetup | undefined,
   cloud: CloudSetup,
-  resolveMlCapabilities: ResolveMlCapabilities
+  resolveMlCapabilities: ResolveMlCapabilities,
+  getClusterClient: () => IClusterClient | null
 ): SharedServices {
+  const getRequestItems = getRequestItemsProvider(resolveMlCapabilities, getClusterClient);
   const { isFullLicense, isMinimumLicense } = licenseChecks(mlLicense);
-  const getHasMlCapabilities = hasMlCapabilitiesProvider(resolveMlCapabilities);
-  const checks: SharedServicesChecks = {
-    isFullLicense,
-    isMinimumLicense,
-    getHasMlCapabilities,
-  };
+
+  function getGuards(request: KibanaRequest): Guards {
+    const { hasMlCapabilities, scopedClient } = getRequestItems(request);
+    const asyncGuards: Array<Promise<void>> = [];
+
+    const guards: Guards = {
+      isMinimumLicense: () => {
+        isMinimumLicense();
+        return guards;
+      },
+      isFullLicense: () => {
+        isFullLicense();
+        return guards;
+      },
+      hasMlCapabilities: (caps: MlCapabilitiesKey[]) => {
+        asyncGuards.push(hasMlCapabilities(caps));
+        return guards;
+      },
+      async ok(callback: OkCallback) {
+        await Promise.all(asyncGuards);
+        return callback({ scopedClient });
+      },
+    };
+    return guards;
+  }
 
   return {
-    ...getJobServiceProvider(checks),
-    ...getAnomalyDetectorsProvider(checks),
-    ...getModulesProvider(checks),
-    ...getResultsServiceProvider(checks),
-    ...getMlSystemProvider(checks, mlLicense, spaces, cloud, resolveMlCapabilities),
+    ...getJobServiceProvider(getGuards),
+    ...getAnomalyDetectorsProvider(getGuards),
+    ...getModulesProvider(getGuards),
+    ...getResultsServiceProvider(getGuards),
+    ...getMlSystemProvider(getGuards, mlLicense, spaces, cloud, resolveMlCapabilities),
+  };
+}
+
+function getRequestItemsProvider(
+  resolveMlCapabilities: ResolveMlCapabilities,
+  getClusterClient: () => IClusterClient | null
+) {
+  return (request: KibanaRequest) => {
+    const getHasMlCapabilities = hasMlCapabilitiesProvider(resolveMlCapabilities);
+    let hasMlCapabilities: HasMlCapabilities;
+    let scopedClient: IScopedClusterClient;
+    // While https://github.com/elastic/kibana/issues/64588 exists we
+    // will not receive a real request object when being called from an alert.
+    // instead a dummy request object will be supplied
+    const clusterClient = getClusterClient();
+
+    if (clusterClient === null) {
+      throw new MLClusterClientUninitialized(`ML's cluster client has not been initialized`);
+    }
+
+    if (request instanceof KibanaRequest) {
+      hasMlCapabilities = getHasMlCapabilities(request);
+      scopedClient = clusterClient.asScoped(request);
+    } else {
+      hasMlCapabilities = () => Promise.resolve();
+      const { asInternalUser } = clusterClient;
+      scopedClient = {
+        asInternalUser,
+        asCurrentUser: asInternalUser,
+      };
+    }
+    return { hasMlCapabilities, scopedClient };
   };
 }
diff --git a/x-pack/plugins/ml/tsconfig.json b/x-pack/plugins/ml/tsconfig.json
deleted file mode 100644
index 4082f16a5d91ce..00000000000000
--- a/x-pack/plugins/ml/tsconfig.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "extends": "../../tsconfig.json"
-}
diff --git a/x-pack/plugins/monitoring/public/components/elasticsearch/ccr_shard/__snapshots__/ccr_shard.test.js.snap b/x-pack/plugins/monitoring/public/components/elasticsearch/ccr_shard/__snapshots__/ccr_shard.test.js.snap
index c2ee498d7189d9..e35d2ba6108f52 100644
--- a/x-pack/plugins/monitoring/public/components/elasticsearch/ccr_shard/__snapshots__/ccr_shard.test.js.snap
+++ b/x-pack/plugins/monitoring/public/components/elasticsearch/ccr_shard/__snapshots__/ccr_shard.test.js.snap
@@ -142,6 +142,8 @@ exports[`CcrShard that it renders normally 1`] = `
       }
       id="ccrLatestStat"
       initialIsOpen={false}
+      isLoading={false}
+      isLoadingMessage={false}
       paddingSize="l"
     >
       <EuiTitle
diff --git a/x-pack/plugins/observability/public/components/app/section/apm/index.tsx b/x-pack/plugins/observability/public/components/app/section/apm/index.tsx
index a1d51ffda6afd8..b635c2c68b9262 100644
--- a/x-pack/plugins/observability/public/components/app/section/apm/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/apm/index.tsx
@@ -112,7 +112,7 @@ export function APMSection({ absoluteTime, relativeTime, bucketSize }: Props) {
             <Axis
               id="y-axis"
               position={Position.Left}
-              showGridLines
+              gridLine={{ visible: true }}
               tickFormat={(value) => `${formatTpm(value)} tpm`}
             />
             <Axis id="x-axis" position={Position.Bottom} tickFormat={formatter} />
diff --git a/x-pack/plugins/observability/public/components/app/section/logs/index.tsx b/x-pack/plugins/observability/public/components/app/section/logs/index.tsx
index aa1dc1640125ef..343611294bc451 100644
--- a/x-pack/plugins/observability/public/components/app/section/logs/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/logs/index.tsx
@@ -150,7 +150,7 @@ export function LogsSection({ absoluteTime, relativeTime, bucketSize }: Props) {
                 />
                 <Axis
                   id="y-axis"
-                  showGridLines
+                  gridLine={{ visible: true }}
                   position={Position.Left}
                   tickFormat={(d: number) => numeral(d).format('0a')}
                 />
diff --git a/x-pack/plugins/observability/public/components/app/section/uptime/index.tsx b/x-pack/plugins/observability/public/components/app/section/uptime/index.tsx
index cfb06af3224c72..5c23c7a065b5e5 100644
--- a/x-pack/plugins/observability/public/components/app/section/uptime/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/uptime/index.tsx
@@ -182,7 +182,7 @@ function UptimeBarSeries({
       />
       <Axis
         id="y-axis"
-        showGridLines
+        gridLine={{ visible: true }}
         position={Position.Left}
         tickFormat={(x: any) => numeral(x).format('0a')}
       />
diff --git a/x-pack/plugins/reporting/server/browsers/chromium/driver/chromium_driver.ts b/x-pack/plugins/reporting/server/browsers/chromium/driver/chromium_driver.ts
index 5f23bbc390bb80..0a76c7fcfd3b27 100644
--- a/x-pack/plugins/reporting/server/browsers/chromium/driver/chromium_driver.ts
+++ b/x-pack/plugins/reporting/server/browsers/chromium/driver/chromium_driver.ts
@@ -12,7 +12,8 @@ import { parse as parseUrl } from 'url';
 import { getDisallowedOutgoingUrlError } from '../';
 import { LevelLogger } from '../../../lib';
 import { ViewZoomWidthHeight } from '../../../lib/layouts/layout';
-import { ConditionalHeaders, ElementPosition } from '../../../types';
+import { ElementPosition } from '../../../lib/screenshots';
+import { ConditionalHeaders } from '../../../types';
 import { allowRequest, NetworkPolicy } from '../../network_policy';
 
 export interface ChromiumDriverOptions {
diff --git a/x-pack/plugins/reporting/server/core.ts b/x-pack/plugins/reporting/server/core.ts
index 25594e1c0140b7..be32b52f198133 100644
--- a/x-pack/plugins/reporting/server/core.ts
+++ b/x-pack/plugins/reporting/server/core.ts
@@ -17,12 +17,11 @@ import {
 } from 'src/core/server';
 import { LicensingPluginSetup } from '../../licensing/server';
 import { SecurityPluginSetup } from '../../security/server';
-import { ScreenshotsObservableFn } from '../server/types';
 import { ReportingConfig } from './';
 import { HeadlessChromiumDriverFactory } from './browsers/chromium/driver_factory';
-import { screenshotsObservableFactory } from './lib/screenshots';
 import { checkLicense, getExportTypesRegistry } from './lib';
 import { ESQueueInstance } from './lib/create_queue';
+import { screenshotsObservableFactory, ScreenshotsObservableFn } from './lib/screenshots';
 import { ReportingStore } from './lib/store';
 
 export interface ReportingInternalSetup {
diff --git a/x-pack/plugins/reporting/server/export_types/common/decrypt_job_headers.ts b/x-pack/plugins/reporting/server/export_types/common/decrypt_job_headers.ts
index 845b9adb38be98..5ab029bfd9f29c 100644
--- a/x-pack/plugins/reporting/server/export_types/common/decrypt_job_headers.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/decrypt_job_headers.ts
@@ -14,14 +14,14 @@ interface HasEncryptedHeaders {
 // TODO merge functionality with CSV execute job
 export const decryptJobHeaders = async <
   JobParamsType,
-  ScheduledTaskParamsType extends HasEncryptedHeaders
+  TaskPayloadType extends HasEncryptedHeaders
 >({
   encryptionKey,
   job,
   logger,
 }: {
   encryptionKey?: string;
-  job: ScheduledTaskParamsType;
+  job: TaskPayloadType;
   logger: LevelLogger;
 }): Promise<Record<string, string>> => {
   try {
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.test.ts b/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.test.ts
index 0372d515c21a86..754bc7bc75cb53 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.test.ts
@@ -8,8 +8,8 @@ import sinon from 'sinon';
 import { ReportingConfig } from '../../';
 import { ReportingCore } from '../../core';
 import { createMockReportingCore } from '../../test_helpers';
-import { ScheduledTaskParams } from '../../types';
-import { ScheduledTaskParamsPDF } from '../printable_pdf/types';
+import { BasePayload } from '../../types';
+import { TaskPayloadPDF } from '../printable_pdf/types';
 import { getConditionalHeaders, getCustomLogo } from './';
 
 let mockConfig: ReportingConfig;
@@ -37,7 +37,7 @@ describe('conditions', () => {
     };
 
     const conditionalHeaders = await getConditionalHeaders({
-      job: {} as ScheduledTaskParams<any>,
+      job: {} as BasePayload<any>,
       filteredHeaders: permittedHeaders,
       config: mockConfig,
     });
@@ -64,14 +64,14 @@ test('uses basePath from job when creating saved object service', async () => {
     baz: 'quix',
   };
   const conditionalHeaders = await getConditionalHeaders({
-    job: {} as ScheduledTaskParams<any>,
+    job: {} as BasePayload<any>,
     filteredHeaders: permittedHeaders,
     config: mockConfig,
   });
   const jobBasePath = '/sbp/s/marketing';
   await getCustomLogo({
     reporting: mockReportingPlugin,
-    job: { basePath: jobBasePath } as ScheduledTaskParamsPDF,
+    job: { basePath: jobBasePath } as TaskPayloadPDF,
     conditionalHeaders,
     config: mockConfig,
   });
@@ -94,14 +94,14 @@ test(`uses basePath from server if job doesn't have a basePath when creating sav
     baz: 'quix',
   };
   const conditionalHeaders = await getConditionalHeaders({
-    job: {} as ScheduledTaskParams<any>,
+    job: {} as BasePayload<any>,
     filteredHeaders: permittedHeaders,
     config: mockConfig,
   });
 
   await getCustomLogo({
     reporting: mockReportingPlugin,
-    job: {} as ScheduledTaskParamsPDF,
+    job: {} as TaskPayloadPDF,
     conditionalHeaders,
     config: mockConfig,
   });
@@ -139,7 +139,7 @@ describe('config formatting', () => {
     mockConfig = getMockConfig(mockConfigGet);
 
     const conditionalHeaders = await getConditionalHeaders({
-      job: {} as ScheduledTaskParams<any>,
+      job: {} as BasePayload<any>,
       filteredHeaders: {},
       config: mockConfig,
     });
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.ts b/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.ts
index 799d0234868327..ce83323914eb8b 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/get_conditional_headers.ts
@@ -7,13 +7,13 @@
 import { ReportingConfig } from '../../';
 import { ConditionalHeaders } from '../../types';
 
-export const getConditionalHeaders = <ScheduledTaskParamsType>({
+export const getConditionalHeaders = <TaskPayloadType>({
   config,
   job,
   filteredHeaders,
 }: {
   config: ReportingConfig;
-  job: ScheduledTaskParamsType;
+  job: TaskPayloadType;
   filteredHeaders: Record<string, string>;
 }) => {
   const { kbnConfig } = config;
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.test.ts b/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.test.ts
index a3d65a1398a202..8c02fdd69de8bd 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.test.ts
@@ -6,7 +6,7 @@
 
 import { ReportingCore } from '../../core';
 import { createMockReportingCore } from '../../test_helpers';
-import { ScheduledTaskParamsPDF } from '../printable_pdf/types';
+import { TaskPayloadPDF } from '../printable_pdf/types';
 import { getConditionalHeaders, getCustomLogo } from './';
 
 const mockConfigGet = jest.fn().mockImplementation((key: string) => {
@@ -37,7 +37,7 @@ test(`gets logo from uiSettings`, async () => {
   });
 
   const conditionalHeaders = await getConditionalHeaders({
-    job: {} as ScheduledTaskParamsPDF,
+    job: {} as TaskPayloadPDF,
     filteredHeaders: permittedHeaders,
     config: mockConfig,
   });
@@ -45,7 +45,7 @@ test(`gets logo from uiSettings`, async () => {
   const { logo } = await getCustomLogo({
     reporting: mockReportingPlugin,
     config: mockConfig,
-    job: {} as ScheduledTaskParamsPDF,
+    job: {} as TaskPayloadPDF,
     conditionalHeaders,
   });
 
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.ts b/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.ts
index 547cc45258dae2..ee61d76c8a9330 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.ts
@@ -7,7 +7,7 @@
 import { ReportingConfig, ReportingCore } from '../../';
 import { UI_SETTINGS_CUSTOM_PDF_LOGO } from '../../../common/constants';
 import { ConditionalHeaders } from '../../types';
-import { ScheduledTaskParamsPDF } from '../printable_pdf/types'; // Logo is PDF only
+import { TaskPayloadPDF } from '../printable_pdf/types'; // Logo is PDF only
 
 export const getCustomLogo = async ({
   reporting,
@@ -17,7 +17,7 @@ export const getCustomLogo = async ({
 }: {
   reporting: ReportingCore;
   config: ReportingConfig;
-  job: ScheduledTaskParamsPDF;
+  job: TaskPayloadPDF;
   conditionalHeaders: ConditionalHeaders;
 }) => {
   const serverBasePath: string = config.kbnConfig.get('server', 'basePath');
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_full_urls.test.ts b/x-pack/plugins/reporting/server/export_types/common/get_full_urls.test.ts
index 73d7c7b03c1283..355536000326e7 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_full_urls.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/get_full_urls.test.ts
@@ -5,12 +5,12 @@
  */
 
 import { ReportingConfig } from '../../';
-import { ScheduledTaskParamsPNG } from '../png/types';
-import { ScheduledTaskParamsPDF } from '../printable_pdf/types';
+import { TaskPayloadPNG } from '../png/types';
+import { TaskPayloadPDF } from '../printable_pdf/types';
 import { getFullUrls } from './get_full_urls';
 
 interface FullUrlsOpts {
-  job: ScheduledTaskParamsPNG & ScheduledTaskParamsPDF;
+  job: TaskPayloadPNG & TaskPayloadPDF;
   config: ReportingConfig;
 }
 
@@ -35,7 +35,7 @@ beforeEach(() => {
   mockConfig = getMockConfig(mockConfigGet);
 });
 
-const getMockJob = (base: object) => base as ScheduledTaskParamsPNG & ScheduledTaskParamsPDF;
+const getMockJob = (base: object) => base as TaskPayloadPNG & TaskPayloadPDF;
 
 test(`fails if no URL is passed`, async () => {
   const fn = () => getFullUrls({ job: getMockJob({}), config: mockConfig } as FullUrlsOpts);
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_full_urls.ts b/x-pack/plugins/reporting/server/export_types/common/get_full_urls.ts
index d3362fd1906807..d6f472e18bc7b2 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_full_urls.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/get_full_urls.ts
@@ -11,28 +11,24 @@ import {
   UrlWithStringQuery,
 } from 'url';
 import { ReportingConfig } from '../../';
-import { ScheduledTaskParamsPNG } from '../png/types';
-import { ScheduledTaskParamsPDF } from '../printable_pdf/types';
+import { TaskPayloadPNG } from '../png/types';
+import { TaskPayloadPDF } from '../printable_pdf/types';
 import { getAbsoluteUrlFactory } from './get_absolute_url';
 import { validateUrls } from './validate_urls';
 
-function isPngJob(
-  job: ScheduledTaskParamsPNG | ScheduledTaskParamsPDF
-): job is ScheduledTaskParamsPNG {
-  return (job as ScheduledTaskParamsPNG).relativeUrl !== undefined;
+function isPngJob(job: TaskPayloadPNG | TaskPayloadPDF): job is TaskPayloadPNG {
+  return (job as TaskPayloadPNG).relativeUrl !== undefined;
 }
-function isPdfJob(
-  job: ScheduledTaskParamsPNG | ScheduledTaskParamsPDF
-): job is ScheduledTaskParamsPDF {
-  return (job as ScheduledTaskParamsPDF).relativeUrls !== undefined;
+function isPdfJob(job: TaskPayloadPNG | TaskPayloadPDF): job is TaskPayloadPDF {
+  return (job as TaskPayloadPDF).relativeUrls !== undefined;
 }
 
-export function getFullUrls<ScheduledTaskParamsType>({
+export function getFullUrls<TaskPayloadType>({
   config,
   job,
 }: {
   config: ReportingConfig;
-  job: ScheduledTaskParamsPDF | ScheduledTaskParamsPNG;
+  job: TaskPayloadPDF | TaskPayloadPNG;
 }) {
   const [basePath, protocol, hostname, port] = [
     config.kbnConfig.get('server', 'basePath'),
diff --git a/x-pack/plugins/reporting/server/export_types/common/omit_blacklisted_headers.ts b/x-pack/plugins/reporting/server/export_types/common/omit_blacklisted_headers.ts
index e56ffc737764c8..b2e0ce23aa3a54 100644
--- a/x-pack/plugins/reporting/server/export_types/common/omit_blacklisted_headers.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/omit_blacklisted_headers.ts
@@ -9,11 +9,11 @@ import {
   KBN_SCREENSHOT_HEADER_BLACKLIST_STARTS_WITH_PATTERN,
 } from '../../../common/constants';
 
-export const omitBlacklistedHeaders = <ScheduledTaskParamsType>({
+export const omitBlacklistedHeaders = <TaskPayloadType>({
   job,
   decryptedHeaders,
 }: {
-  job: ScheduledTaskParamsType;
+  job: TaskPayloadType;
   decryptedHeaders: Record<string, string>;
 }) => {
   const filteredHeaders: Record<string, string> = omitBy(
diff --git a/x-pack/plugins/reporting/server/export_types/csv/create_job.ts b/x-pack/plugins/reporting/server/export_types/csv/create_job.ts
index 252968e386b53f..be18bd7fff361d 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/create_job.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/create_job.ts
@@ -5,16 +5,16 @@
  */
 
 import { cryptoFactory } from '../../lib';
-import { CreateJobFn, ScheduleTaskFnFactory } from '../../types';
+import { CreateJobFn, CreateJobFnFactory } from '../../types';
 import { JobParamsDiscoverCsv } from './types';
 
-export const scheduleTaskFnFactory: ScheduleTaskFnFactory<CreateJobFn<
+export const createJobFnFactory: CreateJobFnFactory<CreateJobFn<
   JobParamsDiscoverCsv
 >> = function createJobFactoryFn(reporting) {
   const config = reporting.getConfig();
   const crypto = cryptoFactory(config.get('encryptionKey'));
 
-  return async function scheduleTask(jobParams, context, request) {
+  return async function createJob(jobParams, context, request) {
     const serializedEncryptedHeaders = await crypto.encrypt(request.headers);
 
     const savedObjectsClient = context.core.savedObjects.client;
diff --git a/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts b/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
index 5eeef0f9906dd4..15432d0cbd1474 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
@@ -21,7 +21,7 @@ import { LevelLogger } from '../../lib';
 import { setFieldFormats } from '../../services';
 import { createMockReportingCore } from '../../test_helpers';
 import { runTaskFnFactory } from './execute_job';
-import { ScheduledTaskParamsCSV } from './types';
+import { TaskPayloadCSV } from './types';
 
 const delay = (ms: number) => new Promise((resolve) => setTimeout(() => resolve(), ms));
 
@@ -30,7 +30,7 @@ const getRandomScrollId = () => {
   return puid.generate();
 };
 
-const getScheduledTaskParams = (baseObj: any) => baseObj as ScheduledTaskParamsCSV;
+const getBasePayload = (baseObj: any) => baseObj as TaskPayloadCSV;
 
 describe('CSV Execute Job', function () {
   const encryptionKey = 'testEncryptionKey';
@@ -128,7 +128,7 @@ describe('CSV Execute Job', function () {
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
       await runTask(
         'job456',
-        getScheduledTaskParams({
+        getBasePayload({
           headers: encryptedHeaders,
           fields: [],
           searchRequest: { index: null, body: null },
@@ -146,7 +146,7 @@ describe('CSV Execute Job', function () {
       };
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const job = getScheduledTaskParams({
+      const job = getBasePayload({
         headers: encryptedHeaders,
         fields: [],
         searchRequest: {
@@ -175,7 +175,7 @@ describe('CSV Execute Job', function () {
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
       await runTask(
         'job456',
-        getScheduledTaskParams({
+        getBasePayload({
           headers: encryptedHeaders,
           fields: [],
           searchRequest: { index: null, body: null },
@@ -193,7 +193,7 @@ describe('CSV Execute Job', function () {
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
       await runTask(
         'job456',
-        getScheduledTaskParams({
+        getBasePayload({
           headers: encryptedHeaders,
           fields: [],
           searchRequest: { index: null, body: null },
@@ -227,7 +227,7 @@ describe('CSV Execute Job', function () {
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
       await runTask(
         'job456',
-        getScheduledTaskParams({
+        getBasePayload({
           headers: encryptedHeaders,
           fields: [],
           searchRequest: { index: null, body: null },
@@ -266,7 +266,7 @@ describe('CSV Execute Job', function () {
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
       await runTask(
         'job456',
-        getScheduledTaskParams({
+        getBasePayload({
           headers: encryptedHeaders,
           fields: [],
           searchRequest: { index: null, body: null },
@@ -296,7 +296,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: undefined,
@@ -323,7 +323,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -348,7 +348,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['=SUM(A1:A2)', 'two'],
         conflictedTypesFields: [],
@@ -374,7 +374,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -400,7 +400,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['=SUM(A1:A2)', 'two'],
         conflictedTypesFields: [],
@@ -426,7 +426,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -453,7 +453,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -474,7 +474,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -497,7 +497,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -518,7 +518,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -534,7 +534,7 @@ describe('CSV Execute Job', function () {
     it('should reject Promise if search call errors out', async function () {
       callAsCurrentUserStub.rejects(new Error());
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: [],
         searchRequest: { index: null, body: null },
@@ -553,7 +553,7 @@ describe('CSV Execute Job', function () {
       });
       callAsCurrentUserStub.onSecondCall().rejects(new Error());
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: [],
         searchRequest: { index: null, body: null },
@@ -574,7 +574,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: [],
         searchRequest: { index: null, body: null },
@@ -593,7 +593,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: [],
         searchRequest: { index: null, body: null },
@@ -619,7 +619,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: [],
         searchRequest: { index: null, body: null },
@@ -645,7 +645,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: [],
         searchRequest: { index: null, body: null },
@@ -681,7 +681,7 @@ describe('CSV Execute Job', function () {
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
       runTask(
         'job345',
-        getScheduledTaskParams({
+        getBasePayload({
           headers: encryptedHeaders,
           fields: [],
           searchRequest: { index: null, body: null },
@@ -700,7 +700,7 @@ describe('CSV Execute Job', function () {
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
       runTask(
         'job345',
-        getScheduledTaskParams({
+        getBasePayload({
           headers: encryptedHeaders,
           fields: [],
           searchRequest: { index: null, body: null },
@@ -718,7 +718,7 @@ describe('CSV Execute Job', function () {
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
       runTask(
         'job345',
-        getScheduledTaskParams({
+        getBasePayload({
           headers: encryptedHeaders,
           fields: [],
           searchRequest: { index: null, body: null },
@@ -738,7 +738,7 @@ describe('CSV Execute Job', function () {
   describe('csv content', function () {
     it('should write column headers to output, even if there are no results', async function () {
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         searchRequest: { index: null, body: null },
@@ -750,7 +750,7 @@ describe('CSV Execute Job', function () {
     it('should use custom uiSettings csv:separator for header', async function () {
       mockUiSettingsClient.get.withArgs(CSV_SEPARATOR_SETTING).returns(';');
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         searchRequest: { index: null, body: null },
@@ -762,7 +762,7 @@ describe('CSV Execute Job', function () {
     it('should escape column headers if uiSettings csv:quoteValues is true', async function () {
       mockUiSettingsClient.get.withArgs(CSV_QUOTE_VALUES_SETTING).returns(true);
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one and a half', 'two', 'three-and-four', 'five & six'],
         searchRequest: { index: null, body: null },
@@ -774,7 +774,7 @@ describe('CSV Execute Job', function () {
     it(`shouldn't escape column headers if uiSettings csv:quoteValues is false`, async function () {
       mockUiSettingsClient.get.withArgs(CSV_QUOTE_VALUES_SETTING).returns(false);
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one and a half', 'two', 'three-and-four', 'five & six'],
         searchRequest: { index: null, body: null },
@@ -792,7 +792,7 @@ describe('CSV Execute Job', function () {
         _scroll_id: 'scrollId',
       });
 
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         searchRequest: { index: null, body: null },
@@ -813,7 +813,7 @@ describe('CSV Execute Job', function () {
         _scroll_id: 'scrollId',
       });
 
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -841,7 +841,7 @@ describe('CSV Execute Job', function () {
         _scroll_id: 'scrollId',
       });
 
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -864,7 +864,7 @@ describe('CSV Execute Job', function () {
         _scroll_id: 'scrollId',
       });
 
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -900,7 +900,7 @@ describe('CSV Execute Job', function () {
         configGetStub.withArgs('csv', 'maxSizeBytes').returns(1);
 
         const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-        const jobParams = getScheduledTaskParams({
+        const jobParams = getBasePayload({
           headers: encryptedHeaders,
           fields: ['one', 'two'],
           searchRequest: { index: null, body: null },
@@ -930,7 +930,7 @@ describe('CSV Execute Job', function () {
         configGetStub.withArgs('csv', 'maxSizeBytes').returns(9);
 
         const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-        const jobParams = getScheduledTaskParams({
+        const jobParams = getBasePayload({
           headers: encryptedHeaders,
           fields: ['one', 'two'],
           searchRequest: { index: null, body: null },
@@ -967,7 +967,7 @@ describe('CSV Execute Job', function () {
         });
 
         const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-        const jobParams = getScheduledTaskParams({
+        const jobParams = getBasePayload({
           headers: encryptedHeaders,
           fields: ['one', 'two'],
           conflictedTypesFields: [],
@@ -1007,7 +1007,7 @@ describe('CSV Execute Job', function () {
         });
 
         const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-        const jobParams = getScheduledTaskParams({
+        const jobParams = getBasePayload({
           headers: encryptedHeaders,
           fields: ['one', 'two'],
           conflictedTypesFields: [],
@@ -1044,7 +1044,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -1070,7 +1070,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
@@ -1096,7 +1096,7 @@ describe('CSV Execute Job', function () {
       });
 
       const runTask = runTaskFnFactory(mockReportingCore, mockLogger);
-      const jobParams = getScheduledTaskParams({
+      const jobParams = getBasePayload({
         headers: encryptedHeaders,
         fields: ['one', 'two'],
         conflictedTypesFields: [],
diff --git a/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts b/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts
index b56a08b86b0cd2..b308935a29e920 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts
@@ -10,9 +10,9 @@ import Hapi from 'hapi';
 import { KibanaRequest } from '../../../../../../src/core/server';
 import { CONTENT_TYPE_CSV, CSV_JOB_TYPE } from '../../../common/constants';
 import { cryptoFactory, LevelLogger } from '../../lib';
-import { WorkerExecuteFn, RunTaskFnFactory } from '../../types';
-import { ScheduledTaskParamsCSV } from './types';
+import { RunTaskFn, RunTaskFnFactory } from '../../types';
 import { createGenerateCsv } from './generate_csv';
+import { TaskPayloadCSV } from './types';
 
 const getRequest = async (headers: string | undefined, crypto: Crypto, logger: LevelLogger) => {
   const decryptHeaders = async () => {
@@ -55,8 +55,8 @@ const getRequest = async (headers: string | undefined, crypto: Crypto, logger: L
   } as Hapi.Request);
 };
 
-export const runTaskFnFactory: RunTaskFnFactory<WorkerExecuteFn<
-  ScheduledTaskParamsCSV
+export const runTaskFnFactory: RunTaskFnFactory<RunTaskFn<
+  TaskPayloadCSV
 >> = function executeJobFactoryFn(reporting, parentLogger) {
   const config = reporting.getConfig();
   const crypto = cryptoFactory(config.get('encryptionKey'));
diff --git a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/hit_iterator.test.ts b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/hit_iterator.test.ts
index 831bf45cf72ea2..b7147fe0a9ebde 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/hit_iterator.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/hit_iterator.test.ts
@@ -7,17 +7,13 @@
 import expect from '@kbn/expect';
 import sinon from 'sinon';
 import { CancellationToken } from '../../../../common';
-import { LevelLogger } from '../../../lib';
+import { createMockLevelLogger } from '../../../test_helpers/create_mock_levellogger';
 import { ScrollConfig } from '../../../types';
 import { createHitIterator } from './hit_iterator';
 
-const mockLogger = {
-  error: new Function(),
-  debug: new Function(),
-  warning: new Function(),
-} as LevelLogger;
+const mockLogger = createMockLevelLogger();
 const debugLogStub = sinon.stub(mockLogger, 'debug');
-const warnLogStub = sinon.stub(mockLogger, 'warning');
+const warnLogStub = sinon.stub(mockLogger, 'warn');
 const errorLogStub = sinon.stub(mockLogger, 'error');
 const mockCallEndpoint = sinon.stub();
 const mockSearchRequest = {};
@@ -134,4 +130,30 @@ describe('hitIterator', function () {
     expect(errorLogStub.callCount).to.be(1);
     expect(errorThrown).to.be(true);
   });
+
+  it('handles scroll id could not be cleared', async () => {
+    // Setup
+    mockCallEndpoint.withArgs('clearScroll').rejects({ status: 404 });
+
+    // Begin
+    const hitIterator = createHitIterator(mockLogger);
+    const iterator = hitIterator(
+      mockConfig,
+      mockCallEndpoint,
+      mockSearchRequest,
+      realCancellationToken
+    );
+
+    while (true) {
+      const { done: iterationDone, value: hit } = await iterator.next();
+      if (iterationDone) {
+        break;
+      }
+      expect(hit).to.be('you found me');
+    }
+
+    expect(mockCallEndpoint.callCount).to.be(13);
+    expect(warnLogStub.callCount).to.be(1);
+    expect(errorLogStub.callCount).to.be(1);
+  });
 });
diff --git a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/hit_iterator.ts b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/hit_iterator.ts
index dee653cf30007b..b95a3112002660 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/hit_iterator.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/hit_iterator.ts
@@ -68,11 +68,17 @@ export function createHitIterator(logger: LevelLogger) {
       );
     }
 
-    function clearScroll(scrollId: string | undefined) {
+    async function clearScroll(scrollId: string | undefined) {
       logger.debug('executing clearScroll request');
-      return callEndpoint('clearScroll', {
-        scrollId: [scrollId],
-      });
+      try {
+        await callEndpoint('clearScroll', {
+          scrollId: [scrollId],
+        });
+      } catch (err) {
+        // Do not throw the error, as the job can still be completed successfully
+        logger.warn('Scroll context can not be cleared!');
+        logger.error(err);
+      }
     }
 
     try {
@@ -86,7 +92,7 @@ export function createHitIterator(logger: LevelLogger) {
           ({ scrollId, hits } = await scroll(scrollId));
 
           if (cancellationToken.isCancelled()) {
-            logger.warning(
+            logger.warn(
               'Any remaining scrolling searches have been cancelled by the cancellation token.'
             );
           }
diff --git a/x-pack/plugins/reporting/server/export_types/csv/index.ts b/x-pack/plugins/reporting/server/export_types/csv/index.ts
index 4bca42e0661e5c..b54844cdf17427 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/index.ts
@@ -13,22 +13,22 @@ import {
   LICENSE_TYPE_TRIAL,
 } from '../../../common/constants';
 import { CSV_JOB_TYPE as jobType } from '../../../constants';
-import { CreateJobFn, WorkerExecuteFn, ExportTypeDefinition } from '../../types';
-import { scheduleTaskFnFactory } from './create_job';
+import { CreateJobFn, ExportTypeDefinition, RunTaskFn } from '../../types';
+import { createJobFnFactory } from './create_job';
 import { runTaskFnFactory } from './execute_job';
 import { metadata } from './metadata';
-import { JobParamsDiscoverCsv, ScheduledTaskParamsCSV } from './types';
+import { JobParamsDiscoverCsv, TaskPayloadCSV } from './types';
 
 export const getExportType = (): ExportTypeDefinition<
   JobParamsDiscoverCsv,
   CreateJobFn<JobParamsDiscoverCsv>,
-  ScheduledTaskParamsCSV,
-  WorkerExecuteFn<ScheduledTaskParamsCSV>
+  TaskPayloadCSV,
+  RunTaskFn<TaskPayloadCSV>
 > => ({
   ...metadata,
   jobType,
   jobContentExtension: 'csv',
-  scheduleTaskFnFactory,
+  createJobFnFactory,
   runTaskFnFactory,
   validLicenses: [
     LICENSE_TYPE_TRIAL,
diff --git a/x-pack/plugins/reporting/server/export_types/csv/types.d.ts b/x-pack/plugins/reporting/server/export_types/csv/types.d.ts
index e0d09d04a3d3a4..f420d8b033170d 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/types.d.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/types.d.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CreateJobBaseParams, ScheduledTaskParams } from '../../types';
+import { BaseParams, BasePayload } from '../../types';
 
 export type RawValue = string | object | null | undefined;
 
@@ -28,7 +28,7 @@ export interface IndexPatternSavedObject {
   };
 }
 
-export interface JobParamsDiscoverCsv extends CreateJobBaseParams {
+export interface JobParamsDiscoverCsv extends BaseParams {
   indexPatternId: string;
   title: string;
   searchRequest: SearchRequest;
@@ -37,7 +37,7 @@ export interface JobParamsDiscoverCsv extends CreateJobBaseParams {
   conflictedTypesFields: string[];
 }
 
-export interface ScheduledTaskParamsCSV extends ScheduledTaskParams<JobParamsDiscoverCsv> {
+export interface TaskPayloadCSV extends BasePayload<JobParamsDiscoverCsv> {
   basePath: string;
   searchRequest: any;
   fields: any;
diff --git a/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/create_job.ts b/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/create_job.ts
index 9acfc6d8c608d1..1746792981a21f 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/create_job.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/create_job.ts
@@ -9,7 +9,7 @@ import { get } from 'lodash';
 import { KibanaRequest, RequestHandlerContext } from 'src/core/server';
 import { CSV_FROM_SAVEDOBJECT_JOB_TYPE } from '../../../common/constants';
 import { cryptoFactory } from '../../lib';
-import { ScheduleTaskFnFactory, TimeRangeParams } from '../../types';
+import { CreateJobFnFactory, TimeRangeParams } from '../../types';
 import {
   JobParamsPanelCsv,
   SavedObject,
@@ -37,7 +37,7 @@ interface VisData {
   panel: SearchPanel;
 }
 
-export const scheduleTaskFnFactory: ScheduleTaskFnFactory<ImmediateCreateJobFn> = function createJobFactoryFn(
+export const createJobFnFactory: CreateJobFnFactory<ImmediateCreateJobFn> = function createJobFactoryFn(
   reporting,
   parentLogger
 ) {
@@ -45,7 +45,7 @@ export const scheduleTaskFnFactory: ScheduleTaskFnFactory<ImmediateCreateJobFn>
   const crypto = cryptoFactory(config.get('encryptionKey'));
   const logger = parentLogger.clone([CSV_FROM_SAVEDOBJECT_JOB_TYPE, 'create-job']);
 
-  return async function scheduleTask(jobParams, headers, context, req) {
+  return async function createJob(jobParams, headers, context, req) {
     const { savedObjectType, savedObjectId } = jobParams;
     const serializedEncryptedHeaders = await crypto.encrypt(headers);
 
diff --git a/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/execute_job.ts b/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/execute_job.ts
index ec7e0a21f0498a..3a5deda176b8c1 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/execute_job.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/execute_job.ts
@@ -7,16 +7,16 @@
 import { KibanaRequest, RequestHandlerContext } from 'src/core/server';
 import { CancellationToken } from '../../../common';
 import { CONTENT_TYPE_CSV, CSV_FROM_SAVEDOBJECT_JOB_TYPE } from '../../../common/constants';
-import { RunTaskFnFactory, ScheduledTaskParams, TaskRunResult } from '../../types';
+import { BasePayload, RunTaskFnFactory, TaskRunResult } from '../../types';
 import { createGenerateCsv } from '../csv/generate_csv';
-import { JobParamsPanelCsv, SearchPanel } from './types';
 import { getGenerateCsvParams } from './lib/get_csv_job';
+import { JobParamsPanelCsv, SearchPanel } from './types';
 
 /*
  * The run function receives the full request which provides the un-encrypted
  * headers, so encrypted headers are not part of these kind of job params
  */
-type ImmediateJobParams = Omit<ScheduledTaskParams<JobParamsPanelCsv>, 'headers'>;
+type ImmediateJobParams = Omit<BasePayload<JobParamsPanelCsv>, 'headers'>;
 
 /*
  * ImmediateExecuteFn receives the job doc payload because the payload was
diff --git a/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/index.ts b/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/index.ts
index 7467f415299fa1..4b4cfb3f062bf2 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/index.ts
@@ -14,16 +14,16 @@ import {
 } from '../../../common/constants';
 import { CSV_FROM_SAVEDOBJECT_JOB_TYPE } from '../../../constants';
 import { ExportTypeDefinition } from '../../types';
-import { metadata } from './metadata';
-import { ImmediateCreateJobFn, scheduleTaskFnFactory } from './create_job';
+import { createJobFnFactory, ImmediateCreateJobFn } from './create_job';
 import { ImmediateExecuteFn, runTaskFnFactory } from './execute_job';
+import { metadata } from './metadata';
 import { JobParamsPanelCsv } from './types';
 
 /*
  * These functions are exported to share with the API route handler that
  * generates csv from saved object immediately on request.
  */
-export { scheduleTaskFnFactory } from './create_job';
+export { createJobFnFactory } from './create_job';
 export { runTaskFnFactory } from './execute_job';
 
 export const getExportType = (): ExportTypeDefinition<
@@ -35,7 +35,7 @@ export const getExportType = (): ExportTypeDefinition<
   ...metadata,
   jobType: CSV_FROM_SAVEDOBJECT_JOB_TYPE,
   jobContentExtension: 'csv',
-  scheduleTaskFnFactory,
+  createJobFnFactory,
   runTaskFnFactory,
   validLicenses: [
     LICENSE_TYPE_TRIAL,
diff --git a/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/types.d.ts b/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/types.d.ts
index 0d19a24114f06d..9c45d23b13a371 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/types.d.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/types.d.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { JobParamPostPayload, ScheduledTaskParams, TimeRangeParams } from '../../types';
+import { JobParamPostPayload, TimeRangeParams } from '../../types';
 
 export interface FakeRequest {
   headers: Record<string, unknown>;
@@ -14,11 +14,20 @@ export interface JobParamsPostPayloadPanelCsv extends JobParamPostPayload {
   state?: any;
 }
 
+export interface SearchPanel {
+  indexPatternSavedObjectId: string;
+  attributes: SavedSearchObjectAttributes;
+  timerange: TimeRangeParams;
+}
+
+export interface JobPayloadPanelCsv extends JobParamsPanelCsv {
+  panel: SearchPanel;
+}
+
 export interface JobParamsPanelCsv {
   savedObjectType: string;
   savedObjectId: string;
   isImmediate: boolean;
-  panel?: SearchPanel;
   post?: JobParamsPostPayloadPanelCsv;
   visType?: string;
 }
@@ -102,12 +111,6 @@ export interface VisPanel {
   timerange: TimeRangeParams;
 }
 
-export interface SearchPanel {
-  indexPatternSavedObjectId: string;
-  attributes: SavedSearchObjectAttributes;
-  timerange: TimeRangeParams;
-}
-
 export interface DocValueFields {
   field: string;
   format: string;
diff --git a/x-pack/plugins/reporting/server/export_types/png/create_job/index.ts b/x-pack/plugins/reporting/server/export_types/png/create_job/index.ts
index 2252177e980850..173a67ad18edf7 100644
--- a/x-pack/plugins/reporting/server/export_types/png/create_job/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/png/create_job/index.ts
@@ -5,17 +5,17 @@
  */
 
 import { cryptoFactory } from '../../../lib';
-import { CreateJobFn, ScheduleTaskFnFactory } from '../../../types';
+import { CreateJobFn, CreateJobFnFactory } from '../../../types';
 import { validateUrls } from '../../common';
 import { JobParamsPNG } from '../types';
 
-export const scheduleTaskFnFactory: ScheduleTaskFnFactory<CreateJobFn<
+export const createJobFnFactory: CreateJobFnFactory<CreateJobFn<
   JobParamsPNG
 >> = function createJobFactoryFn(reporting) {
   const config = reporting.getConfig();
   const crypto = cryptoFactory(config.get('encryptionKey'));
 
-  return async function scheduleTask(
+  return async function createJob(
     { objectType, title, relativeUrl, browserTimezone, layout },
     context,
     req
diff --git a/x-pack/plugins/reporting/server/export_types/png/execute_job/index.test.ts b/x-pack/plugins/reporting/server/export_types/png/execute_job/index.test.ts
index a0bd2d392187a6..8a3f514ec7aeaf 100644
--- a/x-pack/plugins/reporting/server/export_types/png/execute_job/index.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/png/execute_job/index.test.ts
@@ -9,8 +9,8 @@ import { ReportingCore } from '../../../';
 import { CancellationToken } from '../../../../common';
 import { cryptoFactory, LevelLogger } from '../../../lib';
 import { createMockReportingCore } from '../../../test_helpers';
-import { ScheduledTaskParamsPNG } from '../types';
 import { generatePngObservableFactory } from '../lib/generate_png';
+import { TaskPayloadPNG } from '../types';
 import { runTaskFnFactory } from './';
 
 jest.mock('../lib/generate_png', () => ({ generatePngObservableFactory: jest.fn() }));
@@ -36,7 +36,7 @@ const encryptHeaders = async (headers: Record<string, string>) => {
   return await crypto.encrypt(headers);
 };
 
-const getScheduledTaskParams = (baseObj: any) => baseObj as ScheduledTaskParamsPNG;
+const getBasePayload = (baseObj: any) => baseObj as TaskPayloadPNG;
 
 beforeEach(async () => {
   const kbnConfig = {
@@ -85,7 +85,7 @@ test(`passes browserTimezone to generatePng`, async () => {
   const browserTimezone = 'UTC';
   await runTask(
     'pngJobId',
-    getScheduledTaskParams({
+    getBasePayload({
       relativeUrl: '/app/kibana#/something',
       browserTimezone,
       headers: encryptedHeaders,
@@ -133,7 +133,7 @@ test(`returns content_type of application/png`, async () => {
 
   const { content_type: contentType } = await runTask(
     'pngJobId',
-    getScheduledTaskParams({ relativeUrl: '/app/kibana#/something', headers: encryptedHeaders }),
+    getBasePayload({ relativeUrl: '/app/kibana#/something', headers: encryptedHeaders }),
     cancellationToken
   );
   expect(contentType).toBe('image/png');
@@ -148,7 +148,7 @@ test(`returns content of generatePng getBuffer base64 encoded`, async () => {
   const encryptedHeaders = await encryptHeaders({});
   const { content } = await runTask(
     'pngJobId',
-    getScheduledTaskParams({ relativeUrl: '/app/kibana#/something', headers: encryptedHeaders }),
+    getBasePayload({ relativeUrl: '/app/kibana#/something', headers: encryptedHeaders }),
     cancellationToken
   );
 
diff --git a/x-pack/plugins/reporting/server/export_types/png/execute_job/index.ts b/x-pack/plugins/reporting/server/export_types/png/execute_job/index.ts
index 35cd4139df413f..96b896b9389622 100644
--- a/x-pack/plugins/reporting/server/export_types/png/execute_job/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/png/execute_job/index.ts
@@ -8,7 +8,7 @@ import apm from 'elastic-apm-node';
 import * as Rx from 'rxjs';
 import { catchError, map, mergeMap, takeUntil } from 'rxjs/operators';
 import { PNG_JOB_TYPE } from '../../../../common/constants';
-import { WorkerExecuteFn, RunTaskFnFactory, TaskRunResult } from '../../..//types';
+import { RunTaskFn, RunTaskFnFactory, TaskRunResult } from '../../..//types';
 import {
   decryptJobHeaders,
   getConditionalHeaders,
@@ -16,9 +16,9 @@ import {
   omitBlacklistedHeaders,
 } from '../../common';
 import { generatePngObservableFactory } from '../lib/generate_png';
-import { ScheduledTaskParamsPNG } from '../types';
+import { TaskPayloadPNG } from '../types';
 
-type QueuedPngExecutorFactory = RunTaskFnFactory<WorkerExecuteFn<ScheduledTaskParamsPNG>>;
+type QueuedPngExecutorFactory = RunTaskFnFactory<RunTaskFn<TaskPayloadPNG>>;
 
 export const runTaskFnFactory: QueuedPngExecutorFactory = function executeJobFactoryFn(
   reporting,
diff --git a/x-pack/plugins/reporting/server/export_types/png/index.ts b/x-pack/plugins/reporting/server/export_types/png/index.ts
index c966dedb6b076d..1cc6836572b7b3 100644
--- a/x-pack/plugins/reporting/server/export_types/png/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/png/index.ts
@@ -12,23 +12,23 @@ import {
   LICENSE_TYPE_TRIAL,
   PNG_JOB_TYPE as jobType,
 } from '../../../common/constants';
-import { CreateJobFn, WorkerExecuteFn, ExportTypeDefinition } from '../../types';
-import { scheduleTaskFnFactory } from './create_job';
+import { CreateJobFn, ExportTypeDefinition, RunTaskFn } from '../../types';
+import { createJobFnFactory } from './create_job';
 import { runTaskFnFactory } from './execute_job';
 import { metadata } from './metadata';
-import { JobParamsPNG, ScheduledTaskParamsPNG } from './types';
+import { JobParamsPNG, TaskPayloadPNG } from './types';
 
 export const getExportType = (): ExportTypeDefinition<
   JobParamsPNG,
   CreateJobFn<JobParamsPNG>,
-  ScheduledTaskParamsPNG,
-  WorkerExecuteFn<ScheduledTaskParamsPNG>
+  TaskPayloadPNG,
+  RunTaskFn<TaskPayloadPNG>
 > => ({
   ...metadata,
   jobType,
   jobContentEncoding: 'base64',
   jobContentExtension: 'PNG',
-  scheduleTaskFnFactory,
+  createJobFnFactory,
   runTaskFnFactory,
   validLicenses: [
     LICENSE_TYPE_TRIAL,
diff --git a/x-pack/plugins/reporting/server/export_types/png/lib/generate_png.ts b/x-pack/plugins/reporting/server/export_types/png/lib/generate_png.ts
index 5969b5b8abc002..c3d5b2cc600513 100644
--- a/x-pack/plugins/reporting/server/export_types/png/lib/generate_png.ts
+++ b/x-pack/plugins/reporting/server/export_types/png/lib/generate_png.ts
@@ -10,7 +10,8 @@ import { map } from 'rxjs/operators';
 import { ReportingCore } from '../../../';
 import { LevelLogger } from '../../../lib';
 import { LayoutParams, PreserveLayout } from '../../../lib/layouts';
-import { ConditionalHeaders, ScreenshotResults } from '../../../types';
+import { ScreenshotResults } from '../../../lib/screenshots';
+import { ConditionalHeaders } from '../../../types';
 
 export async function generatePngObservableFactory(reporting: ReportingCore) {
   const getScreenshots = await reporting.getScreenshotsObservable();
diff --git a/x-pack/plugins/reporting/server/export_types/png/types.d.ts b/x-pack/plugins/reporting/server/export_types/png/types.d.ts
index 1ddee8419df309..a747f53861a999 100644
--- a/x-pack/plugins/reporting/server/export_types/png/types.d.ts
+++ b/x-pack/plugins/reporting/server/export_types/png/types.d.ts
@@ -4,17 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CreateJobBaseParams, ScheduledTaskParams } from '../../../server/types';
-import { LayoutInstance, LayoutParams } from '../../lib/layouts';
+import { BaseParams, BasePayload } from '../../../server/types';
+import { LayoutParams } from '../../lib/layouts';
 
 // Job params: structure of incoming user request data
-export interface JobParamsPNG extends CreateJobBaseParams {
+export interface JobParamsPNG extends BaseParams {
   title: string;
   relativeUrl: string;
 }
 
 // Job payload: structure of stored job data provided by create_job
-export interface ScheduledTaskParamsPNG extends ScheduledTaskParams<JobParamsPNG> {
+export interface TaskPayloadPNG extends BasePayload<JobParamsPNG> {
   basePath?: string;
   browserTimezone: string;
   forceNow?: string;
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/create_job/index.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/create_job/index.ts
index 5de089a13bfa44..96e634337e6a94 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/create_job/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/create_job/index.ts
@@ -5,17 +5,17 @@
  */
 
 import { cryptoFactory } from '../../../lib';
-import { CreateJobFn, ScheduleTaskFnFactory } from '../../../types';
+import { CreateJobFn, CreateJobFnFactory } from '../../../types';
 import { validateUrls } from '../../common';
 import { JobParamsPDF } from '../types';
 
-export const scheduleTaskFnFactory: ScheduleTaskFnFactory<CreateJobFn<
+export const createJobFnFactory: CreateJobFnFactory<CreateJobFn<
   JobParamsPDF
 >> = function createJobFactoryFn(reporting) {
   const config = reporting.getConfig();
   const crypto = cryptoFactory(config.get('encryptionKey'));
 
-  return async function scheduleTaskFn(
+  return async function createJob(
     { title, relativeUrls, browserTimezone, layout, objectType },
     context,
     req
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts
index 443db1b57fe484..fdc51dc1c9c878 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts
@@ -12,7 +12,7 @@ import { CancellationToken } from '../../../../common';
 import { cryptoFactory, LevelLogger } from '../../../lib';
 import { createMockReportingCore } from '../../../test_helpers';
 import { generatePdfObservableFactory } from '../lib/generate_pdf';
-import { ScheduledTaskParamsPDF } from '../types';
+import { TaskPayloadPDF } from '../types';
 import { runTaskFnFactory } from './';
 
 let mockReporting: ReportingCore;
@@ -36,7 +36,7 @@ const encryptHeaders = async (headers: Record<string, string>) => {
   return await crypto.encrypt(headers);
 };
 
-const getScheduledTaskParams = (baseObj: any) => baseObj as ScheduledTaskParamsPDF;
+const getBasePayload = (baseObj: any) => baseObj as TaskPayloadPDF;
 
 beforeEach(async () => {
   const kbnConfig = {
@@ -83,7 +83,7 @@ test(`passes browserTimezone to generatePdf`, async () => {
   const browserTimezone = 'UTC';
   await runTask(
     'pdfJobId',
-    getScheduledTaskParams({
+    getBasePayload({
       title: 'PDF Params Timezone Test',
       relativeUrl: '/app/kibana#/something',
       browserTimezone,
@@ -106,7 +106,7 @@ test(`returns content_type of application/pdf`, async () => {
 
   const { content_type: contentType } = await runTask(
     'pdfJobId',
-    getScheduledTaskParams({ relativeUrls: [], headers: encryptedHeaders }),
+    getBasePayload({ relativeUrls: [], headers: encryptedHeaders }),
     cancellationToken
   );
   expect(contentType).toBe('application/pdf');
@@ -121,7 +121,7 @@ test(`returns content of generatePdf getBuffer base64 encoded`, async () => {
   const encryptedHeaders = await encryptHeaders({});
   const { content } = await runTask(
     'pdfJobId',
-    getScheduledTaskParams({ relativeUrls: [], headers: encryptedHeaders }),
+    getBasePayload({ relativeUrls: [], headers: encryptedHeaders }),
     cancellationToken
   );
 
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.ts
index 5ace1c987adb5a..78808400c9c9ad 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.ts
@@ -8,7 +8,7 @@ import apm from 'elastic-apm-node';
 import * as Rx from 'rxjs';
 import { catchError, map, mergeMap, takeUntil } from 'rxjs/operators';
 import { PDF_JOB_TYPE } from '../../../../common/constants';
-import { WorkerExecuteFn, RunTaskFnFactory, TaskRunResult } from '../../../types';
+import { RunTaskFn, RunTaskFnFactory, TaskRunResult } from '../../../types';
 import {
   decryptJobHeaders,
   getConditionalHeaders,
@@ -17,9 +17,9 @@ import {
   omitBlacklistedHeaders,
 } from '../../common';
 import { generatePdfObservableFactory } from '../lib/generate_pdf';
-import { ScheduledTaskParamsPDF } from '../types';
+import { TaskPayloadPDF } from '../types';
 
-type QueuedPdfExecutorFactory = RunTaskFnFactory<WorkerExecuteFn<ScheduledTaskParamsPDF>>;
+type QueuedPdfExecutorFactory = RunTaskFnFactory<RunTaskFn<TaskPayloadPDF>>;
 
 export const runTaskFnFactory: QueuedPdfExecutorFactory = function executeJobFactoryFn(
   reporting,
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/index.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/index.ts
index 7f21d36c4b72c4..cf3ec9cdc8c2d0 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/index.ts
@@ -12,23 +12,23 @@ import {
   LICENSE_TYPE_TRIAL,
   PDF_JOB_TYPE as jobType,
 } from '../../../common/constants';
-import { CreateJobFn, WorkerExecuteFn, ExportTypeDefinition } from '../../types';
-import { scheduleTaskFnFactory } from './create_job';
+import { CreateJobFn, ExportTypeDefinition, RunTaskFn } from '../../types';
+import { createJobFnFactory } from './create_job';
 import { runTaskFnFactory } from './execute_job';
 import { metadata } from './metadata';
-import { JobParamsPDF, ScheduledTaskParamsPDF } from './types';
+import { JobParamsPDF, TaskPayloadPDF } from './types';
 
 export const getExportType = (): ExportTypeDefinition<
   JobParamsPDF,
   CreateJobFn<JobParamsPDF>,
-  ScheduledTaskParamsPDF,
-  WorkerExecuteFn<ScheduledTaskParamsPDF>
+  TaskPayloadPDF,
+  RunTaskFn<TaskPayloadPDF>
 > => ({
   ...metadata,
   jobType,
   jobContentEncoding: 'base64',
   jobContentExtension: 'pdf',
-  scheduleTaskFnFactory,
+  createJobFnFactory,
   runTaskFnFactory,
   validLicenses: [
     LICENSE_TYPE_TRIAL,
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/lib/generate_pdf.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/lib/generate_pdf.ts
index 2e0292e1f9ab58..17624c1bedb57a 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/lib/generate_pdf.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/lib/generate_pdf.ts
@@ -10,7 +10,8 @@ import { mergeMap } from 'rxjs/operators';
 import { ReportingCore } from '../../../';
 import { LevelLogger } from '../../../lib';
 import { createLayout, LayoutInstance, LayoutParams } from '../../../lib/layouts';
-import { ConditionalHeaders, ScreenshotResults } from '../../../types';
+import { ScreenshotResults } from '../../../lib/screenshots';
+import { ConditionalHeaders } from '../../../types';
 // @ts-ignore untyped module
 import { pdf } from './pdf';
 import { getTracker } from './tracker';
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/types.d.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/types.d.ts
index 7830f87780c2eb..3020cbb5f28b00 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/types.d.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/types.d.ts
@@ -4,18 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CreateJobBaseParams, ScheduledTaskParams } from '../../../server/types';
+import { BaseParams, BasePayload } from '../../../server/types';
 import { LayoutInstance, LayoutParams } from '../../lib/layouts';
 
 // Job params: structure of incoming user request data, after being parsed from RISON
-export interface JobParamsPDF extends CreateJobBaseParams {
+export interface JobParamsPDF extends BaseParams {
   title: string;
   relativeUrls: string[];
   layout: LayoutInstance;
 }
 
 // Job payload: structure of stored job data provided by create_job
-export interface ScheduledTaskParamsPDF extends ScheduledTaskParams<JobParamsPDF> {
+export interface TaskPayloadPDF extends BasePayload<JobParamsPDF> {
   basePath?: string;
   browserTimezone: string;
   forceNow?: string;
diff --git a/x-pack/plugins/reporting/server/lib/create_worker.ts b/x-pack/plugins/reporting/server/lib/create_worker.ts
index 5b0f1ddb2f1579..dd5c5604552743 100644
--- a/x-pack/plugins/reporting/server/lib/create_worker.ts
+++ b/x-pack/plugins/reporting/server/lib/create_worker.ts
@@ -8,7 +8,7 @@ import { CancellationToken } from '../../common';
 import { PLUGIN_ID } from '../../common/constants';
 import { ReportingCore } from '../../server';
 import { LevelLogger } from '../../server/lib';
-import { ExportTypeDefinition, JobSource, WorkerExecuteFn } from '../../server/types';
+import { ExportTypeDefinition, JobSource, RunTaskFn } from '../../server/types';
 import { ESQueueInstance } from './create_queue';
 // @ts-ignore untyped dependency
 import { events as esqueueEvents } from './esqueue';
@@ -22,18 +22,18 @@ export function createWorkerFactory<JobParamsType>(reporting: ReportingCore, log
   // Once more document types are added, this will need to be passed in
   return async function createWorker(queue: ESQueueInstance) {
     // export type / execute job map
-    const jobExecutors: Map<string, WorkerExecuteFn<unknown>> = new Map();
+    const jobExecutors: Map<string, RunTaskFn<unknown>> = new Map();
 
     for (const exportType of reporting.getExportTypesRegistry().getAll() as Array<
-      ExportTypeDefinition<JobParamsType, unknown, unknown, WorkerExecuteFn<unknown>>
+      ExportTypeDefinition<JobParamsType, unknown, unknown, RunTaskFn<unknown>>
     >) {
       const jobExecutor = exportType.runTaskFnFactory(reporting, logger);
       jobExecutors.set(exportType.jobType, jobExecutor);
     }
 
-    const workerFn = <ScheduledTaskParamsType>(
-      jobSource: JobSource<ScheduledTaskParamsType>,
-      jobParams: ScheduledTaskParamsType,
+    const workerFn = <TaskPayloadType>(
+      jobSource: JobSource<TaskPayloadType>,
+      jobParams: TaskPayloadType,
       cancellationToken: CancellationToken
     ) => {
       const {
diff --git a/x-pack/plugins/reporting/server/lib/enqueue_job.ts b/x-pack/plugins/reporting/server/lib/enqueue_job.ts
index 3e3aef92c55a3c..5acc6e38dddf9d 100644
--- a/x-pack/plugins/reporting/server/lib/enqueue_job.ts
+++ b/x-pack/plugins/reporting/server/lib/enqueue_job.ts
@@ -6,13 +6,13 @@
 
 import { KibanaRequest, RequestHandlerContext } from 'src/core/server';
 import { ReportingCore } from '../';
-import { CreateJobBaseParams, CreateJobFn, ReportingUser } from '../types';
+import { BaseParams, CreateJobFn, ReportingUser } from '../types';
 import { LevelLogger } from './';
 import { Report } from './store';
 
 export type EnqueueJobFn = (
   exportTypeId: string,
-  jobParams: CreateJobBaseParams,
+  jobParams: BaseParams,
   user: ReportingUser,
   context: RequestHandlerContext,
   request: KibanaRequest
@@ -26,12 +26,12 @@ export function enqueueJobFactory(
 
   return async function enqueueJob(
     exportTypeId: string,
-    jobParams: CreateJobBaseParams,
+    jobParams: BaseParams,
     user: ReportingUser,
     context: RequestHandlerContext,
     request: KibanaRequest
   ) {
-    type ScheduleTaskFnType = CreateJobFn<CreateJobBaseParams>;
+    type CreateJobFnType = CreateJobFn<BaseParams>;
 
     const exportType = reporting.getExportTypesRegistry().getById(exportTypeId);
 
@@ -39,13 +39,13 @@ export function enqueueJobFactory(
       throw new Error(`Export type ${exportTypeId} does not exist in the registry!`);
     }
 
-    const [scheduleTask, { store }] = await Promise.all([
-      exportType.scheduleTaskFnFactory(reporting, logger) as ScheduleTaskFnType,
+    const [createJob, { store }] = await Promise.all([
+      exportType.createJobFnFactory(reporting, logger) as CreateJobFnType,
       reporting.getPluginStartDeps(),
     ]);
 
     // add encrytped headers
-    const payload = await scheduleTask(jobParams, context, request);
+    const payload = await createJob(jobParams, context, request);
 
     // store the pending report, puts it in the Reporting Management UI table
     const report = await store.addReport(exportType.jobType, user, payload);
diff --git a/x-pack/plugins/reporting/server/lib/export_types_registry.ts b/x-pack/plugins/reporting/server/lib/export_types_registry.ts
index 501989f21103e7..1159221a9224ea 100644
--- a/x-pack/plugins/reporting/server/lib/export_types_registry.ts
+++ b/x-pack/plugins/reporting/server/lib/export_types_registry.ts
@@ -11,8 +11,8 @@ import { getExportType as getTypePng } from '../export_types/png';
 import { getExportType as getTypePrintablePdf } from '../export_types/printable_pdf';
 import { ExportTypeDefinition } from '../types';
 
-type GetCallbackFn<JobParamsType, ScheduleTaskFnType, JobPayloadType, RunTaskFnType> = (
-  item: ExportTypeDefinition<JobParamsType, ScheduleTaskFnType, JobPayloadType, ScheduleTaskFnType>
+type GetCallbackFn<JobParamsType, CreateJobFnType, JobPayloadType, RunTaskFnType> = (
+  item: ExportTypeDefinition<JobParamsType, CreateJobFnType, JobPayloadType, CreateJobFnType>
 ) => boolean;
 // => ExportTypeDefinition<T, U, V, W>
 
@@ -21,8 +21,8 @@ export class ExportTypesRegistry {
 
   constructor() {}
 
-  register<JobParamsType, ScheduleTaskFnType, JobPayloadType, RunTaskFnType>(
-    item: ExportTypeDefinition<JobParamsType, ScheduleTaskFnType, JobPayloadType, RunTaskFnType>
+  register<JobParamsType, CreateJobFnType, JobPayloadType, RunTaskFnType>(
+    item: ExportTypeDefinition<JobParamsType, CreateJobFnType, JobPayloadType, RunTaskFnType>
   ): void {
     if (!isString(item.id)) {
       throw new Error(`'item' must have a String 'id' property `);
@@ -43,24 +43,24 @@ export class ExportTypesRegistry {
     return this._map.size;
   }
 
-  getById<JobParamsType, ScheduleTaskFnType, JobPayloadType, RunTaskFnType>(
+  getById<JobParamsType, CreateJobFnType, JobPayloadType, RunTaskFnType>(
     id: string
-  ): ExportTypeDefinition<JobParamsType, ScheduleTaskFnType, JobPayloadType, RunTaskFnType> {
+  ): ExportTypeDefinition<JobParamsType, CreateJobFnType, JobPayloadType, RunTaskFnType> {
     if (!this._map.has(id)) {
       throw new Error(`Unknown id ${id}`);
     }
 
     return this._map.get(id) as ExportTypeDefinition<
       JobParamsType,
-      ScheduleTaskFnType,
+      CreateJobFnType,
       JobPayloadType,
       RunTaskFnType
     >;
   }
 
-  get<JobParamsType, ScheduleTaskFnType, JobPayloadType, RunTaskFnType>(
-    findType: GetCallbackFn<JobParamsType, ScheduleTaskFnType, JobPayloadType, RunTaskFnType>
-  ): ExportTypeDefinition<JobParamsType, ScheduleTaskFnType, JobPayloadType, RunTaskFnType> {
+  get<JobParamsType, CreateJobFnType, JobPayloadType, RunTaskFnType>(
+    findType: GetCallbackFn<JobParamsType, CreateJobFnType, JobPayloadType, RunTaskFnType>
+  ): ExportTypeDefinition<JobParamsType, CreateJobFnType, JobPayloadType, RunTaskFnType> {
     let result;
     for (const value of this._map.values()) {
       if (!findType(value)) {
@@ -68,7 +68,7 @@ export class ExportTypesRegistry {
       }
       const foundResult: ExportTypeDefinition<
         JobParamsType,
-        ScheduleTaskFnType,
+        CreateJobFnType,
         JobPayloadType,
         RunTaskFnType
       > = value;
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/get_element_position_data.ts b/x-pack/plugins/reporting/server/lib/screenshots/get_element_position_data.ts
index 4fb9fd96ecfe6d..6c619a726f428c 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/get_element_position_data.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/get_element_position_data.ts
@@ -5,10 +5,10 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { HeadlessChromiumDriver } from '../../browsers';
-import { AttributesMap, ElementsPositionAndAttribute } from '../../types';
 import { LevelLogger, startTrace } from '../';
+import { HeadlessChromiumDriver } from '../../browsers';
 import { LayoutInstance } from '../layouts';
+import { AttributesMap, ElementsPositionAndAttribute } from './';
 import { CONTEXT_ELEMENTATTRIBUTES } from './constants';
 
 export const getElementPositionAndAttributes = async (
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.ts b/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.ts
index bc7b7005674a73..1ed8687bea23eb 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.ts
@@ -5,9 +5,9 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { HeadlessChromiumDriver } from '../../browsers';
-import { ElementsPositionAndAttribute, Screenshot } from '../../types';
 import { LevelLogger, startTrace } from '../';
+import { HeadlessChromiumDriver } from '../../browsers';
+import { ElementsPositionAndAttribute, Screenshot } from './';
 
 export const getScreenshots = async (
   browser: HeadlessChromiumDriver,
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/index.ts b/x-pack/plugins/reporting/server/lib/screenshots/index.ts
index 5a04f1a497abf6..c1d33cb5193843 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/index.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/index.ts
@@ -4,4 +4,61 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import * as Rx from 'rxjs';
+import { LevelLogger } from '../';
+import { ConditionalHeaders } from '../../types';
+import { LayoutInstance } from '../layouts';
+
 export { screenshotsObservableFactory } from './observable';
+
+export interface ScreenshotObservableOpts {
+  logger: LevelLogger;
+  urls: string[];
+  conditionalHeaders: ConditionalHeaders;
+  layout: LayoutInstance;
+  browserTimezone: string;
+}
+
+export interface AttributesMap {
+  [key: string]: any;
+}
+
+export interface ElementPosition {
+  boundingClientRect: {
+    // modern browsers support x/y, but older ones don't
+    top: number;
+    left: number;
+    width: number;
+    height: number;
+  };
+  scroll: {
+    x: number;
+    y: number;
+  };
+}
+
+export interface ElementsPositionAndAttribute {
+  position: ElementPosition;
+  attributes: AttributesMap;
+}
+
+export interface Screenshot {
+  base64EncodedData: string;
+  title: string;
+  description: string;
+}
+
+export interface ScreenshotResults {
+  timeRange: string | null;
+  screenshots: Screenshot[];
+  error?: Error;
+  elementsPositionAndAttributes?: ElementsPositionAndAttribute[]; // NOTE: for testing
+}
+
+export type ScreenshotsObservableFn = ({
+  logger,
+  urls,
+  conditionalHeaders,
+  layout,
+  browserTimezone,
+}: ScreenshotObservableOpts) => Rx.Observable<ScreenshotResults[]>;
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/observable.test.ts b/x-pack/plugins/reporting/server/lib/screenshots/observable.test.ts
index b25e8fab3abcf7..3749e4372bdab0 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/observable.test.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/observable.test.ts
@@ -16,11 +16,12 @@ jest.mock('../../browsers/chromium/puppeteer', () => ({
 }));
 
 import * as Rx from 'rxjs';
+import { LevelLogger } from '../';
 import { loggingSystemMock } from '../../../../../../src/core/server/mocks';
 import { HeadlessChromiumDriver } from '../../browsers';
-import { LevelLogger } from '../';
 import { createMockBrowserDriverFactory, createMockLayoutInstance } from '../../test_helpers';
-import { CaptureConfig, ConditionalHeaders, ElementsPositionAndAttribute } from '../../types';
+import { CaptureConfig, ConditionalHeaders } from '../../types';
+import { ElementsPositionAndAttribute } from './';
 import * as contexts from './constants';
 import { screenshotsObservableFactory } from './observable';
 
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/observable.ts b/x-pack/plugins/reporting/server/lib/screenshots/observable.ts
index c6d3d826c88fb0..342293d113d24d 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/observable.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/observable.ts
@@ -17,13 +17,13 @@ import {
   toArray,
 } from 'rxjs/operators';
 import { HeadlessChromiumDriverFactory } from '../../browsers';
+import { CaptureConfig } from '../../types';
 import {
-  CaptureConfig,
   ElementsPositionAndAttribute,
   ScreenshotObservableOpts,
   ScreenshotResults,
   ScreenshotsObservableFn,
-} from '../../types';
+} from './';
 import { checkPageIsOpen } from './check_browser_open';
 import { DEFAULT_PAGELOAD_SELECTOR } from './constants';
 import { getElementPositionAndAttributes } from './get_element_position_data';
diff --git a/x-pack/plugins/reporting/server/lib/store/store.ts b/x-pack/plugins/reporting/server/lib/store/store.ts
index 88f6fa418a1b35..b1309cbdeb94db 100644
--- a/x-pack/plugins/reporting/server/lib/store/store.ts
+++ b/x-pack/plugins/reporting/server/lib/store/store.ts
@@ -7,11 +7,7 @@
 import { ElasticsearchServiceSetup } from 'src/core/server';
 import { LevelLogger, statuses } from '../';
 import { ReportingCore } from '../../';
-import {
-  CreateJobBaseParams,
-  CreateJobBaseParamsEncryptedFields,
-  ReportingUser,
-} from '../../types';
+import { BaseParams, BaseParamsEncryptedFields, ReportingUser } from '../../types';
 import { indexTimestamp } from './index_timestamp';
 import { mapping } from './mapping';
 import { Report } from './report';
@@ -145,7 +141,7 @@ export class ReportingStore {
   public async addReport(
     type: string,
     user: ReportingUser,
-    payload: CreateJobBaseParams & CreateJobBaseParamsEncryptedFields
+    payload: BaseParams & BaseParamsEncryptedFields
   ): Promise<Report> {
     const timestamp = indexTimestamp(this.indexInterval);
     const index = `${this.indexPrefix}-${timestamp}`;
diff --git a/x-pack/plugins/reporting/server/plugin.test.ts b/x-pack/plugins/reporting/server/plugin.test.ts
index 420fa8347cdebb..e0d018869cef1e 100644
--- a/x-pack/plugins/reporting/server/plugin.test.ts
+++ b/x-pack/plugins/reporting/server/plugin.test.ts
@@ -86,6 +86,15 @@ describe('Reporting Plugin', () => {
     expect(plugin.start(coreStart, pluginStart)).not.toHaveProperty('then');
   });
 
+  it('registers an advanced setting for PDF logos', async () => {
+    const plugin = new ReportingPlugin(initContext);
+    plugin.setup(coreSetup, pluginSetup);
+    expect(coreSetup.uiSettings.register).toHaveBeenCalled();
+    expect(coreSetup.uiSettings.register.mock.calls[0][0]).toHaveProperty(
+      'xpackReporting:customPdfLogo'
+    );
+  });
+
   it('logs start issues', async () => {
     const plugin = new ReportingPlugin(initContext);
     // @ts-ignore overloading error logger
diff --git a/x-pack/plugins/reporting/server/plugin.ts b/x-pack/plugins/reporting/server/plugin.ts
index 20e22c2db00e35..8c0e352aa06c5d 100644
--- a/x-pack/plugins/reporting/server/plugin.ts
+++ b/x-pack/plugins/reporting/server/plugin.ts
@@ -4,16 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { schema } from '@kbn/config-schema';
+import { i18n } from '@kbn/i18n';
 import { CoreSetup, CoreStart, Plugin, PluginInitializerContext } from 'src/core/server';
+import { PLUGIN_ID, UI_SETTINGS_CUSTOM_PDF_LOGO } from '../common/constants';
 import { ReportingCore } from './';
 import { initializeBrowserDriverFactory } from './browsers';
 import { buildConfig, ReportingConfigType } from './config';
-import { createQueueFactory, LevelLogger, runValidations, ReportingStore } from './lib';
+import { createQueueFactory, LevelLogger, ReportingStore, runValidations } from './lib';
 import { registerRoutes } from './routes';
 import { setFieldFormats } from './services';
 import { ReportingSetup, ReportingSetupDeps, ReportingStart, ReportingStartDeps } from './types';
 import { registerReportingUsageCollector } from './usage';
 
+const kbToBase64Length = (kb: number) => Math.floor((kb * 1024 * 8) / 6);
+
 declare module 'src/core/server' {
   interface RequestHandlerContext {
     reporting?: ReportingStart | null;
@@ -34,7 +39,7 @@ export class ReportingPlugin
 
   public setup(core: CoreSetup, plugins: ReportingSetupDeps) {
     // prevent throwing errors in route handlers about async deps not being initialized
-    core.http.registerRouteHandlerContext('reporting', () => {
+    core.http.registerRouteHandlerContext(PLUGIN_ID, () => {
       if (this.reportingCore.pluginIsStarted()) {
         return {}; // ReportingStart contract
       } else {
@@ -42,6 +47,28 @@ export class ReportingPlugin
       }
     });
 
+    core.uiSettings.register({
+      [UI_SETTINGS_CUSTOM_PDF_LOGO]: {
+        name: i18n.translate('xpack.reporting.pdfFooterImageLabel', {
+          defaultMessage: 'PDF footer image',
+        }),
+        value: null,
+        description: i18n.translate('xpack.reporting.pdfFooterImageDescription', {
+          defaultMessage: `Custom image to use in the PDF's footer`,
+        }),
+        type: 'image',
+        schema: schema.nullable(schema.byteSize({ max: '200kb' })),
+        category: [PLUGIN_ID],
+        // Used client-side for size validation
+        validation: {
+          maxSize: {
+            length: kbToBase64Length(200),
+            description: '200 kB',
+          },
+        },
+      },
+    });
+
     const { elasticsearch, http } = core;
     const { licensing, security } = plugins;
     const { initializerContext: initContext, reportingCore } = this;
diff --git a/x-pack/plugins/reporting/server/routes/generate_from_jobparams.ts b/x-pack/plugins/reporting/server/routes/generate_from_jobparams.ts
index f4959b56dfea1e..36f0a7fe67d935 100644
--- a/x-pack/plugins/reporting/server/routes/generate_from_jobparams.ts
+++ b/x-pack/plugins/reporting/server/routes/generate_from_jobparams.ts
@@ -4,13 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import rison from 'rison-node';
 import { schema } from '@kbn/config-schema';
-import { authorizedUserPreRoutingFactory } from './lib/authorized_user_pre_routing';
-import { HandlerErrorFunction, HandlerFunction } from './types';
+import rison from 'rison-node';
 import { ReportingCore } from '../';
 import { API_BASE_URL } from '../../common/constants';
-import { CreateJobBaseParams } from '../types';
+import { BaseParams } from '../types';
+import { authorizedUserPreRoutingFactory } from './lib/authorized_user_pre_routing';
+import { HandlerErrorFunction, HandlerFunction } from './types';
 
 const BASE_GENERATE = `${API_BASE_URL}/generate`;
 
@@ -70,7 +70,7 @@ export function registerGenerateFromJobParams(
       let jobParams;
 
       try {
-        jobParams = rison.decode(jobParamsRison) as CreateJobBaseParams | null;
+        jobParams = rison.decode(jobParamsRison) as BaseParams | null;
         if (!jobParams) {
           return res.customError({
             statusCode: 400,
diff --git a/x-pack/plugins/reporting/server/routes/generate_from_savedobject_immediate.ts b/x-pack/plugins/reporting/server/routes/generate_from_savedobject_immediate.ts
index a0a8f25de7fc49..517f1dadc0ac15 100644
--- a/x-pack/plugins/reporting/server/routes/generate_from_savedobject_immediate.ts
+++ b/x-pack/plugins/reporting/server/routes/generate_from_savedobject_immediate.ts
@@ -8,7 +8,7 @@ import { schema } from '@kbn/config-schema';
 import { KibanaRequest } from 'src/core/server';
 import { ReportingCore } from '../';
 import { API_BASE_GENERATE_V1 } from '../../common/constants';
-import { scheduleTaskFnFactory } from '../export_types/csv_from_savedobject/create_job';
+import { createJobFnFactory } from '../export_types/csv_from_savedobject/create_job';
 import { runTaskFnFactory } from '../export_types/csv_from_savedobject/execute_job';
 import { JobParamsPostPayloadPanelCsv } from '../export_types/csv_from_savedobject/types';
 import { LevelLogger as Logger } from '../lib';
@@ -43,7 +43,7 @@ export function registerGenerateCsvFromSavedObjectImmediate(
 
   /*
    * CSV export with the `immediate` option does not queue a job with Reporting's ESQueue to run the job async. Instead, this does:
-   *  - re-use the scheduleTask function to build up es query config
+   *  - re-use the createJob function to build up es query config
    *  - re-use the runTask function to run the scan and scroll queries and capture the entire CSV in a result object.
    */
   router.post(
@@ -67,12 +67,12 @@ export function registerGenerateCsvFromSavedObjectImmediate(
     userHandler(async (user, context, req: CsvFromSavedObjectRequest, res) => {
       const logger = parentLogger.clone(['savedobject-csv']);
       const jobParams = getJobParamsFromRequest(req, { isImmediate: true });
-      const scheduleTaskFn = scheduleTaskFnFactory(reporting, logger);
+      const createJob = createJobFnFactory(reporting, logger);
       const runTaskFn = runTaskFnFactory(reporting, logger);
 
       try {
-        // FIXME: no scheduleTaskFn for immediate download
-        const jobDocPayload = await scheduleTaskFn(jobParams, req.headers, context, req);
+        // FIXME: no create job for immediate download
+        const jobDocPayload = await createJob(jobParams, req.headers, context, req);
         const {
           content_type: jobOutputContentType,
           content: jobOutputContent,
diff --git a/x-pack/plugins/reporting/server/routes/generation.test.ts b/x-pack/plugins/reporting/server/routes/generation.test.ts
index cef4da9aabbd47..0db0073149e573 100644
--- a/x-pack/plugins/reporting/server/routes/generation.test.ts
+++ b/x-pack/plugins/reporting/server/routes/generation.test.ts
@@ -75,7 +75,7 @@ describe('POST /api/reporting/generate', () => {
       jobContentEncoding: 'base64',
       jobContentExtension: 'pdf',
       validLicenses: ['basic', 'gold'],
-      scheduleTaskFnFactory: () => () => ({ scheduleParamsTest: { test1: 'yes' } }),
+      createJobFnFactory: () => () => ({ jobParamsTest: { test1: 'yes' } }),
       runTaskFnFactory: () => () => ({ runParamsTest: { test2: 'yes' } }),
     });
     core.getExportTypesRegistry = () => mockExportTypesRegistry;
diff --git a/x-pack/plugins/reporting/server/routes/types.d.ts b/x-pack/plugins/reporting/server/routes/types.d.ts
index ab1dd841bbbc22..5c34d466197fe1 100644
--- a/x-pack/plugins/reporting/server/routes/types.d.ts
+++ b/x-pack/plugins/reporting/server/routes/types.d.ts
@@ -5,12 +5,12 @@
  */
 
 import { KibanaRequest, KibanaResponseFactory, RequestHandlerContext } from 'src/core/server';
-import { CreateJobBaseParams, ReportingUser, ScheduledTaskParams } from '../types';
+import { BaseParams, BasePayload, ReportingUser } from '../types';
 
 export type HandlerFunction = (
   user: ReportingUser,
   exportType: string,
-  jobParams: CreateJobBaseParams,
+  jobParams: BaseParams,
   context: RequestHandlerContext,
   req: KibanaRequest,
   res: KibanaResponseFactory
@@ -22,7 +22,7 @@ export interface QueuedJobPayload<JobParamsType> {
   error?: boolean;
   source: {
     job: {
-      payload: ScheduledTaskParams<JobParamsType>;
+      payload: BasePayload<JobParamsType>;
     };
   };
 }
diff --git a/x-pack/plugins/reporting/server/test_helpers/create_mock_browserdriverfactory.ts b/x-pack/plugins/reporting/server/test_helpers/create_mock_browserdriverfactory.ts
index 08313e6892f3c4..f2785bce10964a 100644
--- a/x-pack/plugins/reporting/server/test_helpers/create_mock_browserdriverfactory.ts
+++ b/x-pack/plugins/reporting/server/test_helpers/create_mock_browserdriverfactory.ts
@@ -8,8 +8,9 @@ import { Page } from 'puppeteer';
 import * as Rx from 'rxjs';
 import { chromium, HeadlessChromiumDriver, HeadlessChromiumDriverFactory } from '../browsers';
 import { LevelLogger } from '../lib';
+import { ElementsPositionAndAttribute } from '../lib/screenshots';
 import * as contexts from '../lib/screenshots/constants';
-import { CaptureConfig, ElementsPositionAndAttribute } from '../types';
+import { CaptureConfig } from '../types';
 
 interface CreateMockBrowserDriverFactoryOpts {
   evaluate: jest.Mock<Promise<any>, any[]>;
diff --git a/x-pack/plugins/reporting/server/types.ts b/x-pack/plugins/reporting/server/types.ts
index 542c9cdb3f6774..10519842d9decd 100644
--- a/x-pack/plugins/reporting/server/types.ts
+++ b/x-pack/plugins/reporting/server/types.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import * as Rx from 'rxjs';
 import { KibanaRequest, RequestHandlerContext } from 'src/core/server';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { DataPluginStart } from 'src/plugins/data/server/plugin';
@@ -48,7 +47,7 @@ export interface JobParamPostPayload {
 }
 
 // the pre-processed, encrypted data ready for storage
-export interface ScheduledTaskParams<JobParamsType> {
+export interface BasePayload<JobParamsType> {
   headers: string; // serialized encrypted headers
   jobParams: JobParamsType;
   title: string;
@@ -61,7 +60,7 @@ export interface JobSource<JobParamsType> {
   _source: {
     jobtype: string;
     output: TaskRunResult;
-    payload: ScheduledTaskParams<JobParamsType>;
+    payload: BasePayload<JobParamsType>;
     status: JobStatus;
   };
 }
@@ -87,62 +86,6 @@ export interface ConditionalHeaders {
   conditions: ConditionalHeadersConditions;
 }
 
-/*
- * Screenshots
- */
-
-export interface ScreenshotObservableOpts {
-  logger: LevelLogger;
-  urls: string[];
-  conditionalHeaders: ConditionalHeaders;
-  layout: LayoutInstance;
-  browserTimezone: string;
-}
-
-export interface AttributesMap {
-  [key: string]: any;
-}
-
-export interface ElementPosition {
-  boundingClientRect: {
-    // modern browsers support x/y, but older ones don't
-    top: number;
-    left: number;
-    width: number;
-    height: number;
-  };
-  scroll: {
-    x: number;
-    y: number;
-  };
-}
-
-export interface ElementsPositionAndAttribute {
-  position: ElementPosition;
-  attributes: AttributesMap;
-}
-
-export interface Screenshot {
-  base64EncodedData: string;
-  title: string;
-  description: string;
-}
-
-export interface ScreenshotResults {
-  timeRange: string | null;
-  screenshots: Screenshot[];
-  error?: Error;
-  elementsPositionAndAttributes?: ElementsPositionAndAttribute[]; // NOTE: for testing
-}
-
-export type ScreenshotsObservableFn = ({
-  logger,
-  urls,
-  conditionalHeaders,
-  layout,
-  browserTimezone,
-}: ScreenshotObservableOpts) => Rx.Observable<ScreenshotResults[]>;
-
 /*
  * Plugin Contract
  */
@@ -169,34 +112,33 @@ export type ReportingUser = { username: AuthenticatedUser['username'] } | false;
 export type CaptureConfig = ReportingConfigType['capture'];
 export type ScrollConfig = ReportingConfigType['csv']['scroll'];
 
-export interface CreateJobBaseParams {
+export interface BaseParams {
   browserTimezone: string;
   layout?: LayoutInstance; // for screenshot type reports
   objectType: string;
 }
 
-export interface CreateJobBaseParamsEncryptedFields extends CreateJobBaseParams {
+export interface BaseParamsEncryptedFields extends BaseParams {
   basePath?: string; // for screenshot type reports
   headers: string; // encrypted headers
 }
 
-export type CreateJobFn<JobParamsType extends CreateJobBaseParams> = (
+export type CreateJobFn<JobParamsType extends BaseParams> = (
   jobParams: JobParamsType,
   context: RequestHandlerContext,
   request: KibanaRequest
-) => Promise<JobParamsType & CreateJobBaseParamsEncryptedFields>;
+) => Promise<JobParamsType & BaseParamsEncryptedFields>;
 
-// rename me
-export type WorkerExecuteFn<ScheduledTaskParamsType> = (
+export type RunTaskFn<TaskPayloadType> = (
   jobId: string,
-  job: ScheduledTaskParamsType,
+  job: TaskPayloadType,
   cancellationToken: CancellationToken
 ) => Promise<TaskRunResult>;
 
-export type ScheduleTaskFnFactory<ScheduleTaskFnType> = (
+export type CreateJobFnFactory<CreateJobFnType> = (
   reporting: ReportingCore,
   logger: LevelLogger
-) => ScheduleTaskFnType;
+) => CreateJobFnType;
 
 export type RunTaskFnFactory<RunTaskFnType> = (
   reporting: ReportingCore,
@@ -205,7 +147,7 @@ export type RunTaskFnFactory<RunTaskFnType> = (
 
 export interface ExportTypeDefinition<
   JobParamsType,
-  ScheduleTaskFnType,
+  CreateJobFnType,
   JobPayloadType,
   RunTaskFnType
 > {
@@ -214,7 +156,7 @@ export interface ExportTypeDefinition<
   jobType: string;
   jobContentEncoding?: string;
   jobContentExtension: string;
-  scheduleTaskFnFactory: ScheduleTaskFnFactory<ScheduleTaskFnType>;
+  createJobFnFactory: CreateJobFnFactory<CreateJobFnType>;
   runTaskFnFactory: RunTaskFnFactory<RunTaskFnType>;
   validLicenses: string[];
 }
diff --git a/x-pack/plugins/security/public/account_management/account_management_app.test.ts b/x-pack/plugins/security/public/account_management/account_management_app.test.ts
index 37b97a84723104..c41bd43872beed 100644
--- a/x-pack/plugins/security/public/account_management/account_management_app.test.ts
+++ b/x-pack/plugins/security/public/account_management/account_management_app.test.ts
@@ -54,6 +54,7 @@ describe('accountManagementApp', () => {
       element: containerMock,
       appBasePath: '',
       onAppLeave: jest.fn(),
+      setHeaderActionMenu: jest.fn(),
       history: scopedHistoryMock.create(),
     });
 
diff --git a/x-pack/plugins/security/public/authentication/access_agreement/access_agreement_app.test.ts b/x-pack/plugins/security/public/authentication/access_agreement/access_agreement_app.test.ts
index 0e262e9089842b..eafad74d2f0d83 100644
--- a/x-pack/plugins/security/public/authentication/access_agreement/access_agreement_app.test.ts
+++ b/x-pack/plugins/security/public/authentication/access_agreement/access_agreement_app.test.ts
@@ -48,6 +48,7 @@ describe('accessAgreementApp', () => {
       element: containerMock,
       appBasePath: '',
       onAppLeave: jest.fn(),
+      setHeaderActionMenu: jest.fn(),
       history: scopedHistoryMock.create(),
     });
 
diff --git a/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.test.ts b/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.test.ts
index c5b9245414630a..e6723085460f89 100644
--- a/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.test.ts
+++ b/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.test.ts
@@ -54,6 +54,7 @@ describe('captureURLApp', () => {
       element: document.createElement('div'),
       appBasePath: '',
       onAppLeave: jest.fn(),
+      setHeaderActionMenu: jest.fn(),
       history: (scopedHistoryMock.create() as unknown) as ScopedHistory,
     });
 
diff --git a/x-pack/plugins/security/public/authentication/logged_out/logged_out_app.test.ts b/x-pack/plugins/security/public/authentication/logged_out/logged_out_app.test.ts
index 15d55136b405dc..86a5d21f1b233b 100644
--- a/x-pack/plugins/security/public/authentication/logged_out/logged_out_app.test.ts
+++ b/x-pack/plugins/security/public/authentication/logged_out/logged_out_app.test.ts
@@ -46,6 +46,7 @@ describe('loggedOutApp', () => {
       element: containerMock,
       appBasePath: '',
       onAppLeave: jest.fn(),
+      setHeaderActionMenu: jest.fn(),
       history: scopedHistoryMock.create(),
     });
 
diff --git a/x-pack/plugins/security/public/authentication/login/login_app.test.ts b/x-pack/plugins/security/public/authentication/login/login_app.test.ts
index a6e5a321ef6ec2..5ae8afab9de23b 100644
--- a/x-pack/plugins/security/public/authentication/login/login_app.test.ts
+++ b/x-pack/plugins/security/public/authentication/login/login_app.test.ts
@@ -51,6 +51,7 @@ describe('loginApp', () => {
       element: containerMock,
       appBasePath: '',
       onAppLeave: jest.fn(),
+      setHeaderActionMenu: jest.fn(),
       history: scopedHistoryMock.create(),
     });
 
diff --git a/x-pack/plugins/security/public/authentication/logout/logout_app.test.ts b/x-pack/plugins/security/public/authentication/logout/logout_app.test.ts
index 46b1083a2ed14a..b7bfdf492305e5 100644
--- a/x-pack/plugins/security/public/authentication/logout/logout_app.test.ts
+++ b/x-pack/plugins/security/public/authentication/logout/logout_app.test.ts
@@ -52,6 +52,7 @@ describe('logoutApp', () => {
       element: containerMock,
       appBasePath: '',
       onAppLeave: jest.fn(),
+      setHeaderActionMenu: jest.fn(),
       history: scopedHistoryMock.create(),
     });
 
diff --git a/x-pack/plugins/security/public/authentication/overwritten_session/overwritten_session_app.test.ts b/x-pack/plugins/security/public/authentication/overwritten_session/overwritten_session_app.test.ts
index 0eed1382c270b2..6e0e06dd3dc44f 100644
--- a/x-pack/plugins/security/public/authentication/overwritten_session/overwritten_session_app.test.ts
+++ b/x-pack/plugins/security/public/authentication/overwritten_session/overwritten_session_app.test.ts
@@ -53,6 +53,7 @@ describe('overwrittenSessionApp', () => {
       element: containerMock,
       appBasePath: '',
       onAppLeave: jest.fn(),
+      setHeaderActionMenu: jest.fn(),
       history: scopedHistoryMock.create(),
     });
 
diff --git a/x-pack/plugins/security/public/session/session_timeout_http_interceptor.test.ts b/x-pack/plugins/security/public/session/session_timeout_http_interceptor.test.ts
index 40cbd00858b5f0..0a795ad7678985 100644
--- a/x-pack/plugins/security/public/session/session_timeout_http_interceptor.test.ts
+++ b/x-pack/plugins/security/public/session/session_timeout_http_interceptor.test.ts
@@ -7,7 +7,7 @@
 // @ts-ignore
 import fetchMock from 'fetch-mock/es5/client';
 import { SessionTimeoutHttpInterceptor } from './session_timeout_http_interceptor';
-import { setup } from '../../../../../src/test_utils/public/http_test_setup';
+import { setup } from '../../../../../src/core/test_helpers/http_test_setup';
 import { createSessionTimeoutMock } from './session_timeout.mock';
 
 const mockCurrentUrl = (url: string) => window.history.pushState({}, '', url);
diff --git a/x-pack/plugins/security/public/session/unauthorized_response_http_interceptor.test.ts b/x-pack/plugins/security/public/session/unauthorized_response_http_interceptor.test.ts
index 78c82cbc3a9a66..71ef6496ef6cad 100644
--- a/x-pack/plugins/security/public/session/unauthorized_response_http_interceptor.test.ts
+++ b/x-pack/plugins/security/public/session/unauthorized_response_http_interceptor.test.ts
@@ -7,7 +7,7 @@
 // @ts-ignore
 import fetchMock from 'fetch-mock/es5/client';
 import { SessionExpired } from './session_expired';
-import { setup } from '../../../../../src/test_utils/public/http_test_setup';
+import { setup } from '../../../../../src/core/test_helpers/http_test_setup';
 import { UnauthorizedResponseHttpInterceptor } from './unauthorized_response_http_interceptor';
 jest.mock('./session_expired');
 
diff --git a/x-pack/plugins/security/server/authorization/authorization_service.ts b/x-pack/plugins/security/server/authorization/authorization_service.ts
index 4190499cbd5f43..2dead301b298a4 100644
--- a/x-pack/plugins/security/server/authorization/authorization_service.ts
+++ b/x-pack/plugins/security/server/authorization/authorization_service.ts
@@ -5,7 +5,7 @@
  */
 
 import { Subscription, Observable } from 'rxjs';
-import { UICapabilities } from 'ui/capabilities';
+import type { Capabilities as UICapabilities } from '../../../../../src/core/types';
 import {
   LoggerFactory,
   KibanaRequest,
diff --git a/x-pack/plugins/security/server/authorization/disable_ui_capabilities.ts b/x-pack/plugins/security/server/authorization/disable_ui_capabilities.ts
index c126be1b07f6e3..41d596d570fb97 100644
--- a/x-pack/plugins/security/server/authorization/disable_ui_capabilities.ts
+++ b/x-pack/plugins/security/server/authorization/disable_ui_capabilities.ts
@@ -5,7 +5,7 @@
  */
 
 import { flatten, isObject, mapValues } from 'lodash';
-import { UICapabilities } from 'ui/capabilities';
+import type { Capabilities as UICapabilities } from '../../../../../src/core/types';
 import { KibanaRequest, Logger } from '../../../../../src/core/server';
 import { Feature } from '../../../features/server';
 
diff --git a/x-pack/plugins/security_solution/common/detection_engine/parse_schedule_dates.ts b/x-pack/plugins/security_solution/common/detection_engine/parse_schedule_dates.ts
new file mode 100644
index 00000000000000..b21cd84684fbc2
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/detection_engine/parse_schedule_dates.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import moment from 'moment';
+import dateMath from '@elastic/datemath';
+
+export const parseScheduleDates = (time: string): moment.Moment | null => {
+  const isValidDateString = !isNaN(Date.parse(time));
+  const isValidInput = isValidDateString || time.trim().startsWith('now');
+  const formattedDate = isValidDateString
+    ? moment(time)
+    : isValidInput
+    ? dateMath.parse(time)
+    : null;
+
+  return formattedDate ?? null;
+};
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
index 64f2f223a3073c..498b561a818f2d 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
@@ -14,7 +14,7 @@ import { UUID } from '../types/uuid';
 import { IsoDateString } from '../types/iso_date_string';
 import { PositiveIntegerGreaterThanZero } from '../types/positive_integer_greater_than_zero';
 import { PositiveInteger } from '../types/positive_integer';
-import { parseScheduleDates } from '../../utils';
+import { parseScheduleDates } from '../../parse_schedule_dates';
 
 export const author = t.array(t.string);
 export type Author = t.TypeOf<typeof author>;
@@ -283,6 +283,9 @@ export type Status = t.TypeOf<typeof status>;
 export const job_status = t.keyof({ succeeded: null, failed: null, 'going to run': null });
 export type JobStatus = t.TypeOf<typeof job_status>;
 
+export const conflicts = t.keyof({ abort: null, proceed: null });
+export type Conflicts = t.TypeOf<typeof conflicts>;
+
 // TODO: Create a regular expression type or custom date math part type here
 export const to = t.string;
 export type To = t.TypeOf<typeof to>;
@@ -338,7 +341,7 @@ export const sortFieldOrUndefined = t.union([sort_field, t.undefined]);
 export type SortFieldOrUndefined = t.TypeOf<typeof sortFieldOrUndefined>;
 
 export const sort_order = t.keyof({ asc: null, desc: null });
-export type sortOrder = t.TypeOf<typeof sort_order>;
+export type SortOrder = t.TypeOf<typeof sort_order>;
 
 export const sortOrderOrUndefined = t.union([sort_order, t.undefined]);
 export type SortOrderOrUndefined = t.TypeOf<typeof sortOrderOrUndefined>;
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/index.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/index.ts
new file mode 100644
index 00000000000000..abfbc391896430
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/index.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+export * from './add_prepackaged_rules_schema';
+export * from './create_rules_bulk_schema';
+export * from './create_rules_schema';
+export * from './export_rules_schema';
+export * from './find_rules_schema';
+export * from './import_rules_schema';
+export * from './patch_rules_bulk_schema';
+export * from './patch_rules_schema';
+export * from './query_rules_schema';
+export * from './query_signals_index_schema';
+export * from './set_signal_status_schema';
+export * from './update_rules_bulk_schema';
+export * from './update_rules_schema';
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/set_signal_status_schema.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/set_signal_status_schema.ts
index 1464896e502941..b039558d827bbc 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/set_signal_status_schema.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/set_signal_status_schema.ts
@@ -6,13 +6,14 @@
 
 import * as t from 'io-ts';
 
-import { signal_ids, signal_status_query, status } from '../common/schemas';
+import { conflicts, signal_ids, signal_status_query, status } from '../common/schemas';
 
 export const setSignalsStatusSchema = t.intersection([
   t.type({
     status,
   }),
   t.partial({
+    conflicts,
     signal_ids,
     query: signal_status_query,
   }),
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/index.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/index.ts
new file mode 100644
index 00000000000000..6c22b8140e738f
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/index.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+export * from './error_schema';
+export * from './find_rules_schema';
+export * from './import_rules_schema';
+export * from './prepackaged_rules_schema';
+export * from './prepackaged_rules_status_schema';
+export * from './rules_bulk_schema';
+export * from './rules_schema';
+export * from './type_timeline_only_schema';
diff --git a/x-pack/plugins/security_solution/common/detection_engine/types.ts b/x-pack/plugins/security_solution/common/detection_engine/types.ts
index 7c752bca49dbdf..e7aab2fa5d219e 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/types.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/types.ts
@@ -3,18 +3,8 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import * as t from 'io-ts';
-
 import { AlertAction } from '../../../alerts/common';
 
 export type RuleAlertAction = Omit<AlertAction, 'actionTypeId'> & {
   action_type_id: string;
 };
-
-export const RuleTypeSchema = t.keyof({
-  query: null,
-  saved_query: null,
-  machine_learning: null,
-  threshold: null,
-});
-export type RuleType = t.TypeOf<typeof RuleTypeSchema>;
diff --git a/x-pack/plugins/security_solution/common/detection_engine/utils.ts b/x-pack/plugins/security_solution/common/detection_engine/utils.ts
index a70258c2684b6c..a72d641fbaf783 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/utils.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/utils.ts
@@ -4,11 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import moment from 'moment';
-import dateMath from '@elastic/datemath';
-
 import { EntriesArray } from '../shared_imports';
-import { RuleType } from './types';
+import { Type } from './schemas/common/schemas';
 
 export const hasLargeValueList = (entries: EntriesArray): boolean => {
   const found = entries.filter(({ type }) => type === 'list');
@@ -20,16 +17,4 @@ export const hasNestedEntry = (entries: EntriesArray): boolean => {
   return found.length > 0;
 };
 
-export const isThresholdRule = (ruleType: RuleType) => ruleType === 'threshold';
-
-export const parseScheduleDates = (time: string): moment.Moment | null => {
-  const isValidDateString = !isNaN(Date.parse(time));
-  const isValidInput = isValidDateString || time.trim().startsWith('now');
-  const formattedDate = isValidDateString
-    ? moment(time)
-    : isValidInput
-    ? dateMath.parse(time)
-    : null;
-
-  return formattedDate ?? null;
-};
+export const isThresholdRule = (ruleType: Type) => ruleType === 'threshold';
diff --git a/x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.test.ts b/x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.test.ts
new file mode 100644
index 00000000000000..9ba22e83b4b4d3
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.test.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { extendMap } from './extend_map';
+
+describe('ecs_fields test', () => {
+  describe('extendMap', () => {
+    test('it should extend a record', () => {
+      const osFieldsMap: Readonly<Record<string, string>> = {
+        'os.platform': 'os.platform',
+        'os.full': 'os.full',
+        'os.family': 'os.family',
+        'os.version': 'os.version',
+        'os.kernel': 'os.kernel',
+      };
+      const expected: Record<string, string> = {
+        'host.os.family': 'host.os.family',
+        'host.os.full': 'host.os.full',
+        'host.os.kernel': 'host.os.kernel',
+        'host.os.platform': 'host.os.platform',
+        'host.os.version': 'host.os.version',
+      };
+      expect(extendMap('host', osFieldsMap)).toEqual(expected);
+    });
+
+    test('it should extend a sample hosts record', () => {
+      const hostMap: Record<string, string> = {
+        'host.id': 'host.id',
+        'host.ip': 'host.ip',
+        'host.name': 'host.name',
+      };
+      const osFieldsMap: Readonly<Record<string, string>> = {
+        'os.platform': 'os.platform',
+        'os.full': 'os.full',
+        'os.family': 'os.family',
+        'os.version': 'os.version',
+        'os.kernel': 'os.kernel',
+      };
+      const expected: Record<string, string> = {
+        'host.id': 'host.id',
+        'host.ip': 'host.ip',
+        'host.name': 'host.name',
+        'host.os.family': 'host.os.family',
+        'host.os.full': 'host.os.full',
+        'host.os.kernel': 'host.os.kernel',
+        'host.os.platform': 'host.os.platform',
+        'host.os.version': 'host.os.version',
+      };
+      const output = { ...hostMap, ...extendMap('host', osFieldsMap) };
+      expect(output).toEqual(expected);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.ts b/x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.ts
new file mode 100644
index 00000000000000..c25979cbcdceea
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const extendMap = (
+  path: string,
+  map: Readonly<Record<string, string>>
+): Readonly<Record<string, string>> =>
+  Object.entries(map).reduce<Record<string, string>>((accum, [key, value]) => {
+    accum[`${path}.${key}`] = `${path}.${value}`;
+    return accum;
+  }, {});
diff --git a/x-pack/plugins/security_solution/common/ecs/ecs_fields/index.ts b/x-pack/plugins/security_solution/common/ecs/ecs_fields/index.ts
new file mode 100644
index 00000000000000..19b16bd4bc6d24
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/ecs/ecs_fields/index.ts
@@ -0,0 +1,358 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { extendMap } from './extend_map';
+
+export const auditdMap: Readonly<Record<string, string>> = {
+  'auditd.result': 'auditd.result',
+  'auditd.session': 'auditd.session',
+  'auditd.data.acct': 'auditd.data.acct',
+  'auditd.data.terminal': 'auditd.data.terminal',
+  'auditd.data.op': 'auditd.data.op',
+  'auditd.summary.actor.primary': 'auditd.summary.actor.primary',
+  'auditd.summary.actor.secondary': 'auditd.summary.actor.secondary',
+  'auditd.summary.object.primary': 'auditd.summary.object.primary',
+  'auditd.summary.object.secondary': 'auditd.summary.object.secondary',
+  'auditd.summary.object.type': 'auditd.summary.object.type',
+  'auditd.summary.how': 'auditd.summary.how',
+  'auditd.summary.message_type': 'auditd.summary.message_type',
+  'auditd.summary.sequence': 'auditd.summary.sequence',
+};
+
+export const cloudFieldsMap: Readonly<Record<string, string>> = {
+  'cloud.account.id': 'cloud.account.id',
+  'cloud.availability_zone': 'cloud.availability_zone',
+  'cloud.instance.id': 'cloud.instance.id',
+  'cloud.instance.name': 'cloud.instance.name',
+  'cloud.machine.type': 'cloud.machine.type',
+  'cloud.provider': 'cloud.provider',
+  'cloud.region': 'cloud.region',
+};
+
+export const fileMap: Readonly<Record<string, string>> = {
+  'file.name': 'file.name',
+  'file.path': 'file.path',
+  'file.target_path': 'file.target_path',
+  'file.extension': 'file.extension',
+  'file.type': 'file.type',
+  'file.device': 'file.device',
+  'file.inode': 'file.inode',
+  'file.uid': 'file.uid',
+  'file.owner': 'file.owner',
+  'file.gid': 'file.gid',
+  'file.group': 'file.group',
+  'file.mode': 'file.mode',
+  'file.size': 'file.size',
+  'file.mtime': 'file.mtime',
+  'file.ctime': 'file.ctime',
+};
+
+export const osFieldsMap: Readonly<Record<string, string>> = {
+  'os.platform': 'os.platform',
+  'os.name': 'os.name',
+  'os.full': 'os.full',
+  'os.family': 'os.family',
+  'os.version': 'os.version',
+  'os.kernel': 'os.kernel',
+};
+
+export const hostFieldsMap: Readonly<Record<string, string>> = {
+  'host.architecture': 'host.architecture',
+  'host.id': 'host.id',
+  'host.ip': 'host.ip',
+  'host.mac': 'host.mac',
+  'host.name': 'host.name',
+  ...extendMap('host', osFieldsMap),
+};
+
+export const processFieldsMap: Readonly<Record<string, string>> = {
+  'process.hash.md5': 'process.hash.md5',
+  'process.hash.sha1': 'process.hash.sha1',
+  'process.hash.sha256': 'process.hash.sha256',
+  'process.pid': 'process.pid',
+  'process.name': 'process.name',
+  'process.ppid': 'process.ppid',
+  'process.args': 'process.args',
+  'process.entity_id': 'process.entity_id',
+  'process.executable': 'process.executable',
+  'process.title': 'process.title',
+  'process.thread': 'process.thread',
+  'process.working_directory': 'process.working_directory',
+};
+
+export const agentFieldsMap: Readonly<Record<string, string>> = {
+  'agent.type': 'agent.type',
+};
+
+export const userFieldsMap: Readonly<Record<string, string>> = {
+  'user.domain': 'user.domain',
+  'user.id': 'user.id',
+  'user.name': 'user.name',
+  // NOTE: This field is not tested and available from ECS. Please remove this tag once it is
+  'user.full_name': 'user.full_name',
+  // NOTE: This field is not tested and available from ECS. Please remove this tag once it is
+  'user.email': 'user.email',
+  // NOTE: This field is not tested and available from ECS. Please remove this tag once it is
+  'user.hash': 'user.hash',
+  // NOTE: This field is not tested and available from ECS. Please remove this tag once it is
+  'user.group': 'user.group',
+};
+
+export const winlogFieldsMap: Readonly<Record<string, string>> = {
+  'winlog.event_id': 'winlog.event_id',
+};
+
+export const suricataFieldsMap: Readonly<Record<string, string>> = {
+  'suricata.eve.flow_id': 'suricata.eve.flow_id',
+  'suricata.eve.proto': 'suricata.eve.proto',
+  'suricata.eve.alert.signature': 'suricata.eve.alert.signature',
+  'suricata.eve.alert.signature_id': 'suricata.eve.alert.signature_id',
+};
+
+export const tlsFieldsMap: Readonly<Record<string, string>> = {
+  'tls.client_certificate.fingerprint.sha1': 'tls.client_certificate.fingerprint.sha1',
+  'tls.fingerprints.ja3.hash': 'tls.fingerprints.ja3.hash',
+  'tls.server_certificate.fingerprint.sha1': 'tls.server_certificate.fingerprint.sha1',
+};
+
+export const urlFieldsMap: Readonly<Record<string, string>> = {
+  'url.original': 'url.original',
+  'url.domain': 'url.domain',
+  'user.username': 'user.username',
+  'user.password': 'user.password',
+};
+
+export const httpFieldsMap: Readonly<Record<string, string>> = {
+  'http.version': 'http.version',
+  'http.request': 'http.request',
+  'http.request.method': 'http.request.method',
+  'http.request.body.bytes': 'http.request.body.bytes',
+  'http.request.body.content': 'http.request.body.content',
+  'http.request.referrer': 'http.request.referrer',
+  'http.response.status_code': 'http.response.status_code',
+  'http.response.body': 'http.response.body',
+  'http.response.body.bytes': 'http.response.body.bytes',
+  'http.response.body.content': 'http.response.body.content',
+};
+
+export const zeekFieldsMap: Readonly<Record<string, string>> = {
+  'zeek.session_id': 'zeek.session_id',
+  'zeek.connection.local_resp': 'zeek.connection.local_resp',
+  'zeek.connection.local_orig': 'zeek.connection.local_orig',
+  'zeek.connection.missed_bytes': 'zeek.connection.missed_bytes',
+  'zeek.connection.state': 'zeek.connection.state',
+  'zeek.connection.history': 'zeek.connection.history',
+  'zeek.notice.suppress_for': 'zeek.notice.suppress_for',
+  'zeek.notice.msg': 'zeek.notice.msg',
+  'zeek.notice.note': 'zeek.notice.note',
+  'zeek.notice.sub': 'zeek.notice.sub',
+  'zeek.notice.dst': 'zeek.notice.dst',
+  'zeek.notice.dropped': 'zeek.notice.dropped',
+  'zeek.notice.peer_descr': 'zeek.notice.peer_descr',
+  'zeek.dns.AA': 'zeek.dns.AA',
+  'zeek.dns.qclass_name': 'zeek.dns.qclass_name',
+  'zeek.dns.RD': 'zeek.dns.RD',
+  'zeek.dns.qtype_name': 'zeek.dns.qtype_name',
+  'zeek.dns.qtype': 'zeek.dns.qtype',
+  'zeek.dns.query': 'zeek.dns.query',
+  'zeek.dns.trans_id': 'zeek.dns.trans_id',
+  'zeek.dns.qclass': 'zeek.dns.qclass',
+  'zeek.dns.RA': 'zeek.dns.RA',
+  'zeek.dns.TC': 'zeek.dns.TC',
+  'zeek.http.resp_mime_types': 'zeek.http.resp_mime_types',
+  'zeek.http.trans_depth': 'zeek.http.trans_depth',
+  'zeek.http.status_msg': 'zeek.http.status_msg',
+  'zeek.http.resp_fuids': 'zeek.http.resp_fuids',
+  'zeek.http.tags': 'zeek.http.tags',
+  'zeek.files.session_ids': 'zeek.files.session_ids',
+  'zeek.files.timedout': 'zeek.files.timedout',
+  'zeek.files.local_orig': 'zeek.files.local_orig',
+  'zeek.files.tx_host': 'zeek.files.tx_host',
+  'zeek.files.source': 'zeek.files.source',
+  'zeek.files.is_orig': 'zeek.files.is_orig',
+  'zeek.files.overflow_bytes': 'zeek.files.overflow_bytes',
+  'zeek.files.sha1': 'zeek.files.sha1',
+  'zeek.files.duration': 'zeek.files.duration',
+  'zeek.files.depth': 'zeek.files.depth',
+  'zeek.files.analyzers': 'zeek.files.analyzers',
+  'zeek.files.mime_type': 'zeek.files.mime_type',
+  'zeek.files.rx_host': 'zeek.files.rx_host',
+  'zeek.files.total_bytes': 'zeek.files.total_bytes',
+  'zeek.files.fuid': 'zeek.files.fuid',
+  'zeek.files.seen_bytes': 'zeek.files.seen_bytes',
+  'zeek.files.missing_bytes': 'zeek.files.missing_bytes',
+  'zeek.files.md5': 'zeek.files.md5',
+  'zeek.ssl.cipher': 'zeek.ssl.cipher',
+  'zeek.ssl.established': 'zeek.ssl.established',
+  'zeek.ssl.resumed': 'zeek.ssl.resumed',
+  'zeek.ssl.version': 'zeek.ssl.version',
+};
+
+export const sourceFieldsMap: Readonly<Record<string, string>> = {
+  'source.bytes': 'source.bytes',
+  'source.ip': 'source.ip',
+  'source.packets': 'source.packets',
+  'source.port': 'source.port',
+  'source.domain': 'source.domain',
+  'source.geo.continent_name': 'source.geo.continent_name',
+  'source.geo.country_name': 'source.geo.country_name',
+  'source.geo.country_iso_code': 'source.geo.country_iso_code',
+  'source.geo.city_name': 'source.geo.city_name',
+  'source.geo.region_iso_code': 'source.geo.region_iso_code',
+  'source.geo.region_name': 'source.geo.region_name',
+};
+
+export const destinationFieldsMap: Readonly<Record<string, string>> = {
+  'destination.bytes': 'destination.bytes',
+  'destination.ip': 'destination.ip',
+  'destination.packets': 'destination.packets',
+  'destination.port': 'destination.port',
+  'destination.domain': 'destination.domain',
+  'destination.geo.continent_name': 'destination.geo.continent_name',
+  'destination.geo.country_name': 'destination.geo.country_name',
+  'destination.geo.country_iso_code': 'destination.geo.country_iso_code',
+  'destination.geo.city_name': 'destination.geo.city_name',
+  'destination.geo.region_iso_code': 'destination.geo.region_iso_code',
+  'destination.geo.region_name': 'destination.geo.region_name',
+};
+
+export const networkFieldsMap: Readonly<Record<string, string>> = {
+  'network.bytes': 'network.bytes',
+  'network.community_id': 'network.community_id',
+  'network.direction': 'network.direction',
+  'network.packets': 'network.packets',
+  'network.protocol': 'network.protocol',
+  'network.transport': 'network.transport',
+};
+
+export const geoFieldsMap: Readonly<Record<string, string>> = {
+  'geo.region_name': 'destination.geo.region_name',
+  'geo.country_iso_code': 'destination.geo.country_iso_code',
+};
+
+export const dnsFieldsMap: Readonly<Record<string, string>> = {
+  'dns.question.name': 'dns.question.name',
+  'dns.question.type': 'dns.question.type',
+  'dns.resolved_ip': 'dns.resolved_ip',
+  'dns.response_code': 'dns.response_code',
+};
+
+export const endgameFieldsMap: Readonly<Record<string, string>> = {
+  'endgame.exit_code': 'endgame.exit_code',
+  'endgame.file_name': 'endgame.file_name',
+  'endgame.file_path': 'endgame.file_path',
+  'endgame.logon_type': 'endgame.logon_type',
+  'endgame.parent_process_name': 'endgame.parent_process_name',
+  'endgame.pid': 'endgame.pid',
+  'endgame.process_name': 'endgame.process_name',
+  'endgame.subject_domain_name': 'endgame.subject_domain_name',
+  'endgame.subject_logon_id': 'endgame.subject_logon_id',
+  'endgame.subject_user_name': 'endgame.subject_user_name',
+  'endgame.target_domain_name': 'endgame.target_domain_name',
+  'endgame.target_logon_id': 'endgame.target_logon_id',
+  'endgame.target_user_name': 'endgame.target_user_name',
+};
+
+export const eventBaseFieldsMap: Readonly<Record<string, string>> = {
+  'event.action': 'event.action',
+  'event.category': 'event.category',
+  'event.code': 'event.code',
+  'event.created': 'event.created',
+  'event.dataset': 'event.dataset',
+  'event.duration': 'event.duration',
+  'event.end': 'event.end',
+  'event.hash': 'event.hash',
+  'event.id': 'event.id',
+  'event.kind': 'event.kind',
+  'event.module': 'event.module',
+  'event.original': 'event.original',
+  'event.outcome': 'event.outcome',
+  'event.risk_score': 'event.risk_score',
+  'event.risk_score_norm': 'event.risk_score_norm',
+  'event.severity': 'event.severity',
+  'event.start': 'event.start',
+  'event.timezone': 'event.timezone',
+  'event.type': 'event.type',
+};
+
+export const systemFieldsMap: Readonly<Record<string, string>> = {
+  'system.audit.package.arch': 'system.audit.package.arch',
+  'system.audit.package.entity_id': 'system.audit.package.entity_id',
+  'system.audit.package.name': 'system.audit.package.name',
+  'system.audit.package.size': 'system.audit.package.size',
+  'system.audit.package.summary': 'system.audit.package.summary',
+  'system.audit.package.version': 'system.audit.package.version',
+  'system.auth.ssh.signature': 'system.auth.ssh.signature',
+  'system.auth.ssh.method': 'system.auth.ssh.method',
+};
+
+export const signalFieldsMap: Readonly<Record<string, string>> = {
+  'signal.original_time': 'signal.original_time',
+  'signal.rule.id': 'signal.rule.id',
+  'signal.rule.saved_id': 'signal.rule.saved_id',
+  'signal.rule.timeline_id': 'signal.rule.timeline_id',
+  'signal.rule.timeline_title': 'signal.rule.timeline_title',
+  'signal.rule.output_index': 'signal.rule.output_index',
+  'signal.rule.from': 'signal.rule.from',
+  'signal.rule.index': 'signal.rule.index',
+  'signal.rule.language': 'signal.rule.language',
+  'signal.rule.query': 'signal.rule.query',
+  'signal.rule.to': 'signal.rule.to',
+  'signal.rule.filters': 'signal.rule.filters',
+  'signal.rule.rule_id': 'signal.rule.rule_id',
+  'signal.rule.false_positives': 'signal.rule.false_positives',
+  'signal.rule.max_signals': 'signal.rule.max_signals',
+  'signal.rule.risk_score': 'signal.rule.risk_score',
+  'signal.rule.description': 'signal.rule.description',
+  'signal.rule.name': 'signal.rule.name',
+  'signal.rule.immutable': 'signal.rule.immutable',
+  'signal.rule.references': 'signal.rule.references',
+  'signal.rule.severity': 'signal.rule.severity',
+  'signal.rule.tags': 'signal.rule.tags',
+  'signal.rule.threat': 'signal.rule.threat',
+  'signal.rule.type': 'signal.rule.type',
+  'signal.rule.size': 'signal.rule.size',
+  'signal.rule.enabled': 'signal.rule.enabled',
+  'signal.rule.created_at': 'signal.rule.created_at',
+  'signal.rule.updated_at': 'signal.rule.updated_at',
+  'signal.rule.created_by': 'signal.rule.created_by',
+  'signal.rule.updated_by': 'signal.rule.updated_by',
+  'signal.rule.version': 'signal.rule.version',
+  'signal.rule.note': 'signal.rule.note',
+  'signal.rule.threshold': 'signal.rule.threshold',
+  'signal.rule.exceptions_list': 'signal.rule.exceptions_list',
+};
+
+export const ruleFieldsMap: Readonly<Record<string, string>> = {
+  'rule.reference': 'rule.reference',
+};
+
+export const eventFieldsMap: Readonly<Record<string, string>> = {
+  timestamp: '@timestamp',
+  '@timestamp': '@timestamp',
+  message: 'message',
+  ...{ ...agentFieldsMap },
+  ...{ ...auditdMap },
+  ...{ ...destinationFieldsMap },
+  ...{ ...dnsFieldsMap },
+  ...{ ...endgameFieldsMap },
+  ...{ ...eventBaseFieldsMap },
+  ...{ ...fileMap },
+  ...{ ...geoFieldsMap },
+  ...{ ...hostFieldsMap },
+  ...{ ...networkFieldsMap },
+  ...{ ...ruleFieldsMap },
+  ...{ ...signalFieldsMap },
+  ...{ ...sourceFieldsMap },
+  ...{ ...suricataFieldsMap },
+  ...{ ...systemFieldsMap },
+  ...{ ...tlsFieldsMap },
+  ...{ ...zeekFieldsMap },
+  ...{ ...httpFieldsMap },
+  ...{ ...userFieldsMap },
+  ...{ ...winlogFieldsMap },
+  ...{ ...processFieldsMap },
+};
diff --git a/x-pack/plugins/security_solution/common/ecs/index.ts b/x-pack/plugins/security_solution/common/ecs/index.ts
index ff21ebc5ef9739..e31d42b02f80be 100644
--- a/x-pack/plugins/security_solution/common/ecs/index.ts
+++ b/x-pack/plugins/security_solution/common/ecs/index.ts
@@ -27,52 +27,28 @@ import { SystemEcs } from './system';
 
 export interface Ecs {
   _id: string;
-
   _index?: string;
-
   auditd?: AuditdEcs;
-
   destination?: DestinationEcs;
-
   dns?: DnsEcs;
-
   endgame?: EndgameEcs;
-
   event?: EventEcs;
-
   geo?: GeoEcs;
-
   host?: HostEcs;
-
   network?: NetworkEcs;
-
   rule?: RuleEcs;
-
   signal?: SignalEcs;
-
   source?: SourceEcs;
-
   suricata?: SuricataEcs;
-
   tls?: TlsEcs;
-
   zeek?: ZeekEcs;
-
   http?: HttpEcs;
-
   url?: UrlEcs;
-
   timestamp?: string;
-
   message?: string[];
-
   user?: UserEcs;
-
   winlog?: WinlogEcs;
-
   process?: ProcessEcs;
-
   file?: File;
-
   system?: SystemEcs;
 }
diff --git a/x-pack/plugins/security_solution/common/endpoint/constants.ts b/x-pack/plugins/security_solution/common/endpoint/constants.ts
index 507ce63c7b815f..366bf7a1df1f24 100644
--- a/x-pack/plugins/security_solution/common/endpoint/constants.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/constants.ts
@@ -13,3 +13,5 @@ export const LIMITED_CONCURRENCY_ENDPOINT_ROUTE_TAG = 'endpoint:limited-concurre
 export const LIMITED_CONCURRENCY_ENDPOINT_COUNT = 100;
 
 export const TRUSTED_APPS_LIST_API = '/api/endpoint/trusted_apps';
+export const TRUSTED_APPS_CREATE_API = '/api/endpoint/trusted_apps';
+export const TRUSTED_APPS_DELETE_API = '/api/endpoint/trusted_apps/{id}';
diff --git a/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.test.ts b/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.test.ts
index 7aec8e15c317ca..b0c769216732d2 100644
--- a/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.test.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.test.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { GetTrustedAppsRequestSchema } from './trusted_apps';
+import { GetTrustedAppsRequestSchema, PostTrustedAppCreateRequestSchema } from './trusted_apps';
 
 describe('When invoking Trusted Apps Schema', () => {
   describe('for GET List', () => {
@@ -68,4 +68,180 @@ describe('When invoking Trusted Apps Schema', () => {
       });
     });
   });
+
+  describe('for POST Create', () => {
+    const getCreateTrustedAppItem = () => ({
+      name: 'Some Anti-Virus App',
+      description: 'this one is ok',
+      os: 'windows',
+      entries: [
+        {
+          field: 'path',
+          type: 'match',
+          operator: 'included',
+          value: 'c:/programs files/Anti-Virus',
+        },
+      ],
+    });
+    const body = PostTrustedAppCreateRequestSchema.body;
+
+    it('should not error on a valid message', () => {
+      const bodyMsg = getCreateTrustedAppItem();
+      expect(body.validate(bodyMsg)).toStrictEqual(bodyMsg);
+    });
+
+    it('should validate `name` is required', () => {
+      const bodyMsg = {
+        ...getCreateTrustedAppItem(),
+        name: undefined,
+      };
+      expect(() => body.validate(bodyMsg)).toThrow();
+    });
+
+    it('should validate `name` value to be non-empty', () => {
+      const bodyMsg = {
+        ...getCreateTrustedAppItem(),
+        name: '',
+      };
+      expect(() => body.validate(bodyMsg)).toThrow();
+    });
+
+    it('should validate `description` as optional', () => {
+      const { description, ...bodyMsg } = getCreateTrustedAppItem();
+      expect(body.validate(bodyMsg)).toStrictEqual(bodyMsg);
+    });
+
+    it('should validate `description` to be non-empty if defined', () => {
+      const bodyMsg = {
+        ...getCreateTrustedAppItem(),
+        description: '',
+      };
+      expect(() => body.validate(bodyMsg)).toThrow();
+    });
+
+    it('should validate `os` to to only accept known values', () => {
+      const bodyMsg = {
+        ...getCreateTrustedAppItem(),
+        os: undefined,
+      };
+      expect(() => body.validate(bodyMsg)).toThrow();
+
+      const bodyMsg2 = {
+        ...bodyMsg,
+        os: '',
+      };
+      expect(() => body.validate(bodyMsg2)).toThrow();
+
+      const bodyMsg3 = {
+        ...bodyMsg,
+        os: 'winz',
+      };
+      expect(() => body.validate(bodyMsg3)).toThrow();
+
+      ['linux', 'macos', 'windows'].forEach((os) => {
+        expect(() => {
+          body.validate({
+            ...bodyMsg,
+            os,
+          });
+        }).not.toThrow();
+      });
+    });
+
+    it('should validate `entries` as required', () => {
+      const bodyMsg = {
+        ...getCreateTrustedAppItem(),
+        entries: undefined,
+      };
+      expect(() => body.validate(bodyMsg)).toThrow();
+
+      const { entries, ...bodyMsg2 } = getCreateTrustedAppItem();
+      expect(() => body.validate(bodyMsg2)).toThrow();
+    });
+
+    it('should validate `entries` to have at least 1 item', () => {
+      const bodyMsg = {
+        ...getCreateTrustedAppItem(),
+        entries: [],
+      };
+      expect(() => body.validate(bodyMsg)).toThrow();
+    });
+
+    describe('when `entries` are defined', () => {
+      const getTrustedAppItemEntryItem = () => getCreateTrustedAppItem().entries[0];
+
+      it('should validate `entry.field` is required', () => {
+        const { field, ...entry } = getTrustedAppItemEntryItem();
+        const bodyMsg = {
+          ...getCreateTrustedAppItem(),
+          entries: [entry],
+        };
+        expect(() => body.validate(bodyMsg)).toThrow();
+      });
+
+      it('should validate `entry.field` is limited to known values', () => {
+        const bodyMsg = {
+          ...getCreateTrustedAppItem(),
+          entries: [
+            {
+              ...getTrustedAppItemEntryItem(),
+              field: '',
+            },
+          ],
+        };
+        expect(() => body.validate(bodyMsg)).toThrow();
+
+        const bodyMsg2 = {
+          ...getCreateTrustedAppItem(),
+          entries: [
+            {
+              ...getTrustedAppItemEntryItem(),
+              field: 'invalid value',
+            },
+          ],
+        };
+        expect(() => body.validate(bodyMsg2)).toThrow();
+
+        ['hash', 'path'].forEach((field) => {
+          const bodyMsg3 = {
+            ...getCreateTrustedAppItem(),
+            entries: [
+              {
+                ...getTrustedAppItemEntryItem(),
+                field,
+              },
+            ],
+          };
+
+          expect(() => body.validate(bodyMsg3)).not.toThrow();
+        });
+      });
+
+      it.todo('should validate `entry.type` is limited to known values');
+
+      it.todo('should validate `entry.operator` is limited to known values');
+
+      it('should validate `entry.value` required', () => {
+        const { value, ...entry } = getTrustedAppItemEntryItem();
+        const bodyMsg = {
+          ...getCreateTrustedAppItem(),
+          entries: [entry],
+        };
+        expect(() => body.validate(bodyMsg)).toThrow();
+      });
+
+      it('should validate `entry.value` is non-empty', () => {
+        const bodyMsg = {
+          ...getCreateTrustedAppItem(),
+          entries: [
+            {
+              ...getTrustedAppItemEntryItem(),
+              value: '',
+            },
+          ],
+        };
+        expect(() => body.validate(bodyMsg)).toThrow();
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts b/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts
index 20fab93aaf304a..7c0de84b637c9a 100644
--- a/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts
@@ -6,9 +6,32 @@
 
 import { schema } from '@kbn/config-schema';
 
+export const DeleteTrustedAppsRequestSchema = {
+  params: schema.object({
+    id: schema.string(),
+  }),
+};
+
 export const GetTrustedAppsRequestSchema = {
   query: schema.object({
     page: schema.maybe(schema.number({ defaultValue: 1, min: 1 })),
     per_page: schema.maybe(schema.number({ defaultValue: 20, min: 1 })),
   }),
 };
+
+export const PostTrustedAppCreateRequestSchema = {
+  body: schema.object({
+    name: schema.string({ minLength: 1 }),
+    description: schema.maybe(schema.string({ minLength: 1 })),
+    os: schema.oneOf([schema.literal('linux'), schema.literal('macos'), schema.literal('windows')]),
+    entries: schema.arrayOf(
+      schema.object({
+        field: schema.oneOf([schema.literal('hash'), schema.literal('path')]),
+        type: schema.literal('match'),
+        operator: schema.literal('included'),
+        value: schema.string({ minLength: 1 }),
+      }),
+      { minSize: 1 }
+    ),
+  }),
+};
diff --git a/x-pack/plugins/security_solution/common/endpoint/types/trusted_apps.ts b/x-pack/plugins/security_solution/common/endpoint/types/trusted_apps.ts
index 2905274bef1cb0..7aeb6c6024b993 100644
--- a/x-pack/plugins/security_solution/common/endpoint/types/trusted_apps.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/types/trusted_apps.ts
@@ -5,7 +5,10 @@
  */
 
 import { TypeOf } from '@kbn/config-schema';
-import { GetTrustedAppsRequestSchema } from '../schema/trusted_apps';
+import {
+  GetTrustedAppsRequestSchema,
+  PostTrustedAppCreateRequestSchema,
+} from '../schema/trusted_apps';
 
 /** API request params for retrieving a list of Trusted Apps */
 export type GetTrustedAppsListRequest = TypeOf<typeof GetTrustedAppsRequestSchema.query>;
@@ -16,6 +19,12 @@ export interface GetTrustedListAppsResponse {
   data: TrustedApp[];
 }
 
+/** API Request body for creating a new Trusted App entry */
+export type PostTrustedAppCreateRequest = TypeOf<typeof PostTrustedAppCreateRequestSchema.body>;
+export interface PostTrustedAppCreateResponse {
+  data: TrustedApp;
+}
+
 interface MacosLinuxConditionEntry {
   field: 'hash' | 'path';
   type: 'match';
diff --git a/x-pack/plugins/security_solution/common/machine_learning/helpers.ts b/x-pack/plugins/security_solution/common/machine_learning/helpers.ts
index fe3eb79a6f6109..73dc30f238c7e1 100644
--- a/x-pack/plugins/security_solution/common/machine_learning/helpers.ts
+++ b/x-pack/plugins/security_solution/common/machine_learning/helpers.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { RuleType } from '../detection_engine/types';
+import { Type } from '../detection_engine/schemas/common/schemas';
 
 // Based on ML Job/Datafeed States from x-pack/legacy/plugins/ml/common/constants/states.js
 const enabledStates = ['started', 'opened'];
@@ -23,4 +23,4 @@ export const isJobFailed = (jobState: string, datafeedState: string): boolean =>
   return failureStates.includes(jobState) || failureStates.includes(datafeedState);
 };
 
-export const isMlRule = (ruleType: RuleType) => ruleType === 'machine_learning';
+export const isMlRule = (ruleType: Type) => ruleType === 'machine_learning';
diff --git a/x-pack/plugins/security_solution/common/search_strategy/common/index.ts b/x-pack/plugins/security_solution/common/search_strategy/common/index.ts
new file mode 100644
index 00000000000000..b55226b08b800d
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/common/index.ts
@@ -0,0 +1,115 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../src/plugins/data/common';
+
+export type Maybe<T> = T | null;
+
+export type SearchHit = IEsSearchResponse<object>['rawResponse']['hits']['hits'][0];
+
+export interface TotalValue {
+  value: number;
+  relation: string;
+}
+
+export interface Inspect {
+  dsl: string[];
+}
+
+export interface PageInfoPaginated {
+  activePage: number;
+  fakeTotalCount: number;
+  showMorePagesIndicator: boolean;
+}
+
+export interface CursorType {
+  value?: Maybe<string>;
+  tiebreaker?: Maybe<string>;
+}
+
+export enum Direction {
+  asc = 'asc',
+  desc = 'desc',
+}
+
+export interface SortField<Field = string> {
+  field: Field;
+  direction: Direction;
+}
+
+export interface TimerangeInput {
+  /** The interval string to use for last bucket. The format is '{value}{unit}'. For example '5m' would return the metrics for the last 5 minutes of the timespan. */
+  interval: string;
+  /** The end of the timerange */
+  to: string;
+  /** The beginning of the timerange */
+  from: string;
+}
+
+export interface PaginationInput {
+  /** The limit parameter allows you to configure the maximum amount of items to be returned */
+  limit: number;
+  /** The cursor parameter defines the next result you want to fetch */
+  cursor?: Maybe<string>;
+  /** The tiebreaker parameter allow to be more precise to fetch the next item */
+  tiebreaker?: Maybe<string>;
+}
+
+export interface PaginationInputPaginated {
+  /** The activePage parameter defines the page of results you want to fetch */
+  activePage: number;
+  /** The cursorStart parameter defines the start of the results to be displayed */
+  cursorStart: number;
+  /** The fakePossibleCount parameter determines the total count in order to show 5 additional pages */
+  fakePossibleCount: number;
+  /** The querySize parameter is the number of items to be returned */
+  querySize: number;
+}
+
+export interface DocValueFields {
+  field: string;
+  format: string;
+}
+
+export interface Explanation {
+  value: number;
+  description: string;
+  details: Explanation[];
+}
+
+export interface ShardsResponse {
+  total: number;
+  successful: number;
+  failed: number;
+  skipped: number;
+}
+
+export interface TotalHit {
+  value: number;
+  relation: string;
+}
+
+export interface Hit {
+  _index: string;
+  _type: string;
+  _id: string;
+  _score: number | null;
+}
+
+export interface Hits<T, U> {
+  hits: {
+    total: T;
+    max_score: number | null;
+    hits: U[];
+  };
+}
+
+export interface GenericBuckets {
+  key: string;
+  doc_count: number;
+}
+
+export type StringOrNumber = string | number;
diff --git a/x-pack/plugins/security_solution/common/search_strategy/index.ts b/x-pack/plugins/security_solution/common/search_strategy/index.ts
new file mode 100644
index 00000000000000..cff9f4ca2f029d
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './common';
+export * from './security_solution';
+export * from './timeline';
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/all/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/all/index.ts
new file mode 100644
index 00000000000000..8191fa742ed9c2
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/all/index.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+
+import { HostItem, HostsFields } from '../common';
+import { CursorType, Inspect, Maybe, PageInfoPaginated } from '../../../common';
+import { RequestOptionsPaginated } from '../..';
+
+export interface HostsEdges {
+  node: HostItem;
+  cursor: CursorType;
+}
+
+export interface HostsStrategyResponse extends IEsSearchResponse {
+  edges: HostsEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface HostsRequestOptions extends RequestOptionsPaginated<HostsFields> {
+  defaultIndex: string[];
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/authentications/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/authentications/index.ts
new file mode 100644
index 00000000000000..efdc96b33562a2
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/authentications/index.ts
@@ -0,0 +1,83 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+
+import { UserEcs } from '../../../../ecs/user';
+import { SourceEcs } from '../../../../ecs/source';
+import { HostEcs } from '../../../../ecs/host';
+import {
+  CursorType,
+  Inspect,
+  Maybe,
+  PageInfoPaginated,
+  StringOrNumber,
+  Hit,
+  TotalHit,
+} from '../../../common';
+import { RequestOptionsPaginated } from '../../';
+
+export interface HostAuthenticationsStrategyResponse extends IEsSearchResponse {
+  edges: AuthenticationsEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface HostAuthenticationsRequestOptions extends RequestOptionsPaginated {
+  defaultIndex: string[];
+}
+
+export interface AuthenticationsEdges {
+  node: AuthenticationItem;
+  cursor: CursorType;
+}
+
+export interface AuthenticationItem {
+  _id: string;
+  failures: number;
+  successes: number;
+  user: UserEcs;
+  lastSuccess?: Maybe<LastSourceHost>;
+  lastFailure?: Maybe<LastSourceHost>;
+}
+
+export interface LastSourceHost {
+  timestamp?: Maybe<string>;
+  source?: Maybe<SourceEcs>;
+  host?: Maybe<HostEcs>;
+}
+
+export interface AuthenticationHit extends Hit {
+  _source: {
+    '@timestamp': string;
+    lastSuccess?: LastSourceHost;
+    lastFailure?: LastSourceHost;
+  };
+  user: string;
+  failures: number;
+  successes: number;
+  cursor?: string;
+  sort: StringOrNumber[];
+}
+
+export interface AuthenticationBucket {
+  key: {
+    user_uid: string;
+  };
+  doc_count: number;
+  failures: {
+    doc_count: number;
+  };
+  successes: {
+    doc_count: number;
+  };
+  authentication: {
+    hits: {
+      total: TotalHit;
+      hits: ArrayLike<AuthenticationHit>;
+    };
+  };
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts
new file mode 100644
index 00000000000000..902e9909cf728b
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts
@@ -0,0 +1,112 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CloudEcs } from '../../../../ecs/cloud';
+import { HostEcs, OsEcs } from '../../../../ecs/host';
+import { Hit, Hits, Maybe, SearchHit, StringOrNumber, TotalValue } from '../../../common';
+
+export enum HostPolicyResponseActionStatus {
+  success = 'success',
+  failure = 'failure',
+  warning = 'warning',
+}
+
+export enum HostsFields {
+  lastSeen = 'lastSeen',
+  hostName = 'hostName',
+}
+
+export interface EndpointFields {
+  endpointPolicy?: Maybe<string>;
+  sensorVersion?: Maybe<string>;
+  policyStatus?: Maybe<HostPolicyResponseActionStatus>;
+}
+
+export interface HostItem {
+  _id?: Maybe<string>;
+  cloud?: Maybe<CloudEcs>;
+  endpoint?: Maybe<EndpointFields>;
+  host?: Maybe<HostEcs>;
+  lastSeen?: Maybe<string>;
+}
+
+export interface HostValue {
+  value: number;
+  value_as_string: string;
+}
+
+export interface HostBucketItem {
+  key: string;
+  doc_count: number;
+  timestamp: HostValue;
+}
+
+export interface HostBuckets {
+  buckets: HostBucketItem[];
+}
+
+export interface HostOsHitsItem {
+  hits: {
+    total: TotalValue | number;
+    max_score: number | null;
+    hits: Array<{
+      _source: { host: { os: Maybe<OsEcs> } };
+      sort?: [number];
+      _index?: string;
+      _type?: string;
+      _id?: string;
+      _score?: number | null;
+    }>;
+  };
+}
+
+export interface HostAggEsItem {
+  cloud_instance_id?: HostBuckets;
+  cloud_machine_type?: HostBuckets;
+  cloud_provider?: HostBuckets;
+  cloud_region?: HostBuckets;
+  firstSeen?: HostValue;
+  host_architecture?: HostBuckets;
+  host_id?: HostBuckets;
+  host_ip?: HostBuckets;
+  host_mac?: HostBuckets;
+  host_name?: HostBuckets;
+  host_os_name?: HostBuckets;
+  host_os_version?: HostBuckets;
+  host_type?: HostBuckets;
+  key?: string;
+  lastSeen?: HostValue;
+  os?: HostOsHitsItem;
+}
+
+export interface HostEsData extends SearchHit {
+  sort: string[];
+  aggregations: {
+    host_count: {
+      value: number;
+    };
+    host_data: {
+      buckets: HostAggEsItem[];
+    };
+  };
+}
+
+export interface HostAggEsData extends SearchHit {
+  sort: string[];
+  aggregations: HostAggEsItem;
+}
+
+export interface HostHit extends Hit {
+  _source: {
+    '@timestamp'?: string;
+    host: HostEcs;
+  };
+  cursor?: string;
+  firstSeen?: string;
+  sort?: StringOrNumber[];
+}
+
+export type HostHits = Hits<number, HostHit>;
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/details/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/details/index.ts
new file mode 100644
index 00000000000000..2338df88abad98
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/details/index.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+
+import { Inspect, Maybe, TimerangeInput } from '../../../common';
+import { HostItem, HostsFields } from '../common';
+import { RequestOptionsPaginated } from '../..';
+
+export interface HostDetailsStrategyResponse extends IEsSearchResponse {
+  hostDetails: HostItem;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface HostDetailsRequestOptions extends Partial<RequestOptionsPaginated<HostsFields>> {
+  hostName: string;
+  skip?: boolean;
+  timerange: TimerangeInput;
+  inspect?: Maybe<Inspect>;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/first_last_seen/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/first_last_seen/index.ts
new file mode 100644
index 00000000000000..adf70a109bc036
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/first_last_seen/index.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../common';
+import { RequestOptionsPaginated } from '../..';
+import { HostsFields } from '../common';
+
+export interface HostFirstLastSeenRequestOptions
+  extends Partial<RequestOptionsPaginated<HostsFields>> {
+  hostName: string;
+}
+export interface HostFirstLastSeenStrategyResponse extends IEsSearchResponse {
+  inspect?: Maybe<Inspect>;
+  firstSeen?: Maybe<string>;
+  lastSeen?: Maybe<string>;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts
index 3a0942d2decb82..63a57c20a85932 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts
@@ -4,81 +4,19 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IEsSearchResponse } from '../../../../../../../src/plugins/data/common';
-import { CloudEcs } from '../../../ecs/cloud';
-import { HostEcs } from '../../../ecs/host';
-
-import {
-  CursorType,
-  Inspect,
-  Maybe,
-  PageInfoPaginated,
-  RequestOptionsPaginated,
-  SortField,
-  TimerangeInput,
-} from '..';
+export * from './all';
+export * from './authentications';
+export * from './common';
+export * from './details';
+export * from './first_last_seen';
+export * from './overview';
+export * from './uncommon_processes';
 
 export enum HostsQueries {
+  authentications = 'authentications',
+  details = 'details',
+  firstLastSeen = 'firstLastSeen',
   hosts = 'hosts',
-  hostOverview = 'hostOverview',
-}
-
-export enum HostPolicyResponseActionStatus {
-  success = 'success',
-  failure = 'failure',
-  warning = 'warning',
-}
-
-export interface EndpointFields {
-  endpointPolicy?: Maybe<string>;
-
-  sensorVersion?: Maybe<string>;
-
-  policyStatus?: Maybe<HostPolicyResponseActionStatus>;
-}
-
-export interface HostItem {
-  _id?: Maybe<string>;
-
-  cloud?: Maybe<CloudEcs>;
-
-  endpoint?: Maybe<EndpointFields>;
-
-  host?: Maybe<HostEcs>;
-
-  lastSeen?: Maybe<string>;
-}
-
-export interface HostsEdges {
-  node: HostItem;
-
-  cursor: CursorType;
-}
-
-export interface HostsStrategyResponse extends IEsSearchResponse {
-  edges: HostsEdges[];
-
-  totalCount: number;
-
-  pageInfo: PageInfoPaginated;
-
-  inspect?: Maybe<Inspect>;
-}
-
-export interface HostOverviewStrategyResponse extends IEsSearchResponse, HostItem {
-  inspect?: Maybe<Inspect>;
-}
-
-export interface HostsRequestOptions extends RequestOptionsPaginated {
-  sort: SortField;
-  defaultIndex: string[];
-}
-
-export interface HostLastFirstSeenRequestOptions extends Partial<RequestOptionsPaginated> {
-  hostName: string;
-}
-
-export interface HostOverviewRequestOptions extends HostLastFirstSeenRequestOptions {
-  fields: string[];
-  timerange: TimerangeInput;
+  overview = 'overviewHost',
+  uncommonProcesses = 'uncommonProcesses',
 }
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/overview/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/overview/index.ts
new file mode 100644
index 00000000000000..569ed611bd35bc
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/overview/index.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe, SearchHit } from '../../../common';
+import { RequestBasicOptions } from '../..';
+
+export type HostOverviewRequestOptions = RequestBasicOptions;
+
+export interface HostOverviewStrategyResponse extends IEsSearchResponse {
+  inspect?: Maybe<Inspect>;
+  overviewHost: {
+    auditbeatAuditd?: Maybe<number>;
+    auditbeatFIM?: Maybe<number>;
+    auditbeatLogin?: Maybe<number>;
+    auditbeatPackage?: Maybe<number>;
+    auditbeatProcess?: Maybe<number>;
+    auditbeatUser?: Maybe<number>;
+    endgameDns?: Maybe<number>;
+    endgameFile?: Maybe<number>;
+    endgameImageLoad?: Maybe<number>;
+    endgameNetwork?: Maybe<number>;
+    endgameProcess?: Maybe<number>;
+    endgameRegistry?: Maybe<number>;
+    endgameSecurity?: Maybe<number>;
+    filebeatSystemModule?: Maybe<number>;
+    winlogbeatSecurity?: Maybe<number>;
+    winlogbeatMWSysmonOperational?: Maybe<number>;
+  };
+}
+
+export interface OverviewHostHit extends SearchHit {
+  aggregations: {
+    auditd_count: {
+      doc_count: number;
+    };
+    endgame_module: {
+      dns_event_count: {
+        doc_count: number;
+      };
+      file_event_count: {
+        doc_count: number;
+      };
+      image_load_event_count: {
+        doc_count: number;
+      };
+      network_event_count: {
+        doc_count: number;
+      };
+      process_event_count: {
+        doc_count: number;
+      };
+      registry_event: {
+        doc_count: number;
+      };
+      security_event_count: {
+        doc_count: number;
+      };
+    };
+    fim_count: {
+      doc_count: number;
+    };
+    system_module: {
+      login_count: {
+        doc_count: number;
+      };
+      package_count: {
+        doc_count: number;
+      };
+      process_count: {
+        doc_count: number;
+      };
+      user_count: {
+        doc_count: number;
+      };
+      filebeat_count: {
+        doc_count: number;
+      };
+    };
+    winlog_count: {
+      doc_count: number;
+    };
+  };
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/uncommon_processes/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/uncommon_processes/index.ts
new file mode 100644
index 00000000000000..28c0ccb7f6f4f5
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/uncommon_processes/index.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+
+import { HostEcs } from '../../../../ecs/host';
+import { UserEcs } from '../../../../ecs/user';
+import {
+  RequestOptionsPaginated,
+  SortField,
+  CursorType,
+  Inspect,
+  Maybe,
+  PageInfoPaginated,
+  Hit,
+  TotalHit,
+  StringOrNumber,
+  Hits,
+} from '../../..';
+
+export interface HostUncommonProcessesRequestOptions extends RequestOptionsPaginated {
+  sort: SortField;
+  defaultIndex: string[];
+}
+
+export interface HostUncommonProcessesStrategyResponse extends IEsSearchResponse {
+  edges: UncommonProcessesEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface UncommonProcessesEdges {
+  node: UncommonProcessItem;
+  cursor: CursorType;
+}
+
+export interface UncommonProcessItem {
+  _id: string;
+  instances: number;
+  process: ProcessEcsFields;
+  hosts: HostEcs[];
+  user?: Maybe<UserEcs>;
+}
+
+export interface ProcessEcsFields {
+  hash?: Maybe<ProcessHashData>;
+  pid?: Maybe<number[]>;
+  name?: Maybe<string[]>;
+  ppid?: Maybe<number[]>;
+  args?: Maybe<string[]>;
+  entity_id?: Maybe<string[]>;
+  executable?: Maybe<string[]>;
+  title?: Maybe<string[]>;
+  thread?: Maybe<Thread>;
+  working_directory?: Maybe<string[]>;
+}
+
+export interface ProcessHashData {
+  md5?: Maybe<string[]>;
+  sha1?: Maybe<string[]>;
+  sha256?: Maybe<string[]>;
+}
+
+export interface Thread {
+  id?: Maybe<number[]>;
+  start?: Maybe<string[]>;
+}
+
+export interface UncommonProcessHit extends Hit {
+  total: TotalHit;
+  host: Array<{
+    id: string[] | undefined;
+    name: string[] | undefined;
+  }>;
+  _source: {
+    '@timestamp': string;
+    process: ProcessEcsFields;
+  };
+  cursor: string;
+  sort: StringOrNumber[];
+}
+
+export type ProcessHits = Hits<TotalHit, UncommonProcessHit>;
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
index a188eb7619e6be..b7d905d22e8390 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
@@ -7,76 +7,53 @@
 import { IEsSearchRequest } from '../../../../../../src/plugins/data/common';
 import { ESQuery } from '../../typed_json';
 import {
+  HostDetailsStrategyResponse,
+  HostDetailsRequestOptions,
   HostOverviewStrategyResponse,
+  HostAuthenticationsRequestOptions,
+  HostAuthenticationsStrategyResponse,
   HostOverviewRequestOptions,
+  HostFirstLastSeenStrategyResponse,
+  HostFirstLastSeenRequestOptions,
   HostsQueries,
   HostsRequestOptions,
   HostsStrategyResponse,
+  HostUncommonProcessesStrategyResponse,
+  HostUncommonProcessesRequestOptions,
 } from './hosts';
-export * from './hosts';
-export type Maybe<T> = T | null;
-
-export type FactoryQueryTypes = HostsQueries;
-
-export interface Inspect {
-  dsl: string[];
-  response: string[];
-}
-
-export interface PageInfoPaginated {
-  activePage: number;
-  fakeTotalCount: number;
-  showMorePagesIndicator: boolean;
-}
-
-export interface CursorType {
-  value?: Maybe<string>;
-  tiebreaker?: Maybe<string>;
-}
-
-export enum Direction {
-  asc = 'asc',
-  desc = 'desc',
-}
-
-export interface SortField {
-  field: 'lastSeen' | 'hostName';
-  direction: Direction;
-}
-
-export interface TimerangeInput {
-  /** The interval string to use for last bucket. The format is '{value}{unit}'. For example '5m' would return the metrics for the last 5 minutes of the timespan. */
-  interval: string;
-  /** The end of the timerange */
-  to: string;
-  /** The beginning of the timerange */
-  from: string;
-}
-
-export interface PaginationInput {
-  /** The limit parameter allows you to configure the maximum amount of items to be returned */
-  limit: number;
-  /** The cursor parameter defines the next result you want to fetch */
-  cursor?: Maybe<string>;
-  /** The tiebreaker parameter allow to be more precise to fetch the next item */
-  tiebreaker?: Maybe<string>;
-}
+import {
+  NetworkQueries,
+  NetworkDnsStrategyResponse,
+  NetworkDnsRequestOptions,
+  NetworkTlsStrategyResponse,
+  NetworkTlsRequestOptions,
+  NetworkHttpStrategyResponse,
+  NetworkHttpRequestOptions,
+  NetworkOverviewStrategyResponse,
+  NetworkOverviewRequestOptions,
+  NetworkTopCountriesStrategyResponse,
+  NetworkTopCountriesRequestOptions,
+  NetworkTopNFlowStrategyResponse,
+  NetworkTopNFlowRequestOptions,
+} from './network';
+import {
+  MatrixHistogramQuery,
+  MatrixHistogramRequestOptions,
+  MatrixHistogramStrategyResponse,
+} from './matrix_histogram';
+import {
+  DocValueFields,
+  TimerangeInput,
+  SortField,
+  PaginationInput,
+  PaginationInputPaginated,
+} from '../common';
 
-export interface PaginationInputPaginated {
-  /** The activePage parameter defines the page of results you want to fetch */
-  activePage: number;
-  /** The cursorStart parameter defines the start of the results to be displayed */
-  cursorStart: number;
-  /** The fakePossibleCount parameter determines the total count in order to show 5 additional pages */
-  fakePossibleCount: number;
-  /** The querySize parameter is the number of items to be returned */
-  querySize: number;
-}
+export * from './hosts';
+export * from './matrix_histogram';
+export * from './network';
 
-export interface DocValueFields {
-  field: string;
-  format: string;
-}
+export type FactoryQueryTypes = HostsQueries | NetworkQueries | typeof MatrixHistogramQuery;
 
 export interface RequestBasicOptions extends IEsSearchRequest {
   timerange: TimerangeInput;
@@ -86,24 +63,70 @@ export interface RequestBasicOptions extends IEsSearchRequest {
   factoryQueryType?: FactoryQueryTypes;
 }
 
-export interface RequestOptions extends RequestBasicOptions {
+/** A mapping of semantic fields to their document counterparts */
+
+export interface RequestOptions<Field = string> extends RequestBasicOptions {
   pagination: PaginationInput;
-  sortField?: SortField;
+  sort: SortField<Field>;
 }
 
-export interface RequestOptionsPaginated extends RequestBasicOptions {
+export interface RequestOptionsPaginated<Field = string> extends RequestBasicOptions {
   pagination: PaginationInputPaginated;
-  sortField?: SortField;
+  sort: SortField<Field>;
 }
 
 export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
   ? HostsStrategyResponse
-  : T extends HostsQueries.hostOverview
+  : T extends HostsQueries.details
+  ? HostDetailsStrategyResponse
+  : T extends HostsQueries.overview
   ? HostOverviewStrategyResponse
+  : T extends HostsQueries.authentications
+  ? HostAuthenticationsStrategyResponse
+  : T extends HostsQueries.firstLastSeen
+  ? HostFirstLastSeenStrategyResponse
+  : T extends HostsQueries.uncommonProcesses
+  ? HostUncommonProcessesStrategyResponse
+  : T extends NetworkQueries.dns
+  ? NetworkDnsStrategyResponse
+  : T extends NetworkQueries.http
+  ? NetworkHttpStrategyResponse
+  : T extends NetworkQueries.overview
+  ? NetworkOverviewStrategyResponse
+  : T extends NetworkQueries.tls
+  ? NetworkTlsStrategyResponse
+  : T extends NetworkQueries.topCountries
+  ? NetworkTopCountriesStrategyResponse
+  : T extends NetworkQueries.topNFlow
+  ? NetworkTopNFlowStrategyResponse
+  : T extends typeof MatrixHistogramQuery
+  ? MatrixHistogramStrategyResponse
   : never;
 
 export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
   ? HostsRequestOptions
-  : T extends HostsQueries.hostOverview
+  : T extends HostsQueries.details
+  ? HostDetailsRequestOptions
+  : T extends HostsQueries.overview
   ? HostOverviewRequestOptions
+  : T extends HostsQueries.authentications
+  ? HostAuthenticationsRequestOptions
+  : T extends HostsQueries.firstLastSeen
+  ? HostFirstLastSeenRequestOptions
+  : T extends HostsQueries.uncommonProcesses
+  ? HostUncommonProcessesRequestOptions
+  : T extends NetworkQueries.dns
+  ? NetworkDnsRequestOptions
+  : T extends NetworkQueries.http
+  ? NetworkHttpRequestOptions
+  : T extends NetworkQueries.overview
+  ? NetworkOverviewRequestOptions
+  : T extends NetworkQueries.tls
+  ? NetworkTlsRequestOptions
+  : T extends NetworkQueries.topCountries
+  ? NetworkTopCountriesRequestOptions
+  : T extends NetworkQueries.topNFlow
+  ? NetworkTopNFlowRequestOptions
+  : T extends typeof MatrixHistogramQuery
+  ? MatrixHistogramRequestOptions
   : never;
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/alerts/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/alerts/index.ts
new file mode 100644
index 00000000000000..28953d7df8550f
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/alerts/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { HistogramBucket } from '../common';
+
+export interface AlertsGroupData {
+  key: string;
+  doc_count: number;
+  alerts: {
+    buckets: HistogramBucket[];
+  };
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/anomalies/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/anomalies/index.ts
new file mode 100644
index 00000000000000..dbd7fe6d1c427d
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/anomalies/index.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SearchHit } from '../../../common';
+
+interface AnomaliesOverTimeHistogramData {
+  key_as_string: string;
+  key: number;
+  doc_count: number;
+}
+
+export interface AnomaliesActionGroupData {
+  key: number;
+  anomalies: {
+    bucket: AnomaliesOverTimeHistogramData[];
+  };
+  doc_count: number;
+}
+
+export interface AnomalySource {
+  [field: string]: any; // eslint-disable-line @typescript-eslint/no-explicit-any
+}
+
+export interface AnomalyHit extends SearchHit {
+  sort: string[];
+  _source: AnomalySource;
+  aggregations: {
+    [agg: string]: any; // eslint-disable-line @typescript-eslint/no-explicit-any
+  };
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/authentications/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/authentications/index.ts
new file mode 100644
index 00000000000000..23d656be5044eb
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/authentications/index.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface AuthenticationsOverTimeHistogramData {
+  key_as_string: string;
+  key: number;
+  doc_count: number;
+}
+
+export interface AuthenticationsActionGroupData {
+  key: number;
+  events: {
+    bucket: AuthenticationsOverTimeHistogramData[];
+  };
+  doc_count: number;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/common/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/common/index.ts
new file mode 100644
index 00000000000000..687d55414f78eb
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/common/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface HistogramBucket {
+  key: number;
+  doc_count: number;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/dns/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/dns/index.ts
new file mode 100644
index 00000000000000..7667dce383e542
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/dns/index.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface DnsHistogramSubBucket {
+  key: string;
+  doc_count: number;
+  orderAgg: {
+    value: number;
+  };
+}
+interface DnsHistogramBucket {
+  doc_count_error_upper_bound: number;
+  sum_other_doc_count: number;
+  buckets: DnsHistogramSubBucket[];
+}
+
+export interface DnsHistogramGroupData {
+  key: number;
+  doc_count: number;
+  key_as_string: string;
+  histogram: DnsHistogramBucket;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/events/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/events/index.ts
new file mode 100644
index 00000000000000..f1307335215ed5
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/events/index.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SearchHit } from '../../../common';
+
+interface EventsMatrixHistogramData {
+  key_as_string: string;
+  key: number;
+  doc_count: number;
+}
+
+export interface EventSource {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  [field: string]: any;
+}
+
+export interface EventsActionGroupData {
+  key: number;
+  events: {
+    bucket: EventsMatrixHistogramData[];
+  };
+  doc_count: number;
+}
+
+export interface EventHit extends SearchHit {
+  sort: string[];
+  _source: EventSource;
+  aggregations: {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    [agg: string]: any;
+  };
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/index.ts
new file mode 100644
index 00000000000000..238300801cfc6a
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/matrix_histogram/index.ts
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../src/plugins/data/common';
+import { AuthenticationHit } from '../hosts';
+import { Inspect, Maybe, TimerangeInput } from '../../common';
+import { RequestBasicOptions } from '../';
+import { AlertsGroupData } from './alerts';
+import { AnomaliesActionGroupData, AnomalyHit } from './anomalies';
+import { DnsHistogramGroupData } from './dns';
+import { AuthenticationsActionGroupData } from './authentications';
+import { EventsActionGroupData, EventHit } from './events';
+
+export * from './alerts';
+export * from './anomalies';
+export * from './authentications';
+export * from './common';
+export * from './dns';
+export * from './events';
+
+export const MatrixHistogramQuery = 'matrixHistogram';
+
+export enum MatrixHistogramType {
+  authentications = 'authentications',
+  anomalies = 'anomalies',
+  events = 'events',
+  alerts = 'alerts',
+  dns = 'dns',
+}
+
+export interface MatrixHistogramRequestOptions extends RequestBasicOptions {
+  timerange: TimerangeInput;
+  histogramType: MatrixHistogramType;
+  stackByField: string;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface MatrixHistogramStrategyResponse extends IEsSearchResponse {
+  inspect?: Maybe<Inspect>;
+  matrixHistogramData: MatrixHistogramData[];
+  totalCount: number;
+}
+
+export interface MatrixHistogramData {
+  x?: Maybe<number>;
+  y?: Maybe<number>;
+  g?: Maybe<string>;
+}
+
+export interface MatrixHistogramBucket {
+  key: number;
+  doc_count: number;
+}
+
+export interface MatrixHistogramSchema<T> {
+  buildDsl: (options: MatrixHistogramRequestOptions) => {};
+  aggName: string;
+  parseKey: string;
+  parser?: <T>(data: MatrixHistogramParseData<T>, keyBucket: string) => MatrixHistogramData[];
+}
+
+export type MatrixHistogramParseData<T> = T extends MatrixHistogramType.alerts
+  ? AlertsGroupData[]
+  : T extends MatrixHistogramType.anomalies
+  ? AnomaliesActionGroupData[]
+  : T extends MatrixHistogramType.dns
+  ? DnsHistogramGroupData[]
+  : T extends MatrixHistogramType.authentications
+  ? AuthenticationsActionGroupData[]
+  : T extends MatrixHistogramType.events
+  ? EventsActionGroupData[]
+  : never;
+
+export type MatrixHistogramHit<T> = T extends MatrixHistogramType.alerts
+  ? EventHit
+  : T extends MatrixHistogramType.anomalies
+  ? AnomalyHit
+  : T extends MatrixHistogramType.dns
+  ? EventHit
+  : T extends MatrixHistogramType.authentications
+  ? AuthenticationHit
+  : T extends MatrixHistogramType.events
+  ? EventHit
+  : never;
+
+export type MatrixHistogramDataConfig = Record<
+  MatrixHistogramType,
+  MatrixHistogramSchema<MatrixHistogramType>
+>;
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/common/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/common/index.ts
new file mode 100644
index 00000000000000..66676569b3c9eb
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/common/index.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { GeoEcs } from '../../../../ecs/geo';
+import { Maybe } from '../../..';
+
+export enum NetworkTopTablesFields {
+  bytes_in = 'bytes_in',
+  bytes_out = 'bytes_out',
+  flows = 'flows',
+  destination_ips = 'destination_ips',
+  source_ips = 'source_ips',
+}
+
+export enum FlowTargetSourceDest {
+  destination = 'destination',
+  source = 'source',
+}
+
+export interface TopNetworkTablesEcsField {
+  bytes_in?: Maybe<number>;
+  bytes_out?: Maybe<number>;
+}
+
+export interface GeoItem {
+  geo?: Maybe<GeoEcs>;
+  flowTarget?: Maybe<FlowTargetSourceDest>;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/dns/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/dns/index.ts
new file mode 100644
index 00000000000000..e3899a914ee3a4
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/dns/index.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { CursorType, Inspect, Maybe, PageInfoPaginated, SortField } from '../../../common';
+import { RequestOptionsPaginated } from '../..';
+
+export enum NetworkDnsFields {
+  dnsName = 'dnsName',
+  queryCount = 'queryCount',
+  uniqueDomains = 'uniqueDomains',
+  dnsBytesIn = 'dnsBytesIn',
+  dnsBytesOut = 'dnsBytesOut',
+}
+
+export interface NetworkDnsRequestOptions extends RequestOptionsPaginated {
+  isPtrIncluded: boolean;
+  sort: SortField<NetworkDnsFields>;
+  stackByField?: Maybe<string>;
+}
+
+export interface NetworkDnsStrategyResponse extends IEsSearchResponse {
+  edges: NetworkDnsEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+  histogram?: Maybe<MatrixOverOrdinalHistogramData[]>;
+}
+
+export interface NetworkDnsEdges {
+  node: NetworkDnsItem;
+  cursor: CursorType;
+}
+
+export interface NetworkDnsItem {
+  _id?: Maybe<string>;
+  dnsBytesIn?: Maybe<number>;
+  dnsBytesOut?: Maybe<number>;
+  dnsName?: Maybe<string>;
+  queryCount?: Maybe<number>;
+  uniqueDomains?: Maybe<number>;
+}
+
+export interface MatrixOverOrdinalHistogramData {
+  x: string;
+  y: number;
+  g: string;
+}
+
+export interface NetworkDnsBuckets {
+  key: string;
+  doc_count: number;
+  unique_domains: {
+    value: number;
+  };
+  dns_bytes_in: {
+    value: number;
+  };
+  dns_bytes_out: {
+    value: number;
+  };
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/http/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/http/index.ts
new file mode 100644
index 00000000000000..ad58442b169944
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/http/index.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { Maybe, CursorType, Inspect, PageInfoPaginated, GenericBuckets } from '../../../common';
+import { RequestOptionsPaginated } from '../..';
+
+export interface NetworkHttpRequestOptions extends RequestOptionsPaginated {
+  ip?: string;
+  defaultIndex: string[];
+}
+
+export interface NetworkHttpStrategyResponse extends IEsSearchResponse {
+  edges: NetworkHttpEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface NetworkHttpEdges {
+  node: NetworkHttpItem;
+  cursor: CursorType;
+}
+
+export interface NetworkHttpItem {
+  _id?: Maybe<string>;
+  domains: string[];
+  lastHost?: Maybe<string>;
+  lastSourceIp?: Maybe<string>;
+  methods: string[];
+  path?: Maybe<string>;
+  requestCount?: Maybe<number>;
+  statuses: string[];
+}
+
+export interface NetworkHttpBuckets {
+  key: string;
+  doc_count: number;
+  domains: {
+    buckets: GenericBuckets[];
+  };
+  methods: {
+    buckets: GenericBuckets[];
+  };
+  source: object;
+  status: {
+    buckets: GenericBuckets[];
+  };
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts
new file mode 100644
index 00000000000000..d61acbe62ffb03
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './common';
+export * from './dns';
+export * from './http';
+export * from './overview';
+export * from './tls';
+export * from './top_countries';
+export * from './top_n_flow';
+
+export enum NetworkQueries {
+  dns = 'dns',
+  http = 'http',
+  overview = 'overviewNetwork',
+  tls = 'tls',
+  topCountries = 'topCountries',
+  topNFlow = 'topNFlow',
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/overview/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/overview/index.ts
new file mode 100644
index 00000000000000..b7c8b7448eaf7c
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/overview/index.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe, SearchHit } from '../../../common';
+import { RequestBasicOptions } from '../..';
+
+export type NetworkOverviewRequestOptions = RequestBasicOptions;
+
+export interface NetworkOverviewStrategyResponse extends IEsSearchResponse {
+  inspect?: Maybe<Inspect>;
+  overviewNetwork: {
+    auditbeatSocket?: Maybe<number>;
+    filebeatCisco?: Maybe<number>;
+    filebeatNetflow?: Maybe<number>;
+    filebeatPanw?: Maybe<number>;
+    filebeatSuricata?: Maybe<number>;
+    filebeatZeek?: Maybe<number>;
+    packetbeatDNS?: Maybe<number>;
+    packetbeatFlow?: Maybe<number>;
+    packetbeatTLS?: Maybe<number>;
+  };
+}
+
+export interface OverviewNetworkHit extends SearchHit {
+  aggregations: {
+    unique_flow_count: {
+      doc_count: number;
+    };
+    unique_dns_count: {
+      doc_count: number;
+    };
+    unique_suricata_count: {
+      doc_count: number;
+    };
+    unique_zeek_count: {
+      doc_count: number;
+    };
+    unique_socket_count: {
+      doc_count: number;
+    };
+    unique_filebeat_count: {
+      unique_netflow_count: {
+        doc_count: number;
+      };
+      unique_panw_count: {
+        doc_count: number;
+      };
+      unique_cisco_count: {
+        doc_count: number;
+      };
+    };
+    unique_packetbeat_count: {
+      unique_tls_count: {
+        doc_count: number;
+      };
+    };
+  };
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/tls/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/tls/index.ts
new file mode 100644
index 00000000000000..dffc994fcf4cbb
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/tls/index.ts
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { CursorType, Inspect, Maybe, PageInfoPaginated } from '../../../common';
+import { RequestOptionsPaginated } from '../..';
+import { FlowTargetSourceDest } from '../common';
+
+export interface TlsBuckets {
+  key: string;
+  timestamp?: {
+    value: number;
+    value_as_string: string;
+  };
+  subjects: {
+    buckets: Readonly<Array<{ key: string; doc_count: number }>>;
+  };
+  ja3: {
+    buckets: Readonly<Array<{ key: string; doc_count: number }>>;
+  };
+  issuers: {
+    buckets: Readonly<Array<{ key: string; doc_count: number }>>;
+  };
+  not_after: {
+    buckets: Readonly<Array<{ key: number; key_as_string: string; doc_count: number }>>;
+  };
+}
+
+export interface TlsNode {
+  _id?: Maybe<string>;
+  timestamp?: Maybe<string>;
+  notAfter?: Maybe<string[]>;
+  subjects?: Maybe<string[]>;
+  ja3?: Maybe<string[]>;
+  issuers?: Maybe<string[]>;
+}
+
+export enum TlsFields {
+  _id = '_id',
+}
+
+export interface TlsEdges {
+  node: TlsNode;
+  cursor: CursorType;
+}
+
+export interface NetworkTlsRequestOptions extends RequestOptionsPaginated<TlsFields> {
+  ip: string;
+  flowTarget: FlowTargetSourceDest;
+  defaultIndex: string[];
+}
+
+export interface NetworkTlsStrategyResponse extends IEsSearchResponse {
+  edges: TlsEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/top_countries/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/top_countries/index.ts
new file mode 100644
index 00000000000000..a28388a2c6f8f9
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/top_countries/index.ts
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { CursorType, Inspect, Maybe, PageInfoPaginated } from '../../../common';
+import { RequestOptionsPaginated } from '../..';
+import {
+  GeoItem,
+  FlowTargetSourceDest,
+  NetworkTopTablesFields,
+  TopNetworkTablesEcsField,
+} from '../common';
+
+export enum FlowTarget {
+  client = 'client',
+  destination = 'destination',
+  server = 'server',
+  source = 'source',
+}
+
+export interface TopCountriesItemSource {
+  country?: Maybe<string>;
+  destination_ips?: Maybe<number>;
+  flows?: Maybe<number>;
+  location?: Maybe<GeoItem>;
+  source_ips?: Maybe<number>;
+}
+
+export interface NetworkTopCountriesRequestOptions
+  extends RequestOptionsPaginated<NetworkTopTablesFields> {
+  flowTarget: FlowTargetSourceDest;
+  ip?: string;
+}
+
+export interface NetworkTopCountriesStrategyResponse extends IEsSearchResponse {
+  edges: NetworkTopCountriesEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface NetworkTopCountriesEdges {
+  node: NetworkTopCountriesItem;
+  cursor: CursorType;
+}
+
+export interface NetworkTopCountriesItem {
+  _id?: Maybe<string>;
+  source?: Maybe<TopCountriesItemSource>;
+  destination?: Maybe<TopCountriesItemDestination>;
+  network?: Maybe<TopNetworkTablesEcsField>;
+}
+
+export interface TopCountriesItemDestination {
+  country?: Maybe<string>;
+  destination_ips?: Maybe<number>;
+  flows?: Maybe<number>;
+  location?: Maybe<GeoItem>;
+  source_ips?: Maybe<number>;
+}
+
+export interface NetworkTopCountriesBuckets {
+  country: string;
+  key: string;
+  bytes_in: {
+    value: number;
+  };
+  bytes_out: {
+    value: number;
+  };
+  flows: number;
+  destination_ips: number;
+  source_ips: number;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/top_n_flow/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/top_n_flow/index.ts
new file mode 100644
index 00000000000000..d6be2d29c6eda9
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/top_n_flow/index.ts
@@ -0,0 +1,124 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import {
+  GeoItem,
+  FlowTargetSourceDest,
+  TopNetworkTablesEcsField,
+  NetworkTopTablesFields,
+} from '../common';
+import {
+  CursorType,
+  Inspect,
+  Maybe,
+  PageInfoPaginated,
+  TotalValue,
+  GenericBuckets,
+} from '../../../common';
+import { RequestOptionsPaginated } from '../..';
+
+export interface NetworkTopNFlowRequestOptions
+  extends RequestOptionsPaginated<NetworkTopTablesFields> {
+  flowTarget: FlowTargetSourceDest;
+  ip?: Maybe<string>;
+}
+
+export interface NetworkTopNFlowStrategyResponse extends IEsSearchResponse {
+  edges: NetworkTopNFlowEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface NetworkTopNFlowEdges {
+  node: NetworkTopNFlowItem;
+  cursor: CursorType;
+}
+
+export interface NetworkTopNFlowItem {
+  _id?: Maybe<string>;
+  source?: Maybe<TopNFlowItemSource>;
+  destination?: Maybe<TopNFlowItemDestination>;
+  network?: Maybe<TopNetworkTablesEcsField>;
+}
+
+export interface TopNFlowItemSource {
+  autonomous_system?: Maybe<AutonomousSystemItem>;
+  domain?: Maybe<string[]>;
+  ip?: Maybe<string>;
+  location?: Maybe<GeoItem>;
+  flows?: Maybe<number>;
+  destination_ips?: Maybe<number>;
+}
+
+export interface AutonomousSystemItem {
+  name?: Maybe<string>;
+  number?: Maybe<number>;
+}
+
+export interface TopNFlowItemDestination {
+  autonomous_system?: Maybe<AutonomousSystemItem>;
+  domain?: Maybe<string[]>;
+  ip?: Maybe<string>;
+  location?: Maybe<GeoItem>;
+  flows?: Maybe<number>;
+  source_ips?: Maybe<number>;
+}
+
+export interface AutonomousSystemHit<T> {
+  doc_count: number;
+  top_as: {
+    hits: {
+      total: TotalValue | number;
+      max_score: number | null;
+      hits: Array<{
+        _source: T;
+        sort?: [number];
+        _index?: string;
+        _type?: string;
+        _id?: string;
+        _score?: number | null;
+      }>;
+    };
+  };
+}
+
+export interface NetworkTopNFlowBuckets {
+  key: string;
+  autonomous_system: AutonomousSystemHit<object>;
+  bytes_in: {
+    value: number;
+  };
+  bytes_out: {
+    value: number;
+  };
+  domain: {
+    buckets: GenericBuckets[];
+  };
+  location: LocationHit<object>;
+  flows: number;
+  destination_ips?: number;
+  source_ips?: number;
+}
+
+export interface LocationHit<T> {
+  doc_count: number;
+  top_geo: {
+    hits: {
+      total: TotalValue | number;
+      max_score: number | null;
+      hits: Array<{
+        _source: T;
+        sort?: [number];
+        _index?: string;
+        _type?: string;
+        _id?: string;
+        _score?: number | null;
+      }>;
+    };
+  };
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/timeline/details/index.ts b/x-pack/plugins/security_solution/common/search_strategy/timeline/details/index.ts
new file mode 100644
index 00000000000000..e5e1c41f4731a8
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/timeline/details/index.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../common';
+import { TimelineRequestOptionsPaginated } from '..';
+
+export interface DetailItem {
+  field: string;
+  values?: Maybe<string[]>;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  originalValue?: Maybe<any>;
+}
+
+export interface TimelineDetailsStrategyResponse extends IEsSearchResponse {
+  data?: Maybe<DetailItem[]>;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface TimelineDetailsRequestOptions extends Partial<TimelineRequestOptionsPaginated> {
+  defaultIndex: string[];
+  executeQuery: boolean;
+  indexName: string;
+  eventId: string;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts b/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts
new file mode 100644
index 00000000000000..a7bf61c102cd4d
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchRequest } from '../../../../../../src/plugins/data/common';
+import { ESQuery } from '../../typed_json';
+import { Ecs } from '../../ecs';
+import {
+  CursorType,
+  Maybe,
+  TimerangeInput,
+  DocValueFields,
+  PaginationInput,
+  PaginationInputPaginated,
+  SortField,
+} from '../common';
+import { TimelineDetailsRequestOptions, TimelineDetailsStrategyResponse } from './details';
+
+export * from './details';
+
+export enum TimelineQueries {
+  details = 'details',
+}
+
+export type TimelineFactoryQueryTypes = TimelineQueries;
+
+export interface TimelineEdges {
+  node: TimelineItem;
+  cursor: CursorType;
+}
+
+export interface TimelineItem {
+  _id: string;
+  _index?: Maybe<string>;
+  data: TimelineNonEcsData[];
+  ecs: Ecs;
+}
+
+export interface TimelineNonEcsData {
+  field: string;
+  value?: Maybe<string[] | string>;
+}
+
+export interface TimelineRequestBasicOptions extends IEsSearchRequest {
+  timerange: TimerangeInput;
+  filterQuery: ESQuery | string | undefined;
+  defaultIndex: string[];
+  docValueFields?: DocValueFields[];
+  factoryQueryType?: TimelineFactoryQueryTypes;
+}
+
+export interface TimelineRequestOptions extends TimelineRequestBasicOptions {
+  pagination: PaginationInput;
+  sortField?: SortField;
+}
+
+export interface TimelineRequestOptionsPaginated extends TimelineRequestBasicOptions {
+  pagination: PaginationInputPaginated;
+  sortField?: SortField;
+}
+
+export type TimelineStrategyResponseType<
+  T extends TimelineFactoryQueryTypes
+> = T extends TimelineQueries.details ? TimelineDetailsStrategyResponse : never;
+
+export type TimelineStrategyRequestType<
+  T extends TimelineFactoryQueryTypes
+> = T extends TimelineQueries.details ? TimelineDetailsRequestOptions : never;
diff --git a/x-pack/plugins/security_solution/common/shared_imports.ts b/x-pack/plugins/security_solution/common/shared_imports.ts
index e28d1969b39763..564254b6a75963 100644
--- a/x-pack/plugins/security_solution/common/shared_imports.ts
+++ b/x-pack/plugins/security_solution/common/shared_imports.ts
@@ -25,7 +25,6 @@ export {
   NamespaceType,
   Operator,
   OperatorEnum,
-  OperatorType,
   OperatorTypeEnum,
   ExceptionListTypeEnum,
   exceptionListItemSchema,
diff --git a/x-pack/plugins/security_solution/cypress/fixtures/overview.json b/x-pack/plugins/security_solution/cypress/fixtures/overview.json
index 69594b88b75154..c4aeda0c446e43 100644
--- a/x-pack/plugins/security_solution/cypress/fixtures/overview.json
+++ b/x-pack/plugins/security_solution/cypress/fixtures/overview.json
@@ -2,37 +2,6 @@
   "data": {
     "source": {
       "id": "default",
-      "OverviewNetwork": {
-        "auditbeatSocket": 578502,
-        "filebeatCisco": 999,
-        "filebeatNetflow": 2544,
-        "filebeatPanw": 678,
-        "filebeatSuricata": 303699,
-        "filebeatZeek": 71129,
-        "packetbeatDNS": 1090,
-        "packetbeatFlow": 722153,
-        "packetbeatTLS": 340,
-        "__typename": "OverviewNetworkData"
-      },
-      "OverviewHost": {
-        "auditbeatAuditd": 123,
-        "auditbeatFIM": 345,
-        "auditbeatLogin": 456,
-        "auditbeatPackage": 567,
-        "auditbeatProcess": 678,
-        "auditbeatUser": 789,
-        "endgameDns": 391,
-        "endgameFile": 392,
-        "endgameImageLoad": 393,
-        "endgameNetwork": 394,
-        "endgameProcess": 395,
-        "endgameRegistry": 396,
-        "endgameSecurity": 397,
-        "filebeatSystemModule": 890,
-        "winlogbeatSecurity": 70,
-        "winlogbeatMWSysmonOperational": 30,
-        "__typename": "OverviewHostData"
-      },
       "status": {
         "indicesExist": true,
         "indexFields": [],
diff --git a/x-pack/plugins/security_solution/cypress/fixtures/overview_search_strategy.json b/x-pack/plugins/security_solution/cypress/fixtures/overview_search_strategy.json
new file mode 100644
index 00000000000000..d0c75170150916
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/fixtures/overview_search_strategy.json
@@ -0,0 +1,33 @@
+{
+  "overviewNetwork": {
+    "auditbeatSocket": 578502,
+    "filebeatCisco": 999,
+    "filebeatNetflow": 2544,
+    "filebeatPanw": 678,
+    "filebeatSuricata": 303699,
+    "filebeatZeek": 71129,
+    "packetbeatDNS": 1090,
+    "packetbeatFlow": 722153,
+    "packetbeatTLS": 340,
+    "__typename": "OverviewNetworkData"
+  },
+  "overviewHost": {
+    "auditbeatAuditd": 123,
+    "auditbeatFIM": 345,
+    "auditbeatLogin": 456,
+    "auditbeatPackage": 567,
+    "auditbeatProcess": 678,
+    "auditbeatUser": 789,
+    "endgameDns": 391,
+    "endgameFile": 392,
+    "endgameImageLoad": 393,
+    "endgameNetwork": 394,
+    "endgameProcess": 395,
+    "endgameRegistry": 396,
+    "endgameSecurity": 397,
+    "filebeatSystemModule": 890,
+    "winlogbeatSecurity": 70,
+    "winlogbeatMWSysmonOperational": 30,
+    "__typename": "OverviewHostData"
+  }
+}
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
index ba1de0e40e270c..d9d9fde8fc8cc9 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
@@ -58,6 +58,8 @@ import {
   createAndActivateRule,
   fillAboutRuleAndContinue,
   fillDefineCustomRuleWithImportedQueryAndContinue,
+  expectDefineFormToRepopulateAndContinue,
+  expectAboutFormToRepopulateAndContinue,
 } from '../tasks/create_new_rule';
 import { esArchiverLoad, esArchiverUnload } from '../tasks/es_archiver';
 import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
@@ -82,6 +84,8 @@ describe('Detection rules, custom', () => {
     goToCreateNewRule();
     fillDefineCustomRuleWithImportedQueryAndContinue(newRule);
     fillAboutRuleAndContinue(newRule);
+    expectDefineFormToRepopulateAndContinue(newRule);
+    expectAboutFormToRepopulateAndContinue(newRule);
     createAndActivateRule();
 
     cy.get(CUSTOM_RULES_BTN).invoke('text').should('eql', 'Custom rules (1)');
diff --git a/x-pack/plugins/security_solution/cypress/integration/overview.spec.ts b/x-pack/plugins/security_solution/cypress/integration/overview.spec.ts
index b799d487acd086..14464333fcafe0 100644
--- a/x-pack/plugins/security_solution/cypress/integration/overview.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/overview.spec.ts
@@ -14,6 +14,7 @@ import { OVERVIEW_URL } from '../urls/navigation';
 describe('Overview Page', () => {
   before(() => {
     cy.stubSecurityApi('overview');
+    cy.stubSearchStrategyApi('overview_search_strategy');
     loginAndWaitForPage(OVERVIEW_URL);
   });
 
diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines_export.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines_export.spec.ts
new file mode 100644
index 00000000000000..d8f96aaf5e5639
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines_export.spec.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { exportTimeline, waitForTimelinesPanelToBeLoaded } from '../tasks/timeline';
+import { esArchiverLoad, esArchiverUnload } from '../tasks/es_archiver';
+import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
+
+import { TIMELINES_URL } from '../urls/navigation';
+
+const EXPECTED_EXPORTED_TIMELINE_PATH = 'cypress/test_files/expected_timelines_export.ndjson';
+
+describe('Export timelines', () => {
+  before(() => {
+    esArchiverLoad('timeline');
+    cy.server();
+    cy.route('POST', '**api/timeline/_export?file_name=timelines_export.ndjson*').as('export');
+  });
+
+  after(() => {
+    esArchiverUnload('timeline');
+  });
+
+  it('Exports a custom timeline', () => {
+    loginAndWaitForPageWithoutDateRange(TIMELINES_URL);
+    waitForTimelinesPanelToBeLoaded();
+
+    cy.readFile(EXPECTED_EXPORTED_TIMELINE_PATH).then(($expectedExportedJson) => {
+      const parsedJson = JSON.parse($expectedExportedJson);
+      const timelineId = parsedJson.savedObjectId;
+      exportTimeline(timelineId);
+
+      cy.wait('@export').then((response) => {
+        cy.wrap(response.status).should('eql', 200);
+        cy.wrap(response.xhr.responseText).should('eql', $expectedExportedJson);
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
index 83ace877cd51df..397d0c01421796 100644
--- a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
@@ -6,6 +6,8 @@
 
 export const ABOUT_CONTINUE_BTN = '[data-test-subj="about-continue"]';
 
+export const ABOUT_EDIT_BUTTON = '[data-test-subj="edit-about-rule"]';
+
 export const ADD_FALSE_POSITIVE_BTN =
   '[data-test-subj="detectionEngineStepAboutRuleFalsePositives"] .euiButtonEmpty__text';
 
@@ -26,6 +28,8 @@ export const CUSTOM_QUERY_INPUT = '[data-test-subj="queryInput"]';
 
 export const DEFINE_CONTINUE_BUTTON = '[data-test-subj="define-continue"]';
 
+export const DEFINE_EDIT_BUTTON = '[data-test-subj="edit-define-rule"]';
+
 export const IMPORT_QUERY_FROM_SAVED_TIMELINE_LINK =
   '[data-test-subj="importQueryFromSavedTimeline"]';
 
diff --git a/x-pack/plugins/security_solution/cypress/screens/search_bar.ts b/x-pack/plugins/security_solution/cypress/screens/search_bar.ts
index 07e9de137826c3..d2838292b04f05 100644
--- a/x-pack/plugins/security_solution/cypress/screens/search_bar.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/search_bar.ts
@@ -14,7 +14,7 @@ export const ADD_FILTER_FORM_FIELD_INPUT =
   '[data-test-subj="filterFieldSuggestionList"] input[data-test-subj="comboBoxSearchInput"]';
 
 export const ADD_FILTER_FORM_FIELD_OPTION = (value: string) =>
-  `[data-test-subj="comboBoxOptionsList filterFieldSuggestionList-optionsList"] button[title="${value}"] strong`;
+  `[data-test-subj="comboBoxOptionsList filterFieldSuggestionList-optionsList"] button[title="${value}"] mark`;
 
 export const ADD_FILTER_FORM_OPERATOR_FIELD =
   '[data-test-subj="filterOperatorList"] input[data-test-subj="comboBoxSearchInput"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/timeline.ts b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
index 26203a8ca3b839..fd41cd63fc090a 100644
--- a/x-pack/plugins/security_solution/cypress/screens/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+export const BULK_ACTIONS = '[data-test-subj="utility-bar-action-button"]';
+
 export const CLOSE_TIMELINE_BTN = '[data-test-subj="close-timeline"]';
 
 export const CREATE_NEW_TIMELINE = '[data-test-subj="timeline-new"]';
@@ -11,6 +13,8 @@ export const CREATE_NEW_TIMELINE = '[data-test-subj="timeline-new"]';
 export const DRAGGABLE_HEADER =
   '[data-test-subj="events-viewer-panel"] [data-test-subj="headers-group"] [data-test-subj="draggable-header"]';
 
+export const EXPORT_TIMELINE_ACTION = '[data-test-subj="export-timeline-action"]';
+
 export const HEADER = '[data-test-subj="header"]';
 
 export const HEADERS_GROUP = '[data-test-subj="headers-group"]';
@@ -41,6 +45,10 @@ export const TIMELINE = (id: string) => {
 
 export const TIMELINE_CHANGES_IN_PROGRESS = '[data-test-subj="timeline"] .euiProgress';
 
+export const TIMELINE_CHECKBOX = (id: string) => {
+  return `[data-test-subj="checkboxSelectRow-${id}"]`;
+};
+
 export const TIMELINE_COLUMN_SPINNER = '[data-test-subj="timeline-loading-spinner"]';
 
 export const TIMELINE_DATA_PROVIDERS = '[data-test-subj="dataProviders"]';
@@ -70,6 +78,8 @@ export const TIMELINE_SETTINGS_ICON = '[data-test-subj="settings-gear"]';
 
 export const TIMELINE_TITLE = '[data-test-subj="timeline-title"]';
 
+export const TIMELINES_TABLE = '[data-test-subj="timelines-table"]';
+
 export const TIMESTAMP_HEADER_FIELD = '[data-test-subj="header-text-@timestamp"]';
 
 export const TIMESTAMP_TOGGLE_FIELD = '[data-test-subj="toggle-field-@timestamp"]';
diff --git a/x-pack/plugins/security_solution/cypress/support/commands.js b/x-pack/plugins/security_solution/cypress/support/commands.js
index 4f382f13bcd5d6..0e3c9562aedf05 100644
--- a/x-pack/plugins/security_solution/cypress/support/commands.js
+++ b/x-pack/plugins/security_solution/cypress/support/commands.js
@@ -39,21 +39,29 @@ Cypress.Commands.add('stubSecurityApi', function (dataFileName) {
   cy.route('POST', 'api/solutions/security/graphql', `@${dataFileName}JSON`);
 });
 
+Cypress.Commands.add('stubSearchStrategyApi', function (dataFileName) {
+  cy.on('window:before:load', (win) => {
+    win.fetch = null;
+  });
+  cy.server();
+  cy.fixture(dataFileName).as(`${dataFileName}JSON`);
+  cy.route('POST', 'internal/search/securitySolutionSearchStrategy', `@${dataFileName}JSON`);
+});
+
 Cypress.Commands.add(
   'attachFile',
   {
     prevSubject: 'element',
   },
   (input, fileName, fileType = 'text/plain') => {
-    cy.fixture(fileName)
-      .then((content) => Cypress.Blob.base64StringToBlob(content, fileType))
-      .then((blob) => {
-        const testFile = new File([blob], fileName, { type: fileType });
-        const dataTransfer = new DataTransfer();
+    cy.fixture(fileName).then((content) => {
+      const blob = Cypress.Blob.base64StringToBlob(content, fileType);
+      const testFile = new File([blob], fileName, { type: fileType });
+      const dataTransfer = new DataTransfer();
 
-        dataTransfer.items.add(testFile);
-        input[0].files = dataTransfer.files;
-        return input;
-      });
+      dataTransfer.items.add(testFile);
+      input[0].files = dataTransfer.files;
+      return input;
+    });
   }
 );
diff --git a/x-pack/plugins/security_solution/cypress/support/index.d.ts b/x-pack/plugins/security_solution/cypress/support/index.d.ts
index 906e526e2c4a04..f66aeff5d578d3 100644
--- a/x-pack/plugins/security_solution/cypress/support/index.d.ts
+++ b/x-pack/plugins/security_solution/cypress/support/index.d.ts
@@ -7,6 +7,7 @@
 declare namespace Cypress {
   interface Chainable<Subject> {
     stubSecurityApi(dataFileName: string): Chainable<Subject>;
+    stubSearchStrategyApi(dataFileName: string): Chainable<Subject>;
     attachFile(fileName: string, fileType?: string): Chainable<JQuery>;
   }
 }
diff --git a/x-pack/plugins/security_solution/cypress/support/index.js b/x-pack/plugins/security_solution/cypress/support/index.js
index 42abecd4b0bad6..244781e0ccd014 100644
--- a/x-pack/plugins/security_solution/cypress/support/index.js
+++ b/x-pack/plugins/security_solution/cypress/support/index.js
@@ -23,7 +23,7 @@
 import './commands';
 
 Cypress.Cookies.defaults({
-  whitelist: 'sid',
+  preserve: 'sid',
 });
 
 Cypress.on('uncaught:exception', (err) => {
diff --git a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
index 1cce72a48e0f0e..3fa300ce9d8d0f 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
@@ -48,6 +48,8 @@ import {
   THRESHOLD_FIELD_SELECTION,
   THRESHOLD_INPUT_AREA,
   THRESHOLD_TYPE,
+  DEFINE_EDIT_BUTTON,
+  ABOUT_EDIT_BUTTON,
 } from '../screens/create_new_rule';
 import { TIMELINE } from '../screens/timeline';
 
@@ -175,6 +177,20 @@ export const fillDefineCustomRuleWithImportedQueryAndContinue = (
   cy.get(CUSTOM_QUERY_INPUT).should('not.exist');
 };
 
+export const expectDefineFormToRepopulateAndContinue = (rule: CustomRule) => {
+  cy.get(DEFINE_EDIT_BUTTON).click();
+  cy.get(CUSTOM_QUERY_INPUT).invoke('text').should('eq', rule.customQuery);
+  cy.get(DEFINE_CONTINUE_BUTTON).should('exist').click({ force: true });
+  cy.get(DEFINE_CONTINUE_BUTTON).should('not.exist');
+};
+
+export const expectAboutFormToRepopulateAndContinue = (rule: CustomRule) => {
+  cy.get(ABOUT_EDIT_BUTTON).click();
+  cy.get(RULE_NAME_INPUT).invoke('val').should('eq', rule.name);
+  cy.get(ABOUT_CONTINUE_BTN).should('exist').click({ force: true });
+  cy.get(ABOUT_CONTINUE_BTN).should('not.exist');
+};
+
 export const fillDefineThresholdRuleAndContinue = (rule: ThresholdRule) => {
   const thresholdField = 0;
   const threshold = 1;
diff --git a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
index 08624df06e096d..6fb8bb5e29ae5e 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
@@ -5,8 +5,11 @@
  */
 
 import {
+  BULK_ACTIONS,
   CLOSE_TIMELINE_BTN,
   CREATE_NEW_TIMELINE,
+  EXPORT_TIMELINE_ACTION,
+  TIMELINE_CHECKBOX,
   HEADER,
   ID_FIELD,
   ID_HEADER_FIELD,
@@ -20,6 +23,7 @@ import {
   TIMELINE_INSPECT_BUTTON,
   TIMELINE_SETTINGS_ICON,
   TIMELINE_TITLE,
+  TIMELINES_TABLE,
   TIMESTAMP_TOGGLE_FIELD,
   TOGGLE_TIMELINE_EXPAND_EVENT,
   REMOVE_COLUMN,
@@ -66,6 +70,12 @@ export const expandFirstTimelineEventDetails = () => {
   cy.get(TOGGLE_TIMELINE_EXPAND_EVENT).first().click({ force: true });
 };
 
+export const exportTimeline = (timelineId: string) => {
+  cy.get(TIMELINE_CHECKBOX(timelineId)).click({ force: true });
+  cy.get(BULK_ACTIONS).click({ force: true });
+  cy.get(EXPORT_TIMELINE_ACTION).click();
+};
+
 export const openTimelineFieldsBrowser = () => {
   cy.get(TIMELINE_FIELDS_BUTTON).click({ force: true });
 };
@@ -122,6 +132,10 @@ export const resetFields = () => {
   cy.get(RESET_FIELDS).click({ force: true });
 };
 
+export const waitForTimelinesPanelToBeLoaded = () => {
+  cy.get(TIMELINES_TABLE).should('exist');
+};
+
 export const waitForTimelineChanges = () => {
   cy.get(TIMELINE_CHANGES_IN_PROGRESS).should('exist');
   cy.get(TIMELINE_CHANGES_IN_PROGRESS).should('not.exist');
diff --git a/x-pack/plugins/security_solution/cypress/test_files/expected_timelines_export.ndjson b/x-pack/plugins/security_solution/cypress/test_files/expected_timelines_export.ndjson
new file mode 100644
index 00000000000000..9cca356a8b0521
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/test_files/expected_timelines_export.ndjson
@@ -0,0 +1 @@
+{"savedObjectId":"0162c130-78be-11ea-9718-118a926974a4","version":"WzcsMV0=","columns":[{"columnHeaderType":"not-filtered","id":"@timestamp"},{"columnHeaderType":"not-filtered","id":"message"},{"columnHeaderType":"not-filtered","id":"event.category"},{"columnHeaderType":"not-filtered","id":"event.action"},{"columnHeaderType":"not-filtered","id":"host.name"},{"columnHeaderType":"not-filtered","id":"source.ip"},{"columnHeaderType":"not-filtered","id":"destination.ip"},{"columnHeaderType":"not-filtered","id":"user.name"}],"created":1586256805054,"createdBy":"elastic","dataProviders":[],"dateRange":{"end":1586256837669,"start":1546343624710},"description":"description","eventType":"all","filters":[],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"expression":"host.name:*","kind":"kuery"},"serializedQuery":"{\"bool\":{\"should\":[{\"exists\":{\"field\":\"host.name\"}}],\"minimum_should_match\":1}}"}},"savedQueryId":null,"sort":{"columnId":"@timestamp","sortDirection":"desc"},"title":"SIEM test","updated":1586256839298,"updatedBy":"elastic","timelineType":"default","eventNotes":[],"globalNotes":[],"pinnedEventIds":[]}
diff --git a/x-pack/plugins/security_solution/cypress/tsconfig.json b/x-pack/plugins/security_solution/cypress/tsconfig.json
index 929a3fb39babb0..d0669ccb782818 100644
--- a/x-pack/plugins/security_solution/cypress/tsconfig.json
+++ b/x-pack/plugins/security_solution/cypress/tsconfig.json
@@ -1,10 +1,11 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../../../tsconfig.base.json",
   "exclude": [],
   "include": [
     "./**/*"
   ],
   "compilerOptions": {
+    "tsBuildInfoFile": "../../../../build/tsbuildinfo/security_solution/cypress",
     "types": [
       "cypress",
       "node"
diff --git a/x-pack/plugins/security_solution/package.json b/x-pack/plugins/security_solution/package.json
index 687099541b3d28..70dbaa0d316813 100644
--- a/x-pack/plugins/security_solution/package.json
+++ b/x-pack/plugins/security_solution/package.json
@@ -8,9 +8,10 @@
     "extract-mitre-attacks": "node scripts/extract_tactics_techniques_mitre.js && node ../../../scripts/eslint ./public/pages/detection_engine/mitre/mitre_tactics_techniques.ts --fix",
     "build-graphql-types": "node scripts/generate_types_from_graphql.js",
     "cypress:open": "cypress open --config-file ./cypress/cypress.json",
+    "cypress:open-as-ci": "node ../../../scripts/functional_tests --config ../../test/security_solution_cypress/visual_config.ts",
     "cypress:run": "cypress run --browser chrome --headless --spec ./cypress/integration/**/*.spec.ts --config-file ./cypress/cypress.json --reporter ../../node_modules/cypress-multi-reporters --reporter-options configFile=./cypress/reporter_config.json; status=$?; ../../node_modules/.bin/mochawesome-merge --reportDir ../../../target/kibana-security-solution/cypress/results > ../../../target/kibana-security-solution/cypress/results/output.json; ../../../node_modules/.bin/marge ../../../target/kibana-security-solution/cypress/results/output.json --reportDir ../../../target/kibana-security-solution/cypress/results; mkdir -p ../../../target/junit && cp ../../../target/kibana-security-solution/cypress/results/*.xml ../../../target/junit/ && exit $status;",
-    "cypress:run-as-ci": "node ../../../scripts/functional_tests --config ../../test/security_solution_cypress/config.ts",
-    "test:generate": "ts-node --project scripts/endpoint/cli_tsconfig.json scripts/endpoint/resolver_generator.ts"
+    "cypress:run-as-ci": "node ../../../scripts/functional_tests --config ../../test/security_solution_cypress/cli_config.ts",
+    "test:generate": "node scripts/endpoint/resolver_generator"
   },
   "devDependencies": {
     "@types/md5": "^2.2.0",
diff --git a/x-pack/plugins/security_solution/public/app/app.tsx b/x-pack/plugins/security_solution/public/app/app.tsx
index b5e952b0ffa8ee..b4e9ba3dd7a716 100644
--- a/x-pack/plugins/security_solution/public/app/app.tsx
+++ b/x-pack/plugins/security_solution/public/app/app.tsx
@@ -15,6 +15,7 @@ import { EuiErrorBoundary } from '@elastic/eui';
 import euiDarkVars from '@elastic/eui/dist/eui_theme_dark.json';
 import euiLightVars from '@elastic/eui/dist/eui_theme_light.json';
 
+import { ManageUserInfo } from '../detections/components/user_info';
 import { DEFAULT_DARK_MODE, APP_NAME } from '../../common/constants';
 import { ErrorToastDispatcher } from '../common/components/error_toast_dispatcher';
 import { MlCapabilitiesProvider } from '../common/components/ml/permissions/ml_capabilities_provider';
@@ -28,6 +29,7 @@ import { ManageGlobalTimeline } from '../timelines/components/manage_timeline';
 import { StartServices } from '../types';
 import { PageRouter } from './routes';
 import { ManageSource } from '../common/containers/sourcerer';
+
 interface StartAppComponent extends AppFrontendLibs {
   children: React.ReactNode;
   history: History;
@@ -57,7 +59,9 @@ const StartAppComponent: FC<StartAppComponent> = ({ children, apolloClient, hist
                   <ManageSource>
                     <ThemeProvider theme={theme}>
                       <MlCapabilitiesProvider>
-                        <PageRouter history={history}>{children}</PageRouter>
+                        <ManageUserInfo>
+                          <PageRouter history={history}>{children}</PageRouter>
+                        </ManageUserInfo>
                       </MlCapabilitiesProvider>
                     </ThemeProvider>
                   </ManageSource>
diff --git a/x-pack/plugins/security_solution/public/app/home/index.tsx b/x-pack/plugins/security_solution/public/app/home/index.tsx
index 7c287646ba7ac5..b48ae4e6e2d75c 100644
--- a/x-pack/plugins/security_solution/public/app/home/index.tsx
+++ b/x-pack/plugins/security_solution/public/app/home/index.tsx
@@ -7,6 +7,7 @@
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
 
+import { TimelineId } from '../../../common/types/timeline';
 import { DragDropContextWrapper } from '../../common/components/drag_and_drop/drag_drop_context_wrapper';
 import { Flyout } from '../../timelines/components/flyout';
 import { HeaderGlobal } from '../../common/components/header_global';
@@ -17,6 +18,7 @@ import { useWithSource } from '../../common/containers/source';
 import { useShowTimeline } from '../../common/utils/timeline/use_show_timeline';
 import { navTabs } from './home_navigations';
 import { useSignalIndex } from '../../detections/containers/detection_engine/alerts/use_signal_index';
+import { useUserInfo } from '../../detections/components/user_info';
 
 const SecuritySolutionAppWrapper = styled.div`
   display: flex;
@@ -52,6 +54,9 @@ const HomePageComponent: React.FC<HomePageProps> = ({ children }) => {
   const [showTimeline] = useShowTimeline();
   const { browserFields, indexPattern, indicesExist } = useWithSource('default', indexToAdd);
 
+  // side effect: this will attempt to create the signals index if it doesn't exist
+  useUserInfo();
+
   return (
     <SecuritySolutionAppWrapper>
       <HeaderGlobal />
@@ -62,7 +67,7 @@ const HomePageComponent: React.FC<HomePageProps> = ({ children }) => {
           {indicesExist && showTimeline && (
             <>
               <AutoSaveWarningMsg />
-              <Flyout timelineId="timeline-1" usersViewing={usersViewing} />
+              <Flyout timelineId={TimelineId.active} usersViewing={usersViewing} />
             </>
           )}
 
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
index 841a1ef09ede6c..00879ace040b91 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
@@ -5,14 +5,12 @@
  */
 
 import React, { useEffect, useMemo } from 'react';
-import { useDispatch } from 'react-redux';
 
 import { Filter } from '../../../../../../../src/plugins/data/public';
 import { TimelineIdLiteral } from '../../../../common/types/timeline';
 import { StatefulEventsViewer } from '../events_viewer';
 import { alertsDefaultModel } from './default_headers';
 import { useManageTimeline } from '../../../timelines/components/manage_timeline';
-import { getInvestigateInResolverAction } from '../../../timelines/components/timeline/body/helpers';
 import * as i18n from './translations';
 import { useKibana } from '../../lib/kibana';
 
@@ -68,7 +66,6 @@ const AlertsTableComponent: React.FC<Props> = ({
   startDate,
   pageFilters = [],
 }) => {
-  const dispatch = useDispatch();
   const alertsFilter = useMemo(() => [...defaultAlertsFilters, ...pageFilters], [pageFilters]);
   const { filterManager } = useKibana().services.data.query;
   const { initializeTimeline } = useManageTimeline();
@@ -80,12 +77,12 @@ const AlertsTableComponent: React.FC<Props> = ({
       filterManager,
       defaultModel: alertsDefaultModel,
       footerText: i18n.TOTAL_COUNT_OF_ALERTS,
-      timelineRowActions: () => [getInvestigateInResolverAction({ dispatch, timelineId })],
       title: i18n.ALERTS_TABLE_TITLE,
       unit: i18n.UNIT,
     });
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
+
   return (
     <StatefulEventsViewer
       pageFilters={alertsFilter}
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/histogram_configs.ts b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/histogram_configs.ts
index 363c7ee7e058be..ce79d839f21622 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/histogram_configs.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/histogram_configs.ts
@@ -5,8 +5,8 @@
  */
 
 import * as i18n from './translations';
-import { MatrixHistogramOption, MatrixHisrogramConfigs } from '../matrix_histogram/types';
-import { HistogramType } from '../../../graphql/types';
+import { MatrixHistogramOption, MatrixHistogramConfigs } from '../matrix_histogram/types';
+import { MatrixHistogramType } from '../../../../common/search_strategy/security_solution/matrix_histogram';
 
 export const alertsStackByOptions: MatrixHistogramOption[] = [
   {
@@ -21,11 +21,11 @@ export const alertsStackByOptions: MatrixHistogramOption[] = [
 
 const DEFAULT_STACK_BY = 'event.module';
 
-export const histogramConfigs: MatrixHisrogramConfigs = {
+export const histogramConfigs: MatrixHistogramConfigs = {
   defaultStackByOption:
     alertsStackByOptions.find((o) => o.text === DEFAULT_STACK_BY) ?? alertsStackByOptions[1],
   errorMessage: i18n.ERROR_FETCHING_ALERTS_DATA,
-  histogramType: HistogramType.alerts,
+  histogramType: MatrixHistogramType.alerts,
   stackByOptions: alertsStackByOptions,
   subtitle: undefined,
   title: i18n.ALERTS_GRAPH_TITLE,
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/index.tsx b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/index.tsx
index 633135d63ac33a..d522e372d7734b 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/index.tsx
@@ -13,12 +13,13 @@ import { AlertsComponentsProps } from './types';
 import { AlertsTable } from './alerts_table';
 import * as i18n from './translations';
 import { useUiSetting$ } from '../../lib/kibana';
-import { MatrixHistogramContainer } from '../matrix_histogram';
+import { MatrixHistogram } from '../matrix_histogram';
 import { histogramConfigs } from './histogram_configs';
-import { MatrixHisrogramConfigs } from '../matrix_histogram/types';
-const ID = 'alertsOverTimeQuery';
+import { MatrixHistogramConfigs } from '../matrix_histogram/types';
 
-export const AlertsView = ({
+const ID = 'alertsHistogramQuery';
+
+const AlertsViewComponent: React.FC<AlertsComponentsProps> = ({
   timelineId,
   deleteQuery,
   endDate,
@@ -26,25 +27,26 @@ export const AlertsView = ({
   pageFilters,
   setQuery,
   startDate,
-  type,
-}: AlertsComponentsProps) => {
+}) => {
   const [defaultNumberFormat] = useUiSetting$<string>(DEFAULT_NUMBER_FORMAT);
+  const { globalFullScreen } = useFullScreen();
+
   const getSubtitle = useCallback(
     (totalCount: number) =>
       `${i18n.SHOWING}: ${numeral(totalCount).format(defaultNumberFormat)} ${i18n.UNIT(
         totalCount
       )}`,
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    []
+    [defaultNumberFormat]
   );
-  const { globalFullScreen } = useFullScreen();
-  const alertsHistogramConfigs: MatrixHisrogramConfigs = useMemo(
+
+  const alertsHistogramConfigs: MatrixHistogramConfigs = useMemo(
     () => ({
       ...histogramConfigs,
       subtitle: getSubtitle,
     }),
     [getSubtitle]
   );
+
   useEffect(() => {
     return () => {
       if (deleteQuery) {
@@ -56,14 +58,12 @@ export const AlertsView = ({
   return (
     <>
       {!globalFullScreen && (
-        <MatrixHistogramContainer
+        <MatrixHistogram
           endDate={endDate}
           filterQuery={filterQuery}
           id={ID}
           setQuery={setQuery}
-          sourceId="default"
           startDate={startDate}
-          type={type}
           {...alertsHistogramConfigs}
         />
       )}
@@ -76,4 +76,7 @@ export const AlertsView = ({
     </>
   );
 };
-AlertsView.displayName = 'AlertsView';
+
+AlertsViewComponent.displayName = 'AlertsViewComponent';
+
+export const AlertsView = React.memo(AlertsViewComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/types.ts b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/types.ts
index 78a6332c90fbca..b2637eeb2c65eb 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/types.ts
@@ -15,7 +15,7 @@ type CommonQueryProps = HostsComponentsQueryProps | NetworkComponentQueryProps;
 export interface AlertsComponentsProps
   extends Pick<
     CommonQueryProps,
-    'deleteQuery' | 'endDate' | 'filterQuery' | 'skip' | 'setQuery' | 'startDate' | 'type'
+    'deleteQuery' | 'endDate' | 'filterQuery' | 'skip' | 'setQuery' | 'startDate'
   > {
   timelineId: TimelineIdLiteral;
   pageFilters: Filter[];
diff --git a/x-pack/plugins/security_solution/public/common/components/charts/areachart.tsx b/x-pack/plugins/security_solution/public/common/components/charts/areachart.tsx
index b503d635538353..45c20b89032811 100644
--- a/x-pack/plugins/security_solution/public/common/components/charts/areachart.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/charts/areachart.tsx
@@ -110,10 +110,23 @@ export const AreaChartBaseComponent = ({
           position={Position.Bottom}
           showOverlappingTicks={false}
           tickFormat={xTickFormatter}
-          tickSize={0}
+          style={{
+            tickLine: {
+              visible: false,
+            },
+          }}
         />
 
-        <Axis id={yAxisId} position={Position.Left} tickSize={0} tickFormat={yTickFormatter} />
+        <Axis
+          id={yAxisId}
+          position={Position.Left}
+          style={{
+            tickLine: {
+              visible: false,
+            },
+          }}
+          tickFormat={yTickFormatter}
+        />
       </Chart>
     </div>
   ) : null;
diff --git a/x-pack/plugins/security_solution/public/common/components/charts/barchart.tsx b/x-pack/plugins/security_solution/public/common/components/charts/barchart.tsx
index cafb0095431f1d..80fc1b45970812 100644
--- a/x-pack/plugins/security_solution/public/common/components/charts/barchart.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/charts/barchart.tsx
@@ -98,11 +98,24 @@ export const BarChartBaseComponent = ({
         id={xAxisId}
         position={Position.Bottom}
         showOverlappingTicks={false}
-        tickSize={tickSize}
+        style={{
+          tickLine: {
+            size: tickSize,
+          },
+        }}
         tickFormat={xTickFormatter}
       />
 
-      <Axis id={yAxisId} position={Position.Left} tickSize={tickSize} tickFormat={yTickFormatter} />
+      <Axis
+        id={yAxisId}
+        position={Position.Left}
+        style={{
+          tickLine: {
+            size: tickSize,
+          },
+        }}
+        tickFormat={yTickFormatter}
+      />
     </Chart>
   ) : null;
 };
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
index 1cc50b7d951a2a..8068d51a80153c 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
@@ -9,7 +9,7 @@ import React, { useMemo } from 'react';
 import styled from 'styled-components';
 
 import { BrowserFields } from '../../containers/source';
-import { DetailItem } from '../../../graphql/types';
+import { DetailItem } from '../../../../common/search_strategy/timeline';
 import { ColumnHeaderOptions } from '../../../timelines/store/timeline/model';
 import { OnUpdateColumns } from '../../../timelines/components/timeline/events';
 import { EventFieldsBrowser } from './event_fields_browser';
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_fields_browser.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_fields_browser.tsx
index 00a4e581320bbf..9737a09c89f499 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_fields_browser.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_fields_browser.tsx
@@ -10,7 +10,7 @@ import React, { useMemo } from 'react';
 
 import { ColumnHeaderOptions } from '../../../timelines/store/timeline/model';
 import { BrowserFields, getAllFieldsByName } from '../../containers/source';
-import { DetailItem } from '../../../graphql/types';
+import { DetailItem } from '../../../../common/search_strategy/timeline';
 import { OnUpdateColumns } from '../../../timelines/components/timeline/events';
 
 import { getColumns } from './columns';
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/stateful_event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/stateful_event_details.tsx
index 0bb0532eee7bee..f4028c988acb8d 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/stateful_event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/stateful_event_details.tsx
@@ -7,7 +7,7 @@
 import React, { useCallback, useState } from 'react';
 
 import { BrowserFields } from '../../containers/source';
-import { DetailItem } from '../../../graphql/types';
+import { DetailItem } from '../../../../common/search_strategy/timeline';
 import { ColumnHeaderOptions } from '../../../timelines/store/timeline/model';
 import { OnUpdateColumns } from '../../../timelines/components/timeline/events';
 
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
index 6f77d15913d073..833688ae579932 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
@@ -50,10 +50,6 @@ const utilityBar = (refetch: inputsModel.Refetch, totalCount: number) => (
   <div data-test-subj="mock-utility-bar" />
 );
 
-const exceptionsModal = (refetch: inputsModel.Refetch) => (
-  <div data-test-subj="mock-exceptions-modal" />
-);
-
 const eventsViewerDefaultProps = {
   browserFields: {},
   columns: [],
@@ -464,42 +460,4 @@ describe('EventsViewer', () => {
       });
     });
   });
-
-  describe('exceptions modal', () => {
-    test('it renders exception modal if "exceptionsModal" callback exists', async () => {
-      const wrapper = mount(
-        <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer
-              {...eventsViewerDefaultProps}
-              exceptionsModal={exceptionsModal}
-              graphEventId=""
-            />
-          </MockedProvider>
-        </TestProviders>
-      );
-
-      await waitFor(() => {
-        wrapper.update();
-
-        expect(wrapper.find(`[data-test-subj="mock-exceptions-modal"]`).exists()).toBeTruthy();
-      });
-    });
-
-    test('it does not render exception modal if "exceptionModal" callback does not exist', async () => {
-      const wrapper = mount(
-        <TestProviders>
-          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
-            <EventsViewer {...eventsViewerDefaultProps} graphEventId="" />
-          </MockedProvider>
-        </TestProviders>
-      );
-
-      await waitFor(() => {
-        wrapper.update();
-
-        expect(wrapper.find(`[data-test-subj="mock-exceptions-modal"]`).exists()).toBeFalsy();
-      });
-    });
-  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
index ebda64efabf65b..3d193856a8ae43 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
@@ -109,7 +109,6 @@ interface Props {
   utilityBar?: (refetch: inputsModel.Refetch, totalCount: number) => React.ReactNode;
   // If truthy, the graph viewer (Resolver) is showing
   graphEventId: string | undefined;
-  exceptionsModal?: (refetch: inputsModel.Refetch) => React.ReactNode;
 }
 
 const EventsViewerComponent: React.FC<Props> = ({
@@ -135,7 +134,6 @@ const EventsViewerComponent: React.FC<Props> = ({
   toggleColumn,
   utilityBar,
   graphEventId,
-  exceptionsModal,
 }) => {
   const { globalFullScreen } = useFullScreen();
   const columnsHeader = isEmpty(columns) ? defaultHeaders : columns;
@@ -261,7 +259,6 @@ const EventsViewerComponent: React.FC<Props> = ({
                       </HeaderFilterGroupWrapper>
                     )}
                   </HeaderSection>
-                  {exceptionsModal && exceptionsModal(refetch)}
                   {utilityBar && !resolverIsShowing(graphEventId) && (
                     <UtilityBar>{utilityBar?.(refetch, totalCountMinusDeleted)}</UtilityBar>
                   )}
@@ -280,6 +277,7 @@ const EventsViewerComponent: React.FC<Props> = ({
                       docValueFields={docValueFields}
                       id={id}
                       isEventViewer={true}
+                      refetch={refetch}
                       sort={sort}
                       toggleColumn={toggleColumn}
                     />
@@ -338,6 +336,5 @@ export const EventsViewer = React.memo(
     prevProps.start === nextProps.start &&
     prevProps.sort === nextProps.sort &&
     prevProps.utilityBar === nextProps.utilityBar &&
-    prevProps.graphEventId === nextProps.graphEventId &&
-    prevProps.exceptionsModal === nextProps.exceptionsModal
+    prevProps.graphEventId === nextProps.graphEventId
 );
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
index ec56a3a1bd8d3f..e4520dab4626a8 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
@@ -43,7 +43,6 @@ export interface OwnProps {
   headerFilterGroup?: React.ReactNode;
   pageFilters?: Filter[];
   utilityBar?: (refetch: inputsModel.Refetch, totalCount: number) => React.ReactNode;
-  exceptionsModal?: (refetch: inputsModel.Refetch) => React.ReactNode;
 }
 
 type Props = OwnProps & PropsFromRedux;
@@ -75,7 +74,6 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
   utilityBar,
   // If truthy, the graph viewer (Resolver) is showing
   graphEventId,
-  exceptionsModal,
 }) => {
   const [
     { docValueFields, browserFields, indexPatterns, isLoading: isLoadingIndexPattern },
@@ -158,7 +156,6 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
           toggleColumn={toggleColumn}
           utilityBar={utilityBar}
           graphEventId={graphEventId}
-          exceptionsModal={exceptionsModal}
         />
       </InspectButtonContainer>
     </FullScreenContainer>
@@ -223,7 +220,6 @@ type PropsFromRedux = ConnectedProps<typeof connector>;
 export const StatefulEventsViewer = connector(
   React.memo(
     StatefulEventsViewerComponent,
-    // eslint-disable-next-line complexity
     (prevProps, nextProps) =>
       prevProps.id === nextProps.id &&
       deepEqual(prevProps.columns, nextProps.columns) &&
@@ -244,7 +240,6 @@ export const StatefulEventsViewer = connector(
       prevProps.showCheckboxes === nextProps.showCheckboxes &&
       prevProps.start === nextProps.start &&
       prevProps.utilityBar === nextProps.utilityBar &&
-      prevProps.graphEventId === nextProps.graphEventId &&
-      prevProps.exceptionsModal === nextProps.exceptionsModal
+      prevProps.graphEventId === nextProps.graphEventId
   )
 );
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
index 21f82c6ab4c986..c1befabdd78095 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
@@ -26,6 +26,7 @@ import {
   CreateExceptionListItemSchema,
   ExceptionListType,
 } from '../../../../../public/lists_plugin_deps';
+import * as i18nCommon from '../../../translations';
 import * as i18n from './translations';
 import * as sharedI18n from '../translations';
 import { TimelineNonEcsData, Ecs } from '../../../../graphql/types';
@@ -49,6 +50,7 @@ import {
 } from '../helpers';
 import { ErrorInfo, ErrorCallout } from '../error_callout';
 import { useFetchIndexPatterns } from '../../../../detections/containers/detection_engine/rules';
+import { ExceptionsBuilderExceptionItem } from '../types';
 
 export interface AddExceptionModalBaseProps {
   ruleName: string;
@@ -63,7 +65,7 @@ export interface AddExceptionModalBaseProps {
 
 export interface AddExceptionModalProps extends AddExceptionModalBaseProps {
   onCancel: () => void;
-  onConfirm: (didCloseAlert: boolean) => void;
+  onConfirm: (didCloseAlert: boolean, didBulkCloseAlert: boolean) => void;
   onRuleChange?: () => void;
   alertStatus?: Status;
 }
@@ -117,7 +119,7 @@ export const AddExceptionModal = memo(function AddExceptionModal({
     Array<ExceptionListItemSchema | CreateExceptionListItemSchema>
   >([]);
   const [fetchOrCreateListError, setFetchOrCreateListError] = useState<ErrorInfo | null>(null);
-  const { addError, addSuccess } = useAppToasts();
+  const { addError, addSuccess, addWarning } = useAppToasts();
   const { loading: isSignalIndexLoading, signalIndexName } = useSignalIndex();
   const [
     { isLoading: isSignalIndexPatternLoading, indexPatterns: signalIndexPatterns },
@@ -129,16 +131,26 @@ export const AddExceptionModal = memo(function AddExceptionModal({
   );
 
   const onError = useCallback(
-    (error: Error) => {
+    (error: Error): void => {
       addError(error, { title: i18n.ADD_EXCEPTION_ERROR });
       onCancel();
     },
     [addError, onCancel]
   );
-  const onSuccess = useCallback(() => {
-    addSuccess(i18n.ADD_EXCEPTION_SUCCESS);
-    onConfirm(shouldCloseAlert);
-  }, [addSuccess, onConfirm, shouldCloseAlert]);
+
+  const onSuccess = useCallback(
+    (updated: number, conflicts: number): void => {
+      addSuccess(i18n.ADD_EXCEPTION_SUCCESS);
+      onConfirm(shouldCloseAlert, shouldBulkCloseAlert);
+      if (conflicts > 0) {
+        addWarning({
+          title: i18nCommon.UPDATE_ALERT_STATUS_FAILED(conflicts),
+          text: i18nCommon.UPDATE_ALERT_STATUS_FAILED_DETAILED(updated, conflicts),
+        });
+      }
+    },
+    [addSuccess, addWarning, onConfirm, shouldBulkCloseAlert, shouldCloseAlert]
+  );
 
   const [{ isLoading: addExceptionIsLoading }, addOrUpdateExceptionItems] = useAddOrUpdateException(
     {
@@ -153,7 +165,7 @@ export const AddExceptionModal = memo(function AddExceptionModal({
       exceptionItems,
     }: {
       exceptionItems: Array<ExceptionListItemSchema | CreateExceptionListItemSchema>;
-    }) => {
+    }): void => {
       setExceptionItemsToAdd(exceptionItems);
     },
     [setExceptionItemsToAdd]
@@ -186,7 +198,7 @@ export const AddExceptionModal = memo(function AddExceptionModal({
   );
 
   const handleFetchOrCreateExceptionListError = useCallback(
-    (error: Error, statusCode: number | null, message: string | null) => {
+    (error: Error, statusCode: number | null, message: string | null): void => {
       setFetchOrCreateListError({
         reason: error.message,
         code: statusCode,
@@ -205,7 +217,7 @@ export const AddExceptionModal = memo(function AddExceptionModal({
     onSuccess: handleRuleChange,
   });
 
-  const initialExceptionItems = useMemo(() => {
+  const initialExceptionItems = useMemo((): ExceptionsBuilderExceptionItem[] => {
     if (exceptionListType === 'endpoint' && alertData !== undefined && ruleExceptionList) {
       return defaultEndpointExceptionItems(
         exceptionListType,
@@ -218,7 +230,7 @@ export const AddExceptionModal = memo(function AddExceptionModal({
     }
   }, [alertData, exceptionListType, ruleExceptionList, ruleName]);
 
-  useEffect(() => {
+  useEffect((): void => {
     if (isSignalIndexPatternLoading === false && isSignalIndexLoading === false) {
       setShouldDisableBulkClose(
         entryHasListType(exceptionItemsToAdd) ||
@@ -234,34 +246,34 @@ export const AddExceptionModal = memo(function AddExceptionModal({
     signalIndexPatterns,
   ]);
 
-  useEffect(() => {
+  useEffect((): void => {
     if (shouldDisableBulkClose === true) {
       setShouldBulkCloseAlert(false);
     }
   }, [shouldDisableBulkClose]);
 
   const onCommentChange = useCallback(
-    (value: string) => {
+    (value: string): void => {
       setComment(value);
     },
     [setComment]
   );
 
   const onCloseAlertCheckboxChange = useCallback(
-    (event: React.ChangeEvent<HTMLInputElement>) => {
+    (event: React.ChangeEvent<HTMLInputElement>): void => {
       setShouldCloseAlert(event.currentTarget.checked);
     },
     [setShouldCloseAlert]
   );
 
   const onBulkCloseAlertCheckboxChange = useCallback(
-    (event: React.ChangeEvent<HTMLInputElement>) => {
+    (event: React.ChangeEvent<HTMLInputElement>): void => {
       setShouldBulkCloseAlert(event.currentTarget.checked);
     },
     [setShouldBulkCloseAlert]
   );
 
-  const retrieveAlertOsTypes = useCallback(() => {
+  const retrieveAlertOsTypes = useCallback((): string[] => {
     const osDefaults = ['windows', 'macos'];
     if (alertData) {
       const osTypes = getMappedNonEcsValue({
@@ -276,7 +288,9 @@ export const AddExceptionModal = memo(function AddExceptionModal({
     return osDefaults;
   }, [alertData]);
 
-  const enrichExceptionItems = useCallback(() => {
+  const enrichExceptionItems = useCallback((): Array<
+    ExceptionListItemSchema | CreateExceptionListItemSchema
+  > => {
     let enriched: Array<ExceptionListItemSchema | CreateExceptionListItemSchema> = [];
     enriched =
       comment !== ''
@@ -289,7 +303,7 @@ export const AddExceptionModal = memo(function AddExceptionModal({
     return enriched;
   }, [comment, exceptionItemsToAdd, exceptionListType, retrieveAlertOsTypes]);
 
-  const onAddExceptionConfirm = useCallback(() => {
+  const onAddExceptionConfirm = useCallback((): void => {
     if (addOrUpdateExceptionItems !== null) {
       const alertIdToClose = shouldCloseAlert && alertData ? alertData.ecsData._id : undefined;
       const bulkCloseIndex =
@@ -306,7 +320,7 @@ export const AddExceptionModal = memo(function AddExceptionModal({
   ]);
 
   const isSubmitButtonDisabled = useMemo(
-    () =>
+    (): boolean =>
       fetchOrCreateListError != null ||
       exceptionItemsToAdd.every((item) => item.entries.length === 0),
     [fetchOrCreateListError, exceptionItemsToAdd]
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
index 46923e07d225ad..2398f8d799c2ce 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
@@ -49,7 +49,7 @@ describe('useAddOrUpdateException', () => {
   const onError = jest.fn();
   const onSuccess = jest.fn();
   const alertIdToClose = 'idToClose';
-  const bulkCloseIndex = ['.signals'];
+  const bulkCloseIndex = ['.custom'];
   const itemsToAdd: CreateExceptionListItemSchema[] = [
     {
       ...getCreateExceptionListItemSchemaMock(),
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
index be289b0e85e66b..dbd634e97a3281 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
@@ -5,6 +5,7 @@
  */
 
 import { useEffect, useRef, useState, useCallback } from 'react';
+import { UpdateDocumentByQueryResponse } from 'elasticsearch';
 import { HttpStart } from '../../../../../../../src/core/public';
 
 import {
@@ -43,7 +44,7 @@ export type ReturnUseAddOrUpdateException = [
 export interface UseAddOrUpdateExceptionProps {
   http: HttpStart;
   onError: (arg: Error, code: number | null, message: string | null) => void;
-  onSuccess: () => void;
+  onSuccess: (updated: number, conficts: number) => void;
 }
 
 /**
@@ -122,8 +123,10 @@ export const useAddOrUpdateException = ({
     ) => {
       try {
         setIsLoading(true);
-        if (alertIdToClose !== null && alertIdToClose !== undefined) {
-          await updateAlertStatus({
+        let alertIdResponse: UpdateDocumentByQueryResponse | undefined;
+        let bulkResponse: UpdateDocumentByQueryResponse | undefined;
+        if (alertIdToClose != null) {
+          alertIdResponse = await updateAlertStatus({
             query: getUpdateAlertsQuery([alertIdToClose]),
             status: 'closed',
             signal: abortCtrl.signal,
@@ -139,7 +142,8 @@ export const useAddOrUpdateException = ({
             prepareExceptionItemsForBulkClose(exceptionItemsToAddOrUpdate),
             false
           );
-          await updateAlertStatus({
+
+          bulkResponse = await updateAlertStatus({
             query: {
               query: filter,
             },
@@ -150,9 +154,18 @@ export const useAddOrUpdateException = ({
 
         await addOrUpdateItems(exceptionItemsToAddOrUpdate);
 
+        // NOTE: there could be some overlap here... it's possible that the first response had conflicts
+        // but that the alert was closed in the second call. In this case, a conflict will be reported even
+        // though it was already resolved. I'm not sure that there's an easy way to solve this, but it should
+        // have minimal impact on the user... they'd see a warning that indicates a possible conflict, but the
+        // state of the alerts and their representation in the UI would be consistent.
+        const updated = (alertIdResponse?.updated ?? 0) + (bulkResponse?.updated ?? 0);
+        const conflicts =
+          alertIdResponse?.version_conflicts ?? 0 + (bulkResponse?.version_conflicts ?? 0);
+
         if (isSubscribed) {
           setIsLoading(false);
-          onSuccess();
+          onSuccess(updated, conflicts);
         }
       } catch (error) {
         if (isSubscribed) {
diff --git a/x-pack/plugins/security_solution/public/common/components/link_icon/index.tsx b/x-pack/plugins/security_solution/public/common/components/link_icon/index.tsx
index 75d396fe384f81..19f1d70e6e230d 100644
--- a/x-pack/plugins/security_solution/public/common/components/link_icon/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/link_icon/index.tsx
@@ -6,7 +6,7 @@
 
 import { EuiIcon, EuiLink, IconSize, IconType } from '@elastic/eui';
 import { LinkAnchorProps } from '@elastic/eui/src/components/link/link';
-import React from 'react';
+import React, { ReactNode } from 'react';
 import styled, { css } from 'styled-components';
 
 interface LinkProps {
@@ -47,7 +47,7 @@ export const Link = styled(({ iconSide, children, ...rest }) => (
 Link.displayName = 'Link';
 
 export interface LinkIconProps extends LinkProps {
-  children: string;
+  children: string | ReactNode;
   iconSize?: IconSize;
   iconType: IconType;
   dataTestSubj?: string;
diff --git a/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_network.tsx b/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_network.tsx
index 8e2b47bd91dbc4..100c5e46141a20 100644
--- a/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_network.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_network.tsx
@@ -4,7 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { FlowTarget, FlowTargetSourceDest } from '../../../graphql/types';
+import {
+  FlowTarget,
+  FlowTargetSourceDest,
+} from '../../../../common/search_strategy/security_solution/network';
 
 import { appendSearch } from './helpers';
 
diff --git a/x-pack/plugins/security_solution/public/common/components/links/index.tsx b/x-pack/plugins/security_solution/public/common/components/links/index.tsx
index 2f7aa1b14cfda9..943f2d8336ca7f 100644
--- a/x-pack/plugins/security_solution/public/common/components/links/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/links/index.tsx
@@ -32,7 +32,10 @@ import {
   getCreateCaseUrl,
   useFormatUrl,
 } from '../link_to';
-import { FlowTarget, FlowTargetSourceDest } from '../../../graphql/types';
+import {
+  FlowTarget,
+  FlowTargetSourceDest,
+} from '../../../../common/search_strategy/security_solution/network';
 import { useUiSetting$, useKibana } from '../../lib/kibana';
 import { isUrlInvalid } from '../../utils/validators';
 import { ExternalLinkIcon } from '../external_link_icon';
diff --git a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.test.tsx
index a80ea48b93f3d6..7286c6b7436929 100644
--- a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.test.tsx
@@ -10,42 +10,32 @@ import { mount, ReactWrapper } from 'enzyme';
 import React from 'react';
 
 import { MatrixHistogram } from '.';
-import { useQuery } from '../../containers/matrix_histogram';
-import { HistogramType } from '../../../graphql/types';
+import { useMatrixHistogram } from '../../containers/matrix_histogram';
+import { MatrixHistogramType } from '../../../../common/search_strategy/security_solution';
+import { TestProviders } from '../../mock';
+
 jest.mock('../../lib/kibana');
 
-jest.mock('./matrix_loader', () => {
-  return {
-    MatrixLoader: () => {
-      return <div className="matrixLoader" />;
-    },
-  };
-});
+jest.mock('./matrix_loader', () => ({
+  MatrixLoader: () => <div className="matrixLoader" />,
+}));
 
-jest.mock('../header_section', () => {
-  return {
-    HeaderSection: () => <div className="headerSection" />,
-  };
-});
+jest.mock('../header_section', () => ({
+  HeaderSection: () => <div className="headerSection" />,
+}));
 
-jest.mock('../charts/barchart', () => {
-  return {
-    BarChart: () => <div className="barchart" />,
-  };
-});
+jest.mock('../charts/barchart', () => ({
+  BarChart: () => <div className="barchart" />,
+}));
 
-jest.mock('../../containers/matrix_histogram', () => {
-  return {
-    useQuery: jest.fn(),
-  };
-});
+jest.mock('../../containers/matrix_histogram', () => ({
+  useMatrixHistogram: jest.fn(),
+}));
 
-jest.mock('../../components/matrix_histogram/utils', () => {
-  return {
-    getBarchartConfigs: jest.fn(),
-    getCustomChartData: jest.fn().mockReturnValue(true),
-  };
-});
+jest.mock('../../components/matrix_histogram/utils', () => ({
+  getBarchartConfigs: jest.fn(),
+  getCustomChartData: jest.fn().mockReturnValue(true),
+}));
 
 describe('Matrix Histogram Component', () => {
   let wrapper: ReactWrapper;
@@ -55,7 +45,7 @@ describe('Matrix Histogram Component', () => {
     defaultStackByOption: { text: 'text', value: 'value' },
     endDate: '2019-07-18T20:00:00.000Z',
     errorMessage: 'error',
-    histogramType: HistogramType.alerts,
+    histogramType: MatrixHistogramType.alerts,
     id: 'mockId',
     isInspected: false,
     isPtrIncluded: false,
@@ -68,17 +58,20 @@ describe('Matrix Histogram Component', () => {
     subtitle: 'mockSubtitle',
     totalCount: -1,
     title: 'mockTitle',
-    dispatchSetAbsoluteRangeDatePicker: jest.fn(),
   };
 
   beforeAll(() => {
-    (useQuery as jest.Mock).mockReturnValue({
-      data: null,
-      loading: false,
-      inspect: false,
-      totalCount: null,
+    (useMatrixHistogram as jest.Mock).mockReturnValue([
+      false,
+      {
+        data: null,
+        inspect: false,
+        totalCount: null,
+      },
+    ]);
+    wrapper = mount(<MatrixHistogram {...mockMatrixOverTimeHistogramProps} />, {
+      wrappingComponent: TestProviders,
     });
-    wrapper = mount(<MatrixHistogram {...mockMatrixOverTimeHistogramProps} />);
   });
   describe('on initial load', () => {
     test('it renders MatrixLoader', () => {
@@ -92,26 +85,33 @@ describe('Matrix Histogram Component', () => {
     });
 
     test('it does NOT render a spacer when showSpacer is false', () => {
-      wrapper = mount(<MatrixHistogram {...mockMatrixOverTimeHistogramProps} showSpacer={false} />);
+      wrapper = mount(
+        <MatrixHistogram {...mockMatrixOverTimeHistogramProps} showSpacer={false} />,
+        {
+          wrappingComponent: TestProviders,
+        }
+      );
       expect(wrapper.find('[data-test-subj="spacer"]').exists()).toBe(false);
     });
   });
 
   describe('not initial load', () => {
     beforeAll(() => {
-      (useQuery as jest.Mock).mockReturnValue({
-        data: [
-          { x: 1, y: 2, g: 'g1' },
-          { x: 2, y: 4, g: 'g1' },
-          { x: 3, y: 6, g: 'g1' },
-          { x: 1, y: 1, g: 'g2' },
-          { x: 2, y: 3, g: 'g2' },
-          { x: 3, y: 5, g: 'g2' },
-        ],
-        loading: false,
-        inspect: false,
-        totalCount: 1,
-      });
+      (useMatrixHistogram as jest.Mock).mockReturnValue([
+        false,
+        {
+          data: [
+            { x: 1, y: 2, g: 'g1' },
+            { x: 2, y: 4, g: 'g1' },
+            { x: 3, y: 6, g: 'g1' },
+            { x: 1, y: 1, g: 'g2' },
+            { x: 2, y: 3, g: 'g2' },
+            { x: 3, y: 5, g: 'g2' },
+          ],
+          inspect: false,
+          totalCount: 1,
+        },
+      ]);
       wrapper.setProps({ endDate: 100 });
       wrapper.update();
     });
diff --git a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx
index e93ade7191f52d..485ca4c93133ac 100644
--- a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx
@@ -9,54 +9,46 @@ import { Position } from '@elastic/charts';
 import styled from 'styled-components';
 
 import { EuiFlexGroup, EuiFlexItem, EuiProgress, EuiSelect, EuiSpacer } from '@elastic/eui';
-import { noop } from 'lodash/fp';
-import { compose } from 'redux';
-import { connect } from 'react-redux';
+import { useDispatch } from 'react-redux';
 import * as i18n from './translations';
 import { BarChart } from '../charts/barchart';
 import { HeaderSection } from '../header_section';
 import { MatrixLoader } from './matrix_loader';
 import { Panel } from '../panel';
 import { getBarchartConfigs, getCustomChartData } from './utils';
-import { useQuery } from '../../containers/matrix_histogram';
+import { useMatrixHistogram } from '../../containers/matrix_histogram';
 import { MatrixHistogramProps, MatrixHistogramOption, MatrixHistogramQueryProps } from './types';
 import { InspectButtonContainer } from '../inspect';
-
-import { State, inputsSelectors } from '../../store';
-import { hostsModel } from '../../../hosts/store';
-import { networkModel } from '../../../network/store';
-
+import { MatrixHistogramType } from '../../../../common/search_strategy/security_solution';
 import {
   MatrixHistogramMappingTypes,
   GetTitle,
   GetSubTitle,
 } from '../../components/matrix_histogram/types';
 import { GlobalTimeArgs } from '../../containers/use_global_time';
-import { QueryTemplateProps } from '../../containers/query_template';
 import { setAbsoluteRangeDatePicker } from '../../store/inputs/actions';
 import { InputsModelId } from '../../store/inputs/constants';
-import { HistogramType } from '../../../graphql/types';
 
-export interface OwnProps extends QueryTemplateProps {
-  defaultStackByOption: MatrixHistogramOption;
-  errorMessage: string;
-  headerChildren?: React.ReactNode;
-  hideHistogramIfEmpty?: boolean;
-  histogramType: HistogramType;
-  id: string;
-  indexToAdd?: string[] | null;
-  legendPosition?: Position;
-  mapping?: MatrixHistogramMappingTypes;
-  showSpacer?: boolean;
-  setQuery: GlobalTimeArgs['setQuery'];
-  setAbsoluteRangeDatePickerTarget?: InputsModelId;
-  showLegend?: boolean;
-  stackByOptions: MatrixHistogramOption[];
-  subtitle?: string | GetSubTitle;
-  timelineId?: string;
-  title: string | GetTitle;
-  type: hostsModel.HostsType | networkModel.NetworkType;
-}
+export type MatrixHistogramComponentProps = MatrixHistogramProps &
+  Omit<MatrixHistogramQueryProps, 'stackByField'> & {
+    defaultStackByOption: MatrixHistogramOption;
+    errorMessage: string;
+    headerChildren?: React.ReactNode;
+    hideHistogramIfEmpty?: boolean;
+    histogramType: MatrixHistogramType;
+    id: string;
+    indexToAdd?: string[] | null;
+    legendPosition?: Position;
+    mapping?: MatrixHistogramMappingTypes;
+    showSpacer?: boolean;
+    setQuery: GlobalTimeArgs['setQuery'];
+    setAbsoluteRangeDatePickerTarget?: InputsModelId;
+    showLegend?: boolean;
+    stackByOptions: MatrixHistogramOption[];
+    subtitle?: string | GetSubTitle;
+    timelineId?: string;
+    title: string | GetTitle;
+  };
 
 const DEFAULT_PANEL_HEIGHT = 300;
 
@@ -70,9 +62,7 @@ const HistogramPanel = styled(Panel)<{ height?: number }>`
   ${({ height }) => (height != null ? `height: ${height}px;` : '')}
 `;
 
-export const MatrixHistogramComponent: React.FC<
-  MatrixHistogramProps & MatrixHistogramQueryProps
-> = ({
+export const MatrixHistogramComponent: React.FC<MatrixHistogramComponentProps> = ({
   chartHeight,
   defaultStackByOption,
   endDate,
@@ -83,7 +73,6 @@ export const MatrixHistogramComponent: React.FC<
   hideHistogramIfEmpty = false,
   id,
   indexToAdd,
-  isInspected,
   legendPosition,
   mapping,
   panelHeight = DEFAULT_PANEL_HEIGHT,
@@ -97,9 +86,25 @@ export const MatrixHistogramComponent: React.FC<
   timelineId,
   title,
   titleSize,
-  dispatchSetAbsoluteRangeDatePicker,
   yTickFormatter,
 }) => {
+  const dispatch = useDispatch();
+  const handleBrushEnd = useCallback(
+    ({ x }) => {
+      if (!x) {
+        return;
+      }
+      const [min, max] = x;
+      dispatch(
+        setAbsoluteRangeDatePicker({
+          id: setAbsoluteRangeDatePickerTarget,
+          from: new Date(min).toISOString(),
+          to: new Date(max).toISOString(),
+        })
+      );
+    },
+    [dispatch, setAbsoluteRangeDatePickerTarget]
+  );
   const barchartConfigs = useMemo(
     () =>
       getBarchartConfigs({
@@ -107,30 +112,11 @@ export const MatrixHistogramComponent: React.FC<
         from: startDate,
         legendPosition,
         to: endDate,
-        onBrushEnd: ({ x }) => {
-          if (!x) {
-            return;
-          }
-          const [min, max] = x;
-          dispatchSetAbsoluteRangeDatePicker({
-            id: setAbsoluteRangeDatePickerTarget,
-            from: new Date(min).toISOString(),
-            to: new Date(max).toISOString(),
-          });
-        },
+        onBrushEnd: handleBrushEnd,
         yTickFormatter,
         showLegend,
       }),
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [
-      chartHeight,
-      startDate,
-      legendPosition,
-      endDate,
-      dispatchSetAbsoluteRangeDatePicker,
-      yTickFormatter,
-      showLegend,
-    ]
+    [chartHeight, startDate, legendPosition, endDate, handleBrushEnd, yTickFormatter, showLegend]
   );
   const [isInitialLoading, setIsInitialLoading] = useState(true);
   const [selectedStackByOption, setSelectedStackByOption] = useState<MatrixHistogramOption>(
@@ -142,18 +128,16 @@ export const MatrixHistogramComponent: React.FC<
         stackByOptions.find((co) => co.value === event.target.value) ?? defaultStackByOption
       );
     },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    []
+    [defaultStackByOption, stackByOptions]
   );
 
-  const { data, loading, inspect, totalCount, refetch = noop } = useQuery({
+  const [loading, { data, inspect, totalCount, refetch }] = useMatrixHistogram({
     endDate,
     errorMessage,
     filterQuery,
     histogramType,
     indexToAdd,
     startDate,
-    isInspected,
     stackByField: selectedStackByOption.value,
   });
 
@@ -254,20 +238,3 @@ export const MatrixHistogramComponent: React.FC<
 };
 
 export const MatrixHistogram = React.memo(MatrixHistogramComponent);
-
-const makeMapStateToProps = () => {
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  const mapStateToProps = (state: State, { id }: OwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      isInspected,
-    };
-  };
-  return mapStateToProps;
-};
-
-export const MatrixHistogramContainer = compose<React.ComponentClass<OwnProps>>(
-  connect(makeMapStateToProps, {
-    dispatchSetAbsoluteRangeDatePicker: setAbsoluteRangeDatePicker,
-  })
-)(MatrixHistogram);
diff --git a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/types.ts b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/types.ts
index a859b0dd392310..fc1df4d8ca85f5 100644
--- a/x-pack/plugins/security_solution/public/common/components/matrix_histogram/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/matrix_histogram/types.ts
@@ -9,7 +9,7 @@ import { ScaleType, Position, TickFormatter } from '@elastic/charts';
 import { ActionCreator } from 'redux';
 import { ESQuery } from '../../../../common/typed_json';
 import { InputsModelId } from '../../store/inputs/constants';
-import { HistogramType } from '../../../graphql/types';
+import { MatrixHistogramType } from '../../../../common/search_strategy/security_solution';
 import { UpdateDateRange } from '../charts/common';
 import { GlobalTimeArgs } from '../../containers/use_global_time';
 
@@ -25,11 +25,11 @@ export interface MatrixHistogramOption {
 export type GetSubTitle = (count: number) => string;
 export type GetTitle = (matrixHistogramOption: MatrixHistogramOption) => string;
 
-export interface MatrixHisrogramConfigs {
+export interface MatrixHistogramConfigs {
   defaultStackByOption: MatrixHistogramOption;
   errorMessage: string;
   hideHistogramIfEmpty?: boolean;
-  histogramType: HistogramType;
+  histogramType: MatrixHistogramType;
   legendPosition?: Position;
   mapping?: MatrixHistogramMappingTypes;
   stackByOptions: MatrixHistogramOption[];
@@ -40,13 +40,7 @@ export interface MatrixHisrogramConfigs {
 
 interface MatrixHistogramBasicProps {
   chartHeight?: number;
-  defaultIndex: string[];
   defaultStackByOption: MatrixHistogramOption;
-  dispatchSetAbsoluteRangeDatePicker: ActionCreator<{
-    id: InputsModelId;
-    from: string;
-    to: string;
-  }>;
   endDate: GlobalTimeArgs['to'];
   headerChildren?: React.ReactNode;
   hideHistogramIfEmpty?: boolean;
@@ -75,8 +69,7 @@ export interface MatrixHistogramQueryProps {
   stackByField: string;
   startDate: string;
   indexToAdd?: string[] | null;
-  isInspected: boolean;
-  histogramType: HistogramType;
+  histogramType: MatrixHistogramType;
 }
 
 export interface MatrixHistogramProps extends MatrixHistogramBasicProps {
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap
index 60088a77878ad0..a40ccfa7cd1b5d 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap
@@ -100,7 +100,11 @@ exports[`JobsTableComponent renders correctly against snapshot 1`] = `
     ]
   }
   loading={true}
-  noItemsMessage={<Memo(NoItemsMessage) />}
+  noItemsMessage={
+    <Memo(NoItemsMessage)
+      basePath="/test/base/path"
+    />
+  }
   onChange={[Function]}
   pagination={
     Object {
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx
index be911a1cd85378..1e9e689dcd6ff2 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx
@@ -125,7 +125,7 @@ export const JobsTableComponent = ({ isLoading, jobs, onJobStateChange }: JobTab
       columns={getJobsTableColumns(isLoading, onJobStateChange, basePath)}
       items={getPaginatedItems(jobs, pageIndex, pageSize)}
       loading={isLoading}
-      noItemsMessage={<NoItemsMessage />}
+      noItemsMessage={<NoItemsMessage basePath={basePath} />}
       pagination={pagination}
       responsive={false}
       onChange={({ page }: { page: { index: number } }) => {
@@ -141,13 +141,13 @@ export const JobsTable = React.memo(JobsTableComponent);
 
 JobsTable.displayName = 'JobsTable';
 
-export const NoItemsMessage = React.memo(() => (
+export const NoItemsMessage = React.memo(({ basePath }: { basePath: string }) => (
   <EuiEmptyPrompt
     title={<h3>{i18n.NO_ITEMS_TEXT}</h3>}
     titleSize="xs"
     actions={
       <EuiButton
-        href="ml#/jobs/new_job/step/index_or_search"
+        href={`${basePath}/app/ml#/jobs/new_job/step/index_or_search`}
         iconType="popout"
         iconSide="right"
         size="s"
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/translations.ts b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/translations.ts
index 12ca5df7fe97fb..bcde39355a21d6 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/translations.ts
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/translations.ts
@@ -30,7 +30,7 @@ export const COLUMN_RUN_JOB = i18n.translate(
 export const NO_ITEMS_TEXT = i18n.translate(
   'xpack.securitySolution.components.mlPopup.jobsTable.noItemsDescription',
   {
-    defaultMessage: 'No SIEM Machine Learning jobs found',
+    defaultMessage: 'No Security Machine Learning jobs found',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/common/components/paginated_table/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/paginated_table/__snapshots__/index.test.tsx.snap
index 3b8ef69892cc02..9724e36f045e4b 100644
--- a/x-pack/plugins/security_solution/public/common/components/paginated_table/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/paginated_table/__snapshots__/index.test.tsx.snap
@@ -24,6 +24,7 @@ exports[`Paginated Table Component rendering it renders the default load more ta
             "size": "64px",
           },
         },
+        "browserDefaultFontSize": "16px",
         "euiAnimSlightBounce": "cubic-bezier(0.34, 1.61, 0.7, 1)",
         "euiAnimSlightResistance": "cubic-bezier(0.694, 0.0482, 0.335, 1)",
         "euiAnimSpeedExtraFast": "90ms",
@@ -434,6 +435,28 @@ exports[`Paginated Table Component rendering it renders the default load more ta
         "euiScrollBarCorner": "6px",
         "euiSelectableListItemBorder": "1px solid #202128",
         "euiSelectableListItemPadding": "4px 12px",
+        "euiSelectableTemplateSitewideTypes": Object {
+          "application": Object {
+            "color": "#6092c0",
+            "font-weight": 500,
+          },
+          "article": Object {
+            "color": "#9777bc",
+            "font-weight": 500,
+          },
+          "case": Object {
+            "color": "#e7664c",
+            "font-weight": 500,
+          },
+          "deployment": Object {
+            "color": "#54b399",
+            "font-weight": 500,
+          },
+          "platform": Object {
+            "color": "#d6bf57",
+            "font-weight": 500,
+          },
+        },
         "euiShadowColor": "#000000",
         "euiShadowColorLarge": "#000000",
         "euiSize": "16px",
diff --git a/x-pack/plugins/security_solution/public/common/components/toasters/__snapshots__/modal_all_errors.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/toasters/__snapshots__/modal_all_errors.test.tsx.snap
index b9cb5f3c83d030..f7924f37d2c173 100644
--- a/x-pack/plugins/security_solution/public/common/components/toasters/__snapshots__/modal_all_errors.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/toasters/__snapshots__/modal_all_errors.test.tsx.snap
@@ -26,6 +26,8 @@ exports[`Modal all errors rendering it renders the default all errors modal when
         data-test-subj="modal-all-errors-accordion"
         id="accordion1"
         initialIsOpen={true}
+        isLoading={false}
+        isLoadingMessage={false}
         key="id-super-id-0"
         paddingSize="none"
       >
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts b/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts
index 5e40cd00fa69ef..6052913b4183b1 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts
@@ -12,6 +12,7 @@ import * as H from 'history';
 import { Query, Filter } from '../../../../../../../src/plugins/data/public';
 import { url } from '../../../../../../../src/plugins/kibana_utils/public';
 
+import { TimelineId } from '../../../../common/types/timeline';
 import { SecurityPageName } from '../../../app/types';
 import { inputsSelectors, State } from '../../store';
 import { UrlInputsModel } from '../../store/inputs/model';
@@ -122,7 +123,7 @@ export const makeMapStateToProps = () => {
     const { linkTo: globalLinkTo, timerange: globalTimerange } = inputState.global;
     const { linkTo: timelineLinkTo, timerange: timelineTimerange } = inputState.timeline;
 
-    const flyoutTimeline = getTimeline(state, 'timeline-1');
+    const flyoutTimeline = getTimeline(state, TimelineId.active);
     const timeline =
       flyoutTimeline != null
         ? {
diff --git a/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/histogram_configs.ts b/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/histogram_configs.ts
index b32919f4868dcc..b4893fa37571af 100644
--- a/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/histogram_configs.ts
+++ b/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/histogram_configs.ts
@@ -6,9 +6,9 @@
 import * as i18n from './translations';
 import {
   MatrixHistogramOption,
-  MatrixHisrogramConfigs,
+  MatrixHistogramConfigs,
 } from '../../../components/matrix_histogram/types';
-import { HistogramType } from '../../../../graphql/types';
+import { MatrixHistogramType } from '../../../../../common/search_strategy/security_solution/matrix_histogram';
 
 export const anomaliesStackByOptions: MatrixHistogramOption[] = [
   {
@@ -19,12 +19,12 @@ export const anomaliesStackByOptions: MatrixHistogramOption[] = [
 
 const DEFAULT_STACK_BY = i18n.ANOMALIES_STACK_BY_JOB_ID;
 
-export const histogramConfigs: MatrixHisrogramConfigs = {
+export const histogramConfigs: MatrixHistogramConfigs = {
   defaultStackByOption:
     anomaliesStackByOptions.find((o) => o.text === DEFAULT_STACK_BY) ?? anomaliesStackByOptions[0],
   errorMessage: i18n.ERROR_FETCHING_ANOMALIES_DATA,
   hideHistogramIfEmpty: true,
-  histogramType: HistogramType.anomalies,
+  histogramType: MatrixHistogramType.anomalies,
   stackByOptions: anomaliesStackByOptions,
   subtitle: undefined,
   title: i18n.ANOMALIES_TITLE,
diff --git a/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/index.tsx b/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/index.tsx
index 94019b26c180b0..f6ebbb990f2234 100644
--- a/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/index.tsx
@@ -11,11 +11,12 @@ import { AnomaliesQueryTabBodyProps } from './types';
 import { getAnomaliesFilterQuery } from './utils';
 import { useInstalledSecurityJobs } from '../../../components/ml/hooks/use_installed_security_jobs';
 import { useUiSetting$ } from '../../../lib/kibana';
-import { MatrixHistogramContainer } from '../../../components/matrix_histogram';
+import { MatrixHistogram } from '../../../components/matrix_histogram';
 import { histogramConfigs } from './histogram_configs';
-const ID = 'anomaliesOverTimeQuery';
 
-export const AnomaliesQueryTabBody = ({
+const ID = 'anomaliesHistogramQuery';
+
+const AnomaliesQueryTabBodyComponent: React.FC<AnomaliesQueryTabBodyProps> = ({
   deleteQuery,
   endDate,
   setQuery,
@@ -28,16 +29,7 @@ export const AnomaliesQueryTabBody = ({
   AnomaliesTableComponent,
   flowTarget,
   ip,
-}: AnomaliesQueryTabBodyProps) => {
-  useEffect(() => {
-    return () => {
-      if (deleteQuery) {
-        deleteQuery({ id: ID });
-      }
-    };
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
+}) => {
   const { jobs } = useInstalledSecurityJobs();
   const [anomalyScore] = useUiSetting$<number>(DEFAULT_ANOMALY_SCORE);
 
@@ -50,16 +42,23 @@ export const AnomaliesQueryTabBody = ({
     ip
   );
 
+  useEffect(() => {
+    return () => {
+      if (deleteQuery) {
+        deleteQuery({ id: ID });
+      }
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
   return (
     <>
-      <MatrixHistogramContainer
+      <MatrixHistogram
         endDate={endDate}
         filterQuery={mergedFilterQuery}
         id={ID}
         setQuery={setQuery}
-        sourceId="default"
         startDate={startDate}
-        type={type}
         {...histogramConfigs}
       />
       <AnomaliesTableComponent
@@ -75,4 +74,8 @@ export const AnomaliesQueryTabBody = ({
   );
 };
 
+AnomaliesQueryTabBodyComponent.displayName = 'AnomaliesQueryTabBodyComponent';
+
+export const AnomaliesQueryTabBody = React.memo(AnomaliesQueryTabBodyComponent);
+
 AnomaliesQueryTabBody.displayName = 'AnomaliesQueryTabBody';
diff --git a/x-pack/plugins/security_solution/public/common/containers/matrix_histogram/index.test.tsx b/x-pack/plugins/security_solution/public/common/containers/matrix_histogram/index.test.tsx
deleted file mode 100644
index 6e780e6b06b521..00000000000000
--- a/x-pack/plugins/security_solution/public/common/containers/matrix_histogram/index.test.tsx
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { useQuery } from '.';
-import { mount } from 'enzyme';
-import React from 'react';
-import { useApolloClient } from '../../utils/apollo_context';
-import { errorToToaster } from '../../components/toasters';
-import { MatrixOverTimeHistogramData, HistogramType } from '../../../graphql/types';
-import { InspectQuery, Refetch } from '../../store/inputs/model';
-
-const mockQuery = jest.fn().mockResolvedValue({
-  data: {
-    source: {
-      MatrixHistogram: {
-        matrixHistogramData: [{}],
-        totalCount: 1,
-        inspect: false,
-      },
-    },
-  },
-});
-
-const mockRejectQuery = jest.fn().mockRejectedValue(new Error());
-jest.mock('../../utils/apollo_context', () => ({
-  useApolloClient: jest.fn(),
-}));
-
-jest.mock('../../lib/kibana', () => {
-  return {
-    useUiSetting$: jest.fn().mockReturnValue(['mockDefaultIndex']),
-  };
-});
-
-jest.mock('./index.gql_query', () => {
-  return {
-    MatrixHistogramGqlQuery: 'mockGqlQuery',
-  };
-});
-
-jest.mock('../../components/toasters/', () => ({
-  useStateToaster: () => [jest.fn(), jest.fn()],
-  errorToToaster: jest.fn(),
-}));
-
-describe('useQuery', () => {
-  let result: {
-    data: MatrixOverTimeHistogramData[] | null;
-    loading: boolean;
-    inspect: InspectQuery | null;
-    totalCount: number;
-    refetch: Refetch | undefined;
-  };
-  describe('happy path', () => {
-    beforeAll(() => {
-      (useApolloClient as jest.Mock).mockReturnValue({
-        query: mockQuery,
-      });
-      const TestComponent = () => {
-        result = useQuery({
-          endDate: '2020-07-07T08:20:00.000Z',
-          errorMessage: 'fakeErrorMsg',
-          filterQuery: '',
-          histogramType: HistogramType.alerts,
-          isInspected: false,
-          stackByField: 'fakeField',
-          startDate: '2020-07-07T08:08:00.000Z',
-        });
-
-        return <div />;
-      };
-
-      mount(<TestComponent />);
-    });
-
-    test('should set variables', () => {
-      expect(mockQuery).toBeCalledWith({
-        query: 'mockGqlQuery',
-        fetchPolicy: 'network-only',
-        variables: {
-          filterQuery: '',
-          sourceId: 'default',
-          timerange: {
-            interval: '12h',
-            from: '2020-07-07T08:08:00.000Z',
-            to: '2020-07-07T08:20:00.000Z',
-          },
-          defaultIndex: 'mockDefaultIndex',
-          inspect: false,
-          stackByField: 'fakeField',
-          histogramType: 'alerts',
-        },
-        context: {
-          fetchOptions: {
-            abortSignal: new AbortController().signal,
-          },
-        },
-      });
-    });
-
-    test('should setData', () => {
-      expect(result.data).toEqual([{}]);
-    });
-
-    test('should set total count', () => {
-      expect(result.totalCount).toEqual(1);
-    });
-
-    test('should set inspect', () => {
-      expect(result.inspect).toEqual(false);
-    });
-  });
-
-  describe('failure path', () => {
-    beforeAll(() => {
-      mockQuery.mockClear();
-      (useApolloClient as jest.Mock).mockReset();
-      (useApolloClient as jest.Mock).mockReturnValue({
-        query: mockRejectQuery,
-      });
-      const TestComponent = () => {
-        result = useQuery({
-          endDate: '2020-07-07T08:20:18.966Z',
-          errorMessage: 'fakeErrorMsg',
-          filterQuery: '',
-          histogramType: HistogramType.alerts,
-          isInspected: false,
-          stackByField: 'fakeField',
-          startDate: '2020-07-08T08:20:18.966Z',
-        });
-
-        return <div />;
-      };
-
-      mount(<TestComponent />);
-    });
-
-    test('should setData', () => {
-      expect(result.data).toEqual(null);
-    });
-
-    test('should set total count', () => {
-      expect(result.totalCount).toEqual(-1);
-    });
-
-    test('should set inspect', () => {
-      expect(result.inspect).toEqual(null);
-    });
-
-    test('should set error to toster', () => {
-      expect(errorToToaster).toHaveBeenCalled();
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/containers/matrix_histogram/index.ts b/x-pack/plugins/security_solution/public/common/containers/matrix_histogram/index.ts
index c4702e915c0761..65ad3cc994c670 100644
--- a/x-pack/plugins/security_solution/public/common/containers/matrix_histogram/index.ts
+++ b/x-pack/plugins/security_solution/public/common/containers/matrix_histogram/index.ts
@@ -5,29 +5,44 @@
  */
 
 import deepEqual from 'fast-deep-equal';
-import { isEmpty } from 'lodash/fp';
-import { useEffect, useMemo, useState, useRef } from 'react';
+import { isEmpty, noop } from 'lodash/fp';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
-import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
 import { MatrixHistogramQueryProps } from '../../components/matrix_histogram/types';
-import { errorToToaster, useStateToaster } from '../../components/toasters';
-import { useUiSetting$ } from '../../lib/kibana';
-import { createFilter } from '../helpers';
-import { useApolloClient } from '../../utils/apollo_context';
-import { inputsModel } from '../../store';
-import { MatrixHistogramGqlQuery } from './index.gql_query';
-import { GetMatrixHistogramQuery, MatrixOverTimeHistogramData } from '../../../graphql/types';
+import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
+import { inputsModel } from '../../../common/store';
+import { createFilter } from '../../../common/containers/helpers';
+import { useKibana, useUiSetting$ } from '../../../common/lib/kibana';
+import {
+  MatrixHistogramQuery,
+  MatrixHistogramRequestOptions,
+  MatrixHistogramStrategyResponse,
+  MatrixHistogramData,
+} from '../../../../common/search_strategy/security_solution';
+import { AbortError } from '../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../helpers';
+import { InspectResponse } from '../../../types';
+import * as i18n from './translations';
 
-export const useQuery = ({
+export interface UseMatrixHistogramArgs {
+  data: MatrixHistogramData[];
+  inspect: InspectResponse;
+  refetch: inputsModel.Refetch;
+  totalCount: number;
+}
+
+export const useMatrixHistogram = ({
   endDate,
   errorMessage,
   filterQuery,
   histogramType,
   indexToAdd,
-  isInspected,
   stackByField,
   startDate,
-}: MatrixHistogramQueryProps) => {
+}: MatrixHistogramQueryProps): [boolean, UseMatrixHistogramArgs] => {
+  const { data, notifications } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
   const [configIndex] = useUiSetting$<string[]>(DEFAULT_INDEX_KEY);
   const defaultIndex = useMemo<string[]>(() => {
     if (indexToAdd != null && !isEmpty(indexToAdd)) {
@@ -35,108 +50,110 @@ export const useQuery = ({
     }
     return configIndex;
   }, [configIndex, indexToAdd]);
-  const [, dispatchToaster] = useStateToaster();
-  const refetch = useRef<inputsModel.Refetch>();
-  const [loading, setLoading] = useState<boolean>(false);
-  const [data, setData] = useState<MatrixOverTimeHistogramData[] | null>(null);
-  const [inspect, setInspect] = useState<inputsModel.InspectQuery | null>(null);
-  const [totalCount, setTotalCount] = useState<number>(-1);
-  const apolloClient = useApolloClient();
-
-  const [matrixHistogramVariables, setMatrixHistogramVariables] = useState<
-    GetMatrixHistogramQuery.Variables
+  const [loading, setLoading] = useState(false);
+  const [matrixHistogramRequest, setMatrixHistogramRequest] = useState<
+    MatrixHistogramRequestOptions
   >({
+    defaultIndex,
+    factoryQueryType: MatrixHistogramQuery,
     filterQuery: createFilter(filterQuery),
-    sourceId: 'default',
+    histogramType,
     timerange: {
       interval: '12h',
-      from: startDate!,
-      to: endDate!,
+      from: startDate,
+      to: endDate,
     },
-    defaultIndex,
-    inspect: isInspected,
     stackByField,
-    histogramType,
   });
 
+  const [matrixHistogramResponse, setMatrixHistogramResponse] = useState<UseMatrixHistogramArgs>({
+    data: [],
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    refetch: refetch.current,
+    totalCount: -1,
+  });
+
+  const hostsSearch = useCallback(
+    (request: MatrixHistogramRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<MatrixHistogramRequestOptions, MatrixHistogramStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setMatrixHistogramResponse((prevResponse) => ({
+                    ...prevResponse,
+                    data: response.matrixHistogramData,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    refetch: refetch.current,
+                    totalCount: response.totalCount,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_MATRIX_HISTOGRAM);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: errorMessage ?? i18n.FAIL_MATRIX_HISTOGRAM,
+                  text: msg.message,
+                });
+              }
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, errorMessage, notifications.toasts]
+  );
+
   useEffect(() => {
-    setMatrixHistogramVariables((prevVariables) => {
-      const localVariables = {
+    setMatrixHistogramRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
         filterQuery: createFilter(filterQuery),
-        sourceId: 'default',
         timerange: {
           interval: '12h',
-          from: startDate!,
-          to: endDate!,
+          from: startDate,
+          to: endDate,
         },
-        defaultIndex,
-        inspect: isInspected,
-        stackByField,
-        histogramType,
       };
-      if (!deepEqual(prevVariables, localVariables)) {
-        return localVariables;
+      if (!deepEqual(prevRequest, myRequest)) {
+        return myRequest;
       }
-      return prevVariables;
+      return prevRequest;
     });
-  }, [
-    defaultIndex,
-    filterQuery,
-    histogramType,
-    indexToAdd,
-    isInspected,
-    stackByField,
-    startDate,
-    endDate,
-  ]);
+  }, [defaultIndex, endDate, filterQuery, startDate]);
 
   useEffect(() => {
-    let isSubscribed = true;
-    const abortCtrl = new AbortController();
-    const abortSignal = abortCtrl.signal;
-
-    async function fetchData() {
-      if (!apolloClient) return null;
-      setLoading(true);
-      return apolloClient
-        .query<GetMatrixHistogramQuery.Query, GetMatrixHistogramQuery.Variables>({
-          query: MatrixHistogramGqlQuery,
-          fetchPolicy: 'network-only',
-          variables: matrixHistogramVariables,
-          context: {
-            fetchOptions: {
-              abortSignal,
-            },
-          },
-        })
-        .then(
-          (result) => {
-            if (isSubscribed) {
-              const source = result?.data?.source?.MatrixHistogram ?? {};
-              setData(source?.matrixHistogramData ?? []);
-              setTotalCount(source?.totalCount ?? -1);
-              setInspect(source?.inspect ?? null);
-              setLoading(false);
-            }
-          },
-          (error) => {
-            if (isSubscribed) {
-              setData(null);
-              setTotalCount(-1);
-              setInspect(null);
-              setLoading(false);
-              errorToToaster({ title: errorMessage, error, dispatchToaster });
-            }
-          }
-        );
-    }
-    refetch.current = fetchData;
-    fetchData();
-    return () => {
-      isSubscribed = false;
-      abortCtrl.abort();
-    };
-  }, [apolloClient, dispatchToaster, errorMessage, matrixHistogramVariables]);
+    hostsSearch(matrixHistogramRequest);
+  }, [matrixHistogramRequest, hostsSearch]);
 
-  return { data, loading, inspect, totalCount, refetch: refetch.current };
+  return [loading, matrixHistogramResponse];
 };
diff --git a/x-pack/plugins/security_solution/public/common/containers/matrix_histogram/translations.ts b/x-pack/plugins/security_solution/public/common/containers/matrix_histogram/translations.ts
new file mode 100644
index 00000000000000..b15b28c6b49aeb
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/containers/matrix_histogram/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_MATRIX_HISTOGRAM = i18n.translate(
+  'xpack.securitySolution.matrixHistogram.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on matrix histogram search`,
+  }
+);
+
+export const FAIL_MATRIX_HISTOGRAM = i18n.translate(
+  'xpack.securitySolution.matrixHistogram.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on matrix histogram`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.test.ts b/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.test.ts
index e0e629793952a7..da43d0c5109974 100644
--- a/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.test.ts
+++ b/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.test.ts
@@ -14,13 +14,16 @@ jest.mock('../lib/kibana');
 describe('useDeleteList', () => {
   let addErrorMock: jest.Mock;
   let addSuccessMock: jest.Mock;
+  let addWarningMock: jest.Mock;
 
   beforeEach(() => {
     addErrorMock = jest.fn();
     addSuccessMock = jest.fn();
+    addWarningMock = jest.fn();
     (useToasts as jest.Mock).mockImplementation(() => ({
       addError: addErrorMock,
       addSuccess: addSuccessMock,
+      addWarning: addWarningMock,
     }));
   });
 
diff --git a/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.ts b/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.ts
index bc59d87100058a..ae811e7400737e 100644
--- a/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.ts
+++ b/x-pack/plugins/security_solution/public/common/hooks/use_app_toasts.ts
@@ -10,7 +10,7 @@ import { ErrorToastOptions, ToastsStart, Toast } from '../../../../../../src/cor
 import { useToasts } from '../lib/kibana';
 import { isAppError, AppError } from '../utils/api';
 
-export type UseAppToasts = Pick<ToastsStart, 'addSuccess'> & {
+export type UseAppToasts = Pick<ToastsStart, 'addSuccess' | 'addWarning'> & {
   api: ToastsStart;
   addError: (error: unknown, options: ErrorToastOptions) => Toast;
 };
@@ -19,6 +19,7 @@ export const useAppToasts = (): UseAppToasts => {
   const toasts = useToasts();
   const addError = useRef(toasts.addError.bind(toasts)).current;
   const addSuccess = useRef(toasts.addSuccess.bind(toasts)).current;
+  const addWarning = useRef(toasts.addWarning.bind(toasts)).current;
 
   const addAppError = useCallback(
     (error: AppError, options: ErrorToastOptions) =>
@@ -44,5 +45,5 @@ export const useAppToasts = (): UseAppToasts => {
     [addAppError, addError]
   );
 
-  return { api: toasts, addError: _addError, addSuccess };
+  return { api: toasts, addError: _addError, addSuccess, addWarning };
 };
diff --git a/x-pack/plugins/security_solution/public/common/lib/kibana/kibana_react.ts b/x-pack/plugins/security_solution/public/common/lib/kibana/kibana_react.ts
index 075f06084384bb..b4fb307a62b6c3 100644
--- a/x-pack/plugins/security_solution/public/common/lib/kibana/kibana_react.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/kibana/kibana_react.ts
@@ -19,12 +19,11 @@ export interface WithKibanaProps {
   kibana: KibanaContext;
 }
 
-// eslint-disable-next-line react-hooks/rules-of-hooks
-const typedUseKibana = () => useKibana<StartServices>();
+const useTypedKibana = () => useKibana<StartServices>();
 
 export {
   KibanaContextProvider,
-  typedUseKibana as useKibana,
+  useTypedKibana as useKibana,
   useUiSetting,
   useUiSetting$,
   withKibana,
diff --git a/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts b/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts
index ab9f12a67fe897..26013915315afb 100644
--- a/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts
@@ -5,7 +5,7 @@
  */
 import { FilterStateStore } from '../../../../../../src/plugins/data/common/es_query/filters/meta_filter';
 
-import { TimelineType, TimelineStatus } from '../../../common/types/timeline';
+import { TimelineId, TimelineType, TimelineStatus } from '../../../common/types/timeline';
 
 import { OpenTimelineResult } from '../../timelines/components/open_timeline/types';
 import {
@@ -2227,7 +2227,7 @@ export const defaultTimelineProps: CreateTimelineProps = {
     filters: [],
     highlightedDropAndProviderId: '',
     historyIds: [],
-    id: 'timeline-1',
+    id: TimelineId.active,
     isFavorite: false,
     isLive: false,
     isLoading: false,
diff --git a/x-pack/plugins/security_solution/public/common/translations.ts b/x-pack/plugins/security_solution/public/common/translations.ts
index 3b94ac8959496f..c4a9540f629142 100644
--- a/x-pack/plugins/security_solution/public/common/translations.ts
+++ b/x-pack/plugins/security_solution/public/common/translations.ts
@@ -61,3 +61,17 @@ export const EMPTY_ACTION_ENDPOINT_DESCRIPTION = i18n.translate(
       'Protect your hosts with threat prevention, detection, and deep security data visibility.',
   }
 );
+
+export const UPDATE_ALERT_STATUS_FAILED = (conflicts: number) =>
+  i18n.translate('xpack.securitySolution.pages.common.updateAlertStatusFailed', {
+    values: { conflicts },
+    defaultMessage:
+      'Failed to update { conflicts } {conflicts, plural, =1 {alert} other {alerts}}.',
+  });
+
+export const UPDATE_ALERT_STATUS_FAILED_DETAILED = (updated: number, conflicts: number) =>
+  i18n.translate('xpack.securitySolution.pages.common.updateAlertStatusFailedDetailed', {
+    values: { updated, conflicts },
+    defaultMessage: `{ updated } {updated, plural, =1 {alert was} other {alerts were}} updated successfully, but { conflicts } failed to update
+         because { conflicts, plural, =1 {it was} other {they were}} already being modified.`,
+  });
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
index e8015f601cb184..3f95fd36b60106 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
@@ -18,7 +18,7 @@ import {
 } from '../../../common/mock/';
 import { CreateTimeline, UpdateTimelineLoading } from './types';
 import { Ecs } from '../../../graphql/types';
-import { TimelineType, TimelineStatus } from '../../../../common/types/timeline';
+import { TimelineId, TimelineType, TimelineStatus } from '../../../../common/types/timeline';
 
 jest.mock('apollo-client');
 
@@ -67,7 +67,10 @@ describe('alert actions', () => {
         });
 
         expect(updateTimelineIsLoading).toHaveBeenCalledTimes(1);
-        expect(updateTimelineIsLoading).toHaveBeenCalledWith({ id: 'timeline-1', isLoading: true });
+        expect(updateTimelineIsLoading).toHaveBeenCalledWith({
+          id: TimelineId.active,
+          isLoading: true,
+        });
       });
 
       test('it invokes createTimeline with designated timeline template if "timelineTemplate" exists', async () => {
@@ -313,9 +316,12 @@ describe('alert actions', () => {
           updateTimelineIsLoading,
         });
 
-        expect(updateTimelineIsLoading).toHaveBeenCalledWith({ id: 'timeline-1', isLoading: true });
         expect(updateTimelineIsLoading).toHaveBeenCalledWith({
-          id: 'timeline-1',
+          id: TimelineId.active,
+          isLoading: true,
+        });
+        expect(updateTimelineIsLoading).toHaveBeenCalledWith({
+          id: TimelineId.active,
           isLoading: false,
         });
         expect(createTimeline).toHaveBeenCalledTimes(1);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
index 34c0537a6d7d24..972a8aa4b08717 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
@@ -9,7 +9,9 @@
 import dateMath from '@elastic/datemath';
 import { get, getOr, isEmpty, find } from 'lodash/fp';
 import moment from 'moment';
+import { i18n } from '@kbn/i18n';
 
+import { TimelineId } from '../../../../common/types/timeline';
 import { updateAlertStatus } from '../../containers/detection_engine/alerts/api';
 import { SendAlertToTimelineActionProps, UpdateAlertStatusActionProps } from './types';
 import {
@@ -67,7 +69,6 @@ export const getFilterAndRuleBounds = (
 export const updateAlertStatusAction = async ({
   query,
   alertIds,
-  status,
   selectedStatus,
   setEventsLoading,
   setEventsDeleted,
@@ -83,7 +84,18 @@ export const updateAlertStatusAction = async ({
     // TODO: Only delete those that were successfully updated from updatedRules
     setEventsDeleted({ eventIds: alertIds, isDeleted: true });
 
-    onAlertStatusUpdateSuccess(response.updated, selectedStatus);
+    if (response.version_conflicts > 0 && alertIds.length === 1) {
+      throw new Error(
+        i18n.translate(
+          'xpack.securitySolution.detectionEngine.alerts.updateAlertStatusFailedSingleAlert',
+          {
+            defaultMessage: 'Failed to update alert because it was already being modified.',
+          }
+        )
+      );
+    }
+
+    onAlertStatusUpdateSuccess(response.updated, response.version_conflicts, selectedStatus);
   } catch (error) {
     onAlertStatusUpdateFailure(selectedStatus, error);
   } finally {
@@ -126,7 +138,7 @@ export const getThresholdAggregationDataProvider = (
   return [
     {
       and: [],
-      id: `send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-${aggregationFieldId}-${dataProviderValue}`,
+      id: `send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${TimelineId.active}-${aggregationFieldId}-${dataProviderValue}`,
       name: ecsData.signal?.rule?.threshold.field,
       enabled: true,
       excluded: false,
@@ -155,7 +167,7 @@ export const sendAlertToTimelineAction = async ({
 
   if (timelineId !== '' && apolloClient != null) {
     try {
-      updateTimelineIsLoading({ id: 'timeline-1', isLoading: true });
+      updateTimelineIsLoading({ id: TimelineId.active, isLoading: true });
       const [responseTimeline, eventDataResp] = await Promise.all([
         apolloClient.query<GetOneTimeline.Query, GetOneTimeline.Variables>({
           query: oneTimelineQuery,
@@ -236,7 +248,7 @@ export const sendAlertToTimelineAction = async ({
       }
     } catch {
       openAlertInBasicTimeline = true;
-      updateTimelineIsLoading({ id: 'timeline-1', isLoading: false });
+      updateTimelineIsLoading({ id: TimelineId.active, isLoading: false });
     }
   }
 
@@ -253,7 +265,7 @@ export const sendAlertToTimelineAction = async ({
         dataProviders: [
           {
             and: [],
-            id: `send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-alert-id-${ecsData._id}`,
+            id: `send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${TimelineId.active}-alert-id-${ecsData._id}`,
             name: ecsData._id,
             enabled: true,
             excluded: false,
@@ -266,7 +278,7 @@ export const sendAlertToTimelineAction = async ({
           },
           ...getThresholdAggregationDataProvider(ecsData, nonEcsData),
         ],
-        id: 'timeline-1',
+        id: TimelineId.active,
         dateRange: {
           start: from,
           end: to,
@@ -304,7 +316,7 @@ export const sendAlertToTimelineAction = async ({
         dataProviders: [
           {
             and: [],
-            id: `send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-alert-id-${ecsData._id}`,
+            id: `send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${TimelineId.active}-alert-id-${ecsData._id}`,
             name: ecsData._id,
             enabled: true,
             excluded: false,
@@ -316,7 +328,7 @@ export const sendAlertToTimelineAction = async ({
             },
           },
         ],
-        id: 'timeline-1',
+        id: TimelineId.active,
         dateRange: {
           start: from,
           end: to,
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
index ca17d331c67e58..eebabc59d93244 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
@@ -4,44 +4,19 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
-import ApolloClient from 'apollo-client';
-import { Dispatch } from 'redux';
-
-import { EuiText } from '@elastic/eui';
-import { RuleType } from '../../../../common/detection_engine/types';
-import { isMlRule } from '../../../../common/machine_learning/helpers';
 import { RowRendererId } from '../../../../common/types/timeline';
-import { DEFAULT_INDEX_PATTERN } from '../../../../common/constants';
 import { Status } from '../../../../common/detection_engine/schemas/common/schemas';
 import { Filter } from '../../../../../../../src/plugins/data/common/es_query';
-import {
-  TimelineRowAction,
-  TimelineRowActionOnClick,
-} from '../../../timelines/components/timeline/body/actions';
+
 import { defaultColumnHeaderType } from '../../../timelines/components/timeline/body/column_headers/default_headers';
-import { getInvestigateInResolverAction } from '../../../timelines/components/timeline/body/helpers';
 import {
   DEFAULT_COLUMN_MIN_WIDTH,
   DEFAULT_DATE_COLUMN_MIN_WIDTH,
 } from '../../../timelines/components/timeline/body/constants';
-import { DEFAULT_ICON_BUTTON_WIDTH } from '../../../timelines/components/timeline/helpers';
 import { ColumnHeaderOptions, SubsetTimelineModel } from '../../../timelines/store/timeline/model';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 
-import { FILTER_OPEN, FILTER_CLOSED, FILTER_IN_PROGRESS } from './alerts_filter_group';
-import { sendAlertToTimelineAction, updateAlertStatusAction } from './actions';
 import * as i18n from './translations';
-import {
-  CreateTimeline,
-  SetEventsDeletedProps,
-  SetEventsLoadingProps,
-  UpdateTimelineLoading,
-} from './types';
-import { Ecs, TimelineNonEcsData } from '../../../graphql/types';
-import { AddExceptionModalBaseProps } from '../../../common/components/exceptions/add_exception_modal';
-import { getMappedNonEcsValue } from '../../../common/components/exceptions/helpers';
-import { isThresholdRule } from '../../../../common/detection_engine/utils';
 
 export const buildAlertStatusFilter = (status: Status): Filter[] => [
   {
@@ -189,13 +164,16 @@ export const alertsDefaultModel: SubsetTimelineModel = {
 
 export const requiredFieldsForActions = [
   '@timestamp',
+  'signal.status',
   'signal.original_time',
   'signal.rule.filters',
   'signal.rule.from',
   'signal.rule.language',
   'signal.rule.query',
+  'signal.rule.name',
   'signal.rule.to',
   'signal.rule.id',
+  'signal.rule.index',
   'signal.rule.type',
   'signal.original_event.kind',
   'signal.original_event.module',
@@ -208,202 +186,3 @@ export const requiredFieldsForActions = [
   'host.os.family',
   'event.code',
 ];
-
-interface AlertActionArgs {
-  apolloClient?: ApolloClient<{}>;
-  canUserCRUD: boolean;
-  createTimeline: CreateTimeline;
-  dispatch: Dispatch;
-  ecsRowData: Ecs;
-  nonEcsRowData: TimelineNonEcsData[];
-  hasIndexWrite: boolean;
-  onAlertStatusUpdateFailure: (status: Status, error: Error) => void;
-  onAlertStatusUpdateSuccess: (count: number, status: Status) => void;
-  setEventsDeleted: ({ eventIds, isDeleted }: SetEventsDeletedProps) => void;
-  setEventsLoading: ({ eventIds, isLoading }: SetEventsLoadingProps) => void;
-  status: Status;
-  timelineId: string;
-  updateTimelineIsLoading: UpdateTimelineLoading;
-  openAddExceptionModal: ({
-    exceptionListType,
-    alertData,
-    ruleName,
-    ruleId,
-  }: AddExceptionModalBaseProps) => void;
-}
-
-export const getAlertActions = ({
-  apolloClient,
-  canUserCRUD,
-  createTimeline,
-  dispatch,
-  ecsRowData,
-  nonEcsRowData,
-  hasIndexWrite,
-  onAlertStatusUpdateFailure,
-  onAlertStatusUpdateSuccess,
-  setEventsDeleted,
-  setEventsLoading,
-  status,
-  timelineId,
-  updateTimelineIsLoading,
-  openAddExceptionModal,
-}: AlertActionArgs): TimelineRowAction[] => {
-  const openAlertActionComponent: TimelineRowAction = {
-    ariaLabel: 'Open alert',
-    content: <EuiText size="m">{i18n.ACTION_OPEN_ALERT}</EuiText>,
-    dataTestSubj: 'open-alert-status',
-    displayType: 'contextMenu',
-    id: FILTER_OPEN,
-    isActionDisabled: () => !canUserCRUD || !hasIndexWrite,
-    onClick: ({ eventId }: TimelineRowActionOnClick) =>
-      updateAlertStatusAction({
-        alertIds: [eventId],
-        onAlertStatusUpdateFailure,
-        onAlertStatusUpdateSuccess,
-        setEventsDeleted,
-        setEventsLoading,
-        status,
-        selectedStatus: FILTER_OPEN,
-      }),
-    width: DEFAULT_ICON_BUTTON_WIDTH,
-  };
-
-  const closeAlertActionComponent: TimelineRowAction = {
-    ariaLabel: 'Close alert',
-    content: <EuiText size="m">{i18n.ACTION_CLOSE_ALERT}</EuiText>,
-    dataTestSubj: 'close-alert-status',
-    displayType: 'contextMenu',
-    id: FILTER_CLOSED,
-    isActionDisabled: () => !canUserCRUD || !hasIndexWrite,
-    onClick: ({ eventId }: TimelineRowActionOnClick) =>
-      updateAlertStatusAction({
-        alertIds: [eventId],
-        onAlertStatusUpdateFailure,
-        onAlertStatusUpdateSuccess,
-        setEventsDeleted,
-        setEventsLoading,
-        status,
-        selectedStatus: FILTER_CLOSED,
-      }),
-    width: DEFAULT_ICON_BUTTON_WIDTH,
-  };
-
-  const inProgressAlertActionComponent: TimelineRowAction = {
-    ariaLabel: 'Mark alert in progress',
-    content: <EuiText size="m">{i18n.ACTION_IN_PROGRESS_ALERT}</EuiText>,
-    dataTestSubj: 'in-progress-alert-status',
-    displayType: 'contextMenu',
-    id: FILTER_IN_PROGRESS,
-    isActionDisabled: () => !canUserCRUD || !hasIndexWrite,
-    onClick: ({ eventId }: TimelineRowActionOnClick) =>
-      updateAlertStatusAction({
-        alertIds: [eventId],
-        onAlertStatusUpdateFailure,
-        onAlertStatusUpdateSuccess,
-        setEventsDeleted,
-        setEventsLoading,
-        status,
-        selectedStatus: FILTER_IN_PROGRESS,
-      }),
-    width: DEFAULT_ICON_BUTTON_WIDTH,
-  };
-
-  const isEndpointAlert = () => {
-    const [module] = getMappedNonEcsValue({
-      data: nonEcsRowData,
-      fieldName: 'signal.original_event.module',
-    });
-    const [kind] = getMappedNonEcsValue({
-      data: nonEcsRowData,
-      fieldName: 'signal.original_event.kind',
-    });
-    return module === 'endpoint' && kind === 'alert';
-  };
-
-  const exceptionsAreAllowed = () => {
-    const ruleTypes = getMappedNonEcsValue({
-      data: nonEcsRowData,
-      fieldName: 'signal.rule.type',
-    });
-    const [ruleType] = ruleTypes as RuleType[];
-    return !isMlRule(ruleType) && !isThresholdRule(ruleType);
-  };
-
-  return [
-    {
-      ...getInvestigateInResolverAction({ dispatch, timelineId }),
-    },
-    {
-      ariaLabel: 'Send alert to timeline',
-      content: i18n.ACTION_INVESTIGATE_IN_TIMELINE,
-      dataTestSubj: 'send-alert-to-timeline',
-      displayType: 'icon',
-      iconType: 'timeline',
-      id: 'sendAlertToTimeline',
-      onClick: ({ ecsData, data }: TimelineRowActionOnClick) =>
-        sendAlertToTimelineAction({
-          apolloClient,
-          createTimeline,
-          ecsData,
-          nonEcsData: data,
-          updateTimelineIsLoading,
-        }),
-      width: DEFAULT_ICON_BUTTON_WIDTH,
-    },
-    // Context menu items
-    ...(FILTER_OPEN !== status ? [openAlertActionComponent] : []),
-    ...(FILTER_CLOSED !== status ? [closeAlertActionComponent] : []),
-    ...(FILTER_IN_PROGRESS !== status ? [inProgressAlertActionComponent] : []),
-    {
-      onClick: ({ ecsData, data }: TimelineRowActionOnClick) => {
-        const [ruleName] = getMappedNonEcsValue({ data, fieldName: 'signal.rule.name' });
-        const [ruleId] = getMappedNonEcsValue({ data, fieldName: 'signal.rule.id' });
-        const ruleIndices = getMappedNonEcsValue({ data, fieldName: 'signal.rule.index' });
-        if (ruleId !== undefined) {
-          openAddExceptionModal({
-            ruleName: ruleName ?? '',
-            ruleId,
-            ruleIndices: ruleIndices.length > 0 ? ruleIndices : DEFAULT_INDEX_PATTERN,
-            exceptionListType: 'endpoint',
-            alertData: {
-              ecsData,
-              nonEcsData: data,
-            },
-          });
-        }
-      },
-      id: 'addEndpointException',
-      isActionDisabled: () => !canUserCRUD || !hasIndexWrite || !isEndpointAlert(),
-      dataTestSubj: 'add-endpoint-exception-menu-item',
-      ariaLabel: 'Add Endpoint Exception',
-      content: <EuiText size="m">{i18n.ACTION_ADD_ENDPOINT_EXCEPTION}</EuiText>,
-      displayType: 'contextMenu',
-    },
-    {
-      onClick: ({ ecsData, data }: TimelineRowActionOnClick) => {
-        const [ruleName] = getMappedNonEcsValue({ data, fieldName: 'signal.rule.name' });
-        const [ruleId] = getMappedNonEcsValue({ data, fieldName: 'signal.rule.id' });
-        const ruleIndices = getMappedNonEcsValue({ data, fieldName: 'signal.rule.index' });
-        if (ruleId !== undefined) {
-          openAddExceptionModal({
-            ruleName: ruleName ?? '',
-            ruleId,
-            ruleIndices: ruleIndices.length > 0 ? ruleIndices : DEFAULT_INDEX_PATTERN,
-            exceptionListType: 'detection',
-            alertData: {
-              ecsData,
-              nonEcsData: data,
-            },
-          });
-        }
-      },
-      id: 'addException',
-      isActionDisabled: () => !canUserCRUD || !hasIndexWrite || !exceptionsAreAllowed(),
-      dataTestSubj: 'add-exception-menu-item',
-      ariaLabel: 'Add Exception',
-      content: <EuiText size="m">{i18n.ACTION_ADD_EXCEPTION}</EuiText>,
-      displayType: 'contextMenu',
-    },
-  ];
-};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.test.tsx
index d5688d84e97597..be249576020370 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.test.tsx
@@ -40,8 +40,6 @@ describe('AlertsTableComponent', () => {
           clearEventsDeleted={jest.fn()}
           showBuildingBlockAlerts={false}
           onShowBuildingBlockAlertsChanged={jest.fn()}
-          updateTimelineIsLoading={jest.fn()}
-          updateTimeline={jest.fn()}
         />
       </TestProviders>
     );
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
index 854565ace9b4bd..0416b3d2a459f9 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
@@ -7,12 +7,12 @@
 import { EuiPanel, EuiLoadingContent } from '@elastic/eui';
 import { isEmpty } from 'lodash/fp';
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
-import { connect, ConnectedProps, useDispatch } from 'react-redux';
+import { connect, ConnectedProps } from 'react-redux';
 import { Dispatch } from 'redux';
-
 import { Status } from '../../../../common/detection_engine/schemas/common/schemas';
 import { Filter, esQuery } from '../../../../../../../src/plugins/data/public';
 import { TimelineIdLiteral } from '../../../../common/types/timeline';
+import { useAppToasts } from '../../../common/hooks/use_app_toasts';
 import { useFetchIndexPatterns } from '../../containers/detection_engine/rules/fetch_index_patterns';
 import { StatefulEventsViewer } from '../../../common/components/events_viewer';
 import { HeaderSection } from '../../../common/components/header_section';
@@ -22,40 +22,29 @@ import { inputsSelectors, State, inputsModel } from '../../../common/store';
 import { timelineActions, timelineSelectors } from '../../../timelines/store/timeline';
 import { TimelineModel } from '../../../timelines/store/timeline/model';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
-import {
-  useManageTimeline,
-  TimelineRowActionArgs,
-} from '../../../timelines/components/manage_timeline';
-import { useApolloClient } from '../../../common/utils/apollo_context';
+import { useManageTimeline } from '../../../timelines/components/manage_timeline';
 
 import { updateAlertStatusAction } from './actions';
 import {
-  getAlertActions,
   requiredFieldsForActions,
   alertsDefaultModel,
   buildAlertStatusFilter,
 } from './default_config';
 import { FILTER_OPEN, AlertsTableFilterGroup } from './alerts_filter_group';
 import { AlertsUtilityBar } from './alerts_utility_bar';
+import * as i18nCommon from '../../../common/translations';
 import * as i18n from './translations';
 import {
-  CreateTimelineProps,
   SetEventsDeletedProps,
   SetEventsLoadingProps,
   UpdateAlertsStatusCallback,
   UpdateAlertsStatusProps,
 } from './types';
-import { dispatchUpdateTimeline } from '../../../timelines/components/open_timeline/helpers';
 import {
   useStateToaster,
   displaySuccessToast,
   displayErrorToast,
 } from '../../../common/components/toasters';
-import { getInvestigateInResolverAction } from '../../../timelines/components/timeline/body/helpers';
-import {
-  AddExceptionModal,
-  AddExceptionModalBaseProps,
-} from '../../../common/components/exceptions/add_exception_modal';
 
 interface OwnProps {
   timelineId: TimelineIdLiteral;
@@ -72,14 +61,6 @@ interface OwnProps {
 
 type AlertsTableComponentProps = OwnProps & PropsFromRedux;
 
-const addExceptionModalInitialState: AddExceptionModalBaseProps = {
-  ruleName: '',
-  ruleId: '',
-  ruleIndices: [],
-  exceptionListType: 'detection',
-  alertData: undefined,
-};
-
 export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   timelineId,
   canUserCRUD,
@@ -101,30 +82,17 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   onShowBuildingBlockAlertsChanged,
   signalsIndex,
   to,
-  updateTimeline,
-  updateTimelineIsLoading,
 }) => {
-  const dispatch = useDispatch();
-  const apolloClient = useApolloClient();
-
   const [showClearSelectionAction, setShowClearSelectionAction] = useState(false);
   const [filterGroup, setFilterGroup] = useState<Status>(FILTER_OPEN);
-  const [shouldShowAddExceptionModal, setShouldShowAddExceptionModal] = useState(false);
-  const [addExceptionModalState, setAddExceptionModalState] = useState<AddExceptionModalBaseProps>(
-    addExceptionModalInitialState
-  );
   const [{ browserFields, indexPatterns, isLoading: indexPatternsLoading }] = useFetchIndexPatterns(
     signalsIndex !== '' ? [signalsIndex] : [],
     'alerts_table'
   );
   const kibana = useKibana();
   const [, dispatchToaster] = useStateToaster();
-  const {
-    initializeTimeline,
-    setSelectAll,
-    setTimelineRowActions,
-    setIndexToAdd,
-  } = useManageTimeline();
+  const { addWarning } = useAppToasts();
+  const { initializeTimeline, setSelectAll, setIndexToAdd } = useManageTimeline();
 
   const getGlobalQuery = useCallback(
     (customFilters: Filter[]) => {
@@ -149,27 +117,6 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
     [browserFields, defaultFilters, globalFilters, globalQuery, indexPatterns, kibana, to, from]
   );
 
-  // Callback for creating a new timeline -- utilized by row/batch actions
-  const createTimelineCallback = useCallback(
-    ({ from: fromTimeline, timeline, to: toTimeline, ruleNote, notes }: CreateTimelineProps) => {
-      updateTimelineIsLoading({ id: 'timeline-1', isLoading: false });
-      updateTimeline({
-        duplicate: true,
-        forceNotes: true,
-        from: fromTimeline,
-        id: 'timeline-1',
-        notes,
-        timeline: {
-          ...timeline,
-          show: true,
-        },
-        to: toTimeline,
-        ruleNote,
-      })();
-    },
-    [updateTimeline, updateTimelineIsLoading]
-  );
-
   const setEventsLoadingCallback = useCallback(
     ({ eventIds, isLoading }: SetEventsLoadingProps) => {
       setEventsLoading!({ id: timelineId, eventIds, isLoading });
@@ -185,21 +132,29 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   );
 
   const onAlertStatusUpdateSuccess = useCallback(
-    (count: number, status: Status) => {
-      let title: string;
-      switch (status) {
-        case 'closed':
-          title = i18n.CLOSED_ALERT_SUCCESS_TOAST(count);
-          break;
-        case 'open':
-          title = i18n.OPENED_ALERT_SUCCESS_TOAST(count);
-          break;
-        case 'in-progress':
-          title = i18n.IN_PROGRESS_ALERT_SUCCESS_TOAST(count);
+    (updated: number, conflicts: number, status: Status) => {
+      if (conflicts > 0) {
+        // Partial failure
+        addWarning({
+          title: i18nCommon.UPDATE_ALERT_STATUS_FAILED(conflicts),
+          text: i18nCommon.UPDATE_ALERT_STATUS_FAILED_DETAILED(updated, conflicts),
+        });
+      } else {
+        let title: string;
+        switch (status) {
+          case 'closed':
+            title = i18n.CLOSED_ALERT_SUCCESS_TOAST(updated);
+            break;
+          case 'open':
+            title = i18n.OPENED_ALERT_SUCCESS_TOAST(updated);
+            break;
+          case 'in-progress':
+            title = i18n.IN_PROGRESS_ALERT_SUCCESS_TOAST(updated);
+        }
+        displaySuccessToast(title, dispatchToaster);
       }
-      displaySuccessToast(title, dispatchToaster);
     },
-    [dispatchToaster]
+    [addWarning, dispatchToaster]
   );
 
   const onAlertStatusUpdateFailure = useCallback(
@@ -220,28 +175,6 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
     [dispatchToaster]
   );
 
-  const openAddExceptionModalCallback = useCallback(
-    ({
-      ruleName,
-      ruleIndices,
-      ruleId,
-      exceptionListType,
-      alertData,
-    }: AddExceptionModalBaseProps) => {
-      if (alertData != null) {
-        setShouldShowAddExceptionModal(true);
-        setAddExceptionModalState({
-          ruleName,
-          ruleId,
-          ruleIndices,
-          exceptionListType,
-          alertData,
-        });
-      }
-    },
-    [setShouldShowAddExceptionModal, setAddExceptionModalState]
-  );
-
   // Catches state change isSelectAllChecked->false upon user selection change to reset utility bar
   useEffect(() => {
     if (isSelectAllChecked) {
@@ -297,7 +230,6 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
           ? getGlobalQuery(currentStatusFilter)?.filterQuery
           : undefined,
         alertIds: Object.keys(selectedEventIds),
-        status,
         selectedStatus,
         setEventsDeleted: setEventsDeletedCallback,
         setEventsLoading: setEventsLoadingCallback,
@@ -352,42 +284,6 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
     ]
   );
 
-  // Send to Timeline / Update Alert Status Actions for each table row
-  const additionalActions = useMemo(
-    () => ({ ecsData, nonEcsData }: TimelineRowActionArgs) =>
-      getAlertActions({
-        apolloClient,
-        canUserCRUD,
-        createTimeline: createTimelineCallback,
-        ecsRowData: ecsData,
-        nonEcsRowData: nonEcsData,
-        dispatch,
-        hasIndexWrite,
-        onAlertStatusUpdateFailure,
-        onAlertStatusUpdateSuccess,
-        setEventsDeleted: setEventsDeletedCallback,
-        setEventsLoading: setEventsLoadingCallback,
-        status: filterGroup,
-        timelineId,
-        updateTimelineIsLoading,
-        openAddExceptionModal: openAddExceptionModalCallback,
-      }),
-    [
-      apolloClient,
-      canUserCRUD,
-      createTimelineCallback,
-      dispatch,
-      hasIndexWrite,
-      filterGroup,
-      setEventsLoadingCallback,
-      setEventsDeletedCallback,
-      timelineId,
-      updateTimelineIsLoading,
-      onAlertStatusUpdateSuccess,
-      onAlertStatusUpdateFailure,
-      openAddExceptionModalCallback,
-    ]
-  );
   const defaultIndices = useMemo(() => [signalsIndex], [signalsIndex]);
   const defaultFiltersMemo = useMemo(() => {
     if (isEmpty(defaultFilters)) {
@@ -408,21 +304,12 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
       indexToAdd: defaultIndices,
       loadingText: i18n.LOADING_ALERTS,
       selectAll: false,
-      timelineRowActions: () => [getInvestigateInResolverAction({ dispatch, timelineId })],
+      queryFields: requiredFieldsForActions,
       title: '',
     });
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 
-  useEffect(() => {
-    setTimelineRowActions({
-      id: timelineId,
-      queryFields: requiredFieldsForActions,
-      timelineRowActions: additionalActions,
-    });
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [additionalActions]);
-
   useEffect(() => {
     setIndexToAdd({ id: timelineId, indexToAdd: defaultIndices });
   }, [timelineId, defaultIndices, setIndexToAdd]);
@@ -432,53 +319,6 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
     [onFilterGroupChangedCallback]
   );
 
-  const closeAddExceptionModal = useCallback(() => {
-    setShouldShowAddExceptionModal(false);
-    setAddExceptionModalState(addExceptionModalInitialState);
-  }, [setShouldShowAddExceptionModal, setAddExceptionModalState]);
-
-  const onAddExceptionCancel = useCallback(() => {
-    closeAddExceptionModal();
-  }, [closeAddExceptionModal]);
-
-  const onAddExceptionConfirm = useCallback(
-    (refetch: inputsModel.Refetch) => (): void => {
-      refetch();
-      closeAddExceptionModal();
-    },
-    [closeAddExceptionModal]
-  );
-
-  // Callback for creating the AddExceptionModal and allowing it
-  // access to the refetchQuery to update the page
-  const exceptionModalCallback = useCallback(
-    (refetchQuery: inputsModel.Refetch) => {
-      if (shouldShowAddExceptionModal) {
-        return (
-          <AddExceptionModal
-            ruleName={addExceptionModalState.ruleName}
-            ruleId={addExceptionModalState.ruleId}
-            ruleIndices={addExceptionModalState.ruleIndices}
-            exceptionListType={addExceptionModalState.exceptionListType}
-            alertData={addExceptionModalState.alertData}
-            onCancel={onAddExceptionCancel}
-            onConfirm={onAddExceptionConfirm(refetchQuery)}
-            alertStatus={filterGroup}
-          />
-        );
-      } else {
-        return <></>;
-      }
-    },
-    [
-      addExceptionModalState,
-      filterGroup,
-      onAddExceptionCancel,
-      onAddExceptionConfirm,
-      shouldShowAddExceptionModal,
-    ]
-  );
-
   if (loading || indexPatternsLoading || isEmpty(signalsIndex)) {
     return (
       <EuiPanel>
@@ -489,19 +329,16 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   }
 
   return (
-    <>
-      <StatefulEventsViewer
-        defaultIndices={defaultIndices}
-        pageFilters={defaultFiltersMemo}
-        defaultModel={alertsDefaultModel}
-        end={to}
-        headerFilterGroup={headerFilterGroup}
-        id={timelineId}
-        start={from}
-        utilityBar={utilityBarCallback}
-        exceptionsModal={exceptionModalCallback}
-      />
-    </>
+    <StatefulEventsViewer
+      defaultIndices={defaultIndices}
+      pageFilters={defaultFiltersMemo}
+      defaultModel={alertsDefaultModel}
+      end={to}
+      headerFilterGroup={headerFilterGroup}
+      id={timelineId}
+      start={from}
+      utilityBar={utilityBarCallback}
+    />
   );
 };
 
@@ -551,9 +388,6 @@ const mapDispatchToProps = (dispatch: Dispatch) => ({
   }) => dispatch(timelineActions.setEventsDeleted({ id, eventIds, isDeleted })),
   clearEventsDeleted: ({ id }: { id: string }) =>
     dispatch(timelineActions.clearEventsDeleted({ id })),
-  updateTimelineIsLoading: ({ id, isLoading }: { id: string; isLoading: boolean }) =>
-    dispatch(timelineActions.updateIsLoading({ id, isLoading })),
-  updateTimeline: dispatchUpdateTimeline(dispatch),
 });
 
 const connector = connect(makeMapStateToProps, mapDispatchToProps);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
new file mode 100644
index 00000000000000..cbf0e08fef5cde
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
@@ -0,0 +1,495 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useCallback, useMemo, useState } from 'react';
+import { useDispatch } from 'react-redux';
+import {
+  EuiText,
+  EuiButtonIcon,
+  EuiContextMenuPanel,
+  EuiPopover,
+  EuiContextMenuItem,
+} from '@elastic/eui';
+import styled from 'styled-components';
+
+import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
+import { TimelineId } from '../../../../../common/types/timeline';
+import { DEFAULT_INDEX_PATTERN } from '../../../../../common/constants';
+import { Status, Type } from '../../../../../common/detection_engine/schemas/common/schemas';
+import { isThresholdRule } from '../../../../../common/detection_engine/utils';
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
+import { timelineActions } from '../../../../timelines/store/timeline';
+import { EventsTd, EventsTdContent } from '../../../../timelines/components/timeline/styles';
+import { DEFAULT_ICON_BUTTON_WIDTH } from '../../../../timelines/components/timeline/helpers';
+import { FILTER_OPEN, FILTER_CLOSED, FILTER_IN_PROGRESS } from '../alerts_filter_group';
+import { updateAlertStatusAction } from '../actions';
+import { SetEventsDeletedProps, SetEventsLoadingProps } from '../types';
+import { Ecs, TimelineNonEcsData } from '../../../../graphql/types';
+import {
+  AddExceptionModal as AddExceptionModalComponent,
+  AddExceptionModalBaseProps,
+} from '../../../../common/components/exceptions/add_exception_modal';
+import { getMappedNonEcsValue } from '../../../../common/components/exceptions/helpers';
+import * as i18nCommon from '../../../../common/translations';
+import * as i18n from '../translations';
+import {
+  useStateToaster,
+  displaySuccessToast,
+  displayErrorToast,
+} from '../../../../common/components/toasters';
+import { inputsModel } from '../../../../common/store';
+import { useUserData } from '../../user_info';
+
+interface AlertContextMenuProps {
+  disabled: boolean;
+  ecsRowData: Ecs;
+  nonEcsRowData: TimelineNonEcsData[];
+  refetch: inputsModel.Refetch;
+  timelineId: string;
+}
+
+const addExceptionModalInitialState: AddExceptionModalBaseProps = {
+  ruleName: '',
+  ruleId: '',
+  ruleIndices: [],
+  exceptionListType: 'detection',
+  alertData: undefined,
+};
+
+const AlertContextMenuComponent: React.FC<AlertContextMenuProps> = ({
+  disabled,
+  ecsRowData,
+  nonEcsRowData,
+  refetch,
+  timelineId,
+}) => {
+  const dispatch = useDispatch();
+  const [, dispatchToaster] = useStateToaster();
+  const [isPopoverOpen, setPopover] = useState(false);
+  const [alertStatus, setAlertStatus] = useState<Status | undefined>(
+    (ecsRowData.signal?.status && (ecsRowData.signal.status[0] as Status)) ?? undefined
+  );
+  const eventId = ecsRowData._id;
+
+  const { addWarning } = useAppToasts();
+
+  const onButtonClick = useCallback(() => {
+    setPopover(!isPopoverOpen);
+  }, [isPopoverOpen]);
+
+  const closePopover = useCallback(() => {
+    setPopover(false);
+  }, []);
+  const [shouldShowAddExceptionModal, setShouldShowAddExceptionModal] = useState(false);
+  const [addExceptionModalState, setAddExceptionModalState] = useState<AddExceptionModalBaseProps>(
+    addExceptionModalInitialState
+  );
+  const [{ canUserCRUD, hasIndexWrite }] = useUserData();
+
+  const isEndpointAlert = useMemo(() => {
+    if (!nonEcsRowData) {
+      return false;
+    }
+
+    const [module] = getMappedNonEcsValue({
+      data: nonEcsRowData,
+      fieldName: 'signal.original_event.module',
+    });
+    const [kind] = getMappedNonEcsValue({
+      data: nonEcsRowData,
+      fieldName: 'signal.original_event.kind',
+    });
+    return module === 'endpoint' && kind === 'alert';
+  }, [nonEcsRowData]);
+
+  const closeAddExceptionModal = useCallback(() => {
+    setShouldShowAddExceptionModal(false);
+    setAddExceptionModalState(addExceptionModalInitialState);
+  }, [setShouldShowAddExceptionModal, setAddExceptionModalState]);
+
+  const onAddExceptionCancel = useCallback(() => {
+    closeAddExceptionModal();
+  }, [closeAddExceptionModal]);
+
+  const onAddExceptionConfirm = useCallback(
+    (didCloseAlert: boolean, didBulkCloseAlert) => {
+      closeAddExceptionModal();
+      if (didCloseAlert) {
+        setAlertStatus('closed');
+      }
+      if (timelineId !== TimelineId.active || didBulkCloseAlert) {
+        refetch();
+      }
+    },
+    [closeAddExceptionModal, timelineId, refetch]
+  );
+
+  const onAlertStatusUpdateSuccess = useCallback(
+    (updated: number, conflicts: number, newStatus: Status) => {
+      if (conflicts > 0) {
+        // Partial failure
+        addWarning({
+          title: i18nCommon.UPDATE_ALERT_STATUS_FAILED(conflicts),
+          text: i18nCommon.UPDATE_ALERT_STATUS_FAILED_DETAILED(updated, conflicts),
+        });
+      } else {
+        let title: string;
+        switch (newStatus) {
+          case 'closed':
+            title = i18n.CLOSED_ALERT_SUCCESS_TOAST(updated);
+            break;
+          case 'open':
+            title = i18n.OPENED_ALERT_SUCCESS_TOAST(updated);
+            break;
+          case 'in-progress':
+            title = i18n.IN_PROGRESS_ALERT_SUCCESS_TOAST(updated);
+        }
+        displaySuccessToast(title, dispatchToaster);
+      }
+      setAlertStatus(newStatus);
+    },
+    [dispatchToaster, addWarning]
+  );
+
+  const onAlertStatusUpdateFailure = useCallback(
+    (newStatus: Status, error: Error) => {
+      let title: string;
+      switch (newStatus) {
+        case 'closed':
+          title = i18n.CLOSED_ALERT_FAILED_TOAST;
+          break;
+        case 'open':
+          title = i18n.OPENED_ALERT_FAILED_TOAST;
+          break;
+        case 'in-progress':
+          title = i18n.IN_PROGRESS_ALERT_FAILED_TOAST;
+      }
+      displayErrorToast(title, [error.message], dispatchToaster);
+    },
+    [dispatchToaster]
+  );
+
+  const setEventsLoading = useCallback(
+    ({ eventIds, isLoading }: SetEventsLoadingProps) => {
+      dispatch(timelineActions.setEventsLoading({ id: timelineId, eventIds, isLoading }));
+    },
+    [dispatch, timelineId]
+  );
+
+  const setEventsDeleted = useCallback(
+    ({ eventIds, isDeleted }: SetEventsDeletedProps) => {
+      dispatch(timelineActions.setEventsDeleted({ id: timelineId, eventIds, isDeleted }));
+    },
+    [dispatch, timelineId]
+  );
+
+  const openAlertActionOnClick = useCallback(() => {
+    updateAlertStatusAction({
+      alertIds: [eventId],
+      onAlertStatusUpdateFailure,
+      onAlertStatusUpdateSuccess,
+      setEventsDeleted,
+      setEventsLoading,
+      selectedStatus: FILTER_OPEN,
+    });
+    closePopover();
+  }, [
+    closePopover,
+    eventId,
+    onAlertStatusUpdateFailure,
+    onAlertStatusUpdateSuccess,
+    setEventsDeleted,
+    setEventsLoading,
+  ]);
+
+  const openAlertActionComponent = (
+    <EuiContextMenuItem
+      key="open-alert"
+      aria-label="Open alert"
+      data-test-subj="open-alert-status"
+      id={FILTER_OPEN}
+      onClick={openAlertActionOnClick}
+      disabled={!canUserCRUD || !hasIndexWrite}
+    >
+      <EuiText size="m">{i18n.ACTION_OPEN_ALERT}</EuiText>
+    </EuiContextMenuItem>
+  );
+
+  const closeAlertActionClick = useCallback(() => {
+    updateAlertStatusAction({
+      alertIds: [eventId],
+      onAlertStatusUpdateFailure,
+      onAlertStatusUpdateSuccess,
+      setEventsDeleted,
+      setEventsLoading,
+      selectedStatus: FILTER_CLOSED,
+    });
+    closePopover();
+  }, [
+    closePopover,
+    eventId,
+    onAlertStatusUpdateFailure,
+    onAlertStatusUpdateSuccess,
+    setEventsDeleted,
+    setEventsLoading,
+  ]);
+
+  const closeAlertActionComponent = (
+    <EuiContextMenuItem
+      key="close-alert"
+      aria-label="Close alert"
+      data-test-subj="close-alert-status"
+      id={FILTER_CLOSED}
+      onClick={closeAlertActionClick}
+      disabled={!canUserCRUD || !hasIndexWrite}
+    >
+      <EuiText size="m">{i18n.ACTION_CLOSE_ALERT}</EuiText>
+    </EuiContextMenuItem>
+  );
+
+  const inProgressAlertActionClick = useCallback(() => {
+    updateAlertStatusAction({
+      alertIds: [eventId],
+      onAlertStatusUpdateFailure,
+      onAlertStatusUpdateSuccess,
+      setEventsDeleted,
+      setEventsLoading,
+      selectedStatus: FILTER_IN_PROGRESS,
+    });
+    closePopover();
+  }, [
+    closePopover,
+    eventId,
+    onAlertStatusUpdateFailure,
+    onAlertStatusUpdateSuccess,
+    setEventsDeleted,
+    setEventsLoading,
+  ]);
+
+  const inProgressAlertActionComponent = (
+    <EuiContextMenuItem
+      key="in-progress-alert"
+      aria-label="Mark alert in progress"
+      data-test-subj="in-progress-alert-status"
+      id={FILTER_IN_PROGRESS}
+      onClick={inProgressAlertActionClick}
+      disabled={!canUserCRUD || !hasIndexWrite}
+    >
+      <EuiText size="m">{i18n.ACTION_IN_PROGRESS_ALERT}</EuiText>
+    </EuiContextMenuItem>
+  );
+
+  const openAddExceptionModal = useCallback(
+    ({
+      ruleName,
+      ruleIndices,
+      ruleId,
+      exceptionListType,
+      alertData,
+    }: AddExceptionModalBaseProps) => {
+      if (alertData !== null && alertData !== undefined) {
+        setShouldShowAddExceptionModal(true);
+        setAddExceptionModalState({
+          ruleName,
+          ruleId,
+          ruleIndices,
+          exceptionListType,
+          alertData,
+        });
+      }
+    },
+    [setShouldShowAddExceptionModal, setAddExceptionModalState]
+  );
+
+  const AddExceptionModal = useCallback(
+    () =>
+      shouldShowAddExceptionModal === true && addExceptionModalState.alertData !== null ? (
+        <AddExceptionModalComponent
+          ruleName={addExceptionModalState.ruleName}
+          ruleId={addExceptionModalState.ruleId}
+          ruleIndices={addExceptionModalState.ruleIndices}
+          exceptionListType={addExceptionModalState.exceptionListType}
+          alertData={addExceptionModalState.alertData}
+          onCancel={onAddExceptionCancel}
+          onConfirm={onAddExceptionConfirm}
+          alertStatus={alertStatus}
+        />
+      ) : null,
+    [
+      shouldShowAddExceptionModal,
+      addExceptionModalState.alertData,
+      addExceptionModalState.ruleName,
+      addExceptionModalState.ruleId,
+      addExceptionModalState.ruleIndices,
+      addExceptionModalState.exceptionListType,
+      onAddExceptionCancel,
+      onAddExceptionConfirm,
+      alertStatus,
+    ]
+  );
+
+  const button = (
+    <EuiButtonIcon
+      aria-label="context menu"
+      data-test-subj="timeline-context-menu-button"
+      size="s"
+      iconType="boxesHorizontal"
+      onClick={onButtonClick}
+      disabled={disabled}
+    />
+  );
+
+  const handleAddEndpointExceptionClick = useCallback(() => {
+    const [ruleName] = getMappedNonEcsValue({
+      data: nonEcsRowData,
+      fieldName: 'signal.rule.name',
+    });
+    const [ruleId] = getMappedNonEcsValue({
+      data: nonEcsRowData,
+      fieldName: 'signal.rule.id',
+    });
+    const ruleIndices = getMappedNonEcsValue({
+      data: nonEcsRowData,
+      fieldName: 'signal.rule.index',
+    });
+
+    closePopover();
+
+    if (ruleId !== undefined) {
+      openAddExceptionModal({
+        ruleName: ruleName ?? '',
+        ruleId,
+        ruleIndices: ruleIndices.length > 0 ? ruleIndices : DEFAULT_INDEX_PATTERN,
+        exceptionListType: 'endpoint',
+        alertData: {
+          ecsData: ecsRowData,
+          nonEcsData: nonEcsRowData,
+        },
+      });
+    }
+  }, [closePopover, ecsRowData, nonEcsRowData, openAddExceptionModal]);
+
+  const addEndpointExceptionComponent = (
+    <EuiContextMenuItem
+      key="add-endpoint-exception-menu-item"
+      aria-label="Add Endpoint Exception"
+      data-test-subj="add-endpoint-exception-menu-item"
+      id="addEndpointException"
+      onClick={handleAddEndpointExceptionClick}
+      disabled={!canUserCRUD || !hasIndexWrite || !isEndpointAlert}
+    >
+      <EuiText size="m">{i18n.ACTION_ADD_ENDPOINT_EXCEPTION}</EuiText>
+    </EuiContextMenuItem>
+  );
+
+  const handleAddExceptionClick = useCallback(() => {
+    const [ruleName] = getMappedNonEcsValue({
+      data: nonEcsRowData,
+      fieldName: 'signal.rule.name',
+    });
+    const [ruleId] = getMappedNonEcsValue({
+      data: nonEcsRowData,
+      fieldName: 'signal.rule.id',
+    });
+    const ruleIndices = getMappedNonEcsValue({
+      data: nonEcsRowData,
+      fieldName: 'signal.rule.index',
+    });
+
+    closePopover();
+
+    if (ruleId !== undefined) {
+      openAddExceptionModal({
+        ruleName: ruleName ?? '',
+        ruleId,
+        ruleIndices: ruleIndices.length > 0 ? ruleIndices : DEFAULT_INDEX_PATTERN,
+        exceptionListType: 'detection',
+        alertData: {
+          ecsData: ecsRowData,
+          nonEcsData: nonEcsRowData,
+        },
+      });
+    }
+  }, [closePopover, ecsRowData, nonEcsRowData, openAddExceptionModal]);
+
+  const areExceptionsAllowed = useMemo(() => {
+    const ruleTypes = getMappedNonEcsValue({
+      data: nonEcsRowData,
+      fieldName: 'signal.rule.type',
+    });
+    const [ruleType] = ruleTypes as Type[];
+    return !isMlRule(ruleType) && !isThresholdRule(ruleType);
+  }, [nonEcsRowData]);
+
+  const addExceptionComponent = (
+    <EuiContextMenuItem
+      key="add-exception-menu-item"
+      aria-label="Add Exception"
+      data-test-subj="add-exception-menu-item"
+      id="addException"
+      onClick={handleAddExceptionClick}
+      disabled={!canUserCRUD || !hasIndexWrite || !areExceptionsAllowed}
+    >
+      <EuiText size="m">{i18n.ACTION_ADD_EXCEPTION}</EuiText>
+    </EuiContextMenuItem>
+  );
+
+  const statusFilters = useMemo(() => {
+    if (!alertStatus) {
+      return [];
+    }
+
+    switch (alertStatus) {
+      case 'open':
+        return [inProgressAlertActionComponent, closeAlertActionComponent];
+      case 'in-progress':
+        return [openAlertActionComponent, closeAlertActionComponent];
+      case 'closed':
+        return [openAlertActionComponent, inProgressAlertActionComponent];
+      default:
+        return [];
+    }
+  }, [
+    alertStatus,
+    closeAlertActionComponent,
+    inProgressAlertActionComponent,
+    openAlertActionComponent,
+  ]);
+
+  const items = useMemo(
+    () => [...statusFilters, addEndpointExceptionComponent, addExceptionComponent],
+    [addEndpointExceptionComponent, addExceptionComponent, statusFilters]
+  );
+
+  return (
+    <>
+      <EventsTd key="actions-context-menu">
+        <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
+          <EuiPopover
+            id="singlePanel"
+            button={button}
+            isOpen={isPopoverOpen}
+            closePopover={closePopover}
+            panelPaddingSize="none"
+            anchorPosition="downLeft"
+            repositionOnScroll
+          >
+            <ContextMenuPanel items={items} />
+          </EuiPopover>
+        </EventsTdContent>
+      </EventsTd>
+      <AddExceptionModal />
+    </>
+  );
+};
+
+const ContextMenuPanel = styled(EuiContextMenuPanel)`
+  font-size: ${({ theme }) => theme.eui.euiFontSizeS};
+`;
+
+ContextMenuPanel.displayName = 'ContextMenuPanel';
+
+export const AlertContextMenu = React.memo(AlertContextMenuComponent);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
new file mode 100644
index 00000000000000..f4080de5b4ba1f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useCallback } from 'react';
+import { useDispatch } from 'react-redux';
+
+import { TimelineId } from '../../../../../common/types/timeline';
+import { TimelineNonEcsData, Ecs } from '../../../../../public/graphql/types';
+import { timelineActions } from '../../../../timelines/store/timeline';
+import { useApolloClient } from '../../../../common/utils/apollo_context';
+import { sendAlertToTimelineAction } from '../actions';
+import { dispatchUpdateTimeline } from '../../../../timelines/components/open_timeline/helpers';
+import { ActionIconItem } from '../../../../timelines/components/timeline/body/actions/action_icon_item';
+
+import { CreateTimelineProps } from '../types';
+import {
+  ACTION_INVESTIGATE_IN_TIMELINE,
+  ACTION_INVESTIGATE_IN_TIMELINE_ARIA_LABEL,
+} from '../translations';
+
+interface InvestigateInTimelineActionProps {
+  ecsRowData: Ecs;
+  nonEcsRowData: TimelineNonEcsData[];
+}
+
+const InvestigateInTimelineActionComponent: React.FC<InvestigateInTimelineActionProps> = ({
+  ecsRowData,
+  nonEcsRowData,
+}) => {
+  const dispatch = useDispatch();
+  const apolloClient = useApolloClient();
+
+  const updateTimelineIsLoading = useCallback(
+    (payload) => dispatch(timelineActions.updateIsLoading(payload)),
+    [dispatch]
+  );
+
+  const createTimeline = useCallback(
+    ({ from: fromTimeline, timeline, to: toTimeline, ruleNote }: CreateTimelineProps) => {
+      updateTimelineIsLoading({ id: TimelineId.active, isLoading: false });
+      dispatchUpdateTimeline(dispatch)({
+        duplicate: true,
+        from: fromTimeline,
+        id: TimelineId.active,
+        notes: [],
+        timeline: {
+          ...timeline,
+          show: true,
+        },
+        to: toTimeline,
+        ruleNote,
+      })();
+    },
+    [dispatch, updateTimelineIsLoading]
+  );
+
+  const investigateInTimelineAlertClick = useCallback(
+    () =>
+      sendAlertToTimelineAction({
+        apolloClient,
+        createTimeline,
+        ecsData: ecsRowData,
+        nonEcsData: nonEcsRowData,
+        updateTimelineIsLoading,
+      }),
+    [apolloClient, createTimeline, ecsRowData, nonEcsRowData, updateTimelineIsLoading]
+  );
+
+  return (
+    <ActionIconItem
+      ariaLabel={ACTION_INVESTIGATE_IN_TIMELINE_ARIA_LABEL}
+      content={ACTION_INVESTIGATE_IN_TIMELINE}
+      dataTestSubj="send-alert-to-timeline"
+      iconType="timeline"
+      id="sendAlertToTimeline"
+      onClick={investigateInTimelineAlertClick}
+      isDisabled={false}
+    />
+  );
+};
+
+export const InvestigateInTimelineAction = React.memo(InvestigateInTimelineActionComponent);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
index 3d6c3dc0a7a8e5..b4da0267d2ea5d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
@@ -115,6 +115,13 @@ export const ACTION_INVESTIGATE_IN_TIMELINE = i18n.translate(
   }
 );
 
+export const ACTION_INVESTIGATE_IN_TIMELINE_ARIA_LABEL = i18n.translate(
+  'xpack.securitySolution.detectionEngine.alerts.actions.investigateInTimelineAriaLabel',
+  {
+    defaultMessage: 'Send alert to timeline',
+  }
+);
+
 export const ACTION_ADD_EXCEPTION = i18n.translate(
   'xpack.securitySolution.detectionEngine.alerts.actions.addException',
   {
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
index 2e77e77f6b3d50..f8b3cd6af8b8a2 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
@@ -41,11 +41,10 @@ export type UpdateAlertsStatus = ({
 export interface UpdateAlertStatusActionProps {
   query?: string;
   alertIds: string[];
-  status: Status;
   selectedStatus: Status;
   setEventsLoading: ({ eventIds, isLoading }: SetEventsLoadingProps) => void;
   setEventsDeleted: ({ eventIds, isDeleted }: SetEventsDeletedProps) => void;
-  onAlertStatusUpdateSuccess: (count: number, status: Status) => void;
+  onAlertStatusUpdateSuccess: (updated: number, conflicts: number, status: Status) => void;
   onAlertStatusUpdateFailure: (status: Status, error: Error) => void;
 }
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.test.tsx
index 0d98a0f2f26ff5..073cb46d3949a3 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.test.tsx
@@ -140,7 +140,11 @@ describe('helpers', () => {
         filterManager: mockFilterManager,
         query: mockQueryBarWithFilters.query,
         savedId: mockQueryBarWithFilters.saved_id,
-        indexPatterns: { fields: [{ name: 'test name', type: 'test type' }], title: 'test title' },
+        indexPatterns: {
+          fields: [{ name: 'event.category', type: 'test type' }],
+          title: 'test title',
+          getFormatterForField: () => ({ convert: (val: unknown) => val }),
+        },
       });
       const wrapper = shallow<React.ReactElement>(result[0].description as React.ReactElement);
       const filterLabelComponent = wrapper.find(esFilters.FilterLabel).at(0);
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx
index 3a0a5b04c58740..680ca78fc222e8 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx
@@ -24,8 +24,7 @@ import styled from 'styled-components';
 import { assertUnreachable } from '../../../../../common/utility_types';
 import * as i18nSeverity from '../severity_mapping/translations';
 import * as i18nRiskScore from '../risk_score_mapping/translations';
-import { Threshold } from '../../../../../common/detection_engine/schemas/common/schemas';
-import { RuleType } from '../../../../../common/detection_engine/types';
+import { Threshold, Type } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { esFilters } from '../../../../../../../../src/plugins/data/public';
 
 import { tacticsOptions, techniquesOptions } from '../../../mitre/mitre_tactics_techniques';
@@ -357,7 +356,7 @@ export const buildNoteDescription = (label: string, note: string): ListItems[] =
   return [];
 };
 
-export const buildRuleTypeDescription = (label: string, ruleType: RuleType): ListItems[] => {
+export const buildRuleTypeDescription = (label: string, ruleType: Type): ListItems[] => {
   switch (ruleType) {
     case 'machine_learning': {
       return [
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.test.tsx
index 8b3d05ce5a574f..8179e5865e4efc 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.test.tsx
@@ -7,7 +7,7 @@ import React from 'react';
 import { shallow, mount } from 'enzyme';
 
 import {
-  StepRuleDescriptionComponent,
+  StepRuleDescription,
   addFilterStateIfNotThere,
   buildListItems,
   getDescriptionItem,
@@ -52,24 +52,24 @@ describe('description_step', () => {
     mockAboutStep = mockAboutStepRule();
   });
 
-  describe('StepRuleDescriptionComponent', () => {
+  describe('StepRuleDescription', () => {
     test('renders tow columns when "columns" is "multi"', () => {
       const wrapper = shallow(
-        <StepRuleDescriptionComponent columns="multi" data={mockAboutStep} schema={schema} />
+        <StepRuleDescription columns="multi" data={mockAboutStep} schema={schema} />
       );
       expect(wrapper.find('[data-test-subj="listItemColumnStepRuleDescription"]')).toHaveLength(2);
     });
 
     test('renders single column when "columns" is "single"', () => {
       const wrapper = shallow(
-        <StepRuleDescriptionComponent columns="single" data={mockAboutStep} schema={schema} />
+        <StepRuleDescription columns="single" data={mockAboutStep} schema={schema} />
       );
       expect(wrapper.find('[data-test-subj="listItemColumnStepRuleDescription"]')).toHaveLength(1);
     });
 
     test('renders one column with title and description split when "columns" is "singleSplit', () => {
       const wrapper = shallow(
-        <StepRuleDescriptionComponent columns="singleSplit" data={mockAboutStep} schema={schema} />
+        <StepRuleDescription columns="singleSplit" data={mockAboutStep} schema={schema} />
       );
       expect(wrapper.find('[data-test-subj="listItemColumnStepRuleDescription"]')).toHaveLength(1);
       expect(
@@ -299,7 +299,6 @@ describe('description_step', () => {
     describe('queryBar', () => {
       test('returns array of ListItems when queryBar exist', () => {
         const mockQueryBar = {
-          isNew: false,
           queryBar: {
             query: {
               query: 'user.name: root or user.name: admin',
@@ -369,7 +368,6 @@ describe('description_step', () => {
     describe('threshold', () => {
       test('returns threshold description when threshold exist and field is empty', () => {
         const mockThreshold = {
-          isNew: false,
           threshold: {
             field: [''],
             value: 100,
@@ -391,7 +389,6 @@ describe('description_step', () => {
 
       test('returns threshold description when threshold exist and field is set', () => {
         const mockThreshold = {
-          isNew: false,
           threshold: {
             field: ['user.name'],
             value: 100,
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.tsx
index 00141c9a453d82..99e36669f78bb6 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.tsx
@@ -9,7 +9,6 @@ import { isEmpty, chunk, get, pick, isNumber } from 'lodash/fp';
 import React, { memo, useState } from 'react';
 import styled from 'styled-components';
 
-import { RuleType } from '../../../../../common/detection_engine/types';
 import {
   IIndexPattern,
   Filter,
@@ -38,10 +37,10 @@ import {
   buildRuleTypeDescription,
   buildThresholdDescription,
 } from './helpers';
-import { useSecurityJobs } from '../../../../common/components/ml_popover/hooks/use_security_jobs';
 import { buildMlJobDescription } from './ml_job_description';
 import { buildActionsDescription } from './actions_description';
 import { buildThrottleDescription } from './throttle_description';
+import { Type } from '../../../../../common/detection_engine/schemas/common/schemas';
 
 const DescriptionListContainer = styled(EuiDescriptionList)`
   &.euiDescriptionList--column .euiDescriptionList__title {
@@ -52,22 +51,21 @@ const DescriptionListContainer = styled(EuiDescriptionList)`
   }
 `;
 
-interface StepRuleDescriptionProps {
+interface StepRuleDescriptionProps<T> {
   columns?: 'multi' | 'single' | 'singleSplit';
   data: unknown;
   indexPatterns?: IIndexPattern;
-  schema: FormSchema;
+  schema: FormSchema<T>;
 }
 
-export const StepRuleDescriptionComponent: React.FC<StepRuleDescriptionProps> = ({
+export const StepRuleDescriptionComponent = <T,>({
   data,
   columns = 'multi',
   indexPatterns,
   schema,
-}) => {
+}: StepRuleDescriptionProps<T>) => {
   const kibana = useKibana();
   const [filterManager] = useState<FilterManager>(new FilterManager(kibana.services.uiSettings));
-  const { jobs } = useSecurityJobs(false);
 
   const keys = Object.keys(schema);
   const listItems = keys.reduce((acc: ListItems[], key: string) => {
@@ -76,8 +74,7 @@ export const StepRuleDescriptionComponent: React.FC<StepRuleDescriptionProps> =
         ...acc,
         buildMlJobDescription(
           get(key, data) as string,
-          (get(key, schema) as { label: string }).label,
-          jobs
+          (get(key, schema) as { label: string }).label
         ),
       ];
     }
@@ -125,11 +122,13 @@ export const StepRuleDescriptionComponent: React.FC<StepRuleDescriptionProps> =
   );
 };
 
-export const StepRuleDescription = memo(StepRuleDescriptionComponent);
+export const StepRuleDescription = memo(
+  StepRuleDescriptionComponent
+) as typeof StepRuleDescriptionComponent;
 
-export const buildListItems = (
+export const buildListItems = <T,>(
   data: unknown,
-  schema: FormSchema,
+  schema: FormSchema<T>,
   filterManager: FilterManager,
   indexPatterns?: IIndexPattern
 ): ListItems[] =>
@@ -211,7 +210,7 @@ export const getDescriptionItem = (
     const val: string = get(field, data);
     return buildNoteDescription(label, val);
   } else if (field === 'ruleType') {
-    const ruleType: RuleType = get(field, data);
+    const ruleType: Type = get(field, data);
     return buildRuleTypeDescription(label, ruleType);
   } else if (field === 'kibanaSiemAppUrl') {
     return [];
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/ml_job_description.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/ml_job_description.test.tsx
index 3152fef12c6523..ec46610286b46d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/ml_job_description.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/ml_job_description.test.tsx
@@ -14,7 +14,7 @@ jest.mock('../../../../common/lib/kibana');
 
 describe('MlJobDescription', () => {
   it('renders correctly', () => {
-    const wrapper = shallow(<MlJobDescription job={mockOpenedJob} />);
+    const wrapper = shallow(<MlJobDescription jobId={'myJobId'} />);
 
     expect(wrapper.find('[data-test-subj="machineLearningJobId"]')).toHaveLength(1);
   });
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/ml_job_description.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/ml_job_description.tsx
index 6baa2abab33d1a..414f6f2c2d3bb9 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/ml_job_description.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/ml_job_description.tsx
@@ -10,6 +10,7 @@ import { EuiBadge, EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
 
 import { MlSummaryJob } from '../../../../../../ml/public';
 import { isJobStarted } from '../../../../../common/machine_learning/helpers';
+import { useSecurityJobs } from '../../../../common/components/ml_popover/hooks/use_security_jobs';
 import { useKibana } from '../../../../common/lib/kibana';
 import { ListItems } from './types';
 import { ML_JOB_STARTED, ML_JOB_STOPPED } from './translations';
@@ -69,35 +70,33 @@ const Wrapper = styled.div`
   overflow: hidden;
 `;
 
-const MlJobDescriptionComponent: React.FC<{ job: MlSummaryJob }> = ({ job }) => {
+const MlJobDescriptionComponent: React.FC<{ jobId: string }> = ({ jobId }) => {
+  const { jobs } = useSecurityJobs(false);
   const jobUrl = useKibana().services.application.getUrlForApp(
-    `ml#/jobs?mlManagement=(jobId:${encodeURI(job.id)})`
+    `ml#/jobs?mlManagement=(jobId:${encodeURI(jobId)})`
   );
+  const job = jobs.find(({ id }) => id === jobId);
 
-  return (
+  const jobIdSpan = <span data-test-subj="machineLearningJobId">{jobId}</span>;
+
+  return job != null ? (
     <Wrapper>
       <div>
-        <JobLink data-test-subj="machineLearningJobId" href={jobUrl} target="_blank">
-          {job.id}
+        <JobLink href={jobUrl} target="_blank">
+          {jobIdSpan}
         </JobLink>
         <AuditIcon message={job.auditMessage} />
       </div>
       <JobStatusBadge job={job} />
     </Wrapper>
+  ) : (
+    jobIdSpan
   );
 };
 
 export const MlJobDescription = React.memo(MlJobDescriptionComponent);
 
-export const buildMlJobDescription = (
-  jobId: string,
-  label: string,
-  jobs: MlSummaryJob[]
-): ListItems => {
-  const job = jobs.find(({ id }) => id === jobId);
-
-  return {
-    title: label,
-    description: job ? <MlJobDescription job={job} /> : jobId,
-  };
-};
+export const buildMlJobDescription = (jobId: string, label: string): ListItems => ({
+  title: label,
+  description: <MlJobDescription jobId={jobId} />,
+});
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/next_step/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/next_step/index.tsx
index d97c2b4c8c0aa4..7c8f5230cc8baa 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/next_step/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/next_step/index.tsx
@@ -9,7 +9,7 @@ import { EuiHorizontalRule, EuiFlexGroup, EuiFlexItem, EuiButton } from '@elasti
 import * as RuleI18n from '../../../pages/detection_engine/rules/translations';
 
 interface NextStepProps {
-  onClick: () => Promise<void>;
+  onClick: () => void;
   isDisabled: boolean;
   dataTestSubj?: string;
 }
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
index c6ea269e1a355a..6f5f3361d2b3e1 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
@@ -9,11 +9,11 @@ import { EuiCard, EuiFlexGrid, EuiFlexItem, EuiFormRow, EuiIcon } from '@elastic
 
 import { isMlRule } from '../../../../../common/machine_learning/helpers';
 import { isThresholdRule } from '../../../../../common/detection_engine/utils';
-import { RuleType } from '../../../../../common/detection_engine/types';
 import { FieldHook } from '../../../../shared_imports';
 import { useKibana } from '../../../../common/lib/kibana';
 import * as i18n from './translations';
 import { MlCardDescription } from './ml_card_description';
+import { Type } from '../../../../../common/detection_engine/schemas/common/schemas';
 
 interface SelectRuleTypeProps {
   describedByIds?: string[];
@@ -30,9 +30,9 @@ export const SelectRuleType: React.FC<SelectRuleTypeProps> = ({
   hasValidLicense = false,
   isMlAdmin = false,
 }) => {
-  const ruleType = field.value as RuleType;
+  const ruleType = field.value as Type;
   const setType = useCallback(
-    (type: RuleType) => {
+    (type: Type) => {
       field.setValue(type);
     },
     [field]
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/data.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/data.tsx
index 1ef3edf8c720e4..08cea23d89e1e9 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/data.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/data.tsx
@@ -8,12 +8,12 @@ import styled from 'styled-components';
 import { EuiHealth } from '@elastic/eui';
 import euiLightVars from '@elastic/eui/dist/eui_theme_light.json';
 import React from 'react';
-import * as I18n from './translations';
 
-export type SeverityValue = 'low' | 'medium' | 'high' | 'critical';
+import { Severity } from '../../../../../common/detection_engine/schemas/common/schemas';
+import * as I18n from './translations';
 
 export interface SeverityOptionItem {
-  value: SeverityValue;
+  value: Severity;
   inputDisplay: React.ReactElement;
 }
 
@@ -44,7 +44,7 @@ export const severityOptions: SeverityOptionItem[] = [
   },
 ];
 
-export const defaultRiskScoreBySeverity: Record<SeverityValue, number> = {
+export const defaultRiskScoreBySeverity: Record<Severity, number> = {
   low: 21,
   medium: 47,
   high: 73,
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/default_value.ts b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/default_value.ts
index b9c3e4f84c18ee..56c61c2ad67665 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/default_value.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/default_value.ts
@@ -21,9 +21,8 @@ export const stepAboutDefaultValue: AboutStepRule = {
   description: '',
   isAssociatedToEndpointList: false,
   isBuildingBlock: false,
-  isNew: true,
   severity: { value: 'low', mapping: fillEmptySeverityMappings([]), isMappingChecked: false },
-  riskScore: { value: 50, mapping: [], isMappingChecked: false },
+  riskScore: { value: 21, mapping: [], isMappingChecked: false },
   references: [''],
   falsePositives: [''],
   license: '',
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.test.tsx
index 0c834b9fff33af..cb25785eaa5b29 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.test.tsx
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import React from 'react';
-import { act } from 'react-dom/test-utils';
 import { mount, shallow } from 'enzyme';
 import { ThemeProvider } from 'styled-components';
 import euiDarkVars from '@elastic/eui/dist/eui_theme_light.json';
@@ -14,9 +13,11 @@ import { StepAboutRule } from '.';
 import { mockAboutStepRule } from '../../../pages/detection_engine/rules/all/__mocks__/mock';
 import { StepRuleDescription } from '../description_step';
 import { stepAboutDefaultValue } from './default_value';
-// we don't have the types for waitFor just yet, so using "as waitFor" until when we do
-import { wait as waitFor } from '@testing-library/react';
-import { AboutStepRule } from '../../../pages/detection_engine/rules/types';
+import {
+  AboutStepRule,
+  RuleStepsFormHooks,
+  RuleStep,
+} from '../../../pages/detection_engine/rules/types';
 import { fillEmptySeverityMappings } from '../../../pages/detection_engine/rules/helpers';
 
 const theme = () => ({ eui: euiDarkVars, darkMode: true });
@@ -33,6 +34,18 @@ afterAll(() => {
 /* eslint-enable no-console */
 
 describe('StepAboutRuleComponent', () => {
+  let formHook: RuleStepsFormHooks[RuleStep.aboutRule] | null = null;
+  const setFormHook = <K extends keyof RuleStepsFormHooks>(
+    step: K,
+    hook: RuleStepsFormHooks[K]
+  ) => {
+    formHook = hook as typeof formHook;
+  };
+
+  beforeEach(() => {
+    formHook = null;
+  });
+
   test('it renders StepRuleDescription if isReadOnlyView is true and "name" property exists', () => {
     const wrapper = shallow(
       <StepAboutRule
@@ -47,7 +60,7 @@ describe('StepAboutRuleComponent', () => {
     expect(wrapper.find(StepRuleDescription).exists()).toBeTruthy();
   });
 
-  test('it prevents user from clicking continue if no "description" defined', () => {
+  it('is invalid if description is not present', async () => {
     const wrapper = mount(
       <ThemeProvider theme={theme}>
         <StepAboutRule
@@ -55,43 +68,26 @@ describe('StepAboutRuleComponent', () => {
           defaultValues={stepAboutDefaultValue}
           descriptionColumns="multi"
           isReadOnlyView={false}
+          setForm={setFormHook}
           isLoading={false}
-          setForm={jest.fn()}
-          setStepData={jest.fn()}
         />
       </ThemeProvider>
     );
 
+    if (!formHook) {
+      throw new Error('Form hook not set, but tests depend on it');
+    }
+
     wrapper
       .find('[data-test-subj="detectionEngineStepAboutRuleName"] input')
       .first()
       .simulate('change', { target: { value: 'Test name text' } });
 
-    const descriptionInput = wrapper
-      .find('[data-test-subj="detectionEngineStepAboutRuleDescription"] textarea')
-      .first();
-    wrapper.find('button[data-test-subj="about-continue"]').first().simulate('click');
-
-    expect(
-      wrapper.find('[data-test-subj="detectionEngineStepAboutRuleName"] input').first().props()
-        .value
-    ).toEqual('Test name text');
-    expect(descriptionInput.props().value).toEqual('');
-    expect(
-      wrapper
-        .find('[data-test-subj="detectionEngineStepAboutRuleDescription"] label')
-        .first()
-        .hasClass('euiFormLabel-isInvalid')
-    ).toBeTruthy();
-    expect(
-      wrapper
-        .find('[data-test-subj="detectionEngineStepAboutRuleDescription"] EuiTextArea')
-        .first()
-        .prop('isInvalid')
-    ).toBeTruthy();
+    const result = await formHook();
+    expect(result?.isValid).toEqual(false);
   });
 
-  test('it prevents user from clicking continue if no "name" defined', () => {
+  it('is invalid if no "name" is present', async () => {
     const wrapper = mount(
       <ThemeProvider theme={theme}>
         <StepAboutRule
@@ -99,47 +95,26 @@ describe('StepAboutRuleComponent', () => {
           defaultValues={stepAboutDefaultValue}
           descriptionColumns="multi"
           isReadOnlyView={false}
+          setForm={setFormHook}
           isLoading={false}
-          setForm={jest.fn()}
-          setStepData={jest.fn()}
         />
       </ThemeProvider>
     );
 
+    if (!formHook) {
+      throw new Error('Form hook not set, but tests depend on it');
+    }
+
     wrapper
       .find('[data-test-subj="detectionEngineStepAboutRuleDescription"] textarea')
       .first()
       .simulate('change', { target: { value: 'Test description text' } });
 
-    const nameInput = wrapper
-      .find('[data-test-subj="detectionEngineStepAboutRuleName"] input')
-      .first();
-
-    wrapper.find('button[data-test-subj="about-continue"]').first().simulate('click');
-
-    expect(
-      wrapper
-        .find('[data-test-subj="detectionEngineStepAboutRuleDescription"] textarea')
-        .first()
-        .props().value
-    ).toEqual('Test description text');
-    expect(nameInput.props().value).toEqual('');
-    expect(
-      wrapper
-        .find('[data-test-subj="detectionEngineStepAboutRuleName"] label')
-        .first()
-        .hasClass('euiFormLabel-isInvalid')
-    ).toBeTruthy();
-    expect(
-      wrapper
-        .find('[data-test-subj="detectionEngineStepAboutRuleName"] EuiFieldText')
-        .first()
-        .prop('isInvalid')
-    ).toBeTruthy();
+    const result = await formHook();
+    expect(result?.isValid).toEqual(false);
   });
 
-  test('it allows user to click continue if "name" and "description" are defined', async () => {
-    const stepDataMock = jest.fn();
+  it('is valid if both "name" and "description" are present', async () => {
     const wrapper = mount(
       <ThemeProvider theme={theme}>
         <StepAboutRule
@@ -147,54 +122,55 @@ describe('StepAboutRuleComponent', () => {
           defaultValues={stepAboutDefaultValue}
           descriptionColumns="multi"
           isReadOnlyView={false}
+          setForm={setFormHook}
           isLoading={false}
-          setForm={jest.fn()}
-          setStepData={stepDataMock}
         />
       </ThemeProvider>
     );
 
+    if (!formHook) {
+      throw new Error('Form hook not set, but tests depend on it');
+    }
+
     wrapper
       .find('[data-test-subj="detectionEngineStepAboutRuleDescription"] textarea')
       .first()
       .simulate('change', { target: { value: 'Test description text' } });
-
     wrapper
       .find('[data-test-subj="detectionEngineStepAboutRuleName"] input')
       .first()
       .simulate('change', { target: { value: 'Test name text' } });
 
-    wrapper.find('button[data-test-subj="about-continue"]').first().simulate('click').update();
-    await waitFor(() => {
-      const expected: Omit<AboutStepRule, 'isNew'> = {
-        author: [],
-        isAssociatedToEndpointList: false,
-        isBuildingBlock: false,
-        license: '',
-        ruleNameOverride: '',
-        timestampOverride: '',
-        description: 'Test description text',
-        falsePositives: [''],
-        name: 'Test name text',
-        note: '',
-        references: [''],
-        riskScore: { value: 50, mapping: [], isMappingChecked: false },
-        severity: { value: 'low', mapping: fillEmptySeverityMappings([]), isMappingChecked: false },
-        tags: [],
-        threat: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: { id: 'none', name: 'none', reference: 'none' },
-            technique: [],
-          },
-        ],
-      };
-      expect(stepDataMock.mock.calls[1][1]).toEqual(expected);
-    });
+    const expected: AboutStepRule = {
+      author: [],
+      isAssociatedToEndpointList: false,
+      isBuildingBlock: false,
+      license: '',
+      ruleNameOverride: '',
+      timestampOverride: '',
+      description: 'Test description text',
+      falsePositives: [''],
+      name: 'Test name text',
+      note: '',
+      references: [''],
+      riskScore: { value: 21, mapping: [], isMappingChecked: false },
+      severity: { value: 'low', mapping: fillEmptySeverityMappings([]), isMappingChecked: false },
+      tags: [],
+      threat: [
+        {
+          framework: 'MITRE ATT&CK',
+          tactic: { id: 'none', name: 'none', reference: 'none' },
+          technique: [],
+        },
+      ],
+    };
+
+    const result = await formHook();
+    expect(result?.isValid).toEqual(true);
+    expect(result?.data).toEqual(expected);
   });
 
   test('it allows user to set the risk score as a number (and not a string)', async () => {
-    const stepDataMock = jest.fn();
     const wrapper = mount(
       <ThemeProvider theme={theme}>
         <StepAboutRule
@@ -202,13 +178,16 @@ describe('StepAboutRuleComponent', () => {
           defaultValues={stepAboutDefaultValue}
           descriptionColumns="multi"
           isReadOnlyView={false}
+          setForm={setFormHook}
           isLoading={false}
-          setForm={jest.fn()}
-          setStepData={stepDataMock}
         />
       </ThemeProvider>
     );
 
+    if (!formHook) {
+      throw new Error('Form hook not set, but tests depend on it');
+    }
+
     wrapper
       .find('[data-test-subj="detectionEngineStepAboutRuleName"] input')
       .first()
@@ -224,11 +203,7 @@ describe('StepAboutRuleComponent', () => {
       .first()
       .simulate('change', { target: { value: '80' } });
 
-    await act(async () => {
-      wrapper.find('[data-test-subj="about-continue"]').first().simulate('click').update();
-    });
-
-    const expected: Omit<AboutStepRule, 'isNew'> = {
+    const expected: AboutStepRule = {
       author: [],
       isAssociatedToEndpointList: false,
       isBuildingBlock: false,
@@ -251,6 +226,52 @@ describe('StepAboutRuleComponent', () => {
         },
       ],
     };
-    expect(stepDataMock.mock.calls[1][1]).toEqual(expected);
+
+    const result = await formHook();
+    expect(result?.isValid).toEqual(true);
+    expect(result?.data).toEqual(expected);
+  });
+
+  it('does not modify the provided risk score until the user changes the severity', async () => {
+    const wrapper = mount(
+      <ThemeProvider theme={theme}>
+        <StepAboutRule
+          addPadding={true}
+          defaultValues={stepAboutDefaultValue}
+          descriptionColumns="multi"
+          isReadOnlyView={false}
+          setForm={setFormHook}
+          isLoading={false}
+        />
+      </ThemeProvider>
+    );
+
+    if (!formHook) {
+      throw new Error('Form hook not set, but tests depend on it');
+    }
+
+    wrapper
+      .find('[data-test-subj="detectionEngineStepAboutRuleName"] input')
+      .first()
+      .simulate('change', { target: { value: 'Test name text' } });
+
+    wrapper
+      .find('[data-test-subj="detectionEngineStepAboutRuleDescription"] textarea')
+      .first()
+      .simulate('change', { target: { value: 'Test description text' } });
+
+    const result = await formHook();
+    expect(result?.isValid).toEqual(true);
+    expect(result?.data?.riskScore.value).toEqual(21);
+
+    wrapper
+      .find('[data-test-subj="detectionEngineStepAboutRuleSeverity"] [data-test-subj="select"]')
+      .last()
+      .simulate('click');
+    wrapper.find('button#medium').simulate('click');
+
+    const result2 = await formHook();
+    expect(result2?.isValid).toEqual(true);
+    expect(result2?.data?.riskScore.value).toEqual(47);
   });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
index 295b13717f0768..d2c84883fa99b5 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
@@ -22,13 +22,14 @@ import { AddMitreThreat } from '../mitre';
 import {
   Field,
   Form,
-  FormDataProvider,
   getUseField,
   UseField,
   useForm,
+  useFormData,
+  FieldHook,
 } from '../../../../shared_imports';
 
-import { defaultRiskScoreBySeverity, severityOptions, SeverityValue } from './data';
+import { defaultRiskScoreBySeverity, severityOptions } from './data';
 import { stepAboutDefaultValue } from './default_value';
 import { isUrlInvalid } from '../../../../common/utils/validators';
 import { schema } from './schema';
@@ -68,47 +69,69 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
   isReadOnlyView,
   isUpdateView = false,
   isLoading,
+  onSubmit,
   setForm,
-  setStepData,
 }) => {
   const initialState = defaultValues ?? stepAboutDefaultValue;
-  const [myStepData, setMyStepData] = useState<AboutStepRule>(initialState);
+  const [severityValue, setSeverityValue] = useState<string>(initialState.severity.value);
   const [{ isLoading: indexPatternLoading, indexPatterns }] = useFetchIndexPatterns(
     defineRuleData?.index ?? [],
-    'step_about_rule'
+    RuleStep.aboutRule
   );
   const canUseExceptions =
     defineRuleData?.ruleType &&
     !isMlRule(defineRuleData.ruleType) &&
     !isThresholdRule(defineRuleData.ruleType);
 
-  const { form } = useForm({
+  const { form } = useForm<AboutStepRule>({
     defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
-  const { getFields, submit } = form;
+  const { getFields, getFormData, submit } = form;
+  const [{ severity: formSeverity }] = (useFormData({
+    form,
+    watch: ['severity'],
+  }) as unknown) as [Partial<AboutStepRule>];
 
-  const onSubmit = useCallback(async () => {
-    if (setStepData) {
-      setStepData(RuleStep.aboutRule, null, false);
-      const { isValid, data } = await submit();
-      if (isValid) {
-        setStepData(RuleStep.aboutRule, data, isValid);
-        setMyStepData({ ...data, isNew: false } as AboutStepRule);
+  useEffect(() => {
+    const formSeverityValue = formSeverity?.value;
+    if (formSeverityValue != null && formSeverityValue !== severityValue) {
+      setSeverityValue(formSeverityValue);
+
+      const newRiskScoreValue = defaultRiskScoreBySeverity[formSeverityValue];
+      if (newRiskScoreValue != null) {
+        const riskScoreField = getFields().riskScore as FieldHook<AboutStepRule['riskScore']>;
+        riskScoreField.setValue({ ...riskScoreField.value, value: newRiskScoreValue });
       }
     }
-  }, [setStepData, submit]);
+  }, [formSeverity?.value, getFields, severityValue]);
+
+  const getData = useCallback(async () => {
+    const result = await submit();
+    return result?.isValid
+      ? result
+      : {
+          isValid: false,
+          data: getFormData(),
+        };
+  }, [getFormData, submit]);
+
+  const handleSubmit = useCallback(() => {
+    if (onSubmit) {
+      onSubmit();
+    }
+  }, [onSubmit]);
 
   useEffect(() => {
     if (setForm) {
-      setForm(RuleStep.aboutRule, form);
+      setForm(RuleStep.aboutRule, getData);
     }
-  }, [setForm, form]);
+  }, [getData, setForm]);
 
-  return isReadOnlyView && myStepData.name != null ? (
+  return isReadOnlyView ? (
     <StepContentWrapper data-test-subj="aboutStep" addPadding={addPadding}>
-      <StepRuleDescription columns={descriptionColumns} schema={schema} data={myStepData} />
+      <StepRuleDescription columns={descriptionColumns} schema={schema} data={initialState} />
     </StepContentWrapper>
   ) : (
     <>
@@ -305,26 +328,11 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
               }}
             />
           </EuiAccordion>
-          <FormDataProvider pathsToWatch="severity">
-            {({ severity }) => {
-              const newRiskScore = defaultRiskScoreBySeverity[severity as SeverityValue];
-              const severityField = getFields().severity;
-              const riskScoreField = getFields().riskScore;
-              if (
-                severityField.value !== severity &&
-                newRiskScore != null &&
-                riskScoreField.value !== newRiskScore
-              ) {
-                riskScoreField.setValue(newRiskScore);
-              }
-              return null;
-            }}
-          </FormDataProvider>
         </Form>
       </StepContentWrapper>
 
       {!isUpdateView && (
-        <NextStep dataTestSubj="about-continue" onClick={onSubmit} isDisabled={isLoading} />
+        <NextStep dataTestSubj="about-continue" onClick={handleSubmit} isDisabled={isLoading} />
       )}
     </>
   );
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx
index 2264a11341eb85..6df94eca429c5c 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/schema.tsx
@@ -13,7 +13,7 @@ import {
   ValidationFunc,
   ERROR_CODE,
 } from '../../../../shared_imports';
-import { IMitreEnterpriseAttack } from '../../../pages/detection_engine/rules/types';
+import { IMitreEnterpriseAttack, AboutStepRule } from '../../../pages/detection_engine/rules/types';
 import { isMitreAttackInvalid } from '../mitre/helpers';
 import { OptionalFieldLabel } from '../optional_field_label';
 import { isUrlInvalid } from '../../../../common/utils/validators';
@@ -21,7 +21,7 @@ import * as I18n from './translations';
 
 const { emptyField } = fieldValidators;
 
-export const schema: FormSchema = {
+export const schema: FormSchema<AboutStepRule> = {
   author: {
     type: FIELD_TYPES.COMBO_BOX,
     label: i18n.translate(
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
index 8a1f9618835196..158f323b739e61 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
@@ -7,15 +7,14 @@
 import { EuiButtonEmpty, EuiFormRow } from '@elastic/eui';
 import React, { FC, memo, useCallback, useState, useEffect } from 'react';
 import styled from 'styled-components';
-import deepEqual from 'fast-deep-equal';
+import isEqual from 'lodash/isEqual';
 
 import { DEFAULT_INDEX_KEY } from '../../../../../common/constants';
+import { DEFAULT_TIMELINE_TITLE } from '../../../../timelines/components/timeline/translations';
 import { isMlRule } from '../../../../../common/machine_learning/helpers';
 import { hasMlAdminPermissions } from '../../../../../common/machine_learning/has_ml_admin_permissions';
 import { hasMlLicense } from '../../../../../common/machine_learning/has_ml_license';
-import { IIndexPattern } from '../../../../../../../../src/plugins/data/public';
 import { useFetchIndexPatterns } from '../../../containers/detection_engine/rules';
-import { DEFAULT_TIMELINE_TITLE } from '../../../../timelines/components/timeline/translations';
 import { useMlCapabilities } from '../../../../common/components/ml/hooks/use_ml_capabilities';
 import { useUiSetting$ } from '../../../../common/lib/kibana';
 import {
@@ -42,9 +41,8 @@ import {
   getUseField,
   UseField,
   UseMultiFields,
-  FormDataProvider,
   useForm,
-  FormSchema,
+  useFormData,
 } from '../../../../shared_imports';
 import { schema } from './schema';
 import * as i18n from './translations';
@@ -52,13 +50,12 @@ import * as i18n from './translations';
 const CommonUseField = getUseField({ component: Field });
 
 interface StepDefineRuleProps extends RuleStepProps {
-  defaultValues?: DefineStepRule | null;
+  defaultValues?: DefineStepRule;
 }
 
 const stepDefineDefaultValue: DefineStepRule = {
   anomalyThreshold: 50,
   index: [],
-  isNew: true,
   machineLearningJobId: '',
   ruleType: 'query',
   queryBar: {
@@ -103,8 +100,8 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   isReadOnlyView,
   isLoading,
   isUpdateView = false,
+  onSubmit,
   setForm,
-  setStepData,
 }) => {
   const mlCapabilities = useMlCapabilities();
   const [openTimelineSearch, setOpenTimelineSearch] = useState(false);
@@ -112,38 +109,54 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   const [indicesConfig] = useUiSetting$<string[]>(DEFAULT_INDEX_KEY);
   const initialState = defaultValues ?? {
     ...stepDefineDefaultValue,
-    index: indicesConfig ?? [],
+    index: indicesConfig,
   };
-  const [localRuleType, setLocalRuleType] = useState(initialState.ruleType);
-  const [myStepData, setMyStepData] = useState<DefineStepRule>(initialState);
-  const [
-    { browserFields, indexPatterns: indexPatternQueryBar, isLoading: indexPatternLoadingQueryBar },
-  ] = useFetchIndexPatterns(myStepData.index, 'step_define_rule');
-
-  const { form } = useForm({
+  const { form } = useForm<DefineStepRule>({
     defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
-  const { getFields, reset, submit } = form;
-  const clearErrors = useCallback(() => reset({ resetValues: false }), [reset]);
+  const { getFields, getFormData, reset, submit } = form;
+  const [{ index: formIndex, ruleType: formRuleType }] = (useFormData({
+    form,
+    watch: ['index', 'ruleType'],
+  }) as unknown) as [Partial<DefineStepRule>];
+  const index = formIndex || initialState.index;
+  const ruleType = formRuleType || initialState.ruleType;
+  const [
+    { browserFields, indexPatterns: indexPatternQueryBar, isLoading: indexPatternLoadingQueryBar },
+  ] = useFetchIndexPatterns(index, RuleStep.defineRule);
 
-  const onSubmit = useCallback(async () => {
-    if (setStepData) {
-      setStepData(RuleStep.defineRule, null, false);
-      const { isValid, data } = await submit();
-      if (isValid && setStepData) {
-        setStepData(RuleStep.defineRule, data, isValid);
-        setMyStepData({ ...data, isNew: false } as DefineStepRule);
-      }
+  // reset form when rule type changes
+  useEffect(() => {
+    reset({ resetValues: false });
+  }, [reset, ruleType]);
+
+  useEffect(() => {
+    setIndexModified(!isEqual(index, indicesConfig));
+  }, [index, indicesConfig]);
+
+  const handleSubmit = useCallback(() => {
+    if (onSubmit) {
+      onSubmit();
     }
-  }, [setStepData, submit]);
+  }, [onSubmit]);
+
+  const getData = useCallback(async () => {
+    const result = await submit();
+    return result?.isValid
+      ? result
+      : {
+          isValid: false,
+          data: getFormData(),
+        };
+  }, [getFormData, submit]);
 
   useEffect(() => {
     if (setForm) {
-      setForm(RuleStep.defineRule, form);
+      setForm(RuleStep.defineRule, getData);
     }
-  }, [form, setForm]);
+  }, [getData, setForm]);
 
   const handleResetIndices = useCallback(() => {
     const indexField = getFields().index;
@@ -173,9 +186,9 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
     <StepContentWrapper data-test-subj="definitionRule" addPadding={addPadding}>
       <StepRuleDescription
         columns={descriptionColumns}
-        indexPatterns={indexPatternQueryBar as IIndexPattern}
-        schema={filterRuleFieldsForType(schema as FormSchema & RuleFields, myStepData.ruleType)}
-        data={filterRuleFieldsForType(myStepData, myStepData.ruleType)}
+        indexPatterns={indexPatternQueryBar}
+        schema={filterRuleFieldsForType(schema as typeof schema & RuleFields, ruleType)}
+        data={filterRuleFieldsForType(initialState, ruleType)}
       />
     </StepContentWrapper>
   ) : (
@@ -192,7 +205,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
               isMlAdmin: hasMlAdminPermissions(mlCapabilities),
             }}
           />
-          <RuleTypeEuiFormRow $isVisible={!isMlRule(localRuleType)} fullWidth>
+          <RuleTypeEuiFormRow $isVisible={!isMlRule(ruleType)} fullWidth>
             <>
               <CommonUseField
                 path="index"
@@ -241,7 +254,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
               />
             </>
           </RuleTypeEuiFormRow>
-          <RuleTypeEuiFormRow $isVisible={isMlRule(localRuleType)} fullWidth>
+          <RuleTypeEuiFormRow $isVisible={isMlRule(ruleType)} fullWidth>
             <>
               <UseField
                 path="machineLearningJobId"
@@ -260,7 +273,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
             </>
           </RuleTypeEuiFormRow>
           <RuleTypeEuiFormRow
-            $isVisible={localRuleType === 'threshold'}
+            $isVisible={ruleType === 'threshold'}
             data-test-subj="thresholdInput"
             fullWidth
           >
@@ -269,11 +282,9 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
                 fields={{
                   thresholdField: {
                     path: 'threshold.field',
-                    defaultValue: initialState.threshold.field,
                   },
                   thresholdValue: {
                     path: 'threshold.value',
-                    defaultValue: initialState.threshold.value,
                   },
                 }}
               >
@@ -290,31 +301,11 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
               dataTestSubj: 'detectionEngineStepDefineRuleTimeline',
             }}
           />
-          <FormDataProvider pathsToWatch={['index', 'ruleType']}>
-            {({ index, ruleType }) => {
-              if (index != null) {
-                if (deepEqual(index, indicesConfig) && indexModified) {
-                  setIndexModified(false);
-                } else if (!deepEqual(index, indicesConfig) && !indexModified) {
-                  setIndexModified(true);
-                }
-                if (myStepData.index !== index) {
-                  setMyStepData((prevValue) => ({ ...prevValue, index }));
-                }
-              }
-
-              if (ruleType !== localRuleType) {
-                setLocalRuleType(ruleType);
-                clearErrors();
-              }
-              return null;
-            }}
-          </FormDataProvider>
         </Form>
       </StepContentWrapper>
 
       {!isUpdateView && (
-        <NextStep dataTestSubj="define-continue" onClick={onSubmit} isDisabled={isLoading} />
+        <NextStep dataTestSubj="define-continue" onClick={handleSubmit} isDisabled={isLoading} />
       )}
     </>
   );
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/schema.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/schema.tsx
index 333b28bf27bbf2..07eff94bbbef4b 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/schema.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/schema.tsx
@@ -19,9 +19,10 @@ import {
   FormSchema,
   ValidationFunc,
 } from '../../../../shared_imports';
+import { DefineStepRule } from '../../../pages/detection_engine/rules/types';
 import { CUSTOM_QUERY_REQUIRED, INVALID_CUSTOM_QUERY, INDEX_HELPER_TEXT } from './translations';
 
-export const schema: FormSchema = {
+export const schema: FormSchema<DefineStepRule> = {
   index: {
     type: FIELD_TYPES.COMBO_BOX,
     label: i18n.translate(
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx
index 5b4f7677dbc30a..e6f1c25bf9dacc 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx
@@ -13,7 +13,7 @@ import {
   EuiSpacer,
 } from '@elastic/eui';
 import { findIndex } from 'lodash/fp';
-import React, { FC, memo, useCallback, useEffect, useMemo, useState } from 'react';
+import React, { FC, memo, useCallback, useEffect, useMemo } from 'react';
 
 import { ActionVariable } from '../../../../../../triggers_actions_ui/public';
 import {
@@ -22,7 +22,7 @@ import {
   ActionsStepRule,
 } from '../../../pages/detection_engine/rules/types';
 import { StepRuleDescription } from '../description_step';
-import { Form, UseField, useForm } from '../../../../shared_imports';
+import { Form, UseField, useForm, useFormData } from '../../../../shared_imports';
 import { StepContentWrapper } from '../step_content_wrapper';
 import {
   ThrottleSelectField,
@@ -40,9 +40,8 @@ interface StepRuleActionsProps extends RuleStepProps {
   actionMessageParams: ActionVariable[];
 }
 
-const stepActionsDefaultValue = {
+const stepActionsDefaultValue: ActionsStepRule = {
   enabled: true,
-  isNew: true,
   actions: [],
   kibanaSiemAppUrl: '',
   throttle: DEFAULT_THROTTLE_OPTION.value,
@@ -65,27 +64,16 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
   isReadOnlyView,
   isLoading,
   isUpdateView = false,
-  setStepData,
+  onSubmit,
   setForm,
   actionMessageParams,
 }) => {
-  const initialState = defaultValues ?? stepActionsDefaultValue;
-  const [myStepData, setMyStepData] = useState<ActionsStepRule>(initialState);
   const {
     services: {
       application,
       triggers_actions_ui: { actionTypeRegistry },
     },
   } = useKibana();
-  const schema = useMemo(() => getSchema({ actionTypeRegistry }), [actionTypeRegistry]);
-
-  const { form } = useForm({
-    defaultValue: initialState,
-    options: { stripEmptyFields: false },
-    schema,
-  });
-  const { submit } = form;
-
   const kibanaAbsoluteUrl = useMemo(
     () =>
       application.getUrlForApp(`${APP_ID}`, {
@@ -93,37 +81,52 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
       }),
     [application]
   );
-
-  const onSubmit = useCallback(
-    async (enabled: boolean) => {
-      if (setStepData) {
-        setStepData(RuleStep.ruleActions, null, false);
-        const { isValid: newIsValid, data } = await submit();
-        if (newIsValid) {
-          setStepData(RuleStep.ruleActions, { ...data, enabled }, newIsValid);
-          setMyStepData({ ...data, isNew: false } as ActionsStepRule);
-        }
+  const initialState = {
+    ...(defaultValues ?? stepActionsDefaultValue),
+    kibanaSiemAppUrl: kibanaAbsoluteUrl,
+  };
+  const schema = useMemo(() => getSchema({ actionTypeRegistry }), [actionTypeRegistry]);
+  const { form } = useForm<ActionsStepRule>({
+    defaultValue: initialState,
+    options: { stripEmptyFields: false },
+    schema,
+  });
+  const { getFields, getFormData, submit } = form;
+  const [{ throttle: formThrottle }] = (useFormData({
+    form,
+    watch: ['throttle'],
+  }) as unknown) as [Partial<ActionsStepRule>];
+  const throttle = formThrottle || initialState.throttle;
+
+  const handleSubmit = useCallback(
+    (enabled: boolean) => {
+      getFields().enabled.setValue(enabled);
+      if (onSubmit) {
+        onSubmit();
       }
     },
-    [setStepData, submit]
+    [getFields, onSubmit]
   );
 
+  const getData = useCallback(async () => {
+    const result = await submit();
+    return result?.isValid
+      ? result
+      : {
+          isValid: false,
+          data: getFormData(),
+        };
+  }, [getFormData, submit]);
+
   useEffect(() => {
     if (setForm) {
-      setForm(RuleStep.ruleActions, form);
+      setForm(RuleStep.ruleActions, getData);
     }
-  }, [form, setForm]);
-
-  const updateThrottle = useCallback((throttle) => setMyStepData({ ...myStepData, throttle }), [
-    myStepData,
-    setMyStepData,
-  ]);
+  }, [getData, setForm]);
 
   const throttleOptions = useMemo(() => {
-    const throttle = myStepData.throttle;
-
     return getThrottleOptions(throttle);
-  }, [myStepData]);
+  }, [throttle]);
 
   const throttleFieldComponentProps = useMemo(
     () => ({
@@ -131,18 +134,16 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
       isDisabled: isLoading,
       dataTestSubj: 'detectionEngineStepRuleActionsThrottle',
       hasNoInitialSelection: false,
-      handleChange: updateThrottle,
       euiFieldProps: {
         options: throttleOptions,
       },
     }),
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [isLoading, updateThrottle]
+    [isLoading, throttleOptions]
   );
 
-  return isReadOnlyView && myStepData != null ? (
+  return isReadOnlyView ? (
     <StepContentWrapper addPadding={addPadding}>
-      <StepRuleDescription schema={schema} data={myStepData} columns="single" />
+      <StepRuleDescription schema={schema} data={initialState} columns="single" />
     </StepContentWrapper>
   ) : (
     <>
@@ -154,12 +155,11 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
               component={ThrottleSelectField}
               componentProps={throttleFieldComponentProps}
             />
-            {myStepData.throttle !== stepActionsDefaultValue.throttle ? (
+            {throttle !== stepActionsDefaultValue.throttle ? (
               <>
                 <EuiSpacer />
                 <UseField
                   path="actions"
-                  defaultValue={myStepData.actions}
                   component={RuleActionsField}
                   componentProps={{
                     messageVariables: actionMessageParams,
@@ -167,18 +167,10 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
                 />
               </>
             ) : (
-              <UseField
-                path="actions"
-                defaultValue={myStepData.actions}
-                component={GhostFormField}
-              />
+              <UseField path="actions" component={GhostFormField} />
             )}
-            <UseField
-              path="kibanaSiemAppUrl"
-              defaultValue={kibanaAbsoluteUrl}
-              component={GhostFormField}
-            />
-            <UseField path="enabled" defaultValue={myStepData.enabled} component={GhostFormField} />
+            <UseField path="kibanaSiemAppUrl" component={GhostFormField} />
+            <UseField path="enabled" component={GhostFormField} />
           </EuiForm>
         </Form>
       </StepContentWrapper>
@@ -197,7 +189,7 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
                 fill={false}
                 isDisabled={isLoading}
                 isLoading={isLoading}
-                onClick={onSubmit.bind(null, false)}
+                onClick={() => handleSubmit(false)}
               >
                 {I18n.COMPLETE_WITHOUT_ACTIVATING}
               </EuiButton>
@@ -207,7 +199,7 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
                 fill
                 isDisabled={isLoading}
                 isLoading={isLoading}
-                onClick={onSubmit.bind(null, true)}
+                onClick={() => handleSubmit(true)}
                 data-test-subj="create-activate"
               >
                 {I18n.COMPLETE_WITH_ACTIVATING}
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/schema.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/schema.tsx
index a093f991afaf79..38de3a2026eca6 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/schema.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/schema.tsx
@@ -12,7 +12,8 @@ import {
   AlertAction,
   ActionTypeRegistryContract,
 } from '../../../../../../triggers_actions_ui/public';
-import { FormSchema, FormData, ValidationFunc, ERROR_CODE } from '../../../../shared_imports';
+import { FormSchema, ValidationFunc, ERROR_CODE } from '../../../../shared_imports';
+import { ActionsStepRule } from '../../../pages/detection_engine/rules/types';
 import * as I18n from './translations';
 import { isUuidv4, getActionTypeName, validateMustache, validateActionParams } from './utils';
 
@@ -61,7 +62,7 @@ export const getSchema = ({
   actionTypeRegistry,
 }: {
   actionTypeRegistry: ActionTypeRegistryContract;
-}): FormSchema<FormData> => ({
+}): FormSchema<ActionsStepRule> => ({
   actions: {
     validations: [
       {
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx
index 52f04f8423bec5..d451932a6b634a 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { FC, memo, useCallback, useEffect, useState } from 'react';
+import React, { FC, memo, useCallback, useEffect } from 'react';
 
 import {
   RuleStep,
@@ -22,9 +22,8 @@ interface StepScheduleRuleProps extends RuleStepProps {
   defaultValues?: ScheduleStepRule | null;
 }
 
-const stepScheduleDefaultValue = {
+const stepScheduleDefaultValue: ScheduleStepRule = {
   interval: '5m',
-  isNew: true,
   from: '1m',
 };
 
@@ -35,39 +34,44 @@ const StepScheduleRuleComponent: FC<StepScheduleRuleProps> = ({
   isReadOnlyView,
   isLoading,
   isUpdateView = false,
-  setStepData,
+  onSubmit,
   setForm,
 }) => {
   const initialState = defaultValues ?? stepScheduleDefaultValue;
-  const [myStepData, setMyStepData] = useState<ScheduleStepRule>(initialState);
 
-  const { form } = useForm({
+  const { form } = useForm<ScheduleStepRule>({
     defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
-  const { submit } = form;
 
-  const onSubmit = useCallback(async () => {
-    if (setStepData) {
-      setStepData(RuleStep.scheduleRule, null, false);
-      const { isValid: newIsValid, data } = await submit();
-      if (newIsValid) {
-        setStepData(RuleStep.scheduleRule, { ...data }, newIsValid);
-        setMyStepData({ ...data, isNew: false } as ScheduleStepRule);
-      }
+  const { getFormData, submit } = form;
+
+  const handleSubmit = useCallback(() => {
+    if (onSubmit) {
+      onSubmit();
     }
-  }, [setStepData, submit]);
+  }, [onSubmit]);
+
+  const getData = useCallback(async () => {
+    const result = await submit();
+    return result?.isValid
+      ? result
+      : {
+          isValid: false,
+          data: getFormData(),
+        };
+  }, [getFormData, submit]);
 
   useEffect(() => {
     if (setForm) {
-      setForm(RuleStep.scheduleRule, form);
+      setForm(RuleStep.scheduleRule, getData);
     }
-  }, [form, setForm]);
+  }, [getData, setForm]);
 
-  return isReadOnlyView && myStepData != null ? (
+  return isReadOnlyView ? (
     <StepContentWrapper addPadding={addPadding}>
-      <StepRuleDescription columns={descriptionColumns} schema={schema} data={myStepData} />
+      <StepRuleDescription columns={descriptionColumns} schema={schema} data={initialState} />
     </StepContentWrapper>
   ) : (
     <>
@@ -96,7 +100,7 @@ const StepScheduleRuleComponent: FC<StepScheduleRuleProps> = ({
       </StepContentWrapper>
 
       {!isUpdateView && (
-        <NextStep dataTestSubj="schedule-continue" onClick={onSubmit} isDisabled={isLoading} />
+        <NextStep dataTestSubj="schedule-continue" onClick={handleSubmit} isDisabled={isLoading} />
       )}
     </>
   );
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/schema.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/schema.tsx
index f4c371a2364f65..cf93a9b61710c4 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/schema.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/schema.tsx
@@ -9,9 +9,10 @@
 import { i18n } from '@kbn/i18n';
 
 import { OptionalFieldLabel } from '../optional_field_label';
+import { ScheduleStepRule } from '../../../pages/detection_engine/rules/types';
 import { FormSchema } from '../../../../shared_imports';
 
-export const schema: FormSchema = {
+export const schema: FormSchema<ScheduleStepRule> = {
   interval: {
     label: i18n.translate(
       'xpack.securitySolution.detectionEngine.createRule.stepScheduleRule.fieldIntervalLabel',
diff --git a/x-pack/plugins/security_solution/public/detections/components/user_info/index.tsx b/x-pack/plugins/security_solution/public/detections/components/user_info/index.tsx
index 50348578cb039a..e1a29c3575d95c 100644
--- a/x-pack/plugins/security_solution/public/detections/components/user_info/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/user_info/index.tsx
@@ -121,7 +121,7 @@ export const userInfoReducer = (state: State, action: Action): State => {
 
 const StateUserInfoContext = createContext<[State, Dispatch<Action>]>([initialState, () => noop]);
 
-const useUserData = () => useContext(StateUserInfoContext);
+export const useUserData = () => useContext(StateUserInfoContext);
 
 interface ManageUserInfoProps {
   children: React.ReactNode;
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.test.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.test.ts
index 3cd819b55685c0..19007c4d2e432b 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.test.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.test.ts
@@ -67,7 +67,7 @@ describe('Detections Alerts API', () => {
       });
       expect(fetchMock).toHaveBeenCalledWith('/api/detection_engine/signals/status', {
         body:
-          '{"status":"closed","bool":{"filter":{"terms":{"_id":["b4ee5c32e3a321057edcc953ca17228c6fdfe5ba43fdbbdaffa8cefa11605cc5"]}}}}',
+          '{"conflicts":"proceed","status":"closed","bool":{"filter":{"terms":{"_id":["b4ee5c32e3a321057edcc953ca17228c6fdfe5ba43fdbbdaffa8cefa11605cc5"]}}}}',
         method: 'POST',
         signal: abortCtrl.signal,
       });
@@ -81,7 +81,7 @@ describe('Detections Alerts API', () => {
       });
       expect(fetchMock).toHaveBeenCalledWith('/api/detection_engine/signals/status', {
         body:
-          '{"status":"open","bool":{"filter":{"terms":{"_id":["b4ee5c32e3a321057edcc953ca17228c6fdfe5ba43fdbbdaffa8cefa11605cc5"]}}}}',
+          '{"conflicts":"proceed","status":"open","bool":{"filter":{"terms":{"_id":["b4ee5c32e3a321057edcc953ca17228c6fdfe5ba43fdbbdaffa8cefa11605cc5"]}}}}',
         method: 'POST',
         signal: abortCtrl.signal,
       });
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.ts
index 3fe676fe2c7d6f..a8a2ae10a3bbd1 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.ts
@@ -58,7 +58,7 @@ export const updateAlertStatus = async ({
 }: UpdateAlertStatusProps): Promise<UpdateDocumentByQueryResponse> =>
   KibanaServices.get().http.fetch(DETECTION_ENGINE_SIGNALS_STATUS_URL, {
     method: 'POST',
-    body: JSON.stringify({ status, ...query }),
+    body: JSON.stringify({ conflicts: 'proceed', status, ...query }),
     signal,
   });
 
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/__mocks__/api.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/__mocks__/api.ts
index f12a5d523bade7..0ed091f2c18a63 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/__mocks__/api.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/__mocks__/api.ts
@@ -5,9 +5,9 @@
  */
 
 import {
-  AddRulesProps,
   PatchRuleProps,
-  NewRule,
+  CreateRulesProps,
+  UpdateRulesProps,
   PrePackagedRulesStatusResponse,
   BasicFetchProps,
   RuleStatusResponse,
@@ -16,13 +16,18 @@ import {
   FetchRulesResponse,
   FetchRulesProps,
 } from '../types';
-import { ruleMock, savedRuleMock, rulesMock } from '../mock';
+import { savedRuleMock, rulesMock } from '../mock';
+import { getRulesSchemaMock } from '../../../../../../common/detection_engine/schemas/response/rules_schema.mocks';
+import { RulesSchema } from '../../../../../../common/detection_engine/schemas/response';
 
-export const addRule = async ({ rule, signal }: AddRulesProps): Promise<NewRule> =>
-  Promise.resolve(ruleMock);
+export const updateRule = async ({ rule, signal }: UpdateRulesProps): Promise<RulesSchema> =>
+  Promise.resolve(getRulesSchemaMock());
 
-export const patchRule = async ({ ruleProperties, signal }: PatchRuleProps): Promise<NewRule> =>
-  Promise.resolve(ruleMock);
+export const createRule = async ({ rule, signal }: CreateRulesProps): Promise<RulesSchema> =>
+  Promise.resolve(getRulesSchemaMock());
+
+export const patchRule = async ({ ruleProperties, signal }: PatchRuleProps): Promise<RulesSchema> =>
+  Promise.resolve(getRulesSchemaMock());
 
 export const getPrePackagedRulesStatus = async ({
   signal,
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts
index f58c95ed71e29e..cd1ded544cfe5a 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts
@@ -6,7 +6,9 @@
 
 import { KibanaServices } from '../../../../common/lib/kibana';
 import {
-  addRule,
+  createRule,
+  updateRule,
+  patchRule,
   fetchRules,
   fetchRuleById,
   enableRules,
@@ -19,9 +21,12 @@ import {
   fetchTags,
   getPrePackagedRulesStatus,
 } from './api';
-import { ruleMock, rulesMock } from './mock';
+import { getRulesSchemaMock } from '../../../../../common/detection_engine/schemas/response/rules_schema.mocks';
+import { getCreateRulesSchemaMock } from '../../../../../common/detection_engine/schemas/request/create_rules_schema.mock';
+import { getUpdateRulesSchemaMock } from '../../../../../common/detection_engine/schemas/request/update_rules_schema.mock';
+import { getPatchRulesSchemaMock } from '../../../../../common/detection_engine/schemas/request/patch_rules_schema.mock';
+import { rulesMock } from './mock';
 import { buildEsQuery } from 'src/plugins/data/common';
-
 const abortCtrl = new AbortController();
 const mockKibanaServices = KibanaServices.get as jest.Mock;
 jest.mock('../../../../common/lib/kibana');
@@ -30,25 +35,56 @@ const fetchMock = jest.fn();
 mockKibanaServices.mockReturnValue({ http: { fetch: fetchMock } });
 
 describe('Detections Rules API', () => {
-  describe('addRule', () => {
+  describe('createRule', () => {
     beforeEach(() => {
       fetchMock.mockClear();
-      fetchMock.mockResolvedValue(ruleMock);
+      fetchMock.mockResolvedValue(getRulesSchemaMock());
     });
 
-    test('check parameter url, body', async () => {
-      await addRule({ rule: ruleMock, signal: abortCtrl.signal });
+    test('POSTs rule', async () => {
+      const payload = getCreateRulesSchemaMock();
+      await createRule({ rule: payload, signal: abortCtrl.signal });
       expect(fetchMock).toHaveBeenCalledWith('/api/detection_engine/rules', {
         body:
-          '{"description":"some desc","enabled":true,"false_positives":[],"filters":[],"from":"now-360s","index":["apm-*-transaction*","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*"],"interval":"5m","rule_id":"bbd3106e-b4b5-4d7c-a1a2-47531d6a2baf","language":"kuery","risk_score":75,"name":"Test rule","query":"user.email: \'root@elastic.co\'","references":[],"severity":"high","tags":["APM"],"to":"now","type":"query","threat":[],"throttle":null}',
+          '{"description":"Detecting root and admin users","name":"Query with a rule id","query":"user.name: root or user.name: admin","severity":"high","type":"query","risk_score":55,"language":"kuery","rule_id":"rule-1"}',
         method: 'POST',
         signal: abortCtrl.signal,
       });
     });
+  });
 
-    test('happy path', async () => {
-      const ruleResp = await addRule({ rule: ruleMock, signal: abortCtrl.signal });
-      expect(ruleResp).toEqual(ruleMock);
+  describe('updateRule', () => {
+    beforeEach(() => {
+      fetchMock.mockClear();
+      fetchMock.mockResolvedValue(getRulesSchemaMock());
+    });
+
+    test('PUTs rule', async () => {
+      const payload = getUpdateRulesSchemaMock();
+      await updateRule({ rule: payload, signal: abortCtrl.signal });
+      expect(fetchMock).toHaveBeenCalledWith('/api/detection_engine/rules', {
+        body:
+          '{"description":"some description","name":"Query with a rule id","query":"user.name: root or user.name: admin","severity":"high","type":"query","risk_score":55,"language":"kuery","rule_id":"rule-1"}',
+        method: 'PUT',
+        signal: abortCtrl.signal,
+      });
+    });
+  });
+
+  describe('patchRule', () => {
+    beforeEach(() => {
+      fetchMock.mockClear();
+      fetchMock.mockResolvedValue(getRulesSchemaMock());
+    });
+
+    test('PATCHs rule', async () => {
+      const payload = getPatchRulesSchemaMock();
+      await patchRule({ ruleProperties: payload, signal: abortCtrl.signal });
+      expect(fetchMock).toHaveBeenCalledWith('/api/detection_engine/rules', {
+        body: JSON.stringify(payload),
+        method: 'PATCH',
+        signal: abortCtrl.signal,
+      });
     });
   });
 
@@ -280,7 +316,7 @@ describe('Detections Rules API', () => {
   describe('fetchRuleById', () => {
     beforeEach(() => {
       fetchMock.mockClear();
-      fetchMock.mockResolvedValue(ruleMock);
+      fetchMock.mockResolvedValue(getRulesSchemaMock());
     });
 
     test('check parameter url, query', async () => {
@@ -296,7 +332,7 @@ describe('Detections Rules API', () => {
 
     test('happy path', async () => {
       const ruleResp = await fetchRuleById({ id: 'mySuperRuleId', signal: abortCtrl.signal });
-      expect(ruleResp).toEqual(ruleMock);
+      expect(ruleResp).toEqual(getRulesSchemaMock());
     });
   });
 
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts
index 3538d8ec8c9b95..e254516d110768 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
 import { HttpStart } from '../../../../../../../../src/core/public';
 import {
   DETECTION_ENGINE_RULES_URL,
@@ -13,13 +12,13 @@ import {
   DETECTION_ENGINE_TAGS_URL,
 } from '../../../../../common/constants';
 import {
-  AddRulesProps,
+  UpdateRulesProps,
+  CreateRulesProps,
   DeleteRulesProps,
   DuplicateRulesProps,
   EnableRulesProps,
   FetchRulesProps,
   FetchRulesResponse,
-  NewRule,
   Rule,
   FetchRuleProps,
   BasicFetchProps,
@@ -33,32 +32,51 @@ import {
 } from './types';
 import { KibanaServices } from '../../../../common/lib/kibana';
 import * as i18n from '../../../pages/detection_engine/rules/translations';
+import { RulesSchema } from '../../../../../common/detection_engine/schemas/response';
 
 /**
- * Add provided Rule
+ * Create provided Rule
  *
- * @param rule to add
+ * @param rule CreateRulesSchema to add
  * @param signal to cancel request
  *
  * @throws An error if response is not OK
  */
-export const addRule = async ({ rule, signal }: AddRulesProps): Promise<NewRule> =>
-  KibanaServices.get().http.fetch<NewRule>(DETECTION_ENGINE_RULES_URL, {
-    method: rule.id != null ? 'PUT' : 'POST',
+export const createRule = async ({ rule, signal }: CreateRulesProps): Promise<RulesSchema> =>
+  KibanaServices.get().http.fetch<RulesSchema>(DETECTION_ENGINE_RULES_URL, {
+    method: 'POST',
+    body: JSON.stringify(rule),
+    signal,
+  });
+
+/**
+ * Update provided Rule using PUT
+ *
+ * @param rule UpdateRulesSchema to be updated
+ * @param signal to cancel request
+ *
+ * @throws An error if response is not OK
+ */
+export const updateRule = async ({ rule, signal }: UpdateRulesProps): Promise<RulesSchema> =>
+  KibanaServices.get().http.fetch<RulesSchema>(DETECTION_ENGINE_RULES_URL, {
+    method: 'PUT',
     body: JSON.stringify(rule),
     signal,
   });
 
 /**
- * Patch provided Rule
+ * Patch provided rule
+ * NOTE: The rule edit flow does NOT use patch as it relies on the
+ * functionality of PUT to delete field values when not provided, if
+ * just expecting changes, use this `patchRule`
  *
  * @param ruleProperties to patch
  * @param signal to cancel request
  *
  * @throws An error if response is not OK
  */
-export const patchRule = async ({ ruleProperties, signal }: PatchRuleProps): Promise<NewRule> =>
-  KibanaServices.get().http.fetch<NewRule>(DETECTION_ENGINE_RULES_URL, {
+export const patchRule = async ({ ruleProperties, signal }: PatchRuleProps): Promise<RulesSchema> =>
+  KibanaServices.get().http.fetch<RulesSchema>(DETECTION_ENGINE_RULES_URL, {
     method: 'PATCH',
     body: JSON.stringify(ruleProperties),
     signal,
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/index.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/index.ts
index c7ecfb33cd9052..a40ab2e4878519 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/index.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/index.ts
@@ -6,7 +6,8 @@
 
 export * from './api';
 export * from './fetch_index_patterns';
-export * from './persist_rule';
+export * from './use_update_rule';
+export * from './use_create_rule';
 export * from './types';
 export * from './use_rule';
 export * from './use_rules';
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/mock.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/mock.ts
index fa11cfabcdf8ba..c0397b0af6db9f 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/mock.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/mock.ts
@@ -4,36 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { NewRule, FetchRulesResponse, Rule } from './types';
-
-export const ruleMock: NewRule = {
-  description: 'some desc',
-  enabled: true,
-  false_positives: [],
-  filters: [],
-  from: 'now-360s',
-  index: [
-    'apm-*-transaction*',
-    'auditbeat-*',
-    'endgame-*',
-    'filebeat-*',
-    'packetbeat-*',
-    'winlogbeat-*',
-  ],
-  interval: '5m',
-  rule_id: 'bbd3106e-b4b5-4d7c-a1a2-47531d6a2baf',
-  language: 'kuery',
-  risk_score: 75,
-  name: 'Test rule',
-  query: "user.email: 'root@elastic.co'",
-  references: [],
-  severity: 'high',
-  tags: ['APM'],
-  to: 'now',
-  type: 'query',
-  threat: [],
-  throttle: null,
-};
+import { FetchRulesResponse, Rule } from './types';
 
 export const savedRuleMock: Rule = {
   author: [],
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/persist_rule.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/persist_rule.test.tsx
deleted file mode 100644
index 1bf21623992e61..00000000000000
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/persist_rule.test.tsx
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { renderHook, act } from '@testing-library/react-hooks';
-
-import { usePersistRule, ReturnPersistRule } from './persist_rule';
-import { ruleMock } from './mock';
-
-jest.mock('./api');
-
-describe('usePersistRule', () => {
-  test('init', async () => {
-    const { result } = renderHook<unknown, ReturnPersistRule>(() => usePersistRule());
-
-    expect(result.current).toEqual([{ isLoading: false, isSaved: false }, result.current[1]]);
-  });
-
-  test('saving rule with isLoading === true', async () => {
-    await act(async () => {
-      const { result, rerender, waitForNextUpdate } = renderHook<void, ReturnPersistRule>(() =>
-        usePersistRule()
-      );
-      await waitForNextUpdate();
-      result.current[1](ruleMock);
-      rerender();
-      expect(result.current).toEqual([{ isLoading: true, isSaved: false }, result.current[1]]);
-    });
-  });
-
-  test('saved rule with isSaved === true', async () => {
-    await act(async () => {
-      const { result, waitForNextUpdate } = renderHook<void, ReturnPersistRule>(() =>
-        usePersistRule()
-      );
-      await waitForNextUpdate();
-      result.current[1](ruleMock);
-      await waitForNextUpdate();
-      expect(result.current).toEqual([{ isLoading: false, isSaved: true }, result.current[1]]);
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/persist_rule.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/persist_rule.tsx
deleted file mode 100644
index fd139d59c0a271..00000000000000
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/persist_rule.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { useEffect, useState, Dispatch } from 'react';
-
-import { errorToToaster, useStateToaster } from '../../../../common/components/toasters';
-
-import { addRule as persistRule } from './api';
-import * as i18n from './translations';
-import { NewRule } from './types';
-
-interface PersistRuleReturn {
-  isLoading: boolean;
-  isSaved: boolean;
-}
-
-export type ReturnPersistRule = [PersistRuleReturn, Dispatch<NewRule | null>];
-
-export const usePersistRule = (): ReturnPersistRule => {
-  const [rule, setRule] = useState<NewRule | null>(null);
-  const [isSaved, setIsSaved] = useState(false);
-  const [isLoading, setIsLoading] = useState(false);
-  const [, dispatchToaster] = useStateToaster();
-
-  useEffect(() => {
-    let isSubscribed = true;
-    const abortCtrl = new AbortController();
-    setIsSaved(false);
-    async function saveRule() {
-      if (rule != null) {
-        try {
-          setIsLoading(true);
-          await persistRule({ rule, signal: abortCtrl.signal });
-          if (isSubscribed) {
-            setIsSaved(true);
-          }
-        } catch (error) {
-          if (isSubscribed) {
-            errorToToaster({ title: i18n.RULE_ADD_FAILURE, error, dispatchToaster });
-          }
-        }
-        if (isSubscribed) {
-          setIsLoading(false);
-        }
-      }
-    }
-
-    saveRule();
-    return () => {
-      isSubscribed = false;
-      abortCtrl.abort();
-    };
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [rule]);
-
-  return [{ isLoading, isSaved }, setRule];
-};
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts
index a5bbc0465ccc1c..e94e57ad82bcfe 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts
@@ -6,8 +6,8 @@
 
 import * as t from 'io-ts';
 
-import { RuleTypeSchema } from '../../../../../common/detection_engine/types';
 import {
+  SortOrder,
   author,
   building_block_type,
   license,
@@ -16,12 +16,14 @@ import {
   severity_mapping,
   timestamp_override,
   threshold,
+  type,
 } from '../../../../../common/detection_engine/schemas/common/schemas';
+import { listArray } from '../../../../../common/detection_engine/schemas/types';
 import {
-  listArray,
-  listArrayOrUndefined,
-} from '../../../../../common/detection_engine/schemas/types';
-import { PatchRulesSchema } from '../../../../../common/detection_engine/schemas/request/patch_rules_schema';
+  CreateRulesSchema,
+  PatchRulesSchema,
+  UpdateRulesSchema,
+} from '../../../../../common/detection_engine/schemas/request';
 
 /**
  * Params is an "record", since it is a type of AlertActionParams which is action templates.
@@ -36,48 +38,13 @@ export const action = t.exact(
   })
 );
 
-export const NewRuleSchema = t.intersection([
-  t.type({
-    description: t.string,
-    enabled: t.boolean,
-    interval: t.string,
-    name: t.string,
-    risk_score: t.number,
-    severity: t.string,
-    type: RuleTypeSchema,
-  }),
-  t.partial({
-    actions: t.array(action),
-    anomaly_threshold: t.number,
-    created_by: t.string,
-    false_positives: t.array(t.string),
-    filters: t.array(t.unknown),
-    from: t.string,
-    id: t.string,
-    index: t.array(t.string),
-    language: t.string,
-    machine_learning_job_id: t.string,
-    max_signals: t.number,
-    query: t.string,
-    references: t.array(t.string),
-    rule_id: t.string,
-    saved_id: t.string,
-    tags: t.array(t.string),
-    threat: t.array(t.unknown),
-    threshold,
-    throttle: t.union([t.string, t.null]),
-    to: t.string,
-    updated_by: t.string,
-    note: t.string,
-    exceptions_list: listArrayOrUndefined,
-  }),
-]);
-
-export const NewRulesSchema = t.array(NewRuleSchema);
-export type NewRule = t.TypeOf<typeof NewRuleSchema>;
+export interface CreateRulesProps {
+  rule: CreateRulesSchema;
+  signal: AbortSignal;
+}
 
-export interface AddRulesProps {
-  rule: NewRule;
+export interface UpdateRulesProps {
+  rule: UpdateRulesSchema;
   signal: AbortSignal;
 }
 
@@ -117,7 +84,7 @@ export const RuleSchema = t.intersection([
     severity: t.string,
     severity_mapping,
     tags: t.array(t.string),
-    type: RuleTypeSchema,
+    type,
     to: t.string,
     threat: t.array(t.unknown),
     updated_at: t.string,
@@ -185,7 +152,7 @@ export interface FetchRulesProps {
 export interface FilterOptions {
   filter: string;
   sortField: string;
-  sortOrder: 'asc' | 'desc';
+  sortOrder: SortOrder;
   showCustomRules?: boolean;
   showElasticRules?: boolean;
   tags?: string[];
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_create_rule.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_create_rule.test.tsx
new file mode 100644
index 00000000000000..42d6a2a92a4c2f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_create_rule.test.tsx
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { renderHook, act } from '@testing-library/react-hooks';
+
+import { useCreateRule, ReturnCreateRule } from './use_create_rule';
+import { getUpdateRulesSchemaMock } from '../../../../../common/detection_engine/schemas/request/update_rules_schema.mock';
+
+jest.mock('./api');
+
+describe('useCreateRule', () => {
+  test('init', async () => {
+    const { result } = renderHook<unknown, ReturnCreateRule>(() => useCreateRule());
+
+    expect(result.current).toEqual([{ isLoading: false, isSaved: false }, result.current[1]]);
+  });
+
+  test('saving rule with isLoading === true', async () => {
+    await act(async () => {
+      const { result, rerender, waitForNextUpdate } = renderHook<void, ReturnCreateRule>(() =>
+        useCreateRule()
+      );
+      await waitForNextUpdate();
+      result.current[1](getUpdateRulesSchemaMock());
+      rerender();
+      expect(result.current).toEqual([{ isLoading: true, isSaved: false }, result.current[1]]);
+    });
+  });
+
+  test('saved rule with isSaved === true', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook<void, ReturnCreateRule>(() =>
+        useCreateRule()
+      );
+      await waitForNextUpdate();
+      result.current[1](getUpdateRulesSchemaMock());
+      await waitForNextUpdate();
+      expect(result.current).toEqual([{ isLoading: false, isSaved: true }, result.current[1]]);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_create_rule.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_create_rule.tsx
new file mode 100644
index 00000000000000..2bbd27994fc771
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_create_rule.tsx
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useEffect, useState, Dispatch } from 'react';
+
+import { errorToToaster, useStateToaster } from '../../../../common/components/toasters';
+import { CreateRulesSchema } from '../../../../../common/detection_engine/schemas/request';
+
+import { createRule } from './api';
+import * as i18n from './translations';
+
+interface CreateRuleReturn {
+  isLoading: boolean;
+  isSaved: boolean;
+}
+
+export type ReturnCreateRule = [CreateRuleReturn, Dispatch<CreateRulesSchema | null>];
+
+export const useCreateRule = (): ReturnCreateRule => {
+  const [rule, setRule] = useState<CreateRulesSchema | null>(null);
+  const [isSaved, setIsSaved] = useState(false);
+  const [isLoading, setIsLoading] = useState(false);
+  const [, dispatchToaster] = useStateToaster();
+
+  useEffect(() => {
+    let isSubscribed = true;
+    const abortCtrl = new AbortController();
+    setIsSaved(false);
+    async function saveRule() {
+      if (rule != null) {
+        try {
+          setIsLoading(true);
+          await createRule({ rule, signal: abortCtrl.signal });
+          if (isSubscribed) {
+            setIsSaved(true);
+          }
+        } catch (error) {
+          if (isSubscribed) {
+            errorToToaster({ title: i18n.RULE_ADD_FAILURE, error, dispatchToaster });
+          }
+        }
+        if (isSubscribed) {
+          setIsLoading(false);
+        }
+      }
+    }
+
+    saveRule();
+    return () => {
+      isSubscribed = false;
+      abortCtrl.abort();
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [rule]);
+
+  return [{ isLoading, isSaved }, setRule];
+};
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_dissasociate_exception_list.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_dissasociate_exception_list.test.tsx
index 6721d89f2799b7..2ba78cd90cf9b0 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_dissasociate_exception_list.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_dissasociate_exception_list.test.tsx
@@ -9,7 +9,7 @@ import { act, renderHook } from '@testing-library/react-hooks';
 import { coreMock } from '../../../../../../../../src/core/public/mocks';
 
 import * as api from './api';
-import { ruleMock } from './mock';
+import { getRulesSchemaMock } from '../../../../../common/detection_engine/schemas/response/rules_schema.mocks';
 import {
   ReturnUseDissasociateExceptionList,
   UseDissasociateExceptionListProps,
@@ -23,7 +23,7 @@ describe('useDissasociateExceptionList', () => {
   const onSuccess = jest.fn();
 
   beforeEach(() => {
-    jest.spyOn(api, 'patchRule').mockResolvedValue(ruleMock);
+    jest.spyOn(api, 'patchRule').mockResolvedValue(getRulesSchemaMock());
   });
 
   afterEach(() => {
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_pre_packaged_rules.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_pre_packaged_rules.test.tsx
index 9a6ea4f60fdcc9..92d46a785b0349 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_pre_packaged_rules.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_pre_packaged_rules.test.tsx
@@ -10,7 +10,7 @@ import * as api from './api';
 
 jest.mock('./api');
 
-describe('usePersistRule', () => {
+describe('usePrePackagedRules', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     jest.restoreAllMocks();
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_update_rule.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_update_rule.test.tsx
new file mode 100644
index 00000000000000..9603a4151933a4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_update_rule.test.tsx
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { renderHook, act } from '@testing-library/react-hooks';
+
+import { useUpdateRule, ReturnUpdateRule } from './use_update_rule';
+import { getUpdateRulesSchemaMock } from '../../../../../common/detection_engine/schemas/request/update_rules_schema.mock';
+
+jest.mock('./api');
+
+describe('useUpdateRule', () => {
+  test('init', async () => {
+    const { result } = renderHook<unknown, ReturnUpdateRule>(() => useUpdateRule());
+
+    expect(result.current).toEqual([{ isLoading: false, isSaved: false }, result.current[1]]);
+  });
+
+  test('saving rule with isLoading === true', async () => {
+    await act(async () => {
+      const { result, rerender, waitForNextUpdate } = renderHook<void, ReturnUpdateRule>(() =>
+        useUpdateRule()
+      );
+      await waitForNextUpdate();
+      result.current[1](getUpdateRulesSchemaMock());
+      rerender();
+      expect(result.current).toEqual([{ isLoading: true, isSaved: false }, result.current[1]]);
+    });
+  });
+
+  test('saved rule with isSaved === true', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook<void, ReturnUpdateRule>(() =>
+        useUpdateRule()
+      );
+      await waitForNextUpdate();
+      result.current[1](getUpdateRulesSchemaMock());
+      await waitForNextUpdate();
+      expect(result.current).toEqual([{ isLoading: false, isSaved: true }, result.current[1]]);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_update_rule.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_update_rule.tsx
new file mode 100644
index 00000000000000..a437974e93ba30
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_update_rule.tsx
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useEffect, useState, Dispatch } from 'react';
+
+import { errorToToaster, useStateToaster } from '../../../../common/components/toasters';
+import { UpdateRulesSchema } from '../../../../../common/detection_engine/schemas/request';
+
+import { updateRule } from './api';
+import * as i18n from './translations';
+
+interface UpdateRuleReturn {
+  isLoading: boolean;
+  isSaved: boolean;
+}
+
+export type ReturnUpdateRule = [UpdateRuleReturn, Dispatch<UpdateRulesSchema | null>];
+
+export const useUpdateRule = (): ReturnUpdateRule => {
+  const [rule, setRule] = useState<UpdateRulesSchema | null>(null);
+  const [isSaved, setIsSaved] = useState(false);
+  const [isLoading, setIsLoading] = useState(false);
+  const [, dispatchToaster] = useStateToaster();
+
+  useEffect(() => {
+    let isSubscribed = true;
+    const abortCtrl = new AbortController();
+    setIsSaved(false);
+    async function saveRule() {
+      if (rule != null) {
+        try {
+          setIsLoading(true);
+          await updateRule({ rule, signal: abortCtrl.signal });
+          if (isSubscribed) {
+            setIsSaved(true);
+          }
+        } catch (error) {
+          if (isSubscribed) {
+            errorToToaster({ title: i18n.RULE_ADD_FAILURE, error, dispatchToaster });
+          }
+        }
+        if (isSubscribed) {
+          setIsLoading(false);
+        }
+      }
+    }
+
+    saveRule();
+    return () => {
+      isSubscribed = false;
+      abortCtrl.abort();
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [rule]);
+
+  return [{ isLoading, isSaved }, setRule];
+};
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
index 982712cbe97975..8c21f6a1e8cb78 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
@@ -19,7 +19,7 @@ import {
 } from '../../../common/mock';
 import { setAbsoluteRangeDatePicker } from '../../../common/store/inputs/actions';
 import { DetectionEnginePageComponent } from './detection_engine';
-import { useUserInfo } from '../../components/user_info';
+import { useUserData } from '../../components/user_info';
 import { useWithSource } from '../../../common/containers/source';
 import { createStore, State } from '../../../common/store';
 import { mockHistory, Router } from '../../../cases/components/__mock__/router';
@@ -73,7 +73,7 @@ const store = createStore(
 describe('DetectionEnginePageComponent', () => {
   beforeAll(() => {
     (useParams as jest.Mock).mockReturnValue({});
-    (useUserInfo as jest.Mock).mockReturnValue({});
+    (useUserData as jest.Mock).mockReturnValue([{}]);
     (useWithSource as jest.Mock).mockReturnValue({
       indicesExist: true,
       indexPattern: {},
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
index d76da592e1c811..3a3854f145db3d 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
@@ -30,7 +30,7 @@ import { NoApiIntegrationKeyCallOut } from '../../components/no_api_integration_
 import { NoWriteAlertsCallOut } from '../../components/no_write_alerts_callout';
 import { AlertsHistogramPanel } from '../../components/alerts_histogram_panel';
 import { alertsHistogramOptions } from '../../components/alerts_histogram_panel/config';
-import { useUserInfo } from '../../components/user_info';
+import { useUserData } from '../../components/user_info';
 import { OverviewEmpty } from '../../../overview/components/overview_empty';
 import { DetectionEngineNoIndex } from './detection_engine_no_index';
 import { DetectionEngineHeaderPage } from '../../components/detection_engine_header_page';
@@ -55,15 +55,17 @@ export const DetectionEnginePageComponent: React.FC<PropsFromRedux> = ({
 }) => {
   const { to, from, deleteQuery, setQuery } = useGlobalTime();
   const { globalFullScreen } = useFullScreen();
-  const {
-    loading: userInfoLoading,
-    isSignalIndexExists,
-    isAuthenticated: isUserAuthenticated,
-    hasEncryptionKey,
-    canUserCRUD,
-    signalIndexName,
-    hasIndexWrite,
-  } = useUserInfo();
+  const [
+    {
+      loading: userInfoLoading,
+      isSignalIndexExists,
+      isAuthenticated: isUserAuthenticated,
+      hasEncryptionKey,
+      canUserCRUD,
+      signalIndexName,
+      hasIndexWrite,
+    },
+  ] = useUserData();
   const {
     loading: listsConfigLoading,
     needsConfiguration: needsListsConfiguration,
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/index.test.tsx
index d4e654321ef988..045e7d402fd2b3 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/index.test.tsx
@@ -12,8 +12,8 @@ import { DetectionEngineContainer } from './index';
 
 describe('DetectionEngineContainer', () => {
   it('renders correctly', () => {
-    const wrapper = shallow(<DetectionEngineContainer url="url" />);
+    const wrapper = shallow(<DetectionEngineContainer />);
 
-    expect(wrapper.find('ManageUserInfo')).toHaveLength(1);
+    expect(wrapper.find('Switch')).toHaveLength(1);
   });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/index.tsx
index 914734aba4ec62..5f379f7dbb70e3 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/index.tsx
@@ -5,37 +5,32 @@
  */
 
 import React from 'react';
-import { Route, Switch, RouteComponentProps } from 'react-router-dom';
+import { Route, Switch } from 'react-router-dom';
 
-import { ManageUserInfo } from '../../components/user_info';
 import { CreateRulePage } from './rules/create';
 import { DetectionEnginePage } from './detection_engine';
 import { EditRulePage } from './rules/edit';
 import { RuleDetailsPage } from './rules/details';
 import { RulesPage } from './rules';
 
-type Props = Partial<RouteComponentProps<{}>> & { url: string };
-
-const DetectionEngineContainerComponent: React.FC<Props> = () => (
-  <ManageUserInfo>
-    <Switch>
-      <Route path="/rules/id/:detailName/edit">
-        <EditRulePage />
-      </Route>
-      <Route path="/rules/id/:detailName">
-        <RuleDetailsPage />
-      </Route>
-      <Route path="/rules/create">
-        <CreateRulePage />
-      </Route>
-      <Route path="/rules">
-        <RulesPage />
-      </Route>
-      <Route exact path="" strict>
-        <DetectionEnginePage />
-      </Route>
-    </Switch>
-  </ManageUserInfo>
+const DetectionEngineContainerComponent: React.FC = () => (
+  <Switch>
+    <Route path="/rules/id/:detailName/edit">
+      <EditRulePage />
+    </Route>
+    <Route path="/rules/id/:detailName">
+      <RuleDetailsPage />
+    </Route>
+    <Route path="/rules/create">
+      <CreateRulePage />
+    </Route>
+    <Route path="/rules">
+      <RulesPage />
+    </Route>
+    <Route exact path="" strict>
+      <DetectionEnginePage />
+    </Route>
+  </Switch>
 );
 
 export const DetectionEngineContainer = React.memo(DetectionEngineContainerComponent);
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/__mocks__/mock.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/__mocks__/mock.ts
index 8c6e91254314eb..5a626ce0ff00a2 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/__mocks__/mock.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/__mocks__/mock.ts
@@ -165,8 +165,7 @@ export const mockRuleWithEverything = (id: string): Rule => ({
 });
 
 // TODO: update types mapping
-export const mockAboutStepRule = (isNew = false): AboutStepRule => ({
-  isNew,
+export const mockAboutStepRule = (): AboutStepRule => ({
   author: ['Elastic'],
   isAssociatedToEndpointList: false,
   isBuildingBlock: false,
@@ -200,16 +199,14 @@ export const mockAboutStepRule = (isNew = false): AboutStepRule => ({
   note: '# this is some markdown documentation',
 });
 
-export const mockActionsStepRule = (isNew = false, enabled = false): ActionsStepRule => ({
-  isNew,
+export const mockActionsStepRule = (enabled = false): ActionsStepRule => ({
   actions: [],
   kibanaSiemAppUrl: 'http://localhost:5601/app/siem',
   enabled,
   throttle: 'no_actions',
 });
 
-export const mockDefineStepRule = (isNew = false): DefineStepRule => ({
-  isNew,
+export const mockDefineStepRule = (): DefineStepRule => ({
   ruleType: 'query',
   anomalyThreshold: 50,
   machineLearningJobId: '',
@@ -225,8 +222,7 @@ export const mockDefineStepRule = (isNew = false): DefineStepRule => ({
   },
 });
 
-export const mockScheduleStepRule = (isNew = false): ScheduleStepRule => ({
-  isNew,
+export const mockScheduleStepRule = (): ScheduleStepRule => ({
   interval: '5m',
   from: '6m',
   to: 'now',
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts
index d6dc97fbae1587..79488231b29ee6 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts
@@ -5,7 +5,8 @@
  */
 
 import { List } from '../../../../../../common/detection_engine/schemas/types';
-import { NewRule } from '../../../../containers/detection_engine/rules';
+import { CreateRulesSchema } from '../../../../../../common/detection_engine/schemas/request/create_rules_schema';
+import { Rule } from '../../../../containers/detection_engine/rules';
 import {
   getListMock,
   getEndpointListMock,
@@ -721,13 +722,13 @@ describe('helpers', () => {
       mockActions = mockActionsStepRule();
     });
 
-    test('returns NewRule with type of saved_query when saved_id exists', () => {
-      const result: NewRule = formatRule(mockDefine, mockAbout, mockSchedule, mockActions);
+    test('returns rule with type of saved_query when saved_id exists', () => {
+      const result: Rule = formatRule<Rule>(mockDefine, mockAbout, mockSchedule, mockActions);
 
       expect(result.type).toEqual('saved_query');
     });
 
-    test('returns NewRule with type of query when saved_id does not exist', () => {
+    test('returns rule with type of query when saved_id does not exist', () => {
       const mockDefineStepRuleWithoutSavedId = {
         ...mockDefine,
         queryBar: {
@@ -735,7 +736,7 @@ describe('helpers', () => {
           saved_id: '',
         },
       };
-      const result: NewRule = formatRule(
+      const result: CreateRulesSchema = formatRule<CreateRulesSchema>(
         mockDefineStepRuleWithoutSavedId,
         mockAbout,
         mockSchedule,
@@ -745,10 +746,15 @@ describe('helpers', () => {
       expect(result.type).toEqual('query');
     });
 
-    test('returns NewRule without id if ruleId does not exist', () => {
-      const result: NewRule = formatRule(mockDefine, mockAbout, mockSchedule, mockActions);
+    test('returns rule without id if ruleId does not exist', () => {
+      const result: CreateRulesSchema = formatRule<CreateRulesSchema>(
+        mockDefine,
+        mockAbout,
+        mockSchedule,
+        mockActions
+      );
 
-      expect(result.id).toBeUndefined();
+      expect(result).not.toHaveProperty<CreateRulesSchema>('id');
     });
   });
 
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
index 434a33ac377228..0137777f8f8f22 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
@@ -10,12 +10,12 @@ import deepmerge from 'deepmerge';
 
 import { NOTIFICATION_THROTTLE_NO_ACTIONS } from '../../../../../../common/constants';
 import { transformAlertToRuleAction } from '../../../../../../common/detection_engine/transform_actions';
-import { RuleType } from '../../../../../../common/detection_engine/types';
 import { isMlRule } from '../../../../../../common/machine_learning/helpers';
 import { isThresholdRule } from '../../../../../../common/detection_engine/utils';
 import { List } from '../../../../../../common/detection_engine/schemas/types';
-import { ENDPOINT_LIST_ID } from '../../../../../shared_imports';
-import { NewRule, Rule } from '../../../../containers/detection_engine/rules';
+import { ENDPOINT_LIST_ID, ExceptionListType, NamespaceType } from '../../../../../shared_imports';
+import { Rule } from '../../../../containers/detection_engine/rules';
+import { Type } from '../../../../../../common/detection_engine/schemas/common/schemas';
 
 import {
   AboutStepRule,
@@ -26,6 +26,8 @@ import {
   ScheduleStepRuleJson,
   AboutStepRuleJson,
   ActionsStepRuleJson,
+  RuleStepsFormData,
+  RuleStep,
 } from '../types';
 
 export const getTimeTypeValue = (time: string): { unit: string; value: number } => {
@@ -33,8 +35,8 @@ export const getTimeTypeValue = (time: string): { unit: string; value: number }
     unit: '',
     value: 0,
   };
-  const filterTimeVal = (time as string).match(/\d+/g);
-  const filterTimeType = (time as string).match(/[a-zA-Z]+/g);
+  const filterTimeVal = time.match(/\d+/g);
+  const filterTimeType = time.match(/[a-zA-Z]+/g);
   if (!isEmpty(filterTimeVal) && filterTimeVal != null && !isNaN(Number(filterTimeVal[0]))) {
     timeObj.value = Number(filterTimeVal[0]);
   }
@@ -48,6 +50,23 @@ export const getTimeTypeValue = (time: string): { unit: string; value: number }
   return timeObj;
 };
 
+export const stepIsValid = <T extends RuleStepsFormData[keyof RuleStepsFormData]>(
+  formData?: T
+): formData is { [K in keyof T]: Exclude<T[K], undefined> } =>
+  !!formData?.isValid && !!formData.data;
+
+export const isDefineStep = (input: unknown): input is RuleStepsFormData[RuleStep.defineRule] =>
+  has('data.ruleType', input);
+
+export const isAboutStep = (input: unknown): input is RuleStepsFormData[RuleStep.aboutRule] =>
+  has('data.name', input);
+
+export const isScheduleStep = (input: unknown): input is RuleStepsFormData[RuleStep.scheduleRule] =>
+  has('data.interval', input);
+
+export const isActionsStep = (input: unknown): input is RuleStepsFormData[RuleStep.ruleActions] =>
+  has('data.actions', input);
+
 export interface RuleFields {
   anomalyThreshold: unknown;
   machineLearningJobId: unknown;
@@ -68,7 +87,7 @@ const isThresholdFields = <T>(
   fields: QueryRuleFields<T> | MlRuleFields<T> | ThresholdRuleFields<T>
 ): fields is ThresholdRuleFields<T> => has('threshold', fields);
 
-export const filterRuleFieldsForType = <T extends RuleFields>(fields: T, type: RuleType) => {
+export const filterRuleFieldsForType = <T extends RuleFields>(fields: T, type: Type) => {
   if (isMlRule(type)) {
     const { index, queryBar, threshold, ...mlRuleFields } = fields;
     return mlRuleFields;
@@ -119,7 +138,7 @@ export const formatDefineStepData = (defineStepData: DefineStepRule): DefineStep
         query: ruleFields.queryBar?.query?.query as string,
         saved_id: ruleFields.queryBar?.saved_id,
         ...(ruleType === 'query' &&
-          ruleFields.queryBar?.saved_id && { type: 'saved_query' as RuleType }),
+          ruleFields.queryBar?.saved_id && { type: 'saved_query' as Type }),
       };
 
   return {
@@ -129,7 +148,7 @@ export const formatDefineStepData = (defineStepData: DefineStepRule): DefineStep
 };
 
 export const formatScheduleStepData = (scheduleData: ScheduleStepRule): ScheduleStepRuleJson => {
-  const { isNew, ...formatScheduleData } = scheduleData;
+  const { ...formatScheduleData } = scheduleData;
   if (!isEmpty(formatScheduleData.interval) && !isEmpty(formatScheduleData.from)) {
     const { unit: intervalUnit, value: intervalValue } = getTimeTypeValue(
       formatScheduleData.interval
@@ -161,7 +180,6 @@ export const formatAboutStepData = (
     threat,
     isAssociatedToEndpointList,
     isBuildingBlock,
-    isNew,
     note,
     ruleNameOverride,
     timestampOverride,
@@ -180,11 +198,11 @@ export const formatAboutStepData = (
             {
               id: ENDPOINT_LIST_ID,
               list_id: ENDPOINT_LIST_ID,
-              namespace_type: 'agnostic',
-              type: 'endpoint',
+              namespace_type: 'agnostic' as NamespaceType,
+              type: 'endpoint' as ExceptionListType,
             },
             ...detectionExceptionLists,
-          ] as AboutStepRuleJson['exceptions_list'],
+          ],
         }
       : exceptionsList != null
       ? {
@@ -237,16 +255,19 @@ export const formatActionsStepData = (actionsStepData: ActionsStepRule): Actions
   };
 };
 
-export const formatRule = (
+// Used to format form data in rule edit and
+// create flows so "T" here would likely
+// either be CreateRulesSchema or Rule
+export const formatRule = <T>(
   defineStepData: DefineStepRule,
   aboutStepData: AboutStepRule,
   scheduleData: ScheduleStepRule,
   actionsData: ActionsStepRule,
   rule?: Rule | null
-): NewRule =>
-  deepmerge.all([
+): T =>
+  (deepmerge.all([
     formatDefineStepData(defineStepData),
     formatAboutStepData(aboutStepData, rule?.exceptions_list),
     formatScheduleStepData(scheduleData),
     formatActionsStepData(actionsData),
-  ]) as NewRule;
+  ]) as unknown) as T;
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.test.tsx
index 50407c5eb219b2..deffee5a56d46d 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.test.tsx
@@ -10,7 +10,7 @@ import { shallow } from 'enzyme';
 import '../../../../../common/mock/match_media';
 import { TestProviders } from '../../../../../common/mock';
 import { CreateRulePage } from './index';
-import { useUserInfo } from '../../../../components/user_info';
+import { useUserData } from '../../../../components/user_info';
 
 jest.mock('react-router-dom', () => {
   const original = jest.requireActual('react-router-dom');
@@ -29,7 +29,7 @@ jest.mock('../../../../components/user_info');
 
 describe('CreateRulePage', () => {
   it('renders correctly', () => {
-    (useUserInfo as jest.Mock).mockReturnValue({});
+    (useUserData as jest.Mock).mockReturnValue([{}]);
     const wrapper = shallow(<CreateRulePage />, { wrappingComponent: TestProviders });
 
     expect(wrapper.find('[title="Create new rule"]')).toHaveLength(1);
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
index 70f278197b0051..48247392dfe7f6 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
@@ -9,7 +9,8 @@ import React, { useCallback, useRef, useState, useMemo } from 'react';
 import { useHistory } from 'react-router-dom';
 import styled, { StyledComponent } from 'styled-components';
 
-import { usePersistRule } from '../../../../containers/detection_engine/rules';
+import { useCreateRule } from '../../../../containers/detection_engine/rules';
+import { CreateRulesSchema } from '../../../../../../common/detection_engine/schemas/request';
 import { useListsConfig } from '../../../../containers/detection_engine/lists/use_lists_config';
 
 import {
@@ -19,34 +20,22 @@ import {
 import { WrapperPage } from '../../../../../common/components/wrapper_page';
 import { displaySuccessToast, useStateToaster } from '../../../../../common/components/toasters';
 import { SpyRoute } from '../../../../../common/utils/route/spy_routes';
-import { useUserInfo } from '../../../../components/user_info';
+import { useUserData } from '../../../../components/user_info';
 import { AccordionTitle } from '../../../../components/rules/accordion_title';
-import { FormData, FormHook } from '../../../../../shared_imports';
-import { StepAboutRule } from '../../../../components/rules/step_about_rule';
 import { StepDefineRule } from '../../../../components/rules/step_define_rule';
+import { StepAboutRule } from '../../../../components/rules/step_about_rule';
 import { StepScheduleRule } from '../../../../components/rules/step_schedule_rule';
 import { StepRuleActions } from '../../../../components/rules/step_rule_actions';
 import { DetectionEngineHeaderPage } from '../../../../components/detection_engine_header_page';
 import * as RuleI18n from '../translations';
 import { redirectToDetections, getActionMessageParams, userHasNoPermissions } from '../helpers';
-import {
-  AboutStepRule,
-  DefineStepRule,
-  RuleStep,
-  RuleStepData,
-  ScheduleStepRule,
-  ActionsStepRule,
-} from '../types';
-import { formatRule } from './helpers';
+import { RuleStep, RuleStepsFormData, RuleStepsFormHooks } from '../types';
+import { formatRule, stepIsValid } from './helpers';
 import * as i18n from './translations';
 import { SecurityPageName } from '../../../../../app/types';
+import { ruleStepsOrder } from '../utils';
 
-const stepsRuleOrder = [
-  RuleStep.defineRule,
-  RuleStep.aboutRule,
-  RuleStep.scheduleRule,
-  RuleStep.ruleActions,
-];
+const formHookNoop = async (): Promise<undefined> => undefined;
 
 const MyEuiPanel = styled(EuiPanel)<{
   zindex?: number;
@@ -84,108 +73,152 @@ const StepDefineRuleAccordion: StyledComponent<
 StepDefineRuleAccordion.displayName = 'StepDefineRuleAccordion';
 
 const CreateRulePageComponent: React.FC = () => {
-  const {
-    loading: userInfoLoading,
-    isSignalIndexExists,
-    isAuthenticated,
-    hasEncryptionKey,
-    canUserCRUD,
-  } = useUserInfo();
+  const [
+    {
+      loading: userInfoLoading,
+      isSignalIndexExists,
+      isAuthenticated,
+      hasEncryptionKey,
+      canUserCRUD,
+    },
+  ] = useUserData();
   const {
     loading: listsConfigLoading,
     needsConfiguration: needsListsConfiguration,
   } = useListsConfig();
   const loading = userInfoLoading || listsConfigLoading;
   const [, dispatchToaster] = useStateToaster();
-  const [openAccordionId, setOpenAccordionId] = useState<RuleStep>(RuleStep.defineRule);
+  const [activeStep, setActiveStep] = useState<RuleStep>(RuleStep.defineRule);
+  const getNextStep = (step: RuleStep): RuleStep | undefined =>
+    ruleStepsOrder[ruleStepsOrder.indexOf(step) + 1];
   const defineRuleRef = useRef<EuiAccordion | null>(null);
   const aboutRuleRef = useRef<EuiAccordion | null>(null);
   const scheduleRuleRef = useRef<EuiAccordion | null>(null);
   const ruleActionsRef = useRef<EuiAccordion | null>(null);
-  const stepsForm = useRef<Record<RuleStep, FormHook<FormData> | null>>({
-    [RuleStep.defineRule]: null,
-    [RuleStep.aboutRule]: null,
-    [RuleStep.scheduleRule]: null,
-    [RuleStep.ruleActions]: null,
+  const formHooks = useRef<RuleStepsFormHooks>({
+    [RuleStep.defineRule]: formHookNoop,
+    [RuleStep.aboutRule]: formHookNoop,
+    [RuleStep.scheduleRule]: formHookNoop,
+    [RuleStep.ruleActions]: formHookNoop,
   });
-  const stepsData = useRef<Record<RuleStep, RuleStepData>>({
+  const setFormHook = useCallback(
+    <K extends keyof RuleStepsFormHooks>(step: K, hook: RuleStepsFormHooks[K]) => {
+      formHooks.current[step] = hook;
+    },
+    []
+  );
+  const stepsData = useRef<RuleStepsFormData>({
     [RuleStep.defineRule]: { isValid: false, data: undefined },
     [RuleStep.aboutRule]: { isValid: false, data: undefined },
     [RuleStep.scheduleRule]: { isValid: false, data: undefined },
     [RuleStep.ruleActions]: { isValid: false, data: undefined },
   });
-  const [isStepRuleInReadOnlyView, setIsStepRuleInEditView] = useState<Record<RuleStep, boolean>>({
+  const setStepData = <K extends keyof RuleStepsFormData>(
+    step: K,
+    data: RuleStepsFormData[K]
+  ): void => {
+    stepsData.current[step] = data;
+  };
+  const [openSteps, setOpenSteps] = useState({
     [RuleStep.defineRule]: false,
     [RuleStep.aboutRule]: false,
     [RuleStep.scheduleRule]: false,
     [RuleStep.ruleActions]: false,
   });
-  const [{ isLoading, isSaved }, setRule] = usePersistRule();
-  const actionMessageParams = useMemo(
-    () =>
-      getActionMessageParams((stepsData.current['define-rule'].data as DefineStepRule)?.ruleType),
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [stepsData.current['define-rule'].data]
-  );
+  const [{ isLoading, isSaved }, setRule] = useCreateRule();
+  const ruleType = stepsData.current[RuleStep.defineRule].data?.ruleType;
+  const ruleName = stepsData.current[RuleStep.aboutRule].data?.name;
+  const actionMessageParams = useMemo(() => getActionMessageParams(ruleType), [ruleType]);
   const history = useHistory();
 
-  const setStepData = useCallback(
-    (step: RuleStep, data: unknown, isValid: boolean) => {
-      stepsData.current[step] = { ...stepsData.current[step], data, isValid };
-      if (isValid) {
-        const stepRuleIdx = stepsRuleOrder.findIndex((item) => step === item);
-        if ([0, 1, 2].includes(stepRuleIdx)) {
-          if (isStepRuleInReadOnlyView[stepsRuleOrder[stepRuleIdx + 1]]) {
-            setOpenAccordionId(stepsRuleOrder[stepRuleIdx + 1]);
-            setIsStepRuleInEditView({
-              ...isStepRuleInReadOnlyView,
-              [step]: true,
-              [stepsRuleOrder[stepRuleIdx + 1]]: false,
-            });
-          } else if (openAccordionId !== stepsRuleOrder[stepRuleIdx + 1]) {
-            setIsStepRuleInEditView({
-              ...isStepRuleInReadOnlyView,
-              [step]: true,
-            });
-            openCloseAccordion(stepsRuleOrder[stepRuleIdx + 1]);
-            setOpenAccordionId(stepsRuleOrder[stepRuleIdx + 1]);
+  const handleAccordionToggle = useCallback(
+    (step: RuleStep, isOpen: boolean) =>
+      setOpenSteps((_openSteps) => ({
+        ..._openSteps,
+        [step]: isOpen,
+      })),
+    []
+  );
+  const goToStep = useCallback(
+    (step: RuleStep) => {
+      if (ruleStepsOrder.indexOf(step) > ruleStepsOrder.indexOf(activeStep) && !openSteps[step]) {
+        toggleStepAccordion(step);
+      }
+      setActiveStep(step);
+    },
+    [activeStep, openSteps]
+  );
+
+  const toggleStepAccordion = (step: RuleStep | null) => {
+    if (step === RuleStep.defineRule) {
+      defineRuleRef.current?.onToggle();
+    } else if (step === RuleStep.aboutRule) {
+      aboutRuleRef.current?.onToggle();
+    } else if (step === RuleStep.scheduleRule) {
+      scheduleRuleRef.current?.onToggle();
+    } else if (step === RuleStep.ruleActions) {
+      ruleActionsRef.current?.onToggle();
+    }
+  };
+
+  const editStep = useCallback(
+    async (step: RuleStep) => {
+      const activeStepData = await formHooks.current[activeStep]();
+
+      if (activeStepData?.isValid) {
+        setStepData(activeStep, activeStepData);
+        goToStep(step);
+      }
+    },
+    [activeStep, goToStep]
+  );
+  const submitStep = useCallback(
+    async (step: RuleStep) => {
+      const stepData = await formHooks.current[step]();
+
+      if (stepData?.isValid) {
+        setStepData(step, stepData);
+        const nextStep = getNextStep(step);
+
+        if (nextStep != null) {
+          goToStep(nextStep);
+        } else {
+          const defineStep = await stepsData.current[RuleStep.defineRule];
+          const aboutStep = await stepsData.current[RuleStep.aboutRule];
+          const scheduleStep = await stepsData.current[RuleStep.scheduleRule];
+          const actionsStep = await stepsData.current[RuleStep.ruleActions];
+
+          if (
+            stepIsValid(defineStep) &&
+            stepIsValid(aboutStep) &&
+            stepIsValid(scheduleStep) &&
+            stepIsValid(actionsStep)
+          ) {
+            setRule(
+              formatRule<CreateRulesSchema>(
+                defineStep.data,
+                aboutStep.data,
+                scheduleStep.data,
+                actionsStep.data
+              )
+            );
           }
-        } else if (
-          stepRuleIdx === 3 &&
-          stepsData.current[RuleStep.defineRule].isValid &&
-          stepsData.current[RuleStep.aboutRule].isValid &&
-          stepsData.current[RuleStep.scheduleRule].isValid
-        ) {
-          setRule(
-            formatRule(
-              stepsData.current[RuleStep.defineRule].data as DefineStepRule,
-              stepsData.current[RuleStep.aboutRule].data as AboutStepRule,
-              stepsData.current[RuleStep.scheduleRule].data as ScheduleStepRule,
-              stepsData.current[RuleStep.ruleActions].data as ActionsStepRule
-            )
-          );
         }
       }
     },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [isStepRuleInReadOnlyView, openAccordionId, stepsData.current, setRule]
+    [goToStep, setRule]
   );
 
-  const setStepsForm = useCallback((step: RuleStep, form: FormHook<FormData>) => {
-    stepsForm.current[step] = form;
-  }, []);
-
   const getAccordionType = useCallback(
-    (accordionId: RuleStep) => {
-      if (accordionId === openAccordionId) {
+    (step: RuleStep) => {
+      if (step === activeStep) {
         return 'active';
-      } else if (stepsData.current[accordionId].isValid) {
+      } else if (stepsData.current[step].isValid) {
         return 'valid';
       }
       return 'passive';
     },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [openAccordionId, stepsData.current]
+    [activeStep]
   );
 
   const defineRuleButton = (
@@ -195,7 +228,6 @@ const CreateRulePageComponent: React.FC = () => {
       type={getAccordionType(RuleStep.defineRule)}
     />
   );
-
   const aboutRuleButton = (
     <AccordionTitle
       name="2"
@@ -203,7 +235,6 @@ const CreateRulePageComponent: React.FC = () => {
       type={getAccordionType(RuleStep.aboutRule)}
     />
   );
-
   const scheduleRuleButton = (
     <AccordionTitle
       name="3"
@@ -211,7 +242,6 @@ const CreateRulePageComponent: React.FC = () => {
       type={getAccordionType(RuleStep.scheduleRule)}
     />
   );
-
   const ruleActionsButton = (
     <AccordionTitle
       name="4"
@@ -220,63 +250,7 @@ const CreateRulePageComponent: React.FC = () => {
     />
   );
 
-  const openCloseAccordion = (accordionId: RuleStep | null) => {
-    if (accordionId != null) {
-      if (accordionId === RuleStep.defineRule && defineRuleRef.current != null) {
-        defineRuleRef.current.onToggle();
-      } else if (accordionId === RuleStep.aboutRule && aboutRuleRef.current != null) {
-        aboutRuleRef.current.onToggle();
-      } else if (accordionId === RuleStep.scheduleRule && scheduleRuleRef.current != null) {
-        scheduleRuleRef.current.onToggle();
-      } else if (accordionId === RuleStep.ruleActions && ruleActionsRef.current != null) {
-        ruleActionsRef.current.onToggle();
-      }
-    }
-  };
-
-  const manageAccordions = useCallback(
-    (id: RuleStep, isOpen: boolean) => {
-      const activeRuleIdx = stepsRuleOrder.findIndex((step) => step === openAccordionId);
-      const stepRuleIdx = stepsRuleOrder.findIndex((step) => step === id);
-
-      if ((id === openAccordionId || stepRuleIdx < activeRuleIdx) && !isOpen) {
-        openCloseAccordion(id);
-      } else if (stepRuleIdx >= activeRuleIdx) {
-        if (
-          openAccordionId !== id &&
-          !stepsData.current[openAccordionId].isValid &&
-          !isStepRuleInReadOnlyView[id] &&
-          isOpen
-        ) {
-          openCloseAccordion(id);
-        }
-      }
-    },
-    [isStepRuleInReadOnlyView, openAccordionId, stepsData]
-  );
-
-  const manageIsEditable = useCallback(
-    async (id: RuleStep) => {
-      const activeForm = await stepsForm.current[openAccordionId]?.submit();
-      if (activeForm != null && activeForm?.isValid) {
-        stepsData.current[openAccordionId] = {
-          ...stepsData.current[openAccordionId],
-          data: activeForm.data,
-          isValid: activeForm.isValid,
-        };
-        setOpenAccordionId(id);
-        setIsStepRuleInEditView({
-          ...isStepRuleInReadOnlyView,
-          [openAccordionId]: true,
-          [id]: false,
-        });
-      }
-    },
-    [isStepRuleInReadOnlyView, openAccordionId]
-  );
-
-  if (isSaved) {
-    const ruleName = (stepsData.current[RuleStep.aboutRule].data as AboutStepRule).name;
+  if (isSaved && ruleName) {
     displaySuccessToast(i18n.SUCCESSFULLY_CREATED_RULES(ruleName), dispatchToaster);
     history.replace(getRulesUrl());
     return null;
@@ -317,13 +291,14 @@ const CreateRulePageComponent: React.FC = () => {
             buttonContent={defineRuleButton}
             paddingSize="xs"
             ref={defineRuleRef}
-            onToggle={manageAccordions.bind(null, RuleStep.defineRule)}
+            onToggle={handleAccordionToggle.bind(null, RuleStep.defineRule)}
             extraAction={
               stepsData.current[RuleStep.defineRule].isValid && (
                 <EuiButtonEmpty
+                  data-test-subj="edit-define-rule"
                   iconType="pencil"
                   size="xs"
-                  onClick={manageIsEditable.bind(null, RuleStep.defineRule)}
+                  onClick={() => editStep(RuleStep.defineRule)}
                 >
                   {i18n.EDIT_RULE}
                 </EuiButtonEmpty>
@@ -333,11 +308,11 @@ const CreateRulePageComponent: React.FC = () => {
             <EuiHorizontalRule margin="m" />
             <StepDefineRule
               addPadding={true}
-              defaultValues={stepsData.current[RuleStep.defineRule].data as DefineStepRule}
-              isReadOnlyView={isStepRuleInReadOnlyView[RuleStep.defineRule]}
+              defaultValues={stepsData.current[RuleStep.defineRule].data}
+              isReadOnlyView={activeStep !== RuleStep.defineRule}
               isLoading={isLoading || loading}
-              setForm={setStepsForm}
-              setStepData={setStepData}
+              setForm={setFormHook}
+              onSubmit={() => submitStep(RuleStep.defineRule)}
               descriptionColumns="singleSplit"
             />
           </StepDefineRuleAccordion>
@@ -350,13 +325,14 @@ const CreateRulePageComponent: React.FC = () => {
             buttonContent={aboutRuleButton}
             paddingSize="xs"
             ref={aboutRuleRef}
-            onToggle={manageAccordions.bind(null, RuleStep.aboutRule)}
+            onToggle={handleAccordionToggle.bind(null, RuleStep.aboutRule)}
             extraAction={
               stepsData.current[RuleStep.aboutRule].isValid && (
                 <EuiButtonEmpty
+                  data-test-subj="edit-about-rule"
                   iconType="pencil"
                   size="xs"
-                  onClick={manageIsEditable.bind(null, RuleStep.aboutRule)}
+                  onClick={() => editStep(RuleStep.aboutRule)}
                 >
                   {i18n.EDIT_RULE}
                 </EuiButtonEmpty>
@@ -366,13 +342,13 @@ const CreateRulePageComponent: React.FC = () => {
             <EuiHorizontalRule margin="m" />
             <StepAboutRule
               addPadding={true}
-              defaultValues={stepsData.current[RuleStep.aboutRule].data as AboutStepRule}
-              defineRuleData={stepsData.current[RuleStep.defineRule].data as DefineStepRule}
+              defaultValues={stepsData.current[RuleStep.aboutRule].data}
+              defineRuleData={stepsData.current[RuleStep.defineRule].data}
               descriptionColumns="singleSplit"
-              isReadOnlyView={isStepRuleInReadOnlyView[RuleStep.aboutRule]}
+              isReadOnlyView={activeStep !== RuleStep.aboutRule}
               isLoading={isLoading || loading}
-              setForm={setStepsForm}
-              setStepData={setStepData}
+              setForm={setFormHook}
+              onSubmit={() => submitStep(RuleStep.aboutRule)}
             />
           </EuiAccordion>
         </MyEuiPanel>
@@ -384,13 +360,13 @@ const CreateRulePageComponent: React.FC = () => {
             buttonContent={scheduleRuleButton}
             paddingSize="xs"
             ref={scheduleRuleRef}
-            onToggle={manageAccordions.bind(null, RuleStep.scheduleRule)}
+            onToggle={handleAccordionToggle.bind(null, RuleStep.scheduleRule)}
             extraAction={
               stepsData.current[RuleStep.scheduleRule].isValid && (
                 <EuiButtonEmpty
                   iconType="pencil"
                   size="xs"
-                  onClick={manageIsEditable.bind(null, RuleStep.scheduleRule)}
+                  onClick={() => editStep(RuleStep.scheduleRule)}
                 >
                   {i18n.EDIT_RULE}
                 </EuiButtonEmpty>
@@ -400,12 +376,12 @@ const CreateRulePageComponent: React.FC = () => {
             <EuiHorizontalRule margin="m" />
             <StepScheduleRule
               addPadding={true}
-              defaultValues={stepsData.current[RuleStep.scheduleRule].data as ScheduleStepRule}
+              defaultValues={stepsData.current[RuleStep.scheduleRule].data}
               descriptionColumns="singleSplit"
-              isReadOnlyView={isStepRuleInReadOnlyView[RuleStep.scheduleRule]}
+              isReadOnlyView={activeStep !== RuleStep.scheduleRule}
               isLoading={isLoading || loading}
-              setForm={setStepsForm}
-              setStepData={setStepData}
+              setForm={setFormHook}
+              onSubmit={() => submitStep(RuleStep.scheduleRule)}
             />
           </EuiAccordion>
         </MyEuiPanel>
@@ -417,13 +393,13 @@ const CreateRulePageComponent: React.FC = () => {
             buttonContent={ruleActionsButton}
             paddingSize="xs"
             ref={ruleActionsRef}
-            onToggle={manageAccordions.bind(null, RuleStep.ruleActions)}
+            onToggle={handleAccordionToggle.bind(null, RuleStep.ruleActions)}
             extraAction={
               stepsData.current[RuleStep.ruleActions].isValid && (
                 <EuiButtonEmpty
                   iconType="pencil"
                   size="xs"
-                  onClick={manageIsEditable.bind(null, RuleStep.ruleActions)}
+                  onClick={() => editStep(RuleStep.ruleActions)}
                 >
                   {i18n.EDIT_RULE}
                 </EuiButtonEmpty>
@@ -433,10 +409,11 @@ const CreateRulePageComponent: React.FC = () => {
             <EuiHorizontalRule margin="m" />
             <StepRuleActions
               addPadding={true}
-              isReadOnlyView={isStepRuleInReadOnlyView[RuleStep.ruleActions]}
+              defaultValues={stepsData.current[RuleStep.ruleActions].data}
+              isReadOnlyView={activeStep !== RuleStep.ruleActions}
               isLoading={isLoading || loading}
-              setForm={setStepsForm}
-              setStepData={setStepData}
+              setForm={setFormHook}
+              onSubmit={() => submitStep(RuleStep.ruleActions)}
               actionMessageParams={actionMessageParams}
             />
           </EuiAccordion>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
index 5e6587dab1736a..f8f9da78b2a062 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
@@ -19,7 +19,7 @@ import {
 import { RuleDetailsPageComponent } from './index';
 import { createStore, State } from '../../../../../common/store';
 import { setAbsoluteRangeDatePicker } from '../../../../../common/store/inputs/actions';
-import { useUserInfo } from '../../../../components/user_info';
+import { useUserData } from '../../../../components/user_info';
 import { useWithSource } from '../../../../../common/containers/source';
 import { useParams } from 'react-router-dom';
 import { mockHistory, Router } from '../../../../../cases/components/__mock__/router';
@@ -69,7 +69,7 @@ const store = createStore(
 
 describe('RuleDetailsPageComponent', () => {
   beforeAll(() => {
-    (useUserInfo as jest.Mock).mockReturnValue({});
+    (useUserData as jest.Mock).mockReturnValue([{}]);
     (useParams as jest.Mock).mockReturnValue({});
     (useWithSource as jest.Mock).mockReturnValue({
       indicesExist: true,
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
index f48dc64966bfc6..2988e031c4dd6d 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
@@ -44,7 +44,7 @@ import { StepAboutRuleToggleDetails } from '../../../../components/rules/step_ab
 import { DetectionEngineHeaderPage } from '../../../../components/detection_engine_header_page';
 import { AlertsHistogramPanel } from '../../../../components/alerts_histogram_panel';
 import { AlertsTable } from '../../../../components/alerts_table';
-import { useUserInfo } from '../../../../components/user_info';
+import { useUserData } from '../../../../components/user_info';
 import { OverviewEmpty } from '../../../../../overview/components/overview_empty';
 import { useAlertInfo } from '../../../../components/alerts_info';
 import { StepDefineRule } from '../../../../components/rules/step_define_rule';
@@ -124,15 +124,17 @@ export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
   setAbsoluteRangeDatePicker,
 }) => {
   const { to, from, deleteQuery, setQuery } = useGlobalTime();
-  const {
-    loading: userInfoLoading,
-    isSignalIndexExists,
-    isAuthenticated,
-    hasEncryptionKey,
-    canUserCRUD,
-    hasIndexWrite,
-    signalIndexName,
-  } = useUserInfo();
+  const [
+    {
+      loading: userInfoLoading,
+      isSignalIndexExists,
+      isAuthenticated,
+      hasEncryptionKey,
+      canUserCRUD,
+      hasIndexWrite,
+      signalIndexName,
+    },
+  ] = useUserData();
   const {
     loading: listsConfigLoading,
     needsConfiguration: needsListsConfiguration,
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.test.tsx
index 2e45dbc6521b70..e89c899b12c392 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.test.tsx
@@ -10,7 +10,7 @@ import { shallow } from 'enzyme';
 import '../../../../../common/mock/match_media';
 import { TestProviders } from '../../../../../common/mock';
 import { EditRulePage } from './index';
-import { useUserInfo } from '../../../../components/user_info';
+import { useUserData } from '../../../../components/user_info';
 import { useParams } from 'react-router-dom';
 
 jest.mock('../../../../containers/detection_engine/lists/use_lists_config');
@@ -28,7 +28,7 @@ jest.mock('react-router-dom', () => {
 
 describe('EditRulePage', () => {
   it('renders correctly', () => {
-    (useUserInfo as jest.Mock).mockReturnValue({});
+    (useUserData as jest.Mock).mockReturnValue([{}]);
     (useParams as jest.Mock).mockReturnValue({});
     const wrapper = shallow(<EditRulePage />, { wrappingComponent: TestProviders });
 
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
index 4033d247c4ecba..5f4fd596691034 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
@@ -17,7 +17,8 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import React, { FC, memo, useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { useParams, useHistory } from 'react-router-dom';
 
-import { useRule, usePersistRule } from '../../../../containers/detection_engine/rules';
+import { UpdateRulesSchema } from '../../../../../../common/detection_engine/schemas/request';
+import { useRule, useUpdateRule } from '../../../../containers/detection_engine/rules';
 import { useListsConfig } from '../../../../containers/detection_engine/lists/use_lists_config';
 import { WrapperPage } from '../../../../../common/components/wrapper_page';
 import {
@@ -26,15 +27,21 @@ import {
 } from '../../../../../common/components/link_to/redirect_to_detection_engine';
 import { displaySuccessToast, useStateToaster } from '../../../../../common/components/toasters';
 import { SpyRoute } from '../../../../../common/utils/route/spy_routes';
-import { useUserInfo } from '../../../../components/user_info';
+import { useUserData } from '../../../../components/user_info';
 import { DetectionEngineHeaderPage } from '../../../../components/detection_engine_header_page';
-import { FormHook, FormData } from '../../../../../shared_imports';
 import { StepPanel } from '../../../../components/rules/step_panel';
 import { StepAboutRule } from '../../../../components/rules/step_about_rule';
 import { StepDefineRule } from '../../../../components/rules/step_define_rule';
 import { StepScheduleRule } from '../../../../components/rules/step_schedule_rule';
 import { StepRuleActions } from '../../../../components/rules/step_rule_actions';
-import { formatRule } from '../create/helpers';
+import {
+  formatRule,
+  stepIsValid,
+  isDefineStep,
+  isAboutStep,
+  isScheduleStep,
+  isActionsStep,
+} from '../create/helpers';
 import {
   getStepsData,
   redirectToDetections,
@@ -42,90 +49,72 @@ import {
   userHasNoPermissions,
 } from '../helpers';
 import * as ruleI18n from '../translations';
-import {
-  RuleStep,
-  DefineStepRule,
-  AboutStepRule,
-  ScheduleStepRule,
-  ActionsStepRule,
-} from '../types';
+import { RuleStep, RuleStepsFormHooks, RuleStepsFormData, RuleStepsData } from '../types';
 import * as i18n from './translations';
 import { SecurityPageName } from '../../../../../app/types';
+import { ruleStepsOrder } from '../utils';
 
-interface StepRuleForm {
-  isValid: boolean;
-}
-interface AboutStepRuleForm extends StepRuleForm {
-  data: AboutStepRule | null;
-}
-interface DefineStepRuleForm extends StepRuleForm {
-  data: DefineStepRule | null;
-}
-interface ScheduleStepRuleForm extends StepRuleForm {
-  data: ScheduleStepRule | null;
-}
-
-interface ActionsStepRuleForm extends StepRuleForm {
-  data: ActionsStepRule | null;
-}
+const formHookNoop = async (): Promise<undefined> => undefined;
 
 const EditRulePageComponent: FC = () => {
   const history = useHistory();
   const [, dispatchToaster] = useStateToaster();
-  const {
-    loading: userInfoLoading,
-    isSignalIndexExists,
-    isAuthenticated,
-    hasEncryptionKey,
-    canUserCRUD,
-  } = useUserInfo();
+  const [
+    {
+      loading: userInfoLoading,
+      isSignalIndexExists,
+      isAuthenticated,
+      hasEncryptionKey,
+      canUserCRUD,
+    },
+  ] = useUserData();
   const {
     loading: listsConfigLoading,
     needsConfiguration: needsListsConfiguration,
   } = useListsConfig();
-  const initLoading = userInfoLoading || listsConfigLoading;
   const { detailName: ruleId } = useParams<{ detailName: string | undefined }>();
-  const [loading, rule] = useRule(ruleId);
+  const [ruleLoading, rule] = useRule(ruleId);
+  const loading = ruleLoading || userInfoLoading || listsConfigLoading;
 
-  const [initForm, setInitForm] = useState(false);
-  const [myAboutRuleForm, setMyAboutRuleForm] = useState<AboutStepRuleForm>({
-    data: null,
-    isValid: false,
-  });
-  const [myDefineRuleForm, setMyDefineRuleForm] = useState<DefineStepRuleForm>({
-    data: null,
-    isValid: false,
+  const formHooks = useRef<RuleStepsFormHooks>({
+    [RuleStep.defineRule]: formHookNoop,
+    [RuleStep.aboutRule]: formHookNoop,
+    [RuleStep.scheduleRule]: formHookNoop,
+    [RuleStep.ruleActions]: formHookNoop,
   });
-  const [myScheduleRuleForm, setMyScheduleRuleForm] = useState<ScheduleStepRuleForm>({
-    data: null,
-    isValid: false,
+  const stepsData = useRef<RuleStepsFormData>({
+    [RuleStep.defineRule]: { isValid: false, data: undefined },
+    [RuleStep.aboutRule]: { isValid: false, data: undefined },
+    [RuleStep.scheduleRule]: { isValid: false, data: undefined },
+    [RuleStep.ruleActions]: { isValid: false, data: undefined },
   });
-  const [myActionsRuleForm, setMyActionsRuleForm] = useState<ActionsStepRuleForm>({
-    data: null,
-    isValid: false,
+  const defineStep = stepsData.current[RuleStep.defineRule];
+  const aboutStep = stepsData.current[RuleStep.aboutRule];
+  const scheduleStep = stepsData.current[RuleStep.scheduleRule];
+  const actionsStep = stepsData.current[RuleStep.ruleActions];
+  const [activeStep, setActiveStep] = useState<RuleStep>(RuleStep.defineRule);
+  const invalidSteps = ruleStepsOrder.filter((step) => {
+    const stepData = stepsData.current[step];
+    return stepData.data != null && !stepIsValid(stepData);
   });
-  const [selectedTab, setSelectedTab] = useState<EuiTabbedContentTab>();
-  const stepsForm = useRef<Record<RuleStep, FormHook<FormData> | null>>({
-    [RuleStep.defineRule]: null,
-    [RuleStep.aboutRule]: null,
-    [RuleStep.scheduleRule]: null,
-    [RuleStep.ruleActions]: null,
-  });
-  const [{ isLoading, isSaved }, setRule] = usePersistRule();
-  const [tabHasError, setTabHasError] = useState<RuleStep[]>([]);
-  // eslint-disable-next-line react-hooks/exhaustive-deps
-  const actionMessageParams = useMemo(() => getActionMessageParams(rule?.type), [rule]);
-  const setStepsForm = useCallback(
-    (step: RuleStep, form: FormHook<FormData>) => {
-      stepsForm.current[step] = form;
-      if (initForm && step === (selectedTab?.id as RuleStep) && form.isSubmitted === false) {
-        setInitForm(false);
-        form.submit();
+  const [{ isLoading, isSaved }, setRule] = useUpdateRule();
+  const actionMessageParams = useMemo(() => getActionMessageParams(rule?.type), [rule?.type]);
+  const setFormHook = useCallback(
+    <K extends keyof RuleStepsFormHooks>(step: K, hook: RuleStepsFormHooks[K]) => {
+      formHooks.current[step] = hook;
+      if (step === activeStep) {
+        hook();
       }
     },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [initForm, selectedTab]
+    [activeStep]
   );
+  const setStepData = useCallback(
+    <K extends keyof RuleStepsData>(step: K, data: RuleStepsData[K], isValid: boolean) => {
+      stepsData.current[step] = { ...stepsData.current[step], data, isValid };
+    },
+    []
+  );
+
   const tabs = useMemo(
     () => [
       {
@@ -135,14 +124,14 @@ const EditRulePageComponent: FC = () => {
         content: (
           <>
             <EuiSpacer />
-            <StepPanel loading={loading || initLoading} title={ruleI18n.DEFINITION}>
-              {myDefineRuleForm.data != null && (
+            <StepPanel loading={loading} title={ruleI18n.DEFINITION}>
+              {defineStep.data != null && (
                 <StepDefineRule
                   isReadOnlyView={false}
                   isLoading={isLoading}
                   isUpdateView
-                  defaultValues={myDefineRuleForm.data}
-                  setForm={setStepsForm}
+                  defaultValues={defineStep.data}
+                  setForm={setFormHook}
                 />
               )}
               <EuiSpacer />
@@ -157,15 +146,15 @@ const EditRulePageComponent: FC = () => {
         content: (
           <>
             <EuiSpacer />
-            <StepPanel loading={loading || initLoading} title={ruleI18n.ABOUT}>
-              {myAboutRuleForm.data != null && myDefineRuleForm.data != null && (
+            <StepPanel loading={loading} title={ruleI18n.ABOUT}>
+              {aboutStep.data != null && defineStep.data != null && (
                 <StepAboutRule
                   isReadOnlyView={false}
                   isLoading={isLoading}
                   isUpdateView
-                  defaultValues={myAboutRuleForm.data}
-                  defineRuleData={myDefineRuleForm.data}
-                  setForm={setStepsForm}
+                  defaultValues={aboutStep.data}
+                  defineRuleData={defineStep.data}
+                  setForm={setFormHook}
                 />
               )}
               <EuiSpacer />
@@ -180,14 +169,14 @@ const EditRulePageComponent: FC = () => {
         content: (
           <>
             <EuiSpacer />
-            <StepPanel loading={loading || initLoading} title={ruleI18n.SCHEDULE}>
-              {myScheduleRuleForm.data != null && (
+            <StepPanel loading={loading} title={ruleI18n.SCHEDULE}>
+              {scheduleStep.data != null && (
                 <StepScheduleRule
                   isReadOnlyView={false}
                   isLoading={isLoading}
                   isUpdateView
-                  defaultValues={myScheduleRuleForm.data}
-                  setForm={setStepsForm}
+                  defaultValues={scheduleStep.data}
+                  setForm={setFormHook}
                 />
               )}
               <EuiSpacer />
@@ -201,14 +190,14 @@ const EditRulePageComponent: FC = () => {
         content: (
           <>
             <EuiSpacer />
-            <StepPanel loading={loading || initLoading} title={ruleI18n.ACTIONS}>
-              {myActionsRuleForm.data != null && (
+            <StepPanel loading={loading} title={ruleI18n.ACTIONS}>
+              {actionsStep.data != null && (
                 <StepRuleActions
                   isReadOnlyView={false}
                   isLoading={isLoading}
                   isUpdateView
-                  defaultValues={myActionsRuleForm.data}
-                  setForm={setStepsForm}
+                  defaultValues={actionsStep.data}
+                  setForm={setFormHook}
                   actionMessageParams={actionMessageParams}
                 />
               )}
@@ -218,76 +207,56 @@ const EditRulePageComponent: FC = () => {
         ),
       },
     ],
-    // eslint-disable-next-line react-hooks/exhaustive-deps
     [
-      rule,
+      rule?.immutable,
       loading,
-      initLoading,
+      defineStep.data,
       isLoading,
-      myAboutRuleForm,
-      myDefineRuleForm,
-      myScheduleRuleForm,
-      myActionsRuleForm,
-      setStepsForm,
-      stepsForm,
+      setFormHook,
+      aboutStep.data,
+      scheduleStep.data,
+      actionsStep.data,
       actionMessageParams,
     ]
   );
 
   const onSubmit = useCallback(async () => {
-    const activeFormId = selectedTab?.id as RuleStep;
-    const activeForm = await stepsForm.current[activeFormId]?.submit();
-
-    const invalidForms = [
-      RuleStep.aboutRule,
-      RuleStep.defineRule,
-      RuleStep.scheduleRule,
-      RuleStep.ruleActions,
-    ].reduce<RuleStep[]>((acc, step) => {
-      if (
-        (step === activeFormId && activeForm != null && !activeForm?.isValid) ||
-        (step === RuleStep.aboutRule && !myAboutRuleForm.isValid) ||
-        (step === RuleStep.defineRule && !myDefineRuleForm.isValid) ||
-        (step === RuleStep.scheduleRule && !myScheduleRuleForm.isValid) ||
-        (step === RuleStep.ruleActions && !myActionsRuleForm.isValid)
-      ) {
-        return [...acc, step];
-      }
-      return acc;
-    }, []);
+    const activeStepData = await formHooks.current[activeStep]();
+    if (activeStepData?.data != null) {
+      setStepData(activeStep, activeStepData.data, activeStepData.isValid);
+    }
+    const define = isDefineStep(activeStepData) ? activeStepData : defineStep;
+    const about = isAboutStep(activeStepData) ? activeStepData : aboutStep;
+    const schedule = isScheduleStep(activeStepData) ? activeStepData : scheduleStep;
+    const actions = isActionsStep(activeStepData) ? activeStepData : actionsStep;
 
-    if (invalidForms.length === 0 && activeForm != null) {
-      setTabHasError([]);
+    if (
+      stepIsValid(define) &&
+      stepIsValid(about) &&
+      stepIsValid(schedule) &&
+      stepIsValid(actions)
+    ) {
       setRule({
-        ...formatRule(
-          (activeFormId === RuleStep.defineRule
-            ? activeForm.data
-            : myDefineRuleForm.data) as DefineStepRule,
-          (activeFormId === RuleStep.aboutRule
-            ? activeForm.data
-            : myAboutRuleForm.data) as AboutStepRule,
-          (activeFormId === RuleStep.scheduleRule
-            ? activeForm.data
-            : myScheduleRuleForm.data) as ScheduleStepRule,
-          (activeFormId === RuleStep.ruleActions
-            ? activeForm.data
-            : myActionsRuleForm.data) as ActionsStepRule,
+        ...formatRule<UpdateRulesSchema>(
+          define.data,
+          about.data,
+          schedule.data,
+          actions.data,
           rule
         ),
         ...(ruleId ? { id: ruleId } : {}),
       });
-    } else {
-      setTabHasError(invalidForms);
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [
-    stepsForm,
-    myAboutRuleForm,
-    myDefineRuleForm,
-    myScheduleRuleForm,
-    myActionsRuleForm,
-    selectedTab,
+    aboutStep,
+    actionsStep,
+    activeStep,
+    defineStep,
+    rule,
     ruleId,
+    scheduleStep,
+    setRule,
+    setStepData,
   ]);
 
   useEffect(() => {
@@ -295,48 +264,29 @@ const EditRulePageComponent: FC = () => {
       const { aboutRuleData, defineRuleData, scheduleRuleData, ruleActionsData } = getStepsData({
         rule,
       });
-      setMyAboutRuleForm({ data: aboutRuleData, isValid: true });
-      setMyDefineRuleForm({ data: defineRuleData, isValid: true });
-      setMyScheduleRuleForm({ data: scheduleRuleData, isValid: true });
-      setMyActionsRuleForm({ data: ruleActionsData, isValid: true });
+      setStepData(RuleStep.defineRule, defineRuleData, true);
+      setStepData(RuleStep.aboutRule, aboutRuleData, true);
+      setStepData(RuleStep.scheduleRule, scheduleRuleData, true);
+      setStepData(RuleStep.ruleActions, ruleActionsData, true);
     }
-  }, [rule]);
+  }, [rule, setStepData]);
+
+  const goToStep = useCallback(async (step: RuleStep) => {
+    setActiveStep(step);
+    await formHooks.current[step]();
+  }, []);
 
   const onTabClick = useCallback(
     async (tab: EuiTabbedContentTab) => {
-      if (selectedTab != null) {
-        const ruleStep = selectedTab.id as RuleStep;
-        const respForm = await stepsForm.current[ruleStep]?.submit();
+      const targetStep = tab.id as RuleStep;
+      const activeStepData = await formHooks.current[activeStep]();
 
-        if (respForm != null) {
-          if (ruleStep === RuleStep.aboutRule) {
-            setMyAboutRuleForm({
-              data: respForm.data as AboutStepRule,
-              isValid: respForm.isValid,
-            });
-          } else if (ruleStep === RuleStep.defineRule) {
-            setMyDefineRuleForm({
-              data: respForm.data as DefineStepRule,
-              isValid: respForm.isValid,
-            });
-          } else if (ruleStep === RuleStep.scheduleRule) {
-            setMyScheduleRuleForm({
-              data: respForm.data as ScheduleStepRule,
-              isValid: respForm.isValid,
-            });
-          } else if (ruleStep === RuleStep.ruleActions) {
-            setMyActionsRuleForm({
-              data: respForm.data as ActionsStepRule,
-              isValid: respForm.isValid,
-            });
-          }
-        }
+      if (activeStepData?.data != null) {
+        setStepData(activeStep, activeStepData.data, activeStepData.isValid);
+        goToStep(targetStep);
       }
-      setInitForm(true);
-      setSelectedTab(tab);
     },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [selectedTab, stepsForm.current]
+    [activeStep, goToStep, setStepData]
   );
 
   const goToDetailsRule = useCallback(
@@ -348,23 +298,13 @@ const EditRulePageComponent: FC = () => {
   );
 
   useEffect(() => {
-    if (rule != null) {
-      const { aboutRuleData, defineRuleData, scheduleRuleData, ruleActionsData } = getStepsData({
-        rule,
-      });
-      setMyAboutRuleForm({ data: aboutRuleData, isValid: true });
-      setMyDefineRuleForm({ data: defineRuleData, isValid: true });
-      setMyScheduleRuleForm({ data: scheduleRuleData, isValid: true });
-      setMyActionsRuleForm({ data: ruleActionsData, isValid: true });
+    if (rule?.immutable) {
+      setActiveStep(RuleStep.ruleActions);
+    } else {
+      setActiveStep(RuleStep.defineRule);
     }
   }, [rule]);
 
-  useEffect(() => {
-    const tabIndex = rule?.immutable ? 3 : 0;
-    setSelectedTab(tabs[tabIndex]);
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [rule]);
-
   if (isSaved) {
     displaySuccessToast(i18n.SUCCESSFULLY_SAVED_RULE(rule?.name ?? ''), dispatchToaster);
     history.replace(getRuleDetailsUrl(ruleId ?? ''));
@@ -398,14 +338,14 @@ const EditRulePageComponent: FC = () => {
           isLoading={isLoading}
           title={i18n.PAGE_TITLE}
         />
-        {tabHasError.length > 0 && (
+        {invalidSteps.length > 0 && (
           <EuiCallOut title={i18n.SORRY_ERRORS} color="danger" iconType="alert">
             <FormattedMessage
               id="xpack.securitySolution.detectionEngine.rule.editRule.errorMsgDescription"
               defaultMessage="You have an invalid input in {countError, plural, one {this tab} other {these tabs}}: {tabHasError}"
               values={{
-                countError: tabHasError.length,
-                tabHasError: tabHasError
+                countError: invalidSteps.length,
+                tabHasError: invalidSteps
                   .map((t) => {
                     if (t === RuleStep.aboutRule) {
                       return ruleI18n.ABOUT;
@@ -426,7 +366,7 @@ const EditRulePageComponent: FC = () => {
 
         <EuiTabbedContent
           initialSelectedTab={tabs[0]}
-          selectedTab={tabs.find((t) => t.id === selectedTab?.id)}
+          selectedTab={tabs.find((t) => t.id === activeStep)}
           onTabClick={onTabClick}
           tabs={tabs}
         />
@@ -451,7 +391,7 @@ const EditRulePageComponent: FC = () => {
               onClick={onSubmit}
               iconType="save"
               isLoading={isLoading}
-              isDisabled={initLoading}
+              isDisabled={loading}
             >
               {i18n.SAVE_CHANGES}
             </EuiButton>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.test.tsx
index 10a20807d6f879..f11b0ac4ec3f88 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.test.tsx
@@ -43,7 +43,6 @@ describe('rule helpers', () => {
         rule: mockRuleWithEverything('test-id'),
       });
       const defineRuleStepData = {
-        isNew: false,
         ruleType: 'saved_query',
         anomalyThreshold: 50,
         index: ['auditbeat-*'],
@@ -93,7 +92,6 @@ describe('rule helpers', () => {
         falsePositives: ['test'],
         isAssociatedToEndpointList: false,
         isBuildingBlock: false,
-        isNew: false,
         license: 'Elastic License',
         name: 'Query with rule-id',
         note: '# this is some markdown documentation',
@@ -121,11 +119,10 @@ describe('rule helpers', () => {
         ],
         timestampOverride: 'event.ingested',
       };
-      const scheduleRuleStepData = { from: '0s', interval: '5m', isNew: false };
+      const scheduleRuleStepData = { from: '0s', interval: '5m' };
       const ruleActionsStepData = {
         enabled: true,
         throttle: 'no_actions',
-        isNew: false,
         actions: [],
       };
       const aboutRuleDataDetailsData = {
@@ -202,7 +199,6 @@ describe('rule helpers', () => {
     test('returns with saved_id if value exists on rule', () => {
       const result: DefineStepRule = getDefineStepsData(mockRule('test-id'));
       const expected = {
-        isNew: false,
         ruleType: 'saved_query',
         anomalyThreshold: 50,
         machineLearningJobId: '',
@@ -235,7 +231,6 @@ describe('rule helpers', () => {
       delete mockedRule.saved_id;
       const result: DefineStepRule = getDefineStepsData(mockedRule);
       const expected = {
-        isNew: false,
         ruleType: 'saved_query',
         anomalyThreshold: 50,
         machineLearningJobId: '',
@@ -311,7 +306,6 @@ describe('rule helpers', () => {
       };
       const result: ScheduleStepRule = getScheduleStepsData(mockedRule);
       const expected = {
-        isNew: false,
         interval: mockedRule.interval,
         from: '0s',
       };
@@ -344,7 +338,6 @@ describe('rule helpers', () => {
           },
         ],
         enabled: mockedRule.enabled,
-        isNew: false,
         throttle: 'no_actions',
       };
 
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
index f9279ce6395344..aab73c5d5a1e5f 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
@@ -10,7 +10,7 @@ import memoizeOne from 'memoize-one';
 import { useLocation } from 'react-router-dom';
 
 import { ActionVariable } from '../../../../../../triggers_actions_ui/public';
-import { RuleAlertAction, RuleType } from '../../../../../common/detection_engine/types';
+import { RuleAlertAction } from '../../../../../common/detection_engine/types';
 import { isMlRule } from '../../../../../common/machine_learning/helpers';
 import { transformRuleToAlertAction } from '../../../../../common/detection_engine/transform_actions';
 import { Filter } from '../../../../../../../../src/plugins/data/public';
@@ -24,7 +24,11 @@ import {
   ScheduleStepRule,
   ActionsStepRule,
 } from './types';
-import { SeverityMapping } from '../../../../../common/detection_engine/schemas/common/schemas';
+import {
+  SeverityMapping,
+  Type,
+  Severity,
+} from '../../../../../common/detection_engine/schemas/common/schemas';
 import { severityOptions } from '../../../components/rules/step_about_rule/data';
 
 export interface GetStepsData {
@@ -64,7 +68,6 @@ export const getActionsStepsData = (
 
   return {
     actions: actions?.map(transformRuleToAlertAction),
-    isNew: false,
     throttle,
     kibanaSiemAppUrl: meta?.kibana_siem_app_url,
     enabled,
@@ -72,7 +75,6 @@ export const getActionsStepsData = (
 };
 
 export const getDefineStepsData = (rule: Rule): DefineStepRule => ({
-  isNew: false,
   ruleType: rule.type,
   anomalyThreshold: rule.anomaly_threshold ?? 50,
   machineLearningJobId: rule.machine_learning_job_id ?? '',
@@ -97,7 +99,6 @@ export const getScheduleStepsData = (rule: Rule): ScheduleStepRule => {
   const fromHumanizedValue = getHumanizedDuration(from, interval);
 
   return {
-    isNew: false,
     interval,
     from: fromHumanizedValue,
   };
@@ -139,7 +140,6 @@ export const getAboutStepsData = (rule: Rule, detailsView: boolean): AboutStepRu
   } = rule;
 
   return {
-    isNew: false,
     author,
     isAssociatedToEndpointList: exceptionsList?.some(({ id }) => id === ENDPOINT_LIST_ID) ?? false,
     isBuildingBlock: buildingBlockType !== undefined,
@@ -151,7 +151,7 @@ export const getAboutStepsData = (rule: Rule, detailsView: boolean): AboutStepRu
     note: note!,
     references,
     severity: {
-      value: severity,
+      value: severity as Severity,
       mapping: fillEmptySeverityMappings(severityMapping),
       isMappingChecked: severityMapping.length > 0,
     },
@@ -307,7 +307,7 @@ export const redirectToDetections = (
   hasEncryptionKey === false ||
   needsListsConfiguration;
 
-const getRuleSpecificRuleParamKeys = (ruleType: RuleType) => {
+const getRuleSpecificRuleParamKeys = (ruleType: Type) => {
   const queryRuleParams = ['index', 'filters', 'language', 'query', 'saved_id'];
 
   if (isMlRule(ruleType)) {
@@ -321,7 +321,7 @@ const getRuleSpecificRuleParamKeys = (ruleType: RuleType) => {
   return queryRuleParams;
 };
 
-export const getActionMessageRuleParams = (ruleType: RuleType): string[] => {
+export const getActionMessageRuleParams = (ruleType: Type): string[] => {
   const commonRuleParamsKeys = [
     'id',
     'name',
@@ -349,23 +349,21 @@ export const getActionMessageRuleParams = (ruleType: RuleType): string[] => {
   return ruleParamsKeys;
 };
 
-export const getActionMessageParams = memoizeOne(
-  (ruleType: RuleType | undefined): ActionVariable[] => {
-    if (!ruleType) {
-      return [];
-    }
-    const actionMessageRuleParams = getActionMessageRuleParams(ruleType);
-
-    return [
-      { name: 'state.signals_count', description: 'state.signals_count' },
-      { name: '{context.results_link}', description: 'context.results_link' },
-      ...actionMessageRuleParams.map((param) => {
-        const extendedParam = `context.rule.${param}`;
-        return { name: extendedParam, description: extendedParam };
-      }),
-    ];
+export const getActionMessageParams = memoizeOne((ruleType: Type | undefined): ActionVariable[] => {
+  if (!ruleType) {
+    return [];
   }
-);
+  const actionMessageRuleParams = getActionMessageRuleParams(ruleType);
+
+  return [
+    { name: 'state.signals_count', description: 'state.signals_count' },
+    { name: '{context.results_link}', description: 'context.results_link' },
+    ...actionMessageRuleParams.map((param) => {
+      const extendedParam = `context.rule.${param}`;
+      return { name: extendedParam, description: extendedParam };
+    }),
+  ];
+});
 
 // typed as null not undefined as the initial state for this value is null.
 export const userHasNoPermissions = (canUserCRUD: boolean | null): boolean =>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.test.tsx
index 95ef85ec1317a1..886a24dd7cbe82 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.test.tsx
@@ -9,7 +9,7 @@ import { shallow } from 'enzyme';
 
 import '../../../../common/mock/match_media';
 import { RulesPage } from './index';
-import { useUserInfo } from '../../../components/user_info';
+import { useUserData } from '../../../components/user_info';
 import { usePrePackagedRules } from '../../../containers/detection_engine/rules';
 
 jest.mock('react-router-dom', () => {
@@ -30,7 +30,7 @@ jest.mock('../../../containers/detection_engine/rules');
 
 describe('RulesPage', () => {
   beforeAll(() => {
-    (useUserInfo as jest.Mock).mockReturnValue({});
+    (useUserData as jest.Mock).mockReturnValue([{}]);
     (usePrePackagedRules as jest.Mock).mockReturnValue({});
   });
   it('renders correctly', () => {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.tsx
index 92ec0bb5a72cd6..53c82569f94aeb 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.tsx
@@ -18,7 +18,7 @@ import { DetectionEngineHeaderPage } from '../../../components/detection_engine_
 import { WrapperPage } from '../../../../common/components/wrapper_page';
 import { SpyRoute } from '../../../../common/utils/route/spy_routes';
 
-import { useUserInfo } from '../../../components/user_info';
+import { useUserData } from '../../../components/user_info';
 import { AllRules } from './all';
 import { ImportDataModal } from '../../../../common/components/import_data_modal';
 import { ReadOnlyCallOut } from '../../../components/rules/read_only_callout';
@@ -42,14 +42,16 @@ const RulesPageComponent: React.FC = () => {
   const [showImportModal, setShowImportModal] = useState(false);
   const [showValueListsModal, setShowValueListsModal] = useState(false);
   const refreshRulesData = useRef<null | Func>(null);
-  const {
-    loading: userInfoLoading,
-    isSignalIndexExists,
-    isAuthenticated,
-    hasEncryptionKey,
-    canUserCRUD,
-    hasIndexWrite,
-  } = useUserInfo();
+  const [
+    {
+      loading: userInfoLoading,
+      isSignalIndexExists,
+      isAuthenticated,
+      hasEncryptionKey,
+      canUserCRUD,
+      hasIndexWrite,
+    },
+  ] = useUserData();
   const {
     loading: listsConfigLoading,
     canWriteIndex: canWriteListsIndex,
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/types.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/types.ts
index e36f08703dae51..e3d0ea123872a4 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/types.ts
@@ -4,10 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { RuleAlertAction, RuleType } from '../../../../../common/detection_engine/types';
+import { RuleAlertAction } from '../../../../../common/detection_engine/types';
 import { AlertAction } from '../../../../../../alerts/common';
 import { Filter } from '../../../../../../../../src/plugins/data/common';
-import { FormData, FormHook } from '../../../../shared_imports';
 import { FieldValueQueryBar } from '../../../components/rules/query_bar';
 import { FieldValueTimeline } from '../../../components/rules/pick_timeline';
 import { FieldValueThreshold } from '../../../components/rules/threshold_input';
@@ -18,13 +17,16 @@ import {
   RiskScoreMapping,
   RuleNameOverride,
   SeverityMapping,
+  SortOrder,
   TimestampOverride,
+  Type,
+  Severity,
 } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { List } from '../../../../../common/detection_engine/schemas/types';
 
 export interface EuiBasicTableSortTypes {
   field: string;
-  direction: 'asc' | 'desc';
+  direction: SortOrder;
 }
 
 export interface EuiBasicTableOnChange {
@@ -35,34 +37,51 @@ export interface EuiBasicTableOnChange {
   sort?: EuiBasicTableSortTypes;
 }
 
+export type RuleStatusType = 'passive' | 'active' | 'valid';
+
 export enum RuleStep {
   defineRule = 'define-rule',
   aboutRule = 'about-rule',
   scheduleRule = 'schedule-rule',
   ruleActions = 'rule-actions',
 }
-export type RuleStatusType = 'passive' | 'active' | 'valid';
+export type RuleStepsOrder = [
+  RuleStep.defineRule,
+  RuleStep.aboutRule,
+  RuleStep.scheduleRule,
+  RuleStep.ruleActions
+];
 
-export interface RuleStepData {
-  data: unknown;
-  isValid: boolean;
+export interface RuleStepsData {
+  [RuleStep.defineRule]: DefineStepRule;
+  [RuleStep.aboutRule]: AboutStepRule;
+  [RuleStep.scheduleRule]: ScheduleStepRule;
+  [RuleStep.ruleActions]: ActionsStepRule;
 }
 
+export type RuleStepsFormData = {
+  [K in keyof RuleStepsData]: {
+    data: RuleStepsData[K] | undefined;
+    isValid: boolean;
+  };
+};
+
+export type RuleStepsFormHooks = {
+  [K in keyof RuleStepsData]: () => Promise<RuleStepsFormData[K] | undefined>;
+};
+
 export interface RuleStepProps {
   addPadding?: boolean;
   descriptionColumns?: 'multi' | 'single' | 'singleSplit';
-  setStepData?: (step: RuleStep, data: unknown, isValid: boolean) => void;
   isReadOnlyView: boolean;
   isUpdateView?: boolean;
   isLoading: boolean;
+  onSubmit?: () => void;
   resizeParentContainer?: (height: number) => void;
-  setForm?: (step: RuleStep, form: FormHook<FormData>) => void;
+  setForm?: <K extends keyof RuleStepsFormHooks>(step: K, hook: RuleStepsFormHooks[K]) => void;
 }
 
-interface StepRuleData {
-  isNew: boolean;
-}
-export interface AboutStepRule extends StepRuleData {
+export interface AboutStepRule {
   author: string[];
   name: string;
   description: string;
@@ -86,7 +105,7 @@ export interface AboutStepRuleDetails {
 }
 
 export interface AboutStepSeverity {
-  value: string;
+  value: Severity;
   mapping: SeverityMapping;
   isMappingChecked: boolean;
 }
@@ -97,23 +116,23 @@ export interface AboutStepRiskScore {
   isMappingChecked: boolean;
 }
 
-export interface DefineStepRule extends StepRuleData {
+export interface DefineStepRule {
   anomalyThreshold: number;
   index: string[];
   machineLearningJobId: string;
   queryBar: FieldValueQueryBar;
-  ruleType: RuleType;
+  ruleType: Type;
   timeline: FieldValueTimeline;
   threshold: FieldValueThreshold;
 }
 
-export interface ScheduleStepRule extends StepRuleData {
+export interface ScheduleStepRule {
   interval: string;
   from: string;
   to?: string;
 }
 
-export interface ActionsStepRule extends StepRuleData {
+export interface ActionsStepRule {
   actions: AlertAction[];
   enabled: boolean;
   kibanaSiemAppUrl?: string;
@@ -134,7 +153,7 @@ export interface DefineStepRuleJson {
   };
   timeline_id?: string;
   timeline_title?: string;
-  type: RuleType;
+  type: Type;
 }
 
 export interface AboutStepRuleJson {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts
index f862a06807e6f7..890746838b0d03 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts
@@ -20,6 +20,14 @@ import { RouteSpyState } from '../../../../common/utils/route/types';
 import { GetUrlForApp } from '../../../../common/components/navigation/types';
 import { SecurityPageName } from '../../../../app/types';
 import { APP_ID } from '../../../../../common/constants';
+import { RuleStep, RuleStepsOrder } from './types';
+
+export const ruleStepsOrder: RuleStepsOrder = [
+  RuleStep.defineRule,
+  RuleStep.aboutRule,
+  RuleStep.scheduleRule,
+  RuleStep.ruleActions,
+];
 
 const getTabBreadcrumb = (pathname: string, search: string[], getUrlForApp: GetUrlForApp) => {
   const tabPath = pathname.split('/')[1];
diff --git a/x-pack/plugins/security_solution/public/detections/routes.tsx b/x-pack/plugins/security_solution/public/detections/routes.tsx
index 8f542d1f886704..b5f7bc6983752e 100644
--- a/x-pack/plugins/security_solution/public/detections/routes.tsx
+++ b/x-pack/plugins/security_solution/public/detections/routes.tsx
@@ -12,12 +12,11 @@ import { NotFoundPage } from '../app/404';
 
 export const AlertsRoutes: React.FC = () => (
   <Switch>
-    <Route
-      path="/"
-      render={({ location, match }) => (
-        <DetectionEngineContainer location={location} url={match.url} />
-      )}
-    />
-    <Route render={() => <NotFoundPage />} />
+    <Route path="/">
+      <DetectionEngineContainer />
+    </Route>
+    <Route>
+      <NotFoundPage />
+    </Route>
   </Switch>
 );
diff --git a/x-pack/plugins/security_solution/public/graphql/introspection.json b/x-pack/plugins/security_solution/public/graphql/introspection.json
index 7b20873bf63ccb..b32083fec1b5e3 100644
--- a/x-pack/plugins/security_solution/public/graphql/introspection.json
+++ b/x-pack/plugins/security_solution/public/graphql/introspection.json
@@ -4719,6 +4719,14 @@
             "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
             "isDeprecated": false,
             "deprecationReason": null
+          },
+          {
+            "name": "status",
+            "description": "",
+            "args": [],
+            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
           }
         ],
         "inputFields": null,
diff --git a/x-pack/plugins/security_solution/public/graphql/types.ts b/x-pack/plugins/security_solution/public/graphql/types.ts
index f7d2c81f536be1..65d9212f77dcc3 100644
--- a/x-pack/plugins/security_solution/public/graphql/types.ts
+++ b/x-pack/plugins/security_solution/public/graphql/types.ts
@@ -1020,6 +1020,8 @@ export interface SignalField {
   rule?: Maybe<RuleField>;
 
   original_time?: Maybe<string[]>;
+
+  status?: Maybe<string[]>;
 }
 
 export interface RuleField {
@@ -5098,6 +5100,8 @@ export namespace GetTimelineQuery {
   export type Signal = {
     __typename?: 'SignalField';
 
+    status: Maybe<string[]>;
+
     original_time: Maybe<string[]>;
 
     rule: Maybe<_Rule>;
diff --git a/x-pack/plugins/security_solution/public/helpers.ts b/x-pack/plugins/security_solution/public/helpers.ts
index 53fe185ef9a658..63c3f3ea81d981 100644
--- a/x-pack/plugins/security_solution/public/helpers.ts
+++ b/x-pack/plugins/security_solution/public/helpers.ts
@@ -6,7 +6,12 @@
 
 import { CoreStart } from '../../../../src/core/public';
 import { APP_ID } from '../common/constants';
+import {
+  FactoryQueryTypes,
+  StrategyResponseType,
+} from '../common/search_strategy/security_solution';
 import { SecurityPageName } from './app/types';
+import { InspectResponse } from './types';
 
 export const manageOldSiemRoutes = async (coreStart: CoreStart) => {
   const { application } = coreStart;
@@ -73,3 +78,11 @@ export const manageOldSiemRoutes = async (coreStart: CoreStart) => {
       break;
   }
 };
+
+export const getInspectResponse = <T extends FactoryQueryTypes>(
+  response: StrategyResponseType<T>,
+  prevResponse: InspectResponse
+): InspectResponse => ({
+  dsl: response?.inspect?.dsl ?? prevResponse?.dsl ?? [],
+  response: response != null ? [JSON.stringify(response, null, 2)] : prevResponse?.response,
+});
diff --git a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.tsx b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.tsx
index e8bd0c58f9ace2..8e2b47769adf3c 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.tsx
@@ -10,8 +10,8 @@ import { has } from 'lodash/fp';
 import React, { useCallback, useMemo } from 'react';
 import { connect, ConnectedProps } from 'react-redux';
 
-import { hostsActions, hostsModel, hostsSelectors } from '../../store';
-import { AuthenticationsEdges } from '../../../graphql/types';
+import { AuthenticationsEdges } from '../../../../common/search_strategy/security_solution/hosts/authentications';
+
 import { State } from '../../../common/store';
 import {
   DragEffects,
@@ -24,9 +24,11 @@ import { HostDetailsLink, IPDetailsLink } from '../../../common/components/links
 import { Columns, ItemsPerRow, PaginatedTable } from '../../../common/components/paginated_table';
 import { IS_OPERATOR } from '../../../timelines/components/timeline/data_providers/data_provider';
 import { Provider } from '../../../timelines/components/timeline/data_providers/provider';
+import { getRowItemDraggables } from '../../../common/components/tables/helpers';
+
+import { hostsActions, hostsModel, hostsSelectors } from '../../store';
 
 import * as i18n from './translations';
-import { getRowItemDraggables } from '../../../common/components/tables/helpers';
 
 const tableType = hostsModel.HostsTableType.authentications;
 
diff --git a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts
index 84682fd14ac6ba..9e60c35b746da3 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts
+++ b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts
@@ -3,11 +3,34 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { SearchResponse } from 'elasticsearch';
+import { HostAuthenticationsStrategyResponse } from '../../../../common/search_strategy/security_solution/hosts/authentications';
 
-import { AuthenticationsData } from '../../../graphql/types';
-
-export const mockData: { Authentications: AuthenticationsData } = {
+export const mockData: { Authentications: HostAuthenticationsStrategyResponse } = {
   Authentications: {
+    rawResponse: {
+      aggregations: {
+        group_by_users: {
+          buckets: [
+            {
+              key: 'SYSTEM',
+              doc_count: 4,
+              failures: {
+                doc_count: 0,
+                lastFailure: { hits: { total: 0, max_score: null, hits: [] } },
+                hits: { total: 0, max_score: null, hits: [] },
+              },
+              successes: {
+                doc_count: 4,
+                lastSuccess: { hits: { total: 4, max_score: null } },
+              },
+            },
+          ],
+          doc_count_error_upper_bound: -1,
+          sum_other_doc_count: 566,
+        },
+      },
+    } as SearchResponse<unknown>,
     totalCount: 54,
     edges: [
       {
diff --git a/x-pack/plugins/security_solution/public/hosts/components/first_last_seen_host/index.test.tsx b/x-pack/plugins/security_solution/public/hosts/components/first_last_seen_host/index.test.tsx
index a2f53be7218162..606b43c6508fb9 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/first_last_seen_host/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/components/first_last_seen_host/index.test.tsx
@@ -4,18 +4,24 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { cloneDeep } from 'lodash/fp';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 
 // we don't have the types for waitFor just yet, so using "as waitFor" until when we do
 import { render, act, wait as waitFor } from '@testing-library/react';
 
-import { mockFirstLastSeenHostQuery } from '../../containers/hosts/first_last_seen/mock';
+import { useFirstLastSeenHost } from '../../containers/hosts/first_last_seen';
 import { TestProviders } from '../../../common/mock';
-
 import { FirstLastSeenHost, FirstLastSeenHostType } from '.';
 
+const MOCKED_RESPONSE = {
+  firstSeen: '2019-04-08T16:09:40.692Z',
+  lastSeen: '2019-04-08T18:35:45.064Z',
+};
+
+jest.mock('../../containers/hosts/first_last_seen');
+const useFirstLastSeenHostMock = useFirstLastSeenHost as jest.Mock;
+useFirstLastSeenHostMock.mockReturnValue([false, MOCKED_RESPONSE]);
+
 describe('FirstLastSeen Component', () => {
   const firstSeen = 'Apr 8, 2019 @ 16:09:40.692';
   const lastSeen = 'Apr 8, 2019 @ 18:35:45.064';
@@ -31,11 +37,10 @@ describe('FirstLastSeen Component', () => {
   });
 
   test('Loading', async () => {
+    useFirstLastSeenHostMock.mockReturnValue([true, MOCKED_RESPONSE]);
     const { container } = render(
       <TestProviders>
-        <MockedProvider mocks={mockFirstLastSeenHostQuery} addTypename={false}>
-          <FirstLastSeenHost hostname="kibana-siem" type={FirstLastSeenHostType.FIRST_SEEN} />
-        </MockedProvider>
+        <FirstLastSeenHost hostName="kibana-siem" type={FirstLastSeenHostType.FIRST_SEEN} />
       </TestProviders>
     );
     expect(container.innerHTML).toBe(
@@ -44,11 +49,10 @@ describe('FirstLastSeen Component', () => {
   });
 
   test('First Seen', async () => {
+    useFirstLastSeenHostMock.mockReturnValue([false, MOCKED_RESPONSE]);
     const { container } = render(
       <TestProviders>
-        <MockedProvider mocks={mockFirstLastSeenHostQuery} addTypename={false}>
-          <FirstLastSeenHost hostname="kibana-siem" type={FirstLastSeenHostType.FIRST_SEEN} />
-        </MockedProvider>
+        <FirstLastSeenHost hostName="kibana-siem" type={FirstLastSeenHostType.FIRST_SEEN} />
       </TestProviders>
     );
 
@@ -62,11 +66,10 @@ describe('FirstLastSeen Component', () => {
   });
 
   test('Last Seen', async () => {
+    useFirstLastSeenHostMock.mockReturnValue([false, MOCKED_RESPONSE]);
     const { container } = render(
       <TestProviders>
-        <MockedProvider mocks={mockFirstLastSeenHostQuery} addTypename={false}>
-          <FirstLastSeenHost hostname="kibana-siem" type={FirstLastSeenHostType.LAST_SEEN} />
-        </MockedProvider>
+        <FirstLastSeenHost hostName="kibana-siem" type={FirstLastSeenHostType.LAST_SEEN} />
       </TestProviders>
     );
     await act(() =>
@@ -79,13 +82,16 @@ describe('FirstLastSeen Component', () => {
   });
 
   test('First Seen is empty but not Last Seen', async () => {
-    const badDateTime = cloneDeep(mockFirstLastSeenHostQuery);
-    badDateTime[0].result.data!.source.HostFirstLastSeen.firstSeen = null;
+    useFirstLastSeenHostMock.mockReturnValue([
+      false,
+      {
+        ...MOCKED_RESPONSE,
+        firstSeen: null,
+      },
+    ]);
     const { container } = render(
       <TestProviders>
-        <MockedProvider mocks={badDateTime} addTypename={false}>
-          <FirstLastSeenHost hostname="kibana-siem" type={FirstLastSeenHostType.LAST_SEEN} />
-        </MockedProvider>
+        <FirstLastSeenHost hostName="kibana-siem" type={FirstLastSeenHostType.LAST_SEEN} />
       </TestProviders>
     );
 
@@ -99,13 +105,16 @@ describe('FirstLastSeen Component', () => {
   });
 
   test('Last Seen is empty but not First Seen', async () => {
-    const badDateTime = cloneDeep(mockFirstLastSeenHostQuery);
-    badDateTime[0].result.data!.source.HostFirstLastSeen.lastSeen = null;
+    useFirstLastSeenHostMock.mockReturnValue([
+      false,
+      {
+        ...MOCKED_RESPONSE,
+        lastSeen: null,
+      },
+    ]);
     const { container } = render(
       <TestProviders>
-        <MockedProvider mocks={badDateTime} addTypename={false}>
-          <FirstLastSeenHost hostname="kibana-siem" type={FirstLastSeenHostType.FIRST_SEEN} />
-        </MockedProvider>
+        <FirstLastSeenHost hostName="kibana-siem" type={FirstLastSeenHostType.FIRST_SEEN} />
       </TestProviders>
     );
 
@@ -119,13 +128,16 @@ describe('FirstLastSeen Component', () => {
   });
 
   test('First Seen With a bad date time string', async () => {
-    const badDateTime = cloneDeep(mockFirstLastSeenHostQuery);
-    badDateTime[0].result.data!.source.HostFirstLastSeen.firstSeen = 'something-invalid';
+    useFirstLastSeenHostMock.mockReturnValue([
+      false,
+      {
+        ...MOCKED_RESPONSE,
+        firstSeen: 'something-invalid',
+      },
+    ]);
     const { container } = render(
       <TestProviders>
-        <MockedProvider mocks={badDateTime} addTypename={false}>
-          <FirstLastSeenHost hostname="kibana-siem" type={FirstLastSeenHostType.FIRST_SEEN} />
-        </MockedProvider>
+        <FirstLastSeenHost hostName="kibana-siem" type={FirstLastSeenHostType.FIRST_SEEN} />
       </TestProviders>
     );
     await act(() =>
@@ -136,13 +148,16 @@ describe('FirstLastSeen Component', () => {
   });
 
   test('Last Seen With a bad date time string', async () => {
-    const badDateTime = cloneDeep(mockFirstLastSeenHostQuery);
-    badDateTime[0].result.data!.source.HostFirstLastSeen.lastSeen = 'something-invalid';
+    useFirstLastSeenHostMock.mockReturnValue([
+      false,
+      {
+        ...MOCKED_RESPONSE,
+        lastSeen: 'something-invalid',
+      },
+    ]);
     const { container } = render(
       <TestProviders>
-        <MockedProvider mocks={badDateTime} addTypename={false}>
-          <FirstLastSeenHost hostname="kibana-siem" type={FirstLastSeenHostType.LAST_SEEN} />
-        </MockedProvider>
+        <FirstLastSeenHost hostName="kibana-siem" type={FirstLastSeenHostType.LAST_SEEN} />
       </TestProviders>
     );
     await act(() =>
diff --git a/x-pack/plugins/security_solution/public/hosts/components/first_last_seen_host/index.tsx b/x-pack/plugins/security_solution/public/hosts/components/first_last_seen_host/index.tsx
index 579c3311cf7322..a1b72fb39069ca 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/first_last_seen_host/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/components/first_last_seen_host/index.tsx
@@ -5,10 +5,9 @@
  */
 
 import { EuiIcon, EuiLoadingSpinner, EuiText, EuiToolTip } from '@elastic/eui';
-import React from 'react';
-import { ApolloConsumer } from 'react-apollo';
+import React, { useMemo } from 'react';
 
-import { useFirstLastSeenHostQuery } from '../../containers/hosts/first_last_seen';
+import { useFirstLastSeenHost } from '../../containers/hosts/first_last_seen';
 import { getEmptyTagValue } from '../../../common/components/empty_value';
 import { FormattedRelativePreferenceDate } from '../../../common/components/formatted_date';
 
@@ -17,49 +16,48 @@ export enum FirstLastSeenHostType {
   LAST_SEEN = 'last-seen',
 }
 
-export const FirstLastSeenHost = React.memo<{ hostname: string; type: FirstLastSeenHostType }>(
-  ({ hostname, type }) => {
+interface FirstLastSeenHostProps {
+  hostName: string;
+  type: FirstLastSeenHostType;
+}
+
+export const FirstLastSeenHost = React.memo<FirstLastSeenHostProps>(({ hostName, type }) => {
+  const [loading, { firstSeen, lastSeen, errorMessage }] = useFirstLastSeenHost({
+    hostName,
+  });
+  const valueSeen = useMemo(
+    () => (type === FirstLastSeenHostType.FIRST_SEEN ? firstSeen : lastSeen),
+    [firstSeen, lastSeen, type]
+  );
+
+  if (errorMessage != null) {
     return (
-      <ApolloConsumer>
-        {(client) => {
-          /* eslint-disable-next-line react-hooks/rules-of-hooks */
-          const { loading, firstSeen, lastSeen, errorMessage } = useFirstLastSeenHostQuery(
-            hostname,
-            'default',
-            client
-          );
-          if (errorMessage != null) {
-            return (
-              <EuiToolTip
-                position="top"
-                content={errorMessage}
-                data-test-subj="firstLastSeenErrorToolTip"
-                aria-label={`firstLastSeenError-${type}`}
-                id={`firstLastSeenError-${hostname}-${type}`}
-              >
-                <EuiIcon aria-describedby={`firstLastSeenError-${hostname}-${type}`} type="alert" />
-              </EuiToolTip>
-            );
-          }
-          const valueSeen = type === FirstLastSeenHostType.FIRST_SEEN ? firstSeen : lastSeen;
-          return (
-            <>
-              {loading && <EuiLoadingSpinner size="m" />}
-              {!loading && valueSeen != null && new Date(valueSeen).toString() === 'Invalid Date'
-                ? valueSeen
-                : !loading &&
-                  valueSeen != null && (
-                    <EuiText size="s">
-                      <FormattedRelativePreferenceDate value={`${valueSeen}`} />
-                    </EuiText>
-                  )}
-              {!loading && valueSeen == null && getEmptyTagValue()}
-            </>
-          );
-        }}
-      </ApolloConsumer>
+      <EuiToolTip
+        position="top"
+        content={errorMessage}
+        data-test-subj="firstLastSeenErrorToolTip"
+        aria-label={`firstLastSeenError-${type}`}
+        id={`firstLastSeenError-${hostName}-${type}`}
+      >
+        <EuiIcon aria-describedby={`firstLastSeenError-${hostName}-${type}`} type="alert" />
+      </EuiToolTip>
     );
   }
-);
+
+  return (
+    <>
+      {loading && <EuiLoadingSpinner size="m" />}
+      {!loading && valueSeen != null && new Date(valueSeen).toString() === 'Invalid Date'
+        ? valueSeen
+        : !loading &&
+          valueSeen != null && (
+            <EuiText size="s">
+              <FormattedRelativePreferenceDate value={`${valueSeen}`} />
+            </EuiText>
+          )}
+      {!loading && valueSeen == null && getEmptyTagValue()}
+    </>
+  );
+});
 
 FirstLastSeenHost.displayName = 'FirstLastSeenHost';
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/authentications/index.tsx b/x-pack/plugins/security_solution/public/hosts/containers/authentications/index.tsx
index efd80c5c590ed6..34f2385051f4c3 100644
--- a/x-pack/plugins/security_solution/public/hosts/containers/authentications/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/containers/authentications/index.tsx
@@ -4,35 +4,42 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { connect } from 'react-redux';
-import { compose } from 'redux';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { shallowEqual, useSelector } from 'react-redux';
+import deepEqual from 'fast-deep-equal';
+
+import { AbortError } from '../../../../../../../src/plugins/data/common';
 
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
+import { HostsQueries } from '../../../../common/search_strategy/security_solution';
 import {
+  HostAuthenticationsRequestOptions,
+  HostAuthenticationsStrategyResponse,
   AuthenticationsEdges,
-  GetAuthenticationsQuery,
   PageInfoPaginated,
-} from '../../../graphql/types';
-import { inputsModel, State, inputsSelectors } from '../../../common/store';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
+  DocValueFields,
+  SortField,
+} from '../../../../common/search_strategy';
+import { ESTermQuery } from '../../../../common/typed_json';
+
+import { inputsModel, State } from '../../../common/store';
+import { createFilter } from '../../../common/containers/helpers';
 import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
-import { withKibana, WithKibanaProps } from '../../../common/lib/kibana';
-import {
-  QueryTemplatePaginated,
-  QueryTemplatePaginatedProps,
-} from '../../../common/containers/query_template_paginated';
+import { useKibana } from '../../../common/lib/kibana';
+import { getInspectResponse } from '../../../helpers';
+import { InspectResponse } from '../../../types';
+
 import { hostsModel, hostsSelectors } from '../../store';
-import { authenticationsQuery } from './index.gql_query';
+
+import * as i18n from './translations';
 
 const ID = 'authenticationQuery';
 
 export interface AuthenticationArgs {
   authentications: AuthenticationsEdges[];
   id: string;
-  inspect: inputsModel.InspectQuery;
+  inspect: InspectResponse;
   isInspected: boolean;
   loading: boolean;
   loadPage: (newActivePage: number) => void;
@@ -41,115 +48,160 @@ export interface AuthenticationArgs {
   totalCount: number;
 }
 
-export interface OwnProps extends QueryTemplatePaginatedProps {
-  children: (args: AuthenticationArgs) => React.ReactNode;
+interface UseAuthentications {
+  docValueFields?: DocValueFields[];
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  startDate: string;
   type: hostsModel.HostsType;
+  skip: boolean;
 }
 
-export interface AuthenticationsComponentReduxProps {
-  activePage: number;
-  isInspected: boolean;
-  limit: number;
-}
+export const useAuthentications = ({
+  docValueFields,
+  filterQuery,
+  endDate,
+  startDate,
+  type,
+  skip,
+}: UseAuthentications): [boolean, AuthenticationArgs] => {
+  const getAuthenticationsSelector = hostsSelectors.authenticationsSelector();
+  const { activePage, limit } = useSelector(
+    (state: State) => getAuthenticationsSelector(state, type),
+    shallowEqual
+  );
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [authenticationsRequest, setAuthenticationsRequest] = useState<
+    HostAuthenticationsRequestOptions
+  >({
+    defaultIndex,
+    docValueFields: docValueFields ?? [],
+    factoryQueryType: HostsQueries.authentications,
+    filterQuery: createFilter(filterQuery),
+    pagination: generateTablePaginationOptions(activePage, limit),
+    timerange: {
+      interval: '12h',
+      from: startDate,
+      to: endDate,
+    },
+    sort: {} as SortField,
+  });
+
+  const wrappedLoadMore = useCallback(
+    (newActivePage: number) => {
+      setAuthenticationsRequest((prevRequest) => {
+        return {
+          ...prevRequest,
+          pagination: generateTablePaginationOptions(newActivePage, limit),
+        };
+      });
+    },
+    [limit]
+  );
 
-type AuthenticationsProps = OwnProps & AuthenticationsComponentReduxProps & WithKibanaProps;
-
-class AuthenticationsComponentQuery extends QueryTemplatePaginated<
-  AuthenticationsProps,
-  GetAuthenticationsQuery.Query,
-  GetAuthenticationsQuery.Variables
-> {
-  public render() {
-    const {
-      activePage,
-      children,
-      docValueFields,
-      endDate,
-      filterQuery,
-      id = ID,
-      isInspected,
-      kibana,
-      limit,
-      skip,
-      sourceId,
-      startDate,
-    } = this.props;
-    const variables: GetAuthenticationsQuery.Variables = {
-      sourceId,
-      timerange: {
-        interval: '12h',
-        from: startDate!,
-        to: endDate!,
-      },
-      pagination: generateTablePaginationOptions(activePage, limit),
-      filterQuery: createFilter(filterQuery),
-      defaultIndex: kibana.services.uiSettings.get<string[]>(DEFAULT_INDEX_KEY),
-      inspect: isInspected,
-      docValueFields: docValueFields ?? [],
-    };
-    return (
-      <Query<GetAuthenticationsQuery.Query, GetAuthenticationsQuery.Variables>
-        query={authenticationsQuery}
-        fetchPolicy={getDefaultFetchPolicy()}
-        notifyOnNetworkStatusChange
-        skip={skip}
-        variables={variables}
-      >
-        {({ data, loading, fetchMore, networkStatus, refetch }) => {
-          const authentications = getOr([], 'source.Authentications.edges', data);
-          this.setFetchMore(fetchMore);
-          this.setFetchMoreOptions((newActivePage: number) => ({
-            variables: {
-              pagination: generateTablePaginationOptions(newActivePage, limit),
+  const [authenticationsResponse, setAuthenticationsResponse] = useState<AuthenticationArgs>({
+    authentications: [],
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    loading: true,
+    loadPage: wrappedLoadMore,
+    pageInfo: {
+      activePage: 0,
+      fakeTotalCount: 0,
+      showMorePagesIndicator: false,
+    },
+    refetch: refetch.current,
+    totalCount: -1,
+  });
+
+  const authenticationsSearch = useCallback(
+    (request: HostAuthenticationsRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<HostAuthenticationsRequestOptions, HostAuthenticationsStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setAuthenticationsResponse((prevResponse) => ({
+                    ...prevResponse,
+                    authentications: response.edges,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    pageInfo: response.pageInfo,
+                    refetch: refetch.current,
+                    totalCount: response.totalCount,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                notifications.toasts.addWarning(i18n.ERROR_AUTHENTICATIONS);
+                searchSubscription$.unsubscribe();
+              }
             },
-            updateQuery: (prev, { fetchMoreResult }) => {
-              if (!fetchMoreResult) {
-                return prev;
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_AUTHENTICATIONS,
+                  text: msg.message,
+                });
               }
-              return {
-                ...fetchMoreResult,
-                source: {
-                  ...fetchMoreResult.source,
-                  Authentications: {
-                    ...fetchMoreResult.source.Authentications,
-                    edges: [...fetchMoreResult.source.Authentications.edges],
-                  },
-                },
-              };
             },
-          }));
-          const isLoading = this.isItAValidLoading(loading, variables, networkStatus);
-          return children({
-            authentications,
-            id,
-            inspect: getOr(null, 'source.Authentications.inspect', data),
-            isInspected,
-            loading: isLoading,
-            loadPage: this.wrappedLoadMore,
-            pageInfo: getOr({}, 'source.Authentications.pageInfo', data),
-            refetch: this.memoizedRefetchQuery(variables, limit, refetch),
-            totalCount: getOr(-1, 'source.Authentications.totalCount', data),
           });
-        }}
-      </Query>
-    );
-  }
-}
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
 
-const makeMapStateToProps = () => {
-  const getAuthenticationsSelector = hostsSelectors.authenticationsSelector();
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  const mapStateToProps = (state: State, { type, id = ID }: OwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      ...getAuthenticationsSelector(state, type),
-      isInspected,
-    };
-  };
-  return mapStateToProps;
-};
+  useEffect(() => {
+    setAuthenticationsRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        docValueFields: docValueFields ?? [],
+        filterQuery: createFilter(filterQuery),
+        pagination: generateTablePaginationOptions(activePage, limit),
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [activePage, defaultIndex, docValueFields, endDate, filterQuery, limit, skip, startDate]);
 
-export const AuthenticationsQuery = compose<React.ComponentClass<OwnProps>>(
-  connect(makeMapStateToProps),
-  withKibana
-)(AuthenticationsComponentQuery);
+  useEffect(() => {
+    authenticationsSearch(authenticationsRequest);
+  }, [authenticationsRequest, authenticationsSearch]);
+
+  return [loading, authenticationsResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/authentications/translations.ts b/x-pack/plugins/security_solution/public/hosts/containers/authentications/translations.ts
new file mode 100644
index 00000000000000..95ff6363a38705
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/hosts/containers/authentications/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_AUTHENTICATIONS = i18n.translate(
+  'xpack.securitySolution.authentications.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on authentications search`,
+  }
+);
+
+export const FAIL_AUTHENTICATIONS = i18n.translate(
+  'xpack.securitySolution.authentications.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on authentications`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/hosts/details/_index.tsx b/x-pack/plugins/security_solution/public/hosts/containers/hosts/details/_index.tsx
new file mode 100644
index 00000000000000..7b248d867bb765
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/hosts/containers/hosts/details/_index.tsx
@@ -0,0 +1,161 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+// REPLACE WHEN HOST ENDPOINT DATA IS AVAILABLE
+
+import deepEqual from 'fast-deep-equal';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+import { DEFAULT_INDEX_KEY } from '../../../../../common/constants';
+import { inputsModel } from '../../../../common/store';
+import { useKibana } from '../../../../common/lib/kibana';
+import {
+  HostItem,
+  HostsQueries,
+  HostDetailsRequestOptions,
+  HostDetailsStrategyResponse,
+} from '../../../../../common/search_strategy/security_solution/hosts';
+
+import * as i18n from './translations';
+import { AbortError } from '../../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../../helpers';
+import { InspectResponse } from '../../../../types';
+
+const ID = 'hostDetailsQuery';
+
+export interface HostDetailsArgs {
+  id: string;
+  inspect: InspectResponse;
+  hostDetails: HostItem;
+  refetch: inputsModel.Refetch;
+  startDate: string;
+  endDate: string;
+}
+
+interface UseHostDetails {
+  id?: string;
+  hostName: string;
+  endDate: string;
+  skip?: boolean;
+  startDate: string;
+}
+
+export const useHostDetails = ({
+  endDate,
+  hostName,
+  skip = false,
+  startDate,
+  id = ID,
+}: UseHostDetails): [boolean, HostDetailsArgs] => {
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [hostDetailsRequest, setHostDetailsRequest] = useState<HostDetailsRequestOptions>({
+    defaultIndex,
+    hostName,
+    factoryQueryType: HostsQueries.details,
+    timerange: {
+      interval: '12h',
+      from: startDate,
+      to: endDate,
+    },
+  });
+
+  const [hostDetailsResponse, setHostDetailsResponse] = useState<HostDetailsArgs>({
+    endDate,
+    hostDetails: {},
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    refetch: refetch.current,
+    startDate,
+  });
+
+  const hostDetailsSearch = useCallback(
+    (request: HostDetailsRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<HostDetailsRequestOptions, HostDetailsStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setHostDetailsResponse((prevResponse) => ({
+                    ...prevResponse,
+                    hostDetails: response.hostDetails,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    refetch: refetch.current,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_HOST_OVERVIEW);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_HOST_OVERVIEW,
+                  text: msg.message,
+                });
+              }
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
+
+  useEffect(() => {
+    setHostDetailsRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        hostName,
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [defaultIndex, endDate, hostName, startDate, skip]);
+
+  useEffect(() => {
+    hostDetailsSearch(hostDetailsRequest);
+  }, [hostDetailsRequest, hostDetailsSearch]);
+
+  return [loading, hostDetailsResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/hosts/overview/host_overview.gql_query.ts b/x-pack/plugins/security_solution/public/hosts/containers/hosts/details/host_overview.gql_query.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/hosts/containers/hosts/overview/host_overview.gql_query.ts
rename to x-pack/plugins/security_solution/public/hosts/containers/hosts/details/host_overview.gql_query.ts
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/hosts/overview/index.tsx b/x-pack/plugins/security_solution/public/hosts/containers/hosts/details/index.tsx
similarity index 100%
rename from x-pack/plugins/security_solution/public/hosts/containers/hosts/overview/index.tsx
rename to x-pack/plugins/security_solution/public/hosts/containers/hosts/details/index.tsx
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/hosts/details/translations.ts b/x-pack/plugins/security_solution/public/hosts/containers/hosts/details/translations.ts
new file mode 100644
index 00000000000000..e3fa319e70cc13
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/hosts/containers/hosts/details/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_HOST_OVERVIEW = i18n.translate(
+  'xpack.securitySolution.overviewHost.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on host overview search`,
+  }
+);
+
+export const FAIL_HOST_OVERVIEW = i18n.translate(
+  'xpack.securitySolution.overviewHost.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on host overview`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/index.ts b/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/index.ts
deleted file mode 100644
index 65e379b5ba2d82..00000000000000
--- a/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/index.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import ApolloClient from 'apollo-client';
-import { get } from 'lodash/fp';
-import React, { useEffect, useState } from 'react';
-
-import { DEFAULT_INDEX_KEY } from '../../../../../common/constants';
-import { useUiSetting$ } from '../../../../common/lib/kibana';
-import { GetHostFirstLastSeenQuery } from '../../../../graphql/types';
-import { inputsModel } from '../../../../common/store';
-import { QueryTemplateProps } from '../../../../common/containers/query_template';
-import { useWithSource } from '../../../../common/containers/source';
-import { HostFirstLastSeenGqlQuery } from './first_last_seen.gql_query';
-
-export interface FirstLastSeenHostArgs {
-  id: string;
-  errorMessage: string;
-  firstSeen: Date;
-  lastSeen: Date;
-  loading: boolean;
-  refetch: inputsModel.Refetch;
-}
-
-export interface OwnProps extends QueryTemplateProps {
-  children: (args: FirstLastSeenHostArgs) => React.ReactNode;
-  hostName: string;
-}
-
-export function useFirstLastSeenHostQuery<TCache = object>(
-  hostName: string,
-  sourceId: string,
-  apolloClient: ApolloClient<TCache>
-) {
-  const [loading, updateLoading] = useState(false);
-  const [firstSeen, updateFirstSeen] = useState<Date | null>(null);
-  const [lastSeen, updateLastSeen] = useState<Date | null>(null);
-  const [errorMessage, updateErrorMessage] = useState<string | null>(null);
-  const [defaultIndex] = useUiSetting$<string[]>(DEFAULT_INDEX_KEY);
-  const { docValueFields } = useWithSource(sourceId);
-
-  async function fetchFirstLastSeenHost(signal: AbortSignal) {
-    updateLoading(true);
-    return apolloClient
-      .query<GetHostFirstLastSeenQuery.Query, GetHostFirstLastSeenQuery.Variables>({
-        query: HostFirstLastSeenGqlQuery,
-        fetchPolicy: 'cache-first',
-        variables: {
-          sourceId,
-          hostName,
-          defaultIndex,
-          docValueFields,
-        },
-        context: {
-          fetchOptions: {
-            signal,
-          },
-        },
-      })
-      .then(
-        (result) => {
-          updateLoading(false);
-          updateFirstSeen(get('data.source.HostFirstLastSeen.firstSeen', result));
-          updateLastSeen(get('data.source.HostFirstLastSeen.lastSeen', result));
-          updateErrorMessage(null);
-        },
-        (error) => {
-          updateLoading(false);
-          updateFirstSeen(null);
-          updateLastSeen(null);
-          updateErrorMessage(error.message);
-        }
-      );
-  }
-
-  useEffect(() => {
-    const abortCtrl = new AbortController();
-    const signal = abortCtrl.signal;
-    fetchFirstLastSeenHost(signal);
-    return () => abortCtrl.abort();
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
-  return { firstSeen, lastSeen, loading, errorMessage };
-}
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/index.tsx b/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/index.tsx
new file mode 100644
index 00000000000000..169fe58e9a2cc4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/index.tsx
@@ -0,0 +1,139 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import deepEqual from 'fast-deep-equal';
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+import { DEFAULT_INDEX_KEY } from '../../../../../common/constants';
+
+import { useKibana } from '../../../../common/lib/kibana';
+import {
+  HostsQueries,
+  HostFirstLastSeenRequestOptions,
+  HostFirstLastSeenStrategyResponse,
+} from '../../../../../common/search_strategy/security_solution';
+import { useWithSource } from '../../../../common/containers/source';
+
+import * as i18n from './translations';
+import { AbortError } from '../../../../../../../../src/plugins/data/common';
+
+const ID = 'firstLastSeenHostQuery';
+
+export interface FirstLastSeenHostArgs {
+  id: string;
+  errorMessage: string | null;
+  firstSeen?: string | null;
+  lastSeen?: string | null;
+}
+interface UseHostFirstLastSeen {
+  hostName: string;
+}
+
+export const useFirstLastSeenHost = ({
+  hostName,
+}: UseHostFirstLastSeen): [boolean, FirstLastSeenHostArgs] => {
+  const { docValueFields } = useWithSource('default');
+  const { data, notifications, uiSettings } = useKibana().services;
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [firstLastSeenHostRequest, setFirstLastSeenHostRequest] = useState<
+    HostFirstLastSeenRequestOptions
+  >({
+    defaultIndex,
+    docValueFields: docValueFields ?? [],
+    factoryQueryType: HostsQueries.firstLastSeen,
+    hostName,
+  });
+
+  const [firstLastSeenHostResponse, setFirstLastSeenHostResponse] = useState<FirstLastSeenHostArgs>(
+    {
+      firstSeen: null,
+      lastSeen: null,
+      errorMessage: null,
+      id: ID,
+    }
+  );
+
+  const firstLastSeenHostSearch = useCallback(
+    (request: HostFirstLastSeenRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<HostFirstLastSeenRequestOptions, HostFirstLastSeenStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setFirstLastSeenHostResponse((prevResponse) => ({
+                    ...prevResponse,
+                    errorMessage: null,
+                    firstSeen: response.firstSeen,
+                    lastSeen: response.lastSeen,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_FIRST_LAST_SEEN_HOST);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                setFirstLastSeenHostResponse((prevResponse) => ({
+                  ...prevResponse,
+                  errorMessage: msg,
+                }));
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_FIRST_LAST_SEEN_HOST,
+                  text: msg.message,
+                });
+              }
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
+
+  useEffect(() => {
+    setFirstLastSeenHostRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        docValueFields: docValueFields ?? [],
+        hostName,
+      };
+      if (!deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [defaultIndex, docValueFields, hostName]);
+
+  useEffect(() => {
+    firstLastSeenHostSearch(firstLastSeenHostRequest);
+  }, [firstLastSeenHostRequest, firstLastSeenHostSearch]);
+
+  return [loading, firstLastSeenHostResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/mock.ts b/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/mock.ts
deleted file mode 100644
index 7f1b3d97eb5255..00000000000000
--- a/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/mock.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { DEFAULT_INDEX_PATTERN } from '../../../../../common/constants';
-import { GetHostFirstLastSeenQuery } from '../../../../graphql/types';
-
-import { HostFirstLastSeenGqlQuery } from './first_last_seen.gql_query';
-
-interface MockedProvidedQuery {
-  request: {
-    query: GetHostFirstLastSeenQuery.Query;
-    variables: GetHostFirstLastSeenQuery.Variables;
-  };
-  result: {
-    data?: {
-      source: {
-        id: string;
-        HostFirstLastSeen: {
-          firstSeen: string | null;
-          lastSeen: string | null;
-        };
-      };
-    };
-    errors?: [{ message: string }];
-  };
-}
-export const mockFirstLastSeenHostQuery: MockedProvidedQuery[] = [
-  {
-    request: {
-      query: HostFirstLastSeenGqlQuery,
-      variables: {
-        sourceId: 'default',
-        hostName: 'kibana-siem',
-        defaultIndex: DEFAULT_INDEX_PATTERN,
-        docValueFields: [],
-      },
-    },
-    result: {
-      data: {
-        source: {
-          id: 'default',
-          HostFirstLastSeen: {
-            firstSeen: '2019-04-08T16:09:40.692Z',
-            lastSeen: '2019-04-08T18:35:45.064Z',
-          },
-        },
-      },
-    },
-  },
-];
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/translations.ts b/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/translations.ts
new file mode 100644
index 00000000000000..1e0a4ad2378970
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/hosts/containers/hosts/first_last_seen/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_FIRST_LAST_SEEN_HOST = i18n.translate(
+  'xpack.securitySolution.firstLastSeenHost.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on first last seen host search`,
+  }
+);
+
+export const FAIL_FIRST_LAST_SEEN_HOST = i18n.translate(
+  'xpack.securitySolution.firstLastSeenHost.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on first last seen host`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/hosts/index.tsx b/x-pack/plugins/security_solution/public/hosts/containers/hosts/index.tsx
index 346de9f87313f3..958d62dfe9b6a4 100644
--- a/x-pack/plugins/security_solution/public/hosts/containers/hosts/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/containers/hosts/index.tsx
@@ -10,22 +10,25 @@ import { useCallback, useEffect, useRef, useState } from 'react';
 import { useSelector } from 'react-redux';
 
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import { HostsEdges, PageInfoPaginated } from '../../../graphql/types';
 import { inputsModel, State } from '../../../common/store';
 import { createFilter } from '../../../common/containers/helpers';
 import { useKibana } from '../../../common/lib/kibana';
 import { hostsModel, hostsSelectors } from '../../store';
 import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
 import {
+  HostsEdges,
+  PageInfoPaginated,
   DocValueFields,
   HostsQueries,
   HostsRequestOptions,
   HostsStrategyResponse,
-} from '../../../../common/search_strategy/security_solution';
+} from '../../../../common/search_strategy';
 import { ESTermQuery } from '../../../../common/typed_json';
 
 import * as i18n from './translations';
 import { AbortError } from '../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../helpers';
+import { InspectResponse } from '../../../types';
 
 const ID = 'hostsQuery';
 
@@ -34,7 +37,7 @@ export interface HostsArgs {
   endDate: string;
   hosts: HostsEdges[];
   id: string;
-  inspect: inputsModel.InspectQuery;
+  inspect: InspectResponse;
   isInspected: boolean;
   loadPage: LoadPage;
   pageInfo: PageInfoPaginated;
@@ -47,6 +50,7 @@ interface UseAllHost {
   docValueFields?: DocValueFields[];
   filterQuery?: ESTermQuery | string;
   endDate: string;
+  skip?: boolean;
   startDate: string;
   type: hostsModel.HostsType;
 }
@@ -55,6 +59,7 @@ export const useAllHost = ({
   docValueFields,
   filterQuery,
   endDate,
+  skip = false,
   startDate,
   type,
 }: UseAllHost): [boolean, HostsArgs] => {
@@ -127,7 +132,7 @@ export const useAllHost = ({
         const searchSubscription$ = data.search
           .search<HostsRequestOptions, HostsStrategyResponse>(request, {
             strategy: 'securitySolutionSearchStrategy',
-            signal: abortCtrl.current.signal,
+            abortSignal: abortCtrl.current.signal,
           })
           .subscribe({
             next: (response) => {
@@ -137,7 +142,7 @@ export const useAllHost = ({
                   setHostsResponse((prevResponse) => ({
                     ...prevResponse,
                     hosts: response.edges,
-                    inspect: response.inspect ?? prevResponse.inspect,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
                     pageInfo: response.pageInfo,
                     refetch: refetch.current,
                     totalCount: response.totalCount,
@@ -189,7 +194,7 @@ export const useAllHost = ({
           field: sortField,
         },
       };
-      if (!deepEqual(prevRequest, myRequest)) {
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
         return myRequest;
       }
       return prevRequest;
@@ -202,6 +207,7 @@ export const useAllHost = ({
     endDate,
     filterQuery,
     limit,
+    skip,
     startDate,
     sortField,
   ]);
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/hosts/translations.ts b/x-pack/plugins/security_solution/public/hosts/containers/hosts/translations.ts
index ada713d135c227..c8cd36e40d6e0e 100644
--- a/x-pack/plugins/security_solution/public/hosts/containers/hosts/translations.ts
+++ b/x-pack/plugins/security_solution/public/hosts/containers/hosts/translations.ts
@@ -19,3 +19,17 @@ export const FAIL_ALL_HOST = i18n.translate(
     defaultMessage: `Failed to run search on all hosts`,
   }
 );
+
+export const ERROR_HOST_OVERVIEW = i18n.translate(
+  'xpack.securitySolution.hostOverview.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on host overview search`,
+  }
+);
+
+export const FAIL_HOST_OVERVIEW = i18n.translate(
+  'xpack.securitySolution.hostOverview.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on host overview`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/index.tsx b/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/index.tsx
index f8e5b1bed73cd2..82f5a97e9e4134 100644
--- a/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/index.tsx
@@ -4,36 +4,39 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { connect, ConnectedProps } from 'react-redux';
-import { compose } from 'redux';
+import deepEqual from 'fast-deep-equal';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { useSelector } from 'react-redux';
+
+import { AbortError } from '../../../../../../../src/plugins/data/common';
 
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import {
-  GetUncommonProcessesQuery,
-  PageInfoPaginated,
-  UncommonProcessesEdges,
-} from '../../../graphql/types';
-import { inputsModel, State, inputsSelectors } from '../../../common/store';
-import { withKibana, WithKibanaProps } from '../../../common/lib/kibana';
+import { PageInfoPaginated, UncommonProcessesEdges } from '../../../graphql/types';
+import { inputsModel, State } from '../../../common/store';
+import { useKibana } from '../../../common/lib/kibana';
 import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
-import {
-  QueryTemplatePaginated,
-  QueryTemplatePaginatedProps,
-} from '../../../common/containers/query_template_paginated';
+import { createFilter } from '../../../common/containers/helpers';
+
 import { hostsModel, hostsSelectors } from '../../store';
-import { uncommonProcessesQuery } from './index.gql_query';
+import {
+  HostUncommonProcessesRequestOptions,
+  HostUncommonProcessesStrategyResponse,
+} from '../../../../common/search_strategy/security_solution/hosts/uncommon_processes';
+import { HostsQueries } from '../../../../common/search_strategy/security_solution/hosts';
+import { DocValueFields, SortField } from '../../../../common/search_strategy';
+
+import * as i18n from './translations';
+import { ESTermQuery } from '../../../../common/typed_json';
+import { getInspectResponse } from '../../../helpers';
+import { InspectResponse } from '../../../types';
 
 const ID = 'uncommonProcessesQuery';
 
 export interface UncommonProcessesArgs {
   id: string;
-  inspect: inputsModel.InspectQuery;
+  inspect: InspectResponse;
   isInspected: boolean;
-  loading: boolean;
   loadPage: (newActivePage: number) => void;
   pageInfo: PageInfoPaginated;
   refetch: inputsModel.Refetch;
@@ -41,111 +44,164 @@ export interface UncommonProcessesArgs {
   uncommonProcesses: UncommonProcessesEdges[];
 }
 
-export interface OwnProps extends QueryTemplatePaginatedProps {
-  children: (args: UncommonProcessesArgs) => React.ReactNode;
+interface UseUncommonProcesses {
+  docValueFields?: DocValueFields[];
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  skip?: boolean;
+  startDate: string;
   type: hostsModel.HostsType;
 }
 
-type UncommonProcessesProps = OwnProps & PropsFromRedux & WithKibanaProps;
-
-class UncommonProcessesComponentQuery extends QueryTemplatePaginated<
-  UncommonProcessesProps,
-  GetUncommonProcessesQuery.Query,
-  GetUncommonProcessesQuery.Variables
-> {
-  public render() {
-    const {
-      activePage,
-      children,
-      endDate,
-      filterQuery,
-      id = ID,
-      isInspected,
-      kibana,
-      limit,
-      skip,
-      sourceId,
-      startDate,
-    } = this.props;
-    const variables: GetUncommonProcessesQuery.Variables = {
-      defaultIndex: kibana.services.uiSettings.get<string[]>(DEFAULT_INDEX_KEY),
-      filterQuery: createFilter(filterQuery),
-      inspect: isInspected,
-      pagination: generateTablePaginationOptions(activePage, limit),
-      sourceId,
-      timerange: {
-        interval: '12h',
-        from: startDate!,
-        to: endDate!,
+export const useUncommonProcesses = ({
+  docValueFields,
+  filterQuery,
+  endDate,
+  skip = false,
+  startDate,
+  type,
+}: UseUncommonProcesses): [boolean, UncommonProcessesArgs] => {
+  const getUncommonProcessesSelector = hostsSelectors.uncommonProcessesSelector();
+  const { activePage, limit } = useSelector((state: State) =>
+    getUncommonProcessesSelector(state, type)
+  );
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [uncommonProcessesRequest, setUncommonProcessesRequest] = useState<
+    HostUncommonProcessesRequestOptions
+  >({
+    defaultIndex,
+    docValueFields: docValueFields ?? [],
+    factoryQueryType: HostsQueries.uncommonProcesses,
+    filterQuery: createFilter(filterQuery),
+    pagination: generateTablePaginationOptions(activePage, limit),
+    timerange: {
+      interval: '12h',
+      from: startDate!,
+      to: endDate!,
+    },
+    sort: {} as SortField,
+  });
+
+  const wrappedLoadMore = useCallback(
+    (newActivePage: number) => {
+      setUncommonProcessesRequest((prevRequest) => {
+        return {
+          ...prevRequest,
+          pagination: generateTablePaginationOptions(newActivePage, limit),
+        };
+      });
+    },
+    [limit]
+  );
+
+  const [uncommonProcessesResponse, setUncommonProcessesResponse] = useState<UncommonProcessesArgs>(
+    {
+      uncommonProcesses: [],
+      id: ID,
+      inspect: {
+        dsl: [],
+        response: [],
       },
-    };
-    return (
-      <Query<GetUncommonProcessesQuery.Query, GetUncommonProcessesQuery.Variables>
-        query={uncommonProcessesQuery}
-        fetchPolicy={getDefaultFetchPolicy()}
-        notifyOnNetworkStatusChange
-        skip={skip}
-        variables={variables}
-      >
-        {({ data, loading, fetchMore, networkStatus, refetch }) => {
-          const uncommonProcesses = getOr([], 'source.UncommonProcesses.edges', data);
-          this.setFetchMore(fetchMore);
-          this.setFetchMoreOptions((newActivePage: number) => ({
-            variables: {
-              pagination: generateTablePaginationOptions(newActivePage, limit),
+      isInspected: false,
+      loadPage: wrappedLoadMore,
+      pageInfo: {
+        activePage: 0,
+        fakeTotalCount: 0,
+        showMorePagesIndicator: false,
+      },
+      refetch: refetch.current,
+      totalCount: -1,
+    }
+  );
+
+  const uncommonProcessesSearch = useCallback(
+    (request: HostUncommonProcessesRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<HostUncommonProcessesRequestOptions, HostUncommonProcessesStrategyResponse>(
+            request,
+            {
+              strategy: 'securitySolutionSearchStrategy',
+              abortSignal: abortCtrl.current.signal,
+            }
+          )
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setUncommonProcessesResponse((prevResponse) => ({
+                    ...prevResponse,
+                    uncommonProcesses: response.edges,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    pageInfo: response.pageInfo,
+                    refetch: refetch.current,
+                    totalCount: response.totalCount,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                notifications.toasts.addWarning(i18n.ERROR_UNCOMMON_PROCESSES);
+                searchSubscription$.unsubscribe();
+              }
             },
-            updateQuery: (prev, { fetchMoreResult }) => {
-              if (!fetchMoreResult) {
-                return prev;
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_UNCOMMON_PROCESSES,
+                  text: msg.message,
+                });
               }
-              return {
-                ...fetchMoreResult,
-                source: {
-                  ...fetchMoreResult.source,
-                  UncommonProcesses: {
-                    ...fetchMoreResult.source.UncommonProcesses,
-                    edges: [...fetchMoreResult.source.UncommonProcesses.edges],
-                  },
-                },
-              };
             },
-          }));
-          const isLoading = this.isItAValidLoading(loading, variables, networkStatus);
-          return children({
-            id,
-            inspect: getOr(null, 'source.UncommonProcesses.inspect', data),
-            isInspected,
-            loading: isLoading,
-            loadPage: this.wrappedLoadMore,
-            pageInfo: getOr({}, 'source.UncommonProcesses.pageInfo', data),
-            refetch: this.memoizedRefetchQuery(variables, limit, refetch),
-            totalCount: getOr(-1, 'source.UncommonProcesses.totalCount', data),
-            uncommonProcesses,
           });
-        }}
-      </Query>
-    );
-  }
-}
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
 
-const makeMapStateToProps = () => {
-  const getUncommonProcessesSelector = hostsSelectors.uncommonProcessesSelector();
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  const mapStateToProps = (state: State, { type, id = ID }: OwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      ...getUncommonProcessesSelector(state, type),
-      isInspected,
-    };
-  };
-  return mapStateToProps;
-};
+  useEffect(() => {
+    setUncommonProcessesRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        docValueFields: docValueFields ?? [],
+        filterQuery: createFilter(filterQuery),
+        pagination: generateTablePaginationOptions(activePage, limit),
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+        sort: {} as SortField,
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [activePage, defaultIndex, docValueFields, endDate, filterQuery, limit, skip, startDate]);
 
-const connector = connect(makeMapStateToProps);
+  useEffect(() => {
+    uncommonProcessesSearch(uncommonProcessesRequest);
+  }, [uncommonProcessesRequest, uncommonProcessesSearch]);
 
-type PropsFromRedux = ConnectedProps<typeof connector>;
-
-export const UncommonProcessesQuery = compose<React.ComponentClass<OwnProps>>(
-  connector,
-  withKibana
-)(UncommonProcessesComponentQuery);
+  return [loading, uncommonProcessesResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/translations.ts b/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/translations.ts
new file mode 100644
index 00000000000000..d563d90dfb2629
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/hosts/containers/uncommon_processes/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_UNCOMMON_PROCESSES = i18n.translate(
+  'xpack.securitySolution.uncommonProcesses.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on uncommon processes search`,
+  }
+);
+
+export const FAIL_UNCOMMON_PROCESSES = i18n.translate(
+  'xpack.securitySolution.uncommonProcesses.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on uncommon processes`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx b/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
index 67f563e944f42f..49b63a5f76a143 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
@@ -25,7 +25,7 @@ import { HostOverview } from '../../../overview/components/host_overview';
 import { manageQuery } from '../../../common/components/page/manage_query';
 import { SiemSearchBar } from '../../../common/components/search_bar';
 import { WrapperPage } from '../../../common/components/wrapper_page';
-import { HostOverviewByNameQuery } from '../../containers/hosts/overview';
+import { HostOverviewByNameQuery } from '../../containers/hosts/details';
 import { KpiHostDetailsQuery } from '../../containers/kpi_host_details';
 import { useGlobalTime } from '../../../common/containers/use_global_time';
 import { useWithSource } from '../../../common/containers/source';
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/authentications_query_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/authentications_query_tab_body.tsx
index 88886a874a9494..65ddb9305f607d 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/authentications_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/authentications_query_tab_body.tsx
@@ -8,21 +8,22 @@ import { getOr } from 'lodash/fp';
 import React, { useEffect } from 'react';
 import { AuthenticationTable } from '../../components/authentications_table';
 import { manageQuery } from '../../../common/components/page/manage_query';
-import { AuthenticationsQuery } from '../../containers/authentications';
+import { useAuthentications } from '../../containers/authentications';
 import { HostsComponentsQueryProps } from './types';
-import { hostsModel } from '../../store';
 import {
   MatrixHistogramOption,
   MatrixHistogramMappingTypes,
-  MatrixHisrogramConfigs,
+  MatrixHistogramConfigs,
 } from '../../../common/components/matrix_histogram/types';
-import { MatrixHistogramContainer } from '../../../common/components/matrix_histogram';
+import { MatrixHistogram } from '../../../common/components/matrix_histogram';
 import { KpiHostsChartColors } from '../../components/kpi_hosts/types';
 import * as i18n from '../translations';
-import { HistogramType } from '../../../graphql/types';
+import { MatrixHistogramType } from '../../../../common/search_strategy/security_solution';
 
 const AuthenticationTableManage = manageQuery(AuthenticationTable);
-const ID = 'authenticationsOverTimeQuery';
+
+const ID = 'authenticationsHistogramQuery';
+
 const authStackByOptions: MatrixHistogramOption[] = [
   {
     text: 'event.outcome',
@@ -49,17 +50,17 @@ export const authMatrixDataMappingFields: MatrixHistogramMappingTypes = {
   },
 };
 
-const histogramConfigs: MatrixHisrogramConfigs = {
+const histogramConfigs: MatrixHistogramConfigs = {
   defaultStackByOption:
     authStackByOptions.find((o) => o.text === DEFAULT_STACK_BY) ?? authStackByOptions[0],
   errorMessage: i18n.ERROR_FETCHING_AUTHENTICATIONS_DATA,
-  histogramType: HistogramType.authentications,
+  histogramType: MatrixHistogramType.authentications,
   mapping: authMatrixDataMappingFields,
   stackByOptions: authStackByOptions,
   title: i18n.NAVIGATION_AUTHENTICATIONS_TITLE,
 };
 
-export const AuthenticationsQueryTabBody = ({
+const AuthenticationsQueryTabBodyComponent: React.FC<HostsComponentsQueryProps> = ({
   deleteQuery,
   docValueFields,
   endDate,
@@ -68,7 +69,12 @@ export const AuthenticationsQueryTabBody = ({
   setQuery,
   startDate,
   type,
-}: HostsComponentsQueryProps) => {
+}) => {
+  const [
+    loading,
+    { authentications, totalCount, pageInfo, loadPage, id, inspect, isInspected, refetch },
+  ] = useAuthentications({ docValueFields, endDate, filterQuery, skip, startDate, type });
+
   useEffect(() => {
     return () => {
       if (deleteQuery) {
@@ -79,55 +85,36 @@ export const AuthenticationsQueryTabBody = ({
 
   return (
     <>
-      <MatrixHistogramContainer
+      <MatrixHistogram
         endDate={endDate}
         filterQuery={filterQuery}
         id={ID}
         setQuery={setQuery}
-        sourceId="default"
         startDate={startDate}
-        type={hostsModel.HostsType.page}
         {...histogramConfigs}
       />
-      <AuthenticationsQuery
-        docValueFields={docValueFields}
-        endDate={endDate}
-        filterQuery={filterQuery}
-        skip={skip}
-        sourceId="default"
-        startDate={startDate}
+
+      <AuthenticationTableManage
+        data={authentications}
+        deleteQuery={deleteQuery}
+        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+        id={id}
+        inspect={inspect}
+        isInspect={isInspected}
+        loading={loading}
+        loadPage={loadPage}
+        refetch={refetch}
+        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+        setQuery={setQuery}
+        totalCount={totalCount}
         type={type}
-      >
-        {({
-          authentications,
-          totalCount,
-          loading,
-          pageInfo,
-          loadPage,
-          id,
-          inspect,
-          isInspected,
-          refetch,
-        }) => (
-          <AuthenticationTableManage
-            data={authentications}
-            deleteQuery={deleteQuery}
-            fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-            id={id}
-            inspect={inspect}
-            isInspect={isInspected}
-            loading={loading}
-            loadPage={loadPage}
-            refetch={refetch}
-            showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-            setQuery={setQuery}
-            totalCount={totalCount}
-            type={type}
-          />
-        )}
-      </AuthenticationsQuery>
+      />
     </>
   );
 };
 
+AuthenticationsQueryTabBodyComponent.displayName = 'AuthenticationsQueryTabBodyComponent';
+
+export const AuthenticationsQueryTabBody = React.memo(AuthenticationsQueryTabBodyComponent);
+
 AuthenticationsQueryTabBody.displayName = 'AuthenticationsQueryTabBody';
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
index cea987db485f4b..be8412caf77326 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
@@ -10,20 +10,18 @@ import { useDispatch } from 'react-redux';
 import { TimelineId } from '../../../../common/types/timeline';
 import { StatefulEventsViewer } from '../../../common/components/events_viewer';
 import { HostsComponentsQueryProps } from './types';
-import { hostsModel } from '../../store';
 import { eventsDefaultModel } from '../../../common/components/events_viewer/default_model';
 import {
   MatrixHistogramOption,
-  MatrixHisrogramConfigs,
+  MatrixHistogramConfigs,
 } from '../../../common/components/matrix_histogram/types';
-import { MatrixHistogramContainer } from '../../../common/components/matrix_histogram';
+import { MatrixHistogram } from '../../../common/components/matrix_histogram';
 import { useFullScreen } from '../../../common/containers/use_full_screen';
 import * as i18n from '../translations';
-import { HistogramType } from '../../../graphql/types';
+import { MatrixHistogramType } from '../../../../common/search_strategy/security_solution';
 import { useManageTimeline } from '../../../timelines/components/manage_timeline';
-import { getInvestigateInResolverAction } from '../../../timelines/components/timeline/body/helpers';
 
-const EVENTS_HISTOGRAM_ID = 'eventsOverTimeQuery';
+const EVENTS_HISTOGRAM_ID = 'eventsHistogramQuery';
 
 export const eventsStackByOptions: MatrixHistogramOption[] = [
   {
@@ -42,34 +40,31 @@ export const eventsStackByOptions: MatrixHistogramOption[] = [
 
 const DEFAULT_STACK_BY = 'event.action';
 
-export const histogramConfigs: MatrixHisrogramConfigs = {
+export const histogramConfigs: MatrixHistogramConfigs = {
   defaultStackByOption:
     eventsStackByOptions.find((o) => o.text === DEFAULT_STACK_BY) ?? eventsStackByOptions[0],
   errorMessage: i18n.ERROR_FETCHING_EVENTS_DATA,
-  histogramType: HistogramType.events,
+  histogramType: MatrixHistogramType.events,
   stackByOptions: eventsStackByOptions,
   subtitle: undefined,
   title: i18n.NAVIGATION_EVENTS_TITLE,
 };
 
-export const EventsQueryTabBody = ({
+const EventsQueryTabBodyComponent: React.FC<HostsComponentsQueryProps> = ({
   deleteQuery,
   endDate,
   filterQuery,
   pageFilters,
   setQuery,
   startDate,
-}: HostsComponentsQueryProps) => {
-  const { initializeTimeline } = useManageTimeline();
+}) => {
   const dispatch = useDispatch();
+  const { initializeTimeline } = useManageTimeline();
   const { globalFullScreen } = useFullScreen();
   useEffect(() => {
     initializeTimeline({
       id: TimelineId.hostsPageEvents,
       defaultModel: eventsDefaultModel,
-      timelineRowActions: () => [
-        getInvestigateInResolverAction({ dispatch, timelineId: TimelineId.hostsPageEvents }),
-      ],
     });
   }, [dispatch, initializeTimeline]);
 
@@ -84,13 +79,11 @@ export const EventsQueryTabBody = ({
   return (
     <>
       {!globalFullScreen && (
-        <MatrixHistogramContainer
+        <MatrixHistogram
           endDate={endDate}
           filterQuery={filterQuery}
           setQuery={setQuery}
-          sourceId="default"
           startDate={startDate}
-          type={hostsModel.HostsType.page}
           id={EVENTS_HISTOGRAM_ID}
           {...histogramConfigs}
         />
@@ -106,4 +99,8 @@ export const EventsQueryTabBody = ({
   );
 };
 
+EventsQueryTabBodyComponent.displayName = 'EventsQueryTabBodyComponent';
+
+export const EventsQueryTabBody = React.memo(EventsQueryTabBodyComponent);
+
 EventsQueryTabBody.displayName = 'EventsQueryTabBody';
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/hosts_query_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/hosts_query_tab_body.tsx
index 5232dcfd88189d..f8dcf9635c053e 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/hosts_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/hosts_query_tab_body.tsx
@@ -27,7 +27,8 @@ export const HostsQueryTabBody = ({
   const [
     loading,
     { hosts, totalCount, pageInfo, loadPage, id, inspect, isInspected, refetch },
-  ] = useAllHost({ docValueFields, endDate, filterQuery, startDate, type });
+  ] = useAllHost({ docValueFields, endDate, filterQuery, skip, startDate, type });
+
   return (
     <HostsTableManage
       deleteQuery={deleteQuery}
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/uncommon_process_query_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/uncommon_process_query_tab_body.tsx
index f1691dbaa04b45..713958f05a3da1 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/uncommon_process_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/uncommon_process_query_tab_body.tsx
@@ -6,7 +6,7 @@
 
 import { getOr } from 'lodash/fp';
 import React from 'react';
-import { UncommonProcessesQuery } from '../../containers/uncommon_processes';
+import { useUncommonProcesses } from '../../containers/uncommon_processes';
 import { HostsComponentsQueryProps } from './types';
 import { UncommonProcessTable } from '../../components/uncommon_process_table';
 import { manageQuery } from '../../../common/components/page/manage_query';
@@ -15,49 +15,35 @@ const UncommonProcessTableManage = manageQuery(UncommonProcessTable);
 
 export const UncommonProcessQueryTabBody = ({
   deleteQuery,
+  docValueFields,
   endDate,
   filterQuery,
   skip,
   setQuery,
   startDate,
   type,
-}: HostsComponentsQueryProps) => (
-  <UncommonProcessesQuery
-    endDate={endDate}
-    filterQuery={filterQuery}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={type}
-  >
-    {({
-      uncommonProcesses,
-      totalCount,
-      loading,
-      pageInfo,
-      loadPage,
-      id,
-      inspect,
-      isInspected,
-      refetch,
-    }) => (
-      <UncommonProcessTableManage
-        deleteQuery={deleteQuery}
-        data={uncommonProcesses}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        id={id}
-        inspect={inspect}
-        isInspect={isInspected}
-        loading={loading}
-        loadPage={loadPage}
-        refetch={refetch}
-        setQuery={setQuery}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        totalCount={totalCount}
-        type={type}
-      />
-    )}
-  </UncommonProcessesQuery>
-);
+}: HostsComponentsQueryProps) => {
+  const [
+    loading,
+    { uncommonProcesses, totalCount, pageInfo, loadPage, id, inspect, isInspected, refetch },
+  ] = useUncommonProcesses({ docValueFields, endDate, filterQuery, skip, startDate, type });
+  return (
+    <UncommonProcessTableManage
+      deleteQuery={deleteQuery}
+      data={uncommonProcesses}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      id={id}
+      inspect={inspect}
+      isInspect={isInspected}
+      loading={loading}
+      loadPage={loadPage}
+      refetch={refetch}
+      setQuery={setQuery}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      totalCount={totalCount}
+      type={type}
+    />
+  );
+};
 
 UncommonProcessQueryTabBody.dispalyName = 'UncommonProcessQueryTabBody';
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts
index aa9bef7bb5417e..cfde474c6290dc 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts
@@ -90,7 +90,6 @@ const endpointListApiPathHandlerMocks = ({
     [INGEST_API_EPM_PACKAGES]: (): GetPackagesResponse => {
       return {
         response: epmPackages,
-        success: true,
       };
     },
 
@@ -114,7 +113,6 @@ const endpointListApiPathHandlerMocks = ({
       return {
         items: [agentPolicy],
         total: 10,
-        success: true,
         perPage: 10,
         page: 1,
       };
@@ -132,7 +130,6 @@ const endpointListApiPathHandlerMocks = ({
         page: 1,
         perPage: 10,
         total: endpointPackagePolicies?.length,
-        success: true,
       };
     },
   };
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts
index 5ef01c00dbf166..1093aed0608d56 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/test_mock_utils.ts
@@ -64,7 +64,6 @@ export const mockPolicyResultList: (options?: {
     total,
     page: requestPageIndex,
     perPage: requestPageSize,
-    success: true,
   };
   return mock;
 };
@@ -81,7 +80,6 @@ export const policyListApiPathHandlers = (totalPolicies: number = 1) => {
     [INGEST_API_EPM_PACKAGES]: (): GetPackagesResponse => {
       return {
         response: [generator.generateEpmPackage()],
-        success: true,
       };
     },
   };
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/__snapshots__/index.test.tsx.snap
index 1127528c776b75..02a8802bfced16 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/__snapshots__/index.test.tsx.snap
@@ -1,7 +1,7 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`NetworkTopCountries Table Component rendering it renders the IP Details NetworkTopCountries table 1`] = `
-<Connect(NetworkTopCountriesTableComponent)
+<Memo(NetworkTopCountriesTableComponent)
   data={
     Array [
       Object {
@@ -146,7 +146,7 @@ exports[`NetworkTopCountries Table Component rendering it renders the IP Details
 `;
 
 exports[`NetworkTopCountries Table Component rendering it renders the default NetworkTopCountries table 1`] = `
-<Connect(NetworkTopCountriesTableComponent)
+<Memo(NetworkTopCountriesTableComponent)
   data={
     Array [
       Object {
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/columns.tsx b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/columns.tsx
index b91bc7553d9c41..d6661ed48197a6 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/columns.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/columns.tsx
@@ -14,7 +14,7 @@ import {
   FlowTargetSourceDest,
   NetworkTopCountriesEdges,
   TopNetworkTablesEcsField,
-} from '../../../graphql/types';
+} from '../../../../common/search_strategy/security_solution/network';
 import { networkModel } from '../../store';
 import {
   DragEffects,
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
index f82c0effbc0a61..5da0ec62a5386b 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
@@ -11,7 +11,7 @@ import { MockedProvider } from 'react-apollo/test-utils';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import '../../../common/mock/match_media';
-import { FlowTargetSourceDest } from '../../../graphql/types';
+import { FlowTargetSourceDest } from '../../../../common/search_strategy/security_solution/network';
 import {
   apolloClientObservable,
   mockGlobalState,
@@ -76,7 +76,7 @@ describe('NetworkTopCountries Table Component', () => {
         </ReduxStoreProvider>
       );
 
-      expect(wrapper.find('Connect(NetworkTopCountriesTableComponent)')).toMatchSnapshot();
+      expect(wrapper.find('Memo(NetworkTopCountriesTableComponent)')).toMatchSnapshot();
     });
     test('it renders the IP Details NetworkTopCountries table', () => {
       const wrapper = shallow(
@@ -101,7 +101,7 @@ describe('NetworkTopCountries Table Component', () => {
         </ReduxStoreProvider>
       );
 
-      expect(wrapper.find('Connect(NetworkTopCountriesTableComponent)')).toMatchSnapshot();
+      expect(wrapper.find('Memo(NetworkTopCountriesTableComponent)')).toMatchSnapshot();
     });
   });
 
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.tsx b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.tsx
index 93d3f410ddde40..114bca9f59d9cd 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.tsx
@@ -6,7 +6,7 @@
 
 import { last } from 'lodash/fp';
 import React, { useCallback, useMemo } from 'react';
-import { connect, ConnectedProps } from 'react-redux';
+import { useDispatch, useSelector, shallowEqual } from 'react-redux';
 import deepEqual from 'fast-deep-equal';
 import { IIndexPattern } from 'src/plugins/data/public';
 
@@ -16,8 +16,8 @@ import {
   FlowTargetSourceDest,
   NetworkTopCountriesEdges,
   NetworkTopTablesFields,
-  NetworkTopTablesSortField,
-} from '../../../graphql/types';
+  SortField,
+} from '../../../../common/search_strategy';
 import { State } from '../../../common/store';
 
 import { Criteria, ItemsPerRow, PaginatedTable } from '../../../common/components/paginated_table';
@@ -25,7 +25,7 @@ import { Criteria, ItemsPerRow, PaginatedTable } from '../../../common/component
 import { getCountriesColumnsCurated } from './columns';
 import * as i18n from './translations';
 
-interface OwnProps {
+interface NetworkTopCountriesTableProps {
   data: NetworkTopCountriesEdges[];
   fakeTotalCount: number;
   flowTargeted: FlowTargetSourceDest;
@@ -39,8 +39,6 @@ interface OwnProps {
   type: networkModel.NetworkType;
 }
 
-type NetworkTopCountriesTableProps = OwnProps & PropsFromRedux;
-
 const rowItems: ItemsPerRow[] = [
   {
     text: i18n.ROWS_5,
@@ -54,139 +52,133 @@ const rowItems: ItemsPerRow[] = [
 
 export const NetworkTopCountriesTableId = 'networkTopCountries-top-talkers';
 
-const NetworkTopCountriesTableComponent = React.memo<NetworkTopCountriesTableProps>(
-  ({
-    activePage,
-    data,
-    fakeTotalCount,
-    flowTargeted,
-    id,
-    indexPattern,
-    isInspect,
-    limit,
-    loading,
-    loadPage,
-    showMorePagesIndicator,
-    sort,
-    totalCount,
-    type,
-    updateNetworkTable,
-  }) => {
-    let tableType: networkModel.TopCountriesTableType;
-    const headerTitle: string =
+const NetworkTopCountriesTableComponent: React.FC<NetworkTopCountriesTableProps> = ({
+  data,
+  fakeTotalCount,
+  flowTargeted,
+  id,
+  indexPattern,
+  isInspect,
+  loading,
+  loadPage,
+  showMorePagesIndicator,
+  totalCount,
+  type,
+}) => {
+  const dispatch = useDispatch();
+  const getTopCountriesSelector = networkSelectors.topCountriesSelector();
+  const { activePage, limit, sort } = useSelector(
+    (state: State) => getTopCountriesSelector(state, type, flowTargeted),
+    shallowEqual
+  );
+
+  const headerTitle: string = useMemo(
+    () =>
       flowTargeted === FlowTargetSourceDest.source
         ? i18n.SOURCE_COUNTRIES
-        : i18n.DESTINATION_COUNTRIES;
+        : i18n.DESTINATION_COUNTRIES,
+    [flowTargeted]
+  );
 
+  const tableType: networkModel.TopCountriesTableType = useMemo(() => {
     if (type === networkModel.NetworkType.page) {
-      tableType =
-        flowTargeted === FlowTargetSourceDest.source
-          ? networkModel.NetworkTableType.topCountriesSource
-          : networkModel.NetworkTableType.topCountriesDestination;
-    } else {
-      tableType =
-        flowTargeted === FlowTargetSourceDest.source
-          ? networkModel.IpDetailsTableType.topCountriesSource
-          : networkModel.IpDetailsTableType.topCountriesDestination;
+      return flowTargeted === FlowTargetSourceDest.source
+        ? networkModel.NetworkTableType.topCountriesSource
+        : networkModel.NetworkTableType.topCountriesDestination;
     }
 
-    const field =
-      sort.field === NetworkTopTablesFields.bytes_out ||
-      sort.field === NetworkTopTablesFields.bytes_in
-        ? `node.network.${sort.field}`
-        : `node.${flowTargeted}.${sort.field}`;
-
-    const updateLimitPagination = useCallback(
-      (newLimit) =>
-        updateNetworkTable({
+    return flowTargeted === FlowTargetSourceDest.source
+      ? networkModel.IpDetailsTableType.topCountriesSource
+      : networkModel.IpDetailsTableType.topCountriesDestination;
+  }, [flowTargeted, type]);
+
+  const field =
+    sort.field === NetworkTopTablesFields.bytes_out ||
+    sort.field === NetworkTopTablesFields.bytes_in
+      ? `node.network.${sort.field}`
+      : `node.${flowTargeted}.${sort.field}`;
+
+  const updateLimitPagination = useCallback(
+    (newLimit) =>
+      dispatch(
+        networkActions.updateNetworkTable({
           networkType: type,
           tableType,
           updates: { limit: newLimit },
-        }),
-      [type, updateNetworkTable, tableType]
-    );
-
-    const updateActivePage = useCallback(
-      (newPage) =>
-        updateNetworkTable({
+        })
+      ),
+    [dispatch, type, tableType]
+  );
+
+  const updateActivePage = useCallback(
+    (newPage) =>
+      dispatch(
+        networkActions.updateNetworkTable({
           networkType: type,
           tableType,
           updates: { activePage: newPage },
-        }),
-      [type, updateNetworkTable, tableType]
-    );
-
-    const onChange = useCallback(
-      (criteria: Criteria) => {
-        if (criteria.sort != null) {
-          const splitField = criteria.sort.field.split('.');
-          const lastField = last(splitField);
-          const newSortDirection =
-            lastField !== sort.field ? Direction.desc : criteria.sort.direction; // sort by desc on init click
-          const newTopCountriesSort: NetworkTopTablesSortField = {
-            field: lastField as NetworkTopTablesFields,
-            direction: newSortDirection as Direction,
-          };
-          if (!deepEqual(newTopCountriesSort, sort)) {
-            updateNetworkTable({
+        })
+      ),
+    [dispatch, type, tableType]
+  );
+
+  const onChange = useCallback(
+    (criteria: Criteria) => {
+      if (criteria.sort != null) {
+        const splitField = criteria.sort.field.split('.');
+        const lastField = last(splitField) as NetworkTopTablesFields;
+        const newSortDirection =
+          lastField !== sort.field ? Direction.desc : (criteria.sort.direction as Direction); // sort by desc on init click
+        const newTopCountriesSort: SortField<NetworkTopTablesFields> = {
+          field: lastField,
+          direction: newSortDirection,
+        };
+        if (!deepEqual(newTopCountriesSort, sort)) {
+          dispatch(
+            networkActions.updateNetworkTable({
               networkType: type,
               tableType,
               updates: {
                 sort: newTopCountriesSort,
               },
-            });
-          }
+            })
+          );
         }
-      },
-      [type, sort, tableType, updateNetworkTable]
-    );
-
-    const columns = useMemo(
-      () =>
-        getCountriesColumnsCurated(indexPattern, flowTargeted, type, NetworkTopCountriesTableId),
-      [indexPattern, flowTargeted, type]
-    );
-
-    return (
-      <PaginatedTable
-        activePage={activePage}
-        columns={columns}
-        dataTestSubj={`table-${tableType}`}
-        headerCount={totalCount}
-        headerTitle={headerTitle}
-        headerUnit={i18n.UNIT(totalCount)}
-        id={id}
-        isInspect={isInspect}
-        itemsPerRow={rowItems}
-        limit={limit}
-        loading={loading}
-        loadPage={loadPage}
-        onChange={onChange}
-        pageOfItems={data}
-        showMorePagesIndicator={showMorePagesIndicator}
-        sorting={{ field, direction: sort.direction }}
-        totalCount={fakeTotalCount}
-        updateActivePage={updateActivePage}
-        updateLimitPagination={updateLimitPagination}
-      />
-    );
-  }
-);
-
-NetworkTopCountriesTableComponent.displayName = 'NetworkTopCountriesTableComponent';
-
-const makeMapStateToProps = () => {
-  const getTopCountriesSelector = networkSelectors.topCountriesSelector();
-  return (state: State, { type, flowTargeted }: OwnProps) =>
-    getTopCountriesSelector(state, type, flowTargeted);
-};
-
-const mapDispatchToProps = {
-  updateNetworkTable: networkActions.updateNetworkTable,
+      }
+    },
+    [sort, dispatch, type, tableType]
+  );
+
+  const columns = useMemo(
+    () => getCountriesColumnsCurated(indexPattern, flowTargeted, type, NetworkTopCountriesTableId),
+    [indexPattern, flowTargeted, type]
+  );
+
+  return (
+    <PaginatedTable
+      activePage={activePage}
+      columns={columns}
+      dataTestSubj={`table-${tableType}`}
+      headerCount={totalCount}
+      headerTitle={headerTitle}
+      headerUnit={i18n.UNIT(totalCount)}
+      id={id}
+      isInspect={isInspect}
+      itemsPerRow={rowItems}
+      limit={limit}
+      loading={loading}
+      loadPage={loadPage}
+      onChange={onChange}
+      pageOfItems={data}
+      showMorePagesIndicator={showMorePagesIndicator}
+      sorting={{ field, direction: sort.direction }}
+      totalCount={fakeTotalCount}
+      updateActivePage={updateActivePage}
+      updateLimitPagination={updateLimitPagination}
+    />
+  );
 };
 
-const connector = connect(makeMapStateToProps, mapDispatchToProps);
-
-type PropsFromRedux = ConnectedProps<typeof connector>;
+NetworkTopCountriesTableComponent.displayName = 'NetworkTopCountriesTableComponent';
 
-export const NetworkTopCountriesTable = connector(NetworkTopCountriesTableComponent);
+export const NetworkTopCountriesTable = React.memo(NetworkTopCountriesTableComponent);
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/mock.ts b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/mock.ts
index cee775c93d66fd..eb6843647f74ac 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/mock.ts
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/mock.ts
@@ -4,10 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { NetworkTopCountriesData } from '../../../graphql/types';
+import { NetworkTopCountriesStrategyResponse } from '../../../../common/search_strategy/security_solution/network';
 
-export const mockData: { NetworkTopCountries: NetworkTopCountriesData } = {
+export const mockData: { NetworkTopCountries: NetworkTopCountriesStrategyResponse } = {
   NetworkTopCountries: {
+    rawResponse: {} as NetworkTopCountriesStrategyResponse['rawResponse'],
     totalCount: 524,
     edges: [
       {
diff --git a/x-pack/plugins/security_solution/public/network/containers/network_dns/histogram.ts b/x-pack/plugins/security_solution/public/network/containers/network_dns/histogram.ts
new file mode 100644
index 00000000000000..dce0c3bd2b30d4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/network_dns/histogram.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { connect } from 'react-redux';
+import { compose } from 'redux';
+import { DocumentNode } from 'graphql';
+import { ScaleType } from '@elastic/charts';
+
+import { MatrixHistogram } from '../../../common/components/matrix_histogram';
+import {
+  MatrixHistogramOption,
+  GetSubTitle,
+} from '../../../common/components/matrix_histogram/types';
+import { UpdateDateRange } from '../../../common/components/charts/common';
+import { GlobalTimeArgs } from '../../../common/containers/use_global_time';
+import { withKibana } from '../../../common/lib/kibana';
+import { QueryTemplatePaginatedProps } from '../../../common/containers/query_template_paginated';
+import { DEFAULT_TABLE_ACTIVE_PAGE, DEFAULT_TABLE_LIMIT } from '../../../common/store/constants';
+import { networkModel, networkSelectors } from '../../store';
+import { State, inputsSelectors } from '../../../common/store';
+
+export const HISTOGRAM_ID = 'networkDnsHistogramQuery';
+
+interface DnsHistogramOwnProps extends QueryTemplatePaginatedProps {
+  dataKey: string | string[];
+  defaultStackByOption: MatrixHistogramOption;
+  errorMessage: string;
+  isDnsHistogram?: boolean;
+  query: DocumentNode;
+  scaleType: ScaleType;
+  setQuery: GlobalTimeArgs['setQuery'];
+  showLegend?: boolean;
+  stackByOptions: MatrixHistogramOption[];
+  subtitle?: string | GetSubTitle;
+  title: string;
+  type: networkModel.NetworkType;
+  updateDateRange: UpdateDateRange;
+  yTickFormatter?: (value: number) => string;
+}
+
+const makeMapHistogramStateToProps = () => {
+  const getNetworkDnsSelector = networkSelectors.dnsSelector();
+  const getQuery = inputsSelectors.globalQueryByIdSelector();
+  const mapStateToProps = (state: State, { id = HISTOGRAM_ID }: DnsHistogramOwnProps) => {
+    const { isInspected } = getQuery(state, id);
+    return {
+      ...getNetworkDnsSelector(state),
+      activePage: DEFAULT_TABLE_ACTIVE_PAGE,
+      limit: DEFAULT_TABLE_LIMIT,
+      isInspected,
+      id,
+    };
+  };
+
+  return mapStateToProps;
+};
+
+export const NetworkDnsHistogramQuery = compose<React.ComponentClass<DnsHistogramOwnProps>>(
+  connect(makeMapHistogramStateToProps),
+  withKibana
+)(MatrixHistogram);
diff --git a/x-pack/plugins/security_solution/public/network/containers/network_dns/index.tsx b/x-pack/plugins/security_solution/public/network/containers/network_dns/index.tsx
index 72e3161de53732..53d9a303ab849b 100644
--- a/x-pack/plugins/security_solution/public/network/containers/network_dns/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/containers/network_dns/index.tsx
@@ -4,48 +4,38 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { connect } from 'react-redux';
-import { compose } from 'redux';
-
-import { DocumentNode } from 'graphql';
-import { ScaleType } from '@elastic/charts';
+import { noop } from 'lodash/fp';
+import { useState, useEffect, useCallback, useRef } from 'react';
+import { shallowEqual, useSelector } from 'react-redux';
+import deepEqual from 'fast-deep-equal';
+
+import { ESTermQuery } from '../../../../common/typed_json';
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import {
-  GetNetworkDnsQuery,
-  NetworkDnsEdges,
-  NetworkDnsSortField,
-  PageInfoPaginated,
-  MatrixOverOrdinalHistogramData,
-} from '../../../graphql/types';
-import { inputsModel, State, inputsSelectors } from '../../../common/store';
-import { withKibana, WithKibanaProps } from '../../../common/lib/kibana';
+import { inputsModel, State } from '../../../common/store';
+import { useKibana } from '../../../common/lib/kibana';
+import { createFilter } from '../../../common/containers/helpers';
+import { NetworkDnsEdges, PageInfoPaginated } from '../../../graphql/types';
 import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
-import {
-  QueryTemplatePaginated,
-  QueryTemplatePaginatedProps,
-} from '../../../common/containers/query_template_paginated';
-import { networkDnsQuery } from './index.gql_query';
-import { DEFAULT_TABLE_ACTIVE_PAGE, DEFAULT_TABLE_LIMIT } from '../../../common/store/constants';
-import { MatrixHistogram } from '../../../common/components/matrix_histogram';
-import {
-  MatrixHistogramOption,
-  GetSubTitle,
-} from '../../../common/components/matrix_histogram/types';
-import { UpdateDateRange } from '../../../common/components/charts/common';
-import { GlobalTimeArgs } from '../../../common/containers/use_global_time';
 import { networkModel, networkSelectors } from '../../store';
+import {
+  NetworkQueries,
+  NetworkDnsRequestOptions,
+  NetworkDnsStrategyResponse,
+  MatrixOverOrdinalHistogramData,
+} from '../../../../common/search_strategy/security_solution/network';
+import { AbortError } from '../../../../../../../src/plugins/data/common';
+import * as i18n from './translations';
+import { getInspectResponse } from '../../../helpers';
+import { InspectResponse } from '../../../types';
+
+export * from './histogram';
 
 const ID = 'networkDnsQuery';
-export const HISTOGRAM_ID = 'networkDnsHistogramQuery';
+
 export interface NetworkDnsArgs {
   id: string;
-  inspect: inputsModel.InspectQuery;
+  inspect: InspectResponse;
   isInspected: boolean;
-  loading: boolean;
   loadPage: (newActivePage: number) => void;
   networkDns: NetworkDnsEdges[];
   pageInfo: PageInfoPaginated;
@@ -55,162 +45,164 @@ export interface NetworkDnsArgs {
   histogram: MatrixOverOrdinalHistogramData[];
 }
 
-export interface OwnProps extends QueryTemplatePaginatedProps {
-  children: (args: NetworkDnsArgs) => React.ReactNode;
+interface UseNetworkDns {
+  id?: string;
   type: networkModel.NetworkType;
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  startDate: string;
+  skip: boolean;
 }
 
-interface DnsHistogramOwnProps extends QueryTemplatePaginatedProps {
-  dataKey: string | string[];
-  defaultStackByOption: MatrixHistogramOption;
-  errorMessage: string;
-  isDnsHistogram?: boolean;
-  query: DocumentNode;
-  scaleType: ScaleType;
-  setQuery: GlobalTimeArgs['setQuery'];
-  showLegend?: boolean;
-  stackByOptions: MatrixHistogramOption[];
-  subtitle?: string | GetSubTitle;
-  title: string;
-  type: networkModel.NetworkType;
-  updateDateRange: UpdateDateRange;
-  yTickFormatter?: (value: number) => string;
-}
+export const useNetworkDns = ({
+  endDate,
+  filterQuery,
+  id = ID,
+  skip,
+  startDate,
+  type,
+}: UseNetworkDns): [boolean, NetworkDnsArgs] => {
+  const getNetworkDnsSelector = networkSelectors.dnsSelector();
+  const { activePage, sort, isPtrIncluded, limit } = useSelector(
+    (state: State) => getNetworkDnsSelector(state),
+    shallowEqual
+  );
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
 
-export interface NetworkDnsComponentReduxProps {
-  activePage: number;
-  sort: NetworkDnsSortField;
-  isInspected: boolean;
-  isPtrIncluded: boolean;
-  limit: number;
-}
+  const [networkDnsRequest, setNetworkDnsRequest] = useState<NetworkDnsRequestOptions>({
+    defaultIndex,
+    factoryQueryType: NetworkQueries.dns,
+    filterQuery: createFilter(filterQuery),
+    isPtrIncluded,
+    pagination: generateTablePaginationOptions(activePage, limit),
+    sort,
+    timerange: {
+      interval: '12h',
+      from: startDate ? startDate : '',
+      to: endDate ? endDate : new Date(Date.now()).toISOString(),
+    },
+  });
+
+  const wrappedLoadMore = useCallback(
+    (newActivePage: number) => {
+      setNetworkDnsRequest((prevRequest) => ({
+        ...prevRequest,
+        pagination: generateTablePaginationOptions(newActivePage, limit),
+      }));
+    },
+    [limit]
+  );
 
-type NetworkDnsProps = OwnProps & NetworkDnsComponentReduxProps & WithKibanaProps;
-
-export class NetworkDnsComponentQuery extends QueryTemplatePaginated<
-  NetworkDnsProps,
-  GetNetworkDnsQuery.Query,
-  GetNetworkDnsQuery.Variables
-> {
-  public render() {
-    const {
-      activePage,
-      children,
-      sort,
-      endDate,
-      filterQuery,
-      id = ID,
-      isInspected,
-      isPtrIncluded,
-      kibana,
-      limit,
-      skip,
-      sourceId,
-      startDate,
-    } = this.props;
-    const variables: GetNetworkDnsQuery.Variables = {
-      defaultIndex: kibana.services.uiSettings.get<string[]>(DEFAULT_INDEX_KEY),
-      filterQuery: createFilter(filterQuery),
-      inspect: isInspected,
-      isPtrIncluded,
-      pagination: generateTablePaginationOptions(activePage, limit),
-      sort,
-      sourceId,
-      timerange: {
-        interval: '12h',
-        from: startDate!,
-        to: endDate!,
-      },
-    };
-
-    return (
-      <Query<GetNetworkDnsQuery.Query, GetNetworkDnsQuery.Variables>
-        fetchPolicy={getDefaultFetchPolicy()}
-        notifyOnNetworkStatusChange
-        query={networkDnsQuery}
-        skip={skip}
-        variables={variables}
-      >
-        {({ data, loading, fetchMore, networkStatus, refetch }) => {
-          const networkDns = getOr([], `source.NetworkDns.edges`, data);
-          this.setFetchMore(fetchMore);
-          this.setFetchMoreOptions((newActivePage: number) => ({
-            variables: {
-              pagination: generateTablePaginationOptions(newActivePage, limit),
+  const [networkDnsResponse, setNetworkDnsResponse] = useState<NetworkDnsArgs>({
+    networkDns: [],
+    histogram: [],
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    loadPage: wrappedLoadMore,
+    pageInfo: {
+      activePage: 0,
+      fakeTotalCount: 0,
+      showMorePagesIndicator: false,
+    },
+    refetch: refetch.current,
+    totalCount: -1,
+  });
+
+  const networkDnsSearch = useCallback(
+    (request: NetworkDnsRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<NetworkDnsRequestOptions, NetworkDnsStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkDnsResponse((prevResponse) => ({
+                    ...prevResponse,
+                    networkDns: response.edges,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    pageInfo: response.pageInfo,
+                    refetch: refetch.current,
+                    totalCount: response.totalCount,
+                    histogram: response.histogram ?? prevResponse.histogram,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_DNS);
+                searchSubscription$.unsubscribe();
+              }
             },
-            updateQuery: (prev, { fetchMoreResult }) => {
-              if (!fetchMoreResult) {
-                return prev;
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_NETWORK_DNS,
+                  text: msg.message,
+                });
               }
-              return {
-                ...fetchMoreResult,
-                source: {
-                  ...fetchMoreResult.source,
-                  NetworkDns: {
-                    ...fetchMoreResult.source.NetworkDns,
-                    edges: [...fetchMoreResult.source.NetworkDns.edges],
-                  },
-                },
-              };
             },
-          }));
-          const isLoading = this.isItAValidLoading(loading, variables, networkStatus);
-          return children({
-            id,
-            inspect: getOr(null, 'source.NetworkDns.inspect', data),
-            isInspected,
-            loading: isLoading,
-            loadPage: this.wrappedLoadMore,
-            networkDns,
-            pageInfo: getOr({}, 'source.NetworkDns.pageInfo', data),
-            refetch: this.memoizedRefetchQuery(variables, limit, refetch),
-            totalCount: getOr(-1, 'source.NetworkDns.totalCount', data),
-            histogram: getOr(null, 'source.NetworkDns.histogram', data),
           });
-        }}
-      </Query>
-    );
-  }
-}
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
 
-const makeMapStateToProps = () => {
-  const getNetworkDnsSelector = networkSelectors.dnsSelector();
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  const mapStateToProps = (state: State, { id = ID }: OwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      ...getNetworkDnsSelector(state),
-      isInspected,
-      id,
-    };
-  };
-
-  return mapStateToProps;
-};
+  useEffect(() => {
+    if (skip) {
+      return;
+    }
 
-const makeMapHistogramStateToProps = () => {
-  const getNetworkDnsSelector = networkSelectors.dnsSelector();
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  const mapStateToProps = (state: State, { id = HISTOGRAM_ID }: DnsHistogramOwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      ...getNetworkDnsSelector(state),
-      activePage: DEFAULT_TABLE_ACTIVE_PAGE,
-      limit: DEFAULT_TABLE_LIMIT,
-      isInspected,
-      id,
-    };
-  };
-
-  return mapStateToProps;
-};
+    setNetworkDnsRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        isPtrIncluded,
+        filterQuery: createFilter(filterQuery),
+        pagination: generateTablePaginationOptions(activePage, limit),
+        sort,
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [activePage, defaultIndex, endDate, filterQuery, limit, startDate, sort, skip, isPtrIncluded]);
 
-export const NetworkDnsQuery = compose<React.ComponentClass<OwnProps>>(
-  connect(makeMapStateToProps),
-  withKibana
-)(NetworkDnsComponentQuery);
+  useEffect(() => {
+    networkDnsSearch(networkDnsRequest);
+  }, [networkDnsRequest, networkDnsSearch]);
 
-export const NetworkDnsHistogramQuery = compose<React.ComponentClass<DnsHistogramOwnProps>>(
-  connect(makeMapHistogramStateToProps),
-  withKibana
-)(MatrixHistogram);
+  return [loading, networkDnsResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/network/containers/network_dns/translations.ts b/x-pack/plugins/security_solution/public/network/containers/network_dns/translations.ts
new file mode 100644
index 00000000000000..54c36dd1536f14
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/network_dns/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_DNS = i18n.translate(
+  'xpack.securitySolution.networkDns.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on network dns search`,
+  }
+);
+
+export const FAIL_NETWORK_DNS = i18n.translate(
+  'xpack.securitySolution.networkDns.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on network dns`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/containers/network_http/index.tsx b/x-pack/plugins/security_solution/public/network/containers/network_http/index.tsx
index 60845d452d69e4..d3e8067d1802e7 100644
--- a/x-pack/plugins/security_solution/public/network/containers/network_http/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/containers/network_http/index.tsx
@@ -4,38 +4,37 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { connect } from 'react-redux';
-import { compose } from 'redux';
+import { noop } from 'lodash/fp';
+import { useState, useEffect, useCallback, useRef } from 'react';
+import { shallowEqual, useSelector } from 'react-redux';
+import deepEqual from 'fast-deep-equal';
 
+import { ESTermQuery } from '../../../../common/typed_json';
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import {
-  GetNetworkHttpQuery,
-  NetworkHttpEdges,
-  NetworkHttpSortField,
-  PageInfoPaginated,
-} from '../../../graphql/types';
-import { inputsModel, inputsSelectors, State } from '../../../common/store';
-import { withKibana, WithKibanaProps } from '../../../common/lib/kibana';
+import { inputsModel, State } from '../../../common/store';
+import { useKibana } from '../../../common/lib/kibana';
+import { createFilter } from '../../../common/containers/helpers';
+import { NetworkHttpEdges, PageInfoPaginated } from '../../../graphql/types';
 import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
-import {
-  QueryTemplatePaginated,
-  QueryTemplatePaginatedProps,
-} from '../../../common/containers/query_template_paginated';
 import { networkModel, networkSelectors } from '../../store';
-import { networkHttpQuery } from './index.gql_query';
+import {
+  NetworkQueries,
+  NetworkHttpRequestOptions,
+  NetworkHttpStrategyResponse,
+  SortField,
+} from '../../../../common/search_strategy';
+import { AbortError } from '../../../../../../../src/plugins/data/common';
+import * as i18n from './translations';
+import { InspectResponse } from '../../../types';
+import { getInspectResponse } from '../../../helpers';
 
 const ID = 'networkHttpQuery';
 
 export interface NetworkHttpArgs {
   id: string;
   ip?: string;
-  inspect: inputsModel.InspectQuery;
+  inspect: InspectResponse;
   isInspected: boolean;
-  loading: boolean;
   loadPage: (newActivePage: number) => void;
   networkHttp: NetworkHttpEdges[];
   pageInfo: PageInfoPaginated;
@@ -43,118 +42,161 @@ export interface NetworkHttpArgs {
   totalCount: number;
 }
 
-export interface OwnProps extends QueryTemplatePaginatedProps {
-  children: (args: NetworkHttpArgs) => React.ReactNode;
+interface UseNetworkHttp {
+  id?: string;
   ip?: string;
   type: networkModel.NetworkType;
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  startDate: string;
+  skip: boolean;
 }
 
-export interface NetworkHttpComponentReduxProps {
-  activePage: number;
-  isInspected: boolean;
-  limit: number;
-  sort: NetworkHttpSortField;
-}
+export const useNetworkHttp = ({
+  endDate,
+  filterQuery,
+  id = ID,
+  ip,
+  skip,
+  startDate,
+  type,
+}: UseNetworkHttp): [boolean, NetworkHttpArgs] => {
+  const getHttpSelector = networkSelectors.httpSelector();
+  const { activePage, limit, sort } = useSelector(
+    (state: State) => getHttpSelector(state, type),
+    shallowEqual
+  );
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+
+  const [networkHttpRequest, setHostRequest] = useState<NetworkHttpRequestOptions>({
+    defaultIndex,
+    factoryQueryType: NetworkQueries.http,
+    filterQuery: createFilter(filterQuery),
+    ip,
+    pagination: generateTablePaginationOptions(activePage, limit),
+    sort: sort as SortField,
+    timerange: {
+      interval: '12h',
+      from: startDate ? startDate : '',
+      to: endDate ? endDate : new Date(Date.now()).toISOString(),
+    },
+  });
+
+  const wrappedLoadMore = useCallback(
+    (newActivePage: number) => {
+      setHostRequest((prevRequest) => {
+        return {
+          ...prevRequest,
+          pagination: generateTablePaginationOptions(newActivePage, limit),
+        };
+      });
+    },
+    [limit]
+  );
 
-type NetworkHttpProps = OwnProps & NetworkHttpComponentReduxProps & WithKibanaProps;
+  const [networkHttpResponse, setNetworkHttpResponse] = useState<NetworkHttpArgs>({
+    networkHttp: [],
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    loadPage: wrappedLoadMore,
+    pageInfo: {
+      activePage: 0,
+      fakeTotalCount: 0,
+      showMorePagesIndicator: false,
+    },
+    refetch: refetch.current,
+    totalCount: -1,
+  });
 
-class NetworkHttpComponentQuery extends QueryTemplatePaginated<
-  NetworkHttpProps,
-  GetNetworkHttpQuery.Query,
-  GetNetworkHttpQuery.Variables
-> {
-  public render() {
-    const {
-      activePage,
-      children,
-      endDate,
-      filterQuery,
-      id = ID,
-      ip,
-      isInspected,
-      kibana,
-      limit,
-      skip,
-      sourceId,
-      sort,
-      startDate,
-    } = this.props;
-    const variables: GetNetworkHttpQuery.Variables = {
-      defaultIndex: kibana.services.uiSettings.get<string[]>(DEFAULT_INDEX_KEY),
-      filterQuery: createFilter(filterQuery),
-      inspect: isInspected,
-      ip,
-      pagination: generateTablePaginationOptions(activePage, limit),
-      sort,
-      sourceId,
-      timerange: {
-        interval: '12h',
-        from: startDate!,
-        to: endDate!,
-      },
-    };
-    return (
-      <Query<GetNetworkHttpQuery.Query, GetNetworkHttpQuery.Variables>
-        fetchPolicy={getDefaultFetchPolicy()}
-        notifyOnNetworkStatusChange
-        query={networkHttpQuery}
-        skip={skip}
-        variables={variables}
-      >
-        {({ data, loading, fetchMore, networkStatus, refetch }) => {
-          const networkHttp = getOr([], `source.NetworkHttp.edges`, data);
-          this.setFetchMore(fetchMore);
-          this.setFetchMoreOptions((newActivePage: number) => ({
-            variables: {
-              pagination: generateTablePaginationOptions(newActivePage, limit),
+  const networkHttpSearch = useCallback(
+    (request: NetworkHttpRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<NetworkHttpRequestOptions, NetworkHttpStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkHttpResponse((prevResponse) => ({
+                    ...prevResponse,
+                    networkHttp: response.edges,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    pageInfo: response.pageInfo,
+                    refetch: refetch.current,
+                    totalCount: response.totalCount,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_HTTP);
+                searchSubscription$.unsubscribe();
+              }
             },
-            updateQuery: (prev, { fetchMoreResult }) => {
-              if (!fetchMoreResult) {
-                return prev;
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_NETWORK_HTTP,
+                  text: msg.message,
+                });
               }
-              return {
-                ...fetchMoreResult,
-                source: {
-                  ...fetchMoreResult.source,
-                  NetworkHttp: {
-                    ...fetchMoreResult.source.NetworkHttp,
-                    edges: [...fetchMoreResult.source.NetworkHttp.edges],
-                  },
-                },
-              };
             },
-          }));
-          const isLoading = this.isItAValidLoading(loading, variables, networkStatus);
-          return children({
-            id,
-            inspect: getOr(null, 'source.NetworkHttp.inspect', data),
-            isInspected,
-            loading: isLoading,
-            loadPage: this.wrappedLoadMore,
-            networkHttp,
-            pageInfo: getOr({}, 'source.NetworkHttp.pageInfo', data),
-            refetch: this.memoizedRefetchQuery(variables, limit, refetch),
-            totalCount: getOr(-1, 'source.NetworkHttp.totalCount', data),
           });
-        }}
-      </Query>
-    );
-  }
-}
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
 
-const makeMapStateToProps = () => {
-  const getHttpSelector = networkSelectors.httpSelector();
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  return (state: State, { id = ID, type }: OwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      ...getHttpSelector(state, type),
-      isInspected,
-    };
-  };
-};
+  useEffect(() => {
+    setHostRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
+        pagination: generateTablePaginationOptions(activePage, limit),
+        sort: sort as SortField,
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [activePage, defaultIndex, endDate, filterQuery, limit, startDate, sort, skip]);
+
+  useEffect(() => {
+    networkHttpSearch(networkHttpRequest);
+  }, [networkHttpRequest, networkHttpSearch]);
 
-export const NetworkHttpQuery = compose<React.ComponentClass<OwnProps>>(
-  connect(makeMapStateToProps),
-  withKibana
-)(NetworkHttpComponentQuery);
+  return [loading, networkHttpResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/network/containers/network_http/translations.ts b/x-pack/plugins/security_solution/public/network/containers/network_http/translations.ts
new file mode 100644
index 00000000000000..7909a5e48b8c4e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/network_http/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_HTTP = i18n.translate(
+  'xpack.securitySolution.networkHttp.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on network http search`,
+  }
+);
+
+export const FAIL_NETWORK_HTTP = i18n.translate(
+  'xpack.securitySolution.networkHttp.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on network http`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/containers/network_top_countries/index.tsx b/x-pack/plugins/security_solution/public/network/containers/network_top_countries/index.tsx
index b167cba460818f..747f5e4f502dd8 100644
--- a/x-pack/plugins/security_solution/public/network/containers/network_top_countries/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/containers/network_top_countries/index.tsx
@@ -4,161 +4,198 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { connect } from 'react-redux';
-import { compose } from 'redux';
+import { noop } from 'lodash/fp';
+import { useState, useEffect, useCallback, useRef } from 'react';
+import { shallowEqual, useSelector } from 'react-redux';
+import deepEqual from 'fast-deep-equal';
 
+import { ESTermQuery } from '../../../../common/typed_json';
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
+import { inputsModel, State } from '../../../common/store';
+import { useKibana } from '../../../common/lib/kibana';
+import { createFilter } from '../../../common/containers/helpers';
+import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
+import { networkModel, networkSelectors } from '../../store';
 import {
   FlowTargetSourceDest,
-  GetNetworkTopCountriesQuery,
+  NetworkQueries,
   NetworkTopCountriesEdges,
-  NetworkTopTablesSortField,
+  NetworkTopCountriesRequestOptions,
+  NetworkTopCountriesStrategyResponse,
   PageInfoPaginated,
-} from '../../../graphql/types';
-import { inputsModel, inputsSelectors, State } from '../../../common/store';
-import { withKibana, WithKibanaProps } from '../../../common/lib/kibana';
-import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
-import {
-  QueryTemplatePaginated,
-  QueryTemplatePaginatedProps,
-} from '../../../common/containers/query_template_paginated';
-import { networkTopCountriesQuery } from './index.gql_query';
-import { networkModel, networkSelectors } from '../../store';
+} from '../../../../common/search_strategy';
+import { AbortError } from '../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../helpers';
+import { InspectResponse } from '../../../types';
+import * as i18n from './translations';
 
 const ID = 'networkTopCountriesQuery';
 
 export interface NetworkTopCountriesArgs {
   id: string;
-  ip?: string;
-  inspect: inputsModel.InspectQuery;
+  inspect: InspectResponse;
   isInspected: boolean;
-  loading: boolean;
   loadPage: (newActivePage: number) => void;
-  networkTopCountries: NetworkTopCountriesEdges[];
   pageInfo: PageInfoPaginated;
   refetch: inputsModel.Refetch;
+  networkTopCountries: NetworkTopCountriesEdges[];
   totalCount: number;
 }
 
-export interface OwnProps extends QueryTemplatePaginatedProps {
-  children: (args: NetworkTopCountriesArgs) => React.ReactNode;
+interface UseNetworkTopCountries {
   flowTarget: FlowTargetSourceDest;
   ip?: string;
   type: networkModel.NetworkType;
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  startDate: string;
+  skip: boolean;
 }
 
-export interface NetworkTopCountriesComponentReduxProps {
-  activePage: number;
-  isInspected: boolean;
-  limit: number;
-  sort: NetworkTopTablesSortField;
-}
+export const useNetworkTopCountries = ({
+  endDate,
+  filterQuery,
+  flowTarget,
+  skip,
+  startDate,
+  type,
+}: UseNetworkTopCountries): [boolean, NetworkTopCountriesArgs] => {
+  const getTopCountriesSelector = networkSelectors.topCountriesSelector();
+  const { activePage, limit, sort } = useSelector(
+    (state: State) => getTopCountriesSelector(state, type, flowTarget),
+    shallowEqual
+  );
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+
+  const [networkTopCountriesRequest, setHostRequest] = useState<NetworkTopCountriesRequestOptions>({
+    defaultIndex,
+    factoryQueryType: NetworkQueries.topCountries,
+    filterQuery: createFilter(filterQuery),
+    flowTarget,
+    pagination: generateTablePaginationOptions(activePage, limit),
+    sort,
+    timerange: {
+      interval: '12h',
+      from: startDate ? startDate : '',
+      to: endDate ? endDate : new Date(Date.now()).toISOString(),
+    },
+  });
+
+  const wrappedLoadMore = useCallback(
+    (newActivePage: number) => {
+      setHostRequest((prevRequest) => ({
+        ...prevRequest,
+        pagination: generateTablePaginationOptions(newActivePage, limit),
+      }));
+    },
+    [limit]
+  );
 
-type NetworkTopCountriesProps = OwnProps & NetworkTopCountriesComponentReduxProps & WithKibanaProps;
+  const [networkTopCountriesResponse, setNetworkTopCountriesResponse] = useState<
+    NetworkTopCountriesArgs
+  >({
+    networkTopCountries: [],
+    id: `${ID}-${flowTarget}`,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    loadPage: wrappedLoadMore,
+    pageInfo: {
+      activePage: 0,
+      fakeTotalCount: 0,
+      showMorePagesIndicator: false,
+    },
+    refetch: refetch.current,
+    totalCount: -1,
+  });
 
-class NetworkTopCountriesComponentQuery extends QueryTemplatePaginated<
-  NetworkTopCountriesProps,
-  GetNetworkTopCountriesQuery.Query,
-  GetNetworkTopCountriesQuery.Variables
-> {
-  public render() {
-    const {
-      activePage,
-      children,
-      endDate,
-      flowTarget,
-      filterQuery,
-      kibana,
-      id = `${ID}-${flowTarget}`,
-      ip,
-      isInspected,
-      limit,
-      skip,
-      sourceId,
-      startDate,
-      sort,
-    } = this.props;
-    const variables: GetNetworkTopCountriesQuery.Variables = {
-      defaultIndex: kibana.services.uiSettings.get<string[]>(DEFAULT_INDEX_KEY),
-      filterQuery: createFilter(filterQuery),
-      flowTarget,
-      inspect: isInspected,
-      ip,
-      pagination: generateTablePaginationOptions(activePage, limit),
-      sort,
-      sourceId,
-      timerange: {
-        interval: '12h',
-        from: startDate!,
-        to: endDate!,
-      },
-    };
-    return (
-      <Query<GetNetworkTopCountriesQuery.Query, GetNetworkTopCountriesQuery.Variables>
-        fetchPolicy={getDefaultFetchPolicy()}
-        notifyOnNetworkStatusChange
-        query={networkTopCountriesQuery}
-        skip={skip}
-        variables={variables}
-      >
-        {({ data, loading, fetchMore, networkStatus, refetch }) => {
-          const networkTopCountries = getOr([], `source.NetworkTopCountries.edges`, data);
-          this.setFetchMore(fetchMore);
-          this.setFetchMoreOptions((newActivePage: number) => ({
-            variables: {
-              pagination: generateTablePaginationOptions(newActivePage, limit),
+  const networkTopCountriesSearch = useCallback(
+    (request: NetworkTopCountriesRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<NetworkTopCountriesRequestOptions, NetworkTopCountriesStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkTopCountriesResponse((prevResponse) => ({
+                    ...prevResponse,
+                    networkTopCountries: response.edges,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    pageInfo: response.pageInfo,
+                    refetch: refetch.current,
+                    totalCount: response.totalCount,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_TOP_COUNTRIES);
+                searchSubscription$.unsubscribe();
+              }
             },
-            updateQuery: (prev, { fetchMoreResult }) => {
-              if (!fetchMoreResult) {
-                return prev;
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_NETWORK_TOP_COUNTRIES,
+                  text: msg.message,
+                });
               }
-              return {
-                ...fetchMoreResult,
-                source: {
-                  ...fetchMoreResult.source,
-                  NetworkTopCountries: {
-                    ...fetchMoreResult.source.NetworkTopCountries,
-                    edges: [...fetchMoreResult.source.NetworkTopCountries.edges],
-                  },
-                },
-              };
             },
-          }));
-          const isLoading = this.isItAValidLoading(loading, variables, networkStatus);
-          return children({
-            id,
-            inspect: getOr(null, 'source.NetworkTopCountries.inspect', data),
-            isInspected,
-            loading: isLoading,
-            loadPage: this.wrappedLoadMore,
-            networkTopCountries,
-            pageInfo: getOr({}, 'source.NetworkTopCountries.pageInfo', data),
-            refetch: this.memoizedRefetchQuery(variables, limit, refetch),
-            totalCount: getOr(-1, 'source.NetworkTopCountries.totalCount', data),
           });
-        }}
-      </Query>
-    );
-  }
-}
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
 
-const makeMapStateToProps = () => {
-  const getTopCountriesSelector = networkSelectors.topCountriesSelector();
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  return (state: State, { flowTarget, id = `${ID}-${flowTarget}`, type }: OwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      ...getTopCountriesSelector(state, type, flowTarget),
-      isInspected,
-    };
-  };
-};
+  useEffect(() => {
+    setHostRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
+        pagination: generateTablePaginationOptions(activePage, limit),
+        sort,
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [activePage, defaultIndex, endDate, filterQuery, limit, startDate, sort, skip]);
 
-export const NetworkTopCountriesQuery = compose<React.ComponentClass<OwnProps>>(
-  connect(makeMapStateToProps),
-  withKibana
-)(NetworkTopCountriesComponentQuery);
+  useEffect(() => {
+    networkTopCountriesSearch(networkTopCountriesRequest);
+  }, [networkTopCountriesRequest, networkTopCountriesSearch]);
+
+  return [loading, networkTopCountriesResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/network/containers/network_top_countries/translations.ts b/x-pack/plugins/security_solution/public/network/containers/network_top_countries/translations.ts
new file mode 100644
index 00000000000000..ff807ee268adf0
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/network_top_countries/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_TOP_COUNTRIES = i18n.translate(
+  'xpack.securitySolution.networkTopCountries.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on network top countries search`,
+  }
+);
+
+export const FAIL_NETWORK_TOP_COUNTRIES = i18n.translate(
+  'xpack.securitySolution.networkTopCountries.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on network top countries`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/containers/network_top_n_flow/index.tsx b/x-pack/plugins/security_solution/public/network/containers/network_top_n_flow/index.tsx
index 770574b0813c1c..cc0da816c57eca 100644
--- a/x-pack/plugins/security_solution/public/network/containers/network_top_n_flow/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/containers/network_top_n_flow/index.tsx
@@ -4,161 +4,196 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { connect } from 'react-redux';
-import { compose } from 'redux';
+import { noop } from 'lodash/fp';
+import { useState, useEffect, useCallback, useRef } from 'react';
+import { shallowEqual, useSelector } from 'react-redux';
+import deepEqual from 'fast-deep-equal';
 
+import { ESTermQuery } from '../../../../common/typed_json';
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
+import { inputsModel, State } from '../../../common/store';
+import { useKibana } from '../../../common/lib/kibana';
+import { createFilter } from '../../../common/containers/helpers';
+import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
+import { networkModel, networkSelectors } from '../../store';
 import {
   FlowTargetSourceDest,
-  GetNetworkTopNFlowQuery,
+  NetworkQueries,
   NetworkTopNFlowEdges,
-  NetworkTopTablesSortField,
+  NetworkTopNFlowRequestOptions,
+  NetworkTopNFlowStrategyResponse,
   PageInfoPaginated,
-} from '../../../graphql/types';
-import { withKibana, WithKibanaProps } from '../../../common/lib/kibana';
-import { inputsModel, inputsSelectors, State } from '../../../common/store';
-import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
-import {
-  QueryTemplatePaginated,
-  QueryTemplatePaginatedProps,
-} from '../../../common/containers/query_template_paginated';
-import { networkTopNFlowQuery } from './index.gql_query';
-import { networkModel, networkSelectors } from '../../store';
+} from '../../../../common/search_strategy';
+import { AbortError } from '../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../helpers';
+import { InspectResponse } from '../../../types';
+import * as i18n from './translations';
 
 const ID = 'networkTopNFlowQuery';
 
 export interface NetworkTopNFlowArgs {
   id: string;
-  ip?: string;
-  inspect: inputsModel.InspectQuery;
+  inspect: InspectResponse;
   isInspected: boolean;
-  loading: boolean;
   loadPage: (newActivePage: number) => void;
-  networkTopNFlow: NetworkTopNFlowEdges[];
   pageInfo: PageInfoPaginated;
   refetch: inputsModel.Refetch;
+  networkTopNFlow: NetworkTopNFlowEdges[];
   totalCount: number;
 }
 
-export interface OwnProps extends QueryTemplatePaginatedProps {
-  children: (args: NetworkTopNFlowArgs) => React.ReactNode;
+interface UseNetworkTopNFlow {
   flowTarget: FlowTargetSourceDest;
   ip?: string;
   type: networkModel.NetworkType;
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  startDate: string;
+  skip: boolean;
 }
 
-export interface NetworkTopNFlowComponentReduxProps {
-  activePage: number;
-  isInspected: boolean;
-  limit: number;
-  sort: NetworkTopTablesSortField;
-}
+export const useNetworkTopNFlow = ({
+  endDate,
+  filterQuery,
+  flowTarget,
+  skip,
+  startDate,
+  type,
+}: UseNetworkTopNFlow): [boolean, NetworkTopNFlowArgs] => {
+  const getTopNFlowSelector = networkSelectors.topNFlowSelector();
+  const { activePage, limit, sort } = useSelector(
+    (state: State) => getTopNFlowSelector(state, type, flowTarget),
+    shallowEqual
+  );
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+
+  const [networkTopNFlowRequest, setTopNFlowRequest] = useState<NetworkTopNFlowRequestOptions>({
+    defaultIndex,
+    factoryQueryType: NetworkQueries.topNFlow,
+    filterQuery: createFilter(filterQuery),
+    flowTarget,
+    pagination: generateTablePaginationOptions(activePage, limit),
+    sort,
+    timerange: {
+      interval: '12h',
+      from: startDate ? startDate : '',
+      to: endDate ? endDate : new Date(Date.now()).toISOString(),
+    },
+  });
+
+  const wrappedLoadMore = useCallback(
+    (newActivePage: number) => {
+      setTopNFlowRequest((prevRequest) => ({
+        ...prevRequest,
+        pagination: generateTablePaginationOptions(newActivePage, limit),
+      }));
+    },
+    [limit]
+  );
 
-type NetworkTopNFlowProps = OwnProps & NetworkTopNFlowComponentReduxProps & WithKibanaProps;
+  const [networkTopNFlowResponse, setNetworkTopNFlowResponse] = useState<NetworkTopNFlowArgs>({
+    networkTopNFlow: [],
+    id: `${ID}-${flowTarget}`,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    loadPage: wrappedLoadMore,
+    pageInfo: {
+      activePage: 0,
+      fakeTotalCount: 0,
+      showMorePagesIndicator: false,
+    },
+    refetch: refetch.current,
+    totalCount: -1,
+  });
 
-class NetworkTopNFlowComponentQuery extends QueryTemplatePaginated<
-  NetworkTopNFlowProps,
-  GetNetworkTopNFlowQuery.Query,
-  GetNetworkTopNFlowQuery.Variables
-> {
-  public render() {
-    const {
-      activePage,
-      children,
-      endDate,
-      flowTarget,
-      filterQuery,
-      kibana,
-      id = `${ID}-${flowTarget}`,
-      ip,
-      isInspected,
-      limit,
-      skip,
-      sourceId,
-      startDate,
-      sort,
-    } = this.props;
-    const variables: GetNetworkTopNFlowQuery.Variables = {
-      defaultIndex: kibana.services.uiSettings.get<string[]>(DEFAULT_INDEX_KEY),
-      filterQuery: createFilter(filterQuery),
-      flowTarget,
-      inspect: isInspected,
-      ip,
-      pagination: generateTablePaginationOptions(activePage, limit),
-      sort,
-      sourceId,
-      timerange: {
-        interval: '12h',
-        from: startDate!,
-        to: endDate!,
-      },
-    };
-    return (
-      <Query<GetNetworkTopNFlowQuery.Query, GetNetworkTopNFlowQuery.Variables>
-        fetchPolicy={getDefaultFetchPolicy()}
-        notifyOnNetworkStatusChange
-        query={networkTopNFlowQuery}
-        skip={skip}
-        variables={variables}
-      >
-        {({ data, loading, fetchMore, networkStatus, refetch }) => {
-          const networkTopNFlow = getOr([], `source.NetworkTopNFlow.edges`, data);
-          this.setFetchMore(fetchMore);
-          this.setFetchMoreOptions((newActivePage: number) => ({
-            variables: {
-              pagination: generateTablePaginationOptions(newActivePage, limit),
+  const networkTopNFlowSearch = useCallback(
+    (request: NetworkTopNFlowRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<NetworkTopNFlowRequestOptions, NetworkTopNFlowStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkTopNFlowResponse((prevResponse) => ({
+                    ...prevResponse,
+                    networkTopNFlow: response.edges,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    pageInfo: response.pageInfo,
+                    refetch: refetch.current,
+                    totalCount: response.totalCount,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_TOP_N_FLOW);
+                searchSubscription$.unsubscribe();
+              }
             },
-            updateQuery: (prev, { fetchMoreResult }) => {
-              if (!fetchMoreResult) {
-                return prev;
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_NETWORK_TOP_N_FLOW,
+                  text: msg.message,
+                });
               }
-              return {
-                ...fetchMoreResult,
-                source: {
-                  ...fetchMoreResult.source,
-                  NetworkTopNFlow: {
-                    ...fetchMoreResult.source.NetworkTopNFlow,
-                    edges: [...fetchMoreResult.source.NetworkTopNFlow.edges],
-                  },
-                },
-              };
             },
-          }));
-          const isLoading = this.isItAValidLoading(loading, variables, networkStatus);
-          return children({
-            id,
-            inspect: getOr(null, 'source.NetworkTopNFlow.inspect', data),
-            isInspected,
-            loading: isLoading,
-            loadPage: this.wrappedLoadMore,
-            networkTopNFlow,
-            pageInfo: getOr({}, 'source.NetworkTopNFlow.pageInfo', data),
-            refetch: this.memoizedRefetchQuery(variables, limit, refetch),
-            totalCount: getOr(-1, 'source.NetworkTopNFlow.totalCount', data),
           });
-        }}
-      </Query>
-    );
-  }
-}
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
 
-const makeMapStateToProps = () => {
-  const getTopNFlowSelector = networkSelectors.topNFlowSelector();
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  return (state: State, { flowTarget, id = `${ID}-${flowTarget}`, type }: OwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      ...getTopNFlowSelector(state, type, flowTarget),
-      isInspected,
-    };
-  };
-};
+  useEffect(() => {
+    setTopNFlowRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
+        pagination: generateTablePaginationOptions(activePage, limit),
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+        sort,
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [activePage, defaultIndex, endDate, filterQuery, limit, startDate, sort, skip]);
 
-export const NetworkTopNFlowQuery = compose<React.ComponentClass<OwnProps>>(
-  connect(makeMapStateToProps),
-  withKibana
-)(NetworkTopNFlowComponentQuery);
+  useEffect(() => {
+    networkTopNFlowSearch(networkTopNFlowRequest);
+  }, [networkTopNFlowRequest, networkTopNFlowSearch]);
+
+  return [loading, networkTopNFlowResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/network/containers/network_top_n_flow/translations.ts b/x-pack/plugins/security_solution/public/network/containers/network_top_n_flow/translations.ts
new file mode 100644
index 00000000000000..4ea704571cf2e0
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/network_top_n_flow/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_TOP_N_FLOW = i18n.translate(
+  'xpack.securitySolution.networkTopNFlow.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on network top n flow search`,
+  }
+);
+
+export const FAIL_NETWORK_TOP_N_FLOW = i18n.translate(
+  'xpack.securitySolution.networkTopNFlow.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on network top n flow`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/containers/tls/index.tsx b/x-pack/plugins/security_solution/public/network/containers/tls/index.tsx
index 17506f9a01cb92..df02acf208603e 100644
--- a/x-pack/plugins/security_solution/public/network/containers/tls/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/containers/tls/index.tsx
@@ -4,38 +4,35 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { connect } from 'react-redux';
-import { compose } from 'redux';
+import { noop } from 'lodash/fp';
+import { useState, useEffect, useCallback, useRef } from 'react';
+import { shallowEqual, useSelector } from 'react-redux';
+import deepEqual from 'fast-deep-equal';
 
+import { ESTermQuery } from '../../../../common/typed_json';
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import {
-  PageInfoPaginated,
-  TlsEdges,
-  TlsSortField,
-  GetTlsQuery,
-  FlowTargetSourceDest,
-} from '../../../graphql/types';
-import { inputsModel, State, inputsSelectors } from '../../../common/store';
-import { withKibana, WithKibanaProps } from '../../../common/lib/kibana';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
+import { inputsModel, State } from '../../../common/store';
+import { useKibana } from '../../../common/lib/kibana';
+import { createFilter } from '../../../common/containers/helpers';
+import { TlsEdges, PageInfoPaginated, FlowTargetSourceDest } from '../../../graphql/types';
 import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
-import {
-  QueryTemplatePaginated,
-  QueryTemplatePaginatedProps,
-} from '../../../common/containers/query_template_paginated';
 import { networkModel, networkSelectors } from '../../store';
-import { tlsQuery } from './index.gql_query';
+import {
+  NetworkQueries,
+  NetworkTlsRequestOptions,
+  NetworkTlsStrategyResponse,
+} from '../../../../common/search_strategy/security_solution/network';
+import { AbortError } from '../../../../../../../src/plugins/data/common';
+
+import * as i18n from './translations';
+import { getInspectResponse } from '../../../helpers';
 
-const ID = 'tlsQuery';
+const ID = 'networkTlsQuery';
 
-export interface TlsArgs {
+export interface NetworkTlsArgs {
   id: string;
   inspect: inputsModel.InspectQuery;
   isInspected: boolean;
-  loading: boolean;
   loadPage: (newActivePage: number) => void;
   pageInfo: PageInfoPaginated;
   refetch: inputsModel.Refetch;
@@ -43,121 +40,159 @@ export interface TlsArgs {
   totalCount: number;
 }
 
-export interface OwnProps extends QueryTemplatePaginatedProps {
-  children: (args: TlsArgs) => React.ReactNode;
+interface UseNetworkTls {
   flowTarget: FlowTargetSourceDest;
   ip: string;
   type: networkModel.NetworkType;
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  startDate: string;
+  skip: boolean;
+  id?: string;
 }
 
-export interface TlsComponentReduxProps {
-  activePage: number;
-  isInspected: boolean;
-  limit: number;
-  sort: TlsSortField;
-}
+export const useNetworkTls = ({
+  endDate,
+  filterQuery,
+  flowTarget,
+  id = ID,
+  ip,
+  skip,
+  startDate,
+  type,
+}: UseNetworkTls): [boolean, NetworkTlsArgs] => {
+  const getTlsSelector = networkSelectors.tlsSelector();
+  const { activePage, limit, sort } = useSelector(
+    (state: State) => getTlsSelector(state, type, flowTarget),
+    shallowEqual
+  );
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+
+  const [networkTlsRequest, setHostRequest] = useState<NetworkTlsRequestOptions>({
+    defaultIndex,
+    factoryQueryType: NetworkQueries.tls,
+    filterQuery: createFilter(filterQuery),
+    flowTarget,
+    ip,
+    pagination: generateTablePaginationOptions(activePage, limit),
+    sort,
+    timerange: {
+      interval: '12h',
+      from: startDate ? startDate : '',
+      to: endDate ? endDate : new Date(Date.now()).toISOString(),
+    },
+  });
 
-type TlsProps = OwnProps & TlsComponentReduxProps & WithKibanaProps;
+  const wrappedLoadMore = useCallback(
+    (newActivePage: number) => {
+      setHostRequest((prevRequest) => ({
+        ...prevRequest,
+        pagination: generateTablePaginationOptions(newActivePage, limit),
+      }));
+    },
+    [limit]
+  );
 
-class TlsComponentQuery extends QueryTemplatePaginated<
-  TlsProps,
-  GetTlsQuery.Query,
-  GetTlsQuery.Variables
-> {
-  public render() {
-    const {
-      activePage,
-      children,
-      endDate,
-      filterQuery,
-      flowTarget,
-      id = ID,
-      ip,
-      isInspected,
-      kibana,
-      limit,
-      skip,
-      sourceId,
-      startDate,
-      sort,
-    } = this.props;
-    const variables: GetTlsQuery.Variables = {
-      defaultIndex: kibana.services.uiSettings.get<string[]>(DEFAULT_INDEX_KEY),
-      filterQuery: createFilter(filterQuery),
-      flowTarget,
-      inspect: isInspected,
-      ip,
-      pagination: generateTablePaginationOptions(activePage, limit),
-      sort,
-      sourceId,
-      timerange: {
-        interval: '12h',
-        from: startDate ? startDate : '',
-        to: endDate ? endDate : new Date(Date.now()).toISOString(),
-      },
-    };
-    return (
-      <Query<GetTlsQuery.Query, GetTlsQuery.Variables>
-        query={tlsQuery}
-        fetchPolicy={getDefaultFetchPolicy()}
-        notifyOnNetworkStatusChange
-        skip={skip}
-        variables={variables}
-      >
-        {({ data, loading, fetchMore, networkStatus, refetch }) => {
-          const tls = getOr([], 'source.Tls.edges', data);
-          this.setFetchMore(fetchMore);
-          this.setFetchMoreOptions((newActivePage: number) => ({
-            variables: {
-              pagination: generateTablePaginationOptions(newActivePage, limit),
+  const [networkTlsResponse, setNetworkTlsResponse] = useState<NetworkTlsArgs>({
+    tls: [],
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    loadPage: wrappedLoadMore,
+    pageInfo: {
+      activePage: 0,
+      fakeTotalCount: 0,
+      showMorePagesIndicator: false,
+    },
+    refetch: refetch.current,
+    totalCount: -1,
+  });
+
+  const networkTlsSearch = useCallback(
+    (request: NetworkTlsRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<NetworkTlsRequestOptions, NetworkTlsStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkTlsResponse((prevResponse) => ({
+                    ...prevResponse,
+                    tls: response.edges,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    pageInfo: response.pageInfo,
+                    refetch: refetch.current,
+                    totalCount: response.totalCount,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_TLS);
+                searchSubscription$.unsubscribe();
+              }
             },
-            updateQuery: (prev, { fetchMoreResult }) => {
-              if (!fetchMoreResult) {
-                return prev;
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({ title: i18n.FAIL_NETWORK_TLS, text: msg.message });
               }
-              return {
-                ...fetchMoreResult,
-                source: {
-                  ...fetchMoreResult.source,
-                  Tls: {
-                    ...fetchMoreResult.source.Tls,
-                    edges: [...fetchMoreResult.source.Tls.edges],
-                  },
-                },
-              };
             },
-          }));
-          const isLoading = this.isItAValidLoading(loading, variables, networkStatus);
-          return children({
-            id,
-            inspect: getOr(null, 'source.Tls.inspect', data),
-            isInspected,
-            loading: isLoading,
-            loadPage: this.wrappedLoadMore,
-            pageInfo: getOr({}, 'source.Tls.pageInfo', data),
-            refetch: this.memoizedRefetchQuery(variables, limit, refetch),
-            tls,
-            totalCount: getOr(-1, 'source.Tls.totalCount', data),
           });
-        }}
-      </Query>
-    );
-  }
-}
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
 
-const makeMapStateToProps = () => {
-  const getTlsSelector = networkSelectors.tlsSelector();
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  return (state: State, { flowTarget, id = ID, type }: OwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      ...getTlsSelector(state, type, flowTarget),
-      isInspected,
-    };
-  };
-};
+  useEffect(() => {
+    setHostRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
+        pagination: generateTablePaginationOptions(activePage, limit),
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+        sort,
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [activePage, defaultIndex, endDate, filterQuery, limit, startDate, sort, skip]);
 
-export const TlsQuery = compose<React.ComponentClass<OwnProps>>(
-  connect(makeMapStateToProps),
-  withKibana
-)(TlsComponentQuery);
+  useEffect(() => {
+    networkTlsSearch(networkTlsRequest);
+  }, [networkTlsRequest, networkTlsSearch]);
+
+  return [loading, networkTlsResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/network/containers/tls/translations.ts b/x-pack/plugins/security_solution/public/network/containers/tls/translations.ts
new file mode 100644
index 00000000000000..aafa3ff0a98b0a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/tls/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_TLS = i18n.translate(
+  'xpack.securitySolution.networkTls.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on network tls search`,
+  }
+);
+
+export const FAIL_NETWORK_TLS = i18n.translate(
+  'xpack.securitySolution.networkTls.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on network tls`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/pages/ip_details/network_http_query_table.tsx b/x-pack/plugins/security_solution/public/network/pages/ip_details/network_http_query_table.tsx
index 551de698cfa08d..1b1b2b5f4f46e2 100644
--- a/x-pack/plugins/security_solution/public/network/pages/ip_details/network_http_query_table.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/ip_details/network_http_query_table.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { getOr } from 'lodash/fp';
 import { manageQuery } from '../../../common/components/page/manage_query';
 import { OwnProps } from './types';
-import { NetworkHttpQuery } from '../../containers/network_http';
+import { useNetworkHttp } from '../../containers/network_http';
 import { NetworkHttpTable } from '../../components/network_http_table';
 
 const NetworkHttpTableManage = manageQuery(NetworkHttpTable);
@@ -21,43 +21,35 @@ export const NetworkHttpQueryTable = ({
   skip,
   startDate,
   type,
-}: OwnProps) => (
-  <NetworkHttpQuery
-    endDate={endDate}
-    filterQuery={filterQuery}
-    ip={ip}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={type}
-  >
-    {({
-      id,
-      inspect,
-      isInspected,
-      loading,
-      loadPage,
-      networkHttp,
-      pageInfo,
-      refetch,
-      totalCount,
-    }) => (
-      <NetworkHttpTableManage
-        data={networkHttp}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        id={id}
-        inspect={inspect}
-        isInspect={isInspected}
-        loading={loading}
-        loadPage={loadPage}
-        refetch={refetch}
-        setQuery={setQuery}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        totalCount={totalCount}
-        type={type}
-      />
-    )}
-  </NetworkHttpQuery>
-);
+}: OwnProps) => {
+  const [
+    loading,
+    { id, inspect, isInspected, loadPage, networkHttp, pageInfo, refetch, totalCount },
+  ] = useNetworkHttp({
+    endDate,
+    filterQuery,
+    ip,
+    skip,
+    startDate,
+    type,
+  });
+
+  return (
+    <NetworkHttpTableManage
+      data={networkHttp}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      id={id}
+      inspect={inspect}
+      isInspect={isInspected}
+      loading={loading}
+      loadPage={loadPage}
+      refetch={refetch}
+      setQuery={setQuery}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      totalCount={totalCount}
+      type={type}
+    />
+  );
+};
 
 NetworkHttpQueryTable.displayName = 'NetworkHttpQueryTable';
diff --git a/x-pack/plugins/security_solution/public/network/pages/ip_details/network_top_countries_query_table.tsx b/x-pack/plugins/security_solution/public/network/pages/ip_details/network_top_countries_query_table.tsx
index 6bc80ef1a6aae4..42ddd3a6bb4a43 100644
--- a/x-pack/plugins/security_solution/public/network/pages/ip_details/network_top_countries_query_table.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/ip_details/network_top_countries_query_table.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { getOr } from 'lodash/fp';
 import { manageQuery } from '../../../common/components/page/manage_query';
 import { NetworkWithIndexComponentsQueryTableProps } from './types';
-import { NetworkTopCountriesQuery } from '../../containers/network_top_countries';
+import { useNetworkTopCountries } from '../../containers/network_top_countries';
 import { NetworkTopCountriesTable } from '../../components/network_top_countries_table';
 
 const NetworkTopCountriesTableManage = manageQuery(NetworkTopCountriesTable);
@@ -23,46 +23,38 @@ export const NetworkTopCountriesQueryTable = ({
   startDate,
   type,
   indexPattern,
-}: NetworkWithIndexComponentsQueryTableProps) => (
-  <NetworkTopCountriesQuery
-    endDate={endDate}
-    flowTarget={flowTarget}
-    filterQuery={filterQuery}
-    ip={ip}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={type}
-  >
-    {({
-      id,
-      inspect,
-      isInspected,
-      loading,
-      loadPage,
-      networkTopCountries,
-      pageInfo,
-      refetch,
-      totalCount,
-    }) => (
-      <NetworkTopCountriesTableManage
-        data={networkTopCountries}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        flowTargeted={flowTarget}
-        id={id}
-        indexPattern={indexPattern}
-        inspect={inspect}
-        isInspect={isInspected}
-        loading={loading}
-        loadPage={loadPage}
-        refetch={refetch}
-        setQuery={setQuery}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        totalCount={totalCount}
-        type={type}
-      />
-    )}
-  </NetworkTopCountriesQuery>
-);
+}: NetworkWithIndexComponentsQueryTableProps) => {
+  const [
+    loading,
+    { id, inspect, isInspected, loadPage, networkTopCountries, pageInfo, refetch, totalCount },
+  ] = useNetworkTopCountries({
+    endDate,
+    flowTarget,
+    filterQuery,
+    ip,
+    skip,
+    startDate,
+    type,
+  });
+
+  return (
+    <NetworkTopCountriesTableManage
+      data={networkTopCountries}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      flowTargeted={flowTarget}
+      id={id}
+      indexPattern={indexPattern}
+      inspect={inspect}
+      isInspect={isInspected}
+      loading={loading}
+      loadPage={loadPage}
+      refetch={refetch}
+      setQuery={setQuery}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      totalCount={totalCount}
+      type={type}
+    />
+  );
+};
 
 NetworkTopCountriesQueryTable.displayName = 'NetworkTopCountriesQueryTable';
diff --git a/x-pack/plugins/security_solution/public/network/pages/ip_details/network_top_n_flow_query_table.tsx b/x-pack/plugins/security_solution/public/network/pages/ip_details/network_top_n_flow_query_table.tsx
index 158b4057a7d5e3..821452201b78b0 100644
--- a/x-pack/plugins/security_solution/public/network/pages/ip_details/network_top_n_flow_query_table.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/ip_details/network_top_n_flow_query_table.tsx
@@ -8,7 +8,7 @@ import { getOr } from 'lodash/fp';
 import React from 'react';
 import { manageQuery } from '../../../common/components/page/manage_query';
 import { NetworkTopNFlowTable } from '../../components/network_top_n_flow_table';
-import { NetworkTopNFlowQuery } from '../../containers/network_top_n_flow';
+import { useNetworkTopNFlow } from '../../containers/network_top_n_flow';
 import { NetworkWithIndexComponentsQueryTableProps } from './types';
 
 const NetworkTopNFlowTableManage = manageQuery(NetworkTopNFlowTable);
@@ -22,45 +22,37 @@ export const NetworkTopNFlowQueryTable = ({
   skip,
   startDate,
   type,
-}: NetworkWithIndexComponentsQueryTableProps) => (
-  <NetworkTopNFlowQuery
-    endDate={endDate}
-    filterQuery={filterQuery}
-    flowTarget={flowTarget}
-    ip={ip}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={type}
-  >
-    {({
-      id,
-      inspect,
-      isInspected,
-      loading,
-      loadPage,
-      networkTopNFlow,
-      pageInfo,
-      refetch,
-      totalCount,
-    }) => (
-      <NetworkTopNFlowTableManage
-        data={networkTopNFlow}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        flowTargeted={flowTarget}
-        id={id}
-        inspect={inspect}
-        isInspect={isInspected}
-        loading={loading}
-        loadPage={loadPage}
-        refetch={refetch}
-        setQuery={setQuery}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        totalCount={totalCount}
-        type={type}
-      />
-    )}
-  </NetworkTopNFlowQuery>
-);
+}: NetworkWithIndexComponentsQueryTableProps) => {
+  const [
+    loading,
+    { id, inspect, isInspected, loadPage, networkTopNFlow, pageInfo, refetch, totalCount },
+  ] = useNetworkTopNFlow({
+    endDate,
+    filterQuery,
+    flowTarget,
+    ip,
+    skip,
+    startDate,
+    type,
+  });
+
+  return (
+    <NetworkTopNFlowTableManage
+      data={networkTopNFlow}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      flowTargeted={flowTarget}
+      id={id}
+      inspect={inspect}
+      isInspect={isInspected}
+      loading={loading}
+      loadPage={loadPage}
+      refetch={refetch}
+      setQuery={setQuery}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      totalCount={totalCount}
+      type={type}
+    />
+  );
+};
 
 NetworkTopNFlowQueryTable.displayName = 'NetworkTopNFlowQueryTable';
diff --git a/x-pack/plugins/security_solution/public/network/pages/ip_details/tls_query_table.tsx b/x-pack/plugins/security_solution/public/network/pages/ip_details/tls_query_table.tsx
index f0c3628af78d85..5184fccecf07a5 100644
--- a/x-pack/plugins/security_solution/public/network/pages/ip_details/tls_query_table.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/ip_details/tls_query_table.tsx
@@ -8,7 +8,7 @@ import { getOr } from 'lodash/fp';
 import React from 'react';
 import { manageQuery } from '../../../common/components/page/manage_query';
 import { TlsTable } from '../../components/tls_table';
-import { TlsQuery } from '../../containers/tls';
+import { useNetworkTls } from '../../containers/tls';
 import { TlsQueryTableComponentProps } from './types';
 
 const TlsTableManage = manageQuery(TlsTable);
@@ -22,34 +22,36 @@ export const TlsQueryTable = ({
   skip,
   startDate,
   type,
-}: TlsQueryTableComponentProps) => (
-  <TlsQuery
-    endDate={endDate}
-    filterQuery={filterQuery}
-    flowTarget={flowTarget}
-    ip={ip}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={type}
-  >
-    {({ id, inspect, isInspected, tls, totalCount, pageInfo, loading, loadPage, refetch }) => (
-      <TlsTableManage
-        data={tls}
-        id={id}
-        inspect={inspect}
-        isInspect={isInspected}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        loading={loading}
-        loadPage={loadPage}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        refetch={refetch}
-        setQuery={setQuery}
-        totalCount={totalCount}
-        type={type}
-      />
-    )}
-  </TlsQuery>
-);
+}: TlsQueryTableComponentProps) => {
+  const [
+    loading,
+    { id, inspect, isInspected, tls, totalCount, pageInfo, loadPage, refetch },
+  ] = useNetworkTls({
+    endDate,
+    filterQuery,
+    flowTarget,
+    ip,
+    skip,
+    startDate,
+    type,
+  });
+
+  return (
+    <TlsTableManage
+      data={tls}
+      id={id}
+      inspect={inspect}
+      isInspect={isInspected}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      loading={loading}
+      loadPage={loadPage}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      refetch={refetch}
+      setQuery={setQuery}
+      totalCount={totalCount}
+      type={type}
+    />
+  );
+};
 
 TlsQueryTable.displayName = 'TlsQueryTable';
diff --git a/x-pack/plugins/security_solution/public/network/pages/ip_details/types.ts b/x-pack/plugins/security_solution/public/network/pages/ip_details/types.ts
index 9691214cc2820c..cab6e8e09b2003 100644
--- a/x-pack/plugins/security_solution/public/network/pages/ip_details/types.ts
+++ b/x-pack/plugins/security_solution/public/network/pages/ip_details/types.ts
@@ -8,7 +8,10 @@ import { IIndexPattern } from 'src/plugins/data/public';
 
 import { ESTermQuery } from '../../../../common/typed_json';
 import { NetworkType } from '../../store/model';
-import { FlowTarget, FlowTargetSourceDest } from '../../../graphql/types';
+import {
+  FlowTarget,
+  FlowTargetSourceDest,
+} from '../../../../common/search_strategy/security_solution';
 import { GlobalTimeArgs } from '../../../common/containers/use_global_time';
 
 export const type = NetworkType.details;
diff --git a/x-pack/plugins/security_solution/public/network/pages/navigation/countries_query_tab_body.tsx b/x-pack/plugins/security_solution/public/network/pages/navigation/countries_query_tab_body.tsx
index 0c569952458e47..1e57ca42257e78 100644
--- a/x-pack/plugins/security_solution/public/network/pages/navigation/countries_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/navigation/countries_query_tab_body.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { getOr } from 'lodash/fp';
 
 import { NetworkTopCountriesTable } from '../../components/network_top_countries_table';
-import { NetworkTopCountriesQuery } from '../../containers/network_top_countries';
+import { useNetworkTopCountries } from '../../containers/network_top_countries';
 import { networkModel } from '../../store';
 import { manageQuery } from '../../../common/components/page/manage_query';
 
@@ -24,45 +24,37 @@ export const CountriesQueryTabBody = ({
   setQuery,
   indexPattern,
   flowTarget,
-}: CountriesQueryTabBodyProps) => (
-  <NetworkTopCountriesQuery
-    endDate={endDate}
-    flowTarget={flowTarget}
-    filterQuery={filterQuery}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={networkModel.NetworkType.page}
-  >
-    {({
-      id,
-      inspect,
-      isInspected,
-      loading,
-      loadPage,
-      networkTopCountries,
-      pageInfo,
-      refetch,
-      totalCount,
-    }) => (
-      <NetworkTopCountriesTableManage
-        data={networkTopCountries}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        flowTargeted={flowTarget}
-        id={id}
-        indexPattern={indexPattern}
-        inspect={inspect}
-        isInspect={isInspected}
-        loading={loading}
-        loadPage={loadPage}
-        refetch={refetch}
-        setQuery={setQuery}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        totalCount={totalCount}
-        type={networkModel.NetworkType.page}
-      />
-    )}
-  </NetworkTopCountriesQuery>
-);
+}: CountriesQueryTabBodyProps) => {
+  const [
+    loading,
+    { id, inspect, isInspected, loadPage, networkTopCountries, pageInfo, refetch, totalCount },
+  ] = useNetworkTopCountries({
+    endDate,
+    flowTarget,
+    filterQuery,
+    skip,
+    startDate,
+    type: networkModel.NetworkType.page,
+  });
+
+  return (
+    <NetworkTopCountriesTableManage
+      data={networkTopCountries}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      flowTargeted={flowTarget}
+      id={id}
+      indexPattern={indexPattern}
+      inspect={inspect}
+      isInspect={isInspected}
+      loading={loading}
+      loadPage={loadPage}
+      refetch={refetch}
+      setQuery={setQuery}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      totalCount={totalCount}
+      type={networkModel.NetworkType.page}
+    />
+  );
+};
 
 CountriesQueryTabBody.displayName = 'CountriesQueryTabBody';
diff --git a/x-pack/plugins/security_solution/public/network/pages/navigation/dns_query_tab_body.tsx b/x-pack/plugins/security_solution/public/network/pages/navigation/dns_query_tab_body.tsx
index 77283dc330257b..5adb78edbec8e5 100644
--- a/x-pack/plugins/security_solution/public/network/pages/navigation/dns_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/navigation/dns_query_tab_body.tsx
@@ -8,19 +8,18 @@ import React, { useEffect, useCallback, useMemo } from 'react';
 import { getOr } from 'lodash/fp';
 
 import { NetworkDnsTable } from '../../components/network_dns_table';
-import { NetworkDnsQuery, HISTOGRAM_ID } from '../../containers/network_dns';
+import { useNetworkDns, HISTOGRAM_ID } from '../../containers/network_dns';
 import { manageQuery } from '../../../common/components/page/manage_query';
 
 import { NetworkComponentQueryProps } from './types';
-import { networkModel } from '../../store';
 
 import {
   MatrixHistogramOption,
-  MatrixHisrogramConfigs,
+  MatrixHistogramConfigs,
 } from '../../../common/components/matrix_histogram/types';
 import * as i18n from '../translations';
-import { MatrixHistogramContainer } from '../../../common/components/matrix_histogram';
-import { HistogramType } from '../../../graphql/types';
+import { MatrixHistogram } from '../../../common/components/matrix_histogram';
+import { MatrixHistogramType } from '../../../../common/search_strategy/security_solution';
 
 const NetworkDnsTableManage = manageQuery(NetworkDnsTable);
 
@@ -33,16 +32,16 @@ const dnsStackByOptions: MatrixHistogramOption[] = [
 
 const DEFAULT_STACK_BY = 'dns.question.registered_domain';
 
-export const histogramConfigs: Omit<MatrixHisrogramConfigs, 'title'> = {
+export const histogramConfigs: Omit<MatrixHistogramConfigs, 'title'> = {
   defaultStackByOption:
     dnsStackByOptions.find((o) => o.text === DEFAULT_STACK_BY) ?? dnsStackByOptions[0],
   errorMessage: i18n.ERROR_FETCHING_DNS_DATA,
-  histogramType: HistogramType.dns,
+  histogramType: MatrixHistogramType.dns,
   stackByOptions: dnsStackByOptions,
   subtitle: undefined,
 };
 
-export const DnsQueryTabBody = ({
+const DnsQueryTabBodyComponent: React.FC<NetworkComponentQueryProps> = ({
   deleteQuery,
   endDate,
   filterQuery,
@@ -50,7 +49,7 @@ export const DnsQueryTabBody = ({
   startDate,
   setQuery,
   type,
-}: NetworkComponentQueryProps) => {
+}) => {
   useEffect(() => {
     return () => {
       if (deleteQuery) {
@@ -59,12 +58,23 @@ export const DnsQueryTabBody = ({
     };
   }, [deleteQuery]);
 
+  const [
+    loading,
+    { totalCount, networkDns, pageInfo, loadPage, id, inspect, isInspected, refetch },
+  ] = useNetworkDns({
+    endDate,
+    filterQuery,
+    skip,
+    startDate,
+    type,
+  });
+
   const getTitle = useCallback(
     (option: MatrixHistogramOption) => i18n.DOMAINS_COUNT_BY(option.text),
     []
   );
 
-  const dnsHistogramConfigs: MatrixHisrogramConfigs = useMemo(
+  const dnsHistogramConfigs: MatrixHistogramConfigs = useMemo(
     () => ({
       ...histogramConfigs,
       title: getTitle,
@@ -74,54 +84,33 @@ export const DnsQueryTabBody = ({
 
   return (
     <>
-      <MatrixHistogramContainer
+      <MatrixHistogram
         endDate={endDate}
         filterQuery={filterQuery}
         id={HISTOGRAM_ID}
         setQuery={setQuery}
         showLegend={true}
-        sourceId="default"
         startDate={startDate}
-        type={networkModel.NetworkType.page}
         {...dnsHistogramConfigs}
       />
-      <NetworkDnsQuery
-        endDate={endDate}
-        filterQuery={filterQuery}
-        skip={skip}
-        sourceId="default"
-        startDate={startDate}
+      <NetworkDnsTableManage
+        data={networkDns}
+        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+        id={id}
+        inspect={inspect}
+        isInspect={isInspected}
+        loading={loading}
+        loadPage={loadPage}
+        refetch={refetch}
+        setQuery={setQuery}
+        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+        totalCount={totalCount}
         type={type}
-      >
-        {({
-          totalCount,
-          loading,
-          networkDns,
-          pageInfo,
-          loadPage,
-          id,
-          inspect,
-          isInspected,
-          refetch,
-        }) => (
-          <NetworkDnsTableManage
-            data={networkDns}
-            fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-            id={id}
-            inspect={inspect}
-            isInspect={isInspected}
-            loading={loading}
-            loadPage={loadPage}
-            refetch={refetch}
-            setQuery={setQuery}
-            showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-            totalCount={totalCount}
-            type={type}
-          />
-        )}
-      </NetworkDnsQuery>
+      />
     </>
   );
 };
 
-DnsQueryTabBody.displayName = 'DNSQueryTabBody';
+DnsQueryTabBodyComponent.displayName = 'DnsQueryTabBodyComponent';
+
+export const DnsQueryTabBody = React.memo(DnsQueryTabBodyComponent);
diff --git a/x-pack/plugins/security_solution/public/network/pages/navigation/http_query_tab_body.tsx b/x-pack/plugins/security_solution/public/network/pages/navigation/http_query_tab_body.tsx
index 7e0c4025d6cac1..3caff05734c1e4 100644
--- a/x-pack/plugins/security_solution/public/network/pages/navigation/http_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/navigation/http_query_tab_body.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { getOr } from 'lodash/fp';
 
 import { NetworkHttpTable } from '../../components/network_http_table';
-import { NetworkHttpQuery } from '../../containers/network_http';
+import { useNetworkHttp } from '../../containers/network_http';
 import { networkModel } from '../../store';
 import { manageQuery } from '../../../common/components/page/manage_query';
 
@@ -22,42 +22,34 @@ export const HttpQueryTabBody = ({
   skip,
   startDate,
   setQuery,
-}: HttpQueryTabBodyProps) => (
-  <NetworkHttpQuery
-    endDate={endDate}
-    filterQuery={filterQuery}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={networkModel.NetworkType.page}
-  >
-    {({
-      id,
-      inspect,
-      isInspected,
-      loading,
-      loadPage,
-      networkHttp,
-      pageInfo,
-      refetch,
-      totalCount,
-    }) => (
-      <NetworkHttpTableManage
-        data={networkHttp}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        id={id}
-        inspect={inspect}
-        isInspect={isInspected}
-        loading={loading}
-        loadPage={loadPage}
-        refetch={refetch}
-        setQuery={setQuery}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        totalCount={totalCount}
-        type={networkModel.NetworkType.page}
-      />
-    )}
-  </NetworkHttpQuery>
-);
+}: HttpQueryTabBodyProps) => {
+  const [
+    loading,
+    { id, inspect, isInspected, loadPage, networkHttp, pageInfo, refetch, totalCount },
+  ] = useNetworkHttp({
+    endDate,
+    filterQuery,
+    skip,
+    startDate,
+    type: networkModel.NetworkType.page,
+  });
+
+  return (
+    <NetworkHttpTableManage
+      data={networkHttp}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      id={id}
+      inspect={inspect}
+      isInspect={isInspected}
+      loading={loading}
+      loadPage={loadPage}
+      refetch={refetch}
+      setQuery={setQuery}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      totalCount={totalCount}
+      type={networkModel.NetworkType.page}
+    />
+  );
+};
 
 HttpQueryTabBody.displayName = 'HttpQueryTabBody';
diff --git a/x-pack/plugins/security_solution/public/network/pages/navigation/ips_query_tab_body.tsx b/x-pack/plugins/security_solution/public/network/pages/navigation/ips_query_tab_body.tsx
index a9f4d504847a07..c83bf6ff809012 100644
--- a/x-pack/plugins/security_solution/public/network/pages/navigation/ips_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/navigation/ips_query_tab_body.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { getOr } from 'lodash/fp';
 
 import { NetworkTopNFlowTable } from '../../components/network_top_n_flow_table';
-import { NetworkTopNFlowQuery } from '../../containers/network_top_n_flow';
+import { useNetworkTopNFlow } from '../../containers/network_top_n_flow';
 import { networkModel } from '../../store';
 import { manageQuery } from '../../../common/components/page/manage_query';
 
@@ -23,44 +23,36 @@ export const IPsQueryTabBody = ({
   startDate,
   setQuery,
   flowTarget,
-}: IPsQueryTabBodyProps) => (
-  <NetworkTopNFlowQuery
-    endDate={endDate}
-    flowTarget={flowTarget}
-    filterQuery={filterQuery}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={networkModel.NetworkType.page}
-  >
-    {({
-      id,
-      inspect,
-      isInspected,
-      loading,
-      loadPage,
-      networkTopNFlow,
-      pageInfo,
-      refetch,
-      totalCount,
-    }) => (
-      <NetworkTopNFlowTableManage
-        data={networkTopNFlow}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        flowTargeted={flowTarget}
-        id={id}
-        inspect={inspect}
-        isInspect={isInspected}
-        loading={loading}
-        loadPage={loadPage}
-        refetch={refetch}
-        setQuery={setQuery}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        totalCount={totalCount}
-        type={networkModel.NetworkType.page}
-      />
-    )}
-  </NetworkTopNFlowQuery>
-);
+}: IPsQueryTabBodyProps) => {
+  const [
+    loading,
+    { id, inspect, isInspected, loadPage, networkTopNFlow, pageInfo, refetch, totalCount },
+  ] = useNetworkTopNFlow({
+    endDate,
+    flowTarget,
+    filterQuery,
+    skip,
+    startDate,
+    type: networkModel.NetworkType.page,
+  });
+
+  return (
+    <NetworkTopNFlowTableManage
+      data={networkTopNFlow}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      flowTargeted={flowTarget}
+      id={id}
+      inspect={inspect}
+      isInspect={isInspected}
+      loading={loading}
+      loadPage={loadPage}
+      refetch={refetch}
+      setQuery={setQuery}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      totalCount={totalCount}
+      type={networkModel.NetworkType.page}
+    />
+  );
+};
 
 IPsQueryTabBody.displayName = 'IPsQueryTabBody';
diff --git a/x-pack/plugins/security_solution/public/network/pages/navigation/network_routes.tsx b/x-pack/plugins/security_solution/public/network/pages/navigation/network_routes.tsx
index 93582088811dca..2da56a30df7c75 100644
--- a/x-pack/plugins/security_solution/public/network/pages/navigation/network_routes.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/navigation/network_routes.tsx
@@ -8,7 +8,7 @@ import React, { useCallback } from 'react';
 import { Route, Switch } from 'react-router-dom';
 import { EuiFlexItem, EuiSpacer } from '@elastic/eui';
 
-import { FlowTargetSourceDest } from '../../../graphql/types';
+import { FlowTargetSourceDest } from '../../../../common/search_strategy/security_solution/network';
 import { scoreIntervalToDateTime } from '../../../common/components/ml/score/score_interval_to_datetime';
 
 import { IPsQueryTabBody } from './ips_query_tab_body';
diff --git a/x-pack/plugins/security_solution/public/network/pages/navigation/tls_query_tab_body.tsx b/x-pack/plugins/security_solution/public/network/pages/navigation/tls_query_tab_body.tsx
index 00da5496e54405..279891cc181e3d 100644
--- a/x-pack/plugins/security_solution/public/network/pages/navigation/tls_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/navigation/tls_query_tab_body.tsx
@@ -6,13 +6,13 @@
 import React from 'react';
 import { getOr } from 'lodash/fp';
 import { manageQuery } from '../../../common/components/page/manage_query';
-import { TlsQuery } from '../../../network/containers/tls';
+import { useNetworkTls } from '../../../network/containers/tls';
 import { TlsTable } from '../../components/tls_table';
 import { TlsQueryTabBodyProps } from './types';
 
 const TlsTableManage = manageQuery(TlsTable);
 
-export const TlsQueryTabBody = ({
+const TlsQueryTabBodyComponent: React.FC<TlsQueryTabBodyProps> = ({
   endDate,
   filterQuery,
   flowTarget,
@@ -21,32 +21,38 @@ export const TlsQueryTabBody = ({
   skip,
   startDate,
   type,
-}: TlsQueryTabBodyProps) => (
-  <TlsQuery
-    endDate={endDate}
-    filterQuery={filterQuery}
-    flowTarget={flowTarget}
-    ip={ip}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={type}
-  >
-    {({ id, inspect, isInspected, tls, totalCount, pageInfo, loading, loadPage, refetch }) => (
-      <TlsTableManage
-        data={tls}
-        id={id}
-        inspect={inspect}
-        isInspect={isInspected}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        loading={loading}
-        loadPage={loadPage}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        refetch={refetch}
-        setQuery={setQuery}
-        totalCount={totalCount}
-        type={type}
-      />
-    )}
-  </TlsQuery>
-);
+}) => {
+  const [
+    loading,
+    { id, inspect, isInspected, tls, totalCount, pageInfo, loadPage, refetch },
+  ] = useNetworkTls({
+    endDate,
+    filterQuery,
+    flowTarget,
+    ip,
+    skip,
+    startDate,
+    type,
+  });
+
+  return (
+    <TlsTableManage
+      data={tls}
+      id={id}
+      inspect={inspect}
+      isInspect={isInspected}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      loading={loading}
+      loadPage={loadPage}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      refetch={refetch}
+      setQuery={setQuery}
+      totalCount={totalCount}
+      type={type}
+    />
+  );
+};
+
+TlsQueryTabBodyComponent.displayName = 'TlsQueryTabBodyComponent';
+
+export const TlsQueryTabBody = React.memo(TlsQueryTabBodyComponent);
diff --git a/x-pack/plugins/security_solution/public/network/pages/navigation/types.ts b/x-pack/plugins/security_solution/public/network/pages/navigation/types.ts
index 183c760e40ab10..2ef04d3371c0b9 100644
--- a/x-pack/plugins/security_solution/public/network/pages/navigation/types.ts
+++ b/x-pack/plugins/security_solution/public/network/pages/navigation/types.ts
@@ -8,7 +8,7 @@ import { ESTermQuery } from '../../../../common/typed_json';
 import { IIndexPattern } from '../../../../../../../src/plugins/data/common';
 
 import { NavTab } from '../../../common/components/navigation/types';
-import { FlowTargetSourceDest } from '../../../graphql/types';
+import { FlowTargetSourceDest } from '../../../../common/search_strategy/security_solution/network';
 import { networkModel } from '../../store';
 import { GlobalTimeArgs } from '../../../common/containers/use_global_time';
 
diff --git a/x-pack/plugins/security_solution/public/network/store/selectors.ts b/x-pack/plugins/security_solution/public/network/store/selectors.ts
index cef8b139402eff..0246305092a323 100644
--- a/x-pack/plugins/security_solution/public/network/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/network/store/selectors.ts
@@ -7,7 +7,7 @@
 import { createSelector } from 'reselect';
 import { get } from 'lodash/fp';
 
-import { FlowTargetSourceDest } from '../../graphql/types';
+import { FlowTargetSourceDest } from '../../../common/search_strategy/security_solution/network';
 import { State } from '../../common/store/types';
 import { initialNetworkState } from './reducer';
 import {
diff --git a/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.test.tsx
index a35d85d1321f53..e365ac38d31df3 100644
--- a/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { ThemeProvider } from 'styled-components';
 
 import '../../../common/mock/match_media';
-import { useQuery } from '../../../common/containers/matrix_histogram';
+import { useMatrixHistogram } from '../../../common/containers/matrix_histogram';
 // we don't have the types for waitFor just yet, so using "as waitFor" until when we do
 import { wait as waitFor } from '@testing-library/react';
 import { mockIndexPattern, TestProviders } from '../../../common/mock';
@@ -19,11 +19,9 @@ import { AlertsByCategory } from '.';
 
 jest.mock('../../../common/components/link_to');
 jest.mock('../../../common/lib/kibana');
-jest.mock('../../../common/containers/matrix_histogram', () => {
-  return {
-    useQuery: jest.fn(),
-  };
-});
+jest.mock('../../../common/containers/matrix_histogram', () => ({
+  useMatrixHistogram: jest.fn(),
+}));
 
 const theme = () => ({ eui: { ...euiDarkVars, euiSizeL: '24px' }, darkMode: true });
 const from = '2020-03-31T06:00:00.000Z';
@@ -34,12 +32,14 @@ describe('Alerts by category', () => {
 
   describe('before loading data', () => {
     beforeAll(async () => {
-      (useQuery as jest.Mock).mockReturnValue({
-        data: null,
-        loading: false,
-        inspect: false,
-        totalCount: null,
-      });
+      (useMatrixHistogram as jest.Mock).mockReturnValue([
+        false,
+        {
+          data: null,
+          inspect: false,
+          totalCount: null,
+        },
+      ]);
 
       wrapper = mount(
         <ThemeProvider theme={theme}>
@@ -100,19 +100,21 @@ describe('Alerts by category', () => {
 
   describe('after loading data', () => {
     beforeAll(async () => {
-      (useQuery as jest.Mock).mockReturnValue({
-        data: [
-          { x: 1, y: 2, g: 'g1' },
-          { x: 2, y: 4, g: 'g1' },
-          { x: 3, y: 6, g: 'g1' },
-          { x: 1, y: 1, g: 'g2' },
-          { x: 2, y: 3, g: 'g2' },
-          { x: 3, y: 5, g: 'g2' },
-        ],
-        loading: false,
-        inspect: false,
-        totalCount: 6,
-      });
+      (useMatrixHistogram as jest.Mock).mockReturnValue([
+        false,
+        {
+          data: [
+            { x: 1, y: 2, g: 'g1' },
+            { x: 2, y: 4, g: 'g1' },
+            { x: 3, y: 6, g: 'g1' },
+            { x: 1, y: 1, g: 'g2' },
+            { x: 2, y: 3, g: 'g2' },
+            { x: 3, y: 5, g: 'g2' },
+          ],
+          inspect: false,
+          totalCount: 6,
+        },
+      ]);
 
       wrapper = mount(
         <ThemeProvider theme={theme}>
diff --git a/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.tsx b/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.tsx
index 6e59d81a1eae91..1a2238c763bdad 100644
--- a/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.tsx
@@ -10,7 +10,7 @@ import { Position } from '@elastic/charts';
 
 import { DEFAULT_NUMBER_FORMAT, APP_ID } from '../../../../common/constants';
 import { SHOWING, UNIT } from '../../../common/components/alerts_viewer/translations';
-import { MatrixHistogramContainer } from '../../../common/components/matrix_histogram';
+import { MatrixHistogram } from '../../../common/components/matrix_histogram';
 import { useKibana, useUiSetting$ } from '../../../common/lib/kibana';
 import { convertToBuildEsQuery } from '../../../common/lib/keury';
 import {
@@ -19,14 +19,14 @@ import {
   IIndexPattern,
   Query,
 } from '../../../../../../../src/plugins/data/public';
-import { HostsTableType, HostsType } from '../../../hosts/store/model';
+import { HostsTableType } from '../../../hosts/store/model';
 
 import * as i18n from '../../pages/translations';
 import {
   alertsStackByOptions,
   histogramConfigs,
 } from '../../../common/components/alerts_viewer/histogram_configs';
-import { MatrixHisrogramConfigs } from '../../../common/components/matrix_histogram/types';
+import { MatrixHistogramConfigs } from '../../../common/components/matrix_histogram/types';
 import { getTabsOnHostsUrl } from '../../../common/components/link_to/redirect_to_hosts';
 import { GlobalTimeArgs } from '../../../common/containers/use_global_time';
 import { SecurityPageName } from '../../../app/types';
@@ -93,7 +93,7 @@ const AlertsByCategoryComponent: React.FC<Props> = ({
     [goToHostAlerts, formatUrl]
   );
 
-  const alertsByCategoryHistogramConfigs: MatrixHisrogramConfigs = useMemo(
+  const alertsByCategoryHistogramConfigs: MatrixHistogramConfigs = useMemo(
     () => ({
       ...histogramConfigs,
       defaultStackByOption:
@@ -107,7 +107,7 @@ const AlertsByCategoryComponent: React.FC<Props> = ({
   );
 
   return (
-    <MatrixHistogramContainer
+    <MatrixHistogram
       endDate={to}
       filterQuery={convertToBuildEsQuery({
         config: esQuery.getEsQueryConfig(kibana.services.uiSettings),
@@ -118,9 +118,7 @@ const AlertsByCategoryComponent: React.FC<Props> = ({
       headerChildren={hideHeaderChildren ? null : alertsCountViewAlertsButton}
       id={ID}
       setQuery={setQuery}
-      sourceId="default"
       startDate={from}
-      type={HostsType.page}
       {...alertsByCategoryHistogramConfigs}
     />
   );
diff --git a/x-pack/plugins/security_solution/public/overview/components/event_counts/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/event_counts/index.test.tsx
index 8268a550257c9c..f2d6b503260825 100644
--- a/x-pack/plugins/security_solution/public/overview/components/event_counts/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/event_counts/index.test.tsx
@@ -22,29 +22,24 @@ describe('EventCounts', () => {
 
   test('it filters the `Host events` widget with a `host.name` `exists` filter', () => {
     const wrapper = mount(
-      <TestProviders>
-        <EventCounts from={from} indexPattern={mockIndexPattern} setQuery={jest.fn()} to={to} />
-      </TestProviders>
+      <EventCounts from={from} indexPattern={mockIndexPattern} setQuery={jest.fn()} to={to} />,
+      { wrappingComponent: TestProviders }
     );
 
     expect(
-      (wrapper.find('[data-test-subj="overview-host-query"]').first().props() as OverviewHostProps)
-        .filterQuery
+      (wrapper.find('Memo(OverviewHostComponent)').first().props() as OverviewHostProps).filterQuery
     ).toContain('[{"bool":{"should":[{"exists":{"field":"host.name"}}]');
   });
 
   test('it filters the `Network events` widget with a `source.ip` or `destination.ip` `exists` filter', () => {
     const wrapper = mount(
-      <TestProviders>
-        <EventCounts from={from} indexPattern={mockIndexPattern} setQuery={jest.fn()} to={to} />
-      </TestProviders>
+      <EventCounts from={from} indexPattern={mockIndexPattern} setQuery={jest.fn()} to={to} />,
+      { wrappingComponent: TestProviders }
     );
 
     expect(
-      (wrapper
-        .find('[data-test-subj="overview-network-query"]')
-        .first()
-        .props() as OverviewNetworkProps).filterQuery
+      (wrapper.find('Memo(OverviewNetworkComponent)').first().props() as OverviewNetworkProps)
+        .filterQuery
     ).toContain(
       '{"bool":{"filter":[{"bool":{"should":[{"bool":{"should":[{"exists":{"field":"source.ip"}}],"minimum_should_match":1}},{"bool":{"should":[{"exists":{"field":"destination.ip"}}],"minimum_should_match":1}}],"minimum_should_match":1}}]}}]'
     );
diff --git a/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx b/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx
index f18fccee50e22b..7025afde963f14 100644
--- a/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx
@@ -12,9 +12,9 @@ import uuid from 'uuid';
 import { DEFAULT_NUMBER_FORMAT, APP_ID } from '../../../../common/constants';
 import { SHOWING, UNIT } from '../../../common/components/events_viewer/translations';
 import { getTabsOnHostsUrl } from '../../../common/components/link_to/redirect_to_hosts';
-import { MatrixHistogramContainer } from '../../../common/components/matrix_histogram';
+import { MatrixHistogram } from '../../../common/components/matrix_histogram';
 import {
-  MatrixHisrogramConfigs,
+  MatrixHistogramConfigs,
   MatrixHistogramOption,
 } from '../../../common/components/matrix_histogram/types';
 import { eventsStackByOptions } from '../../../hosts/pages/navigation';
@@ -27,7 +27,7 @@ import {
   IIndexPattern,
   Query,
 } from '../../../../../../../src/plugins/data/public';
-import { HostsTableType, HostsType } from '../../../hosts/store/model';
+import { HostsTableType } from '../../../hosts/store/model';
 import { InputsModelId } from '../../../common/store/inputs/constants';
 import { GlobalTimeArgs } from '../../../common/containers/use_global_time';
 
@@ -127,7 +127,7 @@ const EventsByDatasetComponent: React.FC<Props> = ({
     [combinedQueries, kibana, indexPattern, query, filters]
   );
 
-  const eventsByDatasetHistogramConfigs: MatrixHisrogramConfigs = useMemo(
+  const eventsByDatasetHistogramConfigs: MatrixHistogramConfigs = useMemo(
     () => ({
       ...histogramConfigs,
       stackByOptions:
@@ -159,7 +159,7 @@ const EventsByDatasetComponent: React.FC<Props> = ({
   }, [onlyField, headerChildren, eventsCountViewEventsButton]);
 
   return (
-    <MatrixHistogramContainer
+    <MatrixHistogram
       endDate={to}
       filterQuery={filterQuery}
       headerChildren={headerContent}
@@ -168,10 +168,8 @@ const EventsByDatasetComponent: React.FC<Props> = ({
       setAbsoluteRangeDatePickerTarget={setAbsoluteRangeDatePickerTarget}
       setQuery={setQuery}
       showSpacer={showSpacer}
-      sourceId="default"
       startDate={from}
       timelineId={timelineId}
-      type={HostsType.page}
       {...eventsByDatasetHistogramConfigs}
       title={onlyField != null ? i18n.TOP(onlyField) : eventsByDatasetHistogramConfigs.title}
     />
diff --git a/x-pack/plugins/security_solution/public/overview/components/host_overview/index.tsx b/x-pack/plugins/security_solution/public/overview/components/host_overview/index.tsx
index c7aba6fcc8a5b3..08f3f01bc99f6c 100644
--- a/x-pack/plugins/security_solution/public/overview/components/host_overview/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/host_overview/index.tsx
@@ -91,7 +91,7 @@ export const HostOverview = React.memo<HostSummaryProps>(
           description:
             data.host != null && data.host.name && data.host.name.length ? (
               <FirstLastSeenHost
-                hostname={data.host.name[0]}
+                hostName={data.host.name[0]}
                 type={FirstLastSeenHostType.FIRST_SEEN}
               />
             ) : (
@@ -103,7 +103,7 @@ export const HostOverview = React.memo<HostSummaryProps>(
           description:
             data.host != null && data.host.name && data.host.name.length ? (
               <FirstLastSeenHost
-                hostname={data.host.name[0]}
+                hostName={data.host.name[0]}
                 type={FirstLastSeenHostType.LAST_SEEN}
               />
             ) : (
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
index 5ff78c9b29cf5a..b932add7afc2c7 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
@@ -7,7 +7,6 @@
 import { cloneDeep } from 'lodash/fp';
 import { mount } from 'enzyme';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 
 import '../../../common/mock/match_media';
 import {
@@ -21,11 +20,7 @@ import {
 
 import { OverviewHost } from '.';
 import { createStore, State } from '../../../common/store';
-import { overviewHostQuery } from '../../containers/overview_host/index.gql_query';
-import { GetOverviewHostQuery } from '../../../graphql/types';
-
-// we don't have the types for waitFor just yet, so using "as waitFor" until when we do
-import { wait as waitFor } from '@testing-library/react';
+import { useHostOverview } from '../../containers/overview_host';
 
 jest.mock('../../../common/lib/kibana');
 jest.mock('../../../common/components/link_to');
@@ -33,67 +28,30 @@ jest.mock('../../../common/components/link_to');
 const startDate = '2020-01-20T20:49:57.080Z';
 const endDate = '2020-01-21T20:49:57.080Z';
 
-interface MockedProvidedQuery {
-  request: {
-    query: GetOverviewHostQuery.Query;
-    fetchPolicy: string;
-    variables: GetOverviewHostQuery.Variables;
-  };
-  result: {
-    data: {
-      source: unknown;
-    };
-  };
-}
-
-const mockOpenTimelineQueryResults: MockedProvidedQuery[] = [
-  {
-    request: {
-      query: overviewHostQuery,
-      fetchPolicy: 'cache-and-network',
-      variables: {
-        sourceId: 'default',
-        timerange: { interval: '12h', from: startDate, to: endDate },
-        filterQuery: undefined,
-        defaultIndex: [
-          'apm-*-transaction*',
-          'auditbeat-*',
-          'endgame-*',
-          'filebeat-*',
-          'logs-*',
-          'packetbeat-*',
-          'winlogbeat-*',
-        ],
-        inspect: false,
-      },
-    },
-    result: {
-      data: {
-        source: {
-          id: 'default',
-          OverviewHost: {
-            auditbeatAuditd: 1,
-            auditbeatFIM: 1,
-            auditbeatLogin: 1,
-            auditbeatPackage: 1,
-            auditbeatProcess: 1,
-            auditbeatUser: 1,
-            endgameDns: 1,
-            endgameFile: 1,
-            endgameImageLoad: 1,
-            endgameNetwork: 1,
-            endgameProcess: 1,
-            endgameRegistry: 1,
-            endgameSecurity: 1,
-            filebeatSystemModule: 1,
-            winlogbeatSecurity: 1,
-            winlogbeatMWSysmonOperational: 1,
-          },
-        },
-      },
-    },
+const MOCKED_RESPONSE = {
+  overviewHost: {
+    auditbeatAuditd: 1,
+    auditbeatFIM: 1,
+    auditbeatLogin: 1,
+    auditbeatPackage: 1,
+    auditbeatProcess: 1,
+    auditbeatUser: 1,
+    endgameDns: 1,
+    endgameFile: 1,
+    endgameImageLoad: 1,
+    endgameNetwork: 1,
+    endgameProcess: 1,
+    endgameRegistry: 1,
+    endgameSecurity: 1,
+    filebeatSystemModule: 1,
+    winlogbeatSecurity: 1,
+    winlogbeatMWSysmonOperational: 1,
   },
-];
+};
+
+jest.mock('../../containers/overview_host');
+const useHostOverviewMock = useHostOverview as jest.Mock;
+useHostOverviewMock.mockReturnValue([false, MOCKED_RESPONSE]);
 
 describe('OverviewHost', () => {
   const state: State = mockGlobalState;
@@ -131,8 +89,9 @@ describe('OverviewHost', () => {
   });
 
   test('it renders an empty subtitle while loading', () => {
+    useHostOverviewMock.mockReturnValueOnce([true, { overviewHost: {} }]);
     const wrapper = mount(
-      <TestProviders>
+      <TestProviders store={store}>
         <OverviewHost endDate={endDate} setQuery={jest.fn()} startDate={startDate} />
       </TestProviders>
     );
@@ -142,18 +101,13 @@ describe('OverviewHost', () => {
 
   test('it renders the expected event count in the subtitle after loading events', async () => {
     const wrapper = mount(
-      <TestProviders>
-        <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-          <OverviewHost endDate={endDate} setQuery={jest.fn()} startDate={startDate} />
-        </MockedProvider>
+      <TestProviders store={store}>
+        <OverviewHost endDate={endDate} setQuery={jest.fn()} startDate={startDate} />
       </TestProviders>
     );
-    await waitFor(() => {
-      wrapper.update();
 
-      expect(wrapper.find('[data-test-subj="header-panel-subtitle"]').first().text()).toEqual(
-        'Showing: 16 events'
-      );
-    });
+    expect(wrapper.find('[data-test-subj="header-panel-subtitle"]').first().text()).toEqual(
+      'Showing: 16 events'
+    );
   });
 });
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.tsx
index 783e433dfba265..3f35d0abbaa856 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.tsx
@@ -12,7 +12,7 @@ import React, { useMemo, useCallback } from 'react';
 
 import { DEFAULT_NUMBER_FORMAT, APP_ID } from '../../../../common/constants';
 import { ESQuery } from '../../../../common/typed_json';
-import { ID as OverviewHostQueryId, OverviewHostQuery } from '../../containers/overview_host';
+import { ID as OverviewHostQueryId, useHostOverview } from '../../containers/overview_host';
 import { HeaderSection } from '../../../common/components/header_section';
 import { useUiSetting$, useKibana } from '../../../common/lib/kibana';
 import { getHostsUrl, useFormatUrl } from '../../../common/components/link_to';
@@ -44,6 +44,12 @@ const OverviewHostComponent: React.FC<OverviewHostProps> = ({
   const { navigateToApp } = useKibana().services.application;
   const [defaultNumberFormat] = useUiSetting$<string>(DEFAULT_NUMBER_FORMAT);
 
+  const [loading, { overviewHost, id, inspect, refetch }] = useHostOverview({
+    endDate,
+    filterQuery,
+    startDate,
+  });
+
   const goToHost = useCallback(
     (ev) => {
       ev.preventDefault();
@@ -54,6 +60,16 @@ const OverviewHostComponent: React.FC<OverviewHostProps> = ({
     [navigateToApp, urlSearch]
   );
 
+  const hostEventsCount = useMemo(
+    () => getOverviewHostStats(overviewHost).reduce((total, stat) => total + stat.count, 0),
+    [overviewHost]
+  );
+
+  const formattedHostEventsCount = useMemo(
+    () => numeral(hostEventsCount).format(defaultNumberFormat),
+    [defaultNumberFormat, hostEventsCount]
+  );
+
   const hostPageButton = useMemo(
     () => (
       <LinkButton onClick={goToHost} href={formatUrl(getHostsUrl())}>
@@ -65,71 +81,54 @@ const OverviewHostComponent: React.FC<OverviewHostProps> = ({
     ),
     [goToHost, formatUrl]
   );
+
   return (
     <EuiFlexItem>
       <InspectButtonContainer>
         <EuiPanel>
-          <OverviewHostQuery
-            data-test-subj="overview-host-query"
-            endDate={endDate}
-            filterQuery={filterQuery}
-            sourceId="default"
-            startDate={startDate}
+          <HeaderSection
+            id={OverviewHostQueryId}
+            subtitle={
+              !isEmpty(overviewHost) ? (
+                <FormattedMessage
+                  defaultMessage="Showing: {formattedHostEventsCount} {hostEventsCount, plural, one {event} other {events}}"
+                  id="xpack.securitySolution.overview.overviewHost.hostsSubtitle"
+                  values={{
+                    hostEventsCount,
+                    formattedHostEventsCount,
+                  }}
+                />
+              ) : (
+                <>{''}</>
+              )
+            }
+            title={
+              <FormattedMessage
+                id="xpack.securitySolution.overview.hostsTitle"
+                defaultMessage="Host events"
+              />
+            }
           >
-            {({ overviewHost, loading, id, inspect, refetch }) => {
-              const hostEventsCount = getOverviewHostStats(overviewHost).reduce(
-                (total, stat) => total + stat.count,
-                0
-              );
-              const formattedHostEventsCount = numeral(hostEventsCount).format(defaultNumberFormat);
+            <>
+              <Sourcerer />
+              {hostPageButton}
+            </>
+          </HeaderSection>
 
-              return (
-                <>
-                  <HeaderSection
-                    id={OverviewHostQueryId}
-                    subtitle={
-                      !isEmpty(overviewHost) ? (
-                        <FormattedMessage
-                          defaultMessage="Showing: {formattedHostEventsCount} {hostEventsCount, plural, one {event} other {events}}"
-                          id="xpack.securitySolution.overview.overviewHost.hostsSubtitle"
-                          values={{
-                            formattedHostEventsCount,
-                            hostEventsCount,
-                          }}
-                        />
-                      ) : (
-                        <>{''}</>
-                      )
-                    }
-                    title={
-                      <FormattedMessage
-                        id="xpack.securitySolution.overview.hostsTitle"
-                        defaultMessage="Host events"
-                      />
-                    }
-                  >
-                    <>
-                      <Sourcerer />
-                      {hostPageButton}
-                    </>
-                  </HeaderSection>
-
-                  <OverviewHostStatsManage
-                    loading={loading}
-                    data={overviewHost}
-                    setQuery={setQuery}
-                    id={id}
-                    inspect={inspect}
-                    refetch={refetch}
-                  />
-                </>
-              );
-            }}
-          </OverviewHostQuery>
+          <OverviewHostStatsManage
+            loading={loading}
+            data={overviewHost}
+            setQuery={setQuery}
+            id={id}
+            inspect={inspect}
+            refetch={refetch}
+          />
         </EuiPanel>
       </InspectButtonContainer>
     </EuiFlexItem>
   );
 };
 
+OverviewHostComponent.displayName = 'OverviewHostComponent';
+
 export const OverviewHost = React.memo(OverviewHostComponent);
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_host_stats/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/overview/components/overview_host_stats/__snapshots__/index.test.tsx.snap
index 8d4de5b90fae9e..23732e88ba1f96 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_host_stats/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_host_stats/__snapshots__/index.test.tsx.snap
@@ -40,6 +40,8 @@ exports[`Overview Host Stat Data rendering it renders the default OverviewHostSt
     buttonContentClassName="accordion-button"
     id="host-stat-accordion-groupauditbeat"
     initialIsOpen={false}
+    isLoading={false}
+    isLoadingMessage={false}
     paddingSize="none"
   >
     <styled.div>
@@ -273,6 +275,8 @@ exports[`Overview Host Stat Data rendering it renders the default OverviewHostSt
     buttonContentClassName="accordion-button"
     id="host-stat-accordion-groupendgame"
     initialIsOpen={false}
+    isLoading={false}
+    isLoadingMessage={false}
     paddingSize="none"
   >
     <styled.div>
@@ -538,6 +542,8 @@ exports[`Overview Host Stat Data rendering it renders the default OverviewHostSt
     buttonContentClassName="accordion-button"
     id="host-stat-accordion-groupfilebeat"
     initialIsOpen={false}
+    isLoading={false}
+    isLoadingMessage={false}
     paddingSize="none"
   >
     <styled.div>
@@ -611,6 +617,8 @@ exports[`Overview Host Stat Data rendering it renders the default OverviewHostSt
     buttonContentClassName="accordion-button"
     id="host-stat-accordion-groupwinlogbeat"
     initialIsOpen={false}
+    isLoading={false}
+    isLoadingMessage={false}
     paddingSize="none"
   >
     <styled.div>
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
index 0bb887b38a4b10..f67287ea4b9e2d 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
@@ -7,7 +7,7 @@
 import { cloneDeep } from 'lodash/fp';
 import { mount } from 'enzyme';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
+
 import '../../../common/mock/match_media';
 import {
   apolloClientObservable,
@@ -17,13 +17,9 @@ import {
   createSecuritySolutionStorageMock,
   kibanaObservable,
 } from '../../../common/mock';
-
 import { OverviewNetwork } from '.';
 import { createStore, State } from '../../../common/store';
-import { overviewNetworkQuery } from '../../containers/overview_network/index.gql_query';
-import { GetOverviewHostQuery } from '../../../graphql/types';
-// we don't have the types for waitFor just yet, so using "as waitFor" until when we do
-import { wait as waitFor } from '@testing-library/react';
+import { useNetworkOverview } from '../../containers/overview_network';
 
 jest.mock('../../../common/components/link_to');
 const mockNavigateToApp = jest.fn();
@@ -48,60 +44,23 @@ jest.mock('../../../common/lib/kibana', () => {
 const startDate = '2020-01-20T20:49:57.080Z';
 const endDate = '2020-01-21T20:49:57.080Z';
 
-interface MockedProvidedQuery {
-  request: {
-    query: GetOverviewHostQuery.Query;
-    fetchPolicy: string;
-    variables: GetOverviewHostQuery.Variables;
-  };
-  result: {
-    data: {
-      source: unknown;
-    };
-  };
-}
-
-const mockOpenTimelineQueryResults: MockedProvidedQuery[] = [
-  {
-    request: {
-      query: overviewNetworkQuery,
-      fetchPolicy: 'cache-and-network',
-      variables: {
-        sourceId: 'default',
-        timerange: { interval: '12h', from: startDate, to: endDate },
-        filterQuery: undefined,
-        defaultIndex: [
-          'apm-*-transaction*',
-          'auditbeat-*',
-          'endgame-*',
-          'filebeat-*',
-          'logs-*',
-          'packetbeat-*',
-          'winlogbeat-*',
-        ],
-        inspect: false,
-      },
-    },
-    result: {
-      data: {
-        source: {
-          id: 'default',
-          OverviewNetwork: {
-            auditbeatSocket: 1,
-            filebeatCisco: 1,
-            filebeatNetflow: 1,
-            filebeatPanw: 1,
-            filebeatSuricata: 1,
-            filebeatZeek: 1,
-            packetbeatDNS: 1,
-            packetbeatFlow: 1,
-            packetbeatTLS: 1,
-          },
-        },
-      },
-    },
+const MOCKED_RESPONSE = {
+  overviewNetwork: {
+    auditbeatSocket: 1,
+    filebeatCisco: 1,
+    filebeatNetflow: 1,
+    filebeatPanw: 1,
+    filebeatSuricata: 1,
+    filebeatZeek: 1,
+    packetbeatDNS: 1,
+    packetbeatFlow: 1,
+    packetbeatTLS: 1,
   },
-];
+};
+
+jest.mock('../../containers/overview_network');
+const useNetworkOverviewMock = useNetworkOverview as jest.Mock;
+useNetworkOverviewMock.mockReturnValue([false, MOCKED_RESPONSE]);
 
 describe('OverviewNetwork', () => {
   const state: State = mockGlobalState;
@@ -139,8 +98,9 @@ describe('OverviewNetwork', () => {
   });
 
   test('it renders an empty subtitle while loading', () => {
+    useNetworkOverviewMock.mockReturnValueOnce([true, { overviewNetwork: {} }]);
     const wrapper = mount(
-      <TestProviders>
+      <TestProviders store={store}>
         <OverviewNetwork endDate={endDate} setQuery={jest.fn()} startDate={startDate} />
       </TestProviders>
     );
@@ -150,27 +110,20 @@ describe('OverviewNetwork', () => {
 
   test('it renders the expected event count in the subtitle after loading events', async () => {
     const wrapper = mount(
-      <TestProviders>
-        <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-          <OverviewNetwork endDate={endDate} setQuery={jest.fn()} startDate={startDate} />
-        </MockedProvider>
+      <TestProviders store={store}>
+        <OverviewNetwork endDate={endDate} setQuery={jest.fn()} startDate={startDate} />
       </TestProviders>
     );
-    await waitFor(() => {
-      wrapper.update();
 
-      expect(wrapper.find('[data-test-subj="header-panel-subtitle"]').first().text()).toEqual(
-        'Showing: 9 events'
-      );
-    });
+    expect(wrapper.find('[data-test-subj="header-panel-subtitle"]').first().text()).toEqual(
+      'Showing: 9 events'
+    );
   });
 
   it('it renders View Network', () => {
     const wrapper = mount(
-      <TestProviders>
-        <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-          <OverviewNetwork endDate={endDate} setQuery={jest.fn()} startDate={startDate} />
-        </MockedProvider>
+      <TestProviders store={store}>
+        <OverviewNetwork endDate={endDate} setQuery={jest.fn()} startDate={startDate} />
       </TestProviders>
     );
 
@@ -179,10 +132,8 @@ describe('OverviewNetwork', () => {
 
   it('when click on View Network we call navigateToApp to make sure to navigate to right page', () => {
     const wrapper = mount(
-      <TestProviders>
-        <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-          <OverviewNetwork endDate={endDate} setQuery={jest.fn()} startDate={startDate} />
-        </MockedProvider>
+      <TestProviders store={store}>
+        <OverviewNetwork endDate={endDate} setQuery={jest.fn()} startDate={startDate} />
       </TestProviders>
     );
 
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.tsx
index 8282eaeb63c28b..089bed3c678087 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.tsx
@@ -17,7 +17,7 @@ import { useUiSetting$, useKibana } from '../../../common/lib/kibana';
 import { manageQuery } from '../../../common/components/page/manage_query';
 import {
   ID as OverviewNetworkQueryId,
-  OverviewNetworkQuery,
+  useNetworkOverview,
 } from '../../containers/overview_network';
 import { getOverviewNetworkStats, OverviewNetworkStats } from '../overview_network_stats';
 import { getNetworkUrl, useFormatUrl } from '../../../common/components/link_to';
@@ -45,6 +45,12 @@ const OverviewNetworkComponent: React.FC<OverviewNetworkProps> = ({
   const { navigateToApp } = useKibana().services.application;
   const [defaultNumberFormat] = useUiSetting$<string>(DEFAULT_NUMBER_FORMAT);
 
+  const [loading, { overviewNetwork, id, inspect, refetch }] = useNetworkOverview({
+    endDate,
+    filterQuery,
+    startDate,
+  });
+
   const goToNetwork = useCallback(
     (ev) => {
       ev.preventDefault();
@@ -55,6 +61,15 @@ const OverviewNetworkComponent: React.FC<OverviewNetworkProps> = ({
     [navigateToApp, urlSearch]
   );
 
+  const networkEventsCount = useMemo(
+    () => getOverviewNetworkStats(overviewNetwork).reduce((total, stat) => total + stat.count, 0),
+    [overviewNetwork]
+  );
+  const formattedNetworkEventsCount = useMemo(
+    () => numeral(networkEventsCount).format(defaultNumberFormat),
+    [defaultNumberFormat, networkEventsCount]
+  );
+
   const networkPageButton = useMemo(
     () => (
       <LinkButton
@@ -74,63 +89,43 @@ const OverviewNetworkComponent: React.FC<OverviewNetworkProps> = ({
   return (
     <EuiFlexItem>
       <InspectButtonContainer>
-        <EuiPanel>
-          <OverviewNetworkQuery
-            data-test-subj="overview-network-query"
-            endDate={endDate}
-            filterQuery={filterQuery}
-            sourceId="default"
-            startDate={startDate}
-          >
-            {({ overviewNetwork, loading, id, inspect, refetch }) => {
-              const networkEventsCount = getOverviewNetworkStats(overviewNetwork).reduce(
-                (total, stat) => total + stat.count,
-                0
-              );
-              const formattedNetworkEventsCount = numeral(networkEventsCount).format(
-                defaultNumberFormat
-              );
-
-              return (
-                <>
-                  <HeaderSection
-                    id={OverviewNetworkQueryId}
-                    subtitle={
-                      !isEmpty(overviewNetwork) ? (
-                        <FormattedMessage
-                          defaultMessage="Showing: {formattedNetworkEventsCount} {networkEventsCount, plural, one {event} other {events}}"
-                          id="xpack.securitySolution.overview.overviewNetwork.networkSubtitle"
-                          values={{
-                            formattedNetworkEventsCount,
-                            networkEventsCount,
-                          }}
-                        />
-                      ) : (
-                        <>{''}</>
-                      )
-                    }
-                    title={
-                      <FormattedMessage
-                        id="xpack.securitySolution.overview.networkTitle"
-                        defaultMessage="Network events"
-                      />
-                    }
-                  >
-                    {networkPageButton}
-                  </HeaderSection>
-
-                  <OverviewNetworkStatsManage
-                    loading={loading}
-                    data={overviewNetwork}
-                    id={id}
-                    inspect={inspect}
-                    setQuery={setQuery}
-                    refetch={refetch}
+        <EuiPanel data-test-subj="overview-network-query">
+          <>
+            <HeaderSection
+              id={OverviewNetworkQueryId}
+              subtitle={
+                !isEmpty(overviewNetwork) ? (
+                  <FormattedMessage
+                    defaultMessage="Showing: {formattedNetworkEventsCount} {networkEventsCount, plural, one {event} other {events}}"
+                    id="xpack.securitySolution.overview.overviewNetwork.networkSubtitle"
+                    values={{
+                      formattedNetworkEventsCount,
+                      networkEventsCount,
+                    }}
                   />
-                </>
-              );
-            }}
-          </OverviewNetworkQuery>
+                ) : (
+                  <>{''}</>
+                )
+              }
+              title={
+                <FormattedMessage
+                  id="xpack.securitySolution.overview.networkTitle"
+                  defaultMessage="Network events"
+                />
+              }
+            >
+              {networkPageButton}
+            </HeaderSection>
+
+            <OverviewNetworkStatsManage
+              loading={loading}
+              data={overviewNetwork}
+              id={id}
+              inspect={inspect}
+              setQuery={setQuery}
+              refetch={refetch}
+            />
+          </>
         </EuiPanel>
       </InspectButtonContainer>
     </EuiFlexItem>
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_network_stats/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/overview/components/overview_network_stats/__snapshots__/index.test.tsx.snap
index f6060fc060958b..167866ef3c6067 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_network_stats/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_network_stats/__snapshots__/index.test.tsx.snap
@@ -40,6 +40,8 @@ exports[`Overview Network Stat Data rendering it renders the default OverviewNet
     buttonContentClassName="accordion-button"
     id="network-stat-accordion-groupauditbeat"
     initialIsOpen={false}
+    isLoading={false}
+    isLoadingMessage={false}
     paddingSize="none"
   >
     <styled.div>
@@ -113,6 +115,8 @@ exports[`Overview Network Stat Data rendering it renders the default OverviewNet
     buttonContentClassName="accordion-button"
     id="network-stat-accordion-groupfilebeat"
     initialIsOpen={false}
+    isLoading={false}
+    isLoadingMessage={false}
     paddingSize="none"
   >
     <styled.div>
@@ -314,6 +318,8 @@ exports[`Overview Network Stat Data rendering it renders the default OverviewNet
     buttonContentClassName="accordion-button"
     id="network-stat-accordion-grouppacketbeat"
     initialIsOpen={false}
+    isLoading={false}
+    isLoadingMessage={false}
     paddingSize="none"
   >
     <styled.div>
diff --git a/x-pack/plugins/security_solution/public/overview/containers/overview_host/index.tsx b/x-pack/plugins/security_solution/public/overview/containers/overview_host/index.tsx
index a6977c3bbd49dc..e011e6c7b6b65e 100644
--- a/x-pack/plugins/security_solution/public/overview/containers/overview_host/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/containers/overview_host/index.tsx
@@ -4,95 +4,161 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React, { useMemo } from 'react';
-import { Query } from 'react-apollo';
-import { connect, ConnectedProps } from 'react-redux';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import deepEqual from 'fast-deep-equal';
 
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import { GetOverviewHostQuery, OverviewHostData } from '../../../graphql/types';
-import { useUiSetting } from '../../../common/lib/kibana';
-import { inputsModel, inputsSelectors } from '../../../common/store/inputs';
-import { State } from '../../../common/store';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
-import { QueryTemplateProps } from '../../../common/containers/query_template';
-
-import { overviewHostQuery } from './index.gql_query';
+import {
+  HostsQueries,
+  HostOverviewRequestOptions,
+  HostOverviewStrategyResponse,
+} from '../../../../common/search_strategy/security_solution';
+import { useKibana } from '../../../common/lib/kibana';
+import { inputsModel } from '../../../common/store/inputs';
+import { createFilter } from '../../../common/containers/helpers';
+import { ESQuery } from '../../../../common/typed_json';
 import { useManageSource } from '../../../common/containers/sourcerer';
 import { SOURCERER_FEATURE_FLAG_ON } from '../../../common/containers/sourcerer/constants';
+import { AbortError } from '../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../helpers';
+import { InspectResponse } from '../../../types';
+import * as i18n from './translations';
 
 export const ID = 'overviewHostQuery';
 
-export interface OverviewHostArgs {
+export interface HostOverviewArgs {
   id: string;
-  inspect: inputsModel.InspectQuery;
-  loading: boolean;
-  overviewHost: OverviewHostData;
+  inspect: InspectResponse;
+  isInspected: boolean;
+  overviewHost: HostOverviewStrategyResponse['overviewHost'];
   refetch: inputsModel.Refetch;
 }
 
-export interface OverviewHostProps extends QueryTemplateProps {
-  children: (args: OverviewHostArgs) => React.ReactNode;
-  sourceId: string;
+interface UseHostOverview {
+  filterQuery?: ESQuery | string;
   endDate: string;
+  skip?: boolean;
   startDate: string;
 }
 
-const OverviewHostComponentQuery = React.memo<OverviewHostProps & PropsFromRedux>(
-  ({ id = ID, children, filterQuery, isInspected, sourceId, startDate, endDate }) => {
-    const { activeSourceGroupId, getManageSourceGroupById } = useManageSource();
-    const { indexPatterns } = useMemo(() => getManageSourceGroupById(activeSourceGroupId), [
-      getManageSourceGroupById,
-      activeSourceGroupId,
-    ]);
-    const uiDefaultIndexPatterns = useUiSetting<string[]>(DEFAULT_INDEX_KEY);
-    const defaultIndex = SOURCERER_FEATURE_FLAG_ON ? indexPatterns : uiDefaultIndexPatterns;
-    return (
-      <Query<GetOverviewHostQuery.Query, GetOverviewHostQuery.Variables>
-        query={overviewHostQuery}
-        fetchPolicy={getDefaultFetchPolicy()}
-        variables={{
-          sourceId,
-          timerange: {
-            interval: '12h',
-            from: startDate,
-            to: endDate,
-          },
-          filterQuery: createFilter(filterQuery),
-          defaultIndex,
-          inspect: isInspected,
-        }}
-      >
-        {({ data, loading, refetch }) => {
-          const overviewHost = getOr({}, `source.OverviewHost`, data);
-          return children({
-            id,
-            inspect: getOr(null, 'source.OverviewHost.inspect', data),
-            overviewHost,
-            loading,
-            refetch,
-          });
-        }}
-      </Query>
-    );
-  }
-);
+export const useHostOverview = ({
+  filterQuery,
+  endDate,
+  skip = false,
+  startDate,
+}: UseHostOverview): [boolean, HostOverviewArgs] => {
+  const { data, notifications, uiSettings } = useKibana().services;
+  const { activeSourceGroupId, getManageSourceGroupById } = useManageSource();
+  const { indexPatterns } = useMemo(() => getManageSourceGroupById(activeSourceGroupId), [
+    getManageSourceGroupById,
+    activeSourceGroupId,
+  ]);
+  const uiDefaultIndexPatterns = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const defaultIndex = SOURCERER_FEATURE_FLAG_ON ? indexPatterns : uiDefaultIndexPatterns;
 
-OverviewHostComponentQuery.displayName = 'OverviewHostComponentQuery';
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const [loading, setLoading] = useState(false);
+  const [overviewHostRequest, setHostRequest] = useState<HostOverviewRequestOptions>({
+    defaultIndex,
+    factoryQueryType: HostsQueries.overview,
+    filterQuery: createFilter(filterQuery),
+    timerange: {
+      interval: '12h',
+      from: startDate,
+      to: endDate,
+    },
+  });
 
-const makeMapStateToProps = () => {
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  const mapStateToProps = (state: State, { id = ID }: OverviewHostProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      isInspected,
-    };
-  };
-  return mapStateToProps;
-};
+  const [overviewHostResponse, setHostOverviewResponse] = useState<HostOverviewArgs>({
+    overviewHost: {},
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    refetch: refetch.current,
+  });
 
-const connector = connect(makeMapStateToProps);
+  const overviewHostSearch = useCallback(
+    (request: HostOverviewRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
 
-type PropsFromRedux = ConnectedProps<typeof connector>;
+        const searchSubscription$ = data.search
+          .search<HostOverviewRequestOptions, HostOverviewStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setHostOverviewResponse((prevResponse) => ({
+                    ...prevResponse,
+                    overviewHost: response.overviewHost,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    refetch: refetch.current,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_HOST_OVERVIEW);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_HOST_OVERVIEW,
+                  text: msg.message,
+                });
+              }
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
 
-export const OverviewHostQuery = connector(OverviewHostComponentQuery);
+  useEffect(() => {
+    setHostRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [defaultIndex, endDate, filterQuery, skip, startDate]);
+
+  useEffect(() => {
+    overviewHostSearch(overviewHostRequest);
+  }, [overviewHostRequest, overviewHostSearch]);
+
+  return [loading, overviewHostResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/overview/containers/overview_host/translations.ts b/x-pack/plugins/security_solution/public/overview/containers/overview_host/translations.ts
new file mode 100644
index 00000000000000..65894847a3e74c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/overview/containers/overview_host/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_HOST_OVERVIEW = i18n.translate(
+  'xpack.securitySolution.allHost.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on all hosts search`,
+  }
+);
+
+export const FAIL_HOST_OVERVIEW = i18n.translate(
+  'xpack.securitySolution.allHost.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on all hosts`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/overview/containers/overview_network/index.tsx b/x-pack/plugins/security_solution/public/overview/containers/overview_network/index.tsx
index 38c035f6883b69..c61606e0c31dd4 100644
--- a/x-pack/plugins/security_solution/public/overview/containers/overview_network/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/containers/overview_network/index.tsx
@@ -4,85 +4,152 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { connect, ConnectedProps } from 'react-redux';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import deepEqual from 'fast-deep-equal';
 
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import { GetOverviewNetworkQuery, OverviewNetworkData } from '../../../graphql/types';
-import { useUiSetting } from '../../../common/lib/kibana';
-import { State } from '../../../common/store';
-import { inputsModel, inputsSelectors } from '../../../common/store/inputs';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
-import { QueryTemplateProps } from '../../../common/containers/query_template';
-
-import { overviewNetworkQuery } from './index.gql_query';
+import {
+  NetworkQueries,
+  NetworkOverviewRequestOptions,
+  NetworkOverviewStrategyResponse,
+} from '../../../../common/search_strategy/security_solution';
+import { useKibana } from '../../../common/lib/kibana';
+import { inputsModel } from '../../../common/store/inputs';
+import { createFilter } from '../../../common/containers/helpers';
+import { ESQuery } from '../../../../common/typed_json';
+import { AbortError } from '../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../helpers';
+import { InspectResponse } from '../../../types';
+import * as i18n from './translations';
 
 export const ID = 'overviewNetworkQuery';
 
-export interface OverviewNetworkArgs {
+export interface NetworkOverviewArgs {
   id: string;
-  inspect: inputsModel.InspectQuery;
-  overviewNetwork: OverviewNetworkData;
-  loading: boolean;
+  inspect: InspectResponse;
+  isInspected: boolean;
+  overviewNetwork: NetworkOverviewStrategyResponse['overviewNetwork'];
   refetch: inputsModel.Refetch;
 }
 
-export interface OverviewNetworkProps extends QueryTemplateProps {
-  children: (args: OverviewNetworkArgs) => React.ReactNode;
-  sourceId: string;
+interface UseNetworkOverview {
+  filterQuery?: ESQuery | string;
   endDate: string;
+  skip?: boolean;
   startDate: string;
 }
 
-export const OverviewNetworkComponentQuery = React.memo<OverviewNetworkProps & PropsFromRedux>(
-  ({ id = ID, children, filterQuery, isInspected, sourceId, startDate, endDate }) => (
-    <Query<GetOverviewNetworkQuery.Query, GetOverviewNetworkQuery.Variables>
-      query={overviewNetworkQuery}
-      fetchPolicy={getDefaultFetchPolicy()}
-      notifyOnNetworkStatusChange
-      variables={{
-        sourceId,
+export const useNetworkOverview = ({
+  filterQuery,
+  endDate,
+  skip = false,
+  startDate,
+}: UseNetworkOverview): [boolean, NetworkOverviewArgs] => {
+  const { data, notifications, uiSettings } = useKibana().services;
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const [loading, setLoading] = useState(false);
+  const [overviewNetworkRequest, setNetworkRequest] = useState<NetworkOverviewRequestOptions>({
+    defaultIndex,
+    factoryQueryType: NetworkQueries.overview,
+    filterQuery: createFilter(filterQuery),
+    timerange: {
+      interval: '12h',
+      from: startDate,
+      to: endDate,
+    },
+  });
+
+  const [overviewNetworkResponse, setNetworkOverviewResponse] = useState<NetworkOverviewArgs>({
+    overviewNetwork: {},
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    refetch: refetch.current,
+  });
+
+  const overviewNetworkSearch = useCallback(
+    (request: NetworkOverviewRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<NetworkOverviewRequestOptions, NetworkOverviewStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkOverviewResponse((prevResponse) => ({
+                    ...prevResponse,
+                    overviewNetwork: response.overviewNetwork,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    refetch: refetch.current,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_OVERVIEW);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_NETWORK_OVERVIEW,
+                  text: msg.message,
+                });
+              }
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
+
+  useEffect(() => {
+    setNetworkRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
         timerange: {
           interval: '12h',
           from: startDate,
           to: endDate,
         },
-        filterQuery: createFilter(filterQuery),
-        defaultIndex: useUiSetting<string[]>(DEFAULT_INDEX_KEY),
-        inspect: isInspected,
-      }}
-    >
-      {({ data, loading, refetch }) => {
-        const overviewNetwork = getOr({}, `source.OverviewNetwork`, data);
-        return children({
-          id,
-          inspect: getOr(null, 'source.OverviewNetwork.inspect', data),
-          overviewNetwork,
-          loading,
-          refetch,
-        });
-      }}
-    </Query>
-  )
-);
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [defaultIndex, endDate, filterQuery, skip, startDate]);
 
-OverviewNetworkComponentQuery.displayName = 'OverviewNetworkComponentQuery';
+  useEffect(() => {
+    overviewNetworkSearch(overviewNetworkRequest);
+  }, [overviewNetworkRequest, overviewNetworkSearch]);
 
-const makeMapStateToProps = () => {
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  const mapStateToProps = (state: State, { id = ID }: OverviewNetworkProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      isInspected,
-    };
-  };
-  return mapStateToProps;
+  return [loading, overviewNetworkResponse];
 };
-
-const connector = connect(makeMapStateToProps);
-
-type PropsFromRedux = ConnectedProps<typeof connector>;
-
-export const OverviewNetworkQuery = connector(OverviewNetworkComponentQuery);
diff --git a/x-pack/plugins/security_solution/public/overview/containers/overview_network/translations.ts b/x-pack/plugins/security_solution/public/overview/containers/overview_network/translations.ts
new file mode 100644
index 00000000000000..ac6b638a4ba011
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/overview/containers/overview_network/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_OVERVIEW = i18n.translate(
+  'xpack.securitySolution.allHost.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on all hosts search`,
+  }
+);
+
+export const FAIL_NETWORK_OVERVIEW = i18n.translate(
+  'xpack.securitySolution.allHost.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on all hosts`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/resolver/data_access_layer/factory.ts b/x-pack/plugins/security_solution/public/resolver/data_access_layer/factory.ts
index dee53a624baff5..55d52d4ba32524 100644
--- a/x-pack/plugins/security_solution/public/resolver/data_access_layer/factory.ts
+++ b/x-pack/plugins/security_solution/public/resolver/data_access_layer/factory.ts
@@ -12,7 +12,6 @@ import {
   ResolverTree,
   ResolverEntityIndex,
 } from '../../../common/endpoint/types';
-import { DEFAULT_INDEX_KEY as defaultIndexKey } from '../../../common/constants';
 
 /**
  * The data access layer for resolver. All communication with the Kibana server is done through this object. This object is provided to Resolver. In tests, a mock data access layer can be used instead.
@@ -38,13 +37,6 @@ export function dataAccessLayerFactory(
       });
     },
 
-    /**
-     * Used to get the default index pattern from the SIEM application.
-     */
-    indexPatterns(): string[] {
-      return context.services.uiSettings.get(defaultIndexKey);
-    },
-
     /**
      * Used to get the entity_id for an _id.
      */
diff --git a/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/emptify_mock.ts b/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/emptify_mock.ts
index 43282848dcf9a1..631eab18fc014e 100644
--- a/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/emptify_mock.ts
+++ b/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/emptify_mock.ts
@@ -12,7 +12,7 @@ import {
 import { mockTreeWithNoProcessEvents } from '../../mocks/resolver_tree';
 import { DataAccessLayer } from '../../types';
 
-type EmptiableRequests = 'relatedEvents' | 'resolverTree' | 'entities' | 'indexPatterns';
+type EmptiableRequests = 'relatedEvents' | 'resolverTree' | 'entities';
 
 interface Metadata<T> {
   /**
@@ -66,15 +66,6 @@ export function emptifyMock<T>(
           : dataAccessLayer.resolverTree(...args);
       },
 
-      /**
-       * Get an array of index patterns that contain events.
-       */
-      indexPatterns(...args): string[] {
-        return dataShouldBeEmpty.includes('indexPatterns')
-          ? []
-          : dataAccessLayer.indexPatterns(...args);
-      },
-
       /**
        * Get entities matching a document.
        */
diff --git a/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children.ts b/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children.ts
index b0407fa5d7c1d1..0883a3787fcced 100644
--- a/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children.ts
+++ b/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children.ts
@@ -78,13 +78,6 @@ export function noAncestorsTwoChildren(): { dataAccessLayer: DataAccessLayer; me
         );
       },
 
-      /**
-       * Get an array of index patterns that contain events.
-       */
-      indexPatterns(): string[] {
-        return ['index pattern'];
-      },
-
       /**
        * Get entities matching a document.
        */
diff --git a/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children_in_index_called_awesome_index.ts b/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children_in_index_called_awesome_index.ts
new file mode 100644
index 00000000000000..ec0fa934857832
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children_in_index_called_awesome_index.ts
@@ -0,0 +1,97 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  ResolverRelatedEvents,
+  ResolverTree,
+  ResolverEntityIndex,
+} from '../../../../common/endpoint/types';
+import { mockEndpointEvent } from '../../mocks/endpoint_event';
+import { mockTreeWithNoAncestorsAnd2Children } from '../../mocks/resolver_tree';
+import { DataAccessLayer } from '../../types';
+
+interface Metadata {
+  /**
+   * The `_id` of the document being analyzed.
+   */
+  databaseDocumentID: string;
+  /**
+   * A record of entityIDs to be used in tests assertions.
+   */
+  entityIDs: {
+    /**
+     * The entityID of the node related to the document being analyzed.
+     */
+    origin: 'origin';
+    /**
+     * The entityID of the first child of the origin.
+     */
+    firstChild: 'firstChild';
+    /**
+     * The entityID of the second child of the origin.
+     */
+    secondChild: 'secondChild';
+  };
+}
+
+/**
+ * A mock DataAccessLayer that will return an origin in two children. The `entity` response will be empty unless
+ * `awesome_index` is passed in the indices array.
+ */
+export function noAncestorsTwoChildenInIndexCalledAwesomeIndex(): {
+  dataAccessLayer: DataAccessLayer;
+  metadata: Metadata;
+} {
+  const metadata: Metadata = {
+    databaseDocumentID: '_id',
+    entityIDs: { origin: 'origin', firstChild: 'firstChild', secondChild: 'secondChild' },
+  };
+  return {
+    metadata,
+    dataAccessLayer: {
+      /**
+       * Fetch related events for an entity ID
+       */
+      relatedEvents(entityID: string): Promise<ResolverRelatedEvents> {
+        return Promise.resolve({
+          entityID,
+          events: [
+            mockEndpointEvent({
+              entityID,
+              name: 'event',
+              timestamp: 0,
+            }),
+          ],
+          nextEvent: null,
+        });
+      },
+
+      /**
+       * Fetch a ResolverTree for a entityID
+       */
+      resolverTree(): Promise<ResolverTree> {
+        return Promise.resolve(
+          mockTreeWithNoAncestorsAnd2Children({
+            originID: metadata.entityIDs.origin,
+            firstChildID: metadata.entityIDs.firstChild,
+            secondChildID: metadata.entityIDs.secondChild,
+          })
+        );
+      },
+
+      /**
+       * Get entities matching a document.
+       */
+      entities({ indices }): Promise<ResolverEntityIndex> {
+        // Only return values if the `indices` array contains exactly `'awesome_index'`
+        if (indices.length === 1 && indices[0] === 'awesome_index') {
+          return Promise.resolve([{ entity_id: metadata.entityIDs.origin }]);
+        }
+        return Promise.resolve([]);
+      },
+    },
+  };
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children_with_related_events_on_origin.ts b/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children_with_related_events_on_origin.ts
index 01e75e3eefdbfa..95ec0cd1a5f775 100644
--- a/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children_with_related_events_on_origin.ts
+++ b/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children_with_related_events_on_origin.ts
@@ -76,13 +76,6 @@ export function noAncestorsTwoChildrenWithRelatedEventsOnOrigin(): {
         return Promise.resolve(tree);
       },
 
-      /**
-       * Get an array of index patterns that contain events.
-       */
-      indexPatterns(): string[] {
-        return ['index pattern'];
-      },
-
       /**
        * Get entities matching a document.
        */
diff --git a/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/pausify_mock.ts b/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/pausify_mock.ts
index baddcdfd0cd841..6a4955b104b8fb 100644
--- a/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/pausify_mock.ts
+++ b/x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/pausify_mock.ts
@@ -105,13 +105,6 @@ export function pausifyMock<T>({
         return dataAccessLayer.resolverTree(...args);
       },
 
-      /**
-       * Get an array of index patterns that contain events.
-       */
-      indexPatterns(...args): string[] {
-        return dataAccessLayer.indexPatterns(...args);
-      },
-
       /**
        * Get entities matching a document.
        */
diff --git a/x-pack/plugins/security_solution/public/resolver/mocks/tree_fetcher_parameters.ts b/x-pack/plugins/security_solution/public/resolver/mocks/tree_fetcher_parameters.ts
new file mode 100644
index 00000000000000..98efb459a0691b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/mocks/tree_fetcher_parameters.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { TreeFetcherParameters } from '../types';
+
+/**
+ * A factory for the most basic `TreeFetcherParameters`. Many tests need to provide this even when the values aren't relevant to the test.
+ */
+export function mockTreeFetcherParameters(): TreeFetcherParameters {
+  return {
+    databaseDocumentID: '',
+    indices: [],
+  };
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/models/tree_fetcher_parameters.test.ts b/x-pack/plugins/security_solution/public/resolver/models/tree_fetcher_parameters.test.ts
new file mode 100644
index 00000000000000..faa4edfccdc350
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/models/tree_fetcher_parameters.test.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { TreeFetcherParameters } from '../types';
+
+import { equal } from './tree_fetcher_parameters';
+describe('TreeFetcherParameters#equal:', () => {
+  const cases: Array<[TreeFetcherParameters, TreeFetcherParameters, boolean]> = [
+    // different databaseDocumentID
+    [{ databaseDocumentID: 'a', indices: [] }, { databaseDocumentID: 'b', indices: [] }, false],
+    // different indices length
+    [{ databaseDocumentID: 'a', indices: [''] }, { databaseDocumentID: 'a', indices: [] }, false],
+    // same indices length, different databaseDocumentID
+    [{ databaseDocumentID: 'a', indices: [''] }, { databaseDocumentID: 'b', indices: [''] }, false],
+    // 1 item in `indices`
+    [{ databaseDocumentID: 'b', indices: [''] }, { databaseDocumentID: 'b', indices: [''] }, true],
+    // 2 item in `indices`
+    [
+      { databaseDocumentID: 'b', indices: ['1', '2'] },
+      { databaseDocumentID: 'b', indices: ['1', '2'] },
+      true,
+    ],
+    // 2 item in `indices`, but order inversed
+    [
+      { databaseDocumentID: 'b', indices: ['2', '1'] },
+      { databaseDocumentID: 'b', indices: ['1', '2'] },
+      true,
+    ],
+  ];
+  describe.each(cases)('%p when compared to %p', (first, second, expected) => {
+    it(`should ${expected ? '' : 'not'}be equal`, () => {
+      expect(equal(first, second)).toBe(expected);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/resolver/models/tree_fetcher_parameters.ts b/x-pack/plugins/security_solution/public/resolver/models/tree_fetcher_parameters.ts
new file mode 100644
index 00000000000000..d8280c7490901c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/models/tree_fetcher_parameters.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { TreeFetcherParameters } from '../types';
+
+/**
+ * Determine if two instances of `TreeFetcherParameters` are equivalent. Use this to determine if
+ * a change to a `TreeFetcherParameters` warrants invaliding a request or response.
+ */
+export function equal(param1: TreeFetcherParameters, param2?: TreeFetcherParameters): boolean {
+  if (!param2) {
+    return false;
+  }
+  if (param1 === param2) {
+    return true;
+  }
+  if (param1.databaseDocumentID !== param2.databaseDocumentID) {
+    return false;
+  }
+  return arraysContainTheSameElements(param1.indices, param2.indices);
+}
+
+function arraysContainTheSameElements(first: unknown[], second: unknown[]): boolean {
+  if (first === second) {
+    return true;
+  }
+  if (first.length !== second.length) {
+    return false;
+  }
+  const firstSet = new Set(first);
+  for (let index = 0; index < second.length; index++) {
+    if (!firstSet.has(second[index])) {
+      return false;
+    }
+  }
+  return true;
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/store/actions.ts b/x-pack/plugins/security_solution/public/resolver/store/actions.ts
index e03f24d78e2a20..7d71cbd97b9ee7 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/actions.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/actions.ts
@@ -115,7 +115,7 @@ interface AppReceivedNewExternalProperties {
     /**
      * the `_id` of an ES document. This defines the origin of the Resolver graph.
      */
-    databaseDocumentID?: string;
+    databaseDocumentID: string;
     /**
      * An ID that uniquely identifies this Resolver instance from other concurrent Resolvers.
      */
@@ -125,6 +125,11 @@ interface AppReceivedNewExternalProperties {
      * The `search` part of the URL of this page.
      */
     locationSearch: string;
+
+    /**
+     * Indices that the backend will use to find the document.
+     */
+    indices: string[];
   };
 }
 
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/action.ts b/x-pack/plugins/security_solution/public/resolver/store/data/action.ts
index 466c37d4ad5f1c..59d1494ae8c272 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/action.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/action.ts
@@ -5,6 +5,7 @@
  */
 
 import { ResolverRelatedEvents, ResolverTree } from '../../../../common/endpoint/types';
+import { TreeFetcherParameters } from '../../types';
 
 interface ServerReturnedResolverData {
   readonly type: 'serverReturnedResolverData';
@@ -14,9 +15,9 @@ interface ServerReturnedResolverData {
      */
     result: ResolverTree;
     /**
-     * The database document ID that was used to fetch the resolver tree
+     * The database parameters that was used to fetch the resolver tree
      */
-    databaseDocumentID: string;
+    parameters: TreeFetcherParameters;
   };
 }
 
@@ -25,7 +26,7 @@ interface AppRequestedResolverData {
   /**
    * entity ID used to make the request.
    */
-  readonly payload: string;
+  readonly payload: TreeFetcherParameters;
 }
 
 interface ServerFailedToReturnResolverData {
@@ -33,7 +34,7 @@ interface ServerFailedToReturnResolverData {
   /**
    * entity ID used to make the failed request
    */
-  readonly payload: string;
+  readonly payload: TreeFetcherParameters;
 }
 
 interface AppAbortedResolverDataRequest {
@@ -41,7 +42,7 @@ interface AppAbortedResolverDataRequest {
   /**
    * entity ID used to make the aborted request
    */
-  readonly payload: string;
+  readonly payload: TreeFetcherParameters;
 }
 
 /**
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/reducer.test.ts b/x-pack/plugins/security_solution/public/resolver/store/data/reducer.test.ts
index e087db9f74685a..e6e525334e818d 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/reducer.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/reducer.test.ts
@@ -12,6 +12,7 @@ import { DataState } from '../../types';
 import { DataAction } from './action';
 import { ResolverChildNode, ResolverTree } from '../../../../common/endpoint/types';
 import * as eventModel from '../../../../common/endpoint/models/event';
+import { mockTreeFetcherParameters } from '../../mocks/tree_fetcher_parameters';
 
 /**
  * Test the data reducer and selector.
@@ -27,7 +28,7 @@ describe('Resolver Data Middleware', () => {
         type: 'serverReturnedResolverData',
         payload: {
           result: tree,
-          databaseDocumentID: '',
+          parameters: mockTreeFetcherParameters(),
         },
       };
       store.dispatch(action);
@@ -59,6 +60,7 @@ describe('Resolver Data Middleware', () => {
     let firstChildNodeInTree: TreeNode;
     let eventStatsForFirstChildNode: { total: number; byCategory: Record<string, number> };
     let categoryToOverCount: string;
+    let aggregateCategoryTotalForFirstChildNode: number;
     let tree: ResolverTree;
 
     /**
@@ -73,6 +75,7 @@ describe('Resolver Data Middleware', () => {
         firstChildNodeInTree,
         eventStatsForFirstChildNode,
         categoryToOverCount,
+        aggregateCategoryTotalForFirstChildNode,
       } = mockedTree());
       if (tree) {
         dispatchTree(tree);
@@ -138,6 +141,13 @@ describe('Resolver Data Middleware', () => {
           expect(notDisplayed(typeCounted)).toBe(0);
         }
       });
+      it('should return an overall correct count for the number of related events', () => {
+        const aggregateTotalByEntityId = selectors.relatedEventAggregateTotalByEntityId(
+          store.getState()
+        );
+        const countForId = aggregateTotalByEntityId(firstChildNodeInTree.id);
+        expect(countForId).toBe(aggregateCategoryTotalForFirstChildNode);
+      });
     });
     describe('when data was received and stats show more related events than the API can provide', () => {
       beforeEach(() => {
@@ -262,6 +272,7 @@ function mockedTree() {
     tree: tree!,
     firstChildNodeInTree,
     eventStatsForFirstChildNode: statsResults.eventStats,
+    aggregateCategoryTotalForFirstChildNode: statsResults.aggregateCategoryTotal,
     categoryToOverCount: statsResults.firstCategory,
   };
 }
@@ -288,6 +299,7 @@ function compileStatsForChild(
   };
   /** The category of the first event.  */
   firstCategory: string;
+  aggregateCategoryTotal: number;
 } {
   const totalRelatedEvents = node.relatedEvents.length;
   // For the purposes of testing, we pick one category to fake an extra event for
@@ -295,6 +307,12 @@ function compileStatsForChild(
 
   let firstCategory: string | undefined;
 
+  // This is the "aggregate total" which is displayed to users as the total count
+  // of related events for the node. It is tallied by incrementing for every discrete
+  // event.category in an event.category array (or just 1 for a plain string). E.g. two events
+  // categories 'file' and ['dns','network'] would have an `aggregate total` of 3.
+  let aggregateCategoryTotal: number = 0;
+
   const compiledStats = node.relatedEvents.reduce(
     (counts: Record<string, number>, relatedEvent) => {
       // `relatedEvent.event.category` is `string | string[]`.
@@ -310,6 +328,7 @@ function compileStatsForChild(
 
         // Increment the count of events with this category
         counts[category] = counts[category] ? counts[category] + 1 : 1;
+        aggregateCategoryTotal++;
       }
       return counts;
     },
@@ -327,5 +346,6 @@ function compileStatsForChild(
       byCategory: compiledStats,
     },
     firstCategory,
+    aggregateCategoryTotal,
   };
 }
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/reducer.ts b/x-pack/plugins/security_solution/public/resolver/store/data/reducer.ts
index c43182ddbf835f..c8df95aaee6f42 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/reducer.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/reducer.ts
@@ -7,34 +7,53 @@
 import { Reducer } from 'redux';
 import { DataState } from '../../types';
 import { ResolverAction } from '../actions';
+import * as treeFetcherParameters from '../../models/tree_fetcher_parameters';
 
 const initialState: DataState = {
   relatedEvents: new Map(),
   relatedEventsReady: new Map(),
   resolverComponentInstanceID: undefined,
+  tree: {},
 };
 
 export const dataReducer: Reducer<DataState, ResolverAction> = (state = initialState, action) => {
   if (action.type === 'appReceivedNewExternalProperties') {
     const nextState: DataState = {
       ...state,
-      databaseDocumentID: action.payload.databaseDocumentID,
+      tree: {
+        ...state.tree,
+        currentParameters: {
+          databaseDocumentID: action.payload.databaseDocumentID,
+          indices: action.payload.indices,
+        },
+      },
       resolverComponentInstanceID: action.payload.resolverComponentInstanceID,
     };
     return nextState;
   } else if (action.type === 'appRequestedResolverData') {
     // keep track of what we're requesting, this way we know when to request and when not to.
-    return {
+    const nextState: DataState = {
       ...state,
-      pendingRequestDatabaseDocumentID: action.payload,
+      tree: {
+        ...state.tree,
+        pendingRequestParameters: {
+          databaseDocumentID: action.payload.databaseDocumentID,
+          indices: action.payload.indices,
+        },
+      },
     };
+    return nextState;
   } else if (action.type === 'appAbortedResolverDataRequest') {
-    if (action.payload === state.pendingRequestDatabaseDocumentID) {
+    if (treeFetcherParameters.equal(action.payload, state.tree.pendingRequestParameters)) {
       // the request we were awaiting was aborted
-      return {
+      const nextState: DataState = {
         ...state,
-        pendingRequestDatabaseDocumentID: undefined,
+        tree: {
+          ...state.tree,
+          pendingRequestParameters: undefined,
+        },
       };
+      return nextState;
     } else {
       return state;
     }
@@ -43,29 +62,35 @@ export const dataReducer: Reducer<DataState, ResolverAction> = (state = initialS
     const nextState: DataState = {
       ...state,
 
-      /**
-       * Store the last received data, as well as the databaseDocumentID it relates to.
-       */
-      lastResponse: {
-        result: action.payload.result,
-        databaseDocumentID: action.payload.databaseDocumentID,
-        successful: true,
-      },
+      tree: {
+        ...state.tree,
+        /**
+         * Store the last received data, as well as the databaseDocumentID it relates to.
+         */
+        lastResponse: {
+          result: action.payload.result,
+          parameters: action.payload.parameters,
+          successful: true,
+        },
 
-      // This assumes that if we just received something, there is no longer a pending request.
-      // This cannot model multiple in-flight requests
-      pendingRequestDatabaseDocumentID: undefined,
+        // This assumes that if we just received something, there is no longer a pending request.
+        // This cannot model multiple in-flight requests
+        pendingRequestParameters: undefined,
+      },
     };
     return nextState;
   } else if (action.type === 'serverFailedToReturnResolverData') {
     /** Only handle this if we are expecting a response */
-    if (state.pendingRequestDatabaseDocumentID !== undefined) {
+    if (state.tree.pendingRequestParameters !== undefined) {
       const nextState: DataState = {
         ...state,
-        pendingRequestDatabaseDocumentID: undefined,
-        lastResponse: {
-          databaseDocumentID: state.pendingRequestDatabaseDocumentID,
-          successful: false,
+        tree: {
+          ...state.tree,
+          pendingRequestParameters: undefined,
+          lastResponse: {
+            parameters: state.tree.pendingRequestParameters,
+            successful: false,
+          },
         },
       };
       return nextState;
@@ -76,16 +101,18 @@ export const dataReducer: Reducer<DataState, ResolverAction> = (state = initialS
     action.type === 'userRequestedRelatedEventData' ||
     action.type === 'appDetectedMissingEventData'
   ) {
-    return {
+    const nextState: DataState = {
       ...state,
       relatedEventsReady: new Map([...state.relatedEventsReady, [action.payload, false]]),
     };
+    return nextState;
   } else if (action.type === 'serverReturnedRelatedEventData') {
-    return {
+    const nextState: DataState = {
       ...state,
       relatedEventsReady: new Map([...state.relatedEventsReady, [action.payload.entityID, true]]),
       relatedEvents: new Map([...state.relatedEvents, [action.payload.entityID, action.payload]]),
     };
+    return nextState;
   } else {
     return state;
   }
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.test.ts b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.test.ts
index dc478ede727902..539325faffdf03 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.test.ts
@@ -18,6 +18,7 @@ import {
 } from '../../mocks/resolver_tree';
 import { uniquePidForProcess } from '../../models/process_event';
 import { EndpointEvent } from '../../../../common/endpoint/types';
+import { mockTreeFetcherParameters } from '../../mocks/tree_fetcher_parameters';
 
 describe('data state', () => {
   let actions: ResolverAction[] = [];
@@ -39,29 +40,32 @@ describe('data state', () => {
    */
   const viewAsAString = (dataState: DataState) => {
     return [
-      ['is loading', selectors.isLoading(dataState)],
-      ['has an error', selectors.hasError(dataState)],
+      ['is loading', selectors.isTreeLoading(dataState)],
+      ['has an error', selectors.hadErrorLoadingTree(dataState)],
       ['has more children', selectors.hasMoreChildren(dataState)],
       ['has more ancestors', selectors.hasMoreAncestors(dataState)],
-      ['document to fetch', selectors.databaseDocumentIDToFetch(dataState)],
-      ['requires a pending request to be aborted', selectors.databaseDocumentIDToAbort(dataState)],
+      ['parameters to fetch', selectors.treeParametersToFetch(dataState)],
+      [
+        'requires a pending request to be aborted',
+        selectors.treeRequestParametersToAbort(dataState),
+      ],
     ]
       .map(([message, value]) => `${message}: ${JSON.stringify(value)}`)
       .join('\n');
   };
 
-  it(`shouldn't initially be loading, or have an error, or have more children or ancestors, or have a document to fetch, or have a pending request that needs to be aborted.`, () => {
+  it(`shouldn't initially be loading, or have an error, or have more children or ancestors, or have a request to make, or have a pending request that needs to be aborted.`, () => {
     expect(viewAsAString(state())).toMatchInlineSnapshot(`
       "is loading: false
       has an error: false
       has more children: false
       has more ancestors: false
-      document to fetch: null
+      parameters to fetch: null
       requires a pending request to be aborted: null"
     `);
   });
 
-  describe('when there is a databaseDocumentID but no pending request', () => {
+  describe('when there are parameters to fetch but no pending request', () => {
     const databaseDocumentID = 'databaseDocumentID';
     const resolverComponentInstanceID = 'resolverComponentInstanceID';
     beforeEach(() => {
@@ -74,12 +78,13 @@ describe('data state', () => {
 
             // `locationSearch` doesn't matter for this test
             locationSearch: '',
+            indices: [],
           },
         },
       ];
     });
-    it('should need to fetch the databaseDocumentID', () => {
-      expect(selectors.databaseDocumentIDToFetch(state())).toBe(databaseDocumentID);
+    it('should need to request the tree', () => {
+      expect(selectors.treeParametersToFetch(state())?.databaseDocumentID).toBe(databaseDocumentID);
     });
     it('should not be loading, have an error, have more children or ancestors, or have a pending request that needs to be aborted.', () => {
       expect(viewAsAString(state())).toMatchInlineSnapshot(`
@@ -87,39 +92,41 @@ describe('data state', () => {
         has an error: false
         has more children: false
         has more ancestors: false
-        document to fetch: \\"databaseDocumentID\\"
+        parameters to fetch: {\\"databaseDocumentID\\":\\"databaseDocumentID\\",\\"indices\\":[]}
         requires a pending request to be aborted: null"
       `);
     });
   });
-  describe('when there is a pending request but no databaseDocumentID', () => {
+  describe('when there is a pending request but no current tree fetching parameters', () => {
     const databaseDocumentID = 'databaseDocumentID';
     beforeEach(() => {
       actions = [
         {
           type: 'appRequestedResolverData',
-          payload: databaseDocumentID,
+          payload: { databaseDocumentID, indices: [] },
         },
       ];
     });
     it('should be loading', () => {
-      expect(selectors.isLoading(state())).toBe(true);
+      expect(selectors.isTreeLoading(state())).toBe(true);
     });
     it('should have a request to abort', () => {
-      expect(selectors.databaseDocumentIDToAbort(state())).toBe(databaseDocumentID);
+      expect(selectors.treeRequestParametersToAbort(state())?.databaseDocumentID).toBe(
+        databaseDocumentID
+      );
     });
-    it('should not have an error, more children, more ancestors, or a document to fetch.', () => {
+    it('should not have an error, more children, more ancestors, or request to make.', () => {
       expect(viewAsAString(state())).toMatchInlineSnapshot(`
         "is loading: true
         has an error: false
         has more children: false
         has more ancestors: false
-        document to fetch: null
-        requires a pending request to be aborted: \\"databaseDocumentID\\""
+        parameters to fetch: null
+        requires a pending request to be aborted: {\\"databaseDocumentID\\":\\"databaseDocumentID\\",\\"indices\\":[]}"
       `);
     });
   });
-  describe('when there is a pending request for the current databaseDocumentID', () => {
+  describe('when there is a pending request that was made using the current parameters', () => {
     const databaseDocumentID = 'databaseDocumentID';
     const resolverComponentInstanceID = 'resolverComponentInstanceID';
     beforeEach(() => {
@@ -132,27 +139,28 @@ describe('data state', () => {
 
             // `locationSearch` doesn't matter for this test
             locationSearch: '',
+            indices: [],
           },
         },
         {
           type: 'appRequestedResolverData',
-          payload: databaseDocumentID,
+          payload: { databaseDocumentID, indices: [] },
         },
       ];
     });
     it('should be loading', () => {
-      expect(selectors.isLoading(state())).toBe(true);
+      expect(selectors.isTreeLoading(state())).toBe(true);
     });
     it('should not have a request to abort', () => {
-      expect(selectors.databaseDocumentIDToAbort(state())).toBe(null);
+      expect(selectors.treeRequestParametersToAbort(state())).toBe(null);
     });
-    it('should not have an error, more children, more ancestors, a document to begin fetching, or a pending request that should be aborted.', () => {
+    it('should not have an error, more children, more ancestors, a request to make, or a pending request that should be aborted.', () => {
       expect(viewAsAString(state())).toMatchInlineSnapshot(`
         "is loading: true
         has an error: false
         has more children: false
         has more ancestors: false
-        document to fetch: null
+        parameters to fetch: null
         requires a pending request to be aborted: null"
       `);
     });
@@ -160,28 +168,28 @@ describe('data state', () => {
       beforeEach(() => {
         actions.push({
           type: 'serverFailedToReturnResolverData',
-          payload: databaseDocumentID,
+          payload: { databaseDocumentID, indices: [] },
         });
       });
       it('should not be loading', () => {
-        expect(selectors.isLoading(state())).toBe(false);
+        expect(selectors.isTreeLoading(state())).toBe(false);
       });
       it('should have an error', () => {
-        expect(selectors.hasError(state())).toBe(true);
+        expect(selectors.hadErrorLoadingTree(state())).toBe(true);
       });
-      it('should not be loading, have more children, have more ancestors, have a document to fetch, or have a pending request that needs to be aborted.', () => {
+      it('should not be loading, have more children, have more ancestors, have a request to make, or have a pending request that needs to be aborted.', () => {
         expect(viewAsAString(state())).toMatchInlineSnapshot(`
           "is loading: false
           has an error: true
           has more children: false
           has more ancestors: false
-          document to fetch: null
+          parameters to fetch: null
           requires a pending request to be aborted: null"
         `);
       });
     });
   });
-  describe('when there is a pending request for a different databaseDocumentID than the current one', () => {
+  describe('when there is a pending request that was made with parameters that are different than the current tree fetching parameters', () => {
     const firstDatabaseDocumentID = 'first databaseDocumentID';
     const secondDatabaseDocumentID = 'second databaseDocumentID';
     const resolverComponentInstanceID1 = 'resolverComponentInstanceID1';
@@ -196,12 +204,13 @@ describe('data state', () => {
             resolverComponentInstanceID: resolverComponentInstanceID1,
             // `locationSearch` doesn't matter for this test
             locationSearch: '',
+            indices: [],
           },
         },
         // this happens when the middleware starts the request
         {
           type: 'appRequestedResolverData',
-          payload: firstDatabaseDocumentID,
+          payload: { databaseDocumentID: firstDatabaseDocumentID, indices: [] },
         },
         // receive a different databaseDocumentID. this should cause the middleware to abort the existing request and start a new one
         {
@@ -211,18 +220,23 @@ describe('data state', () => {
             resolverComponentInstanceID: resolverComponentInstanceID2,
             // `locationSearch` doesn't matter for this test
             locationSearch: '',
+            indices: [],
           },
         },
       ];
     });
     it('should be loading', () => {
-      expect(selectors.isLoading(state())).toBe(true);
+      expect(selectors.isTreeLoading(state())).toBe(true);
     });
-    it('should need to fetch the second databaseDocumentID', () => {
-      expect(selectors.databaseDocumentIDToFetch(state())).toBe(secondDatabaseDocumentID);
+    it('should need to request the tree using the second set of parameters', () => {
+      expect(selectors.treeParametersToFetch(state())?.databaseDocumentID).toBe(
+        secondDatabaseDocumentID
+      );
     });
     it('should need to abort the request for the databaseDocumentID', () => {
-      expect(selectors.databaseDocumentIDToFetch(state())).toBe(secondDatabaseDocumentID);
+      expect(selectors.treeParametersToFetch(state())?.databaseDocumentID).toBe(
+        secondDatabaseDocumentID
+      );
     });
     it('should use the correct location for the second resolver', () => {
       expect(selectors.resolverComponentInstanceID(state())).toBe(resolverComponentInstanceID2);
@@ -233,25 +247,27 @@ describe('data state', () => {
         has an error: false
         has more children: false
         has more ancestors: false
-        document to fetch: \\"second databaseDocumentID\\"
-        requires a pending request to be aborted: \\"first databaseDocumentID\\""
+        parameters to fetch: {\\"databaseDocumentID\\":\\"second databaseDocumentID\\",\\"indices\\":[]}
+        requires a pending request to be aborted: {\\"databaseDocumentID\\":\\"first databaseDocumentID\\",\\"indices\\":[]}"
       `);
     });
     describe('and when the old request was aborted', () => {
       beforeEach(() => {
         actions.push({
           type: 'appAbortedResolverDataRequest',
-          payload: firstDatabaseDocumentID,
+          payload: { databaseDocumentID: firstDatabaseDocumentID, indices: [] },
         });
       });
       it('should not require a pending request to be aborted', () => {
-        expect(selectors.databaseDocumentIDToAbort(state())).toBe(null);
+        expect(selectors.treeRequestParametersToAbort(state())).toBe(null);
       });
       it('should have a document to fetch', () => {
-        expect(selectors.databaseDocumentIDToFetch(state())).toBe(secondDatabaseDocumentID);
+        expect(selectors.treeParametersToFetch(state())?.databaseDocumentID).toBe(
+          secondDatabaseDocumentID
+        );
       });
       it('should not be loading', () => {
-        expect(selectors.isLoading(state())).toBe(false);
+        expect(selectors.isTreeLoading(state())).toBe(false);
       });
       it('should not have an error, more children, or more ancestors.', () => {
         expect(viewAsAString(state())).toMatchInlineSnapshot(`
@@ -259,7 +275,7 @@ describe('data state', () => {
           has an error: false
           has more children: false
           has more ancestors: false
-          document to fetch: \\"second databaseDocumentID\\"
+          parameters to fetch: {\\"databaseDocumentID\\":\\"second databaseDocumentID\\",\\"indices\\":[]}
           requires a pending request to be aborted: null"
         `);
       });
@@ -267,14 +283,14 @@ describe('data state', () => {
         beforeEach(() => {
           actions.push({
             type: 'appRequestedResolverData',
-            payload: secondDatabaseDocumentID,
+            payload: { databaseDocumentID: secondDatabaseDocumentID, indices: [] },
           });
         });
         it('should not have a document ID to fetch', () => {
-          expect(selectors.databaseDocumentIDToFetch(state())).toBe(null);
+          expect(selectors.treeParametersToFetch(state())).toBe(null);
         });
         it('should be loading', () => {
-          expect(selectors.isLoading(state())).toBe(true);
+          expect(selectors.isTreeLoading(state())).toBe(true);
         });
         it('should not have an error, more children, more ancestors, or a pending request that needs to be aborted.', () => {
           expect(viewAsAString(state())).toMatchInlineSnapshot(`
@@ -282,7 +298,7 @@ describe('data state', () => {
             has an error: false
             has more children: false
             has more ancestors: false
-            document to fetch: null
+            parameters to fetch: null
             requires a pending request to be aborted: null"
           `);
         });
@@ -303,7 +319,7 @@ describe('data state', () => {
             secondAncestorID,
           }),
           // this value doesn't matter
-          databaseDocumentID: '',
+          parameters: mockTreeFetcherParameters(),
         },
       });
     });
@@ -331,7 +347,7 @@ describe('data state', () => {
             secondAncestorID,
           }),
           // this value doesn't matter
-          databaseDocumentID: '',
+          parameters: mockTreeFetcherParameters(),
         },
       });
     });
@@ -355,7 +371,7 @@ describe('data state', () => {
         payload: {
           result: mockTreeWithNoAncestorsAnd2Children({ originID, firstChildID, secondChildID }),
           // this value doesn't matter
-          databaseDocumentID: '',
+          parameters: mockTreeFetcherParameters(),
         },
       });
     });
@@ -386,7 +402,7 @@ describe('data state', () => {
         payload: {
           result: tree,
           // this value doesn't matter
-          databaseDocumentID: '',
+          parameters: mockTreeFetcherParameters(),
         },
       });
     });
@@ -417,7 +433,7 @@ describe('data state', () => {
         payload: {
           result: tree,
           // this value doesn't matter
-          databaseDocumentID: '',
+          parameters: mockTreeFetcherParameters(),
         },
       });
     });
@@ -433,7 +449,7 @@ describe('data state', () => {
         payload: {
           result: tree,
           // this value doesn't matter
-          databaseDocumentID: '',
+          parameters: mockTreeFetcherParameters(),
         },
       });
     });
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
index 965547f1e309a9..e647828ddb6064 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
@@ -15,6 +15,7 @@ import {
   AABB,
   VisibleEntites,
   SectionData,
+  TreeFetcherParameters,
 } from '../../types';
 import {
   isGraphableProcess,
@@ -34,6 +35,7 @@ import {
   LegacyEndpointEvent,
 } from '../../../../common/endpoint/types';
 import * as resolverTreeModel from '../../models/resolver_tree';
+import * as treeFetcherParametersModel from '../../models/tree_fetcher_parameters';
 import * as isometricTaxiLayoutModel from '../../models/indexed_process_tree/isometric_taxi_layout';
 import * as eventModel from '../../../../common/endpoint/models/event';
 import * as vector2 from '../../models/vector2';
@@ -42,26 +44,25 @@ import { formatDate } from '../../view/panels/panel_content_utilities';
 /**
  * If there is currently a request.
  */
-export function isLoading(state: DataState): boolean {
-  return state.pendingRequestDatabaseDocumentID !== undefined;
+export function isTreeLoading(state: DataState): boolean {
+  return state.tree.pendingRequestParameters !== undefined;
 }
 
 /**
- * A string for uniquely identifying the instance of resolver within the app.
+ * If a request was made and it threw an error or returned a failure response code.
  */
-export function resolverComponentInstanceID(state: DataState): string {
-  return state.resolverComponentInstanceID ? state.resolverComponentInstanceID : '';
+export function hadErrorLoadingTree(state: DataState): boolean {
+  if (state.tree.lastResponse) {
+    return !state.tree.lastResponse.successful;
+  }
+  return false;
 }
 
 /**
- * If a request was made and it threw an error or returned a failure response code.
+ * A string for uniquely identifying the instance of resolver within the app.
  */
-export function hasError(state: DataState): boolean {
-  if (state.lastResponse && state.lastResponse.successful === false) {
-    return true;
-  } else {
-    return false;
-  }
+export function resolverComponentInstanceID(state: DataState): string {
+  return state.resolverComponentInstanceID ? state.resolverComponentInstanceID : '';
 }
 
 /**
@@ -69,11 +70,7 @@ export function hasError(state: DataState): boolean {
  * we're currently interested in.
  */
 const resolverTreeResponse = (state: DataState): ResolverTree | undefined => {
-  if (state.lastResponse && state.lastResponse.successful) {
-    return state.lastResponse.result;
-  } else {
-    return undefined;
-  }
+  return state.tree.lastResponse?.successful ? state.tree.lastResponse.result : undefined;
 };
 
 /**
@@ -170,6 +167,26 @@ export const relatedEventsStats: (
   }
 );
 
+/**
+ * This returns the "aggregate total" for related events, tallied as the sum
+ * of their individual `event.category`s. E.g. a [DNS, Network] would count as two
+ * towards the aggregate total.
+ */
+export const relatedEventAggregateTotalByEntityId: (
+  state: DataState
+) => (entityId: string) => number = createSelector(relatedEventsStats, (relatedStats) => {
+  return (entityId) => {
+    const statsForEntity = relatedStats(entityId);
+    if (statsForEntity === undefined) {
+      return 0;
+    }
+    return Object.values(statsForEntity?.events?.byCategory || {}).reduce(
+      (sum, val) => sum + val,
+      0
+    );
+  };
+});
+
 /**
  * returns a map of entity_ids to related event data.
  */
@@ -438,18 +455,24 @@ export const relatedEventInfoByEntityId: (
 );
 
 /**
- * If we need to fetch, this is the ID to fetch.
+ * If the tree resource needs to be fetched then these are the parameters that should be used.
  */
-export function databaseDocumentIDToFetch(state: DataState): string | null {
-  // If there is an ID, it must match either the last received version, or the pending version.
-  // Otherwise, we need to fetch it
-  // NB: this technique will not allow for refreshing of data.
+export function treeParametersToFetch(state: DataState): TreeFetcherParameters | null {
+  /**
+   * If there are current tree parameters that don't match the parameters used in the pending request (if there is a pending request) and that don't match the parameters used in the last completed request (if there was a last completed request) then we need to fetch the tree resource using the current parameters.
+   */
   if (
-    state.databaseDocumentID !== undefined &&
-    state.databaseDocumentID !== state.pendingRequestDatabaseDocumentID &&
-    state.databaseDocumentID !== state.lastResponse?.databaseDocumentID
+    state.tree.currentParameters !== undefined &&
+    !treeFetcherParametersModel.equal(
+      state.tree.currentParameters,
+      state.tree.lastResponse?.parameters
+    ) &&
+    !treeFetcherParametersModel.equal(
+      state.tree.currentParameters,
+      state.tree.pendingRequestParameters
+    )
   ) {
-    return state.databaseDocumentID;
+    return state.tree.currentParameters;
   } else {
     return null;
   }
@@ -672,15 +695,18 @@ export const nodesAndEdgelines: (
 /**
  * If there is a pending request that's for a entity ID that doesn't matche the `entityID`, then we should cancel it.
  */
-export function databaseDocumentIDToAbort(state: DataState): string | null {
+export function treeRequestParametersToAbort(state: DataState): TreeFetcherParameters | null {
   /**
-   * If there is a pending request, and its not for the current databaseDocumentID (even, if the current databaseDocumentID is undefined) then we should abort the request.
+   * If there is a pending request, and its not for the current parameters (even, if the current parameters are undefined) then we should abort the request.
    */
   if (
-    state.pendingRequestDatabaseDocumentID !== undefined &&
-    state.pendingRequestDatabaseDocumentID !== state.databaseDocumentID
+    state.tree.pendingRequestParameters !== undefined &&
+    !treeFetcherParametersModel.equal(
+      state.tree.pendingRequestParameters,
+      state.tree.currentParameters
+    )
   ) {
-    return state.pendingRequestDatabaseDocumentID;
+    return state.tree.pendingRequestParameters;
   } else {
     return null;
   }
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts b/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts
index e91c455c9445ff..28948debae891e 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts
@@ -12,6 +12,7 @@ import { LegacyEndpointEvent, ResolverEvent } from '../../../../common/endpoint/
 import { visibleNodesAndEdgeLines } from '../selectors';
 import { mockProcessEvent } from '../../models/process_event_test_helpers';
 import { mock as mockResolverTree } from '../../models/resolver_tree';
+import { mockTreeFetcherParameters } from '../../mocks/tree_fetcher_parameters';
 
 describe('resolver visible entities', () => {
   let processA: LegacyEndpointEvent;
@@ -112,7 +113,7 @@ describe('resolver visible entities', () => {
       ];
       const action: ResolverAction = {
         type: 'serverReturnedResolverData',
-        payload: { result: mockResolverTree({ events })!, databaseDocumentID: '' },
+        payload: { result: mockResolverTree({ events })!, parameters: mockTreeFetcherParameters() },
       };
       const cameraAction: ResolverAction = { type: 'userSetRasterSize', payload: [300, 200] };
       store.dispatch(action);
@@ -140,7 +141,7 @@ describe('resolver visible entities', () => {
       ];
       const action: ResolverAction = {
         type: 'serverReturnedResolverData',
-        payload: { result: mockResolverTree({ events })!, databaseDocumentID: '' },
+        payload: { result: mockResolverTree({ events })!, parameters: mockTreeFetcherParameters() },
       };
       const cameraAction: ResolverAction = { type: 'userSetRasterSize', payload: [2000, 2000] };
       store.dispatch(action);
diff --git a/x-pack/plugins/security_solution/public/resolver/store/middleware/resolver_tree_fetcher.ts b/x-pack/plugins/security_solution/public/resolver/store/middleware/resolver_tree_fetcher.ts
index 0ec340efbdac95..ef4ca2380ebf42 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/middleware/resolver_tree_fetcher.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/middleware/resolver_tree_fetcher.ts
@@ -28,32 +28,31 @@ export function ResolverTreeFetcher(
   // if the entityID changes while
   return async () => {
     const state = api.getState();
-    const databaseDocumentIDToFetch = selectors.databaseDocumentIDToFetch(state);
+    const databaseParameters = selectors.treeParametersToFetch(state);
 
-    if (selectors.databaseDocumentIDToAbort(state) && lastRequestAbortController) {
+    if (selectors.treeRequestParametersToAbort(state) && lastRequestAbortController) {
       lastRequestAbortController.abort();
       // calling abort will cause an action to be fired
-    } else if (databaseDocumentIDToFetch !== null) {
+    } else if (databaseParameters !== null) {
       lastRequestAbortController = new AbortController();
       let result: ResolverTree | undefined;
       // Inform the state that we've made the request. Without this, the middleware will try to make the request again
       // immediately.
       api.dispatch({
         type: 'appRequestedResolverData',
-        payload: databaseDocumentIDToFetch,
+        payload: databaseParameters,
       });
       try {
-        const indices: string[] = dataAccessLayer.indexPatterns();
         const matchingEntities: ResolverEntityIndex = await dataAccessLayer.entities({
-          _id: databaseDocumentIDToFetch,
-          indices,
+          _id: databaseParameters.databaseDocumentID,
+          indices: databaseParameters.indices ?? [],
           signal: lastRequestAbortController.signal,
         });
         if (matchingEntities.length < 1) {
           // If no entity_id could be found for the _id, bail out with a failure.
           api.dispatch({
             type: 'serverFailedToReturnResolverData',
-            payload: databaseDocumentIDToFetch,
+            payload: databaseParameters,
           });
           return;
         }
@@ -67,12 +66,12 @@ export function ResolverTreeFetcher(
         if (error instanceof DOMException && error.name === 'AbortError') {
           api.dispatch({
             type: 'appAbortedResolverDataRequest',
-            payload: databaseDocumentIDToFetch,
+            payload: databaseParameters,
           });
         } else {
           api.dispatch({
             type: 'serverFailedToReturnResolverData',
-            payload: databaseDocumentIDToFetch,
+            payload: databaseParameters,
           });
         }
       }
@@ -81,7 +80,7 @@ export function ResolverTreeFetcher(
           type: 'serverReturnedResolverData',
           payload: {
             result,
-            databaseDocumentID: databaseDocumentIDToFetch,
+            parameters: databaseParameters,
           },
         });
       }
diff --git a/x-pack/plugins/security_solution/public/resolver/store/selectors.test.ts b/x-pack/plugins/security_solution/public/resolver/store/selectors.test.ts
index f113e861d3ce94..d15274f0363ac2 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/selectors.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/selectors.test.ts
@@ -14,6 +14,7 @@ import {
   mockTreeWithNoAncestorsAnd2Children,
 } from '../mocks/resolver_tree';
 import { SafeResolverEvent } from '../../../common/endpoint/types';
+import { mockTreeFetcherParameters } from '../mocks/tree_fetcher_parameters';
 
 describe('resolver selectors', () => {
   const actions: ResolverAction[] = [];
@@ -43,7 +44,7 @@ describe('resolver selectors', () => {
               secondAncestorID,
             }),
             // this value doesn't matter
-            databaseDocumentID: '',
+            parameters: mockTreeFetcherParameters(),
           },
         });
       });
@@ -77,7 +78,7 @@ describe('resolver selectors', () => {
           payload: {
             result: mockTreeWithNoAncestorsAnd2Children({ originID, firstChildID, secondChildID }),
             // this value doesn't matter
-            databaseDocumentID: '',
+            parameters: mockTreeFetcherParameters(),
           },
         });
       });
diff --git a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
index 909a907626f304..8ea0bc9199cb6a 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
@@ -84,14 +84,14 @@ export const layout: (state: ResolverState) => IsometricTaxiLayout = composeSele
 /**
  * If we need to fetch, this is the entity ID to fetch.
  */
-export const databaseDocumentIDToFetch = composeSelectors(
+export const treeParametersToFetch = composeSelectors(
   dataStateSelector,
-  dataSelectors.databaseDocumentIDToFetch
+  dataSelectors.treeParametersToFetch
 );
 
-export const databaseDocumentIDToAbort = composeSelectors(
+export const treeRequestParametersToAbort = composeSelectors(
   dataStateSelector,
-  dataSelectors.databaseDocumentIDToAbort
+  dataSelectors.treeRequestParametersToAbort
 );
 
 export const resolverComponentInstanceID = composeSelectors(
@@ -114,6 +114,18 @@ export const relatedEventsStats: (
   dataSelectors.relatedEventsStats
 );
 
+/**
+ * This returns the "aggregate total" for related events, tallied as the sum
+ * of their individual `event.category`s. E.g. a [DNS, Network] would count as two
+ * towards the aggregate total.
+ */
+export const relatedEventAggregateTotalByEntityId: (
+  state: ResolverState
+) => (nodeID: string) => number = composeSelectors(
+  dataStateSelector,
+  dataSelectors.relatedEventAggregateTotalByEntityId
+);
+
 /**
  * Map of related events... by entity id
  */
@@ -195,12 +207,15 @@ function uiStateSelector(state: ResolverState) {
 /**
  * Whether or not the resolver is pending fetching data
  */
-export const isLoading = composeSelectors(dataStateSelector, dataSelectors.isLoading);
+export const isTreeLoading = composeSelectors(dataStateSelector, dataSelectors.isTreeLoading);
 
 /**
  * Whether or not the resolver encountered an error while fetching data
  */
-export const hasError = composeSelectors(dataStateSelector, dataSelectors.hasError);
+export const hadErrorLoadingTree = composeSelectors(
+  dataStateSelector,
+  dataSelectors.hadErrorLoadingTree
+);
 
 /**
  * True if the children cursor is not null
diff --git a/x-pack/plugins/security_solution/public/resolver/test_utilities/simulator/index.tsx b/x-pack/plugins/security_solution/public/resolver/test_utilities/simulator/index.tsx
index a6520c8f0e06f3..9d10d1c2b64a77 100644
--- a/x-pack/plugins/security_solution/public/resolver/test_utilities/simulator/index.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/test_utilities/simulator/index.tsx
@@ -49,6 +49,7 @@ export class Simulator {
     dataAccessLayer,
     resolverComponentInstanceID,
     databaseDocumentID,
+    indices,
     history,
   }: {
     /**
@@ -59,10 +60,14 @@ export class Simulator {
      * A string that uniquely identifies this Resolver instance among others mounted in the DOM.
      */
     resolverComponentInstanceID: string;
+    /**
+     * Indices that the backend would use to find the document ID.
+     */
+    indices: string[];
     /**
      * a databaseDocumentID to pass to Resolver. Resolver will use this in requests to the mock data layer.
      */
-    databaseDocumentID?: string;
+    databaseDocumentID: string;
     history?: HistoryPackageHistoryInterface<never>;
   }) {
     // create the spy middleware (for debugging tests)
@@ -99,6 +104,7 @@ export class Simulator {
         store={this.store}
         coreStart={coreStart}
         databaseDocumentID={databaseDocumentID}
+        indices={indices}
       />
     );
   }
@@ -124,6 +130,20 @@ export class Simulator {
     this.wrapper.setProps({ resolverComponentInstanceID: value });
   }
 
+  /**
+   * Change the indices (updates the React component props.)
+   */
+  public set indices(value: string[]) {
+    this.wrapper.setProps({ indices: value });
+  }
+
+  /**
+   * Get the indices (updates the React component props.)
+   */
+  public get indices(): string[] {
+    return this.wrapper.prop('indices');
+  }
+
   /**
    * Call this to console.log actions (and state). Use this to debug your tests.
    * State and actions aren't exposed otherwise because the tests using this simulator should
diff --git a/x-pack/plugins/security_solution/public/resolver/test_utilities/simulator/mock_resolver.tsx b/x-pack/plugins/security_solution/public/resolver/test_utilities/simulator/mock_resolver.tsx
index 5d5a414761dbf8..89218e9fca8ce7 100644
--- a/x-pack/plugins/security_solution/public/resolver/test_utilities/simulator/mock_resolver.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/test_utilities/simulator/mock_resolver.tsx
@@ -99,6 +99,7 @@ export const MockResolver = React.memo((props: MockResolverProps) => {
                 ref={resolverRef}
                 databaseDocumentID={props.databaseDocumentID}
                 resolverComponentInstanceID={props.resolverComponentInstanceID}
+                indices={props.indices}
               />
             </Provider>
           </SideEffectContext.Provider>
diff --git a/x-pack/plugins/security_solution/public/resolver/types.ts b/x-pack/plugins/security_solution/public/resolver/types.ts
index e8304bf838e2d7..1e7e2a8eba8a83 100644
--- a/x-pack/plugins/security_solution/public/resolver/types.ts
+++ b/x-pack/plugins/security_solution/public/resolver/types.ts
@@ -194,53 +194,68 @@ export interface VisibleEntites {
   connectingEdgeLineSegments: EdgeLineSegment[];
 }
 
+export interface TreeFetcherParameters {
+  /**
+   * The `_id` for an ES document. Used to select a process that we'll show the graph for.
+   */
+  databaseDocumentID: string;
+
+  /**
+   * The indices that the backend will use to search for the document ID.
+   */
+  indices: string[];
+}
+
 /**
  * State for `data` reducer which handles receiving Resolver data from the back-end.
  */
 export interface DataState {
   readonly relatedEvents: Map<string, ResolverRelatedEvents>;
   readonly relatedEventsReady: Map<string, boolean>;
-  /**
-   * The `_id` for an ES document. Used to select a process that we'll show the graph for.
-   */
-  readonly databaseDocumentID?: string;
-  /**
-   * The id used for the pending request, if there is one.
-   */
-  readonly pendingRequestDatabaseDocumentID?: string;
+
+  readonly tree: {
+    /**
+     * The parameters passed from the resolver properties
+     */
+    readonly currentParameters?: TreeFetcherParameters;
+
+    /**
+     * The id used for the pending request, if there is one.
+     */
+    readonly pendingRequestParameters?: TreeFetcherParameters;
+    /**
+     * The parameters and response from the last successful request.
+     */
+    readonly lastResponse?: {
+      /**
+       * The id used in the request.
+       */
+      readonly parameters: TreeFetcherParameters;
+    } & (
+      | {
+          /**
+           * If a response with a success code was received, this is `true`.
+           */
+          readonly successful: true;
+          /**
+           * The ResolverTree parsed from the response.
+           */
+          readonly result: ResolverTree;
+        }
+      | {
+          /**
+           * If the request threw an exception or the response had a failure code, this will be false.
+           */
+          readonly successful: false;
+        }
+    );
+  };
 
   /**
    * An ID that is used to differentiate this Resolver instance from others concurrently running on the same page.
    * Used to prevent collisions in things like query parameters.
    */
   readonly resolverComponentInstanceID?: string;
-
-  /**
-   * The parameters and response from the last successful request.
-   */
-  readonly lastResponse?: {
-    /**
-     * The id used in the request.
-     */
-    readonly databaseDocumentID: string;
-  } & (
-    | {
-        /**
-         * If a response with a success code was received, this is `true`.
-         */
-        readonly successful: true;
-        /**
-         * The ResolverTree parsed from the response.
-         */
-        readonly result: ResolverTree;
-      }
-    | {
-        /**
-         * If the request threw an exception or the response had a failure code, this will be false.
-         */
-        readonly successful: false;
-      }
-  );
 }
 
 /**
@@ -494,11 +509,6 @@ export interface DataAccessLayer {
    */
   resolverTree: (entityID: string, signal: AbortSignal) => Promise<ResolverTree>;
 
-  /**
-   * Get an array of index patterns that contain events.
-   */
-  indexPatterns: () => string[];
-
   /**
    * Get entities matching a document.
    */
@@ -524,13 +534,18 @@ export interface ResolverProps {
    * The `_id` value of an event in ES.
    * Used as the origin of the Resolver graph.
    */
-  databaseDocumentID?: string;
+  databaseDocumentID: string;
 
   /**
    * An ID that is used to differentiate this Resolver instance from others concurrently running on the same page.
    * Used to prevent collisions in things like query parameters.
    */
   resolverComponentInstanceID: string;
+
+  /**
+   * Indices that the backend should use to find the originating document.
+   */
+  indices: string[];
 }
 
 /**
diff --git a/x-pack/plugins/security_solution/public/resolver/view/clickthrough.test.tsx b/x-pack/plugins/security_solution/public/resolver/view/clickthrough.test.tsx
index 1e5ac093cac776..223ce728f42671 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/clickthrough.test.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/clickthrough.test.tsx
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { noAncestorsTwoChildenInIndexCalledAwesomeIndex } from '../data_access_layer/mocks/no_ancestors_two_children_in_index_called_awesome_index';
 import { noAncestorsTwoChildren } from '../data_access_layer/mocks/no_ancestors_two_children';
 import { Simulator } from '../test_utilities/simulator';
 // Extend jest with a custom matcher
@@ -19,6 +20,62 @@ let entityIDs: { origin: string; firstChild: string; secondChild: string };
 // the resolver component instance ID, used by the react code to distinguish piece of global state from those used by other resolver instances
 const resolverComponentInstanceID = 'resolverComponentInstanceID';
 
+describe("Resolver, when rendered with the `indices` prop set to `[]` and the `databaseDocumentID` prop set to `_id`, and when the document is found in an index called 'awesome_index'", () => {
+  beforeEach(async () => {
+    // create a mock data access layer
+    const {
+      metadata: dataAccessLayerMetadata,
+      dataAccessLayer,
+    } = noAncestorsTwoChildenInIndexCalledAwesomeIndex();
+
+    // save a reference to the entity IDs exposed by the mock data layer
+    entityIDs = dataAccessLayerMetadata.entityIDs;
+
+    // save a reference to the `_id` supported by the mock data layer
+    databaseDocumentID = dataAccessLayerMetadata.databaseDocumentID;
+
+    // create a resolver simulator, using the data access layer and an arbitrary component instance ID
+    simulator = new Simulator({
+      databaseDocumentID,
+      dataAccessLayer,
+      resolverComponentInstanceID,
+      indices: [],
+    });
+  });
+
+  it('should render no processes', async () => {
+    await expect(
+      simulator.map(() => ({
+        processes: simulator.processNodeElements().length,
+      }))
+    ).toYieldEqualTo({
+      processes: 0,
+    });
+  });
+
+  describe("when rerendered with the `indices` prop set to `['awesome_index'`]", () => {
+    beforeEach(async () => {
+      simulator.indices = ['awesome_index'];
+    });
+    // Combining assertions here for performance. Unfortunately, Enzyme + jsdom + React is slow.
+    it(`should have 3 nodes, with the entityID's 'origin', 'firstChild', and 'secondChild'. 'origin' should be selected when the simulator has the right indices`, async () => {
+      await expect(
+        simulator.map(() => ({
+          selectedOriginCount: simulator.selectedProcessNode(entityIDs.origin).length,
+          unselectedFirstChildCount: simulator.unselectedProcessNode(entityIDs.firstChild).length,
+          unselectedSecondChildCount: simulator.unselectedProcessNode(entityIDs.secondChild).length,
+          nodePrimaryButtonCount: simulator.testSubject('resolver:node:primary-button').length,
+        }))
+      ).toYieldEqualTo({
+        selectedOriginCount: 1,
+        unselectedFirstChildCount: 1,
+        unselectedSecondChildCount: 1,
+        nodePrimaryButtonCount: 3,
+      });
+    });
+  });
+});
+
 describe('Resolver, when analyzing a tree that has no ancestors and 2 children', () => {
   beforeEach(async () => {
     // create a mock data access layer
@@ -31,7 +88,12 @@ describe('Resolver, when analyzing a tree that has no ancestors and 2 children',
     databaseDocumentID = dataAccessLayerMetadata.databaseDocumentID;
 
     // create a resolver simulator, using the data access layer and an arbitrary component instance ID
-    simulator = new Simulator({ databaseDocumentID, dataAccessLayer, resolverComponentInstanceID });
+    simulator = new Simulator({
+      databaseDocumentID,
+      dataAccessLayer,
+      resolverComponentInstanceID,
+      indices: [],
+    });
   });
 
   describe('when it has loaded', () => {
@@ -159,7 +221,12 @@ describe('Resolver, when analyzing a tree that has two related events for the or
     databaseDocumentID = dataAccessLayerMetadata.databaseDocumentID;
 
     // create a resolver simulator, using the data access layer and an arbitrary component instance ID
-    simulator = new Simulator({ databaseDocumentID, dataAccessLayer, resolverComponentInstanceID });
+    simulator = new Simulator({
+      databaseDocumentID,
+      dataAccessLayer,
+      resolverComponentInstanceID,
+      indices: [],
+    });
   });
 
   describe('when it has loaded', () => {
diff --git a/x-pack/plugins/security_solution/public/resolver/view/graph_controls.test.tsx b/x-pack/plugins/security_solution/public/resolver/view/graph_controls.test.tsx
index 6497cc2971980c..95fe68d95d7025 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/graph_controls.test.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/graph_controls.test.tsx
@@ -34,6 +34,7 @@ describe('graph controls: when relsover is loaded with an origin node', () => {
       dataAccessLayer,
       databaseDocumentID,
       resolverComponentInstanceID,
+      indices: [],
     });
     originEntityID = entityIDs.origin;
 
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panel.test.tsx b/x-pack/plugins/security_solution/public/resolver/view/panel.test.tsx
index 1add907ae933d4..7021e476e6439d 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panel.test.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panel.test.tsx
@@ -49,6 +49,7 @@ describe(`Resolver: when analyzing a tree with no ancestors and two children, an
           dataAccessLayer,
           resolverComponentInstanceID,
           history: memoryHistory,
+          indices: [],
         });
         return simulatorInstance;
       }
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/index.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/index.tsx
index 98b737de8fa598..133dcd21e7f565 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/index.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/index.tsx
@@ -17,6 +17,7 @@ import { EventCountsForProcess } from './event_counts_for_process';
 import { ProcessDetails } from './process_details';
 import { ProcessListWithCounts } from './process_list_with_counts';
 import { RelatedEventDetail } from './related_event_detail';
+import { ResolverState } from '../../types';
 
 /**
  * The team decided to use this table to determine which breadcrumbs/view to display:
@@ -102,6 +103,12 @@ const PanelContent = memo(function PanelContent() {
     ? relatedEventStats(idFromParams)
     : undefined;
 
+  const parentCount = useSelector((state: ResolverState) => {
+    if (idFromParams === '') {
+      return 0;
+    }
+    return selectors.relatedEventAggregateTotalByEntityId(state)(idFromParams);
+  });
   /**
    * Determine which set of breadcrumbs to display based on the query parameters
    * for the table & breadcrumb nav.
@@ -186,9 +193,6 @@ const PanelContent = memo(function PanelContent() {
     }
 
     if (panelToShow === 'relatedEventDetail') {
-      const parentCount: number = Object.values(
-        relatedStatsForIdFromParams?.events.byCategory || {}
-      ).reduce((sum, val) => sum + val, 0);
       return (
         <RelatedEventDetail
           relatedEventId={crumbId}
@@ -199,7 +203,7 @@ const PanelContent = memo(function PanelContent() {
     }
     // The default 'Event List' / 'List of all processes' view
     return <ProcessListWithCounts />;
-  }, [uiSelectedEvent, crumbEvent, crumbId, relatedStatsForIdFromParams, panelToShow]);
+  }, [uiSelectedEvent, crumbEvent, crumbId, relatedStatsForIdFromParams, panelToShow, parentCount]);
 
   return <>{panelInstance}</>;
 });
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/process_details.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/process_details.tsx
index 01fa912caa866f..4fcc5577426430 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/process_details.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/process_details.tsx
@@ -13,6 +13,7 @@ import {
   EuiText,
   EuiTextColor,
   EuiDescriptionList,
+  EuiLink,
 } from '@elastic/eui';
 import styled from 'styled-components';
 import { FormattedMessage } from 'react-intl';
@@ -58,6 +59,9 @@ export const ProcessDetails = memo(function ProcessDetails({
   const isProcessTerminated = useSelector((state: ResolverState) =>
     selectors.isProcessTerminated(state)(entityId)
   );
+  const relatedEventTotal = useSelector((state: ResolverState) => {
+    return selectors.relatedEventAggregateTotalByEntityId(state)(entityId);
+  });
   const processInfoEntry: EuiDescriptionListProps['listItems'] = useMemo(() => {
     const eventTime = event.eventTimestamp(processEvent);
     const dateTime = eventTime === undefined ? null : formatDate(eventTime);
@@ -164,6 +168,12 @@ export const ProcessDetails = memo(function ProcessDetails({
     return cubeAssetsForNode(isProcessTerminated, false);
   }, [processEvent, cubeAssetsForNode, isProcessTerminated]);
 
+  const handleEventsLinkClick = useMemo(() => {
+    return () => {
+      pushToQueryParams({ crumbId: entityId, crumbEvent: 'all' });
+    };
+  }, [entityId, pushToQueryParams]);
+
   const titleID = useMemo(() => htmlIdGenerator('resolverTable')(), []);
   return (
     <>
@@ -185,6 +195,14 @@ export const ProcessDetails = memo(function ProcessDetails({
           <span id={titleID}>{descriptionText}</span>
         </EuiTextColor>
       </EuiText>
+      <EuiSpacer size="s" />
+      <EuiLink onClick={handleEventsLinkClick}>
+        <FormattedMessage
+          id="xpack.securitySolution.endpoint.resolver.panel.processDescList.numberOfEvents"
+          values={{ relatedEventTotal }}
+          defaultMessage="{relatedEventTotal} Events"
+        />
+      </EuiLink>
       <EuiSpacer size="l" />
       <StyledDescriptionList
         data-test-subj="resolver:node-detail"
diff --git a/x-pack/plugins/security_solution/public/resolver/view/query_params.test.ts b/x-pack/plugins/security_solution/public/resolver/view/query_params.test.ts
index a86237e0e2b45c..e42de5009a0f1a 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/query_params.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/view/query_params.test.ts
@@ -29,7 +29,12 @@ describe('Resolver, when analyzing a tree that has no ancestors and 2 children',
     databaseDocumentID = dataAccessLayerMetadata.databaseDocumentID;
 
     // create a resolver simulator, using the data access layer and an arbitrary component instance ID
-    simulator = new Simulator({ databaseDocumentID, dataAccessLayer, resolverComponentInstanceID });
+    simulator = new Simulator({
+      databaseDocumentID,
+      dataAccessLayer,
+      resolverComponentInstanceID,
+      indices: [],
+    });
   });
 
   describe("when the second child node's first button has been clicked", () => {
diff --git a/x-pack/plugins/security_solution/public/resolver/view/resolver_loading_state.test.tsx b/x-pack/plugins/security_solution/public/resolver/view/resolver_loading_state.test.tsx
index c357ee18acfebd..d8d8de640d7863 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/resolver_loading_state.test.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/resolver_loading_state.test.tsx
@@ -26,6 +26,7 @@ describe('Resolver: data loading and resolution states', () => {
         dataAccessLayer,
         databaseDocumentID,
         resolverComponentInstanceID,
+        indices: [],
       });
     });
 
@@ -56,6 +57,7 @@ describe('Resolver: data loading and resolution states', () => {
         dataAccessLayer,
         databaseDocumentID,
         resolverComponentInstanceID,
+        indices: [],
       });
     });
 
@@ -85,6 +87,7 @@ describe('Resolver: data loading and resolution states', () => {
         dataAccessLayer,
         databaseDocumentID,
         resolverComponentInstanceID,
+        indices: [],
       });
     });
 
@@ -114,6 +117,7 @@ describe('Resolver: data loading and resolution states', () => {
         dataAccessLayer,
         databaseDocumentID,
         resolverComponentInstanceID,
+        indices: [],
       });
     });
 
@@ -145,6 +149,7 @@ describe('Resolver: data loading and resolution states', () => {
         dataAccessLayer,
         databaseDocumentID,
         resolverComponentInstanceID,
+        indices: [],
       });
     });
 
diff --git a/x-pack/plugins/security_solution/public/resolver/view/resolver_without_providers.tsx b/x-pack/plugins/security_solution/public/resolver/view/resolver_without_providers.tsx
index aa845e7283ebe6..f4d471b384b350 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/resolver_without_providers.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/resolver_without_providers.tsx
@@ -31,7 +31,7 @@ export const ResolverWithoutProviders = React.memo(
    * Use `forwardRef` so that the `Simulator` used in testing can access the top level DOM element.
    */
   React.forwardRef(function (
-    { className, databaseDocumentID, resolverComponentInstanceID }: ResolverProps,
+    { className, databaseDocumentID, resolverComponentInstanceID, indices }: ResolverProps,
     refToForward
   ) {
     useResolverQueryParamCleaner();
@@ -39,7 +39,7 @@ export const ResolverWithoutProviders = React.memo(
      * This is responsible for dispatching actions that include any external data.
      * `databaseDocumentID`
      */
-    useStateSyncingActions({ databaseDocumentID, resolverComponentInstanceID });
+    useStateSyncingActions({ databaseDocumentID, resolverComponentInstanceID, indices });
 
     const { timestamp } = useContext(SideEffectContext);
 
@@ -69,8 +69,8 @@ export const ResolverWithoutProviders = React.memo(
       },
       [cameraRef, refToForward]
     );
-    const isLoading = useSelector(selectors.isLoading);
-    const hasError = useSelector(selectors.hasError);
+    const isLoading = useSelector(selectors.isTreeLoading);
+    const hasError = useSelector(selectors.hadErrorLoadingTree);
     const activeDescendantId = useSelector(selectors.ariaActiveDescendant);
     const { colorMap } = useResolverTheme();
 
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx b/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx
index 630ee2f7ff7f08..495cd238d22fc7 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx
@@ -20,6 +20,7 @@ import { mock as mockResolverTree } from '../models/resolver_tree';
 import { ResolverAction } from '../store/actions';
 import { createStore } from 'redux';
 import { resolverReducer } from '../store/reducer';
+import { mockTreeFetcherParameters } from '../mocks/tree_fetcher_parameters';
 
 describe('useCamera on an unpainted element', () => {
   let element: HTMLElement;
@@ -181,7 +182,7 @@ describe('useCamera on an unpainted element', () => {
         if (tree !== null) {
           const serverResponseAction: ResolverAction = {
             type: 'serverReturnedResolverData',
-            payload: { result: tree, databaseDocumentID: '' },
+            payload: { result: tree, parameters: mockTreeFetcherParameters() },
           };
           act(() => {
             store.dispatch(serverResponseAction);
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_state_syncing_actions.ts b/x-pack/plugins/security_solution/public/resolver/view/use_state_syncing_actions.ts
index eaba4438bb1fef..7f3cdcbec76a27 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/use_state_syncing_actions.ts
+++ b/x-pack/plugins/security_solution/public/resolver/view/use_state_syncing_actions.ts
@@ -15,19 +15,21 @@ import { useResolverDispatch } from './use_resolver_dispatch';
 export function useStateSyncingActions({
   databaseDocumentID,
   resolverComponentInstanceID,
+  indices,
 }: {
   /**
    * The `_id` of an event in ES. Used to determine the origin of the Resolver graph.
    */
-  databaseDocumentID?: string;
+  databaseDocumentID: string;
   resolverComponentInstanceID: string;
+  indices: string[];
 }) {
   const dispatch = useResolverDispatch();
   const locationSearch = useLocation().search;
   useLayoutEffect(() => {
     dispatch({
       type: 'appReceivedNewExternalProperties',
-      payload: { databaseDocumentID, resolverComponentInstanceID, locationSearch },
+      payload: { databaseDocumentID, resolverComponentInstanceID, locationSearch, indices },
     });
-  }, [dispatch, databaseDocumentID, resolverComponentInstanceID, locationSearch]);
+  }, [dispatch, databaseDocumentID, resolverComponentInstanceID, locationSearch, indices]);
 }
diff --git a/x-pack/plugins/security_solution/public/shared_imports.ts b/x-pack/plugins/security_solution/public/shared_imports.ts
index 097166a9c866a9..08e9fb854e5a2c 100644
--- a/x-pack/plugins/security_solution/public/shared_imports.ts
+++ b/x-pack/plugins/security_solution/public/shared_imports.ts
@@ -21,6 +21,7 @@ export {
   UseMultiFields,
   useForm,
   useFormContext,
+  useFormData,
   ValidationFunc,
   VALIDATION_TYPES,
 } from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_browser.tsx b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_browser.tsx
index 07c4893e4550b4..3c9101878be8d2 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_browser.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_browser.tsx
@@ -46,13 +46,7 @@ PanesFlexGroup.displayName = 'PanesFlexGroup';
 
 type Props = Pick<
   FieldBrowserProps,
-  | 'browserFields'
-  | 'isEventViewer'
-  | 'height'
-  | 'onFieldSelected'
-  | 'onUpdateColumns'
-  | 'timelineId'
-  | 'width'
+  'browserFields' | 'height' | 'onFieldSelected' | 'onUpdateColumns' | 'timelineId' | 'width'
 > & {
   /**
    * The current timeline column headers
@@ -106,7 +100,6 @@ const FieldsBrowserComponent: React.FC<Props> = ({
   browserFields,
   columnHeaders,
   filteredBrowserFields,
-  isEventViewer,
   isSearching,
   onCategorySelected,
   onFieldSelected,
@@ -193,7 +186,6 @@ const FieldsBrowserComponent: React.FC<Props> = ({
         <Header
           data-test-subj="header"
           filteredBrowserFields={filteredBrowserFields}
-          isEventViewer={isEventViewer}
           isSearching={isSearching}
           onOutsideClick={onOutsideClick}
           onSearchInputChange={onInputChange}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_name.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_name.test.tsx
index 2e48215a894735..90f4444562c5ab 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_name.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/field_name.test.tsx
@@ -66,6 +66,6 @@ describe('FieldName', () => {
       </TestProviders>
     );
 
-    expect(wrapper.find('strong').first().text()).toEqual(highlight);
+    expect(wrapper.find('mark').first().text()).toEqual(highlight);
   });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/header.tsx b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/header.tsx
index 9ad460db4c7b75..916240ac411e5f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/header.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/header.tsx
@@ -54,7 +54,6 @@ SearchContainer.displayName = 'SearchContainer';
 
 interface Props {
   filteredBrowserFields: BrowserFields;
-  isEventViewer?: boolean;
   isSearching: boolean;
   onOutsideClick: () => void;
   onSearchInputChange: (event: React.ChangeEvent<HTMLInputElement>) => void;
@@ -93,7 +92,6 @@ CountRow.displayName = 'CountRow';
 
 const TitleRow = React.memo<{
   id: string;
-  isEventViewer?: boolean;
   onOutsideClick: () => void;
   onUpdateColumns: OnUpdateColumns;
 }>(({ id, onOutsideClick, onUpdateColumns }) => {
@@ -130,7 +128,6 @@ TitleRow.displayName = 'TitleRow';
 
 export const Header = React.memo<Props>(
   ({
-    isEventViewer,
     isSearching,
     filteredBrowserFields,
     onOutsideClick,
@@ -140,12 +137,7 @@ export const Header = React.memo<Props>(
     timelineId,
   }) => (
     <HeaderContainer>
-      <TitleRow
-        id={timelineId}
-        isEventViewer={isEventViewer}
-        onUpdateColumns={onUpdateColumns}
-        onOutsideClick={onOutsideClick}
-      />
+      <TitleRow id={timelineId} onUpdateColumns={onUpdateColumns} onOutsideClick={onOutsideClick} />
       <SearchContainer>
         <EuiFieldSearch
           className={getFieldBrowserSearchInputClassName(timelineId)}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/index.tsx
index f4e39ff8227c75..f197d241cc4223 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/fields_browser/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/fields_browser/index.tsx
@@ -36,7 +36,6 @@ export const StatefulFieldsBrowserComponent: React.FC<FieldBrowserProps> = ({
   columnHeaders,
   browserFields,
   height,
-  isEventViewer = false,
   onFieldSelected,
   onUpdateColumns,
   timelineId,
@@ -164,7 +163,6 @@ export const StatefulFieldsBrowserComponent: React.FC<FieldBrowserProps> = ({
             filteredBrowserFields != null ? filteredBrowserFields : browserFieldsWithDefaultCategory
           }
           height={height}
-          isEventViewer={isEventViewer}
           isSearching={isSearching}
           onCategorySelected={updateSelectedCategoryId}
           onFieldSelected={onFieldSelected}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
index ededf701529683..dc9557da70f915 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
@@ -19,7 +19,7 @@ import styled from 'styled-components';
 
 import { FULL_SCREEN } from '../timeline/body/column_headers/translations';
 import { EXIT_FULL_SCREEN } from '../../../common/components/exit_full_screen/translations';
-import { FULL_SCREEN_TOGGLED_CLASS_NAME } from '../../../../common/constants';
+import { DEFAULT_INDEX_KEY, FULL_SCREEN_TOGGLED_CLASS_NAME } from '../../../../common/constants';
 import { useFullScreen } from '../../../common/containers/use_full_screen';
 import { State } from '../../../common/store';
 import { TimelineId, TimelineType } from '../../../../common/types/timeline';
@@ -33,6 +33,8 @@ import { Resolver } from '../../../resolver/view';
 import { useAllCasesModal } from '../../../cases/components/use_all_cases_modal';
 
 import * as i18n from './translations';
+import { useUiSetting$ } from '../../../common/lib/kibana';
+import { useSignalIndex } from '../../../detections/containers/detection_engine/alerts/use_signal_index';
 
 const OverlayContainer = styled.div`
   height: 100%;
@@ -137,6 +139,16 @@ const GraphOverlayComponent = ({
     globalFullScreen,
   ]);
 
+  const { signalIndexName } = useSignalIndex();
+  const [siemDefaultIndices] = useUiSetting$<string[]>(DEFAULT_INDEX_KEY);
+  const indices: string[] | null = useMemo(() => {
+    if (signalIndexName === null) {
+      return null;
+    } else {
+      return [...siemDefaultIndices, signalIndexName];
+    }
+  }, [signalIndexName, siemDefaultIndices]);
+
   return (
     <OverlayContainer>
       <EuiHorizontalRule margin="none" />
@@ -178,10 +190,13 @@ const GraphOverlayComponent = ({
       </EuiFlexGroup>
 
       <EuiHorizontalRule margin="none" />
-      <StyledResolver
-        databaseDocumentID={graphEventId}
-        resolverComponentInstanceID={currentTimeline.id}
-      />
+      {graphEventId !== undefined && indices !== null && (
+        <StyledResolver
+          databaseDocumentID={graphEventId}
+          resolverComponentInstanceID={currentTimeline.id}
+          indices={indices}
+        />
+      )}
       <AllCasesModal />
     </OverlayContainer>
   );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/manage_timeline/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/manage_timeline/index.test.tsx
index b918e5abc652b3..fe0f0c8f8b91f5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/manage_timeline/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/manage_timeline/index.test.tsx
@@ -8,7 +8,6 @@ import { renderHook, act } from '@testing-library/react-hooks';
 import { getTimelineDefaults, useTimelineManager, UseTimelineManager } from './';
 import { FilterManager } from '../../../../../../../src/plugins/data/public/query/filter_manager';
 import { coreMock } from '../../../../../../../src/core/public/mocks';
-import { TimelineRowAction } from '../timeline/body/actions';
 
 const isStringifiedComparisonEqual = (a: {}, b: {}): boolean =>
   JSON.stringify(a) === JSON.stringify(b);
@@ -17,13 +16,14 @@ describe('useTimelineManager', () => {
   const setupMock = coreMock.createSetup();
   const testId = 'coolness';
   const timelineDefaults = getTimelineDefaults(testId);
-  const timelineRowActions = () => [];
   const mockFilterManager = new FilterManager(setupMock.uiSettings);
+
   beforeEach(() => {
     jest.clearAllMocks();
     jest.restoreAllMocks();
   });
-  it('initilizes an undefined timeline', async () => {
+
+  it('initializes an undefined timeline', async () => {
     await act(async () => {
       const { result, waitForNextUpdate } = renderHook<string, UseTimelineManager>(() =>
         useTimelineManager()
@@ -33,6 +33,7 @@ describe('useTimelineManager', () => {
       expect(isStringifiedComparisonEqual(uninitializedTimeline, timelineDefaults)).toBeTruthy();
     });
   });
+
   it('getIndexToAddById', async () => {
     await act(async () => {
       const { result, waitForNextUpdate } = renderHook<string, UseTimelineManager>(() =>
@@ -43,6 +44,7 @@ describe('useTimelineManager', () => {
       expect(data).toEqual(timelineDefaults.indexToAdd);
     });
   });
+
   it('setIndexToAdd', async () => {
     await act(async () => {
       const indexToAddArgs = { id: testId, indexToAdd: ['example'] };
@@ -52,13 +54,13 @@ describe('useTimelineManager', () => {
       await waitForNextUpdate();
       result.current.initializeTimeline({
         id: testId,
-        timelineRowActions,
       });
       result.current.setIndexToAdd(indexToAddArgs);
       const data = result.current.getIndexToAddById(testId);
       expect(data).toEqual(indexToAddArgs.indexToAdd);
     });
   });
+
   it('setIsTimelineLoading', async () => {
     await act(async () => {
       const isLoadingArgs = { id: testId, isLoading: true };
@@ -68,7 +70,6 @@ describe('useTimelineManager', () => {
       await waitForNextUpdate();
       result.current.initializeTimeline({
         id: testId,
-        timelineRowActions,
       });
       let timeline = result.current.getManageTimelineById(testId);
       expect(timeline.isLoading).toBeFalsy();
@@ -77,29 +78,7 @@ describe('useTimelineManager', () => {
       expect(timeline.isLoading).toBeTruthy();
     });
   });
-  it('setTimelineRowActions', async () => {
-    await act(async () => {
-      const timelineRowActionsEx = () => [
-        { id: 'wow', content: 'hey', displayType: 'icon', onClick: () => {} } as TimelineRowAction,
-      ];
-      const { result, waitForNextUpdate } = renderHook<string, UseTimelineManager>(() =>
-        useTimelineManager()
-      );
-      await waitForNextUpdate();
-      result.current.initializeTimeline({
-        id: testId,
-        timelineRowActions,
-      });
-      let timeline = result.current.getManageTimelineById(testId);
-      expect(timeline.timelineRowActions).toEqual(timelineRowActions);
-      result.current.setTimelineRowActions({
-        id: testId,
-        timelineRowActions: timelineRowActionsEx,
-      });
-      timeline = result.current.getManageTimelineById(testId);
-      expect(timeline.timelineRowActions).toEqual(timelineRowActionsEx);
-    });
-  });
+
   it('getTimelineFilterManager undefined on uninitialized', async () => {
     await act(async () => {
       const { result, waitForNextUpdate } = renderHook<string, UseTimelineManager>(() =>
@@ -110,6 +89,7 @@ describe('useTimelineManager', () => {
       expect(data).toEqual(undefined);
     });
   });
+
   it('getTimelineFilterManager defined at initialize', async () => {
     await act(async () => {
       const { result, waitForNextUpdate } = renderHook<string, UseTimelineManager>(() =>
@@ -118,13 +98,13 @@ describe('useTimelineManager', () => {
       await waitForNextUpdate();
       result.current.initializeTimeline({
         id: testId,
-        timelineRowActions,
         filterManager: mockFilterManager,
       });
       const data = result.current.getTimelineFilterManager(testId);
       expect(data).toEqual(mockFilterManager);
     });
   });
+
   it('isManagedTimeline returns false when unset and then true when set', async () => {
     await act(async () => {
       const { result, waitForNextUpdate } = renderHook<string, UseTimelineManager>(() =>
@@ -135,7 +115,6 @@ describe('useTimelineManager', () => {
       expect(data).toBeFalsy();
       result.current.initializeTimeline({
         id: testId,
-        timelineRowActions,
         filterManager: mockFilterManager,
       });
       data = result.current.isManagedTimeline(testId);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/manage_timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/manage_timeline/index.tsx
index 560d4c6928e4e4..f82158fe65c11b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/manage_timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/manage_timeline/index.tsx
@@ -9,12 +9,10 @@ import { noop } from 'lodash/fp';
 
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { FilterManager } from '../../../../../../../src/plugins/data/public/query/filter_manager';
-import { TimelineRowAction } from '../timeline/body/actions';
 import { SubsetTimelineModel } from '../../store/timeline/model';
 import * as i18n from '../../../common/components/events_viewer/translations';
 import * as i18nF from '../timeline/footer/translations';
 import { timelineDefaults as timelineDefaultModel } from '../../store/timeline/defaults';
-import { Ecs, TimelineNonEcsData } from '../../../graphql/types';
 
 interface ManageTimelineInit {
   documentType?: string;
@@ -25,16 +23,11 @@ interface ManageTimelineInit {
   indexToAdd?: string[] | null;
   loadingText?: string;
   selectAll?: boolean;
-  timelineRowActions: ({ ecsData, nonEcsData }: TimelineRowActionArgs) => TimelineRowAction[];
+  queryFields?: string[];
   title?: string;
   unit?: (totalCount: number) => string;
 }
 
-export interface TimelineRowActionArgs {
-  ecsData: Ecs;
-  nonEcsData: TimelineNonEcsData[];
-}
-
 interface ManageTimeline {
   documentType: string;
   defaultModel: SubsetTimelineModel;
@@ -46,7 +39,6 @@ interface ManageTimeline {
   loadingText: string;
   queryFields: string[];
   selectAll: boolean;
-  timelineRowActions: ({ ecsData, nonEcsData }: TimelineRowActionArgs) => TimelineRowAction[];
   title: string;
   unit: (totalCount: number) => string;
 }
@@ -75,14 +67,6 @@ type ActionManageTimeline =
       type: 'SET_SELECT_ALL';
       id: string;
       payload: boolean;
-    }
-  | {
-      type: 'SET_TIMELINE_ACTIONS';
-      id: string;
-      payload: {
-        queryFields?: string[];
-        timelineRowActions: ({ ecsData, nonEcsData }: TimelineRowActionArgs) => TimelineRowAction[];
-      };
     };
 
 export const getTimelineDefaults = (id: string) => ({
@@ -95,7 +79,6 @@ export const getTimelineDefaults = (id: string) => ({
   id,
   isLoading: false,
   queryFields: [],
-  timelineRowActions: () => [],
   title: i18n.EVENTS,
   unit: (n: number) => i18n.UNIT(n),
 });
@@ -129,14 +112,7 @@ const reducerManageTimeline = (
           selectAll: action.payload,
         },
       } as ManageTimelineById;
-    case 'SET_TIMELINE_ACTIONS':
-      return {
-        ...state,
-        [action.id]: {
-          ...state[action.id],
-          ...action.payload,
-        },
-      } as ManageTimelineById;
+
     case 'SET_IS_LOADING':
       return {
         ...state,
@@ -159,11 +135,6 @@ export interface UseTimelineManager {
   setIndexToAdd: (indexToAddArgs: { id: string; indexToAdd: string[] }) => void;
   setIsTimelineLoading: (isLoadingArgs: { id: string; isLoading: boolean }) => void;
   setSelectAll: (selectAllArgs: { id: string; selectAll: boolean }) => void;
-  setTimelineRowActions: (actionsArgs: {
-    id: string;
-    queryFields?: string[];
-    timelineRowActions: ({ ecsData, nonEcsData }: TimelineRowActionArgs) => TimelineRowAction[];
-  }) => void;
 }
 
 export const useTimelineManager = (
@@ -181,25 +152,6 @@ export const useTimelineManager = (
     });
   }, []);
 
-  const setTimelineRowActions = useCallback(
-    ({
-      id,
-      queryFields,
-      timelineRowActions,
-    }: {
-      id: string;
-      queryFields?: string[];
-      timelineRowActions: ({ ecsData, nonEcsData }: TimelineRowActionArgs) => TimelineRowAction[];
-    }) => {
-      dispatch({
-        type: 'SET_TIMELINE_ACTIONS',
-        id,
-        payload: { queryFields, timelineRowActions },
-      });
-    },
-    []
-  );
-
   const setIsTimelineLoading = useCallback(
     ({ id, isLoading }: { id: string; isLoading: boolean }) => {
       dispatch({
@@ -236,7 +188,7 @@ export const useTimelineManager = (
       if (state[id] != null) {
         return state[id];
       }
-      initializeTimeline({ id, timelineRowActions: () => [] });
+      initializeTimeline({ id });
       return getTimelineDefaults(id);
     },
     [initializeTimeline, state]
@@ -261,7 +213,6 @@ export const useTimelineManager = (
     setIndexToAdd,
     setIsTimelineLoading,
     setSelectAll,
-    setTimelineRowActions,
   };
 };
 
@@ -274,7 +225,6 @@ const init = {
   setIndexToAdd: () => undefined,
   setIsTimelineLoading: () => noop,
   setSelectAll: () => noop,
-  setTimelineRowActions: () => noop,
 };
 
 const ManageTimelineContext = createContext<UseTimelineManager>(init);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/notes/note_card/__snapshots__/note_card_body.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/notes/note_card/__snapshots__/note_card_body.test.tsx.snap
index 6d2f35750d8b16..9c0a9b26f53329 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/notes/note_card/__snapshots__/note_card_body.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/notes/note_card/__snapshots__/note_card_body.test.tsx.snap
@@ -24,6 +24,7 @@ exports[`NoteCardBody renders correctly against snapshot 1`] = `
             "size": "64px",
           },
         },
+        "browserDefaultFontSize": "16px",
         "euiAnimSlightBounce": "cubic-bezier(0.34, 1.61, 0.7, 1)",
         "euiAnimSlightResistance": "cubic-bezier(0.694, 0.0482, 0.335, 1)",
         "euiAnimSpeedExtraFast": "90ms",
@@ -434,6 +435,28 @@ exports[`NoteCardBody renders correctly against snapshot 1`] = `
         "euiScrollBarCorner": "6px",
         "euiSelectableListItemBorder": "1px solid #202128",
         "euiSelectableListItemPadding": "4px 12px",
+        "euiSelectableTemplateSitewideTypes": Object {
+          "application": Object {
+            "color": "#6092c0",
+            "font-weight": 500,
+          },
+          "article": Object {
+            "color": "#9777bc",
+            "font-weight": 500,
+          },
+          "case": Object {
+            "color": "#e7664c",
+            "font-weight": 500,
+          },
+          "deployment": Object {
+            "color": "#54b399",
+            "font-weight": 500,
+          },
+          "platform": Object {
+            "color": "#d6bf57",
+            "font-weight": 500,
+          },
+        },
         "euiShadowColor": "#000000",
         "euiShadowColorLarge": "#000000",
         "euiSize": "16px",
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts
index ac6c61b33b35ec..ed44fc14e3efae 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts
@@ -36,7 +36,7 @@ import { KueryFilterQueryKind } from '../../../common/store/model';
 import { Note } from '../../../common/lib/note';
 import moment from 'moment';
 import sinon from 'sinon';
-import { TimelineType, TimelineStatus } from '../../../../common/types/timeline';
+import { TimelineId, TimelineType, TimelineStatus } from '../../../../common/types/timeline';
 
 jest.mock('../../../common/store/inputs/actions');
 jest.mock('../../../common/components/url_state/normalize_time_range.ts');
@@ -942,7 +942,7 @@ describe('helpers', () => {
     test('it invokes date range picker dispatch', () => {
       timelineDispatch({
         duplicate: true,
-        id: 'timeline-1',
+        id: TimelineId.active,
         from: '2020-03-26T14:35:56.356Z',
         to: '2020-03-26T14:41:56.356Z',
         notes: [],
@@ -958,7 +958,7 @@ describe('helpers', () => {
     test('it invokes add timeline dispatch', () => {
       timelineDispatch({
         duplicate: true,
-        id: 'timeline-1',
+        id: TimelineId.active,
         from: '2020-03-26T14:35:56.356Z',
         to: '2020-03-26T14:41:56.356Z',
         notes: [],
@@ -966,7 +966,7 @@ describe('helpers', () => {
       })();
 
       expect(dispatchAddTimeline).toHaveBeenCalledWith({
-        id: 'timeline-1',
+        id: TimelineId.active,
         savedTimeline: true,
         timeline: mockTimelineModel,
       });
@@ -975,7 +975,7 @@ describe('helpers', () => {
     test('it does not invoke kql filter query dispatches if timeline.kqlQuery.filterQuery is null', () => {
       timelineDispatch({
         duplicate: true,
-        id: 'timeline-1',
+        id: TimelineId.active,
         from: '2020-03-26T14:35:56.356Z',
         to: '2020-03-26T14:41:56.356Z',
         notes: [],
@@ -989,7 +989,7 @@ describe('helpers', () => {
     test('it does not invoke notes dispatch if duplicate is true', () => {
       timelineDispatch({
         duplicate: true,
-        id: 'timeline-1',
+        id: TimelineId.active,
         from: '2020-03-26T14:35:56.356Z',
         to: '2020-03-26T14:41:56.356Z',
         notes: [],
@@ -1012,7 +1012,7 @@ describe('helpers', () => {
       };
       timelineDispatch({
         duplicate: true,
-        id: 'timeline-1',
+        id: TimelineId.active,
         from: '2020-03-26T14:35:56.356Z',
         to: '2020-03-26T14:41:56.356Z',
         notes: [],
@@ -1036,7 +1036,7 @@ describe('helpers', () => {
       };
       timelineDispatch({
         duplicate: true,
-        id: 'timeline-1',
+        id: TimelineId.active,
         from: '2020-03-26T14:35:56.356Z',
         to: '2020-03-26T14:41:56.356Z',
         notes: [],
@@ -1044,14 +1044,14 @@ describe('helpers', () => {
       })();
 
       expect(dispatchSetKqlFilterQueryDraft).toHaveBeenCalledWith({
-        id: 'timeline-1',
+        id: TimelineId.active,
         filterQueryDraft: {
           kind: 'kuery',
           expression: 'expression',
         },
       });
       expect(dispatchApplyKqlFilterQuery).toHaveBeenCalledWith({
-        id: 'timeline-1',
+        id: TimelineId.active,
         filterQuery: {
           kuery: {
             kind: 'kuery',
@@ -1065,7 +1065,7 @@ describe('helpers', () => {
     test('it invokes dispatchAddNotes if duplicate is false', () => {
       timelineDispatch({
         duplicate: false,
-        id: 'timeline-1',
+        id: TimelineId.active,
         from: '2020-03-26T14:35:56.356Z',
         to: '2020-03-26T14:41:56.356Z',
         notes: [
@@ -1099,7 +1099,7 @@ describe('helpers', () => {
     test('it invokes dispatch to create a timeline note if duplicate is true and ruleNote exists', () => {
       timelineDispatch({
         duplicate: true,
-        id: 'timeline-1',
+        id: TimelineId.active,
         from: '2020-03-26T14:35:56.356Z',
         to: '2020-03-26T14:41:56.356Z',
         notes: [],
@@ -1119,7 +1119,7 @@ describe('helpers', () => {
       expect(dispatchAddNotes).not.toHaveBeenCalled();
       expect(dispatchUpdateNote).toHaveBeenCalledWith({ note: expectedNote });
       expect(dispatchAddGlobalTimelineNote).toHaveBeenLastCalledWith({
-        id: 'timeline-1',
+        id: TimelineId.active,
         noteId: 'uuid.v4()',
       });
     });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
index c2e23cc19d89e2..b6b6148340a4a9 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
@@ -22,7 +22,12 @@ import {
   DataProviderResult,
 } from '../../../graphql/types';
 
-import { DataProviderType, TimelineStatus, TimelineType } from '../../../../common/types/timeline';
+import {
+  DataProviderType,
+  TimelineId,
+  TimelineStatus,
+  TimelineType,
+} from '../../../../common/types/timeline';
 
 import {
   addNotes as dispatchAddNotes,
@@ -315,7 +320,7 @@ export const queryTimelineById = <TCache>({
   updateIsLoading,
   updateTimeline,
 }: QueryTimelineById<TCache>) => {
-  updateIsLoading({ id: 'timeline-1', isLoading: true });
+  updateIsLoading({ id: TimelineId.active, isLoading: true });
   if (apolloClient) {
     apolloClient
       .query<GetOneTimeline.Query, GetOneTimeline.Variables>({
@@ -343,7 +348,7 @@ export const queryTimelineById = <TCache>({
           updateTimeline({
             duplicate,
             from,
-            id: 'timeline-1',
+            id: TimelineId.active,
             notes,
             timeline: {
               ...timeline,
@@ -355,7 +360,7 @@ export const queryTimelineById = <TCache>({
         }
       })
       .finally(() => {
-        updateIsLoading({ id: 'timeline-1', isLoading: false });
+        updateIsLoading({ id: TimelineId.active, isLoading: false });
       });
   }
 };
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
index 4c5db80a6c916a..f681043a9047d9 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
@@ -11,6 +11,7 @@ import { Dispatch } from 'redux';
 
 import { DeleteTimelineMutation, SortFieldTimeline, Direction } from '../../../graphql/types';
 import { State } from '../../../common/store';
+import { TimelineId } from '../../../../common/types/timeline';
 import { ColumnHeaderOptions, TimelineModel } from '../../../timelines/store/timeline/model';
 import { timelineSelectors } from '../../../timelines/store/timeline';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
@@ -192,7 +193,7 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
     const deleteTimelines: DeleteTimelines = useCallback(
       async (timelineIds: string[]) => {
         if (timelineIds.includes(timeline.savedObjectId || '')) {
-          createNewTimeline({ id: 'timeline-1', columns: defaultHeaders, show: false });
+          createNewTimeline({ id: TimelineId.active, columns: defaultHeaders, show: false });
         }
 
         await apolloClient.mutate<
@@ -369,7 +370,7 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
 const makeMapStateToProps = () => {
   const getTimeline = timelineSelectors.getTimelineByIdSelector();
   const mapStateToProps = (state: State) => {
-    const timeline = getTimeline(state, 'timeline-1') ?? timelineDefaults;
+    const timeline = getTimeline(state, TimelineId.active) ?? timelineDefaults;
     return {
       timeline,
     };
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx
index 1f5f0ccca3b708..e9ae66703f0178 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx
@@ -224,7 +224,7 @@ export const OpenTimeline = React.memo<OpenTimelineProps>(
                       popoverContent={getBatchItemsPopoverContent}
                       data-test-subj="utility-bar-action"
                     >
-                      {i18n.BATCH_ACTIONS}
+                      <span data-test-subj="utility-bar-action-button">{i18n.BATCH_ACTIONS}</span>
                     </UtilityBarAction>
                   </>
                 )}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/row_renderers_browser/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/row_renderers_browser/index.tsx
index 2792b264ba7e26..d01e8634a489fd 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/row_renderers_browser/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/row_renderers_browser/index.tsx
@@ -102,12 +102,10 @@ const StatefulRowRenderersBrowserComponent: React.FC<StatefulRowRenderersBrowser
   const hideFieldBrowser = useCallback(() => setShow(false), []);
 
   const handleDisableAll = useCallback(() => {
-    // eslint-disable-next-line no-unused-expressions
     tableRef?.current?.setSelection([]);
   }, [tableRef]);
 
   const handleEnableAll = useCallback(() => {
-    // eslint-disable-next-line no-unused-expressions
     tableRef?.current?.setSelection(renderers);
   }, [tableRef]);
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/row_renderers_browser/row_renderers_browser.tsx b/x-pack/plugins/security_solution/public/timelines/components/row_renderers_browser/row_renderers_browser.tsx
index 7baa7c42fb45ec..f1414724e243fe 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/row_renderers_browser/row_renderers_browser.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/row_renderers_browser/row_renderers_browser.tsx
@@ -88,7 +88,7 @@ const RowRenderersBrowserComponent = React.forwardRef(
       (item: RowRendererOption) => () => {
         const newSelection = xor([item], notExcludedRowRenderers);
         // @ts-expect-error
-        ref?.current?.setSelection(newSelection); // eslint-disable-line no-unused-expressions
+        ref?.current?.setSelection(newSelection);
       },
       [notExcludedRowRenderers, ref]
     );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/action_icon_item.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/action_icon_item.tsx
new file mode 100644
index 00000000000000..64f8ce3727f39a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/action_icon_item.tsx
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { MouseEvent } from 'react';
+import { EuiButtonIcon, EuiToolTip } from '@elastic/eui';
+
+import { EventsTd, EventsTdContent } from '../../styles';
+import { DEFAULT_ICON_BUTTON_WIDTH } from '../../helpers';
+
+interface ActionIconItemProps {
+  ariaLabel?: string;
+  id: string;
+  width?: number;
+  dataTestSubj?: string;
+  content?: string;
+  iconType?: string;
+  isDisabled?: boolean;
+  onClick?: (event: MouseEvent) => void;
+  children?: React.ReactNode;
+}
+
+const ActionIconItemComponent: React.FC<ActionIconItemProps> = ({
+  id,
+  width = DEFAULT_ICON_BUTTON_WIDTH,
+  dataTestSubj,
+  content,
+  ariaLabel,
+  iconType,
+  isDisabled = false,
+  onClick,
+  children,
+}) => (
+  <EventsTd key={id}>
+    <EventsTdContent textAlign="center" width={width}>
+      {children ?? (
+        <EuiToolTip data-test-subj={`${dataTestSubj}-tool-tip`} content={content}>
+          <EuiButtonIcon
+            aria-label={ariaLabel}
+            data-test-subj={`${dataTestSubj}-button`}
+            iconType={iconType}
+            isDisabled={isDisabled}
+            onClick={onClick}
+          />
+        </EuiToolTip>
+      )}
+    </EventsTdContent>
+  </EventsTd>
+);
+
+ActionIconItemComponent.displayName = 'ActionIconItemComponent';
+
+export const ActionIconItem = React.memo(ActionIconItemComponent);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/add_note_icon_item.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/add_note_icon_item.tsx
new file mode 100644
index 00000000000000..a82821675d9565
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/add_note_icon_item.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { TimelineType, TimelineStatus } from '../../../../../../common/types/timeline';
+import { AssociateNote, UpdateNote } from '../../../notes/helpers';
+import * as i18n from '../translations';
+import { NotesButton } from '../../properties/helpers';
+import { Note } from '../../../../../common/lib/note';
+import { ActionIconItem } from './action_icon_item';
+
+interface AddEventNoteActionProps {
+  associateNote: AssociateNote;
+  getNotesByIds: (noteIds: string[]) => Note[];
+  noteIds: string[];
+  showNotes: boolean;
+  status: TimelineStatus;
+  timelineType: TimelineType;
+  toggleShowNotes: () => void;
+  updateNote: UpdateNote;
+}
+
+const AddEventNoteActionComponent: React.FC<AddEventNoteActionProps> = ({
+  associateNote,
+  getNotesByIds,
+  noteIds,
+  showNotes,
+  status,
+  timelineType,
+  toggleShowNotes,
+  updateNote,
+}) => (
+  <ActionIconItem id="add-note">
+    <NotesButton
+      animate={false}
+      associateNote={associateNote}
+      data-test-subj="add-note"
+      getNotesByIds={getNotesByIds}
+      noteIds={noteIds}
+      showNotes={showNotes}
+      size="s"
+      status={status}
+      timelineType={timelineType}
+      toggleShowNotes={toggleShowNotes}
+      toolTip={
+        timelineType === TimelineType.template ? i18n.NOTES_DISABLE_TOOLTIP : i18n.NOTES_TOOLTIP
+      }
+      updateNote={updateNote}
+    />
+  </ActionIconItem>
+);
+
+AddEventNoteActionComponent.displayName = 'AddEventNoteActionComponent';
+
+export const AddEventNoteAction = React.memo(AddEventNoteActionComponent);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
index 78ee9bdd053b20..fb1709df013205 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
@@ -9,10 +9,7 @@ import { useSelector } from 'react-redux';
 
 import { TestProviders, mockTimelineModel } from '../../../../../common/mock';
 import { DEFAULT_ACTIONS_COLUMN_WIDTH } from '../constants';
-import * as i18n from '../translations';
-
 import { Actions } from '.';
-import { TimelineType } from '../../../../../../common/types/timeline';
 
 jest.mock('react-redux', () => {
   const origin = jest.requireActual('react-redux');
@@ -30,22 +27,14 @@ describe('Actions', () => {
       <TestProviders>
         <Actions
           actionsColumnWidth={DEFAULT_ACTIONS_COLUMN_WIDTH}
-          associateNote={jest.fn()}
           checked={false}
           expanded={false}
           eventId="abc"
-          eventIsPinned={false}
-          getNotesByIds={jest.fn()}
           loading={false}
           loadingEventIds={[]}
-          noteIds={[]}
           onEventToggled={jest.fn()}
-          onPinClicked={jest.fn()}
           onRowSelected={jest.fn()}
           showCheckboxes={true}
-          showNotes={false}
-          toggleShowNotes={jest.fn()}
-          updateNote={jest.fn()}
         />
       </TestProviders>
     );
@@ -58,22 +47,14 @@ describe('Actions', () => {
       <TestProviders>
         <Actions
           actionsColumnWidth={DEFAULT_ACTIONS_COLUMN_WIDTH}
-          associateNote={jest.fn()}
           checked={false}
           expanded={false}
           eventId="abc"
-          eventIsPinned={false}
-          getNotesByIds={jest.fn()}
           loading={false}
           loadingEventIds={[]}
-          noteIds={[]}
           onEventToggled={jest.fn()}
-          onPinClicked={jest.fn()}
           onRowSelected={jest.fn()}
           showCheckboxes={false}
-          showNotes={false}
-          toggleShowNotes={jest.fn()}
-          updateNote={jest.fn()}
         />
       </TestProviders>
     );
@@ -86,22 +67,14 @@ describe('Actions', () => {
       <TestProviders>
         <Actions
           actionsColumnWidth={DEFAULT_ACTIONS_COLUMN_WIDTH}
-          associateNote={jest.fn()}
           checked={false}
           expanded={false}
           eventId="abc"
-          eventIsPinned={false}
-          getNotesByIds={jest.fn()}
           loading={false}
           loadingEventIds={[]}
-          noteIds={[]}
           onEventToggled={jest.fn()}
-          onPinClicked={jest.fn()}
           onRowSelected={jest.fn()}
           showCheckboxes={false}
-          showNotes={false}
-          toggleShowNotes={jest.fn()}
-          updateNote={jest.fn()}
         />
       </TestProviders>
     );
@@ -116,22 +89,14 @@ describe('Actions', () => {
       <TestProviders>
         <Actions
           actionsColumnWidth={DEFAULT_ACTIONS_COLUMN_WIDTH}
-          associateNote={jest.fn()}
           checked={false}
           expanded={false}
           eventId="abc"
-          eventIsPinned={false}
-          getNotesByIds={jest.fn()}
           loading={false}
           loadingEventIds={[]}
-          noteIds={[]}
           onEventToggled={onEventToggled}
-          onPinClicked={jest.fn()}
           onRowSelected={jest.fn()}
           showCheckboxes={false}
-          showNotes={false}
-          toggleShowNotes={jest.fn()}
-          updateNote={jest.fn()}
         />
       </TestProviders>
     );
@@ -140,197 +105,4 @@ describe('Actions', () => {
 
     expect(onEventToggled).toBeCalled();
   });
-
-  test('it does NOT render a notes button when isEventsViewer is true', () => {
-    const toggleShowNotes = jest.fn();
-
-    const wrapper = mount(
-      <TestProviders>
-        <Actions
-          actionsColumnWidth={DEFAULT_ACTIONS_COLUMN_WIDTH}
-          associateNote={jest.fn()}
-          checked={false}
-          expanded={false}
-          eventId="abc"
-          eventIsPinned={false}
-          getNotesByIds={jest.fn()}
-          isEventViewer={true}
-          loading={false}
-          loadingEventIds={[]}
-          noteIds={[]}
-          onEventToggled={jest.fn()}
-          onPinClicked={jest.fn()}
-          onRowSelected={jest.fn()}
-          showCheckboxes={false}
-          showNotes={false}
-          toggleShowNotes={toggleShowNotes}
-          updateNote={jest.fn()}
-        />
-      </TestProviders>
-    );
-
-    expect(wrapper.find('[data-test-subj="timeline-notes-button-small"]').exists()).toBe(false);
-  });
-
-  test('it invokes toggleShowNotes when the button for adding notes is clicked', () => {
-    const toggleShowNotes = jest.fn();
-
-    const wrapper = mount(
-      <TestProviders>
-        <Actions
-          actionsColumnWidth={DEFAULT_ACTIONS_COLUMN_WIDTH}
-          associateNote={jest.fn()}
-          checked={false}
-          expanded={false}
-          eventId="abc"
-          eventIsPinned={false}
-          getNotesByIds={jest.fn()}
-          loading={false}
-          loadingEventIds={[]}
-          noteIds={[]}
-          onEventToggled={jest.fn()}
-          onPinClicked={jest.fn()}
-          onRowSelected={jest.fn()}
-          showCheckboxes={false}
-          showNotes={false}
-          toggleShowNotes={toggleShowNotes}
-          updateNote={jest.fn()}
-        />
-      </TestProviders>
-    );
-
-    wrapper.find('[data-test-subj="timeline-notes-button-small"]').first().simulate('click');
-
-    expect(toggleShowNotes).toBeCalled();
-  });
-
-  test('it renders correct tooltip for NotesButton - timeline', () => {
-    const toggleShowNotes = jest.fn();
-
-    const wrapper = mount(
-      <TestProviders>
-        <Actions
-          actionsColumnWidth={DEFAULT_ACTIONS_COLUMN_WIDTH}
-          associateNote={jest.fn()}
-          checked={false}
-          expanded={false}
-          eventId="abc"
-          eventIsPinned={false}
-          getNotesByIds={jest.fn()}
-          loading={false}
-          loadingEventIds={[]}
-          noteIds={[]}
-          onEventToggled={jest.fn()}
-          onPinClicked={jest.fn()}
-          onRowSelected={jest.fn()}
-          showCheckboxes={false}
-          showNotes={false}
-          toggleShowNotes={toggleShowNotes}
-          updateNote={jest.fn()}
-        />
-      </TestProviders>
-    );
-
-    expect(wrapper.find('[data-test-subj="add-note"]').prop('toolTip')).toEqual(i18n.NOTES_TOOLTIP);
-  });
-
-  test('it renders correct tooltip for NotesButton - timeline template', () => {
-    (useSelector as jest.Mock).mockReturnValue({
-      ...mockTimelineModel,
-      timelineType: TimelineType.template,
-    });
-    const toggleShowNotes = jest.fn();
-
-    const wrapper = mount(
-      <TestProviders>
-        <Actions
-          actionsColumnWidth={DEFAULT_ACTIONS_COLUMN_WIDTH}
-          associateNote={jest.fn()}
-          checked={false}
-          expanded={false}
-          eventId="abc"
-          eventIsPinned={false}
-          getNotesByIds={jest.fn()}
-          loading={false}
-          loadingEventIds={[]}
-          noteIds={[]}
-          onEventToggled={jest.fn()}
-          onPinClicked={jest.fn()}
-          onRowSelected={jest.fn()}
-          showCheckboxes={false}
-          showNotes={false}
-          toggleShowNotes={toggleShowNotes}
-          updateNote={jest.fn()}
-        />
-      </TestProviders>
-    );
-
-    expect(wrapper.find('[data-test-subj="add-note"]').prop('toolTip')).toEqual(
-      i18n.NOTES_DISABLE_TOOLTIP
-    );
-    (useSelector as jest.Mock).mockReturnValue(mockTimelineModel);
-  });
-
-  test('it does NOT render a pin button when isEventViewer is true', () => {
-    const onPinClicked = jest.fn();
-
-    const wrapper = mount(
-      <TestProviders>
-        <Actions
-          actionsColumnWidth={DEFAULT_ACTIONS_COLUMN_WIDTH}
-          associateNote={jest.fn()}
-          checked={false}
-          expanded={false}
-          eventId="abc"
-          eventIsPinned={false}
-          getNotesByIds={jest.fn()}
-          isEventViewer={true}
-          loading={false}
-          loadingEventIds={[]}
-          noteIds={[]}
-          onEventToggled={jest.fn()}
-          onPinClicked={onPinClicked}
-          onRowSelected={jest.fn()}
-          showCheckboxes={false}
-          showNotes={false}
-          toggleShowNotes={jest.fn()}
-          updateNote={jest.fn()}
-        />
-      </TestProviders>
-    );
-
-    expect(wrapper.find('[data-test-subj="pin"]').exists()).toBe(false);
-  });
-
-  test('it invokes onPinClicked when the button for pinning events is clicked', () => {
-    const onPinClicked = jest.fn();
-
-    const wrapper = mount(
-      <TestProviders>
-        <Actions
-          actionsColumnWidth={DEFAULT_ACTIONS_COLUMN_WIDTH}
-          associateNote={jest.fn()}
-          checked={false}
-          expanded={false}
-          eventId="abc"
-          eventIsPinned={false}
-          getNotesByIds={jest.fn()}
-          loading={false}
-          loadingEventIds={[]}
-          noteIds={[]}
-          onEventToggled={jest.fn()}
-          onPinClicked={onPinClicked}
-          onRowSelected={jest.fn()}
-          showCheckboxes={false}
-          showNotes={false}
-          toggleShowNotes={jest.fn()}
-          updateNote={jest.fn()}
-        />
-      </TestProviders>
-    );
-
-    wrapper.find('[data-test-subj="pin"]').first().simulate('click');
-
-    expect(onPinClicked).toHaveBeenCalled();
-  });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
index c9c8250922161c..3d08d56d6fb195 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
@@ -3,203 +3,90 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React from 'react';
-import { useSelector } from 'react-redux';
-import { EuiButtonIcon, EuiCheckbox, EuiLoadingSpinner, EuiToolTip } from '@elastic/eui';
+import React, { useCallback } from 'react';
+import { EuiButtonIcon, EuiLoadingSpinner, EuiCheckbox } from '@elastic/eui';
 
-import { Note } from '../../../../../common/lib/note';
-import { StoreState } from '../../../../../common/store/types';
-import { TimelineType } from '../../../../../../common/types/timeline';
-
-import { TimelineModel } from '../../../../store/timeline/model';
-
-import { AssociateNote, UpdateNote } from '../../../notes/helpers';
-import { Pin } from '../../pin';
-import { NotesButton } from '../../properties/helpers';
 import { EventsLoading, EventsTd, EventsTdContent, EventsTdGroupActions } from '../../styles';
-import { eventHasNotes, getPinTooltip } from '../helpers';
 import * as i18n from '../translations';
 import { OnRowSelected } from '../../events';
-import { Ecs, TimelineNonEcsData } from '../../../../../graphql/types';
 import { DEFAULT_ICON_BUTTON_WIDTH } from '../../helpers';
 
-export interface TimelineRowActionOnClick {
-  eventId: string;
-  ecsData: Ecs;
-  data: TimelineNonEcsData[];
-}
-
-export interface TimelineRowAction {
-  ariaLabel?: string;
-  dataTestSubj?: string;
-  displayType: 'icon' | 'contextMenu';
-  iconType?: string;
-  id: string;
-  isActionDisabled?: (ecsData?: Ecs) => boolean;
-  onClick: ({ eventId, ecsData }: TimelineRowActionOnClick) => void;
-  content: string | JSX.Element;
-  width?: number;
-}
-
 interface Props {
   actionsColumnWidth: number;
   additionalActions?: JSX.Element[];
-  associateNote: AssociateNote;
   checked: boolean;
   onRowSelected: OnRowSelected;
   expanded: boolean;
   eventId: string;
-  eventIsPinned: boolean;
-  getNotesByIds: (noteIds: string[]) => Note[];
-  isEventViewer?: boolean;
   loading: boolean;
   loadingEventIds: Readonly<string[]>;
-  noteIds: string[];
   onEventToggled: () => void;
-  onPinClicked: () => void;
-  showNotes: boolean;
   showCheckboxes: boolean;
-  toggleShowNotes: () => void;
-  updateNote: UpdateNote;
 }
 
-const emptyNotes: string[] = [];
-
-export const Actions = React.memo<Props>(
-  ({
-    actionsColumnWidth,
-    additionalActions,
-    associateNote,
-    checked,
-    expanded,
-    eventId,
-    eventIsPinned,
-    getNotesByIds,
-    isEventViewer = false,
-    loading = false,
-    loadingEventIds,
-    noteIds,
-    onEventToggled,
-    onPinClicked,
-    onRowSelected,
-    showCheckboxes,
-    showNotes,
-    toggleShowNotes,
-    updateNote,
-  }) => {
-    const timeline = useSelector<StoreState, TimelineModel>((state) => {
-      return state.timeline.timelineById['timeline-1'];
-    });
-    return (
-      <EventsTdGroupActions
-        actionsColumnWidth={actionsColumnWidth}
-        data-test-subj="event-actions-container"
-      >
-        {showCheckboxes && (
-          <EventsTd key="select-event-container" data-test-subj="select-event-container">
-            <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
-              {loadingEventIds.includes(eventId) ? (
-                <EuiLoadingSpinner size="m" data-test-subj="event-loader" />
-              ) : (
-                <EuiCheckbox
-                  data-test-subj="select-event"
-                  id={eventId}
-                  checked={checked}
-                  onChange={(event: React.ChangeEvent<HTMLInputElement>) => {
-                    onRowSelected({
-                      eventIds: [eventId],
-                      isSelected: event.currentTarget.checked,
-                    });
-                  }}
-                />
-              )}
-            </EventsTdContent>
-          </EventsTd>
-        )}
+const ActionsComponent: React.FC<Props> = ({
+  actionsColumnWidth,
+  additionalActions,
+  checked,
+  expanded,
+  eventId,
+  loading = false,
+  loadingEventIds,
+  onEventToggled,
+  onRowSelected,
+  showCheckboxes,
+}) => {
+  const handleSelectEvent = useCallback(
+    (event: React.ChangeEvent<HTMLInputElement>) =>
+      onRowSelected({
+        eventIds: [eventId],
+        isSelected: event.currentTarget.checked,
+      }),
+    [eventId, onRowSelected]
+  );
 
-        <EventsTd key="expand-event">
+  return (
+    <EventsTdGroupActions
+      actionsColumnWidth={actionsColumnWidth}
+      data-test-subj="event-actions-container"
+    >
+      {showCheckboxes && (
+        <EventsTd key="select-event-container" data-test-subj="select-event-container">
           <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
-            {loading ? (
-              <EventsLoading />
+            {loadingEventIds.includes(eventId) ? (
+              <EuiLoadingSpinner size="m" data-test-subj="event-loader" />
             ) : (
-              <EuiButtonIcon
-                aria-label={expanded ? i18n.COLLAPSE : i18n.EXPAND}
-                data-test-subj="expand-event"
-                iconType={expanded ? 'arrowDown' : 'arrowRight'}
+              <EuiCheckbox
+                data-test-subj="select-event"
                 id={eventId}
-                onClick={onEventToggled}
+                checked={checked}
+                onChange={handleSelectEvent}
               />
             )}
           </EventsTdContent>
         </EventsTd>
+      )}
+      <EventsTd key="expand-event">
+        <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
+          {loading ? (
+            <EventsLoading />
+          ) : (
+            <EuiButtonIcon
+              aria-label={expanded ? i18n.COLLAPSE : i18n.EXPAND}
+              data-test-subj="expand-event"
+              iconType={expanded ? 'arrowDown' : 'arrowRight'}
+              id={eventId}
+              onClick={onEventToggled}
+            />
+          )}
+        </EventsTdContent>
+      </EventsTd>
 
-        <>{additionalActions}</>
+      <>{additionalActions}</>
+    </EventsTdGroupActions>
+  );
+};
 
-        {!isEventViewer && (
-          <>
-            <EventsTd key="timeline-action-pin-tool-tip">
-              <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
-                <EuiToolTip
-                  data-test-subj="timeline-action-pin-tool-tip"
-                  content={getPinTooltip({
-                    isPinned: eventIsPinned,
-                    eventHasNotes: eventHasNotes(noteIds),
-                    timelineType: timeline.timelineType,
-                  })}
-                >
-                  <Pin
-                    allowUnpinning={!eventHasNotes(noteIds)}
-                    data-test-subj="pin-event"
-                    onClick={onPinClicked}
-                    pinned={eventIsPinned}
-                    timelineType={timeline.timelineType}
-                  />
-                </EuiToolTip>
-              </EventsTdContent>
-            </EventsTd>
+ActionsComponent.displayName = 'ActionsComponent';
 
-            <EventsTd key="add-note">
-              <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
-                <NotesButton
-                  animate={false}
-                  associateNote={associateNote}
-                  data-test-subj="add-note"
-                  getNotesByIds={getNotesByIds}
-                  noteIds={noteIds || emptyNotes}
-                  showNotes={showNotes}
-                  size="s"
-                  status={timeline.status}
-                  timelineType={timeline.timelineType}
-                  toggleShowNotes={toggleShowNotes}
-                  toolTip={
-                    timeline.timelineType === TimelineType.template
-                      ? i18n.NOTES_DISABLE_TOOLTIP
-                      : i18n.NOTES_TOOLTIP
-                  }
-                  updateNote={updateNote}
-                />
-              </EventsTdContent>
-            </EventsTd>
-          </>
-        )}
-      </EventsTdGroupActions>
-    );
-  },
-  (nextProps, prevProps) => {
-    return (
-      prevProps.actionsColumnWidth === nextProps.actionsColumnWidth &&
-      prevProps.additionalActions === nextProps.additionalActions &&
-      prevProps.checked === nextProps.checked &&
-      prevProps.expanded === nextProps.expanded &&
-      prevProps.eventId === nextProps.eventId &&
-      prevProps.eventIsPinned === nextProps.eventIsPinned &&
-      prevProps.loading === nextProps.loading &&
-      prevProps.loadingEventIds === nextProps.loadingEventIds &&
-      prevProps.noteIds === nextProps.noteIds &&
-      prevProps.onRowSelected === nextProps.onRowSelected &&
-      prevProps.showCheckboxes === nextProps.showCheckboxes &&
-      prevProps.showNotes === nextProps.showNotes
-    );
-  }
-);
-Actions.displayName = 'Actions';
+export const Actions = React.memo(ActionsComponent);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/pin_event_action.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/pin_event_action.tsx
new file mode 100644
index 00000000000000..2f9f15938cad66
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/pin_event_action.tsx
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useMemo } from 'react';
+import { EuiToolTip } from '@elastic/eui';
+
+import { EventsTd, EventsTdContent } from '../../styles';
+import { DEFAULT_ICON_BUTTON_WIDTH } from '../../helpers';
+import { eventHasNotes, getPinTooltip } from '../helpers';
+import { Pin } from '../../pin';
+import { TimelineType } from '../../../../../../common/types/timeline';
+
+interface PinEventActionProps {
+  noteIds: string[];
+  onPinClicked: () => void;
+  eventIsPinned: boolean;
+  timelineType: TimelineType;
+}
+
+const PinEventActionComponent: React.FC<PinEventActionProps> = ({
+  noteIds,
+  onPinClicked,
+  eventIsPinned,
+  timelineType,
+}) => {
+  const tooltipContent = useMemo(
+    () =>
+      getPinTooltip({
+        isPinned: eventIsPinned,
+        eventHasNotes: eventHasNotes(noteIds),
+        timelineType,
+      }),
+    [eventIsPinned, noteIds, timelineType]
+  );
+
+  return (
+    <EventsTd key="timeline-action-pin-tool-tip">
+      <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
+        <EuiToolTip data-test-subj="timeline-action-pin-tool-tip" content={tooltipContent}>
+          <Pin
+            allowUnpinning={!eventHasNotes(noteIds)}
+            data-test-subj="pin-event"
+            onClick={onPinClicked}
+            pinned={eventIsPinned}
+            timelineType={timelineType}
+          />
+        </EuiToolTip>
+      </EventsTdContent>
+    </EventsTd>
+  );
+};
+
+PinEventActionComponent.displayName = 'PinEventActionComponent';
+
+export const PinEventAction = React.memo(PinEventActionComponent);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx
index a3e177604fbd47..120fc12b425f4a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.tsx
@@ -235,7 +235,6 @@ export const ColumnHeadersComponent = ({
               columnHeaders={columnHeaders}
               data-test-subj="field-browser"
               height={FIELD_BROWSER_HEIGHT}
-              isEventViewer={isEventViewer}
               onUpdateColumns={onUpdateColumns}
               timelineId={timelineId}
               toggleColumn={toggleColumn}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.test.tsx
new file mode 100644
index 00000000000000..ae552ade665cbc
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.test.tsx
@@ -0,0 +1,117 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { mount } from 'enzyme';
+import React from 'react';
+import { useSelector } from 'react-redux';
+
+import { TestProviders, mockTimelineModel } from '../../../../../common/mock';
+import { DEFAULT_ACTIONS_COLUMN_WIDTH } from '../constants';
+import * as i18n from '../translations';
+
+import { EventColumnView } from './event_column_view';
+import { TimelineType } from '../../../../../../common/types/timeline';
+
+jest.mock('react-redux', () => {
+  const origin = jest.requireActual('react-redux');
+  return {
+    ...origin,
+    useSelector: jest.fn(),
+  };
+});
+
+describe('EventColumnView', () => {
+  (useSelector as jest.Mock).mockReturnValue(mockTimelineModel);
+
+  const props = {
+    id: 'event-id',
+    actionsColumnWidth: DEFAULT_ACTIONS_COLUMN_WIDTH,
+    associateNote: jest.fn(),
+    columnHeaders: [],
+    columnRenderers: [],
+    data: [
+      {
+        field: 'host.name',
+      },
+    ],
+    ecsData: {
+      _id: 'id',
+    },
+    eventIdToNoteIds: {},
+    expanded: false,
+    getNotesByIds: jest.fn(),
+    loading: false,
+    loadingEventIds: [],
+    onColumnResized: jest.fn(),
+    onEventToggled: jest.fn(),
+    onPinEvent: jest.fn(),
+    onRowSelected: jest.fn(),
+    onUnPinEvent: jest.fn(),
+    refetch: jest.fn(),
+    selectedEventIds: {},
+    showCheckboxes: false,
+    showNotes: false,
+    timelineId: 'timeline-1',
+    toggleShowNotes: jest.fn(),
+    updateNote: jest.fn(),
+    isEventPinned: false,
+  };
+
+  test('it does NOT render a notes button when isEventsViewer is true', () => {
+    const wrapper = mount(<EventColumnView {...props} isEventViewer={true} />, {
+      wrappingComponent: TestProviders,
+    });
+
+    expect(wrapper.find('[data-test-subj="timeline-notes-button-small"]').exists()).toBe(false);
+  });
+
+  test('it invokes toggleShowNotes when the button for adding notes is clicked', () => {
+    const wrapper = mount(<EventColumnView {...props} />, { wrappingComponent: TestProviders });
+
+    expect(props.toggleShowNotes).not.toHaveBeenCalled();
+
+    wrapper.find('[data-test-subj="timeline-notes-button-small"]').first().simulate('click');
+
+    expect(props.toggleShowNotes).toHaveBeenCalled();
+  });
+
+  test('it renders correct tooltip for NotesButton - timeline', () => {
+    const wrapper = mount(<EventColumnView {...props} />, { wrappingComponent: TestProviders });
+
+    expect(wrapper.find('[data-test-subj="add-note"]').prop('toolTip')).toEqual(i18n.NOTES_TOOLTIP);
+  });
+
+  test('it renders correct tooltip for NotesButton - timeline template', () => {
+    (useSelector as jest.Mock).mockReturnValue({
+      ...mockTimelineModel,
+      timelineType: TimelineType.template,
+    });
+
+    const wrapper = mount(<EventColumnView {...props} />, { wrappingComponent: TestProviders });
+
+    expect(wrapper.find('[data-test-subj="add-note"]').prop('toolTip')).toEqual(
+      i18n.NOTES_DISABLE_TOOLTIP
+    );
+    (useSelector as jest.Mock).mockReturnValue(mockTimelineModel);
+  });
+
+  test('it does NOT render a pin button when isEventViewer is true', () => {
+    const wrapper = mount(<EventColumnView {...props} isEventViewer={true} />, {
+      wrappingComponent: TestProviders,
+    });
+
+    expect(wrapper.find('[data-test-subj="pin"]').exists()).toBe(false);
+  });
+
+  test('it invokes onPinClicked when the button for pinning events is clicked', () => {
+    const wrapper = mount(<EventColumnView {...props} />, { wrappingComponent: TestProviders });
+
+    expect(props.onPinEvent).not.toHaveBeenCalled();
+
+    wrapper.find('[data-test-subj="pin"]').first().simulate('click');
+
+    expect(props.onPinEvent).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
index e7462188001e99..f1d45d5458554e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
@@ -4,29 +4,34 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useCallback, useMemo, useState } from 'react';
+import React, { useCallback, useMemo } from 'react';
 import uuid from 'uuid';
+import { useSelector, shallowEqual } from 'react-redux';
 
-import {
-  EuiButtonIcon,
-  EuiToolTip,
-  EuiContextMenuPanel,
-  EuiPopover,
-  EuiContextMenuItem,
-} from '@elastic/eui';
-import styled from 'styled-components';
 import { TimelineNonEcsData, Ecs } from '../../../../../graphql/types';
-import { DEFAULT_ICON_BUTTON_WIDTH } from '../../helpers';
 import { Note } from '../../../../../common/lib/note';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
 import { AssociateNote, UpdateNote } from '../../../notes/helpers';
 import { OnColumnResized, OnPinEvent, OnRowSelected, OnUnPinEvent } from '../../events';
-import { EventsTd, EventsTdContent, EventsTrData } from '../../styles';
+import { EventsTrData } from '../../styles';
 import { Actions } from '../actions';
 import { DataDrivenColumns } from '../data_driven_columns';
-import { eventHasNotes, getPinOnClick } from '../helpers';
+import {
+  eventHasNotes,
+  getEventType,
+  getPinOnClick,
+  InvestigateInResolverAction,
+} from '../helpers';
 import { ColumnRenderer } from '../renderers/column_renderer';
-import { useManageTimeline } from '../../../manage_timeline';
+import { AlertContextMenu } from '../../../../../detections/components/alerts_table/timeline_actions/alert_context_menu';
+import { InvestigateInTimelineAction } from '../../../../../detections/components/alerts_table/timeline_actions/investigate_in_timeline_action';
+import { AddEventNoteAction } from '../actions/add_note_icon_item';
+import { PinEventAction } from '../actions/pin_event_action';
+import { StoreState } from '../../../../../common/store/types';
+import { inputsModel } from '../../../../../common/store';
+import { TimelineId } from '../../../../../../common/types/timeline';
+
+import { TimelineModel } from '../../../../store/timeline/model';
 
 interface Props {
   id: string;
@@ -48,6 +53,7 @@ interface Props {
   onPinEvent: OnPinEvent;
   onRowSelected: OnRowSelected;
   onUnPinEvent: OnUnPinEvent;
+  refetch: inputsModel.Refetch;
   selectedEventIds: Readonly<Record<string, TimelineNonEcsData[]>>;
   showCheckboxes: boolean;
   showNotes: boolean;
@@ -81,6 +87,7 @@ export const EventColumnView = React.memo<Props>(
     onPinEvent,
     onRowSelected,
     onUnPinEvent,
+    refetch,
     selectedEventIds,
     showCheckboxes,
     showNotes,
@@ -88,114 +95,10 @@ export const EventColumnView = React.memo<Props>(
     toggleShowNotes,
     updateNote,
   }) => {
-    const { getManageTimelineById } = useManageTimeline();
-    const timelineActions = useMemo(
-      () => getManageTimelineById(timelineId).timelineRowActions({ nonEcsData: data, ecsData }),
-      [data, ecsData, getManageTimelineById, timelineId]
+    const { timelineType, status } = useSelector<StoreState, TimelineModel>(
+      (state) => state.timeline.timelineById[timelineId],
+      shallowEqual
     );
-    const [isPopoverOpen, setPopover] = useState(false);
-
-    const onButtonClick = useCallback(() => {
-      setPopover(!isPopoverOpen);
-    }, [isPopoverOpen]);
-
-    const closePopover = useCallback(() => {
-      setPopover(false);
-    }, []);
-
-    const button = (
-      <EuiButtonIcon
-        aria-label="context menu"
-        data-test-subj="timeline-context-menu-button"
-        size="s"
-        iconType="boxesHorizontal"
-        onClick={onButtonClick}
-      />
-    );
-
-    const onClickCb = useCallback((cb: () => void) => {
-      cb();
-      closePopover();
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, []);
-
-    const additionalActions = useMemo<JSX.Element[]>(() => {
-      const grouped = timelineActions.reduce(
-        (
-          acc: {
-            contextMenu: JSX.Element[];
-            icon: JSX.Element[];
-          },
-          action
-        ) => {
-          if (action.displayType === 'icon') {
-            return {
-              ...acc,
-              icon: [
-                ...acc.icon,
-                <EventsTd key={action.id}>
-                  <EventsTdContent textAlign="center" width={action.width}>
-                    <EuiToolTip
-                      data-test-subj={`${action.dataTestSubj}-tool-tip`}
-                      content={action.content}
-                    >
-                      <EuiButtonIcon
-                        aria-label={action.ariaLabel}
-                        data-test-subj={`${action.dataTestSubj}-button`}
-                        iconType={action.iconType}
-                        isDisabled={
-                          action.isActionDisabled != null ? action.isActionDisabled(ecsData) : false
-                        }
-                        onClick={() => action.onClick({ eventId: id, ecsData, data })}
-                      />
-                    </EuiToolTip>
-                  </EventsTdContent>
-                </EventsTd>,
-              ],
-            };
-          }
-          return {
-            ...acc,
-            contextMenu: [
-              ...acc.contextMenu,
-              <EuiContextMenuItem
-                aria-label={action.ariaLabel}
-                data-test-subj={action.dataTestSubj}
-                disabled={
-                  action.isActionDisabled != null ? action.isActionDisabled(ecsData) : false
-                }
-                icon={action.iconType}
-                key={action.id}
-                onClick={() => onClickCb(() => action.onClick({ eventId: id, ecsData, data }))}
-              >
-                {action.content}
-              </EuiContextMenuItem>,
-            ],
-          };
-        },
-        { icon: [], contextMenu: [] }
-      );
-      return grouped.contextMenu.length > 0
-        ? [
-            ...grouped.icon,
-            <EventsTd key="actions-context-menu">
-              <EventsTdContent textAlign="center" width={DEFAULT_ICON_BUTTON_WIDTH}>
-                <EuiPopover
-                  id="singlePanel"
-                  button={button}
-                  isOpen={isPopoverOpen}
-                  closePopover={closePopover}
-                  panelPaddingSize="none"
-                  anchorPosition="downLeft"
-                  repositionOnScroll
-                >
-                  <ContextMenuPanel items={grouped.contextMenu} />
-                </EuiPopover>
-              </EventsTdContent>
-            </EventsTd>,
-          ]
-        : grouped.icon;
-    }, [button, closePopover, id, onClickCb, data, ecsData, timelineActions, isPopoverOpen]);
 
     const handlePinClicked = useCallback(
       () =>
@@ -209,29 +112,90 @@ export const EventColumnView = React.memo<Props>(
       [eventIdToNoteIds, id, isEventPinned, onPinEvent, onUnPinEvent]
     );
 
+    const eventType = getEventType(ecsData);
+
+    const additionalActions = useMemo<JSX.Element[]>(
+      () => [
+        <InvestigateInResolverAction
+          key="investigate-in-resolver"
+          timelineId={timelineId}
+          ecsData={ecsData}
+        />,
+        ...(timelineId !== TimelineId.active && eventType === 'signal'
+          ? [
+              <InvestigateInTimelineAction
+                key="investigate-in-timeline"
+                ecsRowData={ecsData}
+                nonEcsRowData={data}
+              />,
+            ]
+          : []),
+        ...(!isEventViewer
+          ? [
+              <AddEventNoteAction
+                key="add-event-note"
+                associateNote={associateNote}
+                getNotesByIds={getNotesByIds}
+                noteIds={eventIdToNoteIds[id] || emptyNotes}
+                showNotes={showNotes}
+                toggleShowNotes={toggleShowNotes}
+                updateNote={updateNote}
+                status={status}
+                timelineType={timelineType}
+              />,
+              <PinEventAction
+                key="pin-event"
+                onPinClicked={handlePinClicked}
+                noteIds={eventIdToNoteIds[id] || emptyNotes}
+                eventIsPinned={isEventPinned}
+                timelineType={timelineType}
+              />,
+            ]
+          : []),
+        <AlertContextMenu
+          key="alert-context-menu"
+          ecsRowData={ecsData}
+          nonEcsRowData={data}
+          timelineId={timelineId}
+          disabled={eventType !== 'signal'}
+          refetch={refetch}
+        />,
+      ],
+      [
+        associateNote,
+        data,
+        ecsData,
+        eventIdToNoteIds,
+        eventType,
+        getNotesByIds,
+        handlePinClicked,
+        id,
+        isEventPinned,
+        isEventViewer,
+        refetch,
+        showNotes,
+        status,
+        timelineId,
+        timelineType,
+        toggleShowNotes,
+        updateNote,
+      ]
+    );
+
     return (
       <EventsTrData data-test-subj="event-column-view">
         <Actions
           actionsColumnWidth={actionsColumnWidth}
           additionalActions={additionalActions}
-          associateNote={associateNote}
           checked={Object.keys(selectedEventIds).includes(id)}
           onRowSelected={onRowSelected}
           expanded={expanded}
           data-test-subj="actions"
           eventId={id}
-          eventIsPinned={isEventPinned}
-          getNotesByIds={getNotesByIds}
-          isEventViewer={isEventViewer}
           loading={loading}
           loadingEventIds={loadingEventIds}
-          noteIds={eventIdToNoteIds[id] || emptyNotes}
           onEventToggled={onEventToggled}
-          onPinClicked={handlePinClicked}
           showCheckboxes={showCheckboxes}
-          showNotes={showNotes}
-          toggleShowNotes={toggleShowNotes}
-          updateNote={updateNote}
         />
 
         <DataDrivenColumns
@@ -245,29 +209,7 @@ export const EventColumnView = React.memo<Props>(
         />
       </EventsTrData>
     );
-  },
-  (prevProps, nextProps) => {
-    return (
-      prevProps.id === nextProps.id &&
-      prevProps.actionsColumnWidth === nextProps.actionsColumnWidth &&
-      prevProps.columnHeaders === nextProps.columnHeaders &&
-      prevProps.columnRenderers === nextProps.columnRenderers &&
-      prevProps.data === nextProps.data &&
-      prevProps.eventIdToNoteIds === nextProps.eventIdToNoteIds &&
-      prevProps.expanded === nextProps.expanded &&
-      prevProps.loading === nextProps.loading &&
-      prevProps.loadingEventIds === nextProps.loadingEventIds &&
-      prevProps.isEventPinned === nextProps.isEventPinned &&
-      prevProps.onRowSelected === nextProps.onRowSelected &&
-      prevProps.selectedEventIds === nextProps.selectedEventIds &&
-      prevProps.showCheckboxes === nextProps.showCheckboxes &&
-      prevProps.showNotes === nextProps.showNotes &&
-      prevProps.timelineId === nextProps.timelineId
-    );
   }
 );
-const ContextMenuPanel = styled(EuiContextMenuPanel)`
-  font-size: ${({ theme }) => theme.eui.euiFontSizeS};
-`;
 
-ContextMenuPanel.displayName = 'ContextMenuPanel';
+EventColumnView.displayName = 'EventColumnView';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx
index ca7a64db58c957..64d55f8cf6c6a2 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx
@@ -6,6 +6,7 @@
 
 import React from 'react';
 
+import { inputsModel } from '../../../../../common/store';
 import { BrowserFields, DocValueFields } from '../../../../../common/containers/source';
 import { TimelineItem, TimelineNonEcsData } from '../../../../../graphql/types';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
@@ -44,6 +45,7 @@ interface Props {
   onUpdateColumns: OnUpdateColumns;
   onUnPinEvent: OnUnPinEvent;
   pinnedEventIds: Readonly<Record<string, boolean>>;
+  refetch: inputsModel.Refetch;
   rowRenderers: RowRenderer[];
   selectedEventIds: Readonly<Record<string, TimelineNonEcsData[]>>;
   showCheckboxes: boolean;
@@ -71,6 +73,7 @@ const EventsComponent: React.FC<Props> = ({
   onUpdateColumns,
   onUnPinEvent,
   pinnedEventIds,
+  refetch,
   rowRenderers,
   selectedEventIds,
   showCheckboxes,
@@ -78,7 +81,7 @@ const EventsComponent: React.FC<Props> = ({
   updateNote,
 }) => (
   <EventsTbody data-test-subj="events">
-    {data.map((event, i) => (
+    {data.map((event) => (
       <StatefulEvent
         actionsColumnWidth={actionsColumnWidth}
         addNoteToEvent={addNoteToEvent}
@@ -100,6 +103,7 @@ const EventsComponent: React.FC<Props> = ({
         onRowSelected={onRowSelected}
         onUnPinEvent={onUnPinEvent}
         onUpdateColumns={onUpdateColumns}
+        refetch={refetch}
         rowRenderers={rowRenderers}
         selectedEventIds={selectedEventIds}
         showCheckboxes={showCheckboxes}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
index 3236482e6bc273..9691327f2c9884 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
@@ -9,9 +9,11 @@ import { useSelector } from 'react-redux';
 import uuid from 'uuid';
 import VisibilitySensor from 'react-visibility-sensor';
 
+import { TimelineId } from '../../../../../../common/types/timeline';
 import { BrowserFields, DocValueFields } from '../../../../../common/containers/source';
-import { TimelineDetailsQuery } from '../../../../containers/details';
-import { TimelineItem, DetailItem, TimelineNonEcsData } from '../../../../../graphql/types';
+import { useTimelineDetails } from '../../../../containers/details';
+import { TimelineItem, TimelineNonEcsData } from '../../../../../graphql/types';
+import { DetailItem } from '../../../../../../common/search_strategy/timeline';
 import { Note } from '../../../../../common/lib/note';
 import { ColumnHeaderOptions, TimelineModel } from '../../../../../timelines/store/timeline/model';
 import { AddNoteToEvent, UpdateNote } from '../../../notes/helpers';
@@ -33,7 +35,7 @@ import { getEventType } from '../helpers';
 import { NoteCards } from '../../../notes/note_cards';
 import { useEventDetailsWidthContext } from '../../../../../common/components/events_viewer/event_details_width_context';
 import { EventColumnView } from './event_column_view';
-import { StoreState } from '../../../../../common/store';
+import { inputsModel, StoreState } from '../../../../../common/store';
 
 interface Props {
   actionsColumnWidth: number;
@@ -55,6 +57,7 @@ interface Props {
   onUnPinEvent: OnUnPinEvent;
   onUpdateColumns: OnUpdateColumns;
   isEventPinned: boolean;
+  refetch: inputsModel.Refetch;
   rowRenderers: RowRenderer[];
   selectedEventIds: Readonly<Record<string, TimelineNonEcsData[]>>;
   showCheckboxes: boolean;
@@ -121,6 +124,7 @@ const StatefulEventComponent: React.FC<Props> = ({
   onRowSelected,
   onUnPinEvent,
   onUpdateColumns,
+  refetch,
   rowRenderers,
   selectedEventIds,
   showCheckboxes,
@@ -130,10 +134,16 @@ const StatefulEventComponent: React.FC<Props> = ({
 }) => {
   const [expanded, setExpanded] = useState<{ [eventId: string]: boolean }>({});
   const [showNotes, setShowNotes] = useState<{ [eventId: string]: boolean }>({});
-  const timeline = useSelector<StoreState, TimelineModel>((state) => {
-    return state.timeline.timelineById['timeline-1'];
-  });
+  const { status: timelineStatus } = useSelector<StoreState, TimelineModel>(
+    (state) => state.timeline.timelineById[TimelineId.active]
+  );
   const divElement = useRef<HTMLDivElement | null>(null);
+  const [loading, detailsData] = useTimelineDetails({
+    docValueFields,
+    indexName: event._index!,
+    eventId: event._id,
+    executeQuery: !!expanded[event._id],
+  });
 
   const onToggleShowNotes = useCallback(() => {
     const eventId = event._id;
@@ -171,93 +181,84 @@ const StatefulEventComponent: React.FC<Props> = ({
       {({ isVisible }) => {
         if (isVisible || disableSensorVisibility) {
           return (
-            <TimelineDetailsQuery
-              docValueFields={docValueFields}
-              sourceId="default"
-              indexName={event._index!}
-              eventId={event._id}
-              executeQuery={!!expanded[event._id]}
+            <EventsTrGroup
+              className={STATEFUL_EVENT_CSS_CLASS_NAME}
+              data-test-subj="event"
+              eventType={getEventType(event.ecs)}
+              showLeftBorder={!isEventViewer}
+              ref={divElement}
             >
-              {({ detailsData, loading }) => (
-                <EventsTrGroup
-                  className={STATEFUL_EVENT_CSS_CLASS_NAME}
-                  data-test-subj="event"
-                  eventType={getEventType(event.ecs)}
-                  showLeftBorder={!isEventViewer}
-                  ref={divElement}
+              <EventColumnView
+                id={event._id}
+                actionsColumnWidth={actionsColumnWidth}
+                associateNote={associateNote}
+                columnHeaders={columnHeaders}
+                columnRenderers={columnRenderers}
+                data={event.data}
+                ecsData={event.ecs}
+                expanded={!!expanded[event._id]}
+                eventIdToNoteIds={eventIdToNoteIds}
+                getNotesByIds={getNotesByIds}
+                isEventPinned={isEventPinned}
+                isEventViewer={isEventViewer}
+                loading={loading}
+                loadingEventIds={loadingEventIds}
+                onColumnResized={onColumnResized}
+                onEventToggled={onToggleExpanded}
+                onPinEvent={onPinEvent}
+                onRowSelected={onRowSelected}
+                onUnPinEvent={onUnPinEvent}
+                refetch={refetch}
+                selectedEventIds={selectedEventIds}
+                showCheckboxes={showCheckboxes}
+                showNotes={!!showNotes[event._id]}
+                timelineId={timelineId}
+                toggleShowNotes={onToggleShowNotes}
+                updateNote={updateNote}
+              />
+
+              <EventsTrSupplementContainerWrapper>
+                <EventsTrSupplement
+                  className="siemEventsTable__trSupplement--notes"
+                  data-test-subj="event-notes-flex-item"
                 >
-                  <EventColumnView
-                    id={event._id}
-                    actionsColumnWidth={actionsColumnWidth}
+                  <NoteCards
                     associateNote={associateNote}
-                    columnHeaders={columnHeaders}
-                    columnRenderers={columnRenderers}
-                    data={event.data}
-                    ecsData={event.ecs}
-                    expanded={!!expanded[event._id]}
-                    eventIdToNoteIds={eventIdToNoteIds}
+                    data-test-subj="note-cards"
+                    getNewNoteId={getNewNoteId}
                     getNotesByIds={getNotesByIds}
-                    isEventPinned={isEventPinned}
-                    isEventViewer={isEventViewer}
-                    loading={loading}
-                    loadingEventIds={loadingEventIds}
-                    onColumnResized={onColumnResized}
-                    onEventToggled={onToggleExpanded}
-                    onPinEvent={onPinEvent}
-                    onRowSelected={onRowSelected}
-                    onUnPinEvent={onUnPinEvent}
-                    selectedEventIds={selectedEventIds}
-                    showCheckboxes={showCheckboxes}
-                    showNotes={!!showNotes[event._id]}
-                    timelineId={timelineId}
-                    toggleShowNotes={onToggleShowNotes}
+                    noteIds={eventIdToNoteIds[event._id] || emptyNotes}
+                    showAddNote={!!showNotes[event._id]}
+                    status={timelineStatus}
+                    toggleShowAddNote={onToggleShowNotes}
                     updateNote={updateNote}
                   />
+                </EventsTrSupplement>
 
-                  <EventsTrSupplementContainerWrapper>
-                    <EventsTrSupplement
-                      className="siemEventsTable__trSupplement--notes"
-                      data-test-subj="event-notes-flex-item"
-                    >
-                      <NoteCards
-                        associateNote={associateNote}
-                        data-test-subj="note-cards"
-                        getNewNoteId={getNewNoteId}
-                        getNotesByIds={getNotesByIds}
-                        noteIds={eventIdToNoteIds[event._id] || emptyNotes}
-                        showAddNote={!!showNotes[event._id]}
-                        status={timeline.status}
-                        toggleShowAddNote={onToggleShowNotes}
-                        updateNote={updateNote}
-                      />
-                    </EventsTrSupplement>
+                {getRowRenderer(event.ecs, rowRenderers).renderRow({
+                  browserFields,
+                  data: event.ecs,
+                  timelineId,
+                })}
 
-                    {getRowRenderer(event.ecs, rowRenderers).renderRow({
-                      browserFields,
-                      data: event.ecs,
-                      timelineId,
-                    })}
-
-                    <EventsTrSupplement
-                      className="siemEventsTable__trSupplement--attributes"
-                      data-test-subj="event-details"
-                    >
-                      <ExpandableEvent
-                        browserFields={browserFields}
-                        columnHeaders={columnHeaders}
-                        event={detailsData || emptyDetails}
-                        forceExpand={!!expanded[event._id] && !loading}
-                        id={event._id}
-                        onEventToggled={onToggleExpanded}
-                        onUpdateColumns={onUpdateColumns}
-                        timelineId={timelineId}
-                        toggleColumn={toggleColumn}
-                      />
-                    </EventsTrSupplement>
-                  </EventsTrSupplementContainerWrapper>
-                </EventsTrGroup>
-              )}
-            </TimelineDetailsQuery>
+                <EventsTrSupplement
+                  className="siemEventsTable__trSupplement--attributes"
+                  data-test-subj="event-details"
+                >
+                  <ExpandableEvent
+                    browserFields={browserFields}
+                    columnHeaders={columnHeaders}
+                    event={detailsData || emptyDetails}
+                    forceExpand={!!expanded[event._id] && !loading}
+                    id={event._id}
+                    onEventToggled={onToggleExpanded}
+                    onUpdateColumns={onUpdateColumns}
+                    timelineId={timelineId}
+                    toggleColumn={toggleColumn}
+                  />
+                </EventsTrSupplement>
+              </EventsTrSupplementContainerWrapper>
+            </EventsTrGroup>
           );
         } else {
           // Height place holder for visibility detection as well as re-rendering sections.
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.ts
deleted file mode 100644
index b62888fbf84272..00000000000000
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.ts
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { get, isEmpty } from 'lodash/fp';
-import { Dispatch } from 'redux';
-
-import { Ecs, TimelineItem, TimelineNonEcsData } from '../../../../graphql/types';
-import { DEFAULT_ICON_BUTTON_WIDTH } from '../helpers';
-import { updateTimelineGraphEventId } from '../../../store/timeline/actions';
-import { EventType } from '../../../../timelines/store/timeline/model';
-import { OnPinEvent, OnUnPinEvent } from '../events';
-
-import { TimelineRowAction, TimelineRowActionOnClick } from './actions';
-
-import * as i18n from './translations';
-import { TimelineTypeLiteral, TimelineType } from '../../../../../common/types/timeline';
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export const omitTypenameAndEmpty = (k: string, v: any): any | undefined =>
-  k !== '__typename' && v != null ? v : undefined;
-
-export const stringifyEvent = (ecs: Ecs): string => JSON.stringify(ecs, omitTypenameAndEmpty, 2);
-
-export const eventHasNotes = (noteIds: string[]): boolean => !isEmpty(noteIds);
-
-export const getPinTooltip = ({
-  isPinned,
-  // eslint-disable-next-line no-shadow
-  eventHasNotes,
-  timelineType,
-}: {
-  isPinned: boolean;
-  eventHasNotes: boolean;
-  timelineType: TimelineTypeLiteral;
-}) =>
-  timelineType === TimelineType.template
-    ? i18n.DISABLE_PIN
-    : isPinned && eventHasNotes
-    ? i18n.PINNED_WITH_NOTES
-    : isPinned
-    ? i18n.PINNED
-    : i18n.UNPINNED;
-
-export interface IsPinnedParams {
-  eventId: string;
-  pinnedEventIds: Readonly<Record<string, boolean>>;
-}
-
-export const eventIsPinned = ({ eventId, pinnedEventIds }: IsPinnedParams): boolean =>
-  pinnedEventIds[eventId] === true;
-
-export interface GetPinOnClickParams {
-  allowUnpinning: boolean;
-  eventId: string;
-  onPinEvent: OnPinEvent;
-  onUnPinEvent: OnUnPinEvent;
-  isEventPinned: boolean;
-}
-
-export const getPinOnClick = ({
-  allowUnpinning,
-  eventId,
-  onPinEvent,
-  onUnPinEvent,
-  isEventPinned,
-}: GetPinOnClickParams) => {
-  if (!allowUnpinning) {
-    return;
-  }
-
-  if (isEventPinned) {
-    onUnPinEvent(eventId);
-  } else {
-    onPinEvent(eventId);
-  }
-};
-
-/**
- * Creates mapping of eventID -> fieldData for given fieldsToKeep. Used to store additional field
- * data necessary for custom timeline actions in conjunction with selection state
- * @param timelineData
- * @param eventIds
- * @param fieldsToKeep
- */
-export const getEventIdToDataMapping = (
-  timelineData: TimelineItem[],
-  eventIds: string[],
-  fieldsToKeep: string[]
-): Record<string, TimelineNonEcsData[]> => {
-  return timelineData.reduce((acc, v) => {
-    const fvm = eventIds.includes(v._id)
-      ? { [v._id]: v.data.filter((ti) => fieldsToKeep.includes(ti.field)) }
-      : {};
-    return {
-      ...acc,
-      ...fvm,
-    };
-  }, {});
-};
-
-/** Return eventType raw or signal */
-export const getEventType = (event: Ecs): Omit<EventType, 'all'> => {
-  if (!isEmpty(event.signal?.rule?.id)) {
-    return 'signal';
-  }
-  return 'raw';
-};
-
-export const isInvestigateInResolverActionEnabled = (ecsData?: Ecs) => {
-  return (
-    get(['agent', 'type', 0], ecsData) === 'endpoint' &&
-    get(['process', 'entity_id'], ecsData)?.length === 1 &&
-    get(['process', 'entity_id', 0], ecsData) !== ''
-  );
-};
-
-export const getInvestigateInResolverAction = ({
-  dispatch,
-  timelineId,
-}: {
-  dispatch: Dispatch;
-  timelineId: string;
-}): TimelineRowAction => ({
-  ariaLabel: i18n.ACTION_INVESTIGATE_IN_RESOLVER,
-  content: i18n.ACTION_INVESTIGATE_IN_RESOLVER,
-  dataTestSubj: 'investigate-in-resolver',
-  displayType: 'icon',
-  iconType: 'node',
-  id: 'investigateInResolver',
-  isActionDisabled: (ecsData?: Ecs) => !isInvestigateInResolverActionEnabled(ecsData),
-  onClick: ({ eventId }: TimelineRowActionOnClick) =>
-    dispatch(updateTimelineGraphEventId({ id: timelineId, graphEventId: eventId })),
-  width: DEFAULT_ICON_BUTTON_WIDTH,
-});
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
new file mode 100644
index 00000000000000..5753efa2bf1bb4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
@@ -0,0 +1,146 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useCallback, useMemo } from 'react';
+import { get, isEmpty } from 'lodash/fp';
+import { useDispatch } from 'react-redux';
+
+import { Ecs, TimelineItem, TimelineNonEcsData } from '../../../../graphql/types';
+import { updateTimelineGraphEventId } from '../../../store/timeline/actions';
+import { EventType } from '../../../store/timeline/model';
+import { OnPinEvent, OnUnPinEvent } from '../events';
+import { ActionIconItem } from './actions/action_icon_item';
+
+import * as i18n from './translations';
+import { TimelineTypeLiteral, TimelineType } from '../../../../../common/types/timeline';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const omitTypenameAndEmpty = (k: string, v: any): any | undefined =>
+  k !== '__typename' && v != null ? v : undefined;
+
+export const stringifyEvent = (ecs: Ecs): string => JSON.stringify(ecs, omitTypenameAndEmpty, 2);
+
+export const eventHasNotes = (noteIds: string[]): boolean => !isEmpty(noteIds);
+
+export const getPinTooltip = ({
+  isPinned,
+  // eslint-disable-next-line no-shadow
+  eventHasNotes,
+  timelineType,
+}: {
+  isPinned: boolean;
+  eventHasNotes: boolean;
+  timelineType: TimelineTypeLiteral;
+}) =>
+  timelineType === TimelineType.template
+    ? i18n.DISABLE_PIN
+    : isPinned && eventHasNotes
+    ? i18n.PINNED_WITH_NOTES
+    : isPinned
+    ? i18n.PINNED
+    : i18n.UNPINNED;
+
+export interface IsPinnedParams {
+  eventId: string;
+  pinnedEventIds: Readonly<Record<string, boolean>>;
+}
+
+export const eventIsPinned = ({ eventId, pinnedEventIds }: IsPinnedParams): boolean =>
+  pinnedEventIds[eventId] === true;
+
+export interface GetPinOnClickParams {
+  allowUnpinning: boolean;
+  eventId: string;
+  onPinEvent: OnPinEvent;
+  onUnPinEvent: OnUnPinEvent;
+  isEventPinned: boolean;
+}
+
+export const getPinOnClick = ({
+  allowUnpinning,
+  eventId,
+  onPinEvent,
+  onUnPinEvent,
+  isEventPinned,
+}: GetPinOnClickParams) => {
+  if (!allowUnpinning) {
+    return;
+  }
+
+  if (isEventPinned) {
+    onUnPinEvent(eventId);
+  } else {
+    onPinEvent(eventId);
+  }
+};
+
+/**
+ * Creates mapping of eventID -> fieldData for given fieldsToKeep. Used to store additional field
+ * data necessary for custom timeline actions in conjunction with selection state
+ * @param timelineData
+ * @param eventIds
+ * @param fieldsToKeep
+ */
+export const getEventIdToDataMapping = (
+  timelineData: TimelineItem[],
+  eventIds: string[],
+  fieldsToKeep: string[]
+): Record<string, TimelineNonEcsData[]> =>
+  timelineData.reduce((acc, v) => {
+    const fvm = eventIds.includes(v._id)
+      ? { [v._id]: v.data.filter((ti) => fieldsToKeep.includes(ti.field)) }
+      : {};
+    return {
+      ...acc,
+      ...fvm,
+    };
+  }, {});
+
+/** Return eventType raw or signal */
+export const getEventType = (event: Ecs): Omit<EventType, 'all'> => {
+  if (!isEmpty(event.signal?.rule?.id)) {
+    return 'signal';
+  }
+  return 'raw';
+};
+
+export const isInvestigateInResolverActionEnabled = (ecsData?: Ecs) =>
+  get(['agent', 'type', 0], ecsData) === 'endpoint' &&
+  get(['process', 'entity_id'], ecsData)?.length === 1 &&
+  get(['process', 'entity_id', 0], ecsData) !== '';
+
+interface InvestigateInResolverActionProps {
+  timelineId: string;
+  ecsData: Ecs;
+}
+
+const InvestigateInResolverActionComponent: React.FC<InvestigateInResolverActionProps> = ({
+  timelineId,
+  ecsData,
+}) => {
+  const dispatch = useDispatch();
+  const isDisabled = useMemo(() => !isInvestigateInResolverActionEnabled(ecsData), [ecsData]);
+  const handleClick = useCallback(
+    () => dispatch(updateTimelineGraphEventId({ id: timelineId, graphEventId: ecsData._id })),
+    [dispatch, ecsData._id, timelineId]
+  );
+
+  return (
+    <ActionIconItem
+      ariaLabel={i18n.ACTION_INVESTIGATE_IN_RESOLVER}
+      content={i18n.ACTION_INVESTIGATE_IN_RESOLVER}
+      dataTestSubj="investigate-in-resolver"
+      iconType="node"
+      id="investigateInResolver"
+      isDisabled={isDisabled}
+      onClick={handleClick}
+    />
+  );
+};
+
+InvestigateInResolverActionComponent.displayName = 'InvestigateInResolverActionComponent';
+
+export const InvestigateInResolverAction = React.memo(InvestigateInResolverActionComponent);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
index 4eac5360321c14..657e1617e8d24e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
@@ -64,7 +64,6 @@ describe('Body', () => {
     data: mockTimelineData,
     docValueFields: [],
     eventIdToNoteIds: {},
-    id: 'timeline-test',
     isSelectAllChecked: false,
     getNotesByIds: mockGetNotesByIds,
     loadingEventIds: [],
@@ -78,11 +77,13 @@ describe('Body', () => {
     onUnPinEvent: jest.fn(),
     onUpdateColumns: jest.fn(),
     pinnedEventIds: {},
+    refetch: jest.fn(),
     rowRenderers,
     selectedEventIds: {},
     show: true,
     sort: mockSort,
     showCheckboxes: false,
+    timelineId: 'timeline-test',
     timelineType: TimelineType.default,
     toggleColumn: jest.fn(),
     updateNote: jest.fn(),
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
index 6f578ffe3e9568..40cc12afde51dc 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
@@ -6,10 +6,11 @@
 
 import React, { useMemo, useRef } from 'react';
 
+import { inputsModel } from '../../../../common/store';
 import { BrowserFields, DocValueFields } from '../../../../common/containers/source';
 import { TimelineItem, TimelineNonEcsData } from '../../../../graphql/types';
 import { Note } from '../../../../common/lib/note';
-import { ColumnHeaderOptions } from '../../../../timelines/store/timeline/model';
+import { ColumnHeaderOptions, EventType } from '../../../../timelines/store/timeline/model';
 import { AddNoteToEvent, UpdateNote } from '../../notes/helpers';
 import {
   OnColumnRemoved,
@@ -42,10 +43,10 @@ export interface BodyProps {
   docValueFields: DocValueFields[];
   getNotesByIds: (noteIds: string[]) => Note[];
   graphEventId?: string;
-  id: string;
   isEventViewer?: boolean;
   isSelectAllChecked: boolean;
   eventIdToNoteIds: Readonly<Record<string, string[]>>;
+  eventType?: EventType;
   loadingEventIds: Readonly<string[]>;
   onColumnRemoved: OnColumnRemoved;
   onColumnResized: OnColumnResized;
@@ -57,18 +58,23 @@ export interface BodyProps {
   onUpdateColumns: OnUpdateColumns;
   onUnPinEvent: OnUnPinEvent;
   pinnedEventIds: Readonly<Record<string, boolean>>;
+  refetch: inputsModel.Refetch;
   rowRenderers: RowRenderer[];
   selectedEventIds: Readonly<Record<string, TimelineNonEcsData[]>>;
   show: boolean;
   showCheckboxes: boolean;
   sort: Sort;
+  timelineId: string;
   timelineType: TimelineType;
   toggleColumn: (column: ColumnHeaderOptions) => void;
   updateNote: UpdateNote;
 }
 
-export const hasAdditonalActions = (id: string): boolean =>
-  id === TimelineId.detectionsPage || id === TimelineId.detectionsRulesDetailsPage;
+export const hasAdditionalActions = (id: string, eventType?: EventType): boolean =>
+  id === TimelineId.detectionsPage ||
+  id === TimelineId.detectionsRulesDetailsPage ||
+  ((id === TimelineId.active && eventType && ['all', 'signal', 'alert'].includes(eventType)) ??
+    false);
 
 const EXTRA_WIDTH = 4; // px
 
@@ -82,9 +88,9 @@ export const Body = React.memo<BodyProps>(
     data,
     docValueFields,
     eventIdToNoteIds,
+    eventType,
     getNotesByIds,
     graphEventId,
-    id,
     isEventViewer = false,
     isSelectAllChecked,
     loadingEventIds,
@@ -99,11 +105,13 @@ export const Body = React.memo<BodyProps>(
     onUnPinEvent,
     pinnedEventIds,
     rowRenderers,
+    refetch,
     selectedEventIds,
     show,
     showCheckboxes,
     sort,
     toggleColumn,
+    timelineId,
     timelineType,
     updateNote,
   }) => {
@@ -113,9 +121,9 @@ export const Body = React.memo<BodyProps>(
         getActionsColumnWidth(
           isEventViewer,
           showCheckboxes,
-          hasAdditonalActions(id) ? DEFAULT_ICON_BUTTON_WIDTH + EXTRA_WIDTH : 0
+          hasAdditionalActions(timelineId, eventType) ? DEFAULT_ICON_BUTTON_WIDTH + EXTRA_WIDTH : 0
         ),
-      [isEventViewer, showCheckboxes, id]
+      [isEventViewer, showCheckboxes, timelineId, eventType]
     );
 
     const columnWidths = useMemo(
@@ -127,11 +135,15 @@ export const Body = React.memo<BodyProps>(
     return (
       <>
         {graphEventId && (
-          <GraphOverlay graphEventId={graphEventId} timelineId={id} timelineType={timelineType} />
+          <GraphOverlay
+            graphEventId={graphEventId}
+            timelineId={timelineId}
+            timelineType={timelineType}
+          />
         )}
         <TimelineBody
           data-test-subj="timeline-body"
-          data-timeline-id={id}
+          data-timeline-id={timelineId}
           ref={containerElementRef}
           visible={show && !graphEventId}
         >
@@ -151,7 +163,7 @@ export const Body = React.memo<BodyProps>(
               showEventsSelect={false}
               showSelectAllCheckbox={showCheckboxes}
               sort={sort}
-              timelineId={id}
+              timelineId={timelineId}
               toggleColumn={toggleColumn}
             />
 
@@ -166,7 +178,7 @@ export const Body = React.memo<BodyProps>(
               docValueFields={docValueFields}
               eventIdToNoteIds={eventIdToNoteIds}
               getNotesByIds={getNotesByIds}
-              id={id}
+              id={timelineId}
               isEventViewer={isEventViewer}
               loadingEventIds={loadingEventIds}
               onColumnResized={onColumnResized}
@@ -175,6 +187,7 @@ export const Body = React.memo<BodyProps>(
               onUpdateColumns={onUpdateColumns}
               onUnPinEvent={onUnPinEvent}
               pinnedEventIds={pinnedEventIds}
+              refetch={refetch}
               rowRenderers={rowRenderers}
               selectedEventIds={selectedEventIds}
               showCheckboxes={showCheckboxes}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx
index 8deda03ece70eb..9b7b896a2ec691 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/stateful_body.tsx
@@ -14,7 +14,7 @@ import { RowRendererId, TimelineId } from '../../../../../common/types/timeline'
 import { BrowserFields, DocValueFields } from '../../../../common/containers/source';
 import { TimelineItem } from '../../../../graphql/types';
 import { Note } from '../../../../common/lib/note';
-import { appSelectors, State } from '../../../../common/store';
+import { appSelectors, inputsModel, State } from '../../../../common/store';
 import { appActions } from '../../../../common/store/actions';
 import { useManageTimeline } from '../../manage_timeline';
 import { ColumnHeaderOptions, TimelineModel } from '../../../store/timeline/model';
@@ -46,6 +46,7 @@ interface OwnProps {
   isEventViewer?: boolean;
   sort: Sort;
   toggleColumn: (column: ColumnHeaderOptions) => void;
+  refetch: inputsModel.Refetch;
 }
 
 type StatefulBodyComponentProps = OwnProps & PropsFromRedux;
@@ -61,6 +62,7 @@ const StatefulBodyComponent = React.memo<StatefulBodyComponentProps>(
     data,
     docValueFields,
     eventIdToNoteIds,
+    eventType,
     excludedRowRendererIds,
     id,
     isEventViewer = false,
@@ -76,6 +78,7 @@ const StatefulBodyComponent = React.memo<StatefulBodyComponentProps>(
     show,
     showCheckboxes,
     graphEventId,
+    refetch,
     sort,
     timelineType,
     toggleColumn,
@@ -195,9 +198,9 @@ const StatefulBodyComponent = React.memo<StatefulBodyComponentProps>(
         data={data}
         docValueFields={docValueFields}
         eventIdToNoteIds={eventIdToNoteIds}
+        eventType={eventType}
         getNotesByIds={getNotesByIds}
         graphEventId={graphEventId}
-        id={id}
         isEventViewer={isEventViewer}
         isSelectAllChecked={isSelectAllChecked}
         loadingEventIds={loadingEventIds}
@@ -211,11 +214,13 @@ const StatefulBodyComponent = React.memo<StatefulBodyComponentProps>(
         onUnPinEvent={onUnPinEvent}
         onUpdateColumns={onUpdateColumns}
         pinnedEventIds={pinnedEventIds}
+        refetch={refetch}
         rowRenderers={enabledRowRenderers}
         selectedEventIds={selectedEventIds}
         show={id === TimelineId.active ? show : true}
         showCheckboxes={showCheckboxes}
         sort={sort}
+        timelineId={id}
         timelineType={timelineType}
         toggleColumn={toggleColumn}
         updateNote={onUpdateNote}
@@ -229,6 +234,7 @@ const StatefulBodyComponent = React.memo<StatefulBodyComponentProps>(
     deepEqual(prevProps.excludedRowRendererIds, nextProps.excludedRowRendererIds) &&
     deepEqual(prevProps.docValueFields, nextProps.docValueFields) &&
     prevProps.eventIdToNoteIds === nextProps.eventIdToNoteIds &&
+    prevProps.eventType === nextProps.eventType &&
     prevProps.graphEventId === nextProps.graphEventId &&
     deepEqual(prevProps.notesById, nextProps.notesById) &&
     prevProps.id === nextProps.id &&
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx
index 269cd14b5973cc..49f17db242f75b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx
@@ -4,12 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
+import React, { useCallback } from 'react';
 import styled from 'styled-components';
 
 import { BrowserFields } from '../../../../common/containers/source';
 import { ColumnHeaderOptions } from '../../../../timelines/store/timeline/model';
-import { DetailItem } from '../../../../graphql/types';
+import { DetailItem } from '../../../../../common/search_strategy/timeline';
 import { StatefulEventDetails } from '../../../../common/components/event_details/stateful_event_details';
 import { LazyAccordion } from '../../lazy_accordion';
 import { OnUpdateColumns } from '../events';
@@ -51,27 +51,43 @@ export const ExpandableEvent = React.memo<Props>(
     toggleColumn,
     onEventToggled,
     onUpdateColumns,
-  }) => (
-    <ExpandableDetails hideExpandButton={true}>
-      <LazyAccordion
-        id={`timeline-${timelineId}-row-${id}`}
-        renderExpandedContent={() => (
-          <StatefulEventDetails
-            browserFields={browserFields}
-            columnHeaders={columnHeaders}
-            data={event}
-            id={id}
-            onEventToggled={onEventToggled}
-            onUpdateColumns={onUpdateColumns}
-            timelineId={timelineId}
-            toggleColumn={toggleColumn}
-          />
-        )}
-        forceExpand={forceExpand}
-        paddingSize="none"
-      />
-    </ExpandableDetails>
-  )
+  }) => {
+    const handleRenderExpandedContent = useCallback(
+      () => (
+        <StatefulEventDetails
+          browserFields={browserFields}
+          columnHeaders={columnHeaders}
+          data={event}
+          id={id}
+          onEventToggled={onEventToggled}
+          onUpdateColumns={onUpdateColumns}
+          timelineId={timelineId}
+          toggleColumn={toggleColumn}
+        />
+      ),
+      [
+        browserFields,
+        columnHeaders,
+        event,
+        id,
+        onEventToggled,
+        onUpdateColumns,
+        timelineId,
+        toggleColumn,
+      ]
+    );
+
+    return (
+      <ExpandableDetails hideExpandButton={true}>
+        <LazyAccordion
+          id={`timeline-${timelineId}-row-${id}`}
+          renderExpandedContent={handleRenderExpandedContent}
+          forceExpand={forceExpand}
+          paddingSize="none"
+        />
+      </ExpandableDetails>
+    );
+  }
 );
 
 ExpandableEvent.displayName = 'ExpandableEvent';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
index 8f18a173f3beda..4ab05af5dd6d46 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
@@ -331,26 +331,23 @@ const LargeNotesButton = React.memo<LargeNotesButtonProps>(({ noteIds, text, tog
 LargeNotesButton.displayName = 'LargeNotesButton';
 
 interface SmallNotesButtonProps {
-  noteIds: string[];
   toggleShowNotes: () => void;
   timelineType: TimelineTypeLiteral;
 }
 
-const SmallNotesButton = React.memo<SmallNotesButtonProps>(
-  ({ noteIds, toggleShowNotes, timelineType }) => {
-    const isTemplate = timelineType === TimelineType.template;
-
-    return (
-      <EuiButtonIcon
-        aria-label={i18n.NOTES}
-        data-test-subj="timeline-notes-button-small"
-        iconType="editorComment"
-        onClick={() => toggleShowNotes()}
-        isDisabled={isTemplate}
-      />
-    );
-  }
-);
+const SmallNotesButton = React.memo<SmallNotesButtonProps>(({ toggleShowNotes, timelineType }) => {
+  const isTemplate = timelineType === TimelineType.template;
+
+  return (
+    <EuiButtonIcon
+      aria-label={i18n.NOTES}
+      data-test-subj="timeline-notes-button-small"
+      iconType="editorComment"
+      onClick={() => toggleShowNotes()}
+      isDisabled={isTemplate}
+    />
+  );
+});
 SmallNotesButton.displayName = 'SmallNotesButton';
 
 /**
@@ -375,11 +372,7 @@ const NotesButtonComponent = React.memo<NotesButtonProps>(
         {size === 'l' ? (
           <LargeNotesButton noteIds={noteIds} text={text} toggleShowNotes={toggleShowNotes} />
         ) : (
-          <SmallNotesButton
-            noteIds={noteIds}
-            toggleShowNotes={toggleShowNotes}
-            timelineType={timelineType}
-          />
+          <SmallNotesButton toggleShowNotes={toggleShowNotes} timelineType={timelineType} />
         )}
         {size === 'l' && showNotes ? (
           <EuiOverlayMask>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.tsx
index e88ecee81d364f..b5aadaa6f1ef8e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.tsx
@@ -6,7 +6,7 @@
 
 import React from 'react';
 
-import { TimelineType } from '../../../../../common/types/timeline';
+import { TimelineId, TimelineType } from '../../../../../common/types/timeline';
 
 import { useKibana } from '../../../../common/lib/kibana';
 import { useCreateTimelineButton } from './use_create_timeline';
@@ -22,7 +22,7 @@ export const NewTemplateTimelineComponent: React.FC<OwnProps> = ({
   closeGearMenu,
   outline,
   title,
-  timelineId = 'timeline-1',
+  timelineId = TimelineId.active,
 }) => {
   const uiCapabilities = useKibana().services.application.capabilities;
   const capabilitiesCanUserCRUD: boolean = !!uiCapabilities.siem.crud;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
index a2ee1e56306b53..7b1c1bd2119cd3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/timeline.tsx
@@ -7,7 +7,6 @@
 import { EuiFlyoutHeader, EuiFlyoutBody, EuiFlyoutFooter, EuiProgress } from '@elastic/eui';
 import { getOr, isEmpty } from 'lodash/fp';
 import React, { useState, useMemo, useEffect } from 'react';
-import { useDispatch } from 'react-redux';
 import styled from 'styled-components';
 
 import { FlyoutHeaderWithCloseButton } from '../flyout/header_with_close_button';
@@ -17,7 +16,6 @@ import { Direction } from '../../../graphql/types';
 import { useKibana } from '../../../common/lib/kibana';
 import { ColumnHeaderOptions, KqlMode, EventType } from '../../../timelines/store/timeline/model';
 import { defaultHeaders } from './body/column_headers/default_headers';
-import { getInvestigateInResolverAction } from './body/helpers';
 import { Sort } from './body/sort';
 import { StatefulBody } from './body/stateful_body';
 import { DataProvider } from './data_providers/data_provider';
@@ -43,6 +41,7 @@ import {
 } from '../../../../../../../src/plugins/data/public';
 import { useManageTimeline } from '../manage_timeline';
 import { TimelineType, TimelineStatusLiteral } from '../../../../common/types/timeline';
+import { requiredFieldsForActions } from '../../../detections/components/alerts_table/default_config';
 
 const TimelineContainer = styled.div`
   height: 100%;
@@ -168,7 +167,6 @@ export const TimelineComponent: React.FC<Props> = ({
   toggleColumn,
   usersViewing,
 }) => {
-  const dispatch = useDispatch();
   const kibana = useKibana();
   const [filterManager] = useState<FilterManager>(new FilterManager(kibana.services.uiSettings));
   const esQueryConfig = useMemo(() => esQuery.getEsQueryConfig(kibana.services.uiSettings), [
@@ -213,7 +211,10 @@ export const TimelineComponent: React.FC<Props> = ({
     [isLoadingSource, combinedQueries, start, end]
   );
   const columnsHeader = isEmpty(columns) ? defaultHeaders : columns;
-  const timelineQueryFields = useMemo(() => columnsHeader.map((c) => c.id), [columnsHeader]);
+  const timelineQueryFields = useMemo(() => {
+    const columnFields = columnsHeader.map((c) => c.id);
+    return [...columnFields, ...requiredFieldsForActions];
+  }, [columnsHeader]);
   const timelineQuerySortField = useMemo(
     () => ({
       sortFieldId: sort.columnId,
@@ -228,7 +229,6 @@ export const TimelineComponent: React.FC<Props> = ({
       filterManager,
       id,
       indexToAdd,
-      timelineRowActions: () => [getInvestigateInResolverAction({ dispatch, timelineId: id })],
     });
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
@@ -317,6 +317,7 @@ export const TimelineComponent: React.FC<Props> = ({
                     data={events}
                     docValueFields={docValueFields}
                     id={id}
+                    refetch={refetch}
                     sort={sort}
                     toggleColumn={toggleColumn}
                   />
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
index a07420dead29be..35f8c7ae90e6e1 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
@@ -4,71 +4,129 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
+import { noop } from 'lodash/fp';
 import memoizeOne from 'memoize-one';
-import React from 'react';
-import { Query } from 'react-apollo';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import deepEqual from 'fast-deep-equal';
 
+import { inputsModel } from '../../../common/store';
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import { DetailItem, GetTimelineDetailsQuery } from '../../../graphql/types';
-import { useUiSetting } from '../../../common/lib/kibana';
-
-import { timelineDetailsQuery } from './index.gql_query';
-import { DocValueFields } from '../../../common/containers/source';
-
+import { useKibana } from '../../../common/lib/kibana';
+import {
+  DocValueFields,
+  DetailItem,
+  TimelineQueries,
+  TimelineDetailsRequestOptions,
+  TimelineDetailsStrategyResponse,
+} from '../../../../common/search_strategy';
 export interface EventsArgs {
   detailsData: DetailItem[] | null;
   loading: boolean;
 }
 
 export interface TimelineDetailsProps {
-  children?: (args: EventsArgs) => React.ReactElement;
   docValueFields: DocValueFields[];
   indexName: string;
   eventId: string;
   executeQuery: boolean;
-  sourceId: string;
 }
 
 const getDetailsEvent = memoizeOne(
   (variables: string, detail: DetailItem[]): DetailItem[] => detail
 );
 
-const TimelineDetailsQueryComponent: React.FC<TimelineDetailsProps> = ({
-  children,
+export const useTimelineDetails = ({
   docValueFields,
   indexName,
   eventId,
   executeQuery,
-  sourceId,
-}) => {
-  const variables: GetTimelineDetailsQuery.Variables = {
+}: TimelineDetailsProps): [boolean, EventsArgs['detailsData']] => {
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [timelineDetailsRequest, setTimelineDetailsRequest] = useState<
+    TimelineDetailsRequestOptions
+  >({
+    defaultIndex,
     docValueFields,
-    sourceId,
+    executeQuery,
     indexName,
     eventId,
-    defaultIndex: useUiSetting<string[]>(DEFAULT_INDEX_KEY),
-  };
-  return executeQuery ? (
-    <Query<GetTimelineDetailsQuery.Query, GetTimelineDetailsQuery.Variables>
-      query={timelineDetailsQuery}
-      fetchPolicy="network-only"
-      notifyOnNetworkStatusChange
-      variables={variables}
-    >
-      {({ data, loading, refetch }) =>
-        children!({
-          loading,
-          detailsData: getDetailsEvent(
-            JSON.stringify(variables),
-            getOr([], 'source.TimelineDetails.data', data)
-          ),
-        })
-      }
-    </Query>
-  ) : (
-    children!({ loading: false, detailsData: null })
+    factoryQueryType: TimelineQueries.details,
+  });
+
+  const [timelineDetailsResponse, setTimelineDetailsResponse] = useState<EventsArgs['detailsData']>(
+    null
   );
-};
 
-export const TimelineDetailsQuery = React.memo(TimelineDetailsQueryComponent);
+  const timelineDetailsSearch = useCallback(
+    (request: TimelineDetailsRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<TimelineDetailsRequestOptions, TimelineDetailsStrategyResponse>(request, {
+            strategy: 'securitySolutionTimelineSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setTimelineDetailsResponse(
+                    getDetailsEvent(JSON.stringify(timelineDetailsRequest), response.data || [])
+                  );
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning('An error has occurred');
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: () => {
+              notifications.toasts.addDanger('Failed to run search');
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts, timelineDetailsRequest]
+  );
+
+  useEffect(() => {
+    setTimelineDetailsRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        docValueFields,
+        indexName,
+        eventId,
+      };
+      if (!deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [defaultIndex, docValueFields, eventId, indexName]);
+
+  useEffect(() => {
+    if (executeQuery) timelineDetailsSearch(timelineDetailsRequest);
+  }, [executeQuery, timelineDetailsRequest, timelineDetailsSearch]);
+
+  return [loading, timelineDetailsResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/index.gql_query.ts b/x-pack/plugins/security_solution/public/timelines/containers/index.gql_query.ts
index 5a162fd2206a1b..c67ad45bede94a 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/index.gql_query.ts
+++ b/x-pack/plugins/security_solution/public/timelines/containers/index.gql_query.ts
@@ -200,6 +200,7 @@ export const timelineQuery = gql`
                 country_iso_code
               }
               signal {
+                status
                 original_time
                 rule {
                   id
diff --git a/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx b/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx
index 1d2e16b3fe5b8b..79d0f909c7d592 100644
--- a/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx
@@ -9,7 +9,7 @@ import React, { useCallback, useState } from 'react';
 import styled from 'styled-components';
 import { useParams } from 'react-router-dom';
 
-import { TimelineType } from '../../../common/types/timeline';
+import { TimelineId, TimelineType } from '../../../common/types/timeline';
 import { HeaderPage } from '../../common/components/header_page';
 import { WrapperPage } from '../../common/components/wrapper_page';
 import { useKibana } from '../../common/lib/kibana';
@@ -65,7 +65,7 @@ export const TimelinesPageComponent: React.FC = () => {
                 {tabName === TimelineType.default ? (
                   <EuiFlexItem>
                     <NewTimeline
-                      timelineId="timeline-1"
+                      timelineId={TimelineId.active}
                       outline={true}
                       data-test-subj="create-default-btn"
                     />
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
index 06dd6f44bea94a..8c3f30c75c35b7 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
@@ -42,7 +42,7 @@ import { Direction } from '../../../graphql/types';
 
 import { addTimelineInStorage } from '../../containers/local_storage';
 import { isPageTimeline } from './epic_local_storage';
-import { TimelineStatus, TimelineType } from '../../../../common/types/timeline';
+import { TimelineId, TimelineStatus, TimelineType } from '../../../../common/types/timeline';
 
 jest.mock('../../containers/local_storage');
 
@@ -115,7 +115,7 @@ describe('epicLocalStorage', () => {
   });
 
   it('filters correctly page timelines', () => {
-    expect(isPageTimeline('timeline-1')).toBe(false);
+    expect(isPageTimeline(TimelineId.active)).toBe(false);
     expect(isPageTimeline('hosts-page-alerts')).toBe(true);
   });
 
diff --git a/x-pack/plugins/security_solution/public/types.ts b/x-pack/plugins/security_solution/public/types.ts
index d2b66207d86028..62069484dd8bda 100644
--- a/x-pack/plugins/security_solution/public/types.ts
+++ b/x-pack/plugins/security_solution/public/types.ts
@@ -22,6 +22,7 @@ import {
 import { SecurityPluginSetup } from '../../security/public';
 import { AppFrontendLibs } from './common/lib/lib';
 import { ResolverPluginSetup } from './resolver/types';
+import { Inspect } from '../common/search_strategy';
 
 export interface SetupPlugins {
   home?: HomePublicPluginSetup;
@@ -56,3 +57,5 @@ export interface PluginStart {}
 export interface AppObservableLibs extends AppFrontendLibs {
   kibana: CoreStart;
 }
+
+export type InspectResponse = Inspect & { response: string[] };
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/README.md b/x-pack/plugins/security_solution/scripts/endpoint/README.md
index bd9502f2f59e03..2827ab065504b5 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/README.md
+++ b/x-pack/plugins/security_solution/scripts/endpoint/README.md
@@ -5,10 +5,6 @@ The default behavior is to create 1 endpoint with 1 alert and a moderate number
 A seed value can be provided as a string for the random number generator for repeatable behavior, useful for demos etc.
 Use the `-d` option if you want to delete and remake the indices, otherwise it will add documents to existing indices.
 
-The sample data generator script depends on ts-node, install with npm:
-
-`npm install -g ts-node`
-
 Example command sequence to get ES and kibana running with sample data after installing ts-node:
 
 `yarn es snapshot` -> starts ES
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/cli_tsconfig.json b/x-pack/plugins/security_solution/scripts/endpoint/cli_tsconfig.json
deleted file mode 100644
index 5c68f8ee0abf26..00000000000000
--- a/x-pack/plugins/security_solution/scripts/endpoint/cli_tsconfig.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-    "extends": "../../../../tsconfig.json",
-    "compilerOptions": {
-      "target": "es2019",
-      "resolveJsonModule": true
-    }
-  }
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator.js b/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator.js
new file mode 100644
index 00000000000000..fb5a865439bc2d
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator.js
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+require('../../../../../src/setup_node_env');
+require('./resolver_generator_script');
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator.ts b/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator_script.ts
similarity index 100%
rename from x-pack/plugins/security_solution/scripts/endpoint/resolver_generator.ts
rename to x-pack/plugins/security_solution/scripts/endpoint/resolver_generator_script.ts
diff --git a/x-pack/plugins/security_solution/scripts/optimize_tsconfig/tsconfig.json b/x-pack/plugins/security_solution/scripts/optimize_tsconfig/tsconfig.json
index ea7a11b89dab2b..ac56a6af31c72c 100644
--- a/x-pack/plugins/security_solution/scripts/optimize_tsconfig/tsconfig.json
+++ b/x-pack/plugins/security_solution/scripts/optimize_tsconfig/tsconfig.json
@@ -10,7 +10,6 @@
   "exclude": [
     "test/**/*",
     "**/__fixtures__/**/*",
-    "plugins/security_solution/cypress/**/*",
-    "**/typespec_tests.ts"
+    "plugins/security_solution/cypress/**/*"
   ]
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/ingest_integration.test.ts b/x-pack/plugins/security_solution/server/endpoint/ingest_integration.test.ts
index 73f2124736a79b..c28ffcf5b7a3f0 100644
--- a/x-pack/plugins/security_solution/server/endpoint/ingest_integration.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/ingest_integration.test.ts
@@ -49,6 +49,36 @@ describe('ingest_integration tests ', () => {
             relative_url:
               '/api/endpoint/artifacts/download/endpoint-exceptionlist-windows-v1/d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
           },
+          'endpoint-trustlist-linux-v1': {
+            compression_algorithm: 'zlib',
+            decoded_sha256: '1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+            decoded_size: 287,
+            encoded_sha256: 'c3dec543df1177561ab2aa74a37997ea3c1d748d532a597884f5a5c16670d56c',
+            encoded_size: 133,
+            encryption_algorithm: 'none',
+            relative_url:
+              '/api/endpoint/artifacts/download/endpoint-trustlist-linux-v1/1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          },
+          'endpoint-trustlist-macos-v1': {
+            compression_algorithm: 'zlib',
+            decoded_sha256: '1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+            decoded_size: 287,
+            encoded_sha256: 'c3dec543df1177561ab2aa74a37997ea3c1d748d532a597884f5a5c16670d56c',
+            encoded_size: 133,
+            encryption_algorithm: 'none',
+            relative_url:
+              '/api/endpoint/artifacts/download/endpoint-trustlist-macos-v1/1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          },
+          'endpoint-trustlist-windows-v1': {
+            compression_algorithm: 'zlib',
+            decoded_sha256: '1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+            decoded_size: 287,
+            encoded_sha256: 'c3dec543df1177561ab2aa74a37997ea3c1d748d532a597884f5a5c16670d56c',
+            encoded_size: 133,
+            encryption_algorithm: 'none',
+            relative_url:
+              '/api/endpoint/artifacts/download/endpoint-trustlist-windows-v1/1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          },
         },
         manifest_version: '1.0.0',
         schema_version: 'v1',
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/common.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/common.ts
index 7f90aa7b910632..457e50b686863a 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/common.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/common.ts
@@ -14,6 +14,8 @@ export const ArtifactConstants = {
   GLOBAL_ALLOWLIST_NAME: 'endpoint-exceptionlist',
   SAVED_OBJECT_TYPE: 'endpoint:user-artifact',
   SUPPORTED_OPERATING_SYSTEMS: ['macos', 'windows'],
+  SUPPORTED_TRUSTED_APPS_OPERATING_SYSTEMS: ['macos', 'windows', 'linux'],
+  GLOBAL_TRUSTED_APPS_NAME: 'endpoint-trustlist',
 };
 
 export const ManifestConstants = {
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts
index fea3b2b9a45266..a10ba9d6be38c2 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts
@@ -11,6 +11,8 @@ import { getExceptionListItemSchemaMock } from '../../../../../lists/common/sche
 import { EntriesArray, EntryList } from '../../../../../lists/common/schemas/types';
 import { buildArtifact, getFullEndpointExceptionList } from './lists';
 import { TranslatedEntry, TranslatedExceptionListItem } from '../../schemas/artifacts';
+import { ArtifactConstants } from './common';
+import { ENDPOINT_LIST_ID } from '../../../../../lists/common';
 
 describe('buildEventTypeSignal', () => {
   let mockExceptionClient: ExceptionListClient;
@@ -47,7 +49,12 @@ describe('buildEventTypeSignal', () => {
 
     const first = getFoundExceptionListItemSchemaMock();
     mockExceptionClient.findExceptionListItem = jest.fn().mockReturnValueOnce(first);
-    const resp = await getFullEndpointExceptionList(mockExceptionClient, 'linux', 'v1');
+    const resp = await getFullEndpointExceptionList(
+      mockExceptionClient,
+      'linux',
+      'v1',
+      ENDPOINT_LIST_ID
+    );
     expect(resp).toEqual({
       entries: [expectedEndpointExceptions],
     });
@@ -88,7 +95,12 @@ describe('buildEventTypeSignal', () => {
     first.data[0].entries = testEntries;
     mockExceptionClient.findExceptionListItem = jest.fn().mockReturnValueOnce(first);
 
-    const resp = await getFullEndpointExceptionList(mockExceptionClient, 'linux', 'v1');
+    const resp = await getFullEndpointExceptionList(
+      mockExceptionClient,
+      'linux',
+      'v1',
+      ENDPOINT_LIST_ID
+    );
     expect(resp).toEqual({
       entries: [expectedEndpointExceptions],
     });
@@ -134,7 +146,12 @@ describe('buildEventTypeSignal', () => {
     first.data[0].entries = testEntries;
     mockExceptionClient.findExceptionListItem = jest.fn().mockReturnValueOnce(first);
 
-    const resp = await getFullEndpointExceptionList(mockExceptionClient, 'linux', 'v1');
+    const resp = await getFullEndpointExceptionList(
+      mockExceptionClient,
+      'linux',
+      'v1',
+      ENDPOINT_LIST_ID
+    );
     expect(resp).toEqual({
       entries: [expectedEndpointExceptions],
     });
@@ -182,7 +199,12 @@ describe('buildEventTypeSignal', () => {
     first.data[0].entries = testEntries;
     mockExceptionClient.findExceptionListItem = jest.fn().mockReturnValueOnce(first);
 
-    const resp = await getFullEndpointExceptionList(mockExceptionClient, 'linux', 'v1');
+    const resp = await getFullEndpointExceptionList(
+      mockExceptionClient,
+      'linux',
+      'v1',
+      ENDPOINT_LIST_ID
+    );
     expect(resp).toEqual({
       entries: [expectedEndpointExceptions],
     });
@@ -229,7 +251,12 @@ describe('buildEventTypeSignal', () => {
     first.data[0].entries = testEntries;
     mockExceptionClient.findExceptionListItem = jest.fn().mockReturnValueOnce(first);
 
-    const resp = await getFullEndpointExceptionList(mockExceptionClient, 'linux', 'v1');
+    const resp = await getFullEndpointExceptionList(
+      mockExceptionClient,
+      'linux',
+      'v1',
+      ENDPOINT_LIST_ID
+    );
     expect(resp).toEqual({
       entries: [expectedEndpointExceptions],
     });
@@ -267,7 +294,12 @@ describe('buildEventTypeSignal', () => {
     first.data[1].entries = testEntries;
     mockExceptionClient.findExceptionListItem = jest.fn().mockReturnValueOnce(first);
 
-    const resp = await getFullEndpointExceptionList(mockExceptionClient, 'linux', 'v1');
+    const resp = await getFullEndpointExceptionList(
+      mockExceptionClient,
+      'linux',
+      'v1',
+      ENDPOINT_LIST_ID
+    );
     expect(resp).toEqual({
       entries: [expectedEndpointExceptions],
     });
@@ -305,7 +337,12 @@ describe('buildEventTypeSignal', () => {
     first.data[0].entries = testEntries;
     mockExceptionClient.findExceptionListItem = jest.fn().mockReturnValueOnce(first);
 
-    const resp = await getFullEndpointExceptionList(mockExceptionClient, 'linux', 'v1');
+    const resp = await getFullEndpointExceptionList(
+      mockExceptionClient,
+      'linux',
+      'v1',
+      ENDPOINT_LIST_ID
+    );
     expect(resp).toEqual({
       entries: [expectedEndpointExceptions],
     });
@@ -329,7 +366,12 @@ describe('buildEventTypeSignal', () => {
       .mockReturnValueOnce(first)
       .mockReturnValueOnce(second);
 
-    const resp = await getFullEndpointExceptionList(mockExceptionClient, 'linux', 'v1');
+    const resp = await getFullEndpointExceptionList(
+      mockExceptionClient,
+      'linux',
+      'v1',
+      ENDPOINT_LIST_ID
+    );
 
     // Expect 2 exceptions, the first two calls returned the same exception list items
     expect(resp.entries.length).toEqual(2);
@@ -340,7 +382,12 @@ describe('buildEventTypeSignal', () => {
     exceptionsResponse.data = [];
     exceptionsResponse.total = 0;
     mockExceptionClient.findExceptionListItem = jest.fn().mockReturnValueOnce(exceptionsResponse);
-    const resp = await getFullEndpointExceptionList(mockExceptionClient, 'linux', 'v1');
+    const resp = await getFullEndpointExceptionList(
+      mockExceptionClient,
+      'linux',
+      'v1',
+      ENDPOINT_LIST_ID
+    );
     expect(resp.entries.length).toEqual(0);
   });
 
@@ -385,8 +432,18 @@ describe('buildEventTypeSignal', () => {
       ],
     };
 
-    const artifact1 = await buildArtifact(translatedExceptionList, 'linux', 'v1');
-    const artifact2 = await buildArtifact(translatedExceptionListReversed, 'linux', 'v1');
+    const artifact1 = await buildArtifact(
+      translatedExceptionList,
+      'linux',
+      'v1',
+      ArtifactConstants.GLOBAL_ALLOWLIST_NAME
+    );
+    const artifact2 = await buildArtifact(
+      translatedExceptionListReversed,
+      'linux',
+      'v1',
+      ArtifactConstants.GLOBAL_ALLOWLIST_NAME
+    );
     expect(artifact1.decodedSha256).toEqual(artifact2.decodedSha256);
   });
 
@@ -430,8 +487,18 @@ describe('buildEventTypeSignal', () => {
       entries: translatedItems.reverse(),
     };
 
-    const artifact1 = await buildArtifact(translatedExceptionList, 'linux', 'v1');
-    const artifact2 = await buildArtifact(translatedExceptionListReversed, 'linux', 'v1');
+    const artifact1 = await buildArtifact(
+      translatedExceptionList,
+      'linux',
+      'v1',
+      ArtifactConstants.GLOBAL_ALLOWLIST_NAME
+    );
+    const artifact2 = await buildArtifact(
+      translatedExceptionListReversed,
+      'linux',
+      'v1',
+      ArtifactConstants.GLOBAL_ALLOWLIST_NAME
+    );
     expect(artifact1.decodedSha256).toEqual(artifact2.decodedSha256);
   });
 });
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
index e41781dd605a07..731b083f3293c3 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
@@ -28,19 +28,20 @@ import {
   internalArtifactCompleteSchema,
   InternalArtifactCompleteSchema,
 } from '../../schemas';
-import { ArtifactConstants } from './common';
+import { ENDPOINT_TRUSTED_APPS_LIST_ID } from '../../../../../lists/common/constants';
 
 export async function buildArtifact(
   exceptions: WrappedTranslatedExceptionList,
   os: string,
-  schemaVersion: string
+  schemaVersion: string,
+  name: string
 ): Promise<InternalArtifactCompleteSchema> {
   const exceptionsBuffer = Buffer.from(JSON.stringify(exceptions));
   const sha256 = createHash('sha256').update(exceptionsBuffer.toString()).digest('hex');
 
   // Keep compression info empty in case its a duplicate. Lazily compress before committing if needed.
   return {
-    identifier: `${ArtifactConstants.GLOBAL_ALLOWLIST_NAME}-${os}-${schemaVersion}`,
+    identifier: `${name}-${os}-${schemaVersion}`,
     compressionAlgorithm: 'none',
     encryptionAlgorithm: 'none',
     decodedSha256: sha256,
@@ -76,7 +77,8 @@ export function isCompressed(artifact: InternalArtifactSchema) {
 export async function getFullEndpointExceptionList(
   eClient: ExceptionListClient,
   os: string,
-  schemaVersion: string
+  schemaVersion: string,
+  listId: typeof ENDPOINT_LIST_ID | typeof ENDPOINT_TRUSTED_APPS_LIST_ID
 ): Promise<WrappedTranslatedExceptionList> {
   const exceptions: WrappedTranslatedExceptionList = { entries: [] };
   let page = 1;
@@ -84,7 +86,7 @@ export async function getFullEndpointExceptionList(
 
   while (paging) {
     const response = await eClient.findExceptionListItem({
-      listId: ENDPOINT_LIST_ID,
+      listId,
       namespaceType: 'agnostic',
       filter: `exception-list-agnostic.attributes._tags:\"os:${os}\"`,
       perPage: 100,
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.test.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.test.ts
index 3d70f7266277f6..507b81b12e10b0 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.test.ts
@@ -94,6 +94,36 @@ describe('manifest', () => {
             relative_url:
               '/api/endpoint/artifacts/download/endpoint-exceptionlist-windows-v1/96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
           },
+          'endpoint-trustlist-linux-v1': {
+            compression_algorithm: 'zlib',
+            decoded_sha256: '96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+            decoded_size: 432,
+            encoded_sha256: '975382ab55d019cbab0bbac207a54e2a7d489fad6e8f6de34fc6402e5ef37b1e',
+            encoded_size: 147,
+            encryption_algorithm: 'none',
+            relative_url:
+              '/api/endpoint/artifacts/download/endpoint-trustlist-linux-v1/96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          },
+          'endpoint-trustlist-macos-v1': {
+            compression_algorithm: 'zlib',
+            decoded_sha256: '96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+            decoded_size: 432,
+            encoded_sha256: '975382ab55d019cbab0bbac207a54e2a7d489fad6e8f6de34fc6402e5ef37b1e',
+            encoded_size: 147,
+            encryption_algorithm: 'none',
+            relative_url:
+              '/api/endpoint/artifacts/download/endpoint-trustlist-macos-v1/96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          },
+          'endpoint-trustlist-windows-v1': {
+            compression_algorithm: 'zlib',
+            decoded_sha256: '96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+            decoded_size: 432,
+            encoded_sha256: '975382ab55d019cbab0bbac207a54e2a7d489fad6e8f6de34fc6402e5ef37b1e',
+            encoded_size: 147,
+            encryption_algorithm: 'none',
+            relative_url:
+              '/api/endpoint/artifacts/download/endpoint-trustlist-windows-v1/96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          },
         },
         manifest_version: '1.0.0',
         schema_version: 'v1',
@@ -107,6 +137,9 @@ describe('manifest', () => {
         ids: [
           'endpoint-exceptionlist-macos-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
           'endpoint-exceptionlist-windows-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          'endpoint-trustlist-macos-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          'endpoint-trustlist-windows-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          'endpoint-trustlist-linux-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
         ],
       });
     });
@@ -119,6 +152,21 @@ describe('manifest', () => {
             'endpoint-exceptionlist-macos-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
           type: 'delete',
         },
+        {
+          id:
+            'endpoint-trustlist-macos-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          type: 'delete',
+        },
+        {
+          id:
+            'endpoint-trustlist-windows-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          type: 'delete',
+        },
+        {
+          id:
+            'endpoint-trustlist-linux-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          type: 'delete',
+        },
         {
           id:
             'endpoint-exceptionlist-macos-v1-0a5a2013a79f9e60682472284a1be45ab1ff68b9b43426d00d665016612c15c8',
@@ -139,6 +187,9 @@ describe('manifest', () => {
       expect(keys).toEqual([
         'endpoint-exceptionlist-macos-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
         'endpoint-exceptionlist-windows-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+        'endpoint-trustlist-macos-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+        'endpoint-trustlist-windows-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+        'endpoint-trustlist-linux-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
       ]);
     });
 
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/mocks.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/mocks.ts
index 61850bfb3bc7d3..cdfbb551940e1b 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/mocks.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/mocks.ts
@@ -16,13 +16,20 @@ import { ArtifactConstants } from './common';
 import { Manifest } from './manifest';
 
 export const getMockArtifacts = async (opts?: { compress: boolean }) => {
-  return Promise.all(
-    ArtifactConstants.SUPPORTED_OPERATING_SYSTEMS.map<Promise<InternalArtifactCompleteSchema>>(
+  return Promise.all([
+    // Exceptions items
+    ...ArtifactConstants.SUPPORTED_OPERATING_SYSTEMS.map<Promise<InternalArtifactCompleteSchema>>(
       async (os) => {
         return getInternalArtifactMock(os, 'v1', opts);
       }
-    )
-  );
+    ),
+    // Trusted Apps items
+    ...ArtifactConstants.SUPPORTED_TRUSTED_APPS_OPERATING_SYSTEMS.map<
+      Promise<InternalArtifactCompleteSchema>
+    >(async (os) => {
+      return getInternalArtifactMock(os, 'v1', opts, ArtifactConstants.GLOBAL_TRUSTED_APPS_NAME);
+    }),
+  ]);
 };
 
 export const getMockArtifactsWithDiff = async (opts?: { compress: boolean }) => {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/policy/index.ts b/x-pack/plugins/security_solution/server/endpoint/routes/policy/index.ts
index b233ff1af30fc4..5993b0b0e752e5 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/policy/index.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/policy/index.ts
@@ -11,6 +11,8 @@ import { getHostPolicyResponseHandler } from './handlers';
 
 export const BASE_POLICY_RESPONSE_ROUTE = `/api/endpoint/policy_response`;
 
+export const INITIAL_POLICY_ID = '00000000-0000-0000-0000-000000000000';
+
 export function registerPolicyRoutes(router: IRouter, endpointAppContext: EndpointAppContext) {
   router.get(
     {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/policy/service.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/policy/service.test.ts
index 7c8d006687a6bb..f05d9ef5b821a5 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/policy/service.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/policy/service.test.ts
@@ -5,6 +5,7 @@
  */
 
 import { GetPolicyResponseSchema } from '../../../../common/endpoint/schema/policy';
+import { getESQueryPolicyResponseByHostID } from './service';
 
 describe('test policy handlers schema', () => {
   it('validate that get policy response query schema', async () => {
@@ -17,3 +18,21 @@ describe('test policy handlers schema', () => {
     expect(() => GetPolicyResponseSchema.query.validate({})).toThrowError();
   });
 });
+
+describe('test policy query', () => {
+  it('queries for the correct host', async () => {
+    const hostID = 'f757d3c0-e874-11ea-9ad9-015510b487f4';
+    const query = getESQueryPolicyResponseByHostID(hostID, 'anyindex');
+    expect(query.body.query.bool.filter.term).toEqual({ 'host.id': hostID });
+  });
+
+  it('filters out initial policy by ID', async () => {
+    const query = getESQueryPolicyResponseByHostID(
+      'f757d3c0-e874-11ea-9ad9-015510b487f4',
+      'anyindex'
+    );
+    expect(query.body.query.bool.must_not.term).toEqual({
+      'Endpoint.policy.applied.id': '00000000-0000-0000-0000-000000000000',
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/policy/service.ts b/x-pack/plugins/security_solution/server/endpoint/routes/policy/service.ts
index 703c46b05f7660..1b3d232f9421c9 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/policy/service.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/policy/service.ts
@@ -7,13 +7,23 @@
 import { SearchResponse } from 'elasticsearch';
 import { ILegacyScopedClusterClient } from 'kibana/server';
 import { GetHostPolicyResponse, HostPolicyResponse } from '../../../../common/endpoint/types';
+import { INITIAL_POLICY_ID } from './index';
 
 export function getESQueryPolicyResponseByHostID(hostID: string, index: string) {
   return {
     body: {
       query: {
-        match: {
-          'host.id': hostID,
+        bool: {
+          filter: {
+            term: {
+              'host.id': hostID,
+            },
+          },
+          must_not: {
+            term: {
+              'Endpoint.policy.applied.id': INITIAL_POLICY_ID,
+            },
+          },
         },
       },
       sort: [
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/entity.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/entity.ts
index bcac559d61f799..510bb6c5455587 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/entity.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/entity.ts
@@ -18,11 +18,6 @@ export function handleEntities(): RequestHandler<unknown, TypeOf<typeof validate
       query: { _id, indices },
     } = request;
 
-    const siemClient = context.securitySolution!.getAppClient();
-    const queryIndices = indices;
-    // if the alert was promoted by a rule it will exist in the signals index so search there too
-    queryIndices.push(siemClient.getSignalsIndex());
-
     /**
      * A safe type for the response based on the semantics of the query.
      * We specify _source, asking for `process.entity_id` and we only
@@ -36,8 +31,8 @@ export function handleEntities(): RequestHandler<unknown, TypeOf<typeof validate
           | [
               {
                 _source: {
-                  process: {
-                    entity_id: string;
+                  process?: {
+                    entity_id?: string;
                   };
                 };
               }
@@ -49,7 +44,7 @@ export function handleEntities(): RequestHandler<unknown, TypeOf<typeof validate
       'search',
       {
         ignoreUnavailable: true,
-        index: queryIndices,
+        index: indices,
         body: {
           // only return process.entity_id
           _source: 'process.entity_id',
@@ -64,19 +59,6 @@ export function handleEntities(): RequestHandler<unknown, TypeOf<typeof validate
                     values: _id,
                   },
                 },
-                {
-                  exists: {
-                    // only return documents that have process.entity_id
-                    field: 'process.entity_id',
-                  },
-                },
-                {
-                  bool: {
-                    must_not: {
-                      term: { 'process.entity_id': '' },
-                    },
-                  },
-                },
               ],
             },
           },
@@ -85,15 +67,13 @@ export function handleEntities(): RequestHandler<unknown, TypeOf<typeof validate
     );
 
     const responseBody: ResolverEntityIndex = [];
-    for (const {
-      _source: {
-        // eslint-disable-next-line @typescript-eslint/naming-convention
-        process: { entity_id },
-      },
-    } of queryResponse.hits.hits) {
-      responseBody.push({
-        entity_id,
-      });
+    for (const hit of queryResponse.hits.hits) {
+      // check that the field is defined and that is not an empty string
+      if (hit._source.process?.entity_id) {
+        responseBody.push({
+          entity_id: hit._source.process.entity_id,
+        });
+      }
     }
     return response.ok({ body: responseBody });
   };
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/handlers.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/handlers.ts
index 6c29a2244c203d..a3e6f54f3eee80 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/handlers.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/handlers.ts
@@ -8,10 +8,40 @@ import { RequestHandler } from 'kibana/server';
 import {
   GetTrustedAppsListRequest,
   GetTrustedListAppsResponse,
+  PostTrustedAppCreateRequest,
 } from '../../../../common/endpoint/types';
 import { EndpointAppContext } from '../../types';
-import { exceptionItemToTrustedAppItem } from './utils';
+import { exceptionItemToTrustedAppItem, newTrustedAppItemToExceptionItem } from './utils';
 import { ENDPOINT_TRUSTED_APPS_LIST_ID } from '../../../../../lists/common/constants';
+import { DeleteTrustedAppsRequestParams } from './types';
+
+export const getTrustedAppsDeleteRouteHandler = (
+  endpointAppContext: EndpointAppContext
+): RequestHandler<DeleteTrustedAppsRequestParams, undefined, undefined> => {
+  const logger = endpointAppContext.logFactory.get('trusted_apps');
+
+  return async (context, req, res) => {
+    const exceptionsListService = endpointAppContext.service.getExceptionsList();
+
+    try {
+      const { id } = req.params;
+      const response = await exceptionsListService.deleteExceptionListItem({
+        id,
+        itemId: undefined,
+        namespaceType: 'agnostic',
+      });
+
+      if (response === null) {
+        return res.notFound({ body: `trusted app id [${id}] not found` });
+      }
+
+      return res.ok();
+    } catch (error) {
+      logger.error(error);
+      return res.internalError({ body: error });
+    }
+  };
+};
 
 export const getTrustedAppsListRouteHandler = (
   endpointAppContext: EndpointAppContext
@@ -24,7 +54,7 @@ export const getTrustedAppsListRouteHandler = (
 
     try {
       // Ensure list is created if it does not exist
-      await exceptionsListService?.createTrustedAppsList();
+      await exceptionsListService.createTrustedAppsList();
       const results = await exceptionsListService.findExceptionListItem({
         listId: ENDPOINT_TRUSTED_APPS_LIST_ID,
         page,
@@ -47,3 +77,32 @@ export const getTrustedAppsListRouteHandler = (
     }
   };
 };
+
+export const getTrustedAppsCreateRouteHandler = (
+  endpointAppContext: EndpointAppContext
+): RequestHandler<undefined, undefined, PostTrustedAppCreateRequest> => {
+  const logger = endpointAppContext.logFactory.get('trusted_apps');
+
+  return async (constext, req, res) => {
+    const exceptionsListService = endpointAppContext.service.getExceptionsList();
+    const newTrustedApp = req.body;
+
+    try {
+      // Ensure list is created if it does not exist
+      await exceptionsListService.createTrustedAppsList();
+
+      const createdTrustedAppExceptionItem = await exceptionsListService.createExceptionListItem(
+        newTrustedAppItemToExceptionItem(newTrustedApp)
+      );
+
+      return res.ok({
+        body: {
+          data: exceptionItemToTrustedAppItem(createdTrustedAppExceptionItem),
+        },
+      });
+    } catch (error) {
+      logger.error(error);
+      return res.internalError({ body: error });
+    }
+  };
+};
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/index.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/index.ts
index 178aa06eee8775..5f502555ee153d 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/index.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/index.ts
@@ -5,15 +5,37 @@
  */
 
 import { IRouter } from 'kibana/server';
-import { GetTrustedAppsRequestSchema } from '../../../../common/endpoint/schema/trusted_apps';
-import { TRUSTED_APPS_LIST_API } from '../../../../common/endpoint/constants';
-import { getTrustedAppsListRouteHandler } from './handlers';
+import {
+  DeleteTrustedAppsRequestSchema,
+  GetTrustedAppsRequestSchema,
+  PostTrustedAppCreateRequestSchema,
+} from '../../../../common/endpoint/schema/trusted_apps';
+import {
+  TRUSTED_APPS_CREATE_API,
+  TRUSTED_APPS_DELETE_API,
+  TRUSTED_APPS_LIST_API,
+} from '../../../../common/endpoint/constants';
+import {
+  getTrustedAppsCreateRouteHandler,
+  getTrustedAppsDeleteRouteHandler,
+  getTrustedAppsListRouteHandler,
+} from './handlers';
 import { EndpointAppContext } from '../../types';
 
 export const registerTrustedAppsRoutes = (
   router: IRouter,
   endpointAppContext: EndpointAppContext
 ) => {
+  // DELETE one
+  router.delete(
+    {
+      path: TRUSTED_APPS_DELETE_API,
+      validate: DeleteTrustedAppsRequestSchema,
+      options: { authRequired: true },
+    },
+    getTrustedAppsDeleteRouteHandler(endpointAppContext)
+  );
+
   // GET list
   router.get(
     {
@@ -23,4 +45,14 @@ export const registerTrustedAppsRoutes = (
     },
     getTrustedAppsListRouteHandler(endpointAppContext)
   );
+
+  // CREATE
+  router.post(
+    {
+      path: TRUSTED_APPS_CREATE_API,
+      validate: PostTrustedAppCreateRequestSchema,
+      options: { authRequired: true },
+    },
+    getTrustedAppsCreateRouteHandler(endpointAppContext)
+  );
 };
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/trusted_apps.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/trusted_apps.test.ts
index 1d4a7919b89f53..2325036ef40aeb 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/trusted_apps.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/trusted_apps.test.ts
@@ -9,15 +9,25 @@ import {
   createMockEndpointAppContext,
   createMockEndpointAppContextServiceStartContract,
 } from '../../mocks';
-import { IRouter, RequestHandler } from 'kibana/server';
+import { IRouter, KibanaRequest, RequestHandler } from 'kibana/server';
 import { httpServerMock, httpServiceMock } from '../../../../../../../src/core/server/mocks';
 import { registerTrustedAppsRoutes } from './index';
-import { TRUSTED_APPS_LIST_API } from '../../../../common/endpoint/constants';
-import { GetTrustedAppsListRequest } from '../../../../common/endpoint/types';
+import {
+  TRUSTED_APPS_CREATE_API,
+  TRUSTED_APPS_DELETE_API,
+  TRUSTED_APPS_LIST_API,
+} from '../../../../common/endpoint/constants';
+import {
+  GetTrustedAppsListRequest,
+  PostTrustedAppCreateRequest,
+} from '../../../../common/endpoint/types';
 import { xpackMocks } from '../../../../../../mocks';
 import { ENDPOINT_TRUSTED_APPS_LIST_ID } from '../../../../../lists/common/constants';
 import { EndpointAppContext } from '../../types';
 import { ExceptionListClient } from '../../../../../lists/server';
+import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
+import { ExceptionListItemSchema } from '../../../../../lists/common/schemas/response';
+import { DeleteTrustedAppsRequestParams } from './types';
 
 describe('when invoking endpoint trusted apps route handlers', () => {
   let routerMock: jest.Mocked<IRouter>;
@@ -105,4 +115,152 @@ describe('when invoking endpoint trusted apps route handlers', () => {
       expect(endpointAppContext.logFactory.get('trusted_apps').error).toHaveBeenCalled();
     });
   });
+
+  describe('when creating a trusted app', () => {
+    let routeHandler: RequestHandler<undefined, PostTrustedAppCreateRequest>;
+    const createNewTrustedAppBody = (): PostTrustedAppCreateRequest => ({
+      name: 'Some Anti-Virus App',
+      description: 'this one is ok',
+      os: 'windows',
+      entries: [
+        {
+          field: 'path',
+          type: 'match',
+          operator: 'included',
+          value: 'c:/programs files/Anti-Virus',
+        },
+      ],
+    });
+    const createPostRequest = () => {
+      return httpServerMock.createKibanaRequest<undefined, PostTrustedAppCreateRequest>({
+        path: TRUSTED_APPS_LIST_API,
+        method: 'post',
+        body: createNewTrustedAppBody(),
+      });
+    };
+
+    beforeEach(() => {
+      // Get the registered POST handler from the IRouter instance
+      [, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+        path.startsWith(TRUSTED_APPS_CREATE_API)
+      )!;
+
+      // Mock the impelementation of `createExceptionListItem()` so that the return value
+      // merges in the provided input
+      exceptionsListClient.createExceptionListItem.mockImplementation(async (newExceptionItem) => {
+        return ({
+          ...getExceptionListItemSchemaMock(),
+          ...newExceptionItem,
+        } as unknown) as ExceptionListItemSchema;
+      });
+    });
+
+    it('should create trusted app list first', async () => {
+      const request = createPostRequest();
+      await routeHandler(context, request, response);
+      expect(exceptionsListClient.createTrustedAppsList).toHaveBeenCalled();
+      expect(response.ok).toHaveBeenCalled();
+    });
+
+    it('should map new trusted app item to an exception list item', async () => {
+      const request = createPostRequest();
+      await routeHandler(context, request, response);
+      expect(exceptionsListClient.createExceptionListItem.mock.calls[0][0]).toEqual({
+        _tags: ['os:windows'],
+        comments: [],
+        description: 'this one is ok',
+        entries: [
+          {
+            field: 'path',
+            operator: 'included',
+            type: 'match',
+            value: 'c:/programs files/Anti-Virus',
+          },
+        ],
+        itemId: expect.stringMatching(/.*/),
+        listId: 'endpoint_trusted_apps',
+        meta: undefined,
+        name: 'Some Anti-Virus App',
+        namespaceType: 'agnostic',
+        tags: [],
+        type: 'simple',
+      });
+    });
+
+    it('should return new trusted app item', async () => {
+      const request = createPostRequest();
+      await routeHandler(context, request, response);
+      expect(response.ok.mock.calls[0][0]).toEqual({
+        body: {
+          data: {
+            created_at: '2020-04-20T15:25:31.830Z',
+            created_by: 'some user',
+            description: 'this one is ok',
+            entries: [
+              {
+                field: 'path',
+                operator: 'included',
+                type: 'match',
+                value: 'c:/programs files/Anti-Virus',
+              },
+            ],
+            id: '1',
+            name: 'Some Anti-Virus App',
+            os: 'windows',
+          },
+        },
+      });
+    });
+
+    it('should log unexpected error if one occurs', async () => {
+      exceptionsListClient.createExceptionListItem.mockImplementation(() => {
+        throw new Error('expected error for create');
+      });
+      const request = createPostRequest();
+      await routeHandler(context, request, response);
+      expect(response.internalError).toHaveBeenCalled();
+      expect(endpointAppContext.logFactory.get('trusted_apps').error).toHaveBeenCalled();
+    });
+  });
+
+  describe('when deleting a trusted app', () => {
+    let routeHandler: RequestHandler<DeleteTrustedAppsRequestParams>;
+    let request: KibanaRequest<DeleteTrustedAppsRequestParams>;
+
+    beforeEach(() => {
+      [, routeHandler] = routerMock.delete.mock.calls.find(([{ path }]) =>
+        path.startsWith(TRUSTED_APPS_DELETE_API)
+      )!;
+
+      request = httpServerMock.createKibanaRequest<DeleteTrustedAppsRequestParams>({
+        path: TRUSTED_APPS_DELETE_API.replace('{id}', '123'),
+        method: 'delete',
+      });
+    });
+
+    it('should return 200 on successful delete', async () => {
+      await routeHandler(context, request, response);
+      expect(exceptionsListClient.deleteExceptionListItem).toHaveBeenCalledWith({
+        id: request.params.id,
+        itemId: undefined,
+        namespaceType: 'agnostic',
+      });
+      expect(response.ok).toHaveBeenCalled();
+    });
+
+    it('should return 404 if item does not exist', async () => {
+      exceptionsListClient.deleteExceptionListItem.mockResolvedValueOnce(null);
+      await routeHandler(context, request, response);
+      expect(response.notFound).toHaveBeenCalled();
+    });
+
+    it('should log unexpected error if one occurs', async () => {
+      exceptionsListClient.deleteExceptionListItem.mockImplementation(() => {
+        throw new Error('expected error for delete');
+      });
+      await routeHandler(context, request, response);
+      expect(response.internalError).toHaveBeenCalled();
+      expect(endpointAppContext.logFactory.get('trusted_apps').error).toHaveBeenCalled();
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/types.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/types.ts
new file mode 100644
index 00000000000000..13c8bcfc207932
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/types.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { TypeOf } from '@kbn/config-schema';
+import { DeleteTrustedAppsRequestSchema } from '../../../../common/endpoint/schema/trusted_apps';
+
+export type DeleteTrustedAppsRequestParams = TypeOf<typeof DeleteTrustedAppsRequestSchema.params>;
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/utils.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/utils.ts
index 2b417a4c6a8e16..794c1db4b49aa8 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/utils.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/utils.ts
@@ -4,8 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import uuid from 'uuid';
 import { ExceptionListItemSchema } from '../../../../../lists/common/shared_exports';
-import { TrustedApp } from '../../../../common/endpoint/types';
+import { NewTrustedApp, TrustedApp } from '../../../../common/endpoint/types';
+import { ExceptionListClient } from '../../../../../lists/server';
+import { ENDPOINT_TRUSTED_APPS_LIST_ID } from '../../../../../lists/common/constants';
+
+type NewExecptionItem = Parameters<ExceptionListClient['createExceptionListItem']>[0];
 
 /**
  * Map an ExcptionListItem to a TrustedApp item
@@ -40,3 +45,28 @@ const osFromTagsList = (tags: string[]): TrustedApp['os'] | 'unknown' => {
   }
   return 'unknown';
 };
+
+export const newTrustedAppItemToExceptionItem = ({
+  os,
+  entries,
+  name,
+  description = '',
+}: NewTrustedApp): NewExecptionItem => {
+  return {
+    _tags: tagsListFromOs(os),
+    comments: [],
+    description,
+    entries,
+    itemId: uuid.v4(),
+    listId: ENDPOINT_TRUSTED_APPS_LIST_ID,
+    meta: undefined,
+    name,
+    namespaceType: 'agnostic',
+    tags: [],
+    type: 'simple',
+  };
+};
+
+const tagsListFromOs = (os: NewTrustedApp['os']): NewExecptionItem['_tags'] => {
+  return [`os:${os}`];
+};
diff --git a/x-pack/plugins/security_solution/server/endpoint/schemas/artifacts/saved_objects.mock.ts b/x-pack/plugins/security_solution/server/endpoint/schemas/artifacts/saved_objects.mock.ts
index ae565f785c399d..5d46fd0f2456b5 100644
--- a/x-pack/plugins/security_solution/server/endpoint/schemas/artifacts/saved_objects.mock.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/schemas/artifacts/saved_objects.mock.ts
@@ -4,7 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { buildArtifact, maybeCompressArtifact, isCompressed } from '../../lib/artifacts';
+import {
+  buildArtifact,
+  maybeCompressArtifact,
+  isCompressed,
+  ArtifactConstants,
+} from '../../lib/artifacts';
 import { getTranslatedExceptionListMock } from './lists.mock';
 import {
   InternalManifestSchema,
@@ -25,9 +30,15 @@ const compressArtifact = async (artifact: InternalArtifactCompleteSchema) => {
 export const getInternalArtifactMock = async (
   os: string,
   schemaVersion: string,
-  opts?: { compress: boolean }
+  opts?: { compress: boolean },
+  artifactName: string = ArtifactConstants.GLOBAL_ALLOWLIST_NAME
 ): Promise<InternalArtifactCompleteSchema> => {
-  const artifact = await buildArtifact(getTranslatedExceptionListMock(), os, schemaVersion);
+  const artifact = await buildArtifact(
+    getTranslatedExceptionListMock(),
+    os,
+    schemaVersion,
+    artifactName
+  );
   return opts?.compress ? compressArtifact(artifact) : artifact;
 };
 
@@ -36,7 +47,12 @@ export const getEmptyInternalArtifactMock = async (
   schemaVersion: string,
   opts?: { compress: boolean }
 ): Promise<InternalArtifactCompleteSchema> => {
-  const artifact = await buildArtifact({ entries: [] }, os, schemaVersion);
+  const artifact = await buildArtifact(
+    { entries: [] },
+    os,
+    schemaVersion,
+    ArtifactConstants.GLOBAL_ALLOWLIST_NAME
+  );
   return opts?.compress ? compressArtifact(artifact) : artifact;
 };
 
@@ -47,7 +63,12 @@ export const getInternalArtifactMockWithDiffs = async (
 ): Promise<InternalArtifactCompleteSchema> => {
   const mock = getTranslatedExceptionListMock();
   mock.entries.pop();
-  const artifact = await buildArtifact(mock, os, schemaVersion);
+  const artifact = await buildArtifact(
+    mock,
+    os,
+    schemaVersion,
+    ArtifactConstants.GLOBAL_ALLOWLIST_NAME
+  );
   return opts?.compress ? compressArtifact(artifact) : artifact;
 };
 
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
index bb6504de6e0a42..40b408166b17f4 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
@@ -24,11 +24,41 @@ describe('manifest_manager', () => {
             'endpoint-exceptionlist-macos-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
           type: 'delete',
         },
+        {
+          id:
+            'endpoint-trustlist-macos-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          type: 'delete',
+        },
+        {
+          id:
+            'endpoint-trustlist-windows-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          type: 'delete',
+        },
+        {
+          id:
+            'endpoint-trustlist-linux-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          type: 'delete',
+        },
         {
           id:
             'endpoint-exceptionlist-macos-v1-0a5a2013a79f9e60682472284a1be45ab1ff68b9b43426d00d665016612c15c8',
           type: 'add',
         },
+        {
+          id:
+            'endpoint-trustlist-macos-v1-1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          type: 'add',
+        },
+        {
+          id:
+            'endpoint-trustlist-windows-v1-1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          type: 'add',
+        },
+        {
+          id:
+            'endpoint-trustlist-linux-v1-1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          type: 'add',
+        },
       ]);
     });
 
@@ -44,16 +74,53 @@ describe('manifest_manager', () => {
             'endpoint-exceptionlist-macos-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
           type: 'delete',
         },
+        {
+          id:
+            'endpoint-trustlist-macos-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          type: 'delete',
+        },
+        {
+          id:
+            'endpoint-trustlist-windows-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          type: 'delete',
+        },
+        {
+          id:
+            'endpoint-trustlist-linux-v1-96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
+          type: 'delete',
+        },
         {
           id:
             'endpoint-exceptionlist-macos-v1-0a5a2013a79f9e60682472284a1be45ab1ff68b9b43426d00d665016612c15c8',
           type: 'add',
         },
+        {
+          id:
+            'endpoint-trustlist-macos-v1-1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          type: 'add',
+        },
+        {
+          id:
+            'endpoint-trustlist-windows-v1-1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          type: 'add',
+        },
+        {
+          id:
+            'endpoint-trustlist-linux-v1-1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          type: 'add',
+        },
       ]);
 
-      const newArtifactId = diffs[1].id;
-      await newManifest.compressArtifact(newArtifactId);
-      const artifact = newManifest.getArtifact(newArtifactId)!;
+      const firstNewArtifactId = diffs.find((diff) => diff.type === 'add')!.id;
+
+      // Compress all `add` artifacts
+      for (const artifactDiff of diffs) {
+        if (artifactDiff.type === 'add') {
+          await newManifest.compressArtifact(artifactDiff.id);
+        }
+      }
+
+      const artifact = newManifest.getArtifact(firstNewArtifactId)!;
 
       if (isCompleteArtifact(artifact)) {
         await manifestManager.pushArtifacts([artifact]); // caches the artifact
@@ -61,7 +128,7 @@ describe('manifest_manager', () => {
         throw new Error('Artifact is missing a body.');
       }
 
-      const entry = JSON.parse(inflateSync(cache.get(newArtifactId)! as Buffer).toString());
+      const entry = JSON.parse(inflateSync(cache.get(firstNewArtifactId)! as Buffer).toString());
       expect(entry).toEqual({
         entries: [
           {
@@ -107,8 +174,12 @@ describe('manifest_manager', () => {
       const oldManifest = await manifestManager.getLastComputedManifest();
       const newManifest = await manifestManager.buildNewManifest(oldManifest!);
       const diffs = newManifest.diff(oldManifest!);
-      const newArtifactId = diffs[1].id;
-      await newManifest.compressArtifact(newArtifactId);
+
+      for (const artifactDiff of diffs) {
+        if (artifactDiff.type === 'add') {
+          await newManifest.compressArtifact(artifactDiff.id);
+        }
+      }
 
       newManifest.bumpSemanticVersion();
 
@@ -145,6 +216,36 @@ describe('manifest_manager', () => {
             relative_url:
               '/api/endpoint/artifacts/download/endpoint-exceptionlist-windows-v1/96b76a1a911662053a1562ac14c4ff1e87c2ff550d6fe52e1e0b3790526597d3',
           },
+          'endpoint-trustlist-linux-v1': {
+            compression_algorithm: 'zlib',
+            decoded_sha256: '1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+            decoded_size: 287,
+            encoded_sha256: 'c3dec543df1177561ab2aa74a37997ea3c1d748d532a597884f5a5c16670d56c',
+            encoded_size: 133,
+            encryption_algorithm: 'none',
+            relative_url:
+              '/api/endpoint/artifacts/download/endpoint-trustlist-linux-v1/1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          },
+          'endpoint-trustlist-macos-v1': {
+            compression_algorithm: 'zlib',
+            decoded_sha256: '1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+            decoded_size: 287,
+            encoded_sha256: 'c3dec543df1177561ab2aa74a37997ea3c1d748d532a597884f5a5c16670d56c',
+            encoded_size: 133,
+            encryption_algorithm: 'none',
+            relative_url:
+              '/api/endpoint/artifacts/download/endpoint-trustlist-macos-v1/1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          },
+          'endpoint-trustlist-windows-v1': {
+            compression_algorithm: 'zlib',
+            decoded_sha256: '1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+            decoded_size: 287,
+            encoded_sha256: 'c3dec543df1177561ab2aa74a37997ea3c1d748d532a597884f5a5c16670d56c',
+            encoded_size: 133,
+            encryption_algorithm: 'none',
+            relative_url:
+              '/api/endpoint/artifacts/download/endpoint-trustlist-windows-v1/1a8295e6ccb93022c6f5ceb8997b29f2912389b3b38f52a8f5a2ff7b0154b1bc',
+          },
         },
       });
     });
@@ -155,8 +256,12 @@ describe('manifest_manager', () => {
       const oldManifest = await manifestManager.getLastComputedManifest();
       const newManifest = await manifestManager.buildNewManifest(oldManifest!);
       const diffs = newManifest.diff(oldManifest!);
-      const newArtifactId = diffs[1].id;
-      await newManifest.compressArtifact(newArtifactId);
+
+      for (const artifactDiff of diffs) {
+        if (artifactDiff.type === 'add') {
+          await newManifest.compressArtifact(artifactDiff.id);
+        }
+      }
 
       newManifest.bumpSemanticVersion();
 
@@ -174,11 +279,17 @@ describe('manifest_manager', () => {
       const oldManifest = await manifestManager.getLastComputedManifest();
       const newManifest = await manifestManager.buildNewManifest(oldManifest!);
       const diffs = newManifest.diff(oldManifest!);
-      const oldArtifactId = diffs[0].id;
-      const newArtifactId = diffs[1].id;
-      await newManifest.compressArtifact(newArtifactId);
+      const firstOldArtifactId = diffs.find((diff) => diff.type === 'delete')!.id;
+      const FirstNewArtifactId = diffs.find((diff) => diff.type === 'add')!.id;
+
+      // Compress all new artifacts
+      for (const artifactDiff of diffs) {
+        if (artifactDiff.type === 'add') {
+          await newManifest.compressArtifact(artifactDiff.id);
+        }
+      }
 
-      const artifact = newManifest.getArtifact(newArtifactId)!;
+      const artifact = newManifest.getArtifact(FirstNewArtifactId)!;
       if (isCompleteArtifact(artifact)) {
         await manifestManager.pushArtifacts([artifact]);
       } else {
@@ -186,7 +297,7 @@ describe('manifest_manager', () => {
       }
 
       await manifestManager.commit(newManifest);
-      await manifestManager.deleteArtifacts([oldArtifactId]);
+      await manifestManager.deleteArtifacts([firstOldArtifactId]);
 
       // created new artifact
       expect(savedObjectsClient.create.mock.calls[0][0]).toEqual(
@@ -201,7 +312,7 @@ describe('manifest_manager', () => {
       // deleted old artifact
       expect(savedObjectsClient.delete).toHaveBeenCalledWith(
         ArtifactConstants.SAVED_OBJECT_TYPE,
-        oldArtifactId
+        firstOldArtifactId
       );
     });
 
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
index 70557886e57c51..f9836c7ecdc30c 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
@@ -13,11 +13,11 @@ import { manifestDispatchSchema } from '../../../../../common/endpoint/schema/ma
 
 import {
   ArtifactConstants,
-  Manifest,
   buildArtifact,
+  getArtifactId,
   getFullEndpointExceptionList,
+  Manifest,
   ManifestDiff,
-  getArtifactId,
 } from '../../../lib/artifacts';
 import {
   InternalArtifactCompleteSchema,
@@ -25,6 +25,8 @@ import {
 } from '../../../schemas/artifacts';
 import { ArtifactClient } from '../artifact_client';
 import { ManifestClient } from '../manifest_client';
+import { ENDPOINT_LIST_ID } from '../../../../../../lists/common';
+import { ENDPOINT_TRUSTED_APPS_LIST_ID } from '../../../../../../lists/common/constants';
 
 export interface ManifestManagerContext {
   savedObjectsClient: SavedObjectsClientContract;
@@ -87,9 +89,43 @@ export class ManifestManager {
       const exceptionList = await getFullEndpointExceptionList(
         this.exceptionListClient,
         os,
-        artifactSchemaVersion ?? 'v1'
+        artifactSchemaVersion ?? 'v1',
+        ENDPOINT_LIST_ID
+      );
+      const artifact = await buildArtifact(
+        exceptionList,
+        os,
+        artifactSchemaVersion ?? 'v1',
+        ArtifactConstants.GLOBAL_ALLOWLIST_NAME
+      );
+      artifacts.push(artifact);
+    }
+    return artifacts;
+  }
+
+  /**
+   * Builds an array of artifacts (one per supported OS) based on the current state of the
+   * Trusted Apps list (which uses the `exception-list-agnostic` SO type)
+   * @param artifactSchemaVersion
+   */
+  protected async buildTrustedAppsArtifacts(
+    artifactSchemaVersion?: string
+  ): Promise<InternalArtifactCompleteSchema[]> {
+    const artifacts: InternalArtifactCompleteSchema[] = [];
+
+    for (const os of ArtifactConstants.SUPPORTED_TRUSTED_APPS_OPERATING_SYSTEMS) {
+      const trustedApps = await getFullEndpointExceptionList(
+        this.exceptionListClient,
+        os,
+        artifactSchemaVersion ?? 'v1',
+        ENDPOINT_TRUSTED_APPS_LIST_ID
+      );
+      const artifact = await buildArtifact(
+        trustedApps,
+        os,
+        'v1',
+        ArtifactConstants.GLOBAL_TRUSTED_APPS_NAME
       );
-      const artifact = await buildArtifact(exceptionList, os, artifactSchemaVersion ?? 'v1');
       artifacts.push(artifact);
     }
     return artifacts;
@@ -205,7 +241,9 @@ export class ManifestManager {
    */
   public async buildNewManifest(baselineManifest?: Manifest): Promise<Manifest> {
     // Build new exception list artifacts
-    const artifacts = await this.buildExceptionListArtifacts();
+    const artifacts = (
+      await Promise.all([this.buildExceptionListArtifacts(), this.buildTrustedAppsArtifacts()])
+    ).flat();
 
     // Build new manifest
     const manifest = Manifest.fromArtifacts(
diff --git a/x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts
index bdc69f85d35429..60c2ce8ceca64f 100644
--- a/x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts
+++ b/x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts
@@ -424,6 +424,7 @@ export const ecsSchema = gql`
   type SignalField {
     rule: RuleField
     original_time: ToStringArray
+    status: ToStringArray
   }
 
   type RuleEcsField {
diff --git a/x-pack/plugins/security_solution/server/graphql/types.ts b/x-pack/plugins/security_solution/server/graphql/types.ts
index fa55af351651e7..7638ebd03f6b16 100644
--- a/x-pack/plugins/security_solution/server/graphql/types.ts
+++ b/x-pack/plugins/security_solution/server/graphql/types.ts
@@ -1022,6 +1022,8 @@ export interface SignalField {
   rule?: Maybe<RuleField>;
 
   original_time?: Maybe<string[] | string>;
+
+  status?: Maybe<string[] | string>;
 }
 
 export interface RuleField {
@@ -4930,6 +4932,8 @@ export namespace SignalFieldResolvers {
     rule?: RuleResolver<Maybe<RuleField>, TypeParent, TContext>;
 
     original_time?: OriginalTimeResolver<Maybe<string[] | string>, TypeParent, TContext>;
+
+    status?: StatusResolver<Maybe<string[] | string>, TypeParent, TContext>;
   }
 
   export type RuleResolver<
@@ -4942,6 +4946,11 @@ export namespace SignalFieldResolvers {
     Parent = SignalField,
     TContext = SiemContext
   > = Resolver<R, Parent, TContext>;
+  export type StatusResolver<
+    R = Maybe<string[] | string>,
+    Parent = SignalField,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
 }
 
 export namespace RuleFieldResolvers {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/rules_notification_alert_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/rules_notification_alert_type.ts
index 0a899562d61c2d..802b9472a44870 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/rules_notification_alert_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/rules_notification_alert_type.ts
@@ -14,7 +14,7 @@ import { RuleAlertAttributes } from '../signals/types';
 import { siemRuleActionGroups } from '../signals/siem_rule_action_groups';
 import { scheduleNotificationActions } from './schedule_notification_actions';
 import { getNotificationResultsLink } from './utils';
-import { parseScheduleDates } from '../../../../common/detection_engine/utils';
+import { parseScheduleDates } from '../../../../common/detection_engine/parse_schedule_dates';
 
 export const rulesNotificationAlertType = ({
   logger,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
index 18eea7c45585fc..8a7215e5a5badd 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
@@ -20,7 +20,7 @@ import {
   importRulesSchema as importRulesResponseSchema,
 } from '../../../../../common/detection_engine/schemas/response/import_rules_schema';
 import { IRouter } from '../../../../../../../../src/core/server';
-import { createPromiseFromStreams } from '../../../../../../../../src/legacy/utils/streams';
+import { createPromiseFromStreams } from '../../../../../../../../src/core/server/utils/';
 import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
 import { ConfigType } from '../../../../config';
 import { SetupPlugins } from '../../../../plugin';
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts
index 3122db1919c3c2..11f74c264ae0cf 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts
@@ -22,7 +22,7 @@ import { INTERNAL_IDENTIFIER } from '../../../../../common/constants';
 import { RuleTypeParams } from '../../types';
 import { BulkError, ImportSuccessError } from '../utils';
 import { getOutputRuleAlertForRest } from '../__mocks__/utils';
-import { createPromiseFromStreams } from '../../../../../../../../src/legacy/utils/streams';
+import { createPromiseFromStreams } from '../../../../../../../../src/core/server/utils';
 import { PartialAlert } from '../../../../../../alerts/server';
 import { SanitizedAlert } from '../../../../../../alerts/server/types';
 import { createRulesStreamFromNdJson } from '../../rules/create_rules_stream_from_ndjson';
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/open_close_signals_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
index ac5132d93a0698..be6e57aee6d0cf 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
@@ -28,11 +28,12 @@ export const setSignalsStatusRoute = (router: IRouter) => {
       },
     },
     async (context, request, response) => {
-      const { signal_ids: signalIds, query, status } = request.body;
+      const { conflicts, signal_ids: signalIds, query, status } = request.body;
       const clusterClient = context.core.elasticsearch.legacy.client;
       const siemClient = context.securitySolution?.getAppClient();
       const siemResponse = buildSiemResponse(response);
       const validationErrors = setSignalStatusValidateTypeDependents(request.body);
+
       if (validationErrors.length) {
         return siemResponse.error({ statusCode: 400, body: validationErrors });
       }
@@ -55,6 +56,7 @@ export const setSignalsStatusRoute = (router: IRouter) => {
       try {
         const result = await clusterClient.callAsCurrentUser('updateByQuery', {
           index: siemClient.getSignalsIndex(),
+          conflicts: conflicts ?? 'abort',
           refresh: 'wait_for',
           body: {
             script: {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.test.ts
index f2061ce1d36de5..60071bc2cef41e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.test.ts
@@ -5,7 +5,7 @@
  */
 import { Readable } from 'stream';
 import { createRulesStreamFromNdJson } from './create_rules_stream_from_ndjson';
-import { createPromiseFromStreams } from 'src/legacy/utils/streams';
+import { createPromiseFromStreams } from 'src/core/server/utils';
 import { BadRequestError } from '../errors/bad_request_error';
 import { ImportRulesSchemaDecoded } from '../../../../common/detection_engine/schemas/request/import_rules_schema';
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.ts
index d7723232ca921d..cd574a8d95615e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.ts
@@ -19,7 +19,7 @@ import {
   createSplitStream,
   createMapStream,
   createConcatStream,
-} from '../../../../../../../src/legacy/utils/streams';
+} from '../../../../../../../src/core/server/utils';
 import { BadRequestError } from '../errors/bad_request_error';
 import {
   parseNdjsonStrings,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/find_ml_signals.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/find_ml_signals.ts
index 18a64a12431b8c..bd9bf50688b58a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/find_ml_signals.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/find_ml_signals.ts
@@ -6,13 +6,12 @@
 
 import dateMath from '@elastic/datemath';
 
-import { ILegacyScopedClusterClient, KibanaRequest } from '../../../../../../../src/core/server';
+import { KibanaRequest } from '../../../../../../../src/core/server';
 import { MlPluginSetup } from '../../../../../ml/server';
 import { getAnomalies } from '../../machine_learning';
 
 export const findMlSignals = async ({
   ml,
-  clusterClient,
   request,
   jobId,
   anomalyThreshold,
@@ -20,14 +19,13 @@ export const findMlSignals = async ({
   to,
 }: {
   ml: MlPluginSetup;
-  clusterClient: ILegacyScopedClusterClient;
   request: KibanaRequest;
   jobId: string;
   anomalyThreshold: number;
   from: string;
   to: string;
 }) => {
-  const { mlAnomalySearch } = ml.mlSystemProvider(clusterClient, request);
+  const { mlAnomalySearch } = ml.mlSystemProvider(request);
   const params = {
     jobIds: [jobId],
     threshold: anomalyThreshold,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
index a7213c30eb3fb2..b8311182f3ca8c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
@@ -17,7 +17,7 @@ import {
   getExceptions,
   sortExceptionItems,
 } from './utils';
-import { parseScheduleDates } from '../../../../common/detection_engine/utils';
+import { parseScheduleDates } from '../../../../common/detection_engine/parse_schedule_dates';
 import { RuleExecutorOptions } from './types';
 import { searchAfterAndBulkCreate } from './search_after_bulk_create';
 import { scheduleNotificationActions } from '../notifications/schedule_notification_actions';
@@ -38,6 +38,7 @@ jest.mock('../notifications/schedule_notification_actions');
 jest.mock('./find_ml_signals');
 jest.mock('./bulk_create_ml_signals');
 jest.mock('./../../../../common/detection_engine/utils');
+jest.mock('../../../../common/detection_engine/parse_schedule_dates');
 
 const getPayload = (ruleAlert: RuleAlertType, services: AlertServicesMock) => ({
   alertId: ruleAlert.id,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index c5124edcaf187a..da17d4a1f123a7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -14,7 +14,7 @@ import {
   SERVER_APP_ID,
 } from '../../../../common/constants';
 import { isJobStarted, isMlRule } from '../../../../common/machine_learning/helpers';
-import { parseScheduleDates } from '../../../../common/detection_engine/utils';
+import { parseScheduleDates } from '../../../../common/detection_engine/parse_schedule_dates';
 import { SetupPlugins } from '../../../plugin';
 import { getInputIndex } from './get_input_output_index';
 import {
@@ -185,12 +185,12 @@ export const signalRulesAlertType = ({
             );
           }
 
-          const scopedClusterClient = services.getLegacyScopedClusterClient(ml.mlClient);
           // Using fake KibanaRequest as it is needed to satisfy the ML Services API, but can be empty as it is
           // currently unused by the jobsSummary function.
-          const summaryJobs = await (
-            await ml.jobServiceProvider(scopedClusterClient, ({} as unknown) as KibanaRequest)
-          ).jobsSummary([machineLearningJobId]);
+          const fakeRequest = {} as KibanaRequest;
+          const summaryJobs = await ml
+            .jobServiceProvider(fakeRequest)
+            .jobsSummary([machineLearningJobId]);
           const jobSummary = summaryJobs.find((job) => job.id === machineLearningJobId);
 
           if (jobSummary == null || !isJobStarted(jobSummary.jobState, jobSummary.datafeedState)) {
@@ -207,7 +207,6 @@ export const signalRulesAlertType = ({
 
           const anomalyResults = await findMlSignals({
             ml,
-            clusterClient: scopedClusterClient,
             // Using fake KibanaRequest as it is needed to satisfy the ML Services API, but can be empty as it is
             // currently unused by the mlAnomalySearch function.
             request: ({} as unknown) as KibanaRequest,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.test.ts
index a2e2fec3309c31..d053a8e1089ad3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.test.ts
@@ -13,7 +13,7 @@ import { buildRuleMessageFactory } from './rule_messages';
 import { ExceptionListClient } from '../../../../../lists/server';
 import { getListArrayMock } from '../../../../common/detection_engine/schemas/types/lists.mock';
 import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
-import { parseScheduleDates } from '../../../../common/detection_engine/utils';
+import { parseScheduleDates } from '../../../../common/detection_engine/parse_schedule_dates';
 
 import {
   generateId,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts
index 92cc9be69839f3..dc09c6d5386fce 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts
@@ -14,7 +14,8 @@ import { ExceptionListItemSchema } from '../../../../../lists/common/schemas';
 import { ListArrayOrUndefined } from '../../../../common/detection_engine/schemas/types/lists';
 import { BulkResponse, BulkResponseErrorAggregation, isValidUnit } from './types';
 import { BuildRuleMessage } from './rule_messages';
-import { hasLargeValueList, parseScheduleDates } from '../../../../common/detection_engine/utils';
+import { parseScheduleDates } from '../../../../common/detection_engine/parse_schedule_dates';
+import { hasLargeValueList } from '../../../../common/detection_engine/utils';
 import { MAX_EXCEPTION_LIST_SIZE } from '../../../../../lists/common/constants';
 
 interface SortExceptionsReturn {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/types.ts
index 4b4f5147c9a42c..cbe756064b72b2 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/types.ts
@@ -36,10 +36,10 @@ import {
   RuleNameOverrideOrUndefined,
   SeverityMappingOrUndefined,
   TimestampOverrideOrUndefined,
+  Type,
 } from '../../../common/detection_engine/schemas/common/schemas';
 import { LegacyCallAPIOptions } from '../../../../../../src/core/server';
 import { Filter } from '../../../../../../src/plugins/data/server';
-import { RuleType } from '../../../common/detection_engine/types';
 import { ListArrayOrUndefined } from '../../../common/detection_engine/schemas/types';
 
 export type PartialFilter = Partial<Filter>;
@@ -75,7 +75,7 @@ export interface RuleTypeParams {
   threshold: ThresholdOrUndefined;
   timestampOverride: TimestampOverrideOrUndefined;
   to: To;
-  type: RuleType;
+  type: Type;
   references: References;
   version: Version;
   exceptionsList: ListArrayOrUndefined;
diff --git a/x-pack/plugins/security_solution/server/lib/ecs_fields/index.ts b/x-pack/plugins/security_solution/server/lib/ecs_fields/index.ts
index 19b16bd4bc6d24..d1c8290b3462d7 100644
--- a/x-pack/plugins/security_solution/server/lib/ecs_fields/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/ecs_fields/index.ts
@@ -324,6 +324,7 @@ export const signalFieldsMap: Readonly<Record<string, string>> = {
   'signal.rule.note': 'signal.rule.note',
   'signal.rule.threshold': 'signal.rule.threshold',
   'signal.rule.exceptions_list': 'signal.rule.exceptions_list',
+  'signal.status': 'signal.status',
 };
 
 export const ruleFieldsMap: Readonly<Record<string, string>> = {
diff --git a/x-pack/plugins/security_solution/server/lib/machine_learning/authz.ts b/x-pack/plugins/security_solution/server/lib/machine_learning/authz.ts
index 98de9536b1baa3..ff565c05848f97 100644
--- a/x-pack/plugins/security_solution/server/lib/machine_learning/authz.ts
+++ b/x-pack/plugins/security_solution/server/lib/machine_learning/authz.ts
@@ -13,12 +13,12 @@ import { SetupPlugins } from '../../plugin';
 import { MINIMUM_ML_LICENSE } from '../../../common/constants';
 import { hasMlAdminPermissions } from '../../../common/machine_learning/has_ml_admin_permissions';
 import { isMlRule } from '../../../common/machine_learning/helpers';
-import { RuleType } from '../../../common/detection_engine/types';
 import { Validation } from './validation';
 import { cache } from './cache';
+import { Type } from '../../../common/detection_engine/schemas/common/schemas';
 
 export interface MlAuthz {
-  validateRuleType: (type: RuleType) => Promise<Validation>;
+  validateRuleType: (type: Type) => Promise<Validation>;
 }
 
 /**
@@ -40,7 +40,7 @@ export const buildMlAuthz = ({
   request: KibanaRequest;
 }): MlAuthz => {
   const cachedValidate = cache(() => validateMlAuthz({ license, ml, request }));
-  const validateRuleType = async (type: RuleType): Promise<Validation> => {
+  const validateRuleType = async (type: Type): Promise<Validation> => {
     if (!isMlRule(type)) {
       return { valid: true, message: undefined };
     } else {
@@ -114,7 +114,6 @@ export const isMlAdmin = async ({
   request: KibanaRequest;
   ml: MlPluginSetup;
 }): Promise<boolean> => {
-  const scopedMlClient = ml.mlClient.asScoped(request);
-  const mlCapabilities = await ml.mlSystemProvider(scopedMlClient, request).mlCapabilities();
+  const mlCapabilities = await ml.mlSystemProvider(request).mlCapabilities();
   return hasMlAdminPermissions(mlCapabilities);
 };
diff --git a/x-pack/plugins/security_solution/server/lib/machine_learning/index.ts b/x-pack/plugins/security_solution/server/lib/machine_learning/index.ts
index ad2f1e5a8285c4..c17d9ab1bb46ee 100644
--- a/x-pack/plugins/security_solution/server/lib/machine_learning/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/machine_learning/index.ts
@@ -4,13 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { SearchResponse, SearchParams } from 'elasticsearch';
+import { SearchResponse } from 'elasticsearch';
+import { RequestParams } from '@elastic/elasticsearch';
 
 import { AnomalyRecordDoc as Anomaly } from '../../../../ml/server';
 
 export { Anomaly };
 export type AnomalyResults = SearchResponse<Anomaly>;
-type MlAnomalySearch = <T>(searchParams: SearchParams) => Promise<SearchResponse<T>>;
+type MlAnomalySearch = <T>(searchParams: RequestParams.Search) => Promise<SearchResponse<T>>;
 
 export interface AnomaliesSearchParams {
   jobIds: string[];
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/create_timelines_stream_from_ndjson.ts b/x-pack/plugins/security_solution/server/lib/timeline/create_timelines_stream_from_ndjson.ts
index 6b4017b5e4d5c7..2827cd373d5e75 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/create_timelines_stream_from_ndjson.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/create_timelines_stream_from_ndjson.ts
@@ -13,7 +13,7 @@ import {
   createConcatStream,
   createSplitStream,
   createMapStream,
-} from '../../../../../../src/legacy/utils';
+} from '../../../../../../src/core/server/utils';
 import {
   parseNdjsonStrings,
   filterExportedCounts,
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/import_timelines.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/import_timelines.ts
index 245146dda183fe..90d5b538a52000 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/import_timelines.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/import_timelines.ts
@@ -5,7 +5,7 @@
  */
 
 import { omit } from 'lodash/fp';
-import { TimelineType, TimelineStatus } from '../../../../../common/types/timeline';
+import { TimelineId, TimelineType, TimelineStatus } from '../../../../../common/types/timeline';
 
 export const mockDuplicateIdErrors = [];
 
@@ -332,8 +332,7 @@ export const mockCheckTimelinesStatusBeforeInstallResult = {
             value: '3c322ed995865f642c1a269d54cbd177bd4b0e6efcf15a589f4f8582efbe7509',
             operator: ':',
           },
-          id:
-            'send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-signal-id-3c322ed995865f642c1a269d54cbd177bd4b0e6efcf15a589f4f8582efbe7509',
+          id: `send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${TimelineId.active}-signal-id-3c322ed995865f642c1a269d54cbd177bd4b0e6efcf15a589f4f8582efbe7509`,
           enabled: true,
         },
       ],
@@ -496,8 +495,7 @@ export const mockCheckTimelinesStatusBeforeInstallResult = {
             value: '30d47c8a1b179ae435058e5b23b96118125a451fe58efd77be288f00456ff77d',
             operator: ':',
           },
-          id:
-            'send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-signal-id-30d47c8a1b179ae435058e5b23b96118125a451fe58efd77be288f00456ff77d',
+          id: `send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${TimelineId.active}-signal-id-30d47c8a1b179ae435058e5b23b96118125a451fe58efd77be288f00456ff77d`,
           enabled: true,
         },
       ],
@@ -675,8 +673,7 @@ export const mockCheckTimelinesStatusBeforeInstallResult = {
             value: '590eb946a7fdbacaa587ed0f6b1a16f5ad3d659ec47ef35ad0826c47af133bde',
             operator: ':',
           },
-          id:
-            'send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-signal-id-590eb946a7fdbacaa587ed0f6b1a16f5ad3d659ec47ef35ad0826c47af133bde',
+          id: `send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${TimelineId.active}-signal-id-590eb946a7fdbacaa587ed0f6b1a16f5ad3d659ec47ef35ad0826c47af133bde`,
           enabled: true,
         },
       ],
@@ -848,8 +845,7 @@ export const mockCheckTimelinesStatusAfterInstallResult = {
             value: '30d47c8a1b179ae435058e5b23b96118125a451fe58efd77be288f00456ff77d',
             operator: ':',
           },
-          id:
-            'send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-signal-id-30d47c8a1b179ae435058e5b23b96118125a451fe58efd77be288f00456ff77d',
+          id: `send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${TimelineId.active}-signal-id-30d47c8a1b179ae435058e5b23b96118125a451fe58efd77be288f00456ff77d`,
           enabled: true,
         },
       ],
@@ -1031,8 +1027,7 @@ export const mockCheckTimelinesStatusAfterInstallResult = {
             value: '590eb946a7fdbacaa587ed0f6b1a16f5ad3d659ec47ef35ad0826c47af133bde',
             operator: ':',
           },
-          id:
-            'send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-signal-id-590eb946a7fdbacaa587ed0f6b1a16f5ad3d659ec47ef35ad0826c47af133bde',
+          id: `send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${TimelineId.active}-signal-id-590eb946a7fdbacaa587ed0f6b1a16f5ad3d659ec47ef35ad0826c47af133bde`,
           enabled: true,
         },
       ],
@@ -1152,8 +1147,7 @@ export const mockCheckTimelinesStatusAfterInstallResult = {
             value: '3c322ed995865f642c1a269d54cbd177bd4b0e6efcf15a589f4f8582efbe7509',
             operator: ':',
           },
-          id:
-            'send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-signal-id-3c322ed995865f642c1a269d54cbd177bd4b0e6efcf15a589f4f8582efbe7509',
+          id: `send-signal-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${TimelineId.active}-signal-id-3c322ed995865f642c1a269d54cbd177bd4b0e6efcf15a589f4f8582efbe7509`,
           enabled: true,
         },
       ],
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts
index c5d69398b7f0c7..026ec1fa847f99 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/__mocks__/request_responses.ts
@@ -3,8 +3,9 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
+import path, { join, resolve } from 'path';
 import * as rt from 'io-ts';
-import stream from 'stream';
 
 import {
   TIMELINE_DRAFT_URL,
@@ -20,8 +21,8 @@ import { requestMock } from '../../../detection_engine/routes/__mocks__';
 import { updateTimelineSchema } from '../schemas/update_timelines_schema';
 import { createTimelineSchema } from '../schemas/create_timelines_schema';
 import { GetTimelineByIdSchemaQuery } from '../schemas/get_timeline_by_id_schema';
+import { getReadables } from '../utils/common';
 
-const readable = new stream.Readable();
 export const getExportTimelinesRequest = () =>
   requestMock.create({
     method: 'get',
@@ -34,15 +35,20 @@ export const getExportTimelinesRequest = () =>
     },
   });
 
-export const getImportTimelinesRequest = (filename?: string) =>
-  requestMock.create({
+export const getImportTimelinesRequest = async (fileName?: string) => {
+  const dir = resolve(join(__dirname, '../../../detection_engine/rules/prepackaged_timelines'));
+  const file = fileName ?? 'index.ndjson';
+  const dataPath = path.join(dir, file);
+  const readable = await getReadables(dataPath);
+  return requestMock.create({
     method: 'post',
     path: TIMELINE_IMPORT_URL,
     query: { overwrite: false },
     body: {
-      file: { ...readable, hapi: { filename: filename ?? 'filename.ndjson' } },
+      file: { ...readable, hapi: { filename: file } },
     },
   });
+};
 
 export const inputTimeline: SavedTimeline = {
   columns: [
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/clean_draft_timelines_route.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/clean_draft_timelines_route.ts
index 8cabd84a965b75..67fc3167a4a29f 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/clean_draft_timelines_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/clean_draft_timelines_route.ts
@@ -11,7 +11,7 @@ import { transformError, buildSiemResponse } from '../../detection_engine/routes
 import { TIMELINE_DRAFT_URL } from '../../../../common/constants';
 import { buildFrameworkRequest } from './utils/common';
 import { SetupPlugins } from '../../../plugin';
-import { buildRouteValidation } from '../../../utils/build_validation/route_validation';
+import { buildRouteValidationWithExcess } from '../../../utils/build_validation/route_validation';
 import { getDraftTimeline, resetTimeline, getTimeline, persistTimeline } from '../saved_object';
 import { draftTimelineDefaults } from '../default_timeline';
 import { cleanDraftTimelineSchema } from './schemas/clean_draft_timelines_schema';
@@ -26,7 +26,7 @@ export const cleanDraftTimelinesRoute = (
     {
       path: TIMELINE_DRAFT_URL,
       validate: {
-        body: buildRouteValidation(cleanDraftTimelineSchema),
+        body: buildRouteValidationWithExcess(cleanDraftTimelineSchema),
       },
       options: {
         tags: ['access:securitySolution'],
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.ts
index 7abcb390d0221c..77cd49406baa16 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/create_timelines_route.ts
@@ -9,7 +9,7 @@ import { TIMELINE_URL } from '../../../../common/constants';
 
 import { ConfigType } from '../../..';
 import { SetupPlugins } from '../../../plugin';
-import { buildRouteValidation } from '../../../utils/build_validation/route_validation';
+import { buildRouteValidationWithExcess } from '../../../utils/build_validation/route_validation';
 
 import { transformError, buildSiemResponse } from '../../detection_engine/routes/utils';
 
@@ -31,7 +31,7 @@ export const createTimelinesRoute = (
     {
       path: TIMELINE_URL,
       validate: {
-        body: buildRouteValidation(createTimelineSchema),
+        body: buildRouteValidationWithExcess(createTimelineSchema),
       },
       options: {
         tags: ['access:securitySolution'],
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.test.ts
index 5a976ee7521af4..5d7cb1c8d3f6cf 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.test.ts
@@ -96,7 +96,7 @@ describe('export timelines', () => {
       const result = server.validate(request);
 
       expect(result.badRequest.mock.calls[0][0]).toEqual(
-        'Invalid value "undefined" supplied to "file_name"'
+        'Invalid value {"id":"someId"}, excess properties: ["id"]'
       );
     });
 
@@ -110,7 +110,7 @@ describe('export timelines', () => {
       const result = server.validate(request);
 
       expect(result.badRequest.mock.calls[0][0]).toEqual(
-        'Invalid value "someId" supplied to "ids",Invalid value "{"ids":"someId"}" supplied to "(Partial<{ ids: (Array<string> | null) }> | null)"'
+        'Invalid value "someId" supplied to "ids"'
       );
     });
   });
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.ts
index 89e38753ac9263..38ee51fb7aa0c8 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.ts
@@ -14,7 +14,7 @@ import {
   exportTimelinesQuerySchema,
   exportTimelinesRequestBodySchema,
 } from './schemas/export_timelines_schema';
-import { buildRouteValidation } from '../../../utils/build_validation/route_validation';
+import { buildRouteValidationWithExcess } from '../../../utils/build_validation/route_validation';
 import { buildFrameworkRequest } from './utils/common';
 import { SetupPlugins } from '../../../plugin';
 
@@ -27,8 +27,8 @@ export const exportTimelinesRoute = (
     {
       path: TIMELINE_EXPORT_URL,
       validate: {
-        query: buildRouteValidation(exportTimelinesQuerySchema),
-        body: buildRouteValidation(exportTimelinesRequestBodySchema),
+        query: buildRouteValidationWithExcess(exportTimelinesQuerySchema),
+        body: buildRouteValidationWithExcess(exportTimelinesRequestBodySchema),
       },
       options: {
         tags: ['access:securitySolution'],
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/get_draft_timelines_route.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/get_draft_timelines_route.ts
index 4db434ec816aa5..43129f0e15f0e6 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/get_draft_timelines_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/get_draft_timelines_route.ts
@@ -10,7 +10,7 @@ import { transformError, buildSiemResponse } from '../../detection_engine/routes
 import { TIMELINE_DRAFT_URL } from '../../../../common/constants';
 import { buildFrameworkRequest } from './utils/common';
 import { SetupPlugins } from '../../../plugin';
-import { buildRouteValidation } from '../../../utils/build_validation/route_validation';
+import { buildRouteValidationWithExcess } from '../../../utils/build_validation/route_validation';
 import { getDraftTimeline, persistTimeline } from '../saved_object';
 import { draftTimelineDefaults } from '../default_timeline';
 import { getDraftTimelineSchema } from './schemas/get_draft_timelines_schema';
@@ -24,7 +24,7 @@ export const getDraftTimelinesRoute = (
     {
       path: TIMELINE_DRAFT_URL,
       validate: {
-        query: buildRouteValidation(getDraftTimelineSchema),
+        query: buildRouteValidationWithExcess(getDraftTimelineSchema),
       },
       options: {
         tags: ['access:securitySolution'],
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/get_timeline_route.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/get_timeline_route.ts
index f36adb648cc036..e46a644d6820e5 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/get_timeline_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/get_timeline_route.ts
@@ -10,7 +10,7 @@ import { TIMELINE_URL } from '../../../../common/constants';
 
 import { ConfigType } from '../../..';
 import { SetupPlugins } from '../../../plugin';
-import { buildRouteValidation } from '../../../utils/build_validation/route_validation';
+import { buildRouteValidationWithExcess } from '../../../utils/build_validation/route_validation';
 
 import { buildSiemResponse, transformError } from '../../detection_engine/routes/utils';
 
@@ -28,7 +28,7 @@ export const getTimelineRoute = (
   router.get(
     {
       path: `${TIMELINE_URL}`,
-      validate: { query: buildRouteValidation(getTimelineByIdSchemaQuery) },
+      validate: { query: buildRouteValidationWithExcess(getTimelineByIdSchemaQuery) },
       options: {
         tags: ['access:securitySolution'],
       },
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.test.ts
index ff76045db90cb8..13cc71840ec962 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.test.ts
@@ -79,7 +79,7 @@ describe('import timelines', () => {
       };
     });
 
-    jest.doMock('../../../../../../../src/legacy/utils', () => {
+    jest.doMock('../../../../../../../src/core/server/utils', () => {
       return {
         createPromiseFromStreams: jest.fn().mockReturnValue(mockParsedObjects),
       };
@@ -155,31 +155,31 @@ describe('import timelines', () => {
     });
 
     test('should use given timelineId to check if the timeline savedObject already exist', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockGetTimeline.mock.calls[0][1]).toEqual(mockUniqueParsedObjects[0].savedObjectId);
     });
 
     test('should Create a new timeline savedObject', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline).toHaveBeenCalled();
     });
 
     test('should Create a new timeline savedObject without timelineId', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline.mock.calls[0][1]).toBeNull();
     });
 
     test('should Create a new timeline savedObject without timeline version', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline.mock.calls[0][2]).toBeNull();
     });
 
     test('should Create a new timeline savedObject with given timeline', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline.mock.calls[0][3]).toEqual({
         ...mockParsedTimelineObject,
@@ -199,7 +199,7 @@ describe('import timelines', () => {
           },
         ],
       ]);
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       const response = await server.inject(mockRequest, context);
       expect(response.body).toEqual({
         success: false,
@@ -219,19 +219,19 @@ describe('import timelines', () => {
     });
 
     test('should Create new pinned events', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistPinnedEventOnTimeline).toHaveBeenCalled();
     });
 
     test('should Create a new pinned event without pinnedEventSavedObjectId', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistPinnedEventOnTimeline.mock.calls[0][1]).toBeNull();
     });
 
     test('should Create a new pinned event with pinnedEventId', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistPinnedEventOnTimeline.mock.calls[0][2]).toEqual(
         mockUniqueParsedObjects[0].pinnedEventIds[0]
@@ -239,7 +239,7 @@ describe('import timelines', () => {
     });
 
     test('should Create a new pinned event with new timelineSavedObjectId', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistPinnedEventOnTimeline.mock.calls[0][3]).toEqual(
         mockCreatedTimeline.savedObjectId
@@ -247,7 +247,7 @@ describe('import timelines', () => {
     });
 
     test('should Check if note exists', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockGetNote.mock.calls[0][1]).toEqual(
         mockUniqueParsedObjects[0].globalNotes[0].noteId
@@ -255,31 +255,31 @@ describe('import timelines', () => {
     });
 
     test('should Create notes', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote).toHaveBeenCalled();
     });
 
     test('should provide no noteSavedObjectId when Creating notes for a timeline', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote.mock.calls[0][1]).toBeNull();
     });
 
     test('should provide new timeline version when Creating notes for a timeline', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote.mock.calls[0][1]).toBeNull();
     });
 
     test('should provide note content when Creating notes for a timeline', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote.mock.calls[0][2]).toEqual(mockCreatedTimeline.version);
     });
 
     test('should provide new notes with original author info when Creating notes for a timeline', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote.mock.calls[0][3]).toEqual({
         eventId: undefined,
@@ -314,7 +314,7 @@ describe('import timelines', () => {
       mockGetNote.mockReset();
       mockGetNote.mockRejectedValue(new Error());
 
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote.mock.calls[0][3]).toEqual({
         created: mockUniqueParsedObjects[0].globalNotes[0].created,
@@ -346,7 +346,8 @@ describe('import timelines', () => {
     });
 
     test('returns 200 when import timeline successfully', async () => {
-      const response = await server.inject(getImportTimelinesRequest(), context);
+      const mockRequest = await getImportTimelinesRequest();
+      const response = await server.inject(mockRequest, context);
       expect(response.status).toEqual(200);
     });
   });
@@ -379,7 +380,8 @@ describe('import timelines', () => {
     });
 
     test('returns error message', async () => {
-      const response = await server.inject(getImportTimelinesRequest(), context);
+      const mockRequest = await getImportTimelinesRequest();
+      const response = await server.inject(mockRequest, context);
       expect(response.body).toEqual({
         success: false,
         success_count: 0,
@@ -407,7 +409,7 @@ describe('import timelines', () => {
           },
         ],
       ]);
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       const response = await server.inject(mockRequest, context);
       expect(response.body).toEqual({
         success: false,
@@ -436,7 +438,7 @@ describe('import timelines', () => {
           },
         ],
       ]);
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       const response = await server.inject(mockRequest, context);
       expect(response.body).toEqual({
         success: false,
@@ -494,7 +496,7 @@ describe('import timelines', () => {
       const result = server.validate(request);
 
       expect(result.badRequest).toHaveBeenCalledWith(
-        'Invalid value "undefined" supplied to "file"'
+        'Invalid value {"id":"someId"}, excess properties: ["id"]'
       );
     });
   });
@@ -543,7 +545,7 @@ describe('import timeline templates', () => {
       };
     });
 
-    jest.doMock('../../../../../../../src/legacy/utils', () => {
+    jest.doMock('../../../../../../../src/core/server/utils', () => {
       return {
         createPromiseFromStreams: jest.fn().mockReturnValue(mockParsedTemplateTimelineObjects),
       };
@@ -592,7 +594,7 @@ describe('import timeline templates', () => {
     });
 
     test('should use given timelineId to check if the timeline savedObject already exist', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockGetTimeline.mock.calls[0][1]).toEqual(
         mockUniqueParsedTemplateTimelineObjects[0].savedObjectId
@@ -600,7 +602,7 @@ describe('import timeline templates', () => {
     });
 
     test('should use given templateTimelineId to check if the timeline savedObject already exist', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockGetTemplateTimeline.mock.calls[0][1]).toEqual(
         mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId
@@ -608,25 +610,25 @@ describe('import timeline templates', () => {
     });
 
     test('should Create a new timeline savedObject', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline).toHaveBeenCalled();
     });
 
     test('should Create a new timeline savedObject without timelineId', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline.mock.calls[0][1]).toBeNull();
     });
 
     test('should Create a new timeline savedObject without timeline version', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline.mock.calls[0][2]).toBeNull();
     });
 
     test('should Create a new timeline savedObject witn given timeline and skip the omitted fields', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline.mock.calls[0][3]).toEqual({
         ...mockParsedTemplateTimelineObject,
@@ -635,25 +637,25 @@ describe('import timeline templates', () => {
     });
 
     test('should NOT Create new pinned events', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistPinnedEventOnTimeline).not.toHaveBeenCalled();
     });
 
     test('should provide no noteSavedObjectId when Creating notes for a timeline', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote.mock.calls[0][1]).toBeNull();
     });
 
     test('should provide new timeline version when Creating notes for a timeline', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote.mock.calls[0][2]).toEqual(mockCreatedTemplateTimeline.version);
     });
 
     test('should exclude event notes when creating notes', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote.mock.calls[0][3]).toEqual({
         eventId: undefined,
@@ -667,7 +669,8 @@ describe('import timeline templates', () => {
     });
 
     test('returns 200 when import timeline successfully', async () => {
-      const response = await server.inject(getImportTimelinesRequest(), context);
+      const mockRequest = await getImportTimelinesRequest();
+      const response = await server.inject(mockRequest, context);
       expect(response.status).toEqual(200);
     });
 
@@ -681,7 +684,7 @@ describe('import timeline templates', () => {
           },
         ],
       ]);
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline.mock.calls[0][3].templateTimelineId).toEqual(
         mockNewTemplateTimelineId
@@ -699,7 +702,7 @@ describe('import timeline templates', () => {
           },
         ],
       ]);
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       const result = await server.inject(mockRequest, context);
       expect(result.body).toEqual({
         errors: [],
@@ -743,7 +746,7 @@ describe('import timeline templates', () => {
     });
 
     test('should use given timelineId to check if the timeline savedObject already exist', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockGetTimeline.mock.calls[0][1]).toEqual(
         mockUniqueParsedTemplateTimelineObjects[0].savedObjectId
@@ -751,7 +754,7 @@ describe('import timeline templates', () => {
     });
 
     test('should use given templateTimelineId to check if the timeline savedObject already exist', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockGetTemplateTimeline.mock.calls[0][1]).toEqual(
         mockUniqueParsedTemplateTimelineObjects[0].templateTimelineId
@@ -759,13 +762,13 @@ describe('import timeline templates', () => {
     });
 
     test('should UPDATE timeline savedObject', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline).toHaveBeenCalled();
     });
 
     test('should UPDATE timeline savedObject with timelineId', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline.mock.calls[0][1]).toEqual(
         mockUniqueParsedTemplateTimelineObjects[0].savedObjectId
@@ -773,7 +776,7 @@ describe('import timeline templates', () => {
     });
 
     test('should UPDATE timeline savedObject without timeline version', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline.mock.calls[0][2]).toEqual(
         mockUniqueParsedTemplateTimelineObjects[0].version
@@ -781,31 +784,31 @@ describe('import timeline templates', () => {
     });
 
     test('should UPDATE a new timeline savedObject witn given timeline and skip the omitted fields', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistTimeline.mock.calls[0][3]).toEqual(mockParsedTemplateTimelineObject);
     });
 
     test('should NOT Create new pinned events', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistPinnedEventOnTimeline).not.toHaveBeenCalled();
     });
 
     test('should provide noteSavedObjectId when Creating notes for a timeline', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote.mock.calls[0][1]).toBeNull();
     });
 
     test('should provide new timeline version when Creating notes for a timeline', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote.mock.calls[0][2]).toEqual(mockCreatedTemplateTimeline.version);
     });
 
     test('should exclude event notes when creating notes', async () => {
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       await server.inject(mockRequest, context);
       expect(mockPersistNote.mock.calls[0][3]).toEqual({
         eventId: undefined,
@@ -819,7 +822,8 @@ describe('import timeline templates', () => {
     });
 
     test('returns 200 when import timeline successfully', async () => {
-      const response = await server.inject(getImportTimelinesRequest(), context);
+      const mockRequest = await getImportTimelinesRequest();
+      const response = await server.inject(mockRequest, context);
       expect(response.status).toEqual(200);
     });
 
@@ -833,7 +837,7 @@ describe('import timeline templates', () => {
           },
         ],
       ]);
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       const response = await server.inject(mockRequest, context);
       expect(response.body).toEqual({
         success: false,
@@ -862,7 +866,7 @@ describe('import timeline templates', () => {
           },
         ],
       ]);
-      const mockRequest = getImportTimelinesRequest();
+      const mockRequest = await getImportTimelinesRequest();
       const response = await server.inject(mockRequest, context);
       expect(response.body).toEqual({
         success: false,
@@ -920,7 +924,7 @@ describe('import timeline templates', () => {
       const result = server.validate(request);
 
       expect(result.badRequest).toHaveBeenCalledWith(
-        'Invalid value "undefined" supplied to "file"'
+        'Invalid value {"id":"someId"}, excess properties: ["id"]'
       );
     });
   });
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.ts
index c93983e499fb54..811d4531b86a71 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/import_timelines_route.ts
@@ -5,6 +5,7 @@
  */
 
 import { extname } from 'path';
+import { Readable } from 'stream';
 
 import { IRouter } from '../../../../../../../src/core/server';
 
@@ -12,7 +13,7 @@ import { TIMELINE_IMPORT_URL } from '../../../../common/constants';
 
 import { SetupPlugins } from '../../../plugin';
 import { ConfigType } from '../../../config';
-import { buildRouteValidation } from '../../../utils/build_validation/route_validation';
+import { buildRouteValidationWithExcess } from '../../../utils/build_validation/route_validation';
 import { buildSiemResponse, transformError } from '../../detection_engine/routes/utils';
 
 import { importTimelines } from './utils/import_timelines';
@@ -28,7 +29,7 @@ export const importTimelinesRoute = (
     {
       path: `${TIMELINE_IMPORT_URL}`,
       validate: {
-        body: buildRouteValidation(ImportTimelinesPayloadSchemaRt),
+        body: buildRouteValidationWithExcess(ImportTimelinesPayloadSchemaRt),
       },
       options: {
         tags: ['access:securitySolution'],
@@ -60,7 +61,7 @@ export const importTimelinesRoute = (
         const frameworkRequest = await buildFrameworkRequest(context, security, request);
 
         const res = await importTimelines(
-          file,
+          (file as unknown) as Readable,
           config.maxTimelineImportExportSize,
           frameworkRequest,
           isImmutable === 'true'
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/create_timelines_schema.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/create_timelines_schema.ts
index 241d266a14c78f..8d542201f61086 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/create_timelines_schema.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/create_timelines_schema.ts
@@ -5,7 +5,11 @@
  */
 import * as rt from 'io-ts';
 
-import { SavedTimelineRuntimeType } from '../../../../../common/types/timeline';
+import {
+  SavedTimelineRuntimeType,
+  TimelineStatusLiteralRt,
+  TimelineTypeLiteralRt,
+} from '../../../../../common/types/timeline';
 import { unionWithNullType } from '../../../../../common/utility_types';
 
 export const createTimelineSchema = rt.intersection([
@@ -13,7 +17,11 @@ export const createTimelineSchema = rt.intersection([
     timeline: SavedTimelineRuntimeType,
   }),
   rt.partial({
+    status: unionWithNullType(TimelineStatusLiteralRt),
     timelineId: unionWithNullType(rt.string),
+    templateTimelineId: unionWithNullType(rt.string),
+    templateTimelineVersion: unionWithNullType(rt.number),
+    timelineType: unionWithNullType(TimelineTypeLiteralRt),
     version: unionWithNullType(rt.string),
   }),
 ]);
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/export_timelines_schema.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/export_timelines_schema.ts
index ce8eb93bdbdbd4..4599d2bb571a2e 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/export_timelines_schema.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/export_timelines_schema.ts
@@ -11,8 +11,6 @@ export const exportTimelinesQuerySchema = rt.type({
   file_name: rt.string,
 });
 
-export const exportTimelinesRequestBodySchema = unionWithNullType(
-  rt.partial({
-    ids: unionWithNullType(rt.array(rt.string)),
-  })
-);
+export const exportTimelinesRequestBodySchema = rt.partial({
+  ids: unionWithNullType(rt.array(rt.string)),
+});
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/get_timeline_by_id_schema.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/get_timeline_by_id_schema.ts
index 65c956ed604400..2c6098bc75500f 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/get_timeline_by_id_schema.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/get_timeline_by_id_schema.ts
@@ -4,13 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import * as rt from 'io-ts';
-import { unionWithNullType } from '../../../../../common/utility_types';
 
-export const getTimelineByIdSchemaQuery = unionWithNullType(
-  rt.partial({
-    template_timeline_id: rt.string,
-    id: rt.string,
-  })
-);
+export const getTimelineByIdSchemaQuery = rt.partial({
+  template_timeline_id: rt.string,
+  id: rt.string,
+});
 
 export type GetTimelineByIdSchemaQuery = rt.TypeOf<typeof getTimelineByIdSchemaQuery>;
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/import_timelines_schema.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/import_timelines_schema.ts
index afce9d6cdcb24e..89f3f9ddec1fc1 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/import_timelines_schema.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/schemas/import_timelines_schema.ts
@@ -5,9 +5,6 @@
  */
 import * as rt from 'io-ts';
 
-import { Readable } from 'stream';
-import { either } from 'fp-ts/lib/Either';
-
 import { SavedTimelineRuntimeType } from '../../../../../common/types/timeline';
 
 import { eventNotes, globalNotes, pinnedEventIds } from './schemas';
@@ -28,16 +25,17 @@ export const ImportTimelinesSchemaRt = rt.intersection([
 
 export type ImportTimelinesSchema = rt.TypeOf<typeof ImportTimelinesSchemaRt>;
 
-const ReadableRt = new rt.Type<Readable, Readable, unknown>(
-  'ReadableRt',
-  (u): u is Readable => u instanceof Readable,
-  (u, c) =>
-    either.chain(rt.object.validate(u, c), (s) => {
-      const d = s as Readable;
-      return d.readable ? rt.success(d) : rt.failure(u, c);
-    }),
-  (a) => a
-);
+const ReadableRt = rt.partial({
+  _maxListeners: rt.unknown,
+  _readableState: rt.unknown,
+  _read: rt.unknown,
+  readable: rt.boolean,
+  _events: rt.unknown,
+  _eventsCount: rt.number,
+  _data: rt.unknown,
+  _position: rt.number,
+  _encoding: rt.string,
+});
 
 const booleanInString = rt.union([rt.literal('true'), rt.literal('false')]);
 
@@ -46,9 +44,14 @@ export const ImportTimelinesPayloadSchemaRt = rt.intersection([
     file: rt.intersection([
       ReadableRt,
       rt.type({
-        hapi: rt.type({ filename: rt.string }),
+        hapi: rt.type({
+          filename: rt.string,
+          headers: rt.unknown,
+        }),
       }),
     ]),
   }),
   rt.partial({ isImmutable: booleanInString }),
 ]);
+
+export type ImportTimelinesPayloadSchema = rt.TypeOf<typeof ImportTimelinesPayloadSchemaRt>;
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.ts
index 07ce9a7336d4d7..6b8ceea80c31a1 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/update_timelines_route.ts
@@ -9,7 +9,7 @@ import { IRouter } from '../../../../../../../src/core/server';
 import { TIMELINE_URL } from '../../../../common/constants';
 
 import { SetupPlugins } from '../../../plugin';
-import { buildRouteValidation } from '../../../utils/build_validation/route_validation';
+import { buildRouteValidationWithExcess } from '../../../utils/build_validation/route_validation';
 import { ConfigType } from '../../..';
 
 import { transformError, buildSiemResponse } from '../../detection_engine/routes/utils';
@@ -28,7 +28,7 @@ export const updateTimelinesRoute = (
     {
       path: TIMELINE_URL,
       validate: {
-        body: buildRouteValidation(updateTimelineSchema),
+        body: buildRouteValidationWithExcess(updateTimelineSchema),
       },
       options: {
         tags: ['access:securitySolution'],
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/common.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/common.ts
index fc25f1a48194e2..9a3dbf365e0266 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/common.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/common.ts
@@ -10,7 +10,7 @@ import { Readable } from 'stream';
 
 import { KibanaRequest, RequestHandlerContext } from 'src/core/server';
 
-import { createListStream } from '../../../../../../../../src/legacy/utils';
+import { createListStream } from '../../../../../../../../src/core/server/utils';
 
 import { SetupPlugins } from '../../../../plugin';
 
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/import_timelines.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/import_timelines.ts
index f62f02cc7bba94..a19b18e7d89b1a 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/import_timelines.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/import_timelines.ts
@@ -21,7 +21,7 @@ import { createBulkErrorObject, BulkError } from '../../../detection_engine/rout
 import { createTimelines } from './create_timelines';
 import { FrameworkRequest } from '../../../framework';
 import { createTimelinesStreamFromNdJson } from '../../create_timelines_stream_from_ndjson';
-import { createPromiseFromStreams } from '../../../../../../../../src/legacy/utils';
+import { createPromiseFromStreams } from '../../../../../../../../src/core/server/utils';
 
 import { getTupleDuplicateErrorsAndUniqueTimeline } from './get_timelines_from_stream';
 import { CompareTimelinesStatus } from './compare_timelines_status';
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/install_prepacked_timelines.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/install_prepacked_timelines.test.ts
index 66f16db01a508b..c63978a1f046e1 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/install_prepacked_timelines.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/utils/install_prepacked_timelines.test.ts
@@ -5,7 +5,7 @@
  */
 import { join, resolve } from 'path';
 
-import { createPromiseFromStreams } from '../../../../../../../../src/legacy/utils/streams';
+import { createPromiseFromStreams } from '../../../../../../../../src/core/server/utils';
 import { SecurityPluginSetup } from '../../../../../../security/server';
 
 import { FrameworkRequest } from '../../../framework';
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 38120bf42fbba2..24cf1f8746d89d 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -61,6 +61,7 @@ import { initUsageCollectors } from './usage';
 import { AppRequestContext } from './types';
 import { registerTrustedAppsRoutes } from './endpoint/routes/trusted_apps';
 import { securitySolutionSearchStrategyProvider } from './search_strategy/security_solution';
+import { securitySolutionTimelineSearchStrategyProvider } from './search_strategy/timeline';
 
 export interface SetupPlugins {
   alerts: AlertingSetup;
@@ -271,10 +272,17 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
 
     core.getStartServices().then(([_, depsStart]) => {
       const securitySolutionSearchStrategy = securitySolutionSearchStrategyProvider(depsStart.data);
+      const securitySolutionTimelineSearchStrategy = securitySolutionTimelineSearchStrategyProvider(
+        depsStart.data
+      );
       plugins.data.search.registerSearchStrategy(
         'securitySolutionSearchStrategy',
         securitySolutionSearchStrategy
       );
+      plugins.data.search.registerSearchStrategy(
+        'securitySolutionTimelineSearchStrategy',
+        securitySolutionTimelineSearchStrategy
+      );
     });
 
     return {};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/helpers/to_array.ts b/x-pack/plugins/security_solution/server/search_strategy/helpers/to_array.ts
new file mode 100644
index 00000000000000..4da319d5b1e429
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/helpers/to_array.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const toArray = <T = string>(value: T | T[] | null) =>
+  Array.isArray(value) ? value : value == null ? [] : [value];
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts
new file mode 100644
index 00000000000000..b9f04502286e55
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts
@@ -0,0 +1,777 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/data/common';
+
+import {
+  Direction,
+  HostAggEsItem,
+  HostsFields,
+  HostsQueries,
+  HostsRequestOptions,
+} from '../../../../../../../common/search_strategy';
+
+export const mockOptions: HostsRequestOptions = {
+  defaultIndex: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  docValueFields: [
+    { field: '@timestamp', format: 'date_time' },
+    { field: 'event.created', format: 'date_time' },
+    { field: 'event.end', format: 'date_time' },
+    { field: 'event.ingested', format: 'date_time' },
+    { field: 'event.start', format: 'date_time' },
+    { field: 'file.accessed', format: 'date_time' },
+    { field: 'file.created', format: 'date_time' },
+    { field: 'file.ctime', format: 'date_time' },
+    { field: 'file.mtime', format: 'date_time' },
+    { field: 'package.installed', format: 'date_time' },
+    { field: 'process.parent.start', format: 'date_time' },
+    { field: 'process.start', format: 'date_time' },
+    { field: 'system.audit.host.boottime', format: 'date_time' },
+    { field: 'system.audit.package.installtime', format: 'date_time' },
+    { field: 'system.audit.user.password.last_changed', format: 'date_time' },
+    { field: 'tls.client.not_after', format: 'date_time' },
+    { field: 'tls.client.not_before', format: 'date_time' },
+    { field: 'tls.server.not_after', format: 'date_time' },
+    { field: 'tls.server.not_before', format: 'date_time' },
+    { field: 'aws.cloudtrail.user_identity.session_context.creation_date', format: 'date_time' },
+    { field: 'azure.auditlogs.properties.activity_datetime', format: 'date_time' },
+    { field: 'azure.enqueued_time', format: 'date_time' },
+    { field: 'azure.signinlogs.properties.created_at', format: 'date_time' },
+    { field: 'cef.extensions.agentReceiptTime', format: 'date_time' },
+    { field: 'cef.extensions.deviceCustomDate1', format: 'date_time' },
+    { field: 'cef.extensions.deviceCustomDate2', format: 'date_time' },
+    { field: 'cef.extensions.deviceReceiptTime', format: 'date_time' },
+    { field: 'cef.extensions.endTime', format: 'date_time' },
+    { field: 'cef.extensions.fileCreateTime', format: 'date_time' },
+    { field: 'cef.extensions.fileModificationTime', format: 'date_time' },
+    { field: 'cef.extensions.flexDate1', format: 'date_time' },
+    { field: 'cef.extensions.managerReceiptTime', format: 'date_time' },
+    { field: 'cef.extensions.oldFileCreateTime', format: 'date_time' },
+    { field: 'cef.extensions.oldFileModificationTime', format: 'date_time' },
+    { field: 'cef.extensions.startTime', format: 'date_time' },
+    { field: 'checkpoint.subs_exp', format: 'date_time' },
+    { field: 'crowdstrike.event.EndTimestamp', format: 'date_time' },
+    { field: 'crowdstrike.event.IncidentEndTime', format: 'date_time' },
+    { field: 'crowdstrike.event.IncidentStartTime', format: 'date_time' },
+    { field: 'crowdstrike.event.ProcessEndTime', format: 'date_time' },
+    { field: 'crowdstrike.event.ProcessStartTime', format: 'date_time' },
+    { field: 'crowdstrike.event.StartTimestamp', format: 'date_time' },
+    { field: 'crowdstrike.event.Timestamp', format: 'date_time' },
+    { field: 'crowdstrike.event.UTCTimestamp', format: 'date_time' },
+    { field: 'crowdstrike.metadata.eventCreationTime', format: 'date_time' },
+    { field: 'gsuite.admin.email.log_search_filter.end_date', format: 'date_time' },
+    { field: 'gsuite.admin.email.log_search_filter.start_date', format: 'date_time' },
+    { field: 'gsuite.admin.user.birthdate', format: 'date_time' },
+    { field: 'kafka.block_timestamp', format: 'date_time' },
+    { field: 'microsoft.defender_atp.lastUpdateTime', format: 'date_time' },
+    { field: 'microsoft.defender_atp.resolvedTime', format: 'date_time' },
+    { field: 'misp.campaign.first_seen', format: 'date_time' },
+    { field: 'misp.campaign.last_seen', format: 'date_time' },
+    { field: 'misp.intrusion_set.first_seen', format: 'date_time' },
+    { field: 'misp.intrusion_set.last_seen', format: 'date_time' },
+    { field: 'misp.observed_data.first_observed', format: 'date_time' },
+    { field: 'misp.observed_data.last_observed', format: 'date_time' },
+    { field: 'misp.report.published', format: 'date_time' },
+    { field: 'misp.threat_indicator.valid_from', format: 'date_time' },
+    { field: 'misp.threat_indicator.valid_until', format: 'date_time' },
+    { field: 'netflow.collection_time_milliseconds', format: 'date_time' },
+    { field: 'netflow.exporter.timestamp', format: 'date_time' },
+    { field: 'netflow.flow_end_microseconds', format: 'date_time' },
+    { field: 'netflow.flow_end_milliseconds', format: 'date_time' },
+    { field: 'netflow.flow_end_nanoseconds', format: 'date_time' },
+    { field: 'netflow.flow_end_seconds', format: 'date_time' },
+    { field: 'netflow.flow_start_microseconds', format: 'date_time' },
+    { field: 'netflow.flow_start_milliseconds', format: 'date_time' },
+    { field: 'netflow.flow_start_nanoseconds', format: 'date_time' },
+    { field: 'netflow.flow_start_seconds', format: 'date_time' },
+    { field: 'netflow.max_export_seconds', format: 'date_time' },
+    { field: 'netflow.max_flow_end_microseconds', format: 'date_time' },
+    { field: 'netflow.max_flow_end_milliseconds', format: 'date_time' },
+    { field: 'netflow.max_flow_end_nanoseconds', format: 'date_time' },
+    { field: 'netflow.max_flow_end_seconds', format: 'date_time' },
+    { field: 'netflow.min_export_seconds', format: 'date_time' },
+    { field: 'netflow.min_flow_start_microseconds', format: 'date_time' },
+    { field: 'netflow.min_flow_start_milliseconds', format: 'date_time' },
+    { field: 'netflow.min_flow_start_nanoseconds', format: 'date_time' },
+    { field: 'netflow.min_flow_start_seconds', format: 'date_time' },
+    { field: 'netflow.monitoring_interval_end_milli_seconds', format: 'date_time' },
+    { field: 'netflow.monitoring_interval_start_milli_seconds', format: 'date_time' },
+    { field: 'netflow.observation_time_microseconds', format: 'date_time' },
+    { field: 'netflow.observation_time_milliseconds', format: 'date_time' },
+    { field: 'netflow.observation_time_nanoseconds', format: 'date_time' },
+    { field: 'netflow.observation_time_seconds', format: 'date_time' },
+    { field: 'netflow.system_init_time_milliseconds', format: 'date_time' },
+    { field: 'rsa.internal.lc_ctime', format: 'date_time' },
+    { field: 'rsa.internal.time', format: 'date_time' },
+    { field: 'rsa.time.effective_time', format: 'date_time' },
+    { field: 'rsa.time.endtime', format: 'date_time' },
+    { field: 'rsa.time.event_queue_time', format: 'date_time' },
+    { field: 'rsa.time.event_time', format: 'date_time' },
+    { field: 'rsa.time.expire_time', format: 'date_time' },
+    { field: 'rsa.time.recorded_time', format: 'date_time' },
+    { field: 'rsa.time.stamp', format: 'date_time' },
+    { field: 'rsa.time.starttime', format: 'date_time' },
+    { field: 'sophos.xg.date', format: 'date_time' },
+    { field: 'sophos.xg.eventtime', format: 'date_time' },
+    { field: 'sophos.xg.start_time', format: 'date_time' },
+  ],
+  factoryQueryType: HostsQueries.hosts,
+  filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+  pagination: { activePage: 0, cursorStart: 0, fakePossibleCount: 50, querySize: 10 },
+  timerange: { interval: '12h', from: '2020-09-03T09:15:21.415Z', to: '2020-09-04T09:15:21.415Z' },
+  sort: { direction: Direction.desc, field: HostsFields.lastSeen },
+};
+
+export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 169,
+    timed_out: false,
+    _shards: { total: 21, successful: 21, skipped: 0, failed: 0 },
+    hits: { total: -1, max_score: 0, hits: [] },
+    aggregations: {
+      host_data: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [
+          {
+            key: 'bastion00.siem.estc.dev',
+            doc_count: 774875,
+            lastSeen: { value: 1599210921410, value_as_string: '2020-09-04T09:15:21.410Z' },
+            os: {
+              hits: {
+                total: 774875,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: 'f6NmWHQBA6bGZw2uJepK',
+                    _score: null,
+                    _source: {},
+                    sort: [1599210921410],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'es02.siem.estc.dev',
+            doc_count: 10496,
+            lastSeen: { value: 1599210907990, value_as_string: '2020-09-04T09:15:07.990Z' },
+            os: {
+              hits: {
+                total: 10496,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: '4_lmWHQBc39KFIJbFdYv',
+                    _score: null,
+                    _source: {},
+                    sort: [1599210907990],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'es00.siem.estc.dev',
+            doc_count: 19722,
+            lastSeen: { value: 1599210906783, value_as_string: '2020-09-04T09:15:06.783Z' },
+            os: {
+              hits: {
+                total: 19722,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: 'z_lmWHQBc39KFIJbAdZP',
+                    _score: null,
+                    _source: {},
+                    sort: [1599210906783],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'es01.siem.estc.dev',
+            doc_count: 16770,
+            lastSeen: { value: 1599210900781, value_as_string: '2020-09-04T09:15:00.781Z' },
+            os: {
+              hits: {
+                total: 16770,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: 'uPllWHQBc39KFIJb6tbR',
+                    _score: null,
+                    _source: {},
+                    sort: [1599210900781],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'siem-windows',
+            doc_count: 1941,
+            lastSeen: { value: 1599210880354, value_as_string: '2020-09-04T09:14:40.354Z' },
+            os: {
+              hits: {
+                total: 1941,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'winlogbeat-8.0.0-2020.09.02-000001',
+                    _id: '56NlWHQBA6bGZw2uiOfb',
+                    _score: null,
+                    _source: {
+                      host: {
+                        os: {
+                          build: '17763.1397',
+                          kernel: '10.0.17763.1397 (WinBuild.160101.0800)',
+                          name: 'Windows Server 2019 Datacenter',
+                          family: 'windows',
+                          version: '10.0',
+                          platform: 'windows',
+                        },
+                      },
+                    },
+                    sort: [1599210880354],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'filebeat-cloud',
+            doc_count: 50,
+            lastSeen: { value: 1599207421000, value_as_string: '2020-09-04T08:17:01.000Z' },
+            os: {
+              hits: {
+                total: 50,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: 'FKMwWHQBA6bGZw2uw5Z3',
+                    _score: null,
+                    _source: {},
+                    sort: [1599207421000],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'kibana00.siem.estc.dev',
+            doc_count: 50,
+            lastSeen: { value: 1599207421000, value_as_string: '2020-09-04T08:17:01.000Z' },
+            os: {
+              hits: {
+                total: 50,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: 'MKMwWHQBA6bGZw2u0ZZw',
+                    _score: null,
+                    _source: {},
+                    sort: [1599207421000],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'DESKTOP-QBBSCUT',
+            doc_count: 128973,
+            lastSeen: { value: 1599150487957, value_as_string: '2020-09-03T16:28:07.957Z' },
+            os: {
+              hits: {
+                total: 128973,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: '.ds-logs-elastic.agent-default-000001',
+                    _id: 'tvTLVHQBc39KFIJb_ykQ',
+                    _score: null,
+                    _source: {
+                      host: {
+                        os: {
+                          build: '18362.1016',
+                          kernel: '10.0.18362.1016 (WinBuild.160101.0800)',
+                          name: 'Windows 10 Pro',
+                          family: 'windows',
+                          version: '10.0',
+                          platform: 'windows',
+                        },
+                      },
+                    },
+                    sort: [1599150487957],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'mainqa-atlcolo-10-0-7-195.eng.endgames.local',
+            doc_count: 21213,
+            lastSeen: { value: 1599150457515, value_as_string: '2020-09-03T16:27:37.515Z' },
+            os: {
+              hits: {
+                total: 21213,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: '.ds-logs-endpoint.events.network-default-000001',
+                    _id: 'efTLVHQBc39KFIJbiCgD',
+                    _score: null,
+                    _source: {
+                      host: {
+                        os: {
+                          Ext: { variant: 'macOS' },
+                          kernel:
+                            'Darwin Kernel Version 18.2.0: Fri Oct  5 19:40:55 PDT 2018; root:xnu-4903.221.2~1/RELEASE_X86_64',
+                          name: 'macOS',
+                          family: 'macos',
+                          version: '10.14.1',
+                          platform: 'macos',
+                          full: 'macOS 10.14.1',
+                        },
+                      },
+                    },
+                    sort: [1599150457515],
+                  },
+                ],
+              },
+            },
+          },
+        ],
+      },
+      host_count: { value: 9 },
+    },
+  },
+  total: 21,
+  loaded: 21,
+};
+
+export const formattedSearchStrategyResponse = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 169,
+    timed_out: false,
+    _shards: { total: 21, successful: 21, skipped: 0, failed: 0 },
+    hits: { total: -1, max_score: 0, hits: [] },
+    aggregations: {
+      host_data: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [
+          {
+            key: 'bastion00.siem.estc.dev',
+            doc_count: 774875,
+            lastSeen: { value: 1599210921410, value_as_string: '2020-09-04T09:15:21.410Z' },
+            os: {
+              hits: {
+                total: 774875,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: 'f6NmWHQBA6bGZw2uJepK',
+                    _score: null,
+                    _source: {},
+                    sort: [1599210921410],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'es02.siem.estc.dev',
+            doc_count: 10496,
+            lastSeen: { value: 1599210907990, value_as_string: '2020-09-04T09:15:07.990Z' },
+            os: {
+              hits: {
+                total: 10496,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: '4_lmWHQBc39KFIJbFdYv',
+                    _score: null,
+                    _source: {},
+                    sort: [1599210907990],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'es00.siem.estc.dev',
+            doc_count: 19722,
+            lastSeen: { value: 1599210906783, value_as_string: '2020-09-04T09:15:06.783Z' },
+            os: {
+              hits: {
+                total: 19722,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: 'z_lmWHQBc39KFIJbAdZP',
+                    _score: null,
+                    _source: {},
+                    sort: [1599210906783],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'es01.siem.estc.dev',
+            doc_count: 16770,
+            lastSeen: { value: 1599210900781, value_as_string: '2020-09-04T09:15:00.781Z' },
+            os: {
+              hits: {
+                total: 16770,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: 'uPllWHQBc39KFIJb6tbR',
+                    _score: null,
+                    _source: {},
+                    sort: [1599210900781],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'siem-windows',
+            doc_count: 1941,
+            lastSeen: { value: 1599210880354, value_as_string: '2020-09-04T09:14:40.354Z' },
+            os: {
+              hits: {
+                total: 1941,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'winlogbeat-8.0.0-2020.09.02-000001',
+                    _id: '56NlWHQBA6bGZw2uiOfb',
+                    _score: null,
+                    _source: {
+                      host: {
+                        os: {
+                          build: '17763.1397',
+                          kernel: '10.0.17763.1397 (WinBuild.160101.0800)',
+                          name: 'Windows Server 2019 Datacenter',
+                          family: 'windows',
+                          version: '10.0',
+                          platform: 'windows',
+                        },
+                      },
+                    },
+                    sort: [1599210880354],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'filebeat-cloud',
+            doc_count: 50,
+            lastSeen: { value: 1599207421000, value_as_string: '2020-09-04T08:17:01.000Z' },
+            os: {
+              hits: {
+                total: 50,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: 'FKMwWHQBA6bGZw2uw5Z3',
+                    _score: null,
+                    _source: {},
+                    sort: [1599207421000],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'kibana00.siem.estc.dev',
+            doc_count: 50,
+            lastSeen: { value: 1599207421000, value_as_string: '2020-09-04T08:17:01.000Z' },
+            os: {
+              hits: {
+                total: 50,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: 'filebeat-8.0.0-2020.09.02-000001',
+                    _id: 'MKMwWHQBA6bGZw2u0ZZw',
+                    _score: null,
+                    _source: {},
+                    sort: [1599207421000],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'DESKTOP-QBBSCUT',
+            doc_count: 128973,
+            lastSeen: { value: 1599150487957, value_as_string: '2020-09-03T16:28:07.957Z' },
+            os: {
+              hits: {
+                total: 128973,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: '.ds-logs-elastic.agent-default-000001',
+                    _id: 'tvTLVHQBc39KFIJb_ykQ',
+                    _score: null,
+                    _source: {
+                      host: {
+                        os: {
+                          build: '18362.1016',
+                          kernel: '10.0.18362.1016 (WinBuild.160101.0800)',
+                          name: 'Windows 10 Pro',
+                          family: 'windows',
+                          version: '10.0',
+                          platform: 'windows',
+                        },
+                      },
+                    },
+                    sort: [1599150487957],
+                  },
+                ],
+              },
+            },
+          },
+          {
+            key: 'mainqa-atlcolo-10-0-7-195.eng.endgames.local',
+            doc_count: 21213,
+            lastSeen: { value: 1599150457515, value_as_string: '2020-09-03T16:27:37.515Z' },
+            os: {
+              hits: {
+                total: 21213,
+                max_score: 0,
+                hits: [
+                  {
+                    _index: '.ds-logs-endpoint.events.network-default-000001',
+                    _id: 'efTLVHQBc39KFIJbiCgD',
+                    _score: null,
+                    _source: {
+                      host: {
+                        os: {
+                          Ext: { variant: 'macOS' },
+                          kernel:
+                            'Darwin Kernel Version 18.2.0: Fri Oct  5 19:40:55 PDT 2018; root:xnu-4903.221.2~1/RELEASE_X86_64',
+                          name: 'macOS',
+                          family: 'macos',
+                          version: '10.14.1',
+                          platform: 'macos',
+                          full: 'macOS 10.14.1',
+                        },
+                      },
+                    },
+                    sort: [1599150457515],
+                  },
+                ],
+              },
+            },
+          },
+        ],
+      },
+      host_count: { value: 9 },
+    },
+  },
+  total: 21,
+  loaded: 21,
+  inspect: {
+    dsl: [
+      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "host_count": {\n        "cardinality": {\n          "field": "host.name"\n        }\n      },\n      "host_data": {\n        "terms": {\n          "size": 10,\n          "field": "host.name",\n          "order": {\n            "lastSeen": "desc"\n          }\n        },\n        "aggs": {\n          "lastSeen": {\n            "max": {\n              "field": "@timestamp"\n            }\n          },\n          "os": {\n            "top_hits": {\n              "size": 1,\n              "sort": [\n                {\n                  "@timestamp": {\n                    "order": "desc"\n                  }\n                }\n              ],\n              "_source": {\n                "includes": [\n                  "host.os.*"\n                ]\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          {\n            "bool": {\n              "must": [],\n              "filter": [\n                {\n                  "match_all": {}\n                }\n              ],\n              "should": [],\n              "must_not": []\n            }\n          },\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-03T09:15:21.415Z",\n                "lte": "2020-09-04T09:15:21.415Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": false\n  }\n}',
+    ],
+  },
+  edges: [
+    {
+      node: {
+        _id: 'bastion00.siem.estc.dev',
+        lastSeen: ['2020-09-04T09:15:21.410Z'],
+        host: { name: ['bastion00.siem.estc.dev'] },
+      },
+      cursor: { value: 'bastion00.siem.estc.dev', tiebreaker: null },
+    },
+    {
+      node: {
+        _id: 'es02.siem.estc.dev',
+        lastSeen: ['2020-09-04T09:15:07.990Z'],
+        host: { name: ['es02.siem.estc.dev'] },
+      },
+      cursor: { value: 'es02.siem.estc.dev', tiebreaker: null },
+    },
+    {
+      node: {
+        _id: 'es00.siem.estc.dev',
+        lastSeen: ['2020-09-04T09:15:06.783Z'],
+        host: { name: ['es00.siem.estc.dev'] },
+      },
+      cursor: { value: 'es00.siem.estc.dev', tiebreaker: null },
+    },
+    {
+      node: {
+        _id: 'es01.siem.estc.dev',
+        lastSeen: ['2020-09-04T09:15:00.781Z'],
+        host: { name: ['es01.siem.estc.dev'] },
+      },
+      cursor: { value: 'es01.siem.estc.dev', tiebreaker: null },
+    },
+    {
+      node: {
+        _id: 'siem-windows',
+        lastSeen: ['2020-09-04T09:14:40.354Z'],
+        host: {
+          name: ['siem-windows'],
+          os: { name: ['Windows Server 2019 Datacenter'], version: ['10.0'] },
+        },
+      },
+      cursor: { value: 'siem-windows', tiebreaker: null },
+    },
+    {
+      node: {
+        _id: 'filebeat-cloud',
+        lastSeen: ['2020-09-04T08:17:01.000Z'],
+        host: { name: ['filebeat-cloud'] },
+      },
+      cursor: { value: 'filebeat-cloud', tiebreaker: null },
+    },
+    {
+      node: {
+        _id: 'kibana00.siem.estc.dev',
+        lastSeen: ['2020-09-04T08:17:01.000Z'],
+        host: { name: ['kibana00.siem.estc.dev'] },
+      },
+      cursor: { value: 'kibana00.siem.estc.dev', tiebreaker: null },
+    },
+    {
+      node: {
+        _id: 'DESKTOP-QBBSCUT',
+        lastSeen: ['2020-09-03T16:28:07.957Z'],
+        host: { name: ['DESKTOP-QBBSCUT'], os: { name: ['Windows 10 Pro'], version: ['10.0'] } },
+      },
+      cursor: { value: 'DESKTOP-QBBSCUT', tiebreaker: null },
+    },
+    {
+      node: {
+        _id: 'mainqa-atlcolo-10-0-7-195.eng.endgames.local',
+        lastSeen: ['2020-09-03T16:27:37.515Z'],
+        host: {
+          name: ['mainqa-atlcolo-10-0-7-195.eng.endgames.local'],
+          os: { name: ['macOS'], version: ['10.14.1'] },
+        },
+      },
+      cursor: { value: 'mainqa-atlcolo-10-0-7-195.eng.endgames.local', tiebreaker: null },
+    },
+  ],
+  totalCount: 9,
+  pageInfo: { activePage: 0, fakeTotalCount: 9, showMorePagesIndicator: false },
+};
+
+export const mockBuckets: HostAggEsItem = {
+  key: 'zeek-london',
+  os: {
+    hits: {
+      total: {
+        value: 242338,
+        relation: 'eq',
+      },
+      max_score: null,
+      hits: [
+        {
+          _index: 'auditbeat-8.0.0-2019.09.06-000022',
+          _id: 'dl0T_m0BHe9nqdOiF2A8',
+          _score: null,
+          _source: {
+            host: {
+              os: {
+                kernel: ['5.0.0-1013-gcp'],
+                name: ['Ubuntu'],
+                family: ['debian'],
+                version: ['18.04.2 LTS (Bionic Beaver)'],
+                platform: ['ubuntu'],
+              },
+            },
+          },
+          sort: [1571925726017],
+        },
+      ],
+    },
+  },
+};
+
+export const expectedDsl = {
+  allowNoIndices: true,
+  body: {
+    aggregations: {
+      host_count: { cardinality: { field: 'host.name' } },
+      host_data: {
+        aggs: {
+          lastSeen: { max: { field: '@timestamp' } },
+          os: {
+            top_hits: {
+              _source: { includes: ['host.os.*'] },
+              size: 1,
+              sort: [{ '@timestamp': { order: 'desc' } }],
+            },
+          },
+        },
+        terms: { field: 'host.name', order: { lastSeen: 'desc' }, size: 10 },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          { bool: { filter: [{ match_all: {} }], must: [], must_not: [], should: [] } },
+          {
+            range: {
+              '@timestamp': {
+                format: 'strict_date_optional_time',
+                gte: '2020-09-03T09:15:21.415Z',
+                lte: '2020-09-04T09:15:21.415Z',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+    track_total_hits: false,
+  },
+  ignoreUnavailable: true,
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.test.ts
new file mode 100644
index 00000000000000..78f214c69f14f3
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.test.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { HostsEdges } from '../../../../../../common/search_strategy/security_solution';
+
+import { formatHostEdgesData } from './helpers';
+import { mockBuckets } from './__mocks__';
+
+describe('#formatHostsData', () => {
+  test('it formats a host with a source of name correctly', () => {
+    const mockFields: readonly string[] = ['host.name'];
+    const data = formatHostEdgesData(mockFields, mockBuckets);
+    const expected: HostsEdges = {
+      cursor: { tiebreaker: null, value: 'zeek-london' },
+      node: { host: { name: ['zeek-london'] }, _id: 'zeek-london' },
+    };
+
+    expect(data).toEqual(expected);
+  });
+
+  test('it formats a host with a source of os correctly', () => {
+    const mockFields: readonly string[] = ['host.os.name'];
+    const data = formatHostEdgesData(mockFields, mockBuckets);
+    const expected: HostsEdges = {
+      cursor: { tiebreaker: null, value: 'zeek-london' },
+      node: { host: { os: { name: ['Ubuntu'] } }, _id: 'zeek-london' },
+    };
+
+    expect(data).toEqual(expected);
+  });
+
+  test('it formats a host with a source of version correctly', () => {
+    const mockFields: readonly string[] = ['host.os.version'];
+    const data = formatHostEdgesData(mockFields, mockBuckets);
+    const expected: HostsEdges = {
+      cursor: { tiebreaker: null, value: 'zeek-london' },
+      node: { host: { os: { version: ['18.04.2 LTS (Bionic Beaver)'] } }, _id: 'zeek-london' },
+    };
+
+    expect(data).toEqual(expected);
+  });
+
+  test('it formats a host with a source of id correctly', () => {
+    const mockFields: readonly string[] = ['host.name'];
+    const data = formatHostEdgesData(mockFields, mockBuckets);
+    const expected: HostsEdges = {
+      cursor: { tiebreaker: null, value: 'zeek-london' },
+      node: { _id: 'zeek-london', host: { name: ['zeek-london'] } },
+    };
+
+    expect(data).toEqual(expected);
+  });
+
+  test('it formats a host with a source of name, lastBeat, os, and version correctly', () => {
+    const mockFields: readonly string[] = ['host.name', 'host.os.name', 'host.os.version'];
+    const data = formatHostEdgesData(mockFields, mockBuckets);
+    const expected: HostsEdges = {
+      cursor: { tiebreaker: null, value: 'zeek-london' },
+      node: {
+        _id: 'zeek-london',
+        host: {
+          name: ['zeek-london'],
+          os: { name: ['Ubuntu'], version: ['18.04.2 LTS (Bionic Beaver)'] },
+        },
+      },
+    };
+
+    expect(data).toEqual(expected);
+  });
+
+  test('it formats a host without any data if mockFields are empty', () => {
+    const mockFields: readonly string[] = [];
+    const data = formatHostEdgesData(mockFields, mockBuckets);
+    const expected: HostsEdges = {
+      cursor: {
+        tiebreaker: null,
+        value: '',
+      },
+      node: {},
+    };
+
+    expect(data).toEqual(expected);
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.ts
new file mode 100644
index 00000000000000..b06c36fd24e1a8
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.ts
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { set } from '@elastic/safer-lodash-set/fp';
+import { get, has, head } from 'lodash/fp';
+import { hostFieldsMap } from '../../../../../../common/ecs/ecs_fields';
+import { HostsEdges } from '../../../../../../common/search_strategy/security_solution/hosts';
+
+import { HostAggEsItem, HostBuckets, HostValue } from '../../../../../lib/hosts/types';
+import { toArray } from '../../../../helpers/to_array';
+
+export const HOSTS_FIELDS: readonly string[] = [
+  '_id',
+  'lastSeen',
+  'host.id',
+  'host.name',
+  'host.os.name',
+  'host.os.version',
+];
+
+export const formatHostEdgesData = (
+  fields: readonly string[] = HOSTS_FIELDS,
+  bucket: HostAggEsItem
+): HostsEdges =>
+  fields.reduce<HostsEdges>(
+    (flattenedFields, fieldName) => {
+      const hostId = get('key', bucket);
+      flattenedFields.node._id = hostId || null;
+      flattenedFields.cursor.value = hostId || '';
+      const fieldValue = getHostFieldValue(fieldName, bucket);
+      if (fieldValue != null) {
+        return set(`node.${fieldName}`, toArray(fieldValue), flattenedFields);
+      }
+      return flattenedFields;
+    },
+    {
+      node: {},
+      cursor: {
+        value: '',
+        tiebreaker: null,
+      },
+    } as HostsEdges
+  );
+
+const getHostFieldValue = (fieldName: string, bucket: HostAggEsItem): string | string[] | null => {
+  const aggField = hostFieldsMap[fieldName]
+    ? hostFieldsMap[fieldName].replace(/\./g, '_')
+    : fieldName.replace(/\./g, '_');
+  if (
+    [
+      'host.ip',
+      'host.mac',
+      'cloud.instance.id',
+      'cloud.machine.type',
+      'cloud.provider',
+      'cloud.region',
+    ].includes(fieldName) &&
+    has(aggField, bucket)
+  ) {
+    const data: HostBuckets = get(aggField, bucket);
+    return data.buckets.map((obj) => obj.key);
+  } else if (has(`${aggField}.buckets`, bucket)) {
+    return getFirstItem(get(`${aggField}`, bucket));
+  } else if (has(aggField, bucket)) {
+    const valueObj: HostValue = get(aggField, bucket);
+    return valueObj.value_as_string;
+  } else if (['host.name', 'host.os.name', 'host.os.version'].includes(fieldName)) {
+    switch (fieldName) {
+      case 'host.name':
+        return get('key', bucket) || null;
+      case 'host.os.name':
+        return get('os.hits.hits[0]._source.host.os.name', bucket) || null;
+      case 'host.os.version':
+        return get('os.hits.hits[0]._source.host.os.version', bucket) || null;
+    }
+  }
+  return null;
+};
+
+const getFirstItem = (data: HostBuckets): string | null => {
+  const firstItem = head(data.buckets);
+  if (firstItem == null) {
+    return null;
+  }
+  return firstItem.key;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/index.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/index.test.ts
new file mode 100644
index 00000000000000..b57112b02fffe3
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/index.test.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+
+import { HostsRequestOptions } from '../../../../../../common/search_strategy/security_solution';
+import * as buildQuery from './query.all_hosts.dsl';
+import { allHosts } from '.';
+import {
+  mockOptions,
+  mockSearchStrategyResponse,
+  formattedSearchStrategyResponse,
+} from './__mocks__';
+
+describe('allHosts search strategy', () => {
+  const buildAllHostsQuery = jest.spyOn(buildQuery, 'buildHostsQuery');
+
+  afterEach(() => {
+    buildAllHostsQuery.mockClear();
+  });
+
+  describe('buildDsl', () => {
+    test('should build dsl query', () => {
+      allHosts.buildDsl(mockOptions);
+      expect(buildAllHostsQuery).toHaveBeenCalledWith(mockOptions);
+    });
+
+    test('should throw error if query size is greater equal than DEFAULT_MAX_TABLE_QUERY_SIZE ', () => {
+      const overSizeOptions = {
+        ...mockOptions,
+        pagination: {
+          ...mockOptions.pagination,
+          querySize: DEFAULT_MAX_TABLE_QUERY_SIZE,
+        },
+      } as HostsRequestOptions;
+
+      expect(() => {
+        allHosts.buildDsl(overSizeOptions);
+      }).toThrowError(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    });
+  });
+
+  describe('parse', () => {
+    test('should parse data correctly', async () => {
+      const result = await allHosts.parse(mockOptions, mockSearchStrategyResponse);
+      expect(result).toMatchObject(formattedSearchStrategyResponse);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/index.ts
new file mode 100644
index 00000000000000..aacfc227a36add
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/index.ts
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+import {
+  HostAggEsItem,
+  HostsStrategyResponse,
+  HostsQueries,
+  HostsRequestOptions,
+} from '../../../../../../common/search_strategy/security_solution/hosts';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+import { buildHostsQuery } from './query.all_hosts.dsl';
+import { formatHostEdgesData, HOSTS_FIELDS } from './helpers';
+
+export const allHosts: SecuritySolutionFactory<HostsQueries.hosts> = {
+  buildDsl: (options: HostsRequestOptions) => {
+    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
+      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    }
+    return buildHostsQuery(options);
+  },
+  parse: async (
+    options: HostsRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<HostsStrategyResponse> => {
+    const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
+    const totalCount = getOr(0, 'aggregations.host_count.value', response.rawResponse);
+    const buckets: HostAggEsItem[] = getOr(
+      [],
+      'aggregations.host_data.buckets',
+      response.rawResponse
+    );
+    const hostsEdges = buckets.map((bucket) => formatHostEdgesData(HOSTS_FIELDS, bucket));
+    const fakeTotalCount = fakePossibleCount <= totalCount ? fakePossibleCount : totalCount;
+    const edges = hostsEdges.splice(cursorStart, querySize - cursorStart);
+    const inspect = {
+      dsl: [inspectStringifyObject(buildHostsQuery(options))],
+    };
+    const showMorePagesIndicator = totalCount > fakeTotalCount;
+
+    return {
+      ...response,
+      inspect,
+      edges,
+      totalCount,
+      pageInfo: {
+        activePage: activePage ? activePage : 0,
+        fakeTotalCount,
+        showMorePagesIndicator,
+      },
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.test.ts
new file mode 100644
index 00000000000000..f5999d15e8950b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.test.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { buildHostsQuery } from './query.all_hosts.dsl';
+import { mockOptions, expectedDsl } from './__mocks__/';
+
+describe('buildHostsQuery', () => {
+  test('build query from options correctly', () => {
+    expect(buildHostsQuery(mockOptions)).toEqual(expectedDsl);
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
new file mode 100644
index 00000000000000..93390c314a637c
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
@@ -0,0 +1,91 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { isEmpty, isString } from 'lodash/fp';
+import { ISearchRequestParams } from '../../../../../../../../../src/plugins/data/common';
+import {
+  Direction,
+  HostsRequestOptions,
+  SortField,
+  HostsFields,
+} from '../../../../../../common/search_strategy';
+import { createQueryFilterClauses } from '../../../../../utils/build_query';
+import { assertUnreachable } from '../../../../../../common/utility_types';
+
+export const buildHostsQuery = ({
+  defaultIndex,
+  docValueFields,
+  filterQuery,
+  pagination: { querySize },
+  sort,
+  timerange: { from, to },
+}: HostsRequestOptions): ISearchRequestParams => {
+  const filter = [
+    ...createQueryFilterClauses(isString(filterQuery) ? JSON.parse(filterQuery) : filterQuery),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const agg = { host_count: { cardinality: { field: 'host.name' } } };
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      ...(isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
+      aggregations: {
+        ...agg,
+        host_data: {
+          terms: { size: querySize, field: 'host.name', order: getQueryOrder(sort) },
+          aggs: {
+            lastSeen: { max: { field: '@timestamp' } },
+            os: {
+              top_hits: {
+                size: 1,
+                sort: [
+                  {
+                    '@timestamp': {
+                      order: 'desc',
+                    },
+                  },
+                ],
+                _source: {
+                  includes: ['host.os.*'],
+                },
+              },
+            },
+          },
+        },
+      },
+      query: { bool: { filter } },
+      size: 0,
+      track_total_hits: false,
+    },
+  };
+
+  return dslQuery;
+};
+
+type QueryOrder = { lastSeen: Direction } | { _key: Direction };
+
+const getQueryOrder = (sort: SortField<HostsFields>): QueryOrder => {
+  switch (sort.field) {
+    case HostsFields.lastSeen:
+      return { lastSeen: sort.direction };
+    case HostsFields.hostName:
+      return { _key: sort.direction };
+    default:
+      return assertUnreachable(sort.field as never);
+  }
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts
new file mode 100644
index 00000000000000..65343dc721fd77
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts
@@ -0,0 +1,2370 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/data/common';
+import {
+  AuthenticationHit,
+  Direction,
+  HostsQueries,
+  HostAuthenticationsRequestOptions,
+} from '../../../../../../../common/search_strategy';
+
+export const mockOptions: HostAuthenticationsRequestOptions = {
+  defaultIndex: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  docValueFields: [
+    {
+      field: '@timestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'event.created',
+      format: 'date_time',
+    },
+    {
+      field: 'event.end',
+      format: 'date_time',
+    },
+    {
+      field: 'event.ingested',
+      format: 'date_time',
+    },
+    {
+      field: 'event.start',
+      format: 'date_time',
+    },
+    {
+      field: 'file.accessed',
+      format: 'date_time',
+    },
+    {
+      field: 'file.created',
+      format: 'date_time',
+    },
+    {
+      field: 'file.ctime',
+      format: 'date_time',
+    },
+    {
+      field: 'file.mtime',
+      format: 'date_time',
+    },
+    {
+      field: 'package.installed',
+      format: 'date_time',
+    },
+    {
+      field: 'process.parent.start',
+      format: 'date_time',
+    },
+    {
+      field: 'process.start',
+      format: 'date_time',
+    },
+    {
+      field: 'system.audit.host.boottime',
+      format: 'date_time',
+    },
+    {
+      field: 'system.audit.package.installtime',
+      format: 'date_time',
+    },
+    {
+      field: 'system.audit.user.password.last_changed',
+      format: 'date_time',
+    },
+    {
+      field: 'tls.client.not_after',
+      format: 'date_time',
+    },
+    {
+      field: 'tls.client.not_before',
+      format: 'date_time',
+    },
+    {
+      field: 'tls.server.not_after',
+      format: 'date_time',
+    },
+    {
+      field: 'tls.server.not_before',
+      format: 'date_time',
+    },
+    {
+      field: 'aws.cloudtrail.user_identity.session_context.creation_date',
+      format: 'date_time',
+    },
+    {
+      field: 'azure.auditlogs.properties.activity_datetime',
+      format: 'date_time',
+    },
+    {
+      field: 'azure.enqueued_time',
+      format: 'date_time',
+    },
+    {
+      field: 'azure.signinlogs.properties.created_at',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.agentReceiptTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.deviceCustomDate1',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.deviceCustomDate2',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.deviceReceiptTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.endTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.fileCreateTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.fileModificationTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.flexDate1',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.managerReceiptTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.oldFileCreateTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.oldFileModificationTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.startTime',
+      format: 'date_time',
+    },
+    {
+      field: 'checkpoint.subs_exp',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.EndTimestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.IncidentEndTime',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.IncidentStartTime',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.ProcessEndTime',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.ProcessStartTime',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.StartTimestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.Timestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.UTCTimestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.metadata.eventCreationTime',
+      format: 'date_time',
+    },
+    {
+      field: 'gsuite.admin.email.log_search_filter.end_date',
+      format: 'date_time',
+    },
+    {
+      field: 'gsuite.admin.email.log_search_filter.start_date',
+      format: 'date_time',
+    },
+    {
+      field: 'gsuite.admin.user.birthdate',
+      format: 'date_time',
+    },
+    {
+      field: 'kafka.block_timestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'microsoft.defender_atp.lastUpdateTime',
+      format: 'date_time',
+    },
+    {
+      field: 'microsoft.defender_atp.resolvedTime',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.campaign.first_seen',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.campaign.last_seen',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.intrusion_set.first_seen',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.intrusion_set.last_seen',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.observed_data.first_observed',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.observed_data.last_observed',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.report.published',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.threat_indicator.valid_from',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.threat_indicator.valid_until',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.collection_time_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.exporter.timestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_end_microseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_end_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_end_nanoseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_end_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_start_microseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_start_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_start_nanoseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_start_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.max_export_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.max_flow_end_microseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.max_flow_end_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.max_flow_end_nanoseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.max_flow_end_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.min_export_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.min_flow_start_microseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.min_flow_start_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.min_flow_start_nanoseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.min_flow_start_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.monitoring_interval_end_milli_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.monitoring_interval_start_milli_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.observation_time_microseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.observation_time_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.observation_time_nanoseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.observation_time_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.system_init_time_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.internal.lc_ctime',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.internal.time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.effective_time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.endtime',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.event_queue_time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.event_time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.expire_time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.recorded_time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.stamp',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.starttime',
+      format: 'date_time',
+    },
+    {
+      field: 'sophos.xg.date',
+      format: 'date_time',
+    },
+    {
+      field: 'sophos.xg.eventtime',
+      format: 'date_time',
+    },
+    {
+      field: 'sophos.xg.start_time',
+      format: 'date_time',
+    },
+  ],
+  factoryQueryType: HostsQueries.authentications,
+  filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+  pagination: {
+    activePage: 0,
+    cursorStart: 0,
+    fakePossibleCount: 50,
+    querySize: 10,
+  },
+  timerange: {
+    interval: '12h',
+    from: '2020-09-02T15:17:13.678Z',
+    to: '2020-09-03T15:17:13.678Z',
+  },
+  sort: {
+    direction: Direction.desc,
+    field: 'success',
+  },
+  params: {},
+};
+
+export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 14,
+    timed_out: false,
+    _shards: { total: 21, successful: 21, skipped: 0, failed: 0 },
+    hits: { total: -1, max_score: 0, hits: [] },
+    aggregations: {
+      group_by_users: {
+        doc_count_error_upper_bound: -1,
+        sum_other_doc_count: 408,
+        buckets: [
+          {
+            key: 'SYSTEM',
+            doc_count: 281,
+            failures: {
+              meta: {},
+              doc_count: 0,
+              lastFailure: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+            successes: {
+              meta: {},
+              doc_count: 4,
+              lastSuccess: {
+                hits: {
+                  total: 4,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'winlogbeat-8.0.0-2020.09.02-000001',
+                      _id: 'zqY7WXQBA6bGZw2uLeKI',
+                      _score: null,
+                      _source: {
+                        process: {
+                          name: 'services.exe',
+                          pid: 564,
+                          executable: 'C:\\Windows\\System32\\services.exe',
+                        },
+                        agent: {
+                          build_date: '2020-07-16 09:16:27 +0000 UTC ',
+                          name: 'siem-windows',
+                          commit: '4dcbde39492bdc3843034bba8db811c68cb44b97 ',
+                          id: '05e1bff7-d7a8-416a-8554-aa10288fa07d',
+                          type: 'winlogbeat',
+                          ephemeral_id: '655abd6c-6c33-435d-a2eb-79b2a01e6d61',
+                          version: '8.0.0',
+                          user: { name: 'inside_winlogbeat_user' },
+                        },
+                        winlog: {
+                          computer_name: 'siem-windows',
+                          process: { pid: 576, thread: { id: 880 } },
+                          keywords: ['Audit Success'],
+                          logon: { id: '0x3e7', type: 'Service' },
+                          channel: 'Security',
+                          event_data: {
+                            LogonGuid: '{00000000-0000-0000-0000-000000000000}',
+                            TargetOutboundDomainName: '-',
+                            VirtualAccount: '%%1843',
+                            LogonType: '5',
+                            IpPort: '-',
+                            TransmittedServices: '-',
+                            SubjectLogonId: '0x3e7',
+                            LmPackageName: '-',
+                            TargetOutboundUserName: '-',
+                            KeyLength: '0',
+                            TargetLogonId: '0x3e7',
+                            RestrictedAdminMode: '-',
+                            SubjectUserName: 'SIEM-WINDOWS$',
+                            TargetLinkedLogonId: '0x0',
+                            ElevatedToken: '%%1842',
+                            SubjectDomainName: 'WORKGROUP',
+                            IpAddress: '-',
+                            ImpersonationLevel: '%%1833',
+                            TargetUserName: 'SYSTEM',
+                            LogonProcessName: 'Advapi  ',
+                            TargetDomainName: 'NT AUTHORITY',
+                            SubjectUserSid: 'S-1-5-18',
+                            TargetUserSid: 'S-1-5-18',
+                            AuthenticationPackageName: 'Negotiate',
+                          },
+                          opcode: 'Info',
+                          version: 2,
+                          record_id: 57818,
+                          task: 'Logon',
+                          event_id: 4624,
+                          provider_guid: '{54849625-5478-4994-a5ba-3e3b0328c30d}',
+                          activity_id: '{d2485217-6bac-0000-8fbb-3f7e2571d601}',
+                          api: 'wineventlog',
+                          provider_name: 'Microsoft-Windows-Security-Auditing',
+                        },
+                        log: { level: 'information' },
+                        source: { domain: '-' },
+                        message:
+                          'An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tSIEM-WINDOWS$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tSYSTEM\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x234\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.',
+                        cloud: {
+                          availability_zone: 'us-central1-c',
+                          instance: { name: 'siem-windows', id: '9156726559029788564' },
+                          provider: 'gcp',
+                          machine: { type: 'g1-small' },
+                          project: { id: 'elastic-siem' },
+                        },
+                        '@timestamp': '2020-09-04T13:08:02.532Z',
+                        related: { user: ['SYSTEM', 'SIEM-WINDOWS$'] },
+                        ecs: { version: '1.5.0' },
+                        host: {
+                          hostname: 'siem-windows',
+                          os: {
+                            build: '17763.1397',
+                            kernel: '10.0.17763.1397 (WinBuild.160101.0800)',
+                            name: 'Windows Server 2019 Datacenter',
+                            family: 'windows',
+                            version: '10.0',
+                            platform: 'windows',
+                          },
+                          ip: ['fe80::ecf5:decc:3ec3:767e', '10.200.0.15'],
+                          name: 'siem-windows',
+                          id: 'ce1d3c9b-a815-4643-9641-ada0f2c00609',
+                          mac: ['42:01:0a:c8:00:0f'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          code: 4624,
+                          provider: 'Microsoft-Windows-Security-Auditing',
+                          created: '2020-09-04T13:08:03.638Z',
+                          kind: 'event',
+                          module: 'security',
+                          action: 'logged-in',
+                          category: 'authentication',
+                          type: 'start',
+                          outcome: 'success',
+                        },
+                        user: { domain: 'NT AUTHORITY', name: 'SYSTEM', id: 'S-1-5-18' },
+                      },
+                      sort: [1599224882532],
+                    },
+                  ],
+                },
+              },
+            },
+          },
+          {
+            key: 'tsg',
+            doc_count: 1,
+            failures: {
+              doc_count: 0,
+              lastFailure: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+            successes: {
+              doc_count: 1,
+              lastSuccess: {
+                hits: {
+                  total: 1,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: '9_sfWXQBc39KFIJbIsDh',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 20764 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 552463 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            region_iso_code: 'DE-BE',
+                            city_name: 'Berlin',
+                            country_iso_code: 'DE',
+                            region_name: 'Land Berlin',
+                            location: { lon: 13.3512, lat: 52.5727 },
+                          },
+                          as: { number: 6805, organization: { name: 'Telefonica Germany' } },
+                          port: 57457,
+                          ip: '77.183.42.188',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:49:21.000Z',
+                        system: {
+                          auth: {
+                            ssh: {
+                              method: 'publickey',
+                              signature: 'RSA SHA256:vv64JNLzKZWYA9vonnGWuW7zxWhyZrL/BFxyIGbISx8',
+                              event: 'Accepted',
+                            },
+                          },
+                        },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_success',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'success',
+                        },
+                        user: { name: 'tsg' },
+                      },
+                      sort: [1599220161000],
+                    },
+                  ],
+                },
+              },
+            },
+          },
+          {
+            key: 'admin',
+            doc_count: 23,
+            failures: {
+              doc_count: 23,
+              lastFailure: {
+                hits: {
+                  total: 23,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'ZfxZWXQBc39KFIJbLN5U',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 22913 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 562910 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'KR-28',
+                            city_name: 'Incheon',
+                            country_iso_code: 'KR',
+                            region_name: 'Incheon',
+                            location: { lon: 126.7288, lat: 37.4562 },
+                          },
+                          as: { number: 4766, organization: { name: 'Korea Telecom' } },
+                          ip: '59.15.3.197',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:40:46.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'admin' },
+                      },
+                      sort: [1599226846000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'user',
+            doc_count: 21,
+            failures: {
+              doc_count: 21,
+              lastFailure: {
+                hits: {
+                  total: 21,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'M_xLWXQBc39KFIJbY7Cb',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20671 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1028103 },
+                        source: {
+                          geo: {
+                            continent_name: 'North America',
+                            region_iso_code: 'US-NY',
+                            city_name: 'New York',
+                            country_iso_code: 'US',
+                            region_name: 'New York',
+                            location: { lon: -74, lat: 40.7157 },
+                          },
+                          ip: '64.227.88.245',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:25:43.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['64.227.88.245'], user: ['user'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T13:25:47.034172Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'user' },
+                      },
+                      sort: [1599225943000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'ubuntu',
+            doc_count: 18,
+            failures: {
+              doc_count: 18,
+              lastFailure: {
+                hits: {
+                  total: 18,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'nPxKWXQBc39KFIJb7q4w',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          type: 'filebeat',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20665 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1027372 },
+                        source: {
+                          geo: {
+                            continent_name: 'North America',
+                            region_iso_code: 'US-NY',
+                            city_name: 'New York',
+                            country_iso_code: 'US',
+                            region_name: 'New York',
+                            location: { lon: -74, lat: 40.7157 },
+                          },
+                          ip: '64.227.88.245',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:25:07.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['64.227.88.245'], user: ['ubuntu'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T13:25:16.974606Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'ubuntu' },
+                      },
+                      sort: [1599225907000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'odoo',
+            doc_count: 17,
+            failures: {
+              doc_count: 17,
+              lastFailure: {
+                hits: {
+                  total: 17,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'mPsfWXQBc39KFIJbI8HI',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          type: 'filebeat',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 21506 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 556761 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'IN-DL',
+                            city_name: 'New Delhi',
+                            country_iso_code: 'IN',
+                            region_name: 'National Capital Territory of Delhi',
+                            location: { lon: 77.2245, lat: 28.6358 },
+                          },
+                          as: { number: 10029, organization: { name: 'SHYAM SPECTRA PVT LTD' } },
+                          ip: '180.151.228.166',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T12:26:36.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'odoo' },
+                      },
+                      sort: [1599222396000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'pi',
+            doc_count: 17,
+            failures: {
+              doc_count: 17,
+              lastFailure: {
+                hits: {
+                  total: 17,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'aaToWHQBA6bGZw2uR-St',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20475 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1019218 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            region_iso_code: 'SE-AB',
+                            city_name: 'Stockholm',
+                            country_iso_code: 'SE',
+                            region_name: 'Stockholm',
+                            location: { lon: 17.7833, lat: 59.25 },
+                          },
+                          as: { number: 8473, organization: { name: 'Bahnhof AB' } },
+                          ip: '178.174.148.58',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:37:22.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['178.174.148.58'], user: ['pi'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T11:37:31.797423Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'pi' },
+                      },
+                      sort: [1599219442000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'demo',
+            doc_count: 14,
+            failures: {
+              doc_count: 14,
+              lastFailure: {
+                hits: {
+                  total: 14,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'VaP_V3QBA6bGZw2upUbg',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 19849 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 981036 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            country_iso_code: 'HR',
+                            location: { lon: 15.5, lat: 45.1667 },
+                          },
+                          as: {
+                            number: 42864,
+                            organization: { name: 'Giganet Internet Szolgaltato Kft' },
+                          },
+                          ip: '45.95.168.157',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T07:23:22.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['45.95.168.157'], user: ['demo'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T07:23:26.046346Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'demo' },
+                      },
+                      sort: [1599204202000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'git',
+            doc_count: 13,
+            failures: {
+              doc_count: 13,
+              lastFailure: {
+                hits: {
+                  total: 13,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'PqYfWXQBA6bGZw2uIhVU',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 20396 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 550795 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'CN-BJ',
+                            city_name: 'Beijing',
+                            country_iso_code: 'CN',
+                            region_name: 'Beijing',
+                            location: { lon: 116.3889, lat: 39.9288 },
+                          },
+                          as: {
+                            number: 45090,
+                            organization: {
+                              name: 'Shenzhen Tencent Computer Systems Company Limited',
+                            },
+                          },
+                          ip: '123.206.30.76',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:20:26.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'git' },
+                      },
+                      sort: [1599218426000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'webadmin',
+            doc_count: 13,
+            failures: {
+              doc_count: 13,
+              lastFailure: {
+                hits: {
+                  total: 13,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'iMABWHQBB-gskclyitP-',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 19870 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 984133 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            country_iso_code: 'HR',
+                            location: { lon: 15.5, lat: 45.1667 },
+                          },
+                          as: {
+                            number: 42864,
+                            organization: { name: 'Giganet Internet Szolgaltato Kft' },
+                          },
+                          ip: '45.95.168.157',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T07:25:28.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['45.95.168.157'], user: ['webadmin'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T07:25:30.236651Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'webadmin' },
+                      },
+                      sort: [1599204328000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+        ],
+      },
+      user_count: { value: 188 },
+    },
+  },
+  total: 21,
+  loaded: 21,
+};
+
+export const formattedSearchStrategyResponse = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 14,
+    timed_out: false,
+    _shards: { total: 21, successful: 21, skipped: 0, failed: 0 },
+    hits: { total: -1, max_score: 0, hits: [] },
+    aggregations: {
+      group_by_users: {
+        doc_count_error_upper_bound: -1,
+        sum_other_doc_count: 408,
+        buckets: [
+          {
+            key: 'SYSTEM',
+            doc_count: 281,
+            failures: {
+              meta: {},
+              doc_count: 0,
+              lastFailure: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+            successes: {
+              meta: {},
+              doc_count: 4,
+              lastSuccess: {
+                hits: {
+                  total: 4,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'winlogbeat-8.0.0-2020.09.02-000001',
+                      _id: 'zqY7WXQBA6bGZw2uLeKI',
+                      _score: null,
+                      _source: {
+                        process: {
+                          name: 'services.exe',
+                          pid: 564,
+                          executable: 'C:\\Windows\\System32\\services.exe',
+                        },
+                        agent: {
+                          build_date: '2020-07-16 09:16:27 +0000 UTC ',
+                          name: 'siem-windows',
+                          commit: '4dcbde39492bdc3843034bba8db811c68cb44b97 ',
+                          id: '05e1bff7-d7a8-416a-8554-aa10288fa07d',
+                          type: 'winlogbeat',
+                          ephemeral_id: '655abd6c-6c33-435d-a2eb-79b2a01e6d61',
+                          version: '8.0.0',
+                          user: { name: 'inside_winlogbeat_user' },
+                        },
+                        winlog: {
+                          computer_name: 'siem-windows',
+                          process: { pid: 576, thread: { id: 880 } },
+                          keywords: ['Audit Success'],
+                          logon: { id: '0x3e7', type: 'Service' },
+                          channel: 'Security',
+                          event_data: {
+                            LogonGuid: '{00000000-0000-0000-0000-000000000000}',
+                            TargetOutboundDomainName: '-',
+                            VirtualAccount: '%%1843',
+                            LogonType: '5',
+                            IpPort: '-',
+                            TransmittedServices: '-',
+                            SubjectLogonId: '0x3e7',
+                            LmPackageName: '-',
+                            TargetOutboundUserName: '-',
+                            KeyLength: '0',
+                            TargetLogonId: '0x3e7',
+                            RestrictedAdminMode: '-',
+                            SubjectUserName: 'SIEM-WINDOWS$',
+                            TargetLinkedLogonId: '0x0',
+                            ElevatedToken: '%%1842',
+                            SubjectDomainName: 'WORKGROUP',
+                            IpAddress: '-',
+                            ImpersonationLevel: '%%1833',
+                            TargetUserName: 'SYSTEM',
+                            LogonProcessName: 'Advapi  ',
+                            TargetDomainName: 'NT AUTHORITY',
+                            SubjectUserSid: 'S-1-5-18',
+                            TargetUserSid: 'S-1-5-18',
+                            AuthenticationPackageName: 'Negotiate',
+                          },
+                          opcode: 'Info',
+                          version: 2,
+                          record_id: 57818,
+                          task: 'Logon',
+                          event_id: 4624,
+                          provider_guid: '{54849625-5478-4994-a5ba-3e3b0328c30d}',
+                          activity_id: '{d2485217-6bac-0000-8fbb-3f7e2571d601}',
+                          api: 'wineventlog',
+                          provider_name: 'Microsoft-Windows-Security-Auditing',
+                        },
+                        log: { level: 'information' },
+                        source: { domain: '-' },
+                        message:
+                          'An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tSIEM-WINDOWS$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tSYSTEM\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x234\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.',
+                        cloud: {
+                          availability_zone: 'us-central1-c',
+                          instance: { name: 'siem-windows', id: '9156726559029788564' },
+                          provider: 'gcp',
+                          machine: { type: 'g1-small' },
+                          project: { id: 'elastic-siem' },
+                        },
+                        '@timestamp': '2020-09-04T13:08:02.532Z',
+                        related: { user: ['SYSTEM', 'SIEM-WINDOWS$'] },
+                        ecs: { version: '1.5.0' },
+                        host: {
+                          hostname: 'siem-windows',
+                          os: {
+                            build: '17763.1397',
+                            kernel: '10.0.17763.1397 (WinBuild.160101.0800)',
+                            name: 'Windows Server 2019 Datacenter',
+                            family: 'windows',
+                            version: '10.0',
+                            platform: 'windows',
+                          },
+                          ip: ['fe80::ecf5:decc:3ec3:767e', '10.200.0.15'],
+                          name: 'siem-windows',
+                          id: 'ce1d3c9b-a815-4643-9641-ada0f2c00609',
+                          mac: ['42:01:0a:c8:00:0f'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          code: 4624,
+                          provider: 'Microsoft-Windows-Security-Auditing',
+                          created: '2020-09-04T13:08:03.638Z',
+                          kind: 'event',
+                          module: 'security',
+                          action: 'logged-in',
+                          category: 'authentication',
+                          type: 'start',
+                          outcome: 'success',
+                        },
+                        user: { domain: 'NT AUTHORITY', name: 'SYSTEM', id: 'S-1-5-18' },
+                      },
+                      sort: [1599224882532],
+                    },
+                  ],
+                },
+              },
+            },
+          },
+          {
+            key: 'tsg',
+            doc_count: 1,
+            failures: {
+              doc_count: 0,
+              lastFailure: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+            successes: {
+              doc_count: 1,
+              lastSuccess: {
+                hits: {
+                  total: 1,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: '9_sfWXQBc39KFIJbIsDh',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 20764 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 552463 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            region_iso_code: 'DE-BE',
+                            city_name: 'Berlin',
+                            country_iso_code: 'DE',
+                            region_name: 'Land Berlin',
+                            location: { lon: 13.3512, lat: 52.5727 },
+                          },
+                          as: { number: 6805, organization: { name: 'Telefonica Germany' } },
+                          port: 57457,
+                          ip: '77.183.42.188',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:49:21.000Z',
+                        system: {
+                          auth: {
+                            ssh: {
+                              method: 'publickey',
+                              signature: 'RSA SHA256:vv64JNLzKZWYA9vonnGWuW7zxWhyZrL/BFxyIGbISx8',
+                              event: 'Accepted',
+                            },
+                          },
+                        },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_success',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'success',
+                        },
+                        user: { name: 'tsg' },
+                      },
+                      sort: [1599220161000],
+                    },
+                  ],
+                },
+              },
+            },
+          },
+          {
+            key: 'admin',
+            doc_count: 23,
+            failures: {
+              doc_count: 23,
+              lastFailure: {
+                hits: {
+                  total: 23,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'ZfxZWXQBc39KFIJbLN5U',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 22913 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 562910 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'KR-28',
+                            city_name: 'Incheon',
+                            country_iso_code: 'KR',
+                            region_name: 'Incheon',
+                            location: { lon: 126.7288, lat: 37.4562 },
+                          },
+                          as: { number: 4766, organization: { name: 'Korea Telecom' } },
+                          ip: '59.15.3.197',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:40:46.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'admin' },
+                      },
+                      sort: [1599226846000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'user',
+            doc_count: 21,
+            failures: {
+              doc_count: 21,
+              lastFailure: {
+                hits: {
+                  total: 21,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'M_xLWXQBc39KFIJbY7Cb',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20671 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1028103 },
+                        source: {
+                          geo: {
+                            continent_name: 'North America',
+                            region_iso_code: 'US-NY',
+                            city_name: 'New York',
+                            country_iso_code: 'US',
+                            region_name: 'New York',
+                            location: { lon: -74, lat: 40.7157 },
+                          },
+                          ip: '64.227.88.245',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:25:43.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['64.227.88.245'], user: ['user'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T13:25:47.034172Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'user' },
+                      },
+                      sort: [1599225943000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'ubuntu',
+            doc_count: 18,
+            failures: {
+              doc_count: 18,
+              lastFailure: {
+                hits: {
+                  total: 18,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'nPxKWXQBc39KFIJb7q4w',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          type: 'filebeat',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20665 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1027372 },
+                        source: {
+                          geo: {
+                            continent_name: 'North America',
+                            region_iso_code: 'US-NY',
+                            city_name: 'New York',
+                            country_iso_code: 'US',
+                            region_name: 'New York',
+                            location: { lon: -74, lat: 40.7157 },
+                          },
+                          ip: '64.227.88.245',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:25:07.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['64.227.88.245'], user: ['ubuntu'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T13:25:16.974606Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'ubuntu' },
+                      },
+                      sort: [1599225907000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'odoo',
+            doc_count: 17,
+            failures: {
+              doc_count: 17,
+              lastFailure: {
+                hits: {
+                  total: 17,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'mPsfWXQBc39KFIJbI8HI',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          type: 'filebeat',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 21506 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 556761 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'IN-DL',
+                            city_name: 'New Delhi',
+                            country_iso_code: 'IN',
+                            region_name: 'National Capital Territory of Delhi',
+                            location: { lon: 77.2245, lat: 28.6358 },
+                          },
+                          as: { number: 10029, organization: { name: 'SHYAM SPECTRA PVT LTD' } },
+                          ip: '180.151.228.166',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T12:26:36.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'odoo' },
+                      },
+                      sort: [1599222396000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'pi',
+            doc_count: 17,
+            failures: {
+              doc_count: 17,
+              lastFailure: {
+                hits: {
+                  total: 17,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'aaToWHQBA6bGZw2uR-St',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20475 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1019218 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            region_iso_code: 'SE-AB',
+                            city_name: 'Stockholm',
+                            country_iso_code: 'SE',
+                            region_name: 'Stockholm',
+                            location: { lon: 17.7833, lat: 59.25 },
+                          },
+                          as: { number: 8473, organization: { name: 'Bahnhof AB' } },
+                          ip: '178.174.148.58',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:37:22.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['178.174.148.58'], user: ['pi'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T11:37:31.797423Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'pi' },
+                      },
+                      sort: [1599219442000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'demo',
+            doc_count: 14,
+            failures: {
+              doc_count: 14,
+              lastFailure: {
+                hits: {
+                  total: 14,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'VaP_V3QBA6bGZw2upUbg',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 19849 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 981036 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            country_iso_code: 'HR',
+                            location: { lon: 15.5, lat: 45.1667 },
+                          },
+                          as: {
+                            number: 42864,
+                            organization: { name: 'Giganet Internet Szolgaltato Kft' },
+                          },
+                          ip: '45.95.168.157',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T07:23:22.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['45.95.168.157'], user: ['demo'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T07:23:26.046346Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'demo' },
+                      },
+                      sort: [1599204202000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'git',
+            doc_count: 13,
+            failures: {
+              doc_count: 13,
+              lastFailure: {
+                hits: {
+                  total: 13,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'PqYfWXQBA6bGZw2uIhVU',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 20396 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 550795 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'CN-BJ',
+                            city_name: 'Beijing',
+                            country_iso_code: 'CN',
+                            region_name: 'Beijing',
+                            location: { lon: 116.3889, lat: 39.9288 },
+                          },
+                          as: {
+                            number: 45090,
+                            organization: {
+                              name: 'Shenzhen Tencent Computer Systems Company Limited',
+                            },
+                          },
+                          ip: '123.206.30.76',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:20:26.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'git' },
+                      },
+                      sort: [1599218426000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'webadmin',
+            doc_count: 13,
+            failures: {
+              doc_count: 13,
+              lastFailure: {
+                hits: {
+                  total: 13,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'iMABWHQBB-gskclyitP-',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 19870 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 984133 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            country_iso_code: 'HR',
+                            location: { lon: 15.5, lat: 45.1667 },
+                          },
+                          as: {
+                            number: 42864,
+                            organization: { name: 'Giganet Internet Szolgaltato Kft' },
+                          },
+                          ip: '45.95.168.157',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T07:25:28.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['45.95.168.157'], user: ['webadmin'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T07:25:30.236651Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'webadmin' },
+                      },
+                      sort: [1599204328000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+        ],
+      },
+      user_count: { value: 188 },
+    },
+  },
+  total: 21,
+  loaded: 21,
+  inspect: {
+    dsl: [
+      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "user_count": {\n        "cardinality": {\n          "field": "user.name"\n        }\n      },\n      "group_by_users": {\n        "terms": {\n          "size": 10,\n          "field": "user.name",\n          "order": [\n            {\n              "successes.doc_count": "desc"\n            },\n            {\n              "failures.doc_count": "desc"\n            }\n          ]\n        },\n        "aggs": {\n          "failures": {\n            "filter": {\n              "term": {\n                "event.outcome": "failure"\n              }\n            },\n            "aggs": {\n              "lastFailure": {\n                "top_hits": {\n                  "size": 1,\n                  "_source": [],\n                  "sort": [\n                    {\n                      "@timestamp": {\n                        "order": "desc"\n                      }\n                    }\n                  ]\n                }\n              }\n            }\n          },\n          "successes": {\n            "filter": {\n              "term": {\n                "event.outcome": "success"\n              }\n            },\n            "aggs": {\n              "lastSuccess": {\n                "top_hits": {\n                  "size": 1,\n                  "_source": [],\n                  "sort": [\n                    {\n                      "@timestamp": {\n                        "order": "desc"\n                      }\n                    }\n                  ]\n                }\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "term": {\n              "event.category": "authentication"\n            }\n          },\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-02T15:17:13.678Z",\n                "lte": "2020-09-03T15:17:13.678Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0\n  },\n  "track_total_hits": false\n}',
+    ],
+  },
+  edges: [
+    {
+      node: {
+        failures: 0,
+        successes: 4,
+        _id: 'SYSTEM+281',
+        user: { name: ['SYSTEM'] },
+        lastSuccess: {
+          timestamp: ['2020-09-04T13:08:02.532Z'],
+          host: { id: ['ce1d3c9b-a815-4643-9641-ada0f2c00609'], name: ['siem-windows'] },
+        },
+      },
+      cursor: { value: '', tiebreaker: null },
+    },
+    {
+      node: {
+        failures: 0,
+        successes: 1,
+        _id: 'tsg+1',
+        user: { name: ['tsg'] },
+        lastSuccess: {
+          timestamp: ['2020-09-04T11:49:21.000Z'],
+          source: { ip: ['77.183.42.188'] },
+          host: { id: ['aa7ca589f1b8220002f2fc61c64cfbf1'], name: ['siem-kibana'] },
+        },
+      },
+      cursor: { value: '', tiebreaker: null },
+    },
+    {
+      node: {
+        failures: 23,
+        successes: 0,
+        _id: 'admin+23',
+        user: { name: ['admin'] },
+        lastFailure: {
+          timestamp: ['2020-09-04T13:40:46.000Z'],
+          source: { ip: ['59.15.3.197'] },
+          host: { id: ['aa7ca589f1b8220002f2fc61c64cfbf1'], name: ['siem-kibana'] },
+        },
+      },
+      cursor: { value: '', tiebreaker: null },
+    },
+    {
+      node: {
+        failures: 21,
+        successes: 0,
+        _id: 'user+21',
+        user: { name: ['user'] },
+        lastFailure: {
+          timestamp: ['2020-09-04T13:25:43.000Z'],
+          source: { ip: ['64.227.88.245'] },
+          host: { name: ['bastion00.siem.estc.dev'] },
+        },
+      },
+      cursor: { value: '', tiebreaker: null },
+    },
+    {
+      node: {
+        failures: 18,
+        successes: 0,
+        _id: 'ubuntu+18',
+        user: { name: ['ubuntu'] },
+        lastFailure: {
+          timestamp: ['2020-09-04T13:25:07.000Z'],
+          source: { ip: ['64.227.88.245'] },
+          host: { name: ['bastion00.siem.estc.dev'] },
+        },
+      },
+      cursor: { value: '', tiebreaker: null },
+    },
+    {
+      node: {
+        failures: 17,
+        successes: 0,
+        _id: 'odoo+17',
+        user: { name: ['odoo'] },
+        lastFailure: {
+          timestamp: ['2020-09-04T12:26:36.000Z'],
+          source: { ip: ['180.151.228.166'] },
+          host: { id: ['aa7ca589f1b8220002f2fc61c64cfbf1'], name: ['siem-kibana'] },
+        },
+      },
+      cursor: { value: '', tiebreaker: null },
+    },
+    {
+      node: {
+        failures: 17,
+        successes: 0,
+        _id: 'pi+17',
+        user: { name: ['pi'] },
+        lastFailure: {
+          timestamp: ['2020-09-04T11:37:22.000Z'],
+          source: { ip: ['178.174.148.58'] },
+          host: { name: ['bastion00.siem.estc.dev'] },
+        },
+      },
+      cursor: { value: '', tiebreaker: null },
+    },
+    {
+      node: {
+        failures: 14,
+        successes: 0,
+        _id: 'demo+14',
+        user: { name: ['demo'] },
+        lastFailure: {
+          timestamp: ['2020-09-04T07:23:22.000Z'],
+          source: { ip: ['45.95.168.157'] },
+          host: { name: ['bastion00.siem.estc.dev'] },
+        },
+      },
+      cursor: { value: '', tiebreaker: null },
+    },
+    {
+      node: {
+        failures: 13,
+        successes: 0,
+        _id: 'git+13',
+        user: { name: ['git'] },
+        lastFailure: {
+          timestamp: ['2020-09-04T11:20:26.000Z'],
+          source: { ip: ['123.206.30.76'] },
+          host: { id: ['aa7ca589f1b8220002f2fc61c64cfbf1'], name: ['siem-kibana'] },
+        },
+      },
+      cursor: { value: '', tiebreaker: null },
+    },
+    {
+      node: {
+        failures: 13,
+        successes: 0,
+        _id: 'webadmin+13',
+        user: { name: ['webadmin'] },
+        lastFailure: {
+          timestamp: ['2020-09-04T07:25:28.000Z'],
+          source: { ip: ['45.95.168.157'] },
+          host: { name: ['bastion00.siem.estc.dev'] },
+        },
+      },
+      cursor: { value: '', tiebreaker: null },
+    },
+  ],
+  totalCount: 188,
+  pageInfo: { activePage: 0, fakeTotalCount: 50, showMorePagesIndicator: true },
+};
+
+export const expectedDsl = {
+  allowNoIndices: true,
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  ignoreUnavailable: true,
+  body: {
+    aggregations: {
+      user_count: { cardinality: { field: 'user.name' } },
+      group_by_users: {
+        terms: {
+          size: 10,
+          field: 'user.name',
+          order: [{ 'successes.doc_count': 'desc' }, { 'failures.doc_count': 'desc' }],
+        },
+        aggs: {
+          failures: {
+            filter: { term: { 'event.outcome': 'failure' } },
+            aggs: {
+              lastFailure: {
+                top_hits: { size: 1, _source: [], sort: [{ '@timestamp': { order: 'desc' } }] },
+              },
+            },
+          },
+          successes: {
+            filter: { term: { 'event.outcome': 'success' } },
+            aggs: {
+              lastSuccess: {
+                top_hits: { size: 1, _source: [], sort: [{ '@timestamp': { order: 'desc' } }] },
+              },
+            },
+          },
+        },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { term: { 'event.category': 'authentication' } },
+          {
+            range: {
+              '@timestamp': {
+                gte: '2020-09-02T15:17:13.678Z',
+                lte: '2020-09-03T15:17:13.678Z',
+                format: 'strict_date_optional_time',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+  },
+  track_total_hits: false,
+};
+
+export const mockHit: AuthenticationHit = {
+  _index: 'index-123',
+  _type: 'type-123',
+  _id: 'id-123',
+  _score: 10,
+  _source: {
+    '@timestamp': 'time-1',
+  },
+  cursor: 'cursor-1',
+  sort: [0],
+  user: 'Evan',
+  failures: 10,
+  successes: 20,
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.test.ts
new file mode 100644
index 00000000000000..31e4069e458be3
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.test.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { buildQuery } from './query.dsl';
+import { mockOptions, expectedDsl } from '../__mocks__/';
+
+describe('buildQuery', () => {
+  test('build query from options correctly', () => {
+    expect(buildQuery(mockOptions)).toEqual(expectedDsl);
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.ts
new file mode 100644
index 00000000000000..df300c85e300f7
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.ts
@@ -0,0 +1,120 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { isEmpty } from 'lodash/fp';
+
+import { HostAuthenticationsRequestOptions } from '../../../../../../../common/search_strategy/security_solution/hosts/authentications';
+import { sourceFieldsMap, hostFieldsMap } from '../../../../../../../common/ecs/ecs_fields';
+
+import { createQueryFilterClauses } from '../../../../../../utils/build_query';
+import { reduceFields } from '../../../../../../utils/build_query/reduce_fields';
+
+import { authenticationFields } from '../helpers';
+import { extendMap } from '../../../../../../../common/ecs/ecs_fields/extend_map';
+
+export const auditdFieldsMap: Readonly<Record<string, string>> = {
+  latest: '@timestamp',
+  'lastSuccess.timestamp': 'lastSuccess.@timestamp',
+  'lastFailure.timestamp': 'lastFailure.@timestamp',
+  ...{ ...extendMap('lastSuccess', sourceFieldsMap) },
+  ...{ ...extendMap('lastSuccess', hostFieldsMap) },
+  ...{ ...extendMap('lastFailure', sourceFieldsMap) },
+  ...{ ...extendMap('lastFailure', hostFieldsMap) },
+};
+
+export const buildQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  pagination: { querySize },
+  defaultIndex,
+  docValueFields,
+}: HostAuthenticationsRequestOptions) => {
+  const esFields = reduceFields(authenticationFields, { ...hostFieldsMap, ...sourceFieldsMap });
+
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    { term: { 'event.category': 'authentication' } },
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const agg = {
+    user_count: {
+      cardinality: {
+        field: 'user.name',
+      },
+    },
+  };
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      ...(isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
+      aggregations: {
+        ...agg,
+        group_by_users: {
+          terms: {
+            size: querySize,
+            field: 'user.name',
+            order: [{ 'successes.doc_count': 'desc' }, { 'failures.doc_count': 'desc' }],
+          },
+          aggs: {
+            failures: {
+              filter: {
+                term: {
+                  'event.outcome': 'failure',
+                },
+              },
+              aggs: {
+                lastFailure: {
+                  top_hits: {
+                    size: 1,
+                    _source: esFields,
+                    sort: [{ '@timestamp': { order: 'desc' } }],
+                  },
+                },
+              },
+            },
+            successes: {
+              filter: {
+                term: {
+                  'event.outcome': 'success',
+                },
+              },
+              aggs: {
+                lastSuccess: {
+                  top_hits: {
+                    size: 1,
+                    _source: esFields,
+                    sort: [{ '@timestamp': { order: 'desc' } }],
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+    },
+    track_total_hits: false,
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/helpers.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/helpers.test.ts
new file mode 100644
index 00000000000000..c2c5bc9181c74c
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/helpers.test.ts
@@ -0,0 +1,118 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AuthenticationsEdges } from '../../../../../../common/search_strategy/security_solution/hosts/authentications';
+import { auditdFieldsMap } from './dsl/query.dsl';
+
+import { formatAuthenticationData } from './helpers';
+import { mockHit } from './__mocks__';
+
+describe('#formatAuthenticationsData', () => {
+  test('it formats a authentication with an empty set', () => {
+    const fields: readonly string[] = [''];
+    const data = formatAuthenticationData(fields, mockHit, auditdFieldsMap);
+    const expected: AuthenticationsEdges = {
+      cursor: {
+        tiebreaker: null,
+        value: 'cursor-1',
+      },
+      node: {
+        _id: 'id-123',
+        failures: 10,
+        successes: 20,
+        user: {
+          name: ['Evan'],
+        },
+      },
+    };
+
+    expect(data).toEqual(expected);
+  });
+
+  test('it formats a authentications with a source ip correctly', () => {
+    const fields: readonly string[] = ['lastSuccess.source.ip'];
+    const data = formatAuthenticationData(fields, mockHit, auditdFieldsMap);
+    const expected: AuthenticationsEdges = {
+      cursor: {
+        tiebreaker: null,
+        value: 'cursor-1',
+      },
+      node: {
+        _id: 'id-123',
+        failures: 10,
+        successes: 20,
+        user: {
+          name: ['Evan'],
+        },
+      },
+    };
+
+    expect(data).toEqual(expected);
+  });
+
+  test('it formats a authentications with a host name only', () => {
+    const fields: readonly string[] = ['lastSuccess.host.name'];
+    const data = formatAuthenticationData(fields, mockHit, auditdFieldsMap);
+    const expected: AuthenticationsEdges = {
+      cursor: {
+        tiebreaker: null,
+        value: 'cursor-1',
+      },
+      node: {
+        _id: 'id-123',
+        failures: 10,
+        successes: 20,
+        user: {
+          name: ['Evan'],
+        },
+      },
+    };
+
+    expect(data).toEqual(expected);
+  });
+
+  test('it formats a authentications with a host id only', () => {
+    const fields: readonly string[] = ['lastSuccess.host.id'];
+    const data = formatAuthenticationData(fields, mockHit, auditdFieldsMap);
+    const expected: AuthenticationsEdges = {
+      cursor: {
+        tiebreaker: null,
+        value: 'cursor-1',
+      },
+      node: {
+        _id: 'id-123',
+        failures: 10,
+        successes: 20,
+        user: {
+          name: ['Evan'],
+        },
+      },
+    };
+
+    expect(data).toEqual(expected);
+  });
+
+  test('it formats a authentications with a host name and id correctly', () => {
+    const fields: readonly string[] = ['lastSuccess.host.name', 'lastSuccess.host.id'];
+    const data = formatAuthenticationData(fields, mockHit, auditdFieldsMap);
+    const expected: AuthenticationsEdges = {
+      cursor: {
+        tiebreaker: null,
+        value: 'cursor-1',
+      },
+      node: {
+        _id: 'id-123',
+        failures: 10,
+        successes: 20,
+        user: {
+          name: ['Evan'],
+        },
+      },
+    };
+
+    expect(data).toEqual(expected);
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/helpers.ts
new file mode 100644
index 00000000000000..d61914fda7d06f
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/helpers.ts
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { get, getOr, isEmpty } from 'lodash/fp';
+import { set } from '@elastic/safer-lodash-set/fp';
+import { mergeFieldsWithHit } from '../../../../../utils/build_query';
+import { toArray } from '../../../../helpers/to_array';
+import {
+  AuthenticationsEdges,
+  AuthenticationHit,
+  AuthenticationBucket,
+  FactoryQueryTypes,
+  StrategyResponseType,
+} from '../../../../../../common/search_strategy/security_solution';
+
+export const authenticationFields = [
+  '_id',
+  'failures',
+  'successes',
+  'user.name',
+  'lastSuccess.timestamp',
+  'lastSuccess.source.ip',
+  'lastSuccess.host.id',
+  'lastSuccess.host.name',
+  'lastFailure.timestamp',
+  'lastFailure.source.ip',
+  'lastFailure.host.id',
+  'lastFailure.host.name',
+];
+
+export const formatAuthenticationData = (
+  fields: readonly string[] = authenticationFields,
+  hit: AuthenticationHit,
+  fieldMap: Readonly<Record<string, string>>
+): AuthenticationsEdges =>
+  fields.reduce<AuthenticationsEdges>(
+    (flattenedFields, fieldName) => {
+      if (hit.cursor) {
+        flattenedFields.cursor.value = hit.cursor;
+      }
+      flattenedFields.node = {
+        ...flattenedFields.node,
+        ...{
+          _id: hit._id,
+          user: { name: [hit.user] },
+          failures: hit.failures,
+          successes: hit.successes,
+        },
+      };
+      const mergedResult = mergeFieldsWithHit(fieldName, flattenedFields, fieldMap, hit);
+      const fieldPath = `node.${fieldName}`;
+      const fieldValue = get(fieldPath, mergedResult);
+      if (!isEmpty(fieldValue)) {
+        return set(fieldPath, toArray(fieldValue), mergedResult);
+      } else {
+        return mergedResult;
+      }
+    },
+    {
+      node: {
+        failures: 0,
+        successes: 0,
+        _id: '',
+        user: {
+          name: [''],
+        },
+      },
+      cursor: {
+        value: '',
+        tiebreaker: null,
+      },
+    }
+  );
+
+export const getHits = <T extends FactoryQueryTypes>(response: StrategyResponseType<T>) =>
+  getOr([], 'aggregations.group_by_users.buckets', response.rawResponse).map(
+    (bucket: AuthenticationBucket) => ({
+      _id: getOr(
+        `${bucket.key}+${bucket.doc_count}`,
+        'failures.lastFailure.hits.hits[0].id',
+        bucket
+      ),
+      _source: {
+        lastSuccess: getOr(null, 'successes.lastSuccess.hits.hits[0]._source', bucket),
+        lastFailure: getOr(null, 'failures.lastFailure.hits.hits[0]._source', bucket),
+      },
+      user: bucket.key,
+      failures: bucket.failures.doc_count,
+      successes: bucket.successes.doc_count,
+    })
+  );
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.test.tsx b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.test.tsx
new file mode 100644
index 00000000000000..9e8e2ead0ed4ae
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.test.tsx
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+
+import { HostAuthenticationsRequestOptions } from '../../../../../../common/search_strategy/security_solution/hosts/authentications';
+import * as buildQuery from './dsl/query.dsl';
+import { authentications } from '.';
+import {
+  mockOptions,
+  mockSearchStrategyResponse,
+  formattedSearchStrategyResponse,
+} from './__mocks__';
+
+describe('authentications search strategy', () => {
+  const buildAuthenticationQuery = jest.spyOn(buildQuery, 'buildQuery');
+
+  afterEach(() => {
+    buildAuthenticationQuery.mockClear();
+  });
+
+  describe('buildDsl', () => {
+    test('should build dsl query', () => {
+      authentications.buildDsl(mockOptions);
+      expect(buildAuthenticationQuery).toHaveBeenCalledWith(mockOptions);
+    });
+
+    test('should throw error if query size is greater equal than DEFAULT_MAX_TABLE_QUERY_SIZE ', () => {
+      const overSizeOptions = {
+        ...mockOptions,
+        pagination: {
+          ...mockOptions.pagination,
+          querySize: DEFAULT_MAX_TABLE_QUERY_SIZE,
+        },
+      } as HostAuthenticationsRequestOptions;
+
+      expect(() => {
+        authentications.buildDsl(overSizeOptions);
+      }).toThrowError(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    });
+  });
+
+  describe('parse', () => {
+    test('should parse data correctly', async () => {
+      const result = await authentications.parse(mockOptions, mockSearchStrategyResponse);
+      expect(result).toMatchObject(formattedSearchStrategyResponse);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.tsx b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.tsx
new file mode 100644
index 00000000000000..d5bdeac38cee56
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/index.tsx
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+import {
+  HostsQueries,
+  AuthenticationsEdges,
+  HostAuthenticationsRequestOptions,
+  HostAuthenticationsStrategyResponse,
+  AuthenticationHit,
+} from '../../../../../../common/search_strategy/security_solution/hosts';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+import { auditdFieldsMap, buildQuery as buildAuthenticationQuery } from './dsl/query.dsl';
+import { authenticationFields, formatAuthenticationData, getHits } from './helpers';
+
+export const authentications: SecuritySolutionFactory<HostsQueries.authentications> = {
+  buildDsl: (options: HostAuthenticationsRequestOptions) => {
+    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
+      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    }
+
+    return buildAuthenticationQuery(options);
+  },
+  parse: async (
+    options: HostAuthenticationsRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<HostAuthenticationsStrategyResponse> => {
+    const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
+    const totalCount = getOr(0, 'aggregations.user_count.value', response.rawResponse);
+
+    const fakeTotalCount = fakePossibleCount <= totalCount ? fakePossibleCount : totalCount;
+    const hits: AuthenticationHit[] = getHits(response);
+    const authenticationEdges: AuthenticationsEdges[] = hits.map((hit) =>
+      formatAuthenticationData(authenticationFields, hit, auditdFieldsMap)
+    );
+
+    const edges = authenticationEdges.splice(cursorStart, querySize - cursorStart);
+    const inspect = {
+      dsl: [inspectStringifyObject(buildAuthenticationQuery(options))],
+    };
+    const showMorePagesIndicator = totalCount > fakeTotalCount;
+
+    return {
+      ...response,
+      inspect,
+      edges,
+      totalCount,
+      pageInfo: {
+        activePage: activePage ? activePage : 0,
+        fakeTotalCount,
+        showMorePagesIndicator,
+      },
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
new file mode 100644
index 00000000000000..ed705e7f6ad56d
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { set } from '@elastic/safer-lodash-set/fp';
+import { get, has, head } from 'lodash/fp';
+import { hostFieldsMap } from '../../../../../../common/ecs/ecs_fields';
+import { HostItem } from '../../../../../../common/search_strategy/security_solution/hosts';
+
+import { HostAggEsItem, HostBuckets, HostValue } from '../../../../../lib/hosts/types';
+
+export const HOST_FIELDS = [
+  '_id',
+  'host.architecture',
+  'host.id',
+  'host.ip',
+  'host.id',
+  'host.mac',
+  'host.name',
+  'host.os.family',
+  'host.os.name',
+  'host.os.platform',
+  'host.os.version',
+  'host.type',
+  'cloud.instance.id',
+  'cloud.machine.type',
+  'cloud.provider',
+  'cloud.region',
+  'endpoint.endpointPolicy',
+  'endpoint.policyStatus',
+  'endpoint.sensorVersion',
+];
+
+export const formatHostItem = (bucket: HostAggEsItem): HostItem =>
+  HOST_FIELDS.reduce<HostItem>((flattenedFields, fieldName) => {
+    const fieldValue = getHostFieldValue(fieldName, bucket);
+    if (fieldValue != null) {
+      return set(fieldName, fieldValue, flattenedFields);
+    }
+    return flattenedFields;
+  }, {});
+
+const getHostFieldValue = (fieldName: string, bucket: HostAggEsItem): string | string[] | null => {
+  const aggField = hostFieldsMap[fieldName]
+    ? hostFieldsMap[fieldName].replace(/\./g, '_')
+    : fieldName.replace(/\./g, '_');
+  if (
+    [
+      'host.ip',
+      'host.mac',
+      'cloud.instance.id',
+      'cloud.machine.type',
+      'cloud.provider',
+      'cloud.region',
+    ].includes(fieldName) &&
+    has(aggField, bucket)
+  ) {
+    const data: HostBuckets = get(aggField, bucket);
+    return data.buckets.map((obj) => obj.key);
+  } else if (has(`${aggField}.buckets`, bucket)) {
+    return getFirstItem(get(`${aggField}`, bucket));
+  } else if (has(aggField, bucket)) {
+    const valueObj: HostValue = get(aggField, bucket);
+    return valueObj.value_as_string;
+  } else if (['host.name', 'host.os.name', 'host.os.version'].includes(fieldName)) {
+    switch (fieldName) {
+      case 'host.name':
+        return get('key', bucket) || null;
+      case 'host.os.name':
+        return get('os.hits.hits[0]._source.host.os.name', bucket) || null;
+      case 'host.os.version':
+        return get('os.hits.hits[0]._source.host.os.version', bucket) || null;
+    }
+  }
+  return null;
+};
+
+const getFirstItem = (data: HostBuckets): string | null => {
+  const firstItem = head(data.buckets);
+  if (firstItem == null) {
+    return null;
+  }
+  return firstItem.key;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.ts
new file mode 100644
index 00000000000000..616e4ed0bac387
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  HostAggEsData,
+  HostAggEsItem,
+  HostDetailsStrategyResponse,
+  HostsQueries,
+  HostDetailsRequestOptions,
+} from '../../../../../../common/search_strategy/security_solution/hosts';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+import { buildHostDetailsQuery } from './query.host_details.dsl';
+import { formatHostItem } from './helpers';
+
+export const hostDetails: SecuritySolutionFactory<HostsQueries.details> = {
+  buildDsl: (options: HostDetailsRequestOptions) => buildHostDetailsQuery(options),
+  parse: async (
+    options: HostDetailsRequestOptions,
+    response: IEsSearchResponse<HostAggEsData>
+  ): Promise<HostDetailsStrategyResponse> => {
+    const aggregations: HostAggEsItem = get('aggregations', response.rawResponse) || {};
+    const inspect = {
+      dsl: [inspectStringifyObject(buildHostDetailsQuery(options))],
+      response: [inspectStringifyObject(response)],
+    };
+    const formattedHostItem = formatHostItem(aggregations);
+
+    return { ...response, inspect, hostDetails: formattedHostItem };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts
new file mode 100644
index 00000000000000..ade6128f0b0528
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ISearchRequestParams } from '../../../../../../../../../src/plugins/data/common';
+import { cloudFieldsMap, hostFieldsMap } from '../../../../../../common/ecs/ecs_fields';
+import { HostDetailsRequestOptions } from '../../../../../../common/search_strategy/security_solution';
+import { buildFieldsTermAggregation } from '../../../../../lib/hosts/helpers';
+import { reduceFields } from '../../../../../utils/build_query/reduce_fields';
+import { HOST_FIELDS } from './helpers';
+
+export const buildHostDetailsQuery = ({
+  hostName,
+  defaultIndex,
+  timerange: { from, to },
+}: HostDetailsRequestOptions): ISearchRequestParams => {
+  const esFields = reduceFields(HOST_FIELDS, { ...hostFieldsMap, ...cloudFieldsMap });
+
+  const filter = [
+    { term: { 'host.name': hostName } },
+    {
+      range: {
+        '@timestamp': {
+          format: 'strict_date_optional_time',
+          gte: from,
+          lte: to,
+        },
+      },
+    },
+  ];
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: {
+        ...buildFieldsTermAggregation(esFields.filter((field) => !['@timestamp'].includes(field))),
+      },
+      query: { bool: { filter } },
+      size: 0,
+      track_total_hits: false,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/dsl/query.detail_host.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/dsl/query.detail_host.dsl.ts
deleted file mode 100644
index 5c5dec92a51001..00000000000000
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/dsl/query.detail_host.dsl.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { ISearchRequestParams } from '../../../../../../../../../src/plugins/data/common';
-import { HostOverviewRequestOptions } from '../../../../../../common/search_strategy/security_solution';
-import { cloudFieldsMap, hostFieldsMap } from '../../../../../lib/ecs_fields';
-import { buildFieldsTermAggregation } from '../../../../../lib/hosts/helpers';
-import { reduceFields } from '../../../../../utils/build_query/reduce_fields';
-
-export const buildHostOverviewQuery = ({
-  fields,
-  hostName,
-  defaultIndex,
-  timerange: { from, to },
-}: HostOverviewRequestOptions): ISearchRequestParams => {
-  const esFields = reduceFields(fields, { ...hostFieldsMap, ...cloudFieldsMap });
-
-  const filter = [
-    { term: { 'host.name': hostName } },
-    {
-      range: {
-        '@timestamp': {
-          format: 'strict_date_optional_time',
-          gte: from,
-          lte: to,
-        },
-      },
-    },
-  ];
-
-  const dslQuery = {
-    allowNoIndices: true,
-    index: defaultIndex,
-    ignoreUnavailable: true,
-    body: {
-      aggregations: {
-        ...buildFieldsTermAggregation(esFields.filter((field) => !['@timestamp'].includes(field))),
-      },
-      query: { bool: { filter } },
-      size: 0,
-      track_total_hits: false,
-    },
-  };
-
-  return dslQuery;
-};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/dsl/query.hosts.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/dsl/query.hosts.dsl.ts
deleted file mode 100644
index a9101f54ada55c..00000000000000
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/dsl/query.hosts.dsl.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { isEmpty, isString } from 'lodash/fp';
-import { ISearchRequestParams } from '../../../../../../../../../src/plugins/data/common';
-import {
-  Direction,
-  HostsRequestOptions,
-  SortField,
-} from '../../../../../../common/search_strategy/security_solution';
-import { createQueryFilterClauses } from '../../../../../utils/build_query';
-
-export const buildHostsQuery = ({
-  defaultIndex,
-  docValueFields,
-  filterQuery,
-  pagination: { querySize },
-  sort,
-  timerange: { from, to },
-}: HostsRequestOptions): ISearchRequestParams => {
-  const filter = [
-    ...createQueryFilterClauses(isString(filterQuery) ? JSON.parse(filterQuery) : filterQuery),
-    {
-      range: {
-        '@timestamp': {
-          gte: from,
-          lte: to,
-          format: 'strict_date_optional_time',
-        },
-      },
-    },
-  ];
-
-  const agg = { host_count: { cardinality: { field: 'host.name' } } };
-
-  const dslQuery = {
-    allowNoIndices: true,
-    index: defaultIndex,
-    ignoreUnavailable: true,
-    body: {
-      ...(isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
-      aggregations: {
-        ...agg,
-        host_data: {
-          terms: { size: querySize, field: 'host.name', order: getQueryOrder(sort) },
-          aggs: {
-            lastSeen: { max: { field: '@timestamp' } },
-            os: {
-              top_hits: {
-                size: 1,
-                sort: [
-                  {
-                    '@timestamp': {
-                      order: 'desc',
-                    },
-                  },
-                ],
-                _source: {
-                  includes: ['host.os.*'],
-                },
-              },
-            },
-          },
-        },
-      },
-      query: { bool: { filter } },
-      size: 0,
-      track_total_hits: false,
-    },
-  };
-
-  return dslQuery;
-};
-
-type QueryOrder = { lastSeen: Direction } | { _key: Direction };
-
-const getQueryOrder = (sort: SortField): QueryOrder => {
-  switch (sort.field) {
-    case 'lastSeen':
-      return { lastSeen: sort.direction };
-    case 'hostName':
-      return { _key: sort.direction };
-  }
-};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/helpers.ts
index a7ec822839d21a..56f7aec2327a59 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/helpers.ts
@@ -5,14 +5,16 @@
  */
 import { set } from '@elastic/safer-lodash-set/fp';
 import { get, has, head } from 'lodash/fp';
+import { hostFieldsMap } from '../../../../../common/ecs/ecs_fields';
 import {
   HostsEdges,
   HostItem,
 } from '../../../../../common/search_strategy/security_solution/hosts';
-import { hostFieldsMap } from '../../../../lib/ecs_fields';
 
 import { HostAggEsItem, HostBuckets, HostValue } from '../../../../lib/hosts/types';
 
+import { toArray } from '../../../helpers/to_array';
+
 const hostsFields = ['_id', 'lastSeen', 'host.id', 'host.name', 'host.os.name', 'host.os.version'];
 
 export const formatHostEdgesData = (bucket: HostAggEsItem): HostsEdges =>
@@ -23,11 +25,7 @@ export const formatHostEdgesData = (bucket: HostAggEsItem): HostsEdges =>
       flattenedFields.cursor.value = hostId || '';
       const fieldValue = getHostFieldValue(fieldName, bucket);
       if (fieldValue != null) {
-        return set(
-          `node.${fieldName}`,
-          Array.isArray(fieldValue) ? fieldValue : [fieldValue],
-          flattenedFields
-        );
+        return set(`node.${fieldName}`, toArray(fieldValue), flattenedFields);
       }
       return flattenedFields;
     },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/index.ts
index 443e524d71ca3b..85619cfec62ce7 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/index.ts
@@ -4,89 +4,24 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { get, getOr } from 'lodash/fp';
-
-import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
-
-import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../common/constants';
-import { FactoryQueryTypes } from '../../../../../common/search_strategy/security_solution';
 import {
-  HostsStrategyResponse,
-  HostOverviewStrategyResponse,
+  FactoryQueryTypes,
   HostsQueries,
-  HostsRequestOptions,
-  HostOverviewRequestOptions,
-} from '../../../../../common/search_strategy/security_solution/hosts';
+} from '../../../../../common/search_strategy/security_solution';
 
-// TO DO need to move all this types in common
-import { HostAggEsData, HostAggEsItem } from '../../../../lib/hosts/types';
-
-import { inspectStringifyObject } from '../../../../utils/build_query';
 import { SecuritySolutionFactory } from '../types';
-import { buildHostOverviewQuery } from './dsl/query.detail_host.dsl';
-import { buildHostsQuery } from './dsl/query.hosts.dsl';
-import { formatHostEdgesData, formatHostItem } from './helpers';
-
-export const allHosts: SecuritySolutionFactory<HostsQueries.hosts> = {
-  buildDsl: (options: HostsRequestOptions) => {
-    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
-      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
-    }
-    return buildHostsQuery(options);
-  },
-  parse: async (
-    options: HostsRequestOptions,
-    response: IEsSearchResponse<unknown>
-  ): Promise<HostsStrategyResponse> => {
-    const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
-    const totalCount = getOr(0, 'aggregations.host_count.value', response.rawResponse);
-    const buckets: HostAggEsItem[] = getOr(
-      [],
-      'aggregations.host_data.buckets',
-      response.rawResponse
-    );
-    const hostsEdges = buckets.map((bucket) => formatHostEdgesData(bucket));
-    const fakeTotalCount = fakePossibleCount <= totalCount ? fakePossibleCount : totalCount;
-    const edges = hostsEdges.splice(cursorStart, querySize - cursorStart);
-    const inspect = {
-      dsl: [inspectStringifyObject(buildHostsQuery(options))],
-      response: [inspectStringifyObject(response)],
-    };
-    const showMorePagesIndicator = totalCount > fakeTotalCount;
-
-    return {
-      ...response,
-      inspect,
-      edges,
-      totalCount,
-      pageInfo: {
-        activePage: activePage ? activePage : 0,
-        fakeTotalCount,
-        showMorePagesIndicator,
-      },
-    };
-  },
-};
-
-export const overviewHost: SecuritySolutionFactory<HostsQueries.hostOverview> = {
-  buildDsl: (options: HostOverviewRequestOptions) => {
-    return buildHostOverviewQuery(options);
-  },
-  parse: async (
-    options: HostOverviewRequestOptions,
-    response: IEsSearchResponse<HostAggEsData>
-  ): Promise<HostOverviewStrategyResponse> => {
-    const aggregations: HostAggEsItem = get('aggregations', response.rawResponse) || {};
-    const inspect = {
-      dsl: [inspectStringifyObject(buildHostOverviewQuery(options))],
-      response: [inspectStringifyObject(response)],
-    };
-    const formattedHostItem = formatHostItem(aggregations);
-    return { ...response, inspect, _id: options.hostName, ...formattedHostItem };
-  },
-};
+import { allHosts } from './all';
+import { hostDetails } from './details';
+import { hostOverview } from './overview';
+import { firstLastSeenHost } from './last_first_seen';
+import { uncommonProcesses } from './uncommon_processes';
+import { authentications } from './authentications';
 
 export const hostsFactory: Record<HostsQueries, SecuritySolutionFactory<FactoryQueryTypes>> = {
+  [HostsQueries.details]: hostDetails,
   [HostsQueries.hosts]: allHosts,
-  [HostsQueries.hostOverview]: overviewHost,
+  [HostsQueries.overview]: hostOverview,
+  [HostsQueries.firstLastSeen]: firstLastSeenHost,
+  [HostsQueries.uncommonProcesses]: uncommonProcesses,
+  [HostsQueries.authentications]: authentications,
 };
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/index.ts
new file mode 100644
index 00000000000000..56895583c2ae9b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/index.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  HostAggEsData,
+  HostAggEsItem,
+  HostFirstLastSeenStrategyResponse,
+  HostsQueries,
+  HostFirstLastSeenRequestOptions,
+} from '../../../../../../common/search_strategy/security_solution/hosts';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+import { buildFirstLastSeenHostQuery } from './query.last_first_seen_host.dsl';
+
+export const firstLastSeenHost: SecuritySolutionFactory<HostsQueries.firstLastSeen> = {
+  buildDsl: (options: HostFirstLastSeenRequestOptions) => buildFirstLastSeenHostQuery(options),
+  parse: async (
+    options: HostFirstLastSeenRequestOptions,
+    response: IEsSearchResponse<HostAggEsData>
+  ): Promise<HostFirstLastSeenStrategyResponse> => {
+    const aggregations: HostAggEsItem = get('aggregations', response.rawResponse) || {};
+    const inspect = {
+      dsl: [inspectStringifyObject(buildFirstLastSeenHostQuery(options))],
+      response: [inspectStringifyObject(response)],
+    };
+
+    return {
+      ...response,
+      inspect,
+      firstSeen: get('firstSeen.value_as_string', aggregations),
+      lastSeen: get('lastSeen.value_as_string', aggregations),
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/dsl/query.last_first_seen_host.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/query.last_first_seen_host.dsl.ts
similarity index 80%
rename from x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/dsl/query.last_first_seen_host.dsl.ts
rename to x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/query.last_first_seen_host.dsl.ts
index b57bbd2960e4fa..2c65f62b258a9f 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/dsl/query.last_first_seen_host.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/query.last_first_seen_host.dsl.ts
@@ -6,13 +6,13 @@
 
 import { isEmpty } from 'lodash/fp';
 import { ISearchRequestParams } from '../../../../../../../../../src/plugins/data/common';
-import { HostLastFirstSeenRequestOptions } from '../../../../../../common/search_strategy/security_solution';
+import { HostFirstLastSeenRequestOptions } from '../../../../../../common/search_strategy/security_solution/hosts';
 
-export const buildLastFirstSeenHostQuery = ({
+export const buildFirstLastSeenHostQuery = ({
   hostName,
   defaultIndex,
   docValueFields,
-}: HostLastFirstSeenRequestOptions): ISearchRequestParams => {
+}: HostFirstLastSeenRequestOptions): ISearchRequestParams => {
   const filter = [{ term: { 'host.name': hostName } }];
 
   const dslQuery = {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/index.ts
new file mode 100644
index 00000000000000..7a28c983ec466d
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/index.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get, getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  HostOverviewStrategyResponse,
+  HostsQueries,
+  HostOverviewRequestOptions,
+  OverviewHostHit,
+} from '../../../../../../common/search_strategy/security_solution/hosts';
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+import { buildOverviewHostQuery } from './query.overview_host.dsl';
+
+export const hostOverview: SecuritySolutionFactory<HostsQueries.overview> = {
+  buildDsl: (options: HostOverviewRequestOptions) => buildOverviewHostQuery(options),
+  parse: async (
+    options: HostOverviewRequestOptions,
+    response: IEsSearchResponse<OverviewHostHit>
+  ): Promise<HostOverviewStrategyResponse> => {
+    const aggregations: OverviewHostHit = get('aggregations', response.rawResponse) || {};
+    const inspect = {
+      dsl: [inspectStringifyObject(buildOverviewHostQuery(options))],
+    };
+
+    return {
+      ...response,
+      inspect,
+      overviewHost: {
+        auditbeatAuditd: getOr(null, 'auditd_count.doc_count', aggregations),
+        auditbeatFIM: getOr(null, 'fim_count.doc_count', aggregations),
+        auditbeatLogin: getOr(null, 'system_module.login_count.doc_count', aggregations),
+        auditbeatPackage: getOr(null, 'system_module.package_count.doc_count', aggregations),
+        auditbeatProcess: getOr(null, 'system_module.process_count.doc_count', aggregations),
+        auditbeatUser: getOr(null, 'system_module.user_count.doc_count', aggregations),
+        endgameDns: getOr(null, 'endgame_module.dns_event_count.doc_count', aggregations),
+        endgameFile: getOr(null, 'endgame_module.file_event_count.doc_count', aggregations),
+        endgameImageLoad: getOr(
+          null,
+          'endgame_module.image_load_event_count.doc_count',
+          aggregations
+        ),
+        endgameNetwork: getOr(null, 'endgame_module.network_event_count.doc_count', aggregations),
+        endgameProcess: getOr(null, 'endgame_module.process_event_count.doc_count', aggregations),
+        endgameRegistry: getOr(null, 'endgame_module.registry_event.doc_count', aggregations),
+        endgameSecurity: getOr(null, 'endgame_module.security_event_count.doc_count', aggregations),
+        filebeatSystemModule: getOr(null, 'system_module.filebeat_count.doc_count', aggregations),
+        winlogbeatSecurity: getOr(
+          null,
+          'winlog_module.security_event_count.doc_count',
+          aggregations
+        ),
+        winlogbeatMWSysmonOperational: getOr(
+          null,
+          'winlog_module.mwsysmon_operational_event_count.doc_count',
+          response
+        ),
+      },
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/query.overview_host.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/query.overview_host.dsl.ts
new file mode 100644
index 00000000000000..cbb098331e112b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/query.overview_host.dsl.ts
@@ -0,0 +1,295 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { createQueryFilterClauses } from '../../../../../utils/build_query';
+import { ISearchRequestParams } from '../../../../../../../../../src/plugins/data/common';
+import { HostOverviewRequestOptions } from '../../../../../../common/search_strategy/security_solution/hosts';
+
+export const buildOverviewHostQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+}: HostOverviewRequestOptions): ISearchRequestParams => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: {
+        auditd_count: {
+          filter: {
+            term: {
+              'event.module': 'auditd',
+            },
+          },
+        },
+        endgame_module: {
+          filter: {
+            bool: {
+              should: [
+                {
+                  term: { 'event.module': 'endpoint' },
+                },
+                {
+                  term: {
+                    'event.module': 'endgame',
+                  },
+                },
+              ],
+            },
+          },
+          aggs: {
+            dns_event_count: {
+              filter: {
+                bool: {
+                  should: [
+                    {
+                      bool: {
+                        filter: [
+                          { term: { 'network.protocol': 'dns' } },
+                          { term: { 'event.category': 'network' } },
+                        ],
+                      },
+                    },
+                    {
+                      term: {
+                        'endgame.event_type_full': 'dns_event',
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+            file_event_count: {
+              filter: {
+                bool: {
+                  should: [
+                    {
+                      term: {
+                        'event.category': 'file',
+                      },
+                    },
+                    {
+                      term: {
+                        'endgame.event_type_full': 'file_event',
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+            image_load_event_count: {
+              filter: {
+                bool: {
+                  should: [
+                    {
+                      bool: {
+                        should: [
+                          {
+                            term: {
+                              'event.category': 'library',
+                            },
+                          },
+                          {
+                            term: {
+                              'event.category': 'driver',
+                            },
+                          },
+                        ],
+                      },
+                    },
+                    {
+                      term: {
+                        'endgame.event_type_full': 'image_load_event',
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+            network_event_count: {
+              filter: {
+                bool: {
+                  should: [
+                    {
+                      bool: {
+                        filter: [
+                          {
+                            bool: {
+                              must_not: {
+                                term: { 'network.protocol': 'dns' },
+                              },
+                            },
+                          },
+                          {
+                            term: { 'event.category': 'network' },
+                          },
+                        ],
+                      },
+                    },
+                    {
+                      term: {
+                        'endgame.event_type_full': 'network_event',
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+            process_event_count: {
+              filter: {
+                bool: {
+                  should: [
+                    {
+                      term: { 'event.category': 'process' },
+                    },
+                    {
+                      term: {
+                        'endgame.event_type_full': 'process_event',
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+            registry_event: {
+              filter: {
+                bool: {
+                  should: [
+                    {
+                      term: { 'event.category': 'registry' },
+                    },
+                    {
+                      term: {
+                        'endgame.event_type_full': 'registry_event',
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+            security_event_count: {
+              filter: {
+                bool: {
+                  should: [
+                    {
+                      bool: {
+                        filter: [
+                          { term: { 'event.category': 'session' } },
+                          { term: { 'event.category': 'authentication' } },
+                        ],
+                      },
+                    },
+                    {
+                      term: {
+                        'endgame.event_type_full': 'security_event',
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+        fim_count: {
+          filter: {
+            term: {
+              'event.module': 'file_integrity',
+            },
+          },
+        },
+        winlog_module: {
+          filter: {
+            term: {
+              'agent.type': 'winlogbeat',
+            },
+          },
+          aggs: {
+            mwsysmon_operational_event_count: {
+              filter: {
+                term: {
+                  'winlog.channel': 'Microsoft-Windows-Sysmon/Operational',
+                },
+              },
+            },
+            security_event_count: {
+              filter: {
+                term: {
+                  'winlog.channel': 'Security',
+                },
+              },
+            },
+          },
+        },
+        system_module: {
+          filter: {
+            term: {
+              'event.module': 'system',
+            },
+          },
+          aggs: {
+            login_count: {
+              filter: {
+                term: {
+                  'event.dataset': 'login',
+                },
+              },
+            },
+            package_count: {
+              filter: {
+                term: {
+                  'event.dataset': 'package',
+                },
+              },
+            },
+            process_count: {
+              filter: {
+                term: {
+                  'event.dataset': 'process',
+                },
+              },
+            },
+            user_count: {
+              filter: {
+                term: {
+                  'event.dataset': 'user',
+                },
+              },
+            },
+            filebeat_count: {
+              filter: {
+                term: {
+                  'agent.type': 'filebeat',
+                },
+              },
+            },
+          },
+        },
+      },
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: false,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts
new file mode 100644
index 00000000000000..2e2d889dda1161
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts
@@ -0,0 +1,226 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createQueryFilterClauses } from '../../../../../../utils/build_query';
+import { reduceFields } from '../../../../../../utils/build_query/reduce_fields';
+import {
+  hostFieldsMap,
+  processFieldsMap,
+  userFieldsMap,
+} from '../../../../../../../common/ecs/ecs_fields';
+import { RequestOptionsPaginated } from '../../../../../../../common/search_strategy/security_solution';
+import { uncommonProcessesFields } from '../helpers';
+
+export const buildQuery = ({
+  defaultIndex,
+  filterQuery,
+  pagination: { querySize },
+  timerange: { from, to },
+}: RequestOptionsPaginated) => {
+  const processUserFields = reduceFields(uncommonProcessesFields, {
+    ...processFieldsMap,
+    ...userFieldsMap,
+  });
+  const hostFields = reduceFields(uncommonProcessesFields, hostFieldsMap);
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const agg = {
+    process_count: {
+      cardinality: {
+        field: 'process.name',
+      },
+    },
+  };
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: {
+        ...agg,
+        group_by_process: {
+          terms: {
+            size: querySize,
+            field: 'process.name',
+            order: [
+              {
+                host_count: 'asc',
+              },
+              {
+                _count: 'asc',
+              },
+              {
+                _key: 'asc',
+              },
+            ],
+          },
+          aggregations: {
+            process: {
+              top_hits: {
+                size: 1,
+                sort: [{ '@timestamp': { order: 'desc' } }],
+                _source: processUserFields,
+              },
+            },
+            host_count: {
+              cardinality: {
+                field: 'host.name',
+              },
+            },
+            hosts: {
+              terms: {
+                field: 'host.name',
+              },
+              aggregations: {
+                host: {
+                  top_hits: {
+                    size: 1,
+                    _source: hostFields,
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+      query: {
+        bool: {
+          should: [
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'agent.type': 'auditbeat',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.module': 'auditd',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.action': 'executed',
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'agent.type': 'auditbeat',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.module': 'system',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.dataset': 'process',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.action': 'process_started',
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'agent.type': 'winlogbeat',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.code': '4688',
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'winlog.event_id': 1,
+                    },
+                  },
+                  {
+                    term: {
+                      'winlog.channel': 'Microsoft-Windows-Sysmon/Operational',
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'event.type': 'process_start',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.category': 'process',
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'event.category': 'process',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.type': 'start',
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+          minimum_should_match: 1,
+          filter,
+        },
+      },
+    },
+    size: 0,
+    track_total_hits: false,
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/helpers.ts
new file mode 100644
index 00000000000000..5c3d76175b7e4a
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/helpers.ts
@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { get, getOr } from 'lodash/fp';
+import { set } from '@elastic/safer-lodash-set/fp';
+
+import { mergeFieldsWithHit } from '../../../../../utils/build_query';
+import {
+  ProcessHits,
+  UncommonProcessesEdges,
+  UncommonProcessHit,
+} from '../../../../../../common/search_strategy/security_solution/hosts/uncommon_processes';
+import { toArray } from '../../../../helpers/to_array';
+import { HostHits } from '../../../../../../common/search_strategy';
+
+export const uncommonProcessesFields = [
+  '_id',
+  'instances',
+  'process.args',
+  'process.name',
+  'user.id',
+  'user.name',
+  'hosts.name',
+];
+
+export const getHits = (buckets: readonly UncommonProcessBucket[]): readonly UncommonProcessHit[] =>
+  buckets.map((bucket: Readonly<UncommonProcessBucket>) => ({
+    _id: bucket.process.hits.hits[0]._id,
+    _index: bucket.process.hits.hits[0]._index,
+    _type: bucket.process.hits.hits[0]._type,
+    _score: bucket.process.hits.hits[0]._score,
+    _source: bucket.process.hits.hits[0]._source,
+    sort: bucket.process.hits.hits[0].sort,
+    cursor: bucket.process.hits.hits[0].cursor,
+    total: bucket.process.hits.total,
+    host: getHosts(bucket.hosts.buckets),
+  }));
+
+export interface UncommonProcessBucket {
+  key: string;
+  hosts: {
+    buckets: Array<{ key: string; host: HostHits }>;
+  };
+  process: ProcessHits;
+}
+
+export const getHosts = (buckets: ReadonlyArray<{ key: string; host: HostHits }>) =>
+  buckets.map((bucket) => {
+    const source = get('host.hits.hits[0]._source', bucket);
+    return {
+      id: [bucket.key],
+      name: get('host.name', source),
+    };
+  });
+
+export const formatUncommonProcessesData = (
+  fields: readonly string[],
+  hit: UncommonProcessHit,
+  fieldMap: Readonly<Record<string, string>>
+): UncommonProcessesEdges =>
+  fields.reduce<UncommonProcessesEdges>(
+    (flattenedFields, fieldName) => {
+      flattenedFields.node._id = hit._id;
+      flattenedFields.node.instances = getOr(0, 'total.value', hit);
+      flattenedFields.node.hosts = hit.host;
+
+      if (hit.cursor) {
+        flattenedFields.cursor.value = hit.cursor;
+      }
+
+      const mergedResult = mergeFieldsWithHit(fieldName, flattenedFields, fieldMap, hit);
+      let fieldPath = `node.${fieldName}`;
+      let fieldValue = get(fieldPath, mergedResult);
+      if (fieldPath === 'node.hosts.name') {
+        fieldPath = `node.hosts.0.name`;
+        fieldValue = get(fieldPath, mergedResult);
+      }
+      return set(fieldPath, toArray(fieldValue), mergedResult);
+    },
+    {
+      node: {
+        _id: '',
+        instances: 0,
+        process: {},
+        hosts: [],
+      },
+      cursor: {
+        value: '',
+        tiebreaker: null,
+      },
+    }
+  );
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts
new file mode 100644
index 00000000000000..fcc76eebe4cf59
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+import { HostsQueries } from '../../../../../../common/search_strategy/security_solution';
+import { processFieldsMap, userFieldsMap } from '../../../../../../common/ecs/ecs_fields';
+import {
+  HostUncommonProcessesRequestOptions,
+  HostUncommonProcessesStrategyResponse,
+} from '../../../../../../common/search_strategy/security_solution/hosts/uncommon_processes';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+
+import { SecuritySolutionFactory } from '../../types';
+import { buildQuery } from './dsl/query.dsl';
+import { formatUncommonProcessesData, getHits, uncommonProcessesFields } from './helpers';
+
+export const uncommonProcesses: SecuritySolutionFactory<HostsQueries.uncommonProcesses> = {
+  buildDsl: (options: HostUncommonProcessesRequestOptions) => {
+    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
+      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    }
+    return buildQuery(options);
+  },
+  parse: async (
+    options: HostUncommonProcessesRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<HostUncommonProcessesStrategyResponse> => {
+    const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
+    const totalCount = getOr(0, 'aggregations.process_count.value', response.rawResponse);
+    const buckets = getOr([], 'aggregations.group_by_process.buckets', response.rawResponse);
+    const hits = getHits(buckets);
+
+    const uncommonProcessesEdges = hits.map((hit) =>
+      formatUncommonProcessesData(uncommonProcessesFields, hit, {
+        ...processFieldsMap,
+        ...userFieldsMap,
+      })
+    );
+
+    const fakeTotalCount = fakePossibleCount <= totalCount ? fakePossibleCount : totalCount;
+    const edges = uncommonProcessesEdges.splice(cursorStart, querySize - cursorStart);
+    const inspect = {
+      dsl: [inspectStringifyObject(buildQuery(options))],
+      response: [inspectStringifyObject(response)],
+    };
+
+    const showMorePagesIndicator = totalCount > fakeTotalCount;
+    return {
+      ...response,
+      edges,
+      inspect,
+      pageInfo: {
+        activePage: activePage ? activePage : 0,
+        fakeTotalCount,
+        showMorePagesIndicator,
+      },
+      totalCount,
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/index.ts
index 53433dfc208cbc..338e733b23914c 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/index.ts
@@ -7,6 +7,8 @@
 import { FactoryQueryTypes } from '../../../../common/search_strategy/security_solution';
 
 import { hostsFactory } from './hosts';
+import { matrixHistogramFactory } from './matrix_histogram';
+import { networkFactory } from './network';
 import { SecuritySolutionFactory } from './types';
 
 export const securitySolutionFactory: Record<
@@ -14,4 +16,6 @@ export const securitySolutionFactory: Record<
   SecuritySolutionFactory<FactoryQueryTypes>
 > = {
   ...hostsFactory,
+  ...matrixHistogramFactory,
+  ...networkFactory,
 };
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/index.ts
new file mode 100644
index 00000000000000..6f27f298bd699f
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/index.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { buildAlertsHistogramQuery } from './query.alerts_histogram.dsl';
+
+export const alertsMatrixHistogramConfig = {
+  buildDsl: buildAlertsHistogramQuery,
+  aggName: 'aggregations.alertsGroup.buckets',
+  parseKey: 'alerts.buckets',
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.ts
new file mode 100644
index 00000000000000..6ec6a110ec3d94
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.ts
@@ -0,0 +1,100 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import moment from 'moment';
+
+import {
+  createQueryFilterClauses,
+  calculateTimeSeriesInterval,
+} from '../../../../../utils/build_query';
+import { MatrixHistogramRequestOptions } from '../../../../../../common/search_strategy/security_solution/matrix_histogram';
+
+export const buildAlertsHistogramQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+  stackByField,
+}: MatrixHistogramRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      bool: {
+        filter: [
+          {
+            bool: {
+              should: [
+                {
+                  match: {
+                    'event.kind': 'alert',
+                  },
+                },
+              ],
+              minimum_should_match: 1,
+            },
+          },
+        ],
+      },
+    },
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const getHistogramAggregation = () => {
+    const interval = calculateTimeSeriesInterval(from, to);
+    const histogramTimestampField = '@timestamp';
+    const dateHistogram = {
+      date_histogram: {
+        field: histogramTimestampField,
+        fixed_interval: interval,
+        min_doc_count: 0,
+        extended_bounds: {
+          min: moment(from).valueOf(),
+          max: moment(to).valueOf(),
+        },
+      },
+    };
+    return {
+      alertsGroup: {
+        terms: {
+          field: stackByField,
+          missing: 'All others',
+          order: {
+            _count: 'desc',
+          },
+          size: 10,
+        },
+        aggs: {
+          alerts: dateHistogram,
+        },
+      },
+    };
+  };
+
+  const dslQuery = {
+    index: defaultIndex,
+    allowNoIndices: true,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: getHistogramAggregation(),
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: true,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/index.ts
new file mode 100644
index 00000000000000..ab273d962ae941
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/index.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { buildAnomaliesHistogramQuery } from './query.anomalies_histogram.dsl';
+
+export const anomaliesMatrixHistogramConfig = {
+  buildDsl: buildAnomaliesHistogramQuery,
+  aggName: 'aggregations.anomalyActionGroup.buckets',
+  parseKey: 'anomalies.buckets',
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/query.anomalies_histogram.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/query.anomalies_histogram.dsl.ts
new file mode 100644
index 00000000000000..e7e0c4b9ab56f8
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/query.anomalies_histogram.dsl.ts
@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import moment from 'moment';
+
+import {
+  createQueryFilterClauses,
+  calculateTimeSeriesInterval,
+} from '../../../../../utils/build_query';
+import { MatrixHistogramRequestOptions } from '../../../../../../common/search_strategy/security_solution/matrix_histogram';
+
+export const buildAnomaliesHistogramQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+  stackByField = 'job_id',
+}: MatrixHistogramRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        timestamp: {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const getHistogramAggregation = () => {
+    const interval = calculateTimeSeriesInterval(from, to);
+    const histogramTimestampField = 'timestamp';
+    const dateHistogram = {
+      date_histogram: {
+        field: histogramTimestampField,
+        fixed_interval: interval,
+        min_doc_count: 0,
+        extended_bounds: {
+          min: moment(from).valueOf(),
+          max: moment(to).valueOf(),
+        },
+      },
+    };
+    return {
+      anomalyActionGroup: {
+        terms: {
+          field: stackByField,
+          order: {
+            _count: 'desc',
+          },
+          size: 10,
+        },
+        aggs: {
+          anomalies: dateHistogram,
+        },
+      },
+    };
+  };
+
+  const dslQuery = {
+    index: defaultIndex,
+    allowNoIndices: true,
+    ignoreUnavailable: true,
+    body: {
+      aggs: getHistogramAggregation(),
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: true,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/index.ts
new file mode 100644
index 00000000000000..17fb67e5fe94d6
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/index.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { buildAuthenticationsHistogramQuery } from './query.authentications_histogram.dsl';
+
+export const authenticationsMatrixHistogramConfig = {
+  buildDsl: buildAuthenticationsHistogramQuery,
+  aggName: 'aggregations.eventActionGroup.buckets',
+  parseKey: 'events.buckets',
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram.dsl.ts
new file mode 100644
index 00000000000000..a580ae7e0355f9
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram.dsl.ts
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import moment from 'moment';
+
+import {
+  createQueryFilterClauses,
+  calculateTimeSeriesInterval,
+} from '../../../../../utils/build_query';
+import { MatrixHistogramRequestOptions } from '../../../../../../common/search_strategy/security_solution/matrix_histogram';
+
+export const buildAuthenticationsHistogramQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+  stackByField = 'event.outcome',
+}: MatrixHistogramRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      bool: {
+        must: [
+          {
+            term: {
+              'event.category': 'authentication',
+            },
+          },
+        ],
+      },
+    },
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const getHistogramAggregation = () => {
+    const interval = calculateTimeSeriesInterval(from, to);
+    const histogramTimestampField = '@timestamp';
+    const dateHistogram = {
+      date_histogram: {
+        field: histogramTimestampField,
+        fixed_interval: interval,
+        min_doc_count: 0,
+        extended_bounds: {
+          min: moment(from).valueOf(),
+          max: moment(to).valueOf(),
+        },
+      },
+    };
+    return {
+      eventActionGroup: {
+        terms: {
+          field: stackByField,
+          include: ['success', 'failure'],
+          order: {
+            _count: 'desc',
+          },
+          size: 2,
+        },
+        aggs: {
+          events: dateHistogram,
+        },
+      },
+    };
+  };
+
+  const dslQuery = {
+    index: defaultIndex,
+    allowNoIndices: true,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: getHistogramAggregation(),
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: true,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/helpers.ts
new file mode 100644
index 00000000000000..d0fff848b426a9
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/helpers.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get, getOr } from 'lodash/fp';
+import {
+  MatrixHistogramData,
+  MatrixHistogramParseData,
+  DnsHistogramSubBucket,
+} from '../../../../../../common/search_strategy/security_solution/matrix_histogram';
+
+export const getDnsParsedData = <T>(
+  data: MatrixHistogramParseData<T>,
+  keyBucket: string
+): MatrixHistogramData[] => {
+  let result: MatrixHistogramData[] = [];
+  data.forEach((bucketData: unknown) => {
+    const time = get('key', bucketData);
+    const histData = getOr([], keyBucket, bucketData).map(
+      // eslint-disable-next-line @typescript-eslint/naming-convention
+      ({ key, doc_count }: DnsHistogramSubBucket) => ({
+        x: time,
+        y: doc_count,
+        g: key,
+      })
+    );
+    result = [...result, ...histData];
+  });
+  return result;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/index.ts
new file mode 100644
index 00000000000000..557e2ebf759e68
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { buildDnsHistogramQuery } from './query.dns_histogram.dsl';
+import { getDnsParsedData } from './helpers';
+
+export const dnsMatrixHistogramConfig = {
+  buildDsl: buildDnsHistogramQuery,
+  aggName: 'aggregations.NetworkDns.buckets',
+  parseKey: 'dns.buckets',
+  parser: getDnsParsedData,
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/query.dns_histogram.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/query.dns_histogram.dsl.ts
new file mode 100644
index 00000000000000..08a080865dfc06
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/query.dns_histogram.dsl.ts
@@ -0,0 +1,84 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  createQueryFilterClauses,
+  calculateTimeSeriesInterval,
+} from '../../../../../utils/build_query';
+import { MatrixHistogramRequestOptions } from '../../../../../../common/search_strategy/security_solution/matrix_histogram';
+
+export const buildDnsHistogramQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+  stackByField,
+}: MatrixHistogramRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const getHistogramAggregation = () => {
+    const interval = calculateTimeSeriesInterval(from, to);
+    const histogramTimestampField = '@timestamp';
+    const dateHistogram = {
+      date_histogram: {
+        field: histogramTimestampField,
+        fixed_interval: interval,
+      },
+    };
+
+    return {
+      NetworkDns: {
+        ...dateHistogram,
+        aggs: {
+          dns: {
+            terms: {
+              field: stackByField,
+              order: {
+                orderAgg: 'desc',
+              },
+              size: 10,
+            },
+            aggs: {
+              orderAgg: {
+                cardinality: {
+                  field: 'dns.question.name',
+                },
+              },
+            },
+          },
+        },
+      },
+    };
+  };
+
+  const dslQuery = {
+    index: defaultIndex,
+    allowNoIndices: true,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: getHistogramAggregation(),
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: true,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/index.ts
new file mode 100644
index 00000000000000..051436ee6c691f
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/index.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { buildEventsHistogramQuery } from './query.events_histogram.dsl';
+
+export const eventsMatrixHistogramConfig = {
+  buildDsl: buildEventsHistogramQuery,
+  aggName: 'aggregations.eventActionGroup.buckets',
+  parseKey: 'events.buckets',
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/query.events_histogram.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/query.events_histogram.dsl.ts
new file mode 100644
index 00000000000000..d3b85872c5f068
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/query.events_histogram.dsl.ts
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import moment from 'moment';
+
+import { showAllOthersBucket } from '../../../../../../common/constants';
+import {
+  createQueryFilterClauses,
+  calculateTimeSeriesInterval,
+} from '../../../../../utils/build_query';
+import { MatrixHistogramRequestOptions } from '../../../../../../common/search_strategy/security_solution/matrix_histogram';
+import * as i18n from './translations';
+
+export const buildEventsHistogramQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+  stackByField = 'event.action',
+}: MatrixHistogramRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const getHistogramAggregation = () => {
+    const interval = calculateTimeSeriesInterval(from, to);
+    const histogramTimestampField = '@timestamp';
+    const dateHistogram = {
+      date_histogram: {
+        field: histogramTimestampField,
+        fixed_interval: interval,
+        min_doc_count: 0,
+        extended_bounds: {
+          min: moment(from).valueOf(),
+          max: moment(to).valueOf(),
+        },
+      },
+    };
+
+    const missing =
+      stackByField != null && showAllOthersBucket.includes(stackByField)
+        ? {
+            missing: stackByField?.endsWith('.ip') ? '0.0.0.0' : i18n.ALL_OTHERS,
+          }
+        : {};
+
+    return {
+      eventActionGroup: {
+        terms: {
+          field: stackByField,
+          ...missing,
+          order: {
+            _count: 'desc',
+          },
+          size: 10,
+        },
+        aggs: {
+          events: dateHistogram,
+        },
+      },
+    };
+  };
+
+  const dslQuery = {
+    index: defaultIndex,
+    allowNoIndices: true,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: getHistogramAggregation(),
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: true,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/translations.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/translations.ts
new file mode 100644
index 00000000000000..0e46f5cff14452
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/translations.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ALL_OTHERS = i18n.translate(
+  'xpack.securitySolution.detectionEngine.alerts.histogram.allOthersGroupingLabel',
+  {
+    defaultMessage: 'All others',
+  }
+);
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/helpers.ts
new file mode 100644
index 00000000000000..f306518fc33502
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/helpers.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get, getOr } from 'lodash/fp';
+import {
+  MatrixHistogramParseData,
+  MatrixHistogramBucket,
+  MatrixHistogramData,
+} from '../../../../../common/search_strategy/security_solution/matrix_histogram';
+
+export const getGenericData = <T>(
+  data: MatrixHistogramParseData<T>,
+  keyBucket: string
+): MatrixHistogramData[] => {
+  let result: MatrixHistogramData[] = [];
+  data.forEach((bucketData: unknown) => {
+    const group = get('key', bucketData);
+    const histData = getOr([], keyBucket, bucketData).map(
+      // eslint-disable-next-line @typescript-eslint/naming-convention
+      ({ key, doc_count }: MatrixHistogramBucket) => ({
+        x: key,
+        y: doc_count,
+        g: group,
+      })
+    );
+    result = [...result, ...histData];
+  });
+
+  return result;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/index.ts
new file mode 100644
index 00000000000000..9cee2c0f1dc43e
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/index.ts
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import {
+  FactoryQueryTypes,
+  MatrixHistogramRequestOptions,
+  MatrixHistogramStrategyResponse,
+  MatrixHistogramQuery,
+  MatrixHistogramType,
+  MatrixHistogramDataConfig,
+} from '../../../../../common/search_strategy/security_solution';
+import { inspectStringifyObject } from '../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../types';
+import { getGenericData } from './helpers';
+import { alertsMatrixHistogramConfig } from './alerts';
+import { anomaliesMatrixHistogramConfig } from './anomalies';
+import { authenticationsMatrixHistogramConfig } from './authentications';
+import { dnsMatrixHistogramConfig } from './dns';
+import { eventsMatrixHistogramConfig } from './events';
+
+const matrixHistogramConfig: MatrixHistogramDataConfig = {
+  [MatrixHistogramType.alerts]: alertsMatrixHistogramConfig,
+  [MatrixHistogramType.anomalies]: anomaliesMatrixHistogramConfig,
+  [MatrixHistogramType.authentications]: authenticationsMatrixHistogramConfig,
+  [MatrixHistogramType.dns]: dnsMatrixHistogramConfig,
+  [MatrixHistogramType.events]: eventsMatrixHistogramConfig,
+};
+
+export const matrixHistogram: SecuritySolutionFactory<typeof MatrixHistogramQuery> = {
+  buildDsl: (options: MatrixHistogramRequestOptions) => {
+    const myConfig = getOr(null, options.histogramType, matrixHistogramConfig);
+    if (myConfig == null) {
+      throw new Error(`This histogram type ${options.histogramType} is unknown to the server side`);
+    }
+    return myConfig.buildDsl(options);
+  },
+  parse: async (
+    options: MatrixHistogramRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<MatrixHistogramStrategyResponse> => {
+    const myConfig = getOr(null, options.histogramType, matrixHistogramConfig);
+    if (myConfig == null) {
+      throw new Error(`This histogram type ${options.histogramType} is unknown to the server side`);
+    }
+    const totalCount = getOr(0, 'hits.total.value', response.rawResponse);
+    const matrixHistogramData = getOr([], myConfig.aggName, response.rawResponse);
+    const inspect = {
+      dsl: [inspectStringifyObject(myConfig.buildDsl(options))],
+    };
+    const dataParser = myConfig.parser ?? getGenericData;
+
+    return {
+      ...response,
+      inspect,
+      matrixHistogramData: dataParser<typeof options.histogramType>(
+        matrixHistogramData,
+        myConfig.parseKey
+      ),
+      totalCount,
+    };
+  },
+};
+
+export const matrixHistogramFactory: Record<
+  typeof MatrixHistogramQuery,
+  SecuritySolutionFactory<FactoryQueryTypes>
+> = {
+  [MatrixHistogramQuery]: matrixHistogram,
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/helpers.ts
new file mode 100644
index 00000000000000..aa242e6ece7bf2
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/helpers.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get, getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  NetworkDnsBuckets,
+  NetworkDnsEdges,
+} from '../../../../../../common/search_strategy/security_solution/network';
+
+export const getDnsEdges = (response: IEsSearchResponse<unknown>): NetworkDnsEdges[] =>
+  formatDnsEdges(getOr([], `aggregations.dns_name_query_count.buckets`, response.rawResponse));
+
+export const formatDnsEdges = (buckets: NetworkDnsBuckets[]): NetworkDnsEdges[] =>
+  buckets.map((bucket: NetworkDnsBuckets) => ({
+    node: {
+      _id: bucket.key,
+      dnsBytesIn: getOrNumber('dns_bytes_in.value', bucket),
+      dnsBytesOut: getOrNumber('dns_bytes_out.value', bucket),
+      dnsName: bucket.key,
+      queryCount: bucket.doc_count,
+      uniqueDomains: getOrNumber('unique_domains.value', bucket),
+    },
+    cursor: {
+      value: bucket.key,
+      tiebreaker: null,
+    },
+  }));
+
+const getOrNumber = (path: string, bucket: NetworkDnsBuckets) => {
+  const numb = get(path, bucket);
+  if (numb == null) {
+    return null;
+  }
+  return numb;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/index.ts
new file mode 100644
index 00000000000000..8e734ca9d1179a
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/index.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+import {
+  NetworkDnsStrategyResponse,
+  NetworkQueries,
+  NetworkDnsRequestOptions,
+  NetworkDnsEdges,
+} from '../../../../../../common/search_strategy/security_solution/network';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+
+import { getDnsEdges } from './helpers';
+import { buildDnsQuery } from './query.dns_network.dsl';
+
+export const networkDns: SecuritySolutionFactory<NetworkQueries.dns> = {
+  buildDsl: (options: NetworkDnsRequestOptions) => {
+    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
+      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    }
+    return buildDnsQuery(options);
+  },
+  parse: async (
+    options: NetworkDnsRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<NetworkDnsStrategyResponse> => {
+    const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
+    const totalCount = getOr(0, 'aggregations.dns_count.value', response.rawResponse);
+    const networkDnsEdges: NetworkDnsEdges[] = getDnsEdges(response);
+    const fakeTotalCount = fakePossibleCount <= totalCount ? fakePossibleCount : totalCount;
+    const edges = networkDnsEdges.splice(cursorStart, querySize - cursorStart);
+    const inspect = {
+      dsl: [inspectStringifyObject(buildDnsQuery(options))],
+    };
+    const showMorePagesIndicator = totalCount > fakeTotalCount;
+
+    return {
+      ...response,
+      edges,
+      inspect,
+      pageInfo: {
+        activePage: activePage ? activePage : 0,
+        fakeTotalCount,
+        showMorePagesIndicator,
+      },
+      totalCount,
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/query.dns_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/query.dns_network.dsl.ts
new file mode 100644
index 00000000000000..85b9051189bfe9
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/query.dns_network.dsl.ts
@@ -0,0 +1,134 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { isEmpty } from 'lodash/fp';
+
+import { assertUnreachable } from '../../../../../../common/utility_types';
+import {
+  Direction,
+  SortField,
+  NetworkDnsRequestOptions,
+  NetworkDnsFields,
+} from '../../../../../../common/search_strategy';
+import { createQueryFilterClauses } from '../../../../../utils/build_query';
+
+type QueryOrder =
+  | { _count: Direction }
+  | { _key: Direction }
+  | { unique_domains: Direction }
+  | { dns_bytes_in: Direction }
+  | { dns_bytes_out: Direction };
+
+const getQueryOrder = (sort: SortField<NetworkDnsFields>): QueryOrder => {
+  switch (sort.field) {
+    case NetworkDnsFields.queryCount:
+      return { _count: sort.direction };
+    case NetworkDnsFields.dnsName:
+      return { _key: sort.direction };
+    case NetworkDnsFields.uniqueDomains:
+      return { unique_domains: sort.direction };
+    case NetworkDnsFields.dnsBytesIn:
+      return { dns_bytes_in: sort.direction };
+    case NetworkDnsFields.dnsBytesOut:
+      return { dns_bytes_out: sort.direction };
+  }
+  assertUnreachable(sort.field);
+};
+
+const getCountAgg = () => ({
+  dns_count: {
+    cardinality: {
+      field: 'dns.question.registered_domain',
+    },
+  },
+});
+
+const createIncludePTRFilter = (isPtrIncluded: boolean) =>
+  isPtrIncluded
+    ? {}
+    : {
+        must_not: [
+          {
+            term: {
+              'dns.question.type': {
+                value: 'PTR',
+              },
+            },
+          },
+        ],
+      };
+
+export const buildDnsQuery = ({
+  defaultIndex,
+  docValueFields,
+  filterQuery,
+  isPtrIncluded,
+  sort,
+  pagination: { querySize },
+  stackByField = 'dns.question.registered_domain',
+  timerange: { from, to },
+}: NetworkDnsRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      ...(isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
+      aggregations: {
+        ...getCountAgg(),
+        dns_name_query_count: {
+          terms: {
+            field: stackByField,
+            size: querySize,
+            order: {
+              ...getQueryOrder(sort),
+            },
+          },
+          aggs: {
+            unique_domains: {
+              cardinality: {
+                field: 'dns.question.name',
+              },
+            },
+            dns_bytes_in: {
+              sum: {
+                field: 'source.bytes',
+              },
+            },
+            dns_bytes_out: {
+              sum: {
+                field: 'destination.bytes',
+              },
+            },
+          },
+        },
+      },
+      query: {
+        bool: {
+          filter,
+          ...createIncludePTRFilter(isPtrIncluded),
+        },
+      },
+    },
+    size: 0,
+    track_total_hits: false,
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/helpers.ts
new file mode 100644
index 00000000000000..a7fba087b87edd
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/helpers.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { assertUnreachable } from '../../../../../common/utility_types';
+import { FlowTargetSourceDest } from '../../../../../common/search_strategy/security_solution/network';
+
+export const getOppositeField = (flowTarget: FlowTargetSourceDest): FlowTargetSourceDest => {
+  switch (flowTarget) {
+    case FlowTargetSourceDest.source:
+      return FlowTargetSourceDest.destination;
+    case FlowTargetSourceDest.destination:
+      return FlowTargetSourceDest.source;
+  }
+  assertUnreachable(flowTarget);
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/helpers.ts
new file mode 100644
index 00000000000000..b8a28441337c7b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/helpers.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get, getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  NetworkHttpBuckets,
+  NetworkHttpEdges,
+} from '../../../../../../common/search_strategy/security_solution/network';
+
+export const getHttpEdges = (response: IEsSearchResponse<unknown>): NetworkHttpEdges[] =>
+  formatHttpEdges(getOr([], `aggregations.url.buckets`, response.rawResponse));
+
+const formatHttpEdges = (buckets: NetworkHttpBuckets[]): NetworkHttpEdges[] =>
+  buckets.map((bucket: NetworkHttpBuckets) => ({
+    node: {
+      _id: bucket.key,
+      domains: bucket.domains.buckets.map(({ key }) => key),
+      methods: bucket.methods.buckets.map(({ key }) => key),
+      statuses: bucket.status.buckets.map(({ key }) => `${key}`),
+      lastHost: get('source.hits.hits[0]._source.host.name', bucket),
+      lastSourceIp: get('source.hits.hits[0]._source.source.ip', bucket),
+      path: bucket.key,
+      requestCount: bucket.doc_count,
+    },
+    cursor: {
+      value: bucket.key,
+      tiebreaker: null,
+    },
+  }));
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/index.ts
new file mode 100644
index 00000000000000..c0205ccce63ccd
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/index.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+import {
+  NetworkHttpStrategyResponse,
+  NetworkQueries,
+  NetworkHttpRequestOptions,
+  NetworkHttpEdges,
+} from '../../../../../../common/search_strategy/security_solution/network';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+
+import { getHttpEdges } from './helpers';
+import { buildHttpQuery } from './query.http_network.dsl';
+
+export const networkHttp: SecuritySolutionFactory<NetworkQueries.http> = {
+  buildDsl: (options: NetworkHttpRequestOptions) => {
+    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
+      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    }
+    return buildHttpQuery(options);
+  },
+  parse: async (
+    options: NetworkHttpRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<NetworkHttpStrategyResponse> => {
+    const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
+    const totalCount = getOr(0, 'aggregations.http_count.value', response.rawResponse);
+    const networkHttpEdges: NetworkHttpEdges[] = getHttpEdges(response);
+    const fakeTotalCount = fakePossibleCount <= totalCount ? fakePossibleCount : totalCount;
+    const edges = networkHttpEdges.splice(cursorStart, querySize - cursorStart);
+    const inspect = {
+      dsl: [inspectStringifyObject(buildHttpQuery(options))],
+    };
+    const showMorePagesIndicator = totalCount > fakeTotalCount;
+
+    return {
+      ...response,
+      edges,
+      inspect,
+      pageInfo: {
+        activePage: activePage ? activePage : 0,
+        fakeTotalCount,
+        showMorePagesIndicator,
+      },
+      totalCount,
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/query.http_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/query.http_network.dsl.ts
new file mode 100644
index 00000000000000..feffe7f70afd98
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/query.http_network.dsl.ts
@@ -0,0 +1,113 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createQueryFilterClauses } from '../../../../../utils/build_query';
+
+import { NetworkHttpRequestOptions, SortField } from '../../../../../../common/search_strategy';
+
+const getCountAgg = () => ({
+  http_count: {
+    cardinality: {
+      field: 'url.path',
+    },
+  },
+});
+
+export const buildHttpQuery = ({
+  defaultIndex,
+  filterQuery,
+  sort,
+  pagination: { querySize },
+  timerange: { from, to },
+  ip,
+}: NetworkHttpRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': { gte: from, lte: to, format: 'strict_date_optional_time' },
+      },
+    },
+    { exists: { field: 'http.request.method' } },
+  ];
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: {
+        ...getCountAgg(),
+        ...getHttpAggs(sort, querySize),
+      },
+      query: {
+        bool: ip
+          ? {
+              filter,
+              should: [
+                {
+                  term: {
+                    'source.ip': ip,
+                  },
+                },
+                {
+                  term: {
+                    'destination.ip': ip,
+                  },
+                },
+              ],
+              minimum_should_match: 1,
+            }
+          : {
+              filter,
+            },
+      },
+    },
+    size: 0,
+    track_total_hits: false,
+  };
+  return dslQuery;
+};
+
+const getHttpAggs = (sortField: SortField, querySize: number) => ({
+  url: {
+    terms: {
+      field: `url.path`,
+      size: querySize,
+      order: {
+        _count: sortField.direction,
+      },
+    },
+    aggs: {
+      methods: {
+        terms: {
+          field: 'http.request.method',
+          size: 4,
+        },
+      },
+      domains: {
+        terms: {
+          field: 'url.domain',
+          size: 4,
+        },
+      },
+      status: {
+        terms: {
+          field: 'http.response.status_code',
+          size: 4,
+        },
+      },
+      source: {
+        top_hits: {
+          size: 1,
+          _source: {
+            includes: ['host.name', 'source.ip'],
+          },
+        },
+      },
+    },
+  },
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.ts
new file mode 100644
index 00000000000000..3b927b85899994
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  FactoryQueryTypes,
+  NetworkQueries,
+} from '../../../../../common/search_strategy/security_solution';
+
+import { SecuritySolutionFactory } from '../types';
+import { networkDns } from './dns';
+import { networkHttp } from './http';
+import { networkOverview } from './overview';
+import { networkTls } from './tls';
+import { networkTopCountries } from './top_countries';
+import { networkTopNFlow } from './top_n_flow';
+
+export const networkFactory: Record<NetworkQueries, SecuritySolutionFactory<FactoryQueryTypes>> = {
+  [NetworkQueries.dns]: networkDns,
+  [NetworkQueries.http]: networkHttp,
+  [NetworkQueries.overview]: networkOverview,
+  [NetworkQueries.tls]: networkTls,
+  [NetworkQueries.topCountries]: networkTopCountries,
+  [NetworkQueries.topNFlow]: networkTopNFlow,
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/index.ts
new file mode 100644
index 00000000000000..45cbbfe85bae86
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/index.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get, getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  NetworkQueries,
+  NetworkOverviewStrategyResponse,
+  NetworkOverviewRequestOptions,
+  OverviewNetworkHit,
+} from '../../../../../../common/search_strategy/security_solution/network';
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+import { buildOverviewNetworkQuery } from './query.overview_network.dsl';
+
+export const networkOverview: SecuritySolutionFactory<NetworkQueries.overview> = {
+  buildDsl: (options: NetworkOverviewRequestOptions) => buildOverviewNetworkQuery(options),
+  parse: async (
+    options: NetworkOverviewRequestOptions,
+    response: IEsSearchResponse<OverviewNetworkHit>
+  ): Promise<NetworkOverviewStrategyResponse> => {
+    const aggregations: OverviewNetworkHit = get('aggregations', response.rawResponse) || {};
+    const inspect = {
+      dsl: [inspectStringifyObject(buildOverviewNetworkQuery(options))],
+    };
+
+    return {
+      ...response,
+      inspect,
+      overviewNetwork: {
+        auditbeatSocket: getOr(null, 'unique_socket_count.doc_count', aggregations),
+        filebeatCisco: getOr(
+          null,
+          'unique_filebeat_count.unique_cisco_count.doc_count',
+          aggregations
+        ),
+        filebeatNetflow: getOr(
+          null,
+          'unique_filebeat_count.unique_netflow_count.doc_count',
+          aggregations
+        ),
+        filebeatPanw: getOr(
+          null,
+          'unique_filebeat_count.unique_panw_count.doc_count',
+          aggregations
+        ),
+        filebeatSuricata: getOr(null, 'unique_suricata_count.doc_count', aggregations),
+        filebeatZeek: getOr(null, 'unique_zeek_count.doc_count', aggregations),
+        packetbeatDNS: getOr(null, 'unique_dns_count.doc_count', aggregations),
+        packetbeatFlow: getOr(null, 'unique_flow_count.doc_count', aggregations),
+        packetbeatTLS: getOr(
+          null,
+          'unique_packetbeat_count.unique_tls_count.doc_count',
+          aggregations
+        ),
+      },
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/query.overview_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/query.overview_network.dsl.ts
new file mode 100644
index 00000000000000..7f0482644c9a4b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/query.overview_network.dsl.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { createQueryFilterClauses } from '../../../../../utils/build_query';
+import { ISearchRequestParams } from '../../../../../../../../../src/plugins/data/common';
+import { NetworkOverviewRequestOptions } from '../../../../../../common/search_strategy/security_solution/network';
+
+export const buildOverviewNetworkQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+}: NetworkOverviewRequestOptions): ISearchRequestParams => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: {
+        unique_flow_count: {
+          filter: {
+            term: { type: 'flow' },
+          },
+        },
+        unique_dns_count: {
+          filter: {
+            term: { type: 'dns' },
+          },
+        },
+        unique_suricata_count: {
+          filter: {
+            term: { 'service.type': 'suricata' },
+          },
+        },
+        unique_zeek_count: {
+          filter: {
+            term: { 'service.type': 'zeek' },
+          },
+        },
+        unique_socket_count: {
+          filter: {
+            term: { 'event.dataset': 'socket' },
+          },
+        },
+        unique_filebeat_count: {
+          filter: {
+            term: { 'agent.type': 'filebeat' },
+          },
+          aggs: {
+            unique_netflow_count: {
+              filter: {
+                term: { 'input.type': 'netflow' },
+              },
+            },
+            unique_panw_count: {
+              filter: {
+                term: { 'event.module': 'panw' },
+              },
+            },
+            unique_cisco_count: {
+              filter: {
+                term: { 'event.module': 'cisco' },
+              },
+            },
+          },
+        },
+        unique_packetbeat_count: {
+          filter: {
+            term: { 'agent.type': 'packetbeat' },
+          },
+          aggs: {
+            unique_tls_count: {
+              filter: {
+                term: { 'network.protocol': 'tls' },
+              },
+            },
+          },
+        },
+      },
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: false,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/helpers.ts
new file mode 100644
index 00000000000000..59359fd35a34eb
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/helpers.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  TlsBuckets,
+  TlsEdges,
+} from '../../../../../../common/search_strategy/security_solution/network';
+
+export const getTlsEdges = (response: IEsSearchResponse<unknown>): TlsEdges[] =>
+  formatTlsEdges(getOr([], 'aggregations.sha1.buckets', response.rawResponse));
+
+export const formatTlsEdges = (buckets: TlsBuckets[]): TlsEdges[] =>
+  buckets.map((bucket: TlsBuckets) => {
+    const edge: TlsEdges = {
+      node: {
+        _id: bucket.key,
+        subjects: bucket.subjects.buckets.map(({ key }) => key),
+        ja3: bucket.ja3.buckets.map(({ key }) => key),
+        issuers: bucket.issuers.buckets.map(({ key }) => key),
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        notAfter: bucket.not_after.buckets.map(({ key_as_string }) => key_as_string),
+      },
+      cursor: {
+        value: bucket.key,
+        tiebreaker: null,
+      },
+    };
+    return edge;
+  });
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/index.ts
new file mode 100644
index 00000000000000..32836c0ef6869e
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/index.ts
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+import {
+  NetworkTlsStrategyResponse,
+  NetworkQueries,
+  NetworkTlsRequestOptions,
+  TlsEdges,
+} from '../../../../../../common/search_strategy/security_solution/network';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+
+import { getTlsEdges } from './helpers';
+import { buildTlsQuery } from './query.tls_network.dsl';
+
+export const networkTls: SecuritySolutionFactory<NetworkQueries.tls> = {
+  buildDsl: (options: NetworkTlsRequestOptions) => {
+    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
+      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    }
+    return buildTlsQuery(options);
+  },
+  parse: async (
+    options: NetworkTlsRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<NetworkTlsStrategyResponse> => {
+    const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
+    const totalCount = getOr(0, 'aggregations.count.value', response.rawResponse);
+    const tlsEdges: TlsEdges[] = getTlsEdges(response);
+    const fakeTotalCount = fakePossibleCount <= totalCount ? fakePossibleCount : totalCount;
+    const edges = tlsEdges.splice(cursorStart, querySize - cursorStart);
+    const inspect = {
+      dsl: [inspectStringifyObject(buildTlsQuery(options))],
+      response: [inspectStringifyObject(response)],
+    };
+    const showMorePagesIndicator = totalCount > fakeTotalCount;
+
+    return {
+      ...response,
+      edges,
+      inspect,
+      pageInfo: {
+        activePage: activePage ? activePage : 0,
+        fakeTotalCount,
+        showMorePagesIndicator,
+      },
+      totalCount,
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/query.tls_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/query.tls_network.dsl.ts
new file mode 100644
index 00000000000000..6e5ba0674a0e7b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/query.tls_network.dsl.ts
@@ -0,0 +1,108 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { assertUnreachable } from '../../../../../../common/utility_types';
+import { createQueryFilterClauses } from '../../../../../utils/build_query';
+
+import {
+  NetworkTlsRequestOptions,
+  SortField,
+  Direction,
+  TlsFields,
+} from '../../../../../../common/search_strategy';
+
+const getAggs = (querySize: number, sort: SortField<TlsFields>) => ({
+  count: {
+    cardinality: {
+      field: 'tls.server.hash.sha1',
+    },
+  },
+  sha1: {
+    terms: {
+      field: 'tls.server.hash.sha1',
+      size: querySize,
+      order: {
+        ...getQueryOrder(sort),
+      },
+    },
+    aggs: {
+      issuers: {
+        terms: {
+          field: 'tls.server.issuer',
+        },
+      },
+      subjects: {
+        terms: {
+          field: 'tls.server.subject',
+        },
+      },
+      not_after: {
+        terms: {
+          field: 'tls.server.not_after',
+        },
+      },
+      ja3: {
+        terms: {
+          field: 'tls.server.ja3s',
+        },
+      },
+    },
+  },
+});
+
+export const buildTlsQuery = ({
+  ip,
+  sort,
+  filterQuery,
+  flowTarget,
+  pagination: { querySize },
+  defaultIndex,
+  timerange: { from, to },
+}: NetworkTlsRequestOptions) => {
+  const defaultFilter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': { gte: from, lte: to, format: 'strict_date_optional_time' },
+      },
+    },
+  ];
+
+  const filter = ip ? [...defaultFilter, { term: { [`${flowTarget}.ip`]: ip } }] : defaultFilter;
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      aggs: {
+        ...getAggs(querySize, sort),
+      },
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: false,
+    },
+  };
+
+  return dslQuery;
+};
+
+interface QueryOrder {
+  _key: Direction;
+}
+
+const getQueryOrder = (sort: SortField<TlsFields>): QueryOrder => {
+  switch (sort.field) {
+    case TlsFields._id:
+      return { _key: sort.direction };
+    default:
+      return assertUnreachable(sort.field);
+  }
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/helpers.ts
new file mode 100644
index 00000000000000..a8972c3d89f36c
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/helpers.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  NetworkTopCountriesBuckets,
+  NetworkTopCountriesEdges,
+  NetworkTopCountriesRequestOptions,
+  FlowTargetSourceDest,
+} from '../../../../../../common/search_strategy/security_solution/network';
+import { getOppositeField } from '../helpers';
+
+export const getTopCountriesEdges = (
+  response: IEsSearchResponse<unknown>,
+  options: NetworkTopCountriesRequestOptions
+): NetworkTopCountriesEdges[] =>
+  formatTopCountriesEdges(
+    getOr([], `aggregations.${options.flowTarget}.buckets`, response.rawResponse),
+    options.flowTarget
+  );
+
+export const formatTopCountriesEdges = (
+  buckets: NetworkTopCountriesBuckets[],
+  flowTarget: FlowTargetSourceDest
+): NetworkTopCountriesEdges[] =>
+  buckets.map((bucket: NetworkTopCountriesBuckets) => ({
+    node: {
+      _id: bucket.key,
+      [flowTarget]: {
+        country: bucket.key,
+        flows: getOr(0, 'flows.value', bucket),
+        [`${getOppositeField(flowTarget)}_ips`]: getOr(
+          0,
+          `${getOppositeField(flowTarget)}_ips.value`,
+          bucket
+        ),
+        [`${flowTarget}_ips`]: getOr(0, `${flowTarget}_ips.value`, bucket),
+      },
+      network: {
+        bytes_in: getOr(0, 'bytes_in.value', bucket),
+        bytes_out: getOr(0, 'bytes_out.value', bucket),
+      },
+    },
+    cursor: {
+      value: bucket.key,
+      tiebreaker: null,
+    },
+  }));
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/index.ts
new file mode 100644
index 00000000000000..5b0ced06f2ee9f
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/index.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+import {
+  NetworkTopCountriesStrategyResponse,
+  NetworkQueries,
+  NetworkTopCountriesRequestOptions,
+  NetworkTopCountriesEdges,
+} from '../../../../../../common/search_strategy/security_solution/network';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+
+import { getTopCountriesEdges } from './helpers';
+import { buildTopCountriesQuery } from './query.top_countries_network.dsl';
+
+export const networkTopCountries: SecuritySolutionFactory<NetworkQueries.topCountries> = {
+  buildDsl: (options: NetworkTopCountriesRequestOptions) => {
+    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
+      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    }
+    return buildTopCountriesQuery(options);
+  },
+  parse: async (
+    options: NetworkTopCountriesRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<NetworkTopCountriesStrategyResponse> => {
+    const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
+    const totalCount = getOr(0, 'aggregations.top_countries_count.value', response.rawResponse);
+    const networkTopCountriesEdges: NetworkTopCountriesEdges[] = getTopCountriesEdges(
+      response,
+      options
+    );
+    const fakeTotalCount = fakePossibleCount <= totalCount ? fakePossibleCount : totalCount;
+    const edges = networkTopCountriesEdges.splice(cursorStart, querySize - cursorStart);
+    const inspect = {
+      dsl: [inspectStringifyObject(buildTopCountriesQuery(options))],
+      response: [inspectStringifyObject(response)],
+    };
+    const showMorePagesIndicator = totalCount > fakeTotalCount;
+
+    return {
+      ...response,
+      edges,
+      inspect,
+      pageInfo: {
+        activePage: activePage ? activePage : 0,
+        fakeTotalCount,
+        showMorePagesIndicator,
+      },
+      totalCount,
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/query.top_countries_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/query.top_countries_network.dsl.ts
new file mode 100644
index 00000000000000..4f4b347e4db023
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/query.top_countries_network.dsl.ts
@@ -0,0 +1,152 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createQueryFilterClauses } from '../../../../../utils/build_query';
+import { assertUnreachable } from '../../../../../../common/utility_types';
+import {
+  Direction,
+  FlowTargetSourceDest,
+  NetworkTopTablesFields,
+  NetworkTopCountriesRequestOptions,
+  SortField,
+} from '../../../../../../common/search_strategy';
+
+const getCountAgg = (flowTarget: FlowTargetSourceDest) => ({
+  top_countries_count: {
+    cardinality: {
+      field: `${flowTarget}.geo.country_iso_code`,
+    },
+  },
+});
+
+export const buildTopCountriesQuery = ({
+  defaultIndex,
+  filterQuery,
+  flowTarget,
+  sort,
+  pagination: { querySize },
+  timerange: { from, to },
+  ip,
+}: NetworkTopCountriesRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': { gte: from, lte: to, format: 'strict_date_optional_time' },
+      },
+    },
+  ];
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: {
+        ...getCountAgg(flowTarget),
+        ...getFlowTargetAggs(sort, flowTarget, querySize),
+      },
+      query: {
+        bool: ip
+          ? {
+              filter,
+              should: [
+                {
+                  term: {
+                    [`${getOppositeField(flowTarget)}.ip`]: ip,
+                  },
+                },
+              ],
+              minimum_should_match: 1,
+            }
+          : {
+              filter,
+            },
+      },
+    },
+    size: 0,
+    track_total_hits: false,
+  };
+  return dslQuery;
+};
+
+const getFlowTargetAggs = (
+  sort: SortField<NetworkTopTablesFields>,
+  flowTarget: FlowTargetSourceDest,
+  querySize: number
+) => ({
+  [flowTarget]: {
+    terms: {
+      field: `${flowTarget}.geo.country_iso_code`,
+      size: querySize,
+      order: {
+        ...getQueryOrder(sort),
+      },
+    },
+    aggs: {
+      bytes_in: {
+        sum: {
+          field: `${getOppositeField(flowTarget)}.bytes`,
+        },
+      },
+      bytes_out: {
+        sum: {
+          field: `${flowTarget}.bytes`,
+        },
+      },
+      flows: {
+        cardinality: {
+          field: 'network.community_id',
+        },
+      },
+      source_ips: {
+        cardinality: {
+          field: 'source.ip',
+        },
+      },
+      destination_ips: {
+        cardinality: {
+          field: 'destination.ip',
+        },
+      },
+    },
+  },
+});
+
+export const getOppositeField = (flowTarget: FlowTargetSourceDest): FlowTargetSourceDest => {
+  switch (flowTarget) {
+    case FlowTargetSourceDest.source:
+      return FlowTargetSourceDest.destination;
+    case FlowTargetSourceDest.destination:
+      return FlowTargetSourceDest.source;
+  }
+  assertUnreachable(flowTarget);
+};
+
+type QueryOrder =
+  | { bytes_in: Direction }
+  | { bytes_out: Direction }
+  | { flows: Direction }
+  | { destination_ips: Direction }
+  | { source_ips: Direction };
+
+const getQueryOrder = (
+  networkTopCountriesSortField: SortField<NetworkTopTablesFields>
+): QueryOrder => {
+  switch (networkTopCountriesSortField.field) {
+    case NetworkTopTablesFields.bytes_in:
+      return { bytes_in: networkTopCountriesSortField.direction };
+    case NetworkTopTablesFields.bytes_out:
+      return { bytes_out: networkTopCountriesSortField.direction };
+    case NetworkTopTablesFields.flows:
+      return { flows: networkTopCountriesSortField.direction };
+    case NetworkTopTablesFields.destination_ips:
+      return { destination_ips: networkTopCountriesSortField.direction };
+    case NetworkTopTablesFields.source_ips:
+      return { source_ips: networkTopCountriesSortField.direction };
+  }
+  assertUnreachable(networkTopCountriesSortField.field);
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/helpers.ts
new file mode 100644
index 00000000000000..720661e12bd966
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/helpers.ts
@@ -0,0 +1,126 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { assertUnreachable } from '../../../../../../common/utility_types';
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  Direction,
+  GeoItem,
+  SortField,
+  NetworkTopNFlowBuckets,
+  NetworkTopNFlowEdges,
+  NetworkTopNFlowRequestOptions,
+  NetworkTopTablesFields,
+  FlowTargetSourceDest,
+  AutonomousSystemItem,
+} from '../../../../../../common/search_strategy';
+import { getOppositeField } from '../helpers';
+
+export const getTopNFlowEdges = (
+  response: IEsSearchResponse<unknown>,
+  options: NetworkTopNFlowRequestOptions
+): NetworkTopNFlowEdges[] =>
+  formatTopNFlowEdges(
+    getOr([], `aggregations.${options.flowTarget}.buckets`, response.rawResponse),
+    options.flowTarget
+  );
+
+const formatTopNFlowEdges = (
+  buckets: NetworkTopNFlowBuckets[],
+  flowTarget: FlowTargetSourceDest
+): NetworkTopNFlowEdges[] =>
+  buckets.map((bucket: NetworkTopNFlowBuckets) => ({
+    node: {
+      _id: bucket.key,
+      [flowTarget]: {
+        domain: bucket.domain.buckets.map((bucketDomain) => bucketDomain.key),
+        ip: bucket.key,
+        location: getGeoItem(bucket),
+        autonomous_system: getAsItem(bucket),
+        flows: getOr(0, 'flows.value', bucket),
+        [`${getOppositeField(flowTarget)}_ips`]: getOr(
+          0,
+          `${getOppositeField(flowTarget)}_ips.value`,
+          bucket
+        ),
+      },
+      network: {
+        bytes_in: getOr(0, 'bytes_in.value', bucket),
+        bytes_out: getOr(0, 'bytes_out.value', bucket),
+      },
+    },
+    cursor: {
+      value: bucket.key,
+      tiebreaker: null,
+    },
+  }));
+
+const getFlowTargetFromString = (flowAsString: string) =>
+  flowAsString === 'source' ? FlowTargetSourceDest.source : FlowTargetSourceDest.destination;
+
+const getGeoItem = (result: NetworkTopNFlowBuckets): GeoItem | null =>
+  result.location.top_geo.hits.hits.length > 0 && result.location.top_geo.hits.hits[0]._source
+    ? {
+        geo: getOr(
+          '',
+          `location.top_geo.hits.hits[0]._source.${
+            Object.keys(result.location.top_geo.hits.hits[0]._source)[0]
+          }.geo`,
+          result
+        ),
+        flowTarget: getFlowTargetFromString(
+          Object.keys(result.location.top_geo.hits.hits[0]._source)[0]
+        ),
+      }
+    : null;
+
+const getAsItem = (result: NetworkTopNFlowBuckets): AutonomousSystemItem | null =>
+  result.autonomous_system.top_as.hits.hits.length > 0 &&
+  result.autonomous_system.top_as.hits.hits[0]._source
+    ? {
+        number: getOr(
+          null,
+          `autonomous_system.top_as.hits.hits[0]._source.${
+            Object.keys(result.autonomous_system.top_as.hits.hits[0]._source)[0]
+          }.as.number`,
+          result
+        ),
+        name: getOr(
+          '',
+          `autonomous_system.top_as.hits.hits[0]._source.${
+            Object.keys(result.autonomous_system.top_as.hits.hits[0]._source)[0]
+          }.as.organization.name`,
+          result
+        ),
+      }
+    : null;
+
+type QueryOrder =
+  | { bytes_in: Direction }
+  | { bytes_out: Direction }
+  | { flows: Direction }
+  | { destination_ips: Direction }
+  | { source_ips: Direction };
+
+export const getQueryOrder = (
+  networkTopNFlowSortField: SortField<NetworkTopTablesFields>
+): QueryOrder => {
+  switch (networkTopNFlowSortField.field) {
+    case NetworkTopTablesFields.bytes_in:
+      return { bytes_in: networkTopNFlowSortField.direction };
+    case NetworkTopTablesFields.bytes_out:
+      return { bytes_out: networkTopNFlowSortField.direction };
+    case NetworkTopTablesFields.flows:
+      return { flows: networkTopNFlowSortField.direction };
+    case NetworkTopTablesFields.destination_ips:
+      return { destination_ips: networkTopNFlowSortField.direction };
+    case NetworkTopTablesFields.source_ips:
+      return { source_ips: networkTopNFlowSortField.direction };
+  }
+  assertUnreachable(networkTopNFlowSortField.field);
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/index.ts
new file mode 100644
index 00000000000000..198368d9818004
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/index.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+import {
+  NetworkTopNFlowStrategyResponse,
+  NetworkQueries,
+  NetworkTopNFlowRequestOptions,
+  NetworkTopNFlowEdges,
+} from '../../../../../../common/search_strategy/security_solution/network';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+
+import { getTopNFlowEdges } from './helpers';
+import { buildTopNFlowQuery } from './query.top_n_flow_network.dsl';
+
+export const networkTopNFlow: SecuritySolutionFactory<NetworkQueries.topNFlow> = {
+  buildDsl: (options: NetworkTopNFlowRequestOptions) => {
+    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
+      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    }
+    return buildTopNFlowQuery(options);
+  },
+  parse: async (
+    options: NetworkTopNFlowRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<NetworkTopNFlowStrategyResponse> => {
+    const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
+    const totalCount = getOr(0, 'aggregations.top_n_flow_count.value', response.rawResponse);
+    const networkTopNFlowEdges: NetworkTopNFlowEdges[] = getTopNFlowEdges(response, options);
+    const fakeTotalCount = fakePossibleCount <= totalCount ? fakePossibleCount : totalCount;
+    const edges = networkTopNFlowEdges.splice(cursorStart, querySize - cursorStart);
+    const inspect = {
+      dsl: [inspectStringifyObject(buildTopNFlowQuery(options))],
+    };
+    const showMorePagesIndicator = totalCount > fakeTotalCount;
+
+    return {
+      ...response,
+      edges,
+      inspect,
+      pageInfo: {
+        activePage: activePage ? activePage : 0,
+        fakeTotalCount,
+        showMorePagesIndicator,
+      },
+      totalCount,
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/query.top_n_flow_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/query.top_n_flow_network.dsl.ts
new file mode 100644
index 00000000000000..374dfa4d485fa7
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/query.top_n_flow_network.dsl.ts
@@ -0,0 +1,157 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  SortField,
+  FlowTargetSourceDest,
+  NetworkTopTablesFields,
+  NetworkTopNFlowRequestOptions,
+} from '../../../../../../common/search_strategy';
+import { createQueryFilterClauses } from '../../../../../utils/build_query';
+import { getOppositeField } from '../helpers';
+import { getQueryOrder } from './helpers';
+
+const getCountAgg = (flowTarget: FlowTargetSourceDest) => ({
+  top_n_flow_count: {
+    cardinality: {
+      field: `${flowTarget}.ip`,
+    },
+  },
+});
+
+export const buildTopNFlowQuery = ({
+  defaultIndex,
+  filterQuery,
+  flowTarget,
+  sort,
+  pagination: { querySize },
+  timerange: { from, to },
+  ip,
+}: NetworkTopNFlowRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': { gte: from, lte: to, format: 'strict_date_optional_time' },
+      },
+    },
+  ];
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: {
+        ...getCountAgg(flowTarget),
+        ...getFlowTargetAggs(sort, flowTarget, querySize),
+      },
+      query: {
+        bool: ip
+          ? {
+              filter,
+              should: [
+                {
+                  term: {
+                    [`${getOppositeField(flowTarget)}.ip`]: ip,
+                  },
+                },
+              ],
+              minimum_should_match: 1,
+            }
+          : {
+              filter,
+            },
+      },
+    },
+    size: 0,
+    track_total_hits: false,
+  };
+  return dslQuery;
+};
+
+const getFlowTargetAggs = (
+  sort: SortField<NetworkTopTablesFields>,
+  flowTarget: FlowTargetSourceDest,
+  querySize: number
+) => ({
+  [flowTarget]: {
+    terms: {
+      field: `${flowTarget}.ip`,
+      size: querySize,
+      order: {
+        ...getQueryOrder(sort),
+      },
+    },
+    aggs: {
+      bytes_in: {
+        sum: {
+          field: `${getOppositeField(flowTarget)}.bytes`,
+        },
+      },
+      bytes_out: {
+        sum: {
+          field: `${flowTarget}.bytes`,
+        },
+      },
+      domain: {
+        terms: {
+          field: `${flowTarget}.domain`,
+          order: {
+            timestamp: 'desc',
+          },
+        },
+        aggs: {
+          timestamp: {
+            max: {
+              field: '@timestamp',
+            },
+          },
+        },
+      },
+      location: {
+        filter: {
+          exists: {
+            field: `${flowTarget}.geo`,
+          },
+        },
+        aggs: {
+          top_geo: {
+            top_hits: {
+              _source: `${flowTarget}.geo.*`,
+              size: 1,
+            },
+          },
+        },
+      },
+      autonomous_system: {
+        filter: {
+          exists: {
+            field: `${flowTarget}.as`,
+          },
+        },
+        aggs: {
+          top_as: {
+            top_hits: {
+              _source: `${flowTarget}.as.*`,
+              size: 1,
+            },
+          },
+        },
+      },
+      flows: {
+        cardinality: {
+          field: 'network.community_id',
+        },
+      },
+      [`${getOppositeField(flowTarget)}_ips`]: {
+        cardinality: {
+          field: `${getOppositeField(flowTarget)}.ip`,
+        },
+      },
+    },
+  },
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/helpers.ts
new file mode 100644
index 00000000000000..b772dec773dceb
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/helpers.ts
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get, isEmpty, isNumber, isObject, isString } from 'lodash/fp';
+
+import { DetailItem } from '../../../../../common/search_strategy/timeline';
+import { baseCategoryFields } from '../../../../utils/beat_schema/8.0.0';
+
+export const getFieldCategory = (field: string): string => {
+  const fieldCategory = field.split('.')[0];
+  if (!isEmpty(fieldCategory) && baseCategoryFields.includes(fieldCategory)) {
+    return 'base';
+  }
+  return fieldCategory;
+};
+
+export const getDataFromHits = (
+  sources: EventSource,
+  category?: string,
+  path?: string
+): DetailItem[] =>
+  Object.keys(sources).reduce<DetailItem[]>((accumulator, source) => {
+    const item: EventSource = get(source, sources);
+    if (Array.isArray(item) || isString(item) || isNumber(item)) {
+      const field = path ? `${path}.${source}` : source;
+      const fieldCategory = getFieldCategory(field);
+
+      return [
+        ...accumulator,
+        {
+          category: fieldCategory,
+          field,
+          values: Array.isArray(item)
+            ? item.map((value) => {
+                if (isObject(value)) {
+                  return JSON.stringify(value);
+                }
+
+                return value;
+              })
+            : [item],
+          originalValue: item,
+        } as DetailItem,
+      ];
+    } else if (isObject(item)) {
+      return [
+        ...accumulator,
+        ...getDataFromHits(item, category || source, path ? `${path}.${source}` : source),
+      ];
+    }
+    return accumulator;
+  }, []);
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/index.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/index.ts
new file mode 100644
index 00000000000000..e1fabe2b4d586a
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/index.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr, merge } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import {
+  TimelineQueries,
+  TimelineDetailsStrategyResponse,
+  TimelineDetailsRequestOptions,
+} from '../../../../../common/search_strategy/timeline';
+import { inspectStringifyObject } from '../../../../utils/build_query';
+import { SecuritySolutionTimelineFactory } from '../types';
+import { buildTimelineDetailsQuery } from './query.timeline_details.dsl';
+import { getDataFromHits } from './helpers';
+
+export const timelineDetails: SecuritySolutionTimelineFactory<TimelineQueries.details> = {
+  buildDsl: (options: TimelineDetailsRequestOptions) => {
+    const { indexName, eventId, docValueFields = [] } = options;
+    return buildTimelineDetailsQuery(indexName, eventId, docValueFields);
+  },
+  parse: async (
+    options: TimelineDetailsRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<TimelineDetailsStrategyResponse> => {
+    const { indexName, eventId, docValueFields = [] } = options;
+    const sourceData = getOr({}, 'hits.hits.0._source', response.rawResponse);
+    const hitsData = getOr({}, 'hits.hits.0', response.rawResponse);
+    delete hitsData._source;
+    const inspect = {
+      dsl: [inspectStringifyObject(buildTimelineDetailsQuery(indexName, eventId, docValueFields))],
+    };
+    const data = getDataFromHits(merge(sourceData, hitsData));
+
+    return {
+      ...response,
+      data,
+      inspect,
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/query.timeline_details.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/query.timeline_details.dsl.ts
new file mode 100644
index 00000000000000..4f003c1c27ef25
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/details/query.timeline_details.dsl.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { DocValueFields } from '../../../../../common/search_strategy';
+
+export const buildTimelineDetailsQuery = (
+  indexName: string,
+  id: string,
+  docValueFields: DocValueFields[]
+) => ({
+  allowNoIndices: true,
+  index: indexName,
+  ignoreUnavailable: true,
+  body: {
+    docvalue_fields: docValueFields,
+    query: {
+      terms: {
+        _id: [id],
+      },
+    },
+  },
+  size: 1,
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/index.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/index.ts
new file mode 100644
index 00000000000000..aa4cdaeedb1317
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/index.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  TimelineFactoryQueryTypes,
+  TimelineQueries,
+} from '../../../../common/search_strategy/timeline';
+
+import { timelineDetails } from './details';
+import { SecuritySolutionTimelineFactory } from './types';
+
+export const securitySolutionTimelineFactory: Record<
+  TimelineFactoryQueryTypes,
+  SecuritySolutionTimelineFactory<TimelineFactoryQueryTypes>
+> = {
+  [TimelineQueries.details]: timelineDetails,
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/types.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/types.ts
new file mode 100644
index 00000000000000..55eddf64b68ffc
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/types.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../src/plugins/data/common';
+import {
+  TimelineFactoryQueryTypes,
+  TimelineStrategyRequestType,
+  TimelineStrategyResponseType,
+} from '../../../../common/search_strategy/timeline';
+
+export interface SecuritySolutionTimelineFactory<T extends TimelineFactoryQueryTypes> {
+  buildDsl: (options: TimelineStrategyRequestType<T>) => unknown;
+  parse: (
+    options: TimelineStrategyRequestType<T>,
+    response: IEsSearchResponse
+  ) => Promise<TimelineStrategyResponseType<T>>;
+}
diff --git a/x-pack/plugins/security_solution/server/search_strategy/timeline/index.ts b/x-pack/plugins/security_solution/server/search_strategy/timeline/index.ts
new file mode 100644
index 00000000000000..6d8505211123ba
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/timeline/index.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ISearchStrategy, PluginStart } from '../../../../../../src/plugins/data/server';
+import {
+  TimelineFactoryQueryTypes,
+  TimelineStrategyResponseType,
+  TimelineStrategyRequestType,
+} from '../../../common/search_strategy/timeline';
+import { securitySolutionTimelineFactory } from './factory';
+import { SecuritySolutionTimelineFactory } from './factory/types';
+
+export const securitySolutionTimelineSearchStrategyProvider = <T extends TimelineFactoryQueryTypes>(
+  data: PluginStart
+): ISearchStrategy<TimelineStrategyRequestType<T>, TimelineStrategyResponseType<T>> => {
+  const es = data.search.getSearchStrategy('es');
+
+  return {
+    search: async (context, request, options) => {
+      if (request.factoryQueryType == null) {
+        throw new Error('factoryQueryType is required');
+      }
+      const queryFactory: SecuritySolutionTimelineFactory<T> =
+        securitySolutionTimelineFactory[request.factoryQueryType];
+      const dsl = queryFactory.buildDsl(request);
+      const esSearchRes = await es.search(context, { ...request, params: dsl }, options);
+      return queryFactory.parse(request, esSearchRes);
+    },
+    cancel: async (context, id) => {
+      if (es.cancel) {
+        es.cancel(context, id);
+      }
+    },
+  };
+};
diff --git a/x-pack/plugins/security_solution/server/usage/detections/detections_helpers.ts b/x-pack/plugins/security_solution/server/usage/detections/detections_helpers.ts
index a6d4dc7a38e14a..5cf17af2fa9c0b 100644
--- a/x-pack/plugins/security_solution/server/usage/detections/detections_helpers.ts
+++ b/x-pack/plugins/security_solution/server/usage/detections/detections_helpers.ts
@@ -172,18 +172,12 @@ export const getMlJobsUsage = async (ml: MlPluginSetup | undefined): Promise<MlJ
 
   if (ml) {
     try {
-      const fakeRequest = { headers: {}, params: 'DummyKibanaRequest' } as KibanaRequest;
+      const fakeRequest = {} as KibanaRequest;
       const fakeSOClient = {} as SavedObjectsClient;
-      const internalMlClient = {
-        callAsCurrentUser: ml?.mlClient.callAsInternalUser,
-        callAsInternalUser: ml?.mlClient.callAsInternalUser,
-      };
-
-      const modules = await ml
-        .modulesProvider(internalMlClient, fakeRequest, fakeSOClient)
-        .listModules();
+
+      const modules = await ml.modulesProvider(fakeRequest, fakeSOClient).listModules();
       const moduleJobs = modules.flatMap((module) => module.jobs);
-      const jobs = await ml.jobServiceProvider(internalMlClient, fakeRequest).jobsSummary();
+      const jobs = await ml.jobServiceProvider(fakeRequest).jobsSummary();
 
       jobsUsage = jobs.filter(isSecurityJob).reduce((usage, job) => {
         const isElastic = moduleJobs.some((moduleJob) => moduleJob.id === job.id);
diff --git a/x-pack/plugins/security_solution/server/utils/build_validation/route_validation.test.ts b/x-pack/plugins/security_solution/server/utils/build_validation/route_validation.test.ts
index 9559e442e2159d..ffc12d2bce2612 100644
--- a/x-pack/plugins/security_solution/server/utils/build_validation/route_validation.test.ts
+++ b/x-pack/plugins/security_solution/server/utils/build_validation/route_validation.test.ts
@@ -3,84 +3,195 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
-import { buildRouteValidation } from './route_validation';
 import * as rt from 'io-ts';
 import { RouteValidationResultFactory } from 'src/core/server';
 
-describe('buildRouteValidation', () => {
-  const schema = rt.exact(
-    rt.type({
-      ids: rt.array(rt.string),
-    })
-  );
-  type Schema = rt.TypeOf<typeof schema>;
-
-  /**
-   * If your schema is using exact all the way down then the validation will
-   * catch any additional keys that should not be present within the validation
-   * when the route_validation uses the exact check.
-   */
-  const deepSchema = rt.exact(
-    rt.type({
-      topLevel: rt.exact(
-        rt.type({
-          secondLevel: rt.exact(
-            rt.type({
-              thirdLevel: rt.string,
-            })
-          ),
-        })
-      ),
-    })
-  );
-  type DeepSchema = rt.TypeOf<typeof deepSchema>;
-
-  const validationResult: RouteValidationResultFactory = {
-    ok: jest.fn().mockImplementation((validatedInput) => validatedInput),
-    badRequest: jest.fn().mockImplementation((e) => e),
-  };
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
+import { buildRouteValidation, buildRouteValidationWithExcess } from './route_validation';
 
-  test('return validation error', () => {
-    const input: Omit<Schema, 'ids'> & { id: string } = { id: 'someId' };
-    const result = buildRouteValidation(schema)(input, validationResult);
+describe('Route Validation with ', () => {
+  describe('buildRouteValidation', () => {
+    const schema = rt.exact(
+      rt.type({
+        ids: rt.array(rt.string),
+      })
+    );
+    type Schema = rt.TypeOf<typeof schema>;
 
-    expect(result).toEqual('Invalid value "undefined" supplied to "ids"');
-  });
+    /**
+     * If your schema is using exact all the way down then the validation will
+     * catch any additional keys that should not be present within the validation
+     * when the route_validation uses the exact check.
+     */
+    const deepSchema = rt.exact(
+      rt.type({
+        topLevel: rt.exact(
+          rt.type({
+            secondLevel: rt.exact(
+              rt.type({
+                thirdLevel: rt.string,
+              })
+            ),
+          })
+        ),
+      })
+    );
+    type DeepSchema = rt.TypeOf<typeof deepSchema>;
 
-  test('return validated input', () => {
-    const input: Schema = { ids: ['someId'] };
-    const result = buildRouteValidation(schema)(input, validationResult);
+    const validationResult: RouteValidationResultFactory = {
+      ok: jest.fn().mockImplementation((validatedInput) => validatedInput),
+      badRequest: jest.fn().mockImplementation((e) => e),
+    };
 
-    expect(result).toEqual(input);
-  });
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
 
-  test('returns validation error if given extra keys on input for an array', () => {
-    const input: Schema & { somethingExtra: string } = {
-      ids: ['someId'],
-      somethingExtra: 'hello',
-    };
-    const result = buildRouteValidation(schema)(input, validationResult);
-    expect(result).toEqual('invalid keys "somethingExtra"');
-  });
+    test('return validation error', () => {
+      const input: Omit<Schema, 'ids'> & { id: string } = { id: 'someId' };
+      const result = buildRouteValidation(schema)(input, validationResult);
+
+      expect(result).toEqual('Invalid value "undefined" supplied to "ids"');
+    });
+
+    test('return validated input', () => {
+      const input: Schema = { ids: ['someId'] };
+      const result = buildRouteValidation(schema)(input, validationResult);
+
+      expect(result).toEqual(input);
+    });
 
-  test('return validation input for a deep 3rd level object', () => {
-    const input: DeepSchema = { topLevel: { secondLevel: { thirdLevel: 'hello' } } };
-    const result = buildRouteValidation(deepSchema)(input, validationResult);
-    expect(result).toEqual(input);
+    test('returns validation error if given extra keys on input for an array', () => {
+      const input: Schema & { somethingExtra: string } = {
+        ids: ['someId'],
+        somethingExtra: 'hello',
+      };
+      const result = buildRouteValidation(schema)(input, validationResult);
+      expect(result).toEqual('invalid keys "somethingExtra"');
+    });
+
+    test('return validation input for a deep 3rd level object', () => {
+      const input: DeepSchema = { topLevel: { secondLevel: { thirdLevel: 'hello' } } };
+      const result = buildRouteValidation(deepSchema)(input, validationResult);
+      expect(result).toEqual(input);
+    });
+
+    test('return validation error for a deep 3rd level object that has an extra key value of "somethingElse"', () => {
+      const input: DeepSchema & {
+        topLevel: { secondLevel: { thirdLevel: string; somethingElse: string } };
+      } = {
+        topLevel: { secondLevel: { thirdLevel: 'hello', somethingElse: 'extraKey' } },
+      };
+      const result = buildRouteValidation(deepSchema)(input, validationResult);
+      expect(result).toEqual('invalid keys "somethingElse"');
+    });
   });
 
-  test('return validation error for a deep 3rd level object that has an extra key value of "somethingElse"', () => {
-    const input: DeepSchema & {
-      topLevel: { secondLevel: { thirdLevel: string; somethingElse: string } };
-    } = {
-      topLevel: { secondLevel: { thirdLevel: 'hello', somethingElse: 'extraKey' } },
+  describe('buildRouteValidationwithExcess', () => {
+    const schema = rt.type({
+      ids: rt.array(rt.string),
+    });
+    type Schema = rt.TypeOf<typeof schema>;
+
+    /**
+     * If your schema is using exact all the way down then the validation will
+     * catch any additional keys that should not be present within the validation
+     * when the route_validation uses the exact check.
+     */
+    const deepSchema = rt.type({
+      topLevel: rt.type({
+        secondLevel: rt.type({
+          thirdLevel: rt.string,
+        }),
+      }),
+    });
+    type DeepSchema = rt.TypeOf<typeof deepSchema>;
+
+    const validationResult: RouteValidationResultFactory = {
+      ok: jest.fn().mockImplementation((validatedInput) => validatedInput),
+      badRequest: jest.fn().mockImplementation((e) => e),
     };
-    const result = buildRouteValidation(deepSchema)(input, validationResult);
-    expect(result).toEqual('invalid keys "somethingElse"');
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    test('return validation error', () => {
+      const input: Omit<Schema, 'ids'> & { id: string } = { id: 'someId' };
+      const result = buildRouteValidationWithExcess(schema)(input, validationResult);
+
+      expect(result).toEqual('Invalid value {"id":"someId"}, excess properties: ["id"]');
+    });
+
+    test('return validation error with intersection', () => {
+      const schemaI = rt.intersection([
+        rt.type({
+          ids: rt.array(rt.string),
+        }),
+        rt.partial({
+          valid: rt.array(rt.string),
+        }),
+      ]);
+      type SchemaI = rt.TypeOf<typeof schemaI>;
+      const input: Omit<SchemaI, 'ids'> & { id: string } = { id: 'someId', valid: ['yes'] };
+      const result = buildRouteValidationWithExcess(schemaI)(input, validationResult);
+
+      expect(result).toEqual(
+        'Invalid value {"id":"someId","valid":["yes"]}, excess properties: ["id"]'
+      );
+    });
+
+    test('return NO validation error with a partial intersection', () => {
+      const schemaI = rt.intersection([
+        rt.type({
+          id: rt.array(rt.string),
+        }),
+        rt.partial({
+          valid: rt.array(rt.string),
+        }),
+      ]);
+      const input = { id: ['someId'] };
+      const result = buildRouteValidationWithExcess(schemaI)(input, validationResult);
+
+      expect(result).toEqual({ id: ['someId'] });
+    });
+
+    test('return validated input', () => {
+      const input: Schema = { ids: ['someId'] };
+      const result = buildRouteValidationWithExcess(schema)(input, validationResult);
+
+      expect(result).toEqual(input);
+    });
+
+    test('returns validation error if given extra keys on input for an array', () => {
+      const input: Schema & { somethingExtra: string } = {
+        ids: ['someId'],
+        somethingExtra: 'hello',
+      };
+      const result = buildRouteValidationWithExcess(schema)(input, validationResult);
+      expect(result).toEqual(
+        'Invalid value {"ids":["someId"],"somethingExtra":"hello"}, excess properties: ["somethingExtra"]'
+      );
+    });
+
+    test('return validation input for a deep 3rd level object', () => {
+      const input: DeepSchema = { topLevel: { secondLevel: { thirdLevel: 'hello' } } };
+      const result = buildRouteValidationWithExcess(deepSchema)(input, validationResult);
+      expect(result).toEqual(input);
+    });
+
+    test('return validation error for a deep 3rd level object that has an extra key value of "somethingElse"', () => {
+      const input: DeepSchema & {
+        topLevel: { secondLevel: { thirdLevel: string; somethingElse: string } };
+      } = {
+        topLevel: { secondLevel: { thirdLevel: 'hello', somethingElse: 'extraKey' } },
+      };
+      const result = buildRouteValidationWithExcess(deepSchema)(input, validationResult);
+      expect(result).toEqual(
+        'Invalid value {"topLevel":{"secondLevel":{"thirdLevel":"hello","somethingElse":"extraKey"}}}, excess properties: ["somethingElse"]'
+      );
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/server/utils/build_validation/route_validation.ts b/x-pack/plugins/security_solution/server/utils/build_validation/route_validation.ts
index d7ab9affa6c1c1..51f807d6aad818 100644
--- a/x-pack/plugins/security_solution/server/utils/build_validation/route_validation.ts
+++ b/x-pack/plugins/security_solution/server/utils/build_validation/route_validation.ts
@@ -14,6 +14,7 @@ import {
   RouteValidationResultFactory,
   RouteValidationError,
 } from '../../../../../../src/core/server';
+import { excess, GenericIntersectionC } from '../runtime_types';
 
 type RequestValidationResult<T> =
   | {
@@ -39,3 +40,20 @@ export const buildRouteValidation = <T extends rt.Mixed, A = rt.TypeOf<T>>(
       (validatedInput: A) => validationResult.ok(validatedInput)
     )
   );
+
+export const buildRouteValidationWithExcess = <
+  T extends rt.InterfaceType<rt.Props> | GenericIntersectionC | rt.PartialType<rt.Props>,
+  A = rt.TypeOf<T>
+>(
+  schema: T
+): RouteValidationFunction<A> => (
+  inputValue: unknown,
+  validationResult: RouteValidationResultFactory
+) =>
+  pipe(
+    excess(schema).decode(inputValue),
+    fold<rt.Errors, A, RequestValidationResult<A>>(
+      (errors: rt.Errors) => validationResult.badRequest(formatErrors(errors).join()),
+      (validatedInput: A) => validationResult.ok(validatedInput)
+    )
+  );
diff --git a/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts b/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts
index 0eb021bfe2a83d..4446e82f99de46 100644
--- a/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts
+++ b/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts
@@ -16,7 +16,7 @@ import {
   ImportRulesSchema,
 } from '../../../common/detection_engine/schemas/request/import_rules_schema';
 import { exactCheck } from '../../../common/exact_check';
-import { createMapStream, createFilterStream } from '../../../../../../src/legacy/utils/streams';
+import { createMapStream, createFilterStream } from '../../../../../../src/core/server/utils';
 import { BadRequestError } from '../../lib/detection_engine/errors/bad_request_error';
 
 export interface RulesObjectsExportResultDetails {
diff --git a/x-pack/plugins/security_solution/server/utils/runtime_types.ts b/x-pack/plugins/security_solution/server/utils/runtime_types.ts
new file mode 100644
index 00000000000000..7177cc5765f8a5
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/utils/runtime_types.ts
@@ -0,0 +1,130 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { either, fold } from 'fp-ts/lib/Either';
+import { identity } from 'fp-ts/lib/function';
+import { pipe } from 'fp-ts/lib/pipeable';
+import * as rt from 'io-ts';
+import { failure } from 'io-ts/lib/PathReporter';
+import get from 'lodash/get';
+
+type ErrorFactory = (message: string) => Error;
+
+export type GenericIntersectionC =
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  | rt.IntersectionC<[any, any]>
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  | rt.IntersectionC<[any, any, any]>
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  | rt.IntersectionC<[any, any, any, any]>
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  | rt.IntersectionC<[any, any, any, any, any]>;
+
+export const createPlainError = (message: string) => new Error(message);
+
+export const throwErrors = (createError: ErrorFactory) => (errors: rt.Errors) => {
+  throw createError(failure(errors).join('\n'));
+};
+
+export const decodeOrThrow = <A, O, I>(
+  runtimeType: rt.Type<A, O, I>,
+  createError: ErrorFactory = createPlainError
+) => (inputValue: I) =>
+  pipe(runtimeType.decode(inputValue), fold(throwErrors(createError), identity));
+
+const getProps = (
+  codec:
+    | rt.HasProps
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    | rt.RecordC<rt.StringC, any>
+    | GenericIntersectionC
+): rt.Props | null => {
+  if (codec == null) {
+    return null;
+  }
+  switch (codec._tag) {
+    case 'DictionaryType':
+      if (codec.codomain.props != null) {
+        return codec.codomain.props;
+      }
+      const dTypes: rt.HasProps[] = codec.codomain.types;
+      return dTypes.reduce<rt.Props>((props, type) => Object.assign(props, getProps(type)), {});
+    case 'RefinementType':
+    case 'ReadonlyType':
+      return getProps(codec.type);
+    case 'InterfaceType':
+    case 'StrictType':
+    case 'PartialType':
+      return codec.props;
+    case 'IntersectionType':
+      const iTypes = codec.types as rt.HasProps[];
+      return iTypes.reduce<rt.Props>((props, type) => {
+        return Object.assign(props, getProps(type) as rt.Props);
+      }, {} as rt.Props) as rt.Props;
+    default:
+      return null;
+  }
+};
+
+const getExcessProps = (
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  props: rt.Props | rt.RecordC<rt.StringC, any>,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  r: any
+): string[] => {
+  return Object.keys(r).reduce<string[]>((acc, k) => {
+    const codecChildren = get(props, [k]);
+    const childrenProps = getProps(codecChildren);
+    const childrenObject = r[k] as Record<string, unknown>;
+    if (codecChildren != null && childrenProps != null && codecChildren._tag === 'DictionaryType') {
+      const keys = Object.keys(childrenObject);
+      return [
+        ...acc,
+        ...keys.reduce<string[]>(
+          (kAcc, i) => [...kAcc, ...getExcessProps(childrenProps, childrenObject[i])],
+          []
+        ),
+      ];
+    }
+    if (codecChildren != null && childrenProps != null) {
+      return [...acc, ...getExcessProps(childrenProps, childrenObject)];
+    } else if (codecChildren == null) {
+      return [...acc, k];
+    }
+    return acc;
+  }, []);
+};
+
+export const excess = <
+  C extends rt.InterfaceType<rt.Props> | GenericIntersectionC | rt.PartialType<rt.Props>
+>(
+  codec: C
+): C => {
+  const codecProps = getProps(codec);
+
+  const r = new rt.InterfaceType(
+    codec.name,
+    codec.is,
+    (i, c) =>
+      either.chain(rt.UnknownRecord.validate(i, c), (s) => {
+        if (codecProps == null) {
+          return rt.failure(i, c, 'unknown codec');
+        }
+        const ex = getExcessProps(codecProps, s);
+
+        return ex.length > 0
+          ? rt.failure(
+              i,
+              c,
+              `Invalid value ${JSON.stringify(i)}, excess properties: ${JSON.stringify(ex)}`
+            )
+          : codec.validate(i, c);
+      }),
+    codec.encode,
+    codecProps
+  );
+  return r as C;
+};
diff --git a/x-pack/plugins/snapshot_restore/__jest__/client_integration/home.test.ts b/x-pack/plugins/snapshot_restore/__jest__/client_integration/home.test.ts
index 0abc47686a6b4b..6021ab2a42c90e 100644
--- a/x-pack/plugins/snapshot_restore/__jest__/client_integration/home.test.ts
+++ b/x-pack/plugins/snapshot_restore/__jest__/client_integration/home.test.ts
@@ -20,13 +20,6 @@ import { REPOSITORY_NAME } from './helpers/constant';
 
 const { setup } = pageHelpers.home;
 
-jest.mock('ui/new_platform');
-
-jest.mock('ui/i18n', () => {
-  const I18nContext = ({ children }: any) => children;
-  return { I18nContext };
-});
-
 // Mocking FormattedDate and FormattedTime due to timezone differences on CI
 jest.mock('@kbn/i18n/react', () => {
   const original = jest.requireActual('@kbn/i18n/react');
diff --git a/x-pack/plugins/snapshot_restore/__jest__/client_integration/policy_add.test.ts b/x-pack/plugins/snapshot_restore/__jest__/client_integration/policy_add.test.ts
index f480e937f162a8..dc568161d4fb4f 100644
--- a/x-pack/plugins/snapshot_restore/__jest__/client_integration/policy_add.test.ts
+++ b/x-pack/plugins/snapshot_restore/__jest__/client_integration/policy_add.test.ts
@@ -17,11 +17,6 @@ import { DEFAULT_POLICY_SCHEDULE } from '../../public/application/constants';
 
 const { setup } = pageHelpers.policyAdd;
 
-jest.mock('ui/i18n', () => {
-  const I18nContext = ({ children }: any) => children;
-  return { I18nContext };
-});
-
 // mock for EuiSelectable's virtualization
 jest.mock('react-virtualized-auto-sizer', () => {
   return ({
diff --git a/x-pack/plugins/snapshot_restore/__jest__/client_integration/policy_edit.test.ts b/x-pack/plugins/snapshot_restore/__jest__/client_integration/policy_edit.test.ts
index 7eec80890ca86a..a5b2ec73b85cd1 100644
--- a/x-pack/plugins/snapshot_restore/__jest__/client_integration/policy_edit.test.ts
+++ b/x-pack/plugins/snapshot_restore/__jest__/client_integration/policy_edit.test.ts
@@ -18,11 +18,6 @@ const { setup: setupPolicyAdd } = pageHelpers.policyAdd;
 const EXPIRE_AFTER_VALUE = '5';
 const EXPIRE_AFTER_UNIT = TIME_UNITS.MINUTE;
 
-jest.mock('ui/i18n', () => {
-  const I18nContext = ({ children }: any) => children;
-  return { I18nContext };
-});
-
 describe('<PolicyEdit />', () => {
   let testBed: PolicyFormTestBed;
   let testBedPolicyAdd: PolicyFormTestBed;
diff --git a/x-pack/plugins/snapshot_restore/__jest__/client_integration/repository_add.test.ts b/x-pack/plugins/snapshot_restore/__jest__/client_integration/repository_add.test.ts
index 2a9e17a1c9c4dd..e0c9aeffa09e8d 100644
--- a/x-pack/plugins/snapshot_restore/__jest__/client_integration/repository_add.test.ts
+++ b/x-pack/plugins/snapshot_restore/__jest__/client_integration/repository_add.test.ts
@@ -11,16 +11,9 @@ import { RepositoryType } from '../../common/types';
 import { setupEnvironment, pageHelpers, nextTick } from './helpers';
 import { RepositoryAddTestBed } from './helpers/repository_add.helpers';
 
-jest.mock('ui/new_platform');
-
 const { setup } = pageHelpers.repositoryAdd;
 const repositoryTypes = ['fs', 'url', 'source', 'azure', 'gcs', 's3', 'hdfs'];
 
-jest.mock('ui/i18n', () => {
-  const I18nContext = ({ children }: any) => children;
-  return { I18nContext };
-});
-
 describe('<RepositoryAdd />', () => {
   let testBed: RepositoryAddTestBed;
 
diff --git a/x-pack/plugins/snapshot_restore/__jest__/client_integration/repository_edit.test.ts b/x-pack/plugins/snapshot_restore/__jest__/client_integration/repository_edit.test.ts
index bab276584966bb..1606db07b57b47 100644
--- a/x-pack/plugins/snapshot_restore/__jest__/client_integration/repository_edit.test.ts
+++ b/x-pack/plugins/snapshot_restore/__jest__/client_integration/repository_edit.test.ts
@@ -12,16 +12,9 @@ import { RepositoryEditTestSubjects } from './helpers/repository_edit.helpers';
 import { RepositoryAddTestSubjects } from './helpers/repository_add.helpers';
 import { REPOSITORY_EDIT } from './helpers/constant';
 
-jest.mock('ui/new_platform');
-
 const { setup } = pageHelpers.repositoryEdit;
 const { setup: setupRepositoryAdd } = pageHelpers.repositoryAdd;
 
-jest.mock('ui/i18n', () => {
-  const I18nContext = ({ children }: any) => children;
-  return { I18nContext };
-});
-
 describe('<RepositoryEdit />', () => {
   let testBed: TestBed<RepositoryEditTestSubjects>;
   let testBedRepositoryAdd: TestBed<RepositoryAddTestSubjects>;
diff --git a/x-pack/plugins/snapshot_restore/common/lib/snapshot_serialization.test.ts b/x-pack/plugins/snapshot_restore/common/lib/snapshot_serialization.test.ts
index 473a3392deb3ee..e5d8e804691a8f 100644
--- a/x-pack/plugins/snapshot_restore/common/lib/snapshot_serialization.test.ts
+++ b/x-pack/plugins/snapshot_restore/common/lib/snapshot_serialization.test.ts
@@ -4,55 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { deserializeSnapshotDetails } from './snapshot_serialization';
+import { deserializeSnapshotDetails, serializeSnapshotConfig } from './snapshot_serialization';
 
-describe('deserializeSnapshotDetails', () => {
-  test('deserializes a snapshot', () => {
-    expect(
-      deserializeSnapshotDetails(
-        'repositoryName',
-        {
-          snapshot: 'snapshot name',
-          uuid: 'UUID',
-          version_id: 5,
-          version: 'version',
-          indices: ['index2', 'index3', 'index1'],
-          include_global_state: false,
-          state: 'SUCCESS',
-          start_time: '0',
-          start_time_in_millis: 0,
-          end_time: '1',
-          end_time_in_millis: 1,
-          duration_in_millis: 1,
-          shards: {
-            total: 3,
-            failed: 1,
-            successful: 2,
-          },
-          failures: [
-            {
-              index: 'z',
-              shard: 1,
-            },
-            {
-              index: 'a',
-              shard: 3,
-            },
-            {
-              index: 'a',
-              shard: 1,
-            },
-            {
-              index: 'a',
-              shard: 2,
-            },
-          ],
-        },
-        'found-snapshots',
-        [
+describe('Snapshot serialization and deserialization', () => {
+  describe('deserializeSnapshotDetails', () => {
+    test('deserializes a snapshot', () => {
+      expect(
+        deserializeSnapshotDetails(
+          'repositoryName',
           {
-            snapshot: 'last_successful_snapshot',
-            uuid: 'last_successful_snapshot_UUID',
+            snapshot: 'snapshot name',
+            uuid: 'UUID',
             version_id: 5,
             version: 'version',
             indices: ['index2', 'index3', 'index1'],
@@ -87,56 +49,109 @@ describe('deserializeSnapshotDetails', () => {
               },
             ],
           },
-        ]
-      )
-    ).toEqual({
-      repository: 'repositoryName',
-      snapshot: 'snapshot name',
-      uuid: 'UUID',
-      versionId: 5,
-      version: 'version',
-      // Indices are sorted.
-      indices: ['index1', 'index2', 'index3'],
-      dataStreams: [],
-      includeGlobalState: false,
-      // Failures are grouped and sorted by index, and the failures themselves are sorted by shard.
-      indexFailures: [
-        {
-          index: 'a',
-          failures: [
+          'found-snapshots',
+          [
             {
-              shard: 1,
-            },
-            {
-              shard: 2,
-            },
-            {
-              shard: 3,
-            },
-          ],
-        },
-        {
-          index: 'z',
-          failures: [
-            {
-              shard: 1,
+              snapshot: 'last_successful_snapshot',
+              uuid: 'last_successful_snapshot_UUID',
+              version_id: 5,
+              version: 'version',
+              indices: ['index2', 'index3', 'index1'],
+              include_global_state: false,
+              state: 'SUCCESS',
+              start_time: '0',
+              start_time_in_millis: 0,
+              end_time: '1',
+              end_time_in_millis: 1,
+              duration_in_millis: 1,
+              shards: {
+                total: 3,
+                failed: 1,
+                successful: 2,
+              },
+              failures: [
+                {
+                  index: 'z',
+                  shard: 1,
+                },
+                {
+                  index: 'a',
+                  shard: 3,
+                },
+                {
+                  index: 'a',
+                  shard: 1,
+                },
+                {
+                  index: 'a',
+                  shard: 2,
+                },
+              ],
             },
-          ],
+          ]
+        )
+      ).toEqual({
+        repository: 'repositoryName',
+        snapshot: 'snapshot name',
+        uuid: 'UUID',
+        versionId: 5,
+        version: 'version',
+        // Indices are sorted.
+        indices: ['index1', 'index2', 'index3'],
+        dataStreams: [],
+        includeGlobalState: false,
+        // Failures are grouped and sorted by index, and the failures themselves are sorted by shard.
+        indexFailures: [
+          {
+            index: 'a',
+            failures: [
+              {
+                shard: 1,
+              },
+              {
+                shard: 2,
+              },
+              {
+                shard: 3,
+              },
+            ],
+          },
+          {
+            index: 'z',
+            failures: [
+              {
+                shard: 1,
+              },
+            ],
+          },
+        ],
+        state: 'SUCCESS',
+        startTime: '0',
+        startTimeInMillis: 0,
+        endTime: '1',
+        endTimeInMillis: 1,
+        durationInMillis: 1,
+        shards: {
+          total: 3,
+          failed: 1,
+          successful: 2,
         },
-      ],
-      state: 'SUCCESS',
-      startTime: '0',
-      startTimeInMillis: 0,
-      endTime: '1',
-      endTimeInMillis: 1,
-      durationInMillis: 1,
-      shards: {
-        total: 3,
-        failed: 1,
-        successful: 2,
-      },
-      managedRepository: 'found-snapshots',
-      isLastSuccessfulSnapshot: false,
+        managedRepository: 'found-snapshots',
+        isLastSuccessfulSnapshot: false,
+      });
+    });
+  });
+
+  describe('serializeSnapshotConfig', () => {
+    test('serializes config as expected', () => {
+      const metadata = { test: 'what have you' };
+      expect(serializeSnapshotConfig({ metadata, indices: '.k*' })).toEqual({
+        metadata,
+        indices: ['.k*'],
+      });
+    });
+    test('serializes empty config as expected', () => {
+      expect(serializeSnapshotConfig({})).toEqual({});
     });
   });
 });
diff --git a/x-pack/plugins/snapshot_restore/common/lib/snapshot_serialization.ts b/x-pack/plugins/snapshot_restore/common/lib/snapshot_serialization.ts
index a85b49430eecd5..61a57c9288f033 100644
--- a/x-pack/plugins/snapshot_restore/common/lib/snapshot_serialization.ts
+++ b/x-pack/plugins/snapshot_restore/common/lib/snapshot_serialization.ts
@@ -131,10 +131,10 @@ export function deserializeSnapshotConfig(snapshotConfigEs: SnapshotConfigEs): S
 export function serializeSnapshotConfig(snapshotConfig: SnapshotConfig): SnapshotConfigEs {
   const { indices, ignoreUnavailable, includeGlobalState, partial, metadata } = snapshotConfig;
 
-  const indicesArray = csvToArray(indices);
+  const maybeIndicesArray = csvToArray(indices);
 
   const snapshotConfigEs: SnapshotConfigEs = {
-    indices: indicesArray,
+    indices: maybeIndicesArray,
     ignore_unavailable: ignoreUnavailable,
     include_global_state: includeGlobalState,
     partial,
diff --git a/x-pack/plugins/snapshot_restore/common/lib/utils.ts b/x-pack/plugins/snapshot_restore/common/lib/utils.ts
index 96eb7cb6908d89..3d07aa8de3a558 100644
--- a/x-pack/plugins/snapshot_restore/common/lib/utils.ts
+++ b/x-pack/plugins/snapshot_restore/common/lib/utils.ts
@@ -4,10 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export const csvToArray = (indices?: string | string[]): string[] => {
+export const csvToArray = (indices?: string | string[]): string[] | undefined => {
   return indices && Array.isArray(indices)
     ? indices
     : typeof indices === 'string'
     ? indices.split(',')
-    : [];
+    : undefined;
 };
diff --git a/x-pack/plugins/snapshot_restore/public/application/components/collapsible_lists/use_collapsible_list.ts b/x-pack/plugins/snapshot_restore/public/application/components/collapsible_lists/use_collapsible_list.ts
index 275915c5760afd..7ec34dd7b3984a 100644
--- a/x-pack/plugins/snapshot_restore/public/application/components/collapsible_lists/use_collapsible_list.ts
+++ b/x-pack/plugins/snapshot_restore/public/application/components/collapsible_lists/use_collapsible_list.ts
@@ -24,7 +24,7 @@ const maximumItemPreviewCount = 10;
 
 export const useCollapsibleList = ({ items }: Arg): ReturnValue => {
   const [isShowingFullList, setIsShowingFullList] = useState<boolean>(false);
-  const itemsArray = csvToArray(items);
+  const itemsArray = csvToArray(items) ?? [];
   const displayItems: ChildItems =
     items === undefined
       ? 'all'
diff --git a/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_retention.tsx b/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_retention.tsx
index ae22464c8a52b7..407b9be14e3c1b 100644
--- a/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_retention.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_retention.tsx
@@ -35,11 +35,17 @@ export const PolicyStepRetention: React.FunctionComponent<StepProps> = ({
 }) => {
   const { retention = {} } = policy;
 
-  const updatePolicyRetention = (updatedFields: Partial<SlmPolicyPayload['retention']>): void => {
+  const updatePolicyRetention = (
+    updatedFields: Partial<SlmPolicyPayload['retention']>,
+    validationHelperData = {}
+  ): void => {
     const newRetention = { ...retention, ...updatedFields };
-    updatePolicy({
-      retention: newRetention,
-    });
+    updatePolicy(
+      {
+        retention: newRetention,
+      },
+      validationHelperData
+    );
   };
 
   // State for touched inputs
diff --git a/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_settings/fields/indices_and_data_streams_field/indices_and_data_streams_field.tsx b/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_settings/fields/indices_and_data_streams_field/indices_and_data_streams_field.tsx
index 94854905e66863..54ea73a3e7a968 100644
--- a/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_settings/fields/indices_and_data_streams_field/indices_and_data_streams_field.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_settings/fields/indices_and_data_streams_field/indices_and_data_streams_field.tsx
@@ -25,7 +25,7 @@ import {
 
 import { SlmPolicyPayload } from '../../../../../../../../common/types';
 import { useServices } from '../../../../../../app_context';
-import { PolicyValidation } from '../../../../../../services/validation';
+import { PolicyValidation, ValidatePolicyHelperData } from '../../../../../../services/validation';
 
 import { orderDataStreamsAndIndices } from '../../../../../lib';
 import { DataStreamBadge } from '../../../../../data_stream_badge';
@@ -34,12 +34,16 @@ import { mapSelectionToIndicesOptions, determineListMode } from './helpers';
 
 import { DataStreamsAndIndicesListHelpText } from './data_streams_and_indices_list_help_text';
 
+interface IndicesConfig {
+  indices?: string[] | string;
+}
+
 interface Props {
   isManagedPolicy: boolean;
   policy: SlmPolicyPayload;
   indices: string[];
   dataStreams: string[];
-  onUpdate: (arg: { indices?: string[] | string }) => void;
+  onUpdate: (arg: IndicesConfig, validateHelperData: ValidatePolicyHelperData) => void;
   errors: PolicyValidation['errors'];
 }
 
@@ -53,7 +57,7 @@ export const IndicesAndDataStreamsField: FunctionComponent<Props> = ({
   dataStreams,
   indices,
   policy,
-  onUpdate,
+  onUpdate: _onUpdate,
   errors,
 }) => {
   const { i18n } = useServices();
@@ -63,9 +67,15 @@ export const IndicesAndDataStreamsField: FunctionComponent<Props> = ({
 
   // We assume all indices if the config has no indices entry or if we receive an empty array
   const [isAllIndices, setIsAllIndices] = useState<boolean>(
-    !config.indices || (Array.isArray(config.indices) && config.indices.length === 0)
+    config.indices == null || (Array.isArray(config.indices) && config.indices.length === 0)
   );
 
+  const onUpdate = (data: IndicesConfig) => {
+    _onUpdate(data, {
+      validateIndicesCount: !isAllIndices,
+    });
+  };
+
   const [indicesAndDataStreamsSelection, setIndicesAndDataStreamsSelection] = useState<string[]>(
     () =>
       Array.isArray(config.indices) && !isAllIndices
@@ -125,12 +135,17 @@ export const IndicesAndDataStreamsField: FunctionComponent<Props> = ({
           );
           onUpdate({ indices: undefined });
         } else {
-          onUpdate({
-            indices:
-              selectIndicesMode === 'custom'
-                ? indexPatterns.join(',')
-                : [...(indicesAndDataStreamsSelection || [])],
-          });
+          _onUpdate(
+            {
+              indices:
+                selectIndicesMode === 'custom'
+                  ? indexPatterns.join(',')
+                  : [...(indicesAndDataStreamsSelection || [])],
+            },
+            {
+              validateIndicesCount: true,
+            }
+          );
         }
       }}
     />
diff --git a/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_settings/step_settings.tsx b/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_settings/step_settings.tsx
index 9d43c45d17ea7a..f65156bada2780 100644
--- a/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_settings/step_settings.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_settings/step_settings.tsx
@@ -31,11 +31,17 @@ export const PolicyStepSettings: React.FunctionComponent<StepProps> = ({
 }) => {
   const { config = {}, isManagedPolicy } = policy;
 
-  const updatePolicyConfig = (updatedFields: Partial<SlmPolicyPayload['config']>): void => {
+  const updatePolicyConfig = (
+    updatedFields: Partial<SlmPolicyPayload['config']>,
+    validationHelperData = {}
+  ): void => {
     const newConfig = { ...config, ...updatedFields };
-    updatePolicy({
-      config: newConfig,
-    });
+    updatePolicy(
+      {
+        config: newConfig,
+      },
+      validationHelperData
+    );
   };
 
   const renderIgnoreUnavailableField = () => (
diff --git a/x-pack/plugins/snapshot_restore/public/application/components/restore_snapshot_form/steps/step_logistics/step_logistics.tsx b/x-pack/plugins/snapshot_restore/public/application/components/restore_snapshot_form/steps/step_logistics/step_logistics.tsx
index d9fd4cca0d614f..855abb04b7c2b1 100644
--- a/x-pack/plugins/snapshot_restore/public/application/components/restore_snapshot_form/steps/step_logistics/step_logistics.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/components/restore_snapshot_form/steps/step_logistics/step_logistics.tsx
@@ -311,7 +311,7 @@ export const RestoreSnapshotStepLogistics: React.FunctionComponent<StepProps> =
                             });
                           }
                         }}
-                        selectedIndicesAndDataStreams={csvToArray(restoreIndices)}
+                        selectedIndicesAndDataStreams={csvToArray(restoreIndices) ?? []}
                         indices={snapshotIndices}
                         dataStreams={snapshotDataStreams}
                       />
diff --git a/x-pack/plugins/snapshot_restore/public/application/lib/attempt_to_uri_decode.ts b/x-pack/plugins/snapshot_restore/public/application/lib/attempt_to_uri_decode.ts
new file mode 100644
index 00000000000000..6f99fae118cd73
--- /dev/null
+++ b/x-pack/plugins/snapshot_restore/public/application/lib/attempt_to_uri_decode.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const attemptToURIDecode = (value: string) => {
+  let result: string;
+
+  try {
+    result = decodeURI(value);
+    result = decodeURIComponent(result);
+  } catch (e1) {
+    try {
+      result = decodeURIComponent(value);
+    } catch (e2) {
+      result = value;
+    }
+  }
+
+  return result;
+};
diff --git a/x-pack/plugins/snapshot_restore/public/application/lib/index.ts b/x-pack/plugins/snapshot_restore/public/application/lib/index.ts
new file mode 100644
index 00000000000000..c544df4365606d
--- /dev/null
+++ b/x-pack/plugins/snapshot_restore/public/application/lib/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { useDecodedParams } from './use_decoded_params';
diff --git a/x-pack/plugins/snapshot_restore/public/application/lib/use_decoded_params.ts b/x-pack/plugins/snapshot_restore/public/application/lib/use_decoded_params.ts
new file mode 100644
index 00000000000000..d4582de4084ba8
--- /dev/null
+++ b/x-pack/plugins/snapshot_restore/public/application/lib/use_decoded_params.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useParams } from 'react-router-dom';
+import { attemptToURIDecode } from './attempt_to_uri_decode';
+
+export const useDecodedParams = <
+  Params extends { [K in keyof Params]?: string } = {}
+>(): Params => {
+  const params = useParams<Record<string, string>>();
+  const decodedParams = {} as Params;
+
+  for (const [key, value] of Object.entries(params)) {
+    if (value) {
+      (decodedParams as any)[key] = attemptToURIDecode(value);
+    }
+  }
+
+  return decodedParams;
+};
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/home.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/home.tsx
index 962dfa73e95c71..12e7e2de9383dd 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/home.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/home.tsx
@@ -89,7 +89,7 @@ export const SnapshotRestoreHome: React.FunctionComponent<RouteComponentProps<Ma
   }
 
   const onSectionChange = (newSection: Section) => {
-    history.push(`${BASE_PATH}/${newSection}`);
+    history.push(encodeURI(`${BASE_PATH}/${encodeURIComponent(newSection)}`));
   };
 
   // Set breadcrumb and page title
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_details/policy_details.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_details/policy_details.tsx
index 5959ad6441f5d9..f67e8eb586238f 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_details/policy_details.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_details/policy_details.tsx
@@ -24,6 +24,8 @@ import {
   EuiSpacer,
 } from '@elastic/eui';
 
+import { reactRouterNavigate } from '../../../../../../../../../src/plugins/kibana_react/public';
+
 import { SlmPolicy } from '../../../../../../common/types';
 import { useServices } from '../../../../app_context';
 import { SectionError, Error } from '../../../../../shared_imports';
@@ -41,8 +43,6 @@ import {
 } from '../../../../components';
 import { TabSummary, TabHistory } from './tabs';
 
-import { reactRouterNavigate } from '../../../../../../../../../src/plugins/kibana_react/public';
-
 interface Props {
   policyName: SlmPolicy['name'];
   onClose: () => void;
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_list.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_list.tsx
index 39ef66eb0658ce..655bd0e9d8bb9d 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_list.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_list.tsx
@@ -9,6 +9,8 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { RouteComponentProps } from 'react-router-dom';
 import { EuiEmptyPrompt, EuiButton, EuiCallOut, EuiSpacer } from '@elastic/eui';
 
+import { reactRouterNavigate } from '../../../../../../../../src/plugins/kibana_react/public';
+
 import {
   SectionError,
   Error,
@@ -20,6 +22,7 @@ import { SlmPolicy } from '../../../../../common/types';
 import { APP_SLM_CLUSTER_PRIVILEGES } from '../../../../../common';
 import { SectionLoading } from '../../../components';
 import { BASE_PATH, UIM_POLICY_LIST_LOAD } from '../../../constants';
+import { useDecodedParams } from '../../../lib';
 import { useLoadPolicies, useLoadRetentionSettings } from '../../../services/http';
 import { linkToAddPolicy, linkToPolicy } from '../../../services/navigation';
 import { useServices } from '../../../app_context';
@@ -28,18 +31,14 @@ import { PolicyDetails } from './policy_details';
 import { PolicyTable } from './policy_table';
 import { PolicyRetentionSchedule } from './policy_retention_schedule';
 
-import { reactRouterNavigate } from '../../../../../../../../src/plugins/kibana_react/public';
-
 interface MatchParams {
   policyName?: SlmPolicy['name'];
 }
 
 export const PolicyList: React.FunctionComponent<RouteComponentProps<MatchParams>> = ({
-  match: {
-    params: { policyName },
-  },
   history,
 }) => {
+  const { policyName } = useDecodedParams<MatchParams>();
   const {
     error,
     isLoading,
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_list.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_list.tsx
index f6b9ac08cc0a22..9afdad3806defb 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_list.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_list.tsx
@@ -7,11 +7,14 @@
 import React, { Fragment, useEffect } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { RouteComponentProps } from 'react-router-dom';
-
 import { EuiButton, EuiEmptyPrompt } from '@elastic/eui';
+
+import { reactRouterNavigate } from '../../../../../../../../src/plugins/kibana_react/public';
+
 import { Repository } from '../../../../../common/types';
 import { SectionError, Error } from '../../../../shared_imports';
 import { SectionLoading } from '../../../components';
+import { useDecodedParams } from '../../../lib';
 import { BASE_PATH, UIM_REPOSITORY_LIST_LOAD } from '../../../constants';
 import { useServices } from '../../../app_context';
 import { useLoadRepositories } from '../../../services/http';
@@ -20,18 +23,14 @@ import { linkToAddRepository, linkToRepository } from '../../../services/navigat
 import { RepositoryDetails } from './repository_details';
 import { RepositoryTable } from './repository_table';
 
-import { reactRouterNavigate } from '../../../../../../../../src/plugins/kibana_react/public';
-
 interface MatchParams {
   repositoryName?: Repository['name'];
 }
 
 export const RepositoryList: React.FunctionComponent<RouteComponentProps<MatchParams>> = ({
-  match: {
-    params: { repositoryName },
-  },
   history,
 }) => {
+  const { repositoryName } = useDecodedParams<MatchParams>();
   const {
     error,
     isLoading,
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_list.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_list.tsx
index 2b8df7294c3749..d13188fc44730e 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_list.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_list.tsx
@@ -24,6 +24,7 @@ import {
   linkToSnapshot,
 } from '../../../services/navigation';
 import { useServices } from '../../../app_context';
+import { useDecodedParams } from '../../../lib';
 import { SnapshotDetails } from './snapshot_details';
 import { SnapshotTable } from './snapshot_table';
 
@@ -35,12 +36,10 @@ interface MatchParams {
 }
 
 export const SnapshotList: React.FunctionComponent<RouteComponentProps<MatchParams>> = ({
-  match: {
-    params: { repositoryName, snapshotId },
-  },
   location: { search },
   history,
 }) => {
+  const { repositoryName, snapshotId } = useDecodedParams<MatchParams>();
   const {
     error,
     isLoading,
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/policy_add/policy_add.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/policy_add/policy_add.tsx
index 90cd26c821c5e2..dead9abb6ef0c1 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/policy_add/policy_add.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/policy_add/policy_add.tsx
@@ -43,7 +43,7 @@ export const PolicyAdd: React.FunctionComponent<RouteComponentProps> = ({
     if (error) {
       setSaveError(error);
     } else {
-      history.push(`${BASE_PATH}/policies/${name}`);
+      history.push(encodeURI(`${BASE_PATH}/policies/${encodeURIComponent(name)}`));
     }
   };
 
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/policy_edit/policy_edit.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/policy_edit/policy_edit.tsx
index 915b1cbef1233a..7af663b29957d8 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/policy_edit/policy_edit.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/policy_edit/policy_edit.tsx
@@ -10,6 +10,7 @@ import { RouteComponentProps } from 'react-router-dom';
 import { EuiPageBody, EuiPageContent, EuiSpacer, EuiTitle, EuiCallOut } from '@elastic/eui';
 import { SlmPolicyPayload } from '../../../../common/types';
 import { SectionError, Error } from '../../../shared_imports';
+import { useDecodedParams } from '../../lib';
 import { TIME_UNITS } from '../../../../common/constants';
 import { SectionLoading, PolicyForm } from '../../components';
 import { BASE_PATH } from '../../constants';
@@ -22,12 +23,10 @@ interface MatchParams {
 }
 
 export const PolicyEdit: React.FunctionComponent<RouteComponentProps<MatchParams>> = ({
-  match: {
-    params: { name },
-  },
   history,
   location: { pathname },
 }) => {
+  const { name } = useDecodedParams<MatchParams>();
   const { i18n } = useServices();
 
   // Set breadcrumb and page title
@@ -83,12 +82,12 @@ export const PolicyEdit: React.FunctionComponent<RouteComponentProps<MatchParams
     if (error) {
       setSaveError(error);
     } else {
-      history.push(`${BASE_PATH}/policies/${name}`);
+      history.push(encodeURI(`${BASE_PATH}/policies/${encodeURIComponent(name)}`));
     }
   };
 
   const onCancel = () => {
-    history.push(`${BASE_PATH}/policies/${name}`);
+    history.push(encodeURI(`${BASE_PATH}/policies/${encodeURIComponent(name)}`));
   };
 
   const renderLoading = () => {
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/repository_add/repository_add.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/repository_add/repository_add.tsx
index 08bfde833c3688..a66d137471eba5 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/repository_add/repository_add.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/repository_add/repository_add.tsx
@@ -44,7 +44,11 @@ export const RepositoryAdd: React.FunctionComponent<RouteComponentProps> = ({
     } else {
       const { redirect } = parse(search.replace(/^\?/, ''), { sort: false });
 
-      history.push(redirect ? (redirect as string) : `${BASE_PATH}/${section}/${name}`);
+      history.push(
+        redirect
+          ? (redirect as string)
+          : encodeURI(`${BASE_PATH}/${encodeURIComponent(section)}/${encodeURIComponent(name)}`)
+      );
     }
   };
 
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/repository_edit/repository_edit.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/repository_edit/repository_edit.tsx
index 95f8b9b8bde7d0..3e8cff57935725 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/repository_edit/repository_edit.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/repository_edit/repository_edit.tsx
@@ -16,18 +16,17 @@ import { BASE_PATH, Section } from '../../constants';
 import { useServices } from '../../app_context';
 import { breadcrumbService, docTitleService } from '../../services/navigation';
 import { editRepository, useLoadRepository } from '../../services/http';
+import { useDecodedParams } from '../../lib';
 
 interface MatchParams {
   name: string;
 }
 
 export const RepositoryEdit: React.FunctionComponent<RouteComponentProps<MatchParams>> = ({
-  match: {
-    params: { name },
-  },
   history,
 }) => {
   const { i18n } = useServices();
+  const { name } = useDecodedParams<MatchParams>();
   const section = 'repositories' as Section;
 
   // Set breadcrumb and page title
@@ -70,7 +69,9 @@ export const RepositoryEdit: React.FunctionComponent<RouteComponentProps<MatchPa
     if (error) {
       setSaveError(error);
     } else {
-      history.push(`${BASE_PATH}/${section}/${name}`);
+      history.push(
+        encodeURI(`${BASE_PATH}/${encodeURIComponent(section)}/${encodeURIComponent(name)}`)
+      );
     }
   };
 
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/restore_snapshot/restore_snapshot.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/restore_snapshot/restore_snapshot.tsx
index 9eabed8341ee02..033bdeb902d31e 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/restore_snapshot/restore_snapshot.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/restore_snapshot/restore_snapshot.tsx
@@ -15,6 +15,7 @@ import { SectionLoading, RestoreSnapshotForm } from '../../components';
 import { useServices } from '../../app_context';
 import { breadcrumbService, docTitleService } from '../../services/navigation';
 import { useLoadSnapshot, executeRestore } from '../../services/http';
+import { useDecodedParams } from '../../lib';
 
 interface MatchParams {
   repositoryName: string;
@@ -22,12 +23,10 @@ interface MatchParams {
 }
 
 export const RestoreSnapshot: React.FunctionComponent<RouteComponentProps<MatchParams>> = ({
-  match: {
-    params: { repositoryName, snapshotId },
-  },
   history,
 }) => {
   const { i18n } = useServices();
+  const { repositoryName, snapshotId } = useDecodedParams<MatchParams>();
 
   // Set breadcrumb and page title
   useEffect(() => {
diff --git a/x-pack/plugins/snapshot_restore/public/application/services/navigation/links.ts b/x-pack/plugins/snapshot_restore/public/application/services/navigation/links.ts
index 503704c6fe820f..b498dc280d3952 100644
--- a/x-pack/plugins/snapshot_restore/public/application/services/navigation/links.ts
+++ b/x-pack/plugins/snapshot_restore/public/application/services/navigation/links.ts
@@ -13,33 +13,37 @@ export function linkToRepositories() {
 }
 
 export function linkToRepository(repositoryName: string) {
-  return `/repositories/${encodeURIComponent(repositoryName)}`;
+  return encodeURI(`/repositories/${encodeURIComponent(repositoryName)}`);
 }
 
 export function linkToEditRepository(repositoryName: string) {
-  return `/edit_repository/${encodeURIComponent(repositoryName)}`;
+  return encodeURI(`/edit_repository/${encodeURIComponent(repositoryName)}`);
 }
 
 export function linkToAddRepository(redirect?: string) {
-  return `/add_repository${redirect ? `?redirect=${encodeURIComponent(redirect)}` : ''}`;
+  return encodeURI(`/add_repository${redirect ? `?redirect=${encodeURIComponent(redirect)}` : ''}`);
 }
 
 export function linkToSnapshots(repositoryName?: string, policyName?: string) {
   if (repositoryName) {
-    return `/snapshots?repository=${encodeURIComponent(repositoryName)}`;
+    return encodeURI(`/snapshots?repository=${encodeURIComponent(repositoryName)}`);
   }
   if (policyName) {
-    return `/snapshots?policy=${encodeURIComponent(policyName)}`;
+    return encodeURI(`/snapshots?policy=${encodeURIComponent(policyName)}`);
   }
   return `/snapshots`;
 }
 
 export function linkToSnapshot(repositoryName: string, snapshotName: string) {
-  return `/snapshots/${encodeURIComponent(repositoryName)}/${encodeURIComponent(snapshotName)}`;
+  return encodeURI(
+    `/snapshots/${encodeURIComponent(repositoryName)}/${encodeURIComponent(snapshotName)}`
+  );
 }
 
 export function linkToRestoreSnapshot(repositoryName: string, snapshotName: string) {
-  return `/restore/${encodeURIComponent(repositoryName)}/${encodeURIComponent(snapshotName)}`;
+  return encodeURI(
+    `/restore/${encodeURIComponent(repositoryName)}/${encodeURIComponent(snapshotName)}`
+  );
 }
 
 export function linkToPolicies() {
@@ -47,11 +51,11 @@ export function linkToPolicies() {
 }
 
 export function linkToPolicy(policyName: string) {
-  return `/policies/${encodeURIComponent(policyName)}`;
+  return encodeURI(`/policies/${encodeURIComponent(policyName)}`);
 }
 
 export function linkToEditPolicy(policyName: string) {
-  return `/edit_policy/${encodeURIComponent(policyName)}`;
+  return encodeURI(`/edit_policy/${encodeURIComponent(policyName)}`);
 }
 
 export function linkToAddPolicy() {
diff --git a/x-pack/plugins/snapshot_restore/public/application/services/validation/index.ts b/x-pack/plugins/snapshot_restore/public/application/services/validation/index.ts
index 7fd755497eec68..82bf0ef06c400a 100644
--- a/x-pack/plugins/snapshot_restore/public/application/services/validation/index.ts
+++ b/x-pack/plugins/snapshot_restore/public/application/services/validation/index.ts
@@ -12,4 +12,4 @@ export {
 
 export { RestoreValidation, validateRestore } from './validate_restore';
 
-export { PolicyValidation, validatePolicy } from './validate_policy';
+export { PolicyValidation, validatePolicy, ValidatePolicyHelperData } from './validate_policy';
diff --git a/x-pack/plugins/snapshot_restore/public/application/services/validation/validate_policy.ts b/x-pack/plugins/snapshot_restore/public/application/services/validation/validate_policy.ts
index 24960b2533230e..4314b703722f6f 100644
--- a/x-pack/plugins/snapshot_restore/public/application/services/validation/validate_policy.ts
+++ b/x-pack/plugins/snapshot_restore/public/application/services/validation/validate_policy.ts
@@ -25,21 +25,32 @@ const isSnapshotNameNotLowerCase = (str: string): boolean => {
   return strExcludeDate !== strExcludeDate.toLowerCase() ? true : false;
 };
 
+export interface ValidatePolicyHelperData {
+  managedRepository?: {
+    name: string;
+    policy: string;
+  };
+  isEditing?: boolean;
+  policyName?: string;
+  /**
+   * Whether to block on the indices configured for this snapshot.
+   *
+   * By default ES will back up all indices and data streams if this is an empty array or left blank.
+   * However, in the UI, under certain conditions, like when displaying indices to select for backup,
+   * we want to block users from submitting an empty array, but not block the entire form if they
+   * are not configuring this value - like when they are on a previous step.
+   */
+  validateIndicesCount?: boolean;
+}
+
 export const validatePolicy = (
   policy: SlmPolicyPayload,
-  validationHelperData: {
-    managedRepository?: {
-      name: string;
-      policy: string;
-    };
-    isEditing?: boolean;
-    policyName?: string;
-  }
+  validationHelperData: ValidatePolicyHelperData
 ): PolicyValidation => {
   const i18n = textService.i18n;
 
   const { name, snapshotName, schedule, repository, config, retention } = policy;
-  const { managedRepository, isEditing, policyName } = validationHelperData;
+  const { managedRepository, isEditing, policyName, validateIndicesCount } = validationHelperData;
 
   const validation: PolicyValidation = {
     isValid: true,
@@ -96,7 +107,12 @@ export const validatePolicy = (
     );
   }
 
-  if (config && typeof config.indices === 'string' && config.indices.trim().length === 0) {
+  if (
+    validateIndicesCount &&
+    config &&
+    typeof config.indices === 'string' &&
+    config.indices.trim().length === 0
+  ) {
     validation.errors.indices.push(
       i18n.translate('xpack.snapshotRestore.policyValidation.indexPatternRequiredErrorMessage', {
         defaultMessage: 'At least one index pattern is required.',
@@ -104,7 +120,12 @@ export const validatePolicy = (
     );
   }
 
-  if (config && Array.isArray(config.indices) && config.indices.length === 0) {
+  if (
+    validateIndicesCount &&
+    config &&
+    Array.isArray(config.indices) &&
+    config.indices.length === 0
+  ) {
     validation.errors.indices.push(
       i18n.translate('xpack.snapshotRestore.policyValidation.indicesRequiredErrorMessage', {
         defaultMessage: 'You must select at least one data stream or index.',
diff --git a/x-pack/plugins/spaces/server/lib/request_interceptors/on_post_auth_interceptor.test.ts b/x-pack/plugins/spaces/server/lib/request_interceptors/on_post_auth_interceptor.test.ts
index 8375296d869e6d..dabdcf553edb4a 100644
--- a/x-pack/plugins/spaces/server/lib/request_interceptors/on_post_auth_interceptor.test.ts
+++ b/x-pack/plugins/spaces/server/lib/request_interceptors/on_post_auth_interceptor.test.ts
@@ -20,7 +20,7 @@ import {
   loggingSystemMock,
   coreMock,
 } from '../../../../../../src/core/server/mocks';
-import * as kbnTestServer from '../../../../../../src/test_utils/kbn_server';
+import * as kbnTestServer from '../../../../../../src/core/test_helpers/kbn_server';
 import { SpacesService } from '../../spaces_service';
 import { SpacesAuditLogger } from '../audit_logger';
 import { convertSavedObjectToSpace } from '../../routes/lib';
diff --git a/x-pack/plugins/spaces/server/lib/request_interceptors/on_request_interceptor.test.ts b/x-pack/plugins/spaces/server/lib/request_interceptors/on_request_interceptor.test.ts
index 1558c6425f542d..998c6ca18983d7 100644
--- a/x-pack/plugins/spaces/server/lib/request_interceptors/on_request_interceptor.test.ts
+++ b/x-pack/plugins/spaces/server/lib/request_interceptors/on_request_interceptor.test.ts
@@ -15,7 +15,7 @@ import {
   IRouter,
 } from '../../../../../../src/core/server';
 
-import * as kbnTestServer from '../../../../../../src/test_utils/kbn_server';
+import * as kbnTestServer from '../../../../../../src/core/test_helpers/kbn_server';
 import { elasticsearchServiceMock } from 'src/core/server/mocks';
 
 // FAILING: https://github.com/elastic/kibana/issues/58942
diff --git a/x-pack/plugins/spaces/server/routes/api/__fixtures__/create_copy_to_space_mocks.ts b/x-pack/plugins/spaces/server/routes/api/__fixtures__/create_copy_to_space_mocks.ts
index 0e117b3f16e3f4..ef6f5e1541a469 100644
--- a/x-pack/plugins/spaces/server/routes/api/__fixtures__/create_copy_to_space_mocks.ts
+++ b/x-pack/plugins/spaces/server/routes/api/__fixtures__/create_copy_to_space_mocks.ts
@@ -5,7 +5,7 @@
  */
 
 import { Readable } from 'stream';
-import { createPromiseFromStreams, createConcatStream } from 'src/legacy/utils';
+import { createPromiseFromStreams, createConcatStream } from 'src/core/server/utils';
 
 async function readStreamToCompletion(stream: Readable) {
   return (await (createPromiseFromStreams([stream, createConcatStream([])]) as unknown)) as any[];
diff --git a/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json b/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json
index 5280f094e3a5d2..2435d8a9aaf04c 100644
--- a/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json
+++ b/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json
@@ -30,6 +30,9 @@
           "properties": {
             "cannot_connect": {
               "type": "long"
+            },
+            "not_found": {
+              "type": "long"
             }
           }
         },
@@ -64,6 +67,9 @@
           "properties": {
             "cannot_connect": {
               "type": "long"
+            },
+            "not_found": {
+              "type": "long"
             }
           }
         },
diff --git a/x-pack/plugins/transform/server/routes/api/field_histograms.ts b/x-pack/plugins/transform/server/routes/api/field_histograms.ts
index f2fd81368ec17c..2642040c4cd0db 100644
--- a/x-pack/plugins/transform/server/routes/api/field_histograms.ts
+++ b/x-pack/plugins/transform/server/routes/api/field_histograms.ts
@@ -34,7 +34,7 @@ export function registerFieldHistogramsRoutes({ router, license }: RouteDependen
 
       try {
         const resp = await getHistogramsForFields(
-          ctx.transform!.dataClient,
+          ctx.core.elasticsearch.client,
           indexPatternTitle,
           query,
           fields,
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 07b646df74b9f5..eacb1febd20ff8 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -253,31 +253,6 @@
     "charts.controls.rangeErrorMessage": "値は{min}と{max}の間でなければなりません",
     "charts.controls.vislibBasicOptions.legendPositionLabel": "凡例位置",
     "charts.controls.vislibBasicOptions.showTooltipLabel": "ツールヒントを表示",
-    "common.ui.flotCharts.aprLabel": "4 月",
-    "common.ui.flotCharts.augLabel": "8 月",
-    "common.ui.flotCharts.decLabel": "12 月",
-    "common.ui.flotCharts.febLabel": "2 月",
-    "common.ui.flotCharts.friLabel": "金",
-    "common.ui.flotCharts.janLabel": "1 月",
-    "common.ui.flotCharts.julLabel": "7 月",
-    "common.ui.flotCharts.junLabel": "6 月",
-    "common.ui.flotCharts.marLabel": "3 月",
-    "common.ui.flotCharts.mayLabel": "5 月",
-    "common.ui.flotCharts.monLabel": "月",
-    "common.ui.flotCharts.novLabel": "11 月",
-    "common.ui.flotCharts.octLabel": "10 月",
-    "common.ui.flotCharts.pie.unableToDrawLabelsInsideCanvasErrorMessage": "キャンバス内のラベルではパイを作成できません",
-    "common.ui.flotCharts.satLabel": "土",
-    "common.ui.flotCharts.sepLabel": "9 月",
-    "common.ui.flotCharts.sunLabel": "日",
-    "common.ui.flotCharts.thuLabel": "木",
-    "common.ui.flotCharts.tueLabel": "火",
-    "common.ui.flotCharts.wedLabel": "水",
-    "common.ui.stateManagement.unableToParseUrlErrorMessage": "URL をパースできません",
-    "common.ui.stateManagement.unableToRestoreUrlErrorMessage": "URL を完全に復元できません。共有機能を使用していることを確認してください。",
-    "common.ui.stateManagement.unableToStoreHistoryInSessionErrorMessage": "セッションがいっぱいで安全に削除できるアイテムが見つからないため、Kibana は履歴アイテムを保存できません。\n\nこれは大抵新規タブに移動することで解決されますが、より大きな問題が原因である可能性もあります。このメッセージが定期的に表示される場合は、{gitHubIssuesUrl} で問題を報告してください。",
-    "common.ui.url.replacementFailedErrorMessage": "置換に失敗、未解決の表現式: {expr}",
-    "common.ui.url.savedObjectIsMissingNotificationMessage": "保存されたオブジェクトがありません",
     "console.autocomplete.addMethodMetaText": "メソド",
     "console.consoleDisplayName": "コンソール",
     "console.consoleMenu.copyAsCurlMessage": "リクエストが URL としてコピーされました",
@@ -526,47 +501,6 @@
     "core.ui.securityNavList.label": "セキュリティ",
     "core.ui.welcomeErrorMessage": "Elasticが正常に読み込まれませんでした。詳細はサーバーアウトプットを確認してください。",
     "core.ui.welcomeMessage": "Elasticの読み込み中",
-    "core.ui_settings.params.darkModeText": "Kibana UI のダークモードを有効にします。この設定を適用するにはページの更新が必要です。",
-    "core.ui_settings.params.darkModeTitle": "ダークモード",
-    "core.ui_settings.params.dateFormat.dayOfWeekText": "週の初めの曜日を設定します",
-    "core.ui_settings.params.dateFormat.dayOfWeekTitle": "曜日",
-    "core.ui_settings.params.dateFormat.optionsLinkText": "フォーマット",
-    "core.ui_settings.params.dateFormat.scaled.intervalsLinkText": "ISO8601 間隔",
-    "core.ui_settings.params.dateFormat.scaledText": "時間ベースのデータが順番にレンダリングされ、フォーマットされたタイムスタンプが測定値の間隔に適応すべき状況で使用されるフォーマットを定義する値です。キーは {intervalsLink}。",
-    "core.ui_settings.params.dateFormat.scaledTitle": "スケーリングされたデータフォーマットです",
-    "core.ui_settings.params.dateFormat.timezoneText": "使用されるタイムゾーンです。{defaultOption} ではご使用のブラウザにより検知されたタイムゾーンが使用されます。",
-    "core.ui_settings.params.dateFormat.timezoneTitle": "データフォーマットのタイムゾーン",
-    "core.ui_settings.params.dateFormatText": "きちんとフォーマットされたデータを表示する際、この {formatLink} を使用します",
-    "core.ui_settings.params.dateFormatTitle": "データフォーマット",
-    "core.ui_settings.params.dateNanosFormatText": "Elasticsearch の {dateNanosLink} データタイプに使用されます",
-    "core.ui_settings.params.dateNanosFormatTitle": "ナノ秒フォーマットでの日付",
-    "core.ui_settings.params.dateNanosLinkTitle": "date_nanos",
-    "core.ui_settings.params.defaultRoute.defaultRouteIsRelativeValidationMessage": "相対 URL でなければなりません。",
-    "core.ui_settings.params.defaultRoute.defaultRouteText": "この設定は、Kibana 起動時のデフォルトのルートを設定します。この設定で、Kibana 起動時のランディングページを変更できます。経路は相対 URL でなければなりません。",
-    "core.ui_settings.params.defaultRoute.defaultRouteTitle": "デフォルトのルート",
-    "core.ui_settings.params.disableAnimationsText": "Kibana UI の不要なアニメーションをオフにします。変更を適用するにはページを更新してください。",
-    "core.ui_settings.params.disableAnimationsTitle": "アニメーションを無効にする",
-    "core.ui_settings.params.maxCellHeightText": "表のセルが使用する高さの上限です。この切り捨てを無効にするには 0 に設定します",
-    "core.ui_settings.params.maxCellHeightTitle": "表のセルの高さの上限",
-    "core.ui_settings.params.notifications.banner.markdownLinkText": "マークダウン対応",
-    "core.ui_settings.params.notifications.bannerLifetimeText": "バナー通知が画面に表示されるミリ秒単位での時間です。{infinityValue} に設定するとカウントダウンが無効になります。",
-    "core.ui_settings.params.notifications.bannerLifetimeTitle": "バナー通知時間",
-    "core.ui_settings.params.notifications.bannerText": "すべてのユーザーへの一時的な通知を目的としたカスタムバナーです。{markdownLink}",
-    "core.ui_settings.params.notifications.bannerTitle": "カスタムバナー通知",
-    "core.ui_settings.params.notifications.errorLifetimeText": "エラー通知が画面に表示されるミリ秒単位での時間です。{infinityValue} に設定すると無効になります。",
-    "core.ui_settings.params.notifications.errorLifetimeTitle": "エラー通知時間",
-    "core.ui_settings.params.notifications.infoLifetimeText": "情報通知が画面に表示されるミリ秒単位での時間です。{infinityValue} に設定すると無効になります。",
-    "core.ui_settings.params.notifications.infoLifetimeTitle": "情報通知時間",
-    "core.ui_settings.params.notifications.warningLifetimeText": "警告通知が画面に表示されるミリ秒単位での時間です。{infinityValue} に設定すると無効になります。",
-    "core.ui_settings.params.notifications.warningLifetimeTitle": "警告通知時間",
-    "core.ui_settings.params.pageNavigationDesc": "ナビゲーションのスタイルを変更",
-    "core.ui_settings.params.pageNavigationLegacy": "レガシー",
-    "core.ui_settings.params.pageNavigationModern": "モダン",
-    "core.ui_settings.params.pageNavigationName": "サイドナビゲーションスタイル",
-    "core.ui_settings.params.themeVersionText": "現在のバージョンと次のバージョンのKibanaで使用されるテーマを切り替えます。この設定を適用するにはページの更新が必要です。",
-    "core.ui_settings.params.themeVersionTitle": "テーマバージョン",
-    "core.ui_settings.params.storeUrlText": "URL は長くなりすぎてブラウザが対応できない場合があります。セッションストレージに URL の一部を保存することがで　この問題に対処できるかテストしています。結果を教えてください！",
-    "core.ui_settings.params.storeUrlTitle": "セッションストレージに URL を格納",
     "dashboard.actions.toggleExpandPanelMenuItem.expandedDisplayName": "最小化",
     "dashboard.actions.toggleExpandPanelMenuItem.notExpandedDisplayName": "全画面",
     "dashboard.addExistingVisualizationLinkText": "既存のユーザーを追加",
@@ -739,8 +673,6 @@
     "data.advancedSettings.timepicker.refreshIntervalDefaultsText": "時間フィルターのデフォルト更新間隔「値」はミリ秒で指定する必要があります。",
     "data.advancedSettings.timepicker.refreshIntervalDefaultsTitle": "タイムピッカーの更新間隔",
     "data.advancedSettings.timepicker.thisWeek": "今週",
-    "data.advancedSettings.timepicker.timeDefaultsText": "時間フィルターが選択されずに Kibana が起動した際に使用される時間フィルターです",
-    "data.advancedSettings.timepicker.timeDefaultsTitle": "デフォルトのタイムピッカー",
     "data.advancedSettings.timepicker.today": "今日",
     "data.aggTypes.buckets.ranges.rangesFormatMessage": "{gte} {from} と {lt} {to}",
     "data.common.kql.errors.endOfInputText": "インプットの終わり",
@@ -1671,7 +1603,6 @@
     "home.loadTutorials.unableToLoadErrorMessage": "チュートリアルが読み込めません。",
     "home.pageTitle": "ホーム",
     "home.recentlyAccessed.recentlyViewedTitle": "最近閲覧",
-    "home.sampleData.ecommerceSpec.averageSalesPerRegionTitle": "[e コマース] 地域ごとの平均売上",
     "home.sampleData.ecommerceSpec.averageSalesPriceTitle": "[e コマース] 平均販売価格",
     "home.sampleData.ecommerceSpec.averageSoldQuantityTitle": "[e コマース] 平均販売数",
     "home.sampleData.ecommerceSpec.controlsTitle": "[e コマース] コントロール",
@@ -1702,7 +1633,6 @@
     "home.sampleData.flightsSpec.globalFlightDashboardDescription": "ES-Air、Logstash Airways、Kibana Airlines、JetBeats のサンプル飛行データを分析します",
     "home.sampleData.flightsSpec.globalFlightDashboardTitle": "[フライト] グローバルフライトダッシュボード",
     "home.sampleData.flightsSpec.markdownInstructionsTitle": "[フライト] マークダウンの指示",
-    "home.sampleData.flightsSpec.originCountryTicketPricesTitle": "[フライト] 出発国の運賃",
     "home.sampleData.flightsSpec.originCountryTitle": "[Flights] 出発国と到着国の比較",
     "home.sampleData.flightsSpec.totalFlightCancellationsTitle": "[フライト] フライト欠航合計",
     "home.sampleData.flightsSpec.totalFlightDelaysTitle": "[フライト] フライト遅延合計",
@@ -1717,7 +1647,6 @@
     "home.sampleData.logsSpec.markdownInstructionsTitle": "[ログ] マークダウンの指示",
     "home.sampleData.logsSpec.responseCodesOverTimeTitle": "[ログ] 一定期間の応答コードと注釈",
     "home.sampleData.logsSpec.sourceAndDestinationSankeyChartTitle": "[ログ] ソースと行先のサンキーダイアグラム",
-    "home.sampleData.logsSpec.uniqueVisitorsByCountryTitle": "[ログ] 国ごとのユニークビジター",
     "home.sampleData.logsSpec.uniqueVisitorsTitle": "[ログ] ユニークビジターと平均バイトの比較",
     "home.sampleData.logsSpec.visitorOSTitle": "[ログ] OS 別のビジター",
     "home.sampleData.logsSpec.webTrafficDescription": "Elastic Web サイトのサンプル Webトラフィックログデータを分析します",
@@ -4458,8 +4387,6 @@
     "visualizations.newVisWizard.searchSelection.savedObjectType.search": "保存検索",
     "visualizations.newVisWizard.selectVisType": "ビジュアライゼーションのタイプを選択してください",
     "visualizations.newVisWizard.title": "新規ビジュアライゼーション",
-    "visualizations.newVisWizard.visTypeAliasDescription": "Visualize 外で Kibana アプリケーションを開きます。",
-    "visualizations.newVisWizard.visTypeAliasTitle": "Kibana アプリケーション",
     "visualizations.savedObjectName": "ビジュアライゼーション",
     "visualizations.visualizationTypeInvalidMessage": "無効なビジュアライゼーションタイプ \"{visType}\"",
     "visualize.badge.readOnly.text": "読み取り専用",
@@ -4558,7 +4485,6 @@
     "xpack.actions.serverSideErrors.predefinedActionUpdateDisabled": "あらかじめ構成されたアクション{id}は更新できません。",
     "xpack.actions.serverSideErrors.unavailableLicenseErrorMessage": "現時点でライセンス情報を入手できないため、アクションタイプ {actionTypeId} は無効です。",
     "xpack.actions.serverSideErrors.unavailableLicenseInformationErrorMessage": "グラフを利用できません。現在ライセンス情報が利用できません。",
-    "xpack.actions.urlAllowedHostsConfigurationError": "target {field} \"{value}\" は Kibana 構成 xpack.actions.allowedHosts にはホワイトリスト化されていません。",
     "xpack.alertingBuiltins.indexThreshold.actionGroupThresholdMetTitle": "しきい値一致",
     "xpack.alertingBuiltins.indexThreshold.actionVariableContextDateLabel": "アラートがしきい値を超えた日付。",
     "xpack.alertingBuiltins.indexThreshold.actionVariableContextGroupLabel": "しきい値を超えたグループ。",
@@ -4704,6 +4630,11 @@
     "xpack.apm.agentMetrics.java.threadCountMax": "最高カウント",
     "xpack.apm.alertTypes.errorRate": "エラー率",
     "xpack.apm.alertTypes.transactionDuration": "トランザクション期間",
+    "xpack.apm.anomaly_detection.error.invalid_license": "異常検知を使用するには、Elastic Platinumライセンスのサブスクリプションが必要です。このライセンスがあれば、機械学習を活用して、サービスを監視できます。",
+    "xpack.apm.anomaly_detection.error.missing_read_privileges": "異常検知ジョブを表示するには、機械学習およびAPMの「読み取り」権限が必要です",
+    "xpack.apm.anomaly_detection.error.missing_write_privileges": "異常検知ジョブを作成するには、機械学習およびAPMの「書き込み」権限が必要です",
+    "xpack.apm.anomaly_detection.error.not_available": "機械学習を利用できません",
+    "xpack.apm.anomaly_detection.error.not_available_in_space": "選択したスペースでは、機械学習を利用できません",
     "xpack.apm.anomalyDetection.createJobs.failed.text": "APMサービス環境用に[{environments}]1つ以上の異常検知ジョブを作成しているときに問題が発生しました。エラー: 「{errorMessage}」",
     "xpack.apm.anomalyDetection.createJobs.failed.title": "異常検知ジョブを作成できませんでした",
     "xpack.apm.anomalyDetection.createJobs.succeeded.text": "APMサービス環境[{environments}]の異常検知ジョブが正常に作成されました。機械学習がトラフィック異常値の分析を開始するには、少し時間がかかります。",
@@ -4751,7 +4682,7 @@
     "xpack.apm.errorGroupDetails.logMessageLabel": "ログメッセージ",
     "xpack.apm.errorGroupDetails.noErrorsLabel": "エラーが見つかりませんでした",
     "xpack.apm.errorGroupDetails.occurrencesChartLabel": "オカレンス",
-    "xpack.apm.errorGroupDetails.occurrencesLongLabel": "{occCount} 件",
+    "xpack.apm.errorGroupDetails.occurrencesLongLabel": "{occCount} {occCount, plural, one {件の発生} other {件の発生}}",
     "xpack.apm.errorGroupDetails.occurrencesShortLabel": "{occCount} 件",
     "xpack.apm.errorGroupDetails.relatedTransactionSample": "関連トランザクションサンプル",
     "xpack.apm.errorGroupDetails.unhandledLabel": "未対応",
@@ -4778,7 +4709,6 @@
     "xpack.apm.fetcher.error.title": "リソースの取得中にエラーが発生しました",
     "xpack.apm.fetcher.error.url": "URL",
     "xpack.apm.filter.environment.label": "環境",
-    "xpack.apm.filter.environment.allLabel": "すべて",
     "xpack.apm.filter.environment.notDefinedLabel": "未定義",
     "xpack.apm.filter.environment.selectEnvironmentLabel": "環境を選択",
     "xpack.apm.formatters.hoursTimeUnitLabel": "h",
@@ -4857,7 +4787,6 @@
     "xpack.apm.metrics.transactionChart.transactionDurationLabel": "トランザクション時間",
     "xpack.apm.metrics.transactionChart.transactionsPerMinuteLabel": "1 分あたりのトランザクション数",
     "xpack.apm.notAvailableLabel": "N/A",
-    "xpack.apm.percentOfParent": "({value} {parentType, select, transaction {トランザクション} trace {トレース} })",
     "xpack.apm.propertiesTable.agentFeature.noDataAvailableLabel": "利用可能なデータがありません",
     "xpack.apm.propertiesTable.agentFeature.noResultFound": "\"{value}\"に対する結果が見つかりませんでした。",
     "xpack.apm.propertiesTable.tabs.exceptionStacktraceLabel": "例外のスタックトレース",
@@ -4900,7 +4829,10 @@
     "xpack.apm.serviceMap.anomalyDetectionPopoverScoreMetric": "スコア（最大）",
     "xpack.apm.serviceMap.anomalyDetectionPopoverTitle": "異常検知",
     "xpack.apm.serviceMap.anomalyDetectionPopoverTooltip": "サービス正常性インジケーターは、機械学習の異常検知に基づいています。",
+    "xpack.apm.serviceMap.avgCpuUsagePopoverStat": "CPU使用状況（平均）",
+    "xpack.apm.serviceMap.avgMemoryUsagePopoverStat": "メモリー使用状況（平均）",
     "xpack.apm.serviceMap.avgReqPerMinutePopoverMetric": "1分あたりのリクエスト（平均）",
+    "xpack.apm.serviceMap.avgTransDurationPopoverStat": "トランザクションの長さ（平均）",
     "xpack.apm.serviceMap.betaBadge": "ベータ",
     "xpack.apm.serviceMap.betaTooltipMessage": "現在、この機能はベータです。不具合を見つけた場合やご意見がある場合、サポートに問い合わせるか、またはディスカッションフォーラムにご報告ください。",
     "xpack.apm.serviceMap.center": "中央",
@@ -4908,10 +4840,13 @@
     "xpack.apm.serviceMap.emptyBanner.docsLink": "詳細はドキュメントをご覧ください",
     "xpack.apm.serviceMap.emptyBanner.message": "接続されているサービスや外部リクエストを検出できる場合、システムはそれらをマップします。最新版の APM エージェントが動作していることを確認してください。",
     "xpack.apm.serviceMap.emptyBanner.title": "単一のサービスしかないようです。",
+    "xpack.apm.serviceMap.errorRatePopoverStat": "トランザクションエラー率（平均）",
     "xpack.apm.serviceMap.focusMapButtonText": "焦点マップ",
     "xpack.apm.serviceMap.invalidLicenseMessage": "サービスマップを利用するには、Elastic Platinum ライセンスが必要です。これにより、APM データとともにアプリケーションスタック全てを可視化することができるようになります。",
     "xpack.apm.serviceMap.popoverMetrics.noDataText": "選択した環境のデータがありません。別の環境に切り替えてください。",
     "xpack.apm.serviceMap.serviceDetailsButtonText": "サービス詳細",
+    "xpack.apm.serviceMap.subtypePopoverStat": "サブタイプ",
+    "xpack.apm.serviceMap.typePopoverStat": "タイプ",
     "xpack.apm.serviceMap.viewFullMap": "サービスの全体マップを表示",
     "xpack.apm.serviceMap.zoomIn": "ズームイン",
     "xpack.apm.serviceMap.zoomOut": "ズームアウト",
@@ -4957,7 +4892,7 @@
     "xpack.apm.settings.anomalyDetection.jobList.emptyListText": "異常検知ジョブがありません。",
     "xpack.apm.settings.anomalyDetection.jobList.environmentColumnLabel": "環境",
     "xpack.apm.settings.anomalyDetection.jobList.environments": "環境",
-    "xpack.apm.settings.anomalyDetection.jobList.failedFetchText": "異常検知ジョブを取得できませんでした。",
+    "xpack.apm.settings.anomalyDetection.jobList.failedFetchText": "異常検知ジョブを取得できません。",
     "xpack.apm.settings.anomalyDetection.jobList.mlDescriptionText": "異常検知を新しい環境に追加するには、機械学習ジョブを作成します。既存の機械学習ジョブは、{mlJobsLink}で管理できます。",
     "xpack.apm.settings.anomalyDetection.jobList.mlDescriptionText.mlJobsLinkText": "機械学習",
     "xpack.apm.settings.anomalyDetection.jobList.mlJobLinkText": "MLでジョブを表示",
@@ -5067,7 +5002,6 @@
     "xpack.apm.transactionActionMenu.viewInUptime": "ステータス",
     "xpack.apm.transactionActionMenu.viewSampleDocumentLinkLabel": "サンプルドキュメントを表示",
     "xpack.apm.transactionBreakdown.chartTitle": "スパンタイプ別時間",
-    "xpack.apm.transactionBreakdown.noData": "この時間範囲のデータがありません。",
     "xpack.apm.transactionCardinalityWarning.body": "一意のトランザクション名の数が構成された値{bucketSize}を超えています。エージェントを再構成し、類似したトランザクションをグループ化するか、{codeBlock}の値を増やしてください。",
     "xpack.apm.transactionCardinalityWarning.docsLink": "詳細はドキュメントをご覧ください",
     "xpack.apm.transactionCardinalityWarning.title": "このビューには、報告されたトランザクションのサブセットが表示されます。",
@@ -5432,7 +5366,7 @@
     "xpack.canvas.elementSettings.dataTabLabel": "データ",
     "xpack.canvas.elementSettings.displayTabLabel": "表示",
     "xpack.canvas.embedObject.noMatchingObjectsMessage": "一致するオブジェクトが見つかりませんでした。",
-    "xpack.canvas.embedObject.titleText": "Visualizeライブラリから追加",
+    "xpack.canvas.embedObject.titleText": "Kibanaから追加",
     "xpack.canvas.error.actionsElements.invaludArgIndexErrorMessage": "無効な引数インデックス: {index}",
     "xpack.canvas.error.downloadWorkpad.downloadFailureErrorMessage": "ワークパッドをダウンロードできませんでした",
     "xpack.canvas.error.downloadWorkpad.downloadRenderedWorkpadFailureErrorMessage": "レンダリングされたワークパッドをダウンロードできませんでした",
@@ -6319,7 +6253,7 @@
     "xpack.canvas.workpadHeaderElementMenu.chartMenuItemLabel": "グラフ",
     "xpack.canvas.workpadHeaderElementMenu.elementMenuButtonLabel": "エレメントを追加",
     "xpack.canvas.workpadHeaderElementMenu.elementMenuLabel": "要素を追加",
-    "xpack.canvas.workpadHeaderElementMenu.embedObjectMenuItemLabel": "Visualizeライブラリから追加",
+    "xpack.canvas.workpadHeaderElementMenu.embedObjectMenuItemLabel": "Kibanaから追加",
     "xpack.canvas.workpadHeaderElementMenu.filterMenuItemLabel": "フィルター",
     "xpack.canvas.workpadHeaderElementMenu.imageMenuItemLabel": "画像",
     "xpack.canvas.workpadHeaderElementMenu.manageAssetsMenuItemLabel": "アセットの管理",
@@ -6772,6 +6706,9 @@
     "xpack.enterpriseSearch.errorConnectingState.description4": "セットアップガイドを確認するか、サーバーログの{pluginLog}ログメッセージを確認してください。",
     "xpack.enterpriseSearch.errorConnectingState.setupGuideCta": "セットアップガイドを確認",
     "xpack.enterpriseSearch.errorConnectingState.title": "接続できません",
+    "xpack.enterpriseSearch.errorConnectingState.troubleshootAuth": "ユーザー認証を確認してください。",
+    "xpack.enterpriseSearch.errorConnectingState.troubleshootAuthNative": "Elasticsearchネイティブ認証またはSSO/SAMLを使用して認証する必要があります。",
+    "xpack.enterpriseSearch.errorConnectingState.troubleshootAuthSAML": "SSO/SAMLを使用している場合は、エンタープライズ サーチでSAMLレルムも設定する必要があります。",
     "xpack.enterpriseSearch.setupGuide.step1.instruction1": "{configFile}ファイルで、{configSetting}を{productName}インスタンスのURLに設定します。例：",
     "xpack.enterpriseSearch.setupGuide.step1.title": "{productName}ホストURLをKibana構成に追加",
     "xpack.enterpriseSearch.setupGuide.step2.instruction1": "Kibanaを再起動して、前のステップから構成変更を取得します。",
@@ -8126,7 +8063,6 @@
     "xpack.indexLifecycleMgmt.editPolicy.learnAboutShardAllocationLink": "シャード割り当ての詳細をご覧ください",
     "xpack.indexLifecycleMgmt.editPolicy.learnAboutTimingText": "タイミングの詳細をご覧ください",
     "xpack.indexLifecycleMgmt.editPolicy.lifecyclePolicyDescriptionText": "インデックスへのアクティブな書き込みから削除までの、インデックスライフサイクルの 4 つのフェーズを自動化するには、インデックスポリシーを使用します。",
-    "xpack.indexLifecycleMgmt.editPolicy.loadPolicyErrorMessage": "ポリシーの読み込み中にエラーが発生しました",
     "xpack.indexLifecycleMgmt.editPolicy.maximumAgeMissingError": "最高年齢が必要です。",
     "xpack.indexLifecycleMgmt.editPolicy.maximumDocumentsMissingError": "最高ドキュメント数が必要です。",
     "xpack.indexLifecycleMgmt.editPolicy.maximumIndexSizeMissingError": "最大インデックスサイズが必要です。",
@@ -8265,7 +8201,6 @@
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.title": "インデックステンプレートにポリシー「{name}」 を追加",
     "xpack.indexLifecycleMgmt.policyTable.addPolicyToTemplateButtonText": "インデックステンプレートにポリシーを追加",
     "xpack.indexLifecycleMgmt.policyTable.captionText": "以下は {total} 列中 {count, plural, one {# 列} other {# 列}} を含むインデックスライフサイクルポリシー表です。",
-    "xpack.indexLifecycleMgmt.policyTable.deletedPoliciesText": "{numSelected} 件の{numSelected, plural, one {ポリシー} other {ポリシー}}が削除されました",
     "xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonDisabledTooltip": "インデックスが使用中のポリシーは削除できません",
     "xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonText": "ポリシーを削除",
     "xpack.indexLifecycleMgmt.policyTable.emptyPrompt.createButtonLabel": "ポリシーを作成",
@@ -8490,6 +8425,7 @@
     "xpack.infra.logs.analysis.anomalySectionLogRateChartNoData": "表示するログレートデータがありません。",
     "xpack.infra.logs.analysis.anomalySectionNoDataBody": "時間範囲を調整する必要があるかもしれません。",
     "xpack.infra.logs.analysis.anomalySectionNoDataTitle": "表示するデータがありません。",
+    "xpack.infra.logs.analysis.createJobButtonLabel": "MLジョブを作成",
     "xpack.infra.logs.analysis.datasetFilterPlaceholder": "データセットでフィルター",
     "xpack.infra.logs.analysis.enableAnomalyDetectionButtonLabel": "異常検知を有効にする",
     "xpack.infra.logs.analysis.jobConfigurationOutdatedCalloutMessage": "異なるソース構成を使用して{moduleName} MLジョブが作成されました。現在の構成を適用するにはジョブを再作成してください。これにより以前検出された異常が削除されます。",
@@ -8505,6 +8441,9 @@
     "xpack.infra.logs.analysis.logEntryRateModuleDescription": "機械学習を使用して自動的に異常ログエントリ率を検出します。",
     "xpack.infra.logs.analysis.logEntryRateModuleName": "ログレート",
     "xpack.infra.logs.analysis.manageMlJobsButtonLabel": "MLジョブの管理",
+    "xpack.infra.logs.analysis.missingMlPrivilegesTitle": "追加の機械学習の権限が必要です",
+    "xpack.infra.logs.analysis.missingMlResultsPrivilegesDescription": "本機能は機械学習ジョブを利用し、そのステータスと結果にアクセスするためには、少なくとも機械学習アプリの読み取り権限が必要です。",
+    "xpack.infra.logs.analysis.missingMlSetupPrivilegesDescription": "本機能は機械学習ジョブを利用し、設定には機械学習アプリのすべての権限が必要です。",
     "xpack.infra.logs.analysis.mlAppButton": "機械学習を開く",
     "xpack.infra.logs.analysis.mlUnavailableBody": "詳細は{machineLearningAppLink}をご覧ください。",
     "xpack.infra.logs.analysis.mlUnavailableTitle": "この機能には機械学習が必要です",
@@ -8525,7 +8464,6 @@
     "xpack.infra.logs.customizeLogs.customizeButtonLabel": "カスタマイズ",
     "xpack.infra.logs.customizeLogs.lineWrappingFormRowLabel": "改行",
     "xpack.infra.logs.customizeLogs.textSizeFormRowLabel": "テキストサイズ",
-    "xpack.infra.logs.customizeLogs.textSizeRadioGroup": "{textScale, select, small {小さい} medium {中くらい} large {大きい} other {{textScale}}}",
     "xpack.infra.logs.customizeLogs.wrapLongLinesSwitchLabel": "長い行を改行",
     "xpack.infra.logs.emptyView.checkForNewDataButtonLabel": "新規データを確認",
     "xpack.infra.logs.emptyView.noLogMessageDescription": "フィルターを調整してみてください。",
@@ -8555,7 +8493,7 @@
     "xpack.infra.logs.logAnalysis.splash.loadingMessage": "ライセンスを確認しています...",
     "xpack.infra.logs.logAnalysis.splash.splashImageAlt": "プレースホルダー画像",
     "xpack.infra.logs.logAnalysis.splash.startTrialCta": "トライアルを開始",
-    "xpack.infra.logs.logAnalysis.splash.startTrialDescription": "14日間無料の試用版には、機械学習機能が含まれており、ログで異常を検出することができます。",
+    "xpack.infra.logs.logAnalysis.splash.startTrialDescription": "無料の試用版には、機械学習機能が含まれており、ログで異常を検出することができます。",
     "xpack.infra.logs.logAnalysis.splash.startTrialTitle": "異常検知を利用するには、無料の試用版を開始してください",
     "xpack.infra.logs.logAnalysis.splash.updateSubscriptionCta": "サブスクリプションのアップグレード",
     "xpack.infra.logs.logAnalysis.splash.updateSubscriptionDescription": "機械学習機能を使用するには、プラチナサブスクリプションが必要です。",
@@ -8754,11 +8692,11 @@
     "xpack.infra.metrics.alertFlyout.alertName": "メトリックしきい値",
     "xpack.infra.metrics.alertFlyout.alertOnNoData": "データがない場合に通知する",
     "xpack.infra.metrics.alertFlyout.alertPreviewError": "このアラート条件をプレビューするときにエラーが発生しました",
+    "xpack.infra.metrics.alertFlyout.alertPreviewErrorDesc": "しばらくたってから再試行するか、詳細を確認してください。",
     "xpack.infra.metrics.alertFlyout.alertPreviewErrorResult": "一部のデータを評価するときにエラーが発生しました。",
-    "xpack.infra.metrics.alertFlyout.alertPreviewGroups": "{numberOfGroups} {groupName}",
     "xpack.infra.metrics.alertFlyout.alertPreviewGroupsAcross": "すべてを対象にする",
-    "xpack.infra.metrics.alertFlyout.alertPreviewNoDataResult": "データがない {boldedResultsNumber}結果がありました。",
-    "xpack.infra.metrics.alertFlyout.alertPreviewNoDataResultNumber": "{noData}",
+    "xpack.infra.metrics.alertFlyout.alertPreviewNoDataResult": "データなしの件数：{boldedResultsNumber}",
+    "xpack.infra.metrics.alertFlyout.alertPreviewNoDataResultNumber": "{noData, plural, one {件の結果がありました} other {件の結果がありました}}",
     "xpack.infra.metrics.alertFlyout.alertPreviewResult": "このアラートは{firedTimes}回発生しました",
     "xpack.infra.metrics.alertFlyout.alertPreviewResultLookback": "過去{lookback}",
     "xpack.infra.metrics.alertFlyout.conditions": "条件",
@@ -8770,6 +8708,7 @@
     "xpack.infra.metrics.alertFlyout.error.thresholdRequired": "しきい値が必要です。",
     "xpack.infra.metrics.alertFlyout.error.thresholdTypeRequired": "しきい値には有効な数値を含める必要があります。",
     "xpack.infra.metrics.alertFlyout.error.timeRequred": "ページサイズが必要です。",
+    "xpack.infra.metrics.alertFlyout.errorDetails": "詳細",
     "xpack.infra.metrics.alertFlyout.expandRowLabel": "行を展開します。",
     "xpack.infra.metrics.alertFlyout.expression.for.descriptionLabel": "対象",
     "xpack.infra.metrics.alertFlyout.expression.for.popoverTitle": "インベントリタイプ",
@@ -8796,8 +8735,12 @@
     "xpack.infra.metrics.alertFlyout.tooManyBucketsErrorDescription": "選択するプレビュー長を短くするか、{forTheLast}フィールドの時間を増やしてください。",
     "xpack.infra.metrics.alertFlyout.tooManyBucketsErrorTitle": "データが多すぎます（>{maxBuckets}結果）",
     "xpack.infra.metrics.alertFlyout.weekLabel": "週",
+    "xpack.infra.metrics.alerting.alertStateActionVariableDescription": "現在のアラートの状態",
+    "xpack.infra.metrics.alerting.groupActionVariableDescription": "データを報告するグループの名前",
     "xpack.infra.metrics.alerting.inventory.threshold.defaultActionMessage": "\\{\\{alertName\\}\\} - \\{\\{context.group\\}\\}は状態\\{\\{context.alertState\\}\\}です\n\n理由：\n\\{\\{context.reason\\}\\}\n",
     "xpack.infra.metrics.alerting.inventory.threshold.fired": "実行",
+    "xpack.infra.metrics.alerting.metricActionVariableDescription": "指定された条件のメトリック名。使用方法：（ctx.metric.condition0、ctx.metric.condition1など）。",
+    "xpack.infra.metrics.alerting.reasonActionVariableDescription": "どのメトリックがどのしきい値を超えたのかを含む、アラートがこの状態である理由に関する説明",
     "xpack.infra.metrics.alerting.threshold.aboveRecovery": "より大",
     "xpack.infra.metrics.alerting.threshold.alertState": "アラート",
     "xpack.infra.metrics.alerting.threshold.belowRecovery": "より小",
@@ -8818,6 +8761,9 @@
     "xpack.infra.metrics.alerting.threshold.outsideRangeComparator": "の間にない",
     "xpack.infra.metrics.alerting.threshold.recoveredAlertReason": "{metric}は{comparator} {threshold}のしきい値です（現在の値は{currentValue}）",
     "xpack.infra.metrics.alerting.threshold.thresholdRange": "{a}と{b}",
+    "xpack.infra.metrics.alerting.thresholdActionVariableDescription": "指定された条件のメトリックのしきい値。使用方法：（ctx.threshold.condition0、ctx.threshold.condition1など）。",
+    "xpack.infra.metrics.alerting.timestampDescription": "アラートが検出された時点のタイムスタンプ。",
+    "xpack.infra.metrics.alerting.valueActionVariableDescription": "指定された条件のメトリックの値。使用方法：（ctx.value.condition0、ctx.value.condition1など）。",
     "xpack.infra.metrics.alerts.dataTimeRangeLabel": "過去{lookback} {timeLabel}",
     "xpack.infra.metrics.alerts.dataTimeRangeLabelWithGrouping": "{id}のデータの過去{lookback} {timeLabel}",
     "xpack.infra.metrics.alerts.loadingMessage": "読み込み中",
@@ -8836,7 +8782,6 @@
     "xpack.infra.metrics.missingTSVBModelError": "{nodeType}では{metricId}のTSVBモデルが存在しません",
     "xpack.infra.metrics.pluginTitle": "メトリック",
     "xpack.infra.metrics.refetchButtonLabel": "新規データを確認",
-    "xpack.infra.metricsExplorer.everything": "すべて",
     "xpack.infra.metricsExplorer.actionsLabel.aria": "{grouping} のアクション",
     "xpack.infra.metricsExplorer.actionsLabel.button": "アクション",
     "xpack.infra.metricsExplorer.aggregationLabel": "/",
@@ -8928,7 +8873,7 @@
     "xpack.infra.savedView.manageViews": "ビューの管理",
     "xpack.infra.savedView.saveNewView": "新しいビューの保存",
     "xpack.infra.savedView.searchPlaceholder": "保存されたビューの検索",
-    "xpack.infra.savedView.unknownView": "不明",
+    "xpack.infra.savedView.unknownView": "ビューが選択されていません",
     "xpack.infra.savedView.updateView": "ビューの更新",
     "xpack.infra.snapshot.missingSnapshotMetricError": "{nodeType}の{metric}の集約を使用できません。",
     "xpack.infra.sourceConfiguration.addLogColumnButtonLabel": "列を追加",
@@ -9079,54 +9024,11 @@
     "xpack.infra.waffle.unableToSelectMetricErrorTitle": "メトリックのオプションまたは値を選択できません",
     "xpack.infra.waffleTime.autoRefreshButtonLabel": "自動更新",
     "xpack.infra.waffleTime.stopRefreshingButtonLabel": "更新中止",
-    "xpack.ingestManager.agentPolicy.confirmModalCalloutDescription": "選択されたエージェント構成{policyName}が一部のエージェントで既に使用されていることをフリートが検出しました。このアクションの結果として、フリートはこの構成で使用されているすべてのエージェントに更新をデプロイします。",
-    "xpack.ingestManager.agentPolicy.confirmModalCancelButtonLabel": "キャンセル",
-    "xpack.ingestManager.agentPolicy.confirmModalConfirmButtonLabel": "変更を保存してデプロイ",
-    "xpack.ingestManager.agentPolicy.confirmModalDescription": "このアクションは元に戻せません。続行していいですか？",
-    "xpack.ingestManager.agentPolicy.confirmModalTitle": "変更を保存してデプロイ",
-    "xpack.ingestManager.agentPolicy.linkedAgentCountText": "{count, plural, one {# エージェント} other {# エージェント}}",
-    "xpack.ingestManager.agentPolicyActionMenu.buttonText": "アクション",
-    "xpack.ingestManager.agentPolicyActionMenu.copyPolicyActionText": "構成のコピー",
-    "xpack.ingestManager.agentPolicyActionMenu.enrollAgentActionText": "エージェントの追加",
-    "xpack.ingestManager.agentPolicyActionMenu.viewPolicyText": "構成を表示",
-    "xpack.ingestManager.agentPolicyForm.advancedOptionsToggleLabel": "高度なオプション",
-    "xpack.ingestManager.agentPolicyForm.descriptionFieldLabel": "説明",
-    "xpack.ingestManager.agentPolicyForm.descriptionFieldPlaceholder": "この構成がどのように使用されるか",
-    "xpack.ingestManager.agentPolicyForm.monitoringDescription": "パフォーマンスのデバッグと追跡のために、エージェントに関するデータを収集します。",
-    "xpack.ingestManager.agentPolicyForm.monitoringLabel": "アラート監視",
-    "xpack.ingestManager.agentPolicyForm.monitoringLogsFieldLabel": "エージェントログを収集",
-    "xpack.ingestManager.agentPolicyForm.monitoringMetricsFieldLabel": "エージェントメトリックを収集",
-    "xpack.ingestManager.agentPolicyForm.nameFieldLabel": "名前",
-    "xpack.ingestManager.agentPolicyForm.nameFieldPlaceholder": "名前を選択",
-    "xpack.ingestManager.agentPolicyForm.nameRequiredErrorMessage": "エージェント構成名が必要です",
-    "xpack.ingestManager.agentPolicyForm.namespaceFieldDescription": "この構成を使用する統合にデフォルトの名前空間を適用します。統合はその独自の名前空間を指定できます。",
-    "xpack.ingestManager.agentPolicyForm.namespaceFieldLabel": "デフォルト名前空間",
-    "xpack.ingestManager.agentPolicyForm.namespaceRequiredErrorMessage": "ネームスペースが必要です",
-    "xpack.ingestManager.agentPolicyForm.systemMonitoringFieldLabel": "オプション",
-    "xpack.ingestManager.agentPolicyForm.systemMonitoringText": "システムメトリックを収集",
-    "xpack.ingestManager.agentPolicyForm.systemMonitoringTooltipText": "このオプションを有効にすると、システムメトリックと情報を収集する統合で構成をブートストラップできます。",
-    "xpack.ingestManager.agentPolicyList.actionsColumnTitle": "アクション",
-    "xpack.ingestManager.agentPolicyList.addButton": "エージェント構成を作成",
-    "xpack.ingestManager.agentPolicyList.agentsColumnTitle": "エージェント",
-    "xpack.ingestManager.agentPolicyList.clearFiltersLinkText": "フィルターを消去",
-    "xpack.ingestManager.agentPolicyList.descriptionColumnTitle": "説明",
-    "xpack.ingestManager.agentPolicyList.loadingAgentPoliciesMessage": "エージェント構成を読み込み中...",
-    "xpack.ingestManager.agentPolicyList.nameColumnTitle": "名前",
-    "xpack.ingestManager.agentPolicyList.noAgentPoliciesPrompt": "エージェント構成なし",
-    "xpack.ingestManager.agentPolicyList.noFilteredAgentPoliciesPrompt": "エージェント構成が見つかりません。 {clearFiltersLink}",
-    "xpack.ingestManager.agentPolicyList.packagePoliciesCountColumnTitle": "統合",
-    "xpack.ingestManager.agentPolicyList.pageSubtitle": "エージェント構成を使用すると、エージェントとエージェントが収集するデータを管理できます。",
-    "xpack.ingestManager.agentPolicyList.pageTitle": "エージェント構成",
-    "xpack.ingestManager.agentPolicyList.reloadAgentPoliciesButtonText": "再読み込み",
-    "xpack.ingestManager.agentPolicyList.revisionNumber": "rev. {revNumber}",
-    "xpack.ingestManager.agentPolicyList.updatedOnColumnTitle": "最終更新日:",
     "xpack.ingestManager.agentDetails.actionsButton": "アクション",
-    "xpack.ingestManager.agentDetails.agentPolicyLabel": "エージェント構成",
     "xpack.ingestManager.agentDetails.agentDetailsTitle": "エージェント'{id}'",
     "xpack.ingestManager.agentDetails.agentNotFoundErrorDescription": "エージェントID {agentId}が見つかりません",
     "xpack.ingestManager.agentDetails.agentNotFoundErrorTitle": "エージェントが見つかりません",
-    "xpack.ingestManager.agentDetails.policyLabel": "構成",
-    "xpack.ingestManager.agentDetails.hostIdLabel": "ホストID",
+    "xpack.ingestManager.agentDetails.hostIdLabel": "エージェントID",
     "xpack.ingestManager.agentDetails.hostNameLabel": "ホスト名",
     "xpack.ingestManager.agentDetails.localMetadataSectionSubtitle": "メタデータを読み込み中",
     "xpack.ingestManager.agentDetails.metadataSectionTitle": "メタデータ",
@@ -9140,21 +9042,16 @@
     "xpack.ingestManager.agentDetails.viewAgentListTitle": "すべてのエージェントを表示",
     "xpack.ingestManager.agentEnrollment.cancelButtonLabel": "キャンセル",
     "xpack.ingestManager.agentEnrollment.continueButtonLabel": "続行",
-    "xpack.ingestManager.agentEnrollment.copyPolicyButton": "クリップボードにコピー",
     "xpack.ingestManager.agentEnrollment.copyRunInstructionsButton": "クリップボードにコピー",
-    "xpack.ingestManager.agentEnrollment.downloadPolicyButton": "構成のダウンロード",
     "xpack.ingestManager.agentEnrollment.downloadDescription": "ホストのコンピューターでElasticエージェントをダウンロードします。Elasticエージェントダウンロードページでは、エージェントバイナリと検証署名にアクセスできます。",
     "xpack.ingestManager.agentEnrollment.downloadLink": "elastic.co/downloadsに移動",
     "xpack.ingestManager.agentEnrollment.enrollFleetTabLabel": "フリートに登録",
     "xpack.ingestManager.agentEnrollment.enrollStandaloneTabLabel": "スタンドアロンモード",
     "xpack.ingestManager.agentEnrollment.fleetNotInitializedText": "エージェントを登録する前に、フリートを設定する必要があります。{link}",
     "xpack.ingestManager.agentEnrollment.flyoutTitle": "エージェントの追加",
-    "xpack.ingestManager.agentEnrollment.goToFleetButton": "フリートに移動します。",
     "xpack.ingestManager.agentEnrollment.managedDescription": "必要なエージェントの数に関係なく、Fleetでは、簡単に一元的に更新を管理し、エージェントにデプロイすることができます。次の手順に従い、Elasticエージェントをダウンロードし、Fleetに登録してください。",
     "xpack.ingestManager.agentEnrollment.standaloneDescription": "スタンドアロンモードで実行中のエージェントは、構成を変更したい場合には、手動で更新する必要があります。次の手順に従い、スタンドアロンモードでElasticエージェントをダウンロードし、セットアップしてください。",
-    "xpack.ingestManager.agentEnrollment.stepCheckForDataDescription": "エージェントを起動した後、エージェントはデータの送信を開始します。Ingest Managerのデータセットページでは、このデータを確認できます。",
     "xpack.ingestManager.agentEnrollment.stepCheckForDataTitle": "データを確認",
-    "xpack.ingestManager.agentEnrollment.stepChooseAgentPolicyTitle": "エージェント構成を選択",
     "xpack.ingestManager.agentEnrollment.stepConfigureAgentDescription": "この構成をコピーし、Elasticエージェントがインストールされているシステムのファイル{fileName}に置きます。必ず、構成ファイルの{outputSection}セクションで{ESUsernameVariable}と{ESPasswordVariable}を修正し、実際のElasticsearch認証資格情報が使用されるようにしてください。",
     "xpack.ingestManager.agentEnrollment.stepConfigureAgentTitle": "エージェントの構成",
     "xpack.ingestManager.agentEnrollment.stepDownloadAgentTitle": "Elasticエージェントをダウンロード",
@@ -9172,8 +9069,8 @@
     "xpack.ingestManager.agentEventsList.timestampColumnTitle": "タイムスタンプ",
     "xpack.ingestManager.agentEventsList.typeColumnTitle": "タイプ",
     "xpack.ingestManager.agentEventSubtype.acknowledgedLabel": "認識",
-    "xpack.ingestManager.agentEventSubtype.policyLabel": "構成",
     "xpack.ingestManager.agentEventSubtype.dataDumpLabel": "データダンプ",
+    "xpack.ingestManager.agentEventSubtype.degradedLabel": "劣化",
     "xpack.ingestManager.agentEventSubtype.failedLabel": "失敗",
     "xpack.ingestManager.agentEventSubtype.inProgressLabel": "進行中",
     "xpack.ingestManager.agentEventSubtype.runningLabel": "実行中",
@@ -9198,9 +9095,8 @@
     "xpack.ingestManager.agentList.actionsColumnTitle": "アクション",
     "xpack.ingestManager.agentList.addButton": "エージェントの追加",
     "xpack.ingestManager.agentList.clearFiltersLinkText": "フィルターを消去",
-    "xpack.ingestManager.agentList.policyColumnTitle": "エージェント構成",
-    "xpack.ingestManager.agentList.policyFilterText": "エージェント構成",
     "xpack.ingestManager.agentList.enrollButton": "エージェントの追加",
+    "xpack.ingestManager.agentList.forceUnenrollOneButton": "強制的に登録解除する",
     "xpack.ingestManager.agentList.hostColumnTitle": "ホスト",
     "xpack.ingestManager.agentList.lastCheckinTitle": "前回のアクティビティ",
     "xpack.ingestManager.agentList.loadingAgentsMessage": "エージェントを読み込み中...",
@@ -9222,13 +9118,6 @@
     "xpack.ingestManager.agentListStatus.offlineLabel": "オフライン",
     "xpack.ingestManager.agentListStatus.onlineLabel": "オンライン",
     "xpack.ingestManager.agentListStatus.totalLabel": "エージェント",
-    "xpack.ingestManager.agentReassignPolicy.cancelButtonLabel": "キャンセル",
-    "xpack.ingestManager.agentReassignPolicy.policyDescription": "選択したエージェント構成は、{count, plural, one {{countValue}個の統合} other {{countValue}個の統合}}のデータを収集します。",
-    "xpack.ingestManager.agentReassignPolicy.continueButtonLabel": "構成を割り当て",
-    "xpack.ingestManager.agentReassignPolicy.flyoutDescription": "選択したエージェントに割り当てる、新しいエージェント構成を選択します。",
-    "xpack.ingestManager.agentReassignPolicy.flyoutTitle": "新しいエージェント構成を割り当て",
-    "xpack.ingestManager.agentReassignPolicy.selectPolicyLabel": "エージェント構成",
-    "xpack.ingestManager.agentReassignPolicy.successSingleNotificationTitle": "新しいエージェント構成が再割り当てされました",
     "xpack.ingestManager.alphaMessageDescription": "Ingest Managerは本番環境用ではありません。",
     "xpack.ingestManager.alphaMessageLinkText": "詳細を参照してください。",
     "xpack.ingestManager.alphaMessageTitle": "ベータリリース",
@@ -9238,7 +9127,6 @@
     "xpack.ingestManager.alphaMessaging.forumLink": "ディスカッションフォーラム",
     "xpack.ingestManager.alphaMessaging.introText": "Ingest Managerは開発中であり、本番環境用ではありません。このベータリリースは、ユーザーがIngest Managerと新しいElasticエージェントをテストしてフィードバックを提供することを目的としています。このプラグインには、サポートSLAが適用されません。",
     "xpack.ingestManager.alphaMessging.closeFlyoutLabel": "閉じる",
-    "xpack.ingestManager.appNavigation.policiesLinkText": "構成",
     "xpack.ingestManager.appNavigation.dataStreamsLinkText": "データセット",
     "xpack.ingestManager.appNavigation.epmLinkText": "統合",
     "xpack.ingestManager.appNavigation.fleetLinkText": "フリート",
@@ -9248,102 +9136,15 @@
     "xpack.ingestManager.appTitle": "Ingest Manager",
     "xpack.ingestManager.betaBadge.labelText": "ベータ",
     "xpack.ingestManager.betaBadge.tooltipText": "このプラグインは本番環境用ではありません。バグについてはディスカッションフォーラムで報告してください。",
-    "xpack.ingestManager.breadcrumbs.addPackagePolicyPageTitle": "統合の追加",
     "xpack.ingestManager.breadcrumbs.allIntegrationsPageTitle": "すべて",
     "xpack.ingestManager.breadcrumbs.appTitle": "Ingest Manager",
-    "xpack.ingestManager.breadcrumbs.policiesPageTitle": "構成",
     "xpack.ingestManager.breadcrumbs.datastreamsPageTitle": "データセット",
-    "xpack.ingestManager.breadcrumbs.editPackagePolicyPageTitle": "統合の編集",
     "xpack.ingestManager.breadcrumbs.fleetAgentsPageTitle": "エージェント",
     "xpack.ingestManager.breadcrumbs.fleetEnrollmentTokensPageTitle": "登録トークン",
     "xpack.ingestManager.breadcrumbs.fleetPageTitle": "フリート",
     "xpack.ingestManager.breadcrumbs.installedIntegrationsPageTitle": "インストール済み",
     "xpack.ingestManager.breadcrumbs.integrationsPageTitle": "統合",
     "xpack.ingestManager.breadcrumbs.overviewPageTitle": "概要",
-    "xpack.ingestManager.policyDetails.addPackagePolicyButtonText": "統合の追加",
-    "xpack.ingestManager.policyDetails.policyDetailsTitle": "構成「{id}」",
-    "xpack.ingestManager.policyDetails.policyNotFoundErrorTitle": "構成「{id}」が見つかりません",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.actionsColumnTitle": "アクション",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.deleteActionTitle": "統合の削除",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.descriptionColumnTitle": "説明",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.editActionTitle": "統合の編集",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.nameColumnTitle": "名前",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.namespaceColumnTitle": "名前空間",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.packageNameColumnTitle": "統合",
-    "xpack.ingestManager.policyDetails.subTabs.packagePoliciesTabText": "統合",
-    "xpack.ingestManager.policyDetails.subTabs.settingsTabText": "設定",
-    "xpack.ingestManager.policyDetails.summary.lastUpdated": "最終更新日:",
-    "xpack.ingestManager.policyDetails.summary.integrations": "統合",
-    "xpack.ingestManager.policyDetails.summary.revision": "リビジョン",
-    "xpack.ingestManager.policyDetails.summary.usedBy": "使用者",
-    "xpack.ingestManager.policyDetails.unexceptedErrorTitle": "構成を読み込む間にエラーが発生しました",
-    "xpack.ingestManager.policyDetails.viewAgentListTitle": "すべてのエージェント構成を表示",
-    "xpack.ingestManager.policyDetails.yamlDownloadButtonLabel": "構成のダウンロード",
-    "xpack.ingestManager.policyDetails.yamlFlyoutCloseButtonLabel": "閉じる",
-    "xpack.ingestManager.policyDetails.yamlflyoutTitleWithName": "「{name}」エージェント構成の編集",
-    "xpack.ingestManager.policyDetails.yamlflyoutTitleWithoutName": "エージェント構成",
-    "xpack.ingestManager.policyDetailsPackagePolicies.createFirstButtonText": "統合の追加",
-    "xpack.ingestManager.policyDetailsPackagePolicies.createFirstMessage": "この構成にはまだ統合がありません。",
-    "xpack.ingestManager.policyDetailsPackagePolicies.createFirstTitle": "最初の統合を追加",
-    "xpack.ingestManager.policyForm.deletePolicyActionText": "構成を削除",
-    "xpack.ingestManager.policyForm.deletePolicyGroupDescription": "既存のデータは削除されません。",
-    "xpack.ingestManager.policyForm.deletePolicyGroupTitle": "構成を削除",
-    "xpack.ingestManager.policyForm.generalSettingsGroupDescription": "エージェント構成の名前と説明を選択してください。",
-    "xpack.ingestManager.policyForm.generalSettingsGroupTitle": "一般設定",
-    "xpack.ingestManager.policyForm.unableToDeleteDefaultPolicyText": "既定の構成は削除できません。",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.cancelButtonLabel": "キャンセル",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.confirmButtonLabel": "構成をコピー",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.copyPolicyPrompt": "新しいエージェント構成の名前と説明を選択してください。",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.copyPolicyTitle": "「{name}」エージェント構成をコピー",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.defaultNewPolicyName": "{name}（コピー）",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.newDescriptionLabel": "説明",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.newNameLabel": "新しい構成名",
-    "xpack.ingestManager.copyAgentPolicy.failureNotificationTitle": "エージェント構成「{id}」のコピーエラー",
-    "xpack.ingestManager.copyAgentPolicy.fatalErrorNotificationTitle": "エージェント構成のコピーエラー",
-    "xpack.ingestManager.copyAgentPolicy.successNotificationTitle": "エージェント構成がコピーされました",
-    "xpack.ingestManager.createAgentPolicy.cancelButtonLabel": "キャンセル",
-    "xpack.ingestManager.createAgentPolicy.errorNotificationTitle": "エージェント構成を作成できません",
-    "xpack.ingestManager.createAgentPolicy.flyoutTitle": "エージェント構成を作成",
-    "xpack.ingestManager.createAgentPolicy.flyoutTitleDescription": "エージェント構成は、エージェントのグループ全体にわたる設定を管理する目的で使用されます。エージェント構成に統合を追加すると、エージェントで収集するデータを指定できます。エージェント構成の編集時には、フリートを使用して、指定したエージェントのグループに更新をデプロイできます。",
-    "xpack.ingestManager.createAgentPolicy.submitButtonLabel": "エージェント構成を作成",
-    "xpack.ingestManager.createAgentPolicy.successNotificationTitle": "エージェント構成「{name}」を作成しました",
-    "xpack.ingestManager.createPackagePolicy.addedNotificationMessage": "フリートは'{agentPolicyName}'構成で使用されているすべてのエージェントに更新をデプロイします。",
-    "xpack.ingestManager.createPackagePolicy.addedNotificationTitle": "正常に「{packagePolicyName}」を追加しました",
-    "xpack.ingestManager.createPackagePolicy.agentPolicyNameLabel": "エージェント構成",
-    "xpack.ingestManager.createPackagePolicy.cancelButton": "キャンセル",
-    "xpack.ingestManager.createPackagePolicy.cancelLinkText": "キャンセル",
-    "xpack.ingestManager.createPackagePolicy.errorOnSaveText": "統合構成にはエラーがあります。保存前に修正してください。",
-    "xpack.ingestManager.createPackagePolicy.pageDescriptionfromPolicy": "選択したエージェント構成の統合を構成します。",
-    "xpack.ingestManager.createPackagePolicy.pageDescriptionfromPackage": "次の手順に従い、この統合をエージェント構成に追加します。",
-    "xpack.ingestManager.createPackagePolicy.pageTitle": "統合の追加",
-    "xpack.ingestManager.createPackagePolicy.pageTitleWithPackageName": "{packageName}統合の追加",
-    "xpack.ingestManager.createPackagePolicy.saveButton": "統合の保存",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.advancedOptionsToggleLinkText": "高度なオプション",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.errorCountText": "{count, plural, one {件のエラー} other {件のエラー}}",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.hideStreamsAriaLabel": "{type}入力を非表示",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.inputSettingsDescription": "次の設定は以下のすべての入力に適用されます。",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.inputSettingsTitle": "設定",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.inputVarFieldOptionalLabel": "オプション",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.integrationSettingsSectionDescription": "この統合の使用方法を識別できるように、名前と説明を選択してください。",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.integrationSettingsSectionTitle": "統合設定",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.noPolicyOptionsMessage": "構成するものがありません",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.packagePolicyDescriptionInputLabel": "説明",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.packagePolicyNameInputLabel": "統合名",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.packagePolicyNamespaceInputLabel": "名前空間",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.showStreamsAriaLabel": "{type}入力を表示",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.toggleAdvancedOptionsButtonText": "高度なオプション",
-    "xpack.ingestManager.createPackagePolicy.stepConfigurePackagePolicyTitle": "統合の構成",
-    "xpack.ingestManager.createPackagePolicy.stepSelectAgentPolicyTitle": "エージェント構成を選択する",
-    "xpack.ingestManager.createPackagePolicy.StepSelectPolicy.addButton": "新しいエージェント構成",
-    "xpack.ingestManager.createPackagePolicy.StepSelectPolicy.agentPolicyAgentsCountText": "{count, plural, one {# エージェント} other {# エージェント}}",
-    "xpack.ingestManager.createPackagePolicy.StepSelectPolicy.errorLoadingAgentPoliciesTitle": "エージェント構成の読み込みエラー",
-    "xpack.ingestManager.createPackagePolicy.StepSelectPolicy.errorLoadingPackageTitle": "パッケージ情報の読み込みエラー",
-    "xpack.ingestManager.createPackagePolicy.StepSelectPolicy.errorLoadingSelectedAgentPolicyTitle": "選択したエージェント構成の読み込みエラー",
-    "xpack.ingestManager.createPackagePolicy.stepSelectPackage.errorLoadingPolicyTitle": "エージェント構成情報の読み込みエラー",
-    "xpack.ingestManager.createPackagePolicy.stepSelectPackage.errorLoadingPackagesTitle": "統合の読み込みエラー",
-    "xpack.ingestManager.createPackagePolicy.stepSelectPackage.errorLoadingSelectedPackageTitle": "選択した統合の読み込みエラー",
-    "xpack.ingestManager.createPackagePolicy.stepSelectPackage.filterPackagesInputPlaceholder": "統合を検索",
-    "xpack.ingestManager.createPackagePolicy.stepSelectPackageTitle": "統合を選択",
     "xpack.ingestManager.dataStreamList.actionsColumnTitle": "アクション",
     "xpack.ingestManager.dataStreamList.datasetColumnTitle": "データセット",
     "xpack.ingestManager.dataStreamList.integrationColumnTitle": "統合",
@@ -9362,73 +9163,34 @@
     "xpack.ingestManager.dataStreamList.viewDashboardsActionText": "ダッシュボードを表示",
     "xpack.ingestManager.dataStreamList.viewDashboardsPanelTitle": "ダッシュボードを表示",
     "xpack.ingestManager.defaultSearchPlaceholderText": "検索",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.affectedAgentsMessage": "{agentsCount, plural, one {# エージェントは} other {# エージェントは}}このエージェント構成に割り当てられました。この構成を削除する前に、これらのエージェントの割り当てを解除します。",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.affectedAgentsTitle": "使用中の構成",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.cancelButtonLabel": "キャンセル",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.confirmButtonLabel": "構成を削除",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.deletePolicyTitle": "このエージェント構成を削除しますか？",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.irreversibleMessage": "この操作は元に戻すことができません。",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.loadingAgentsCountMessage": "影響があるエージェントの数を確認中...",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.loadingButtonLabel": "読み込み中...",
-    "xpack.ingestManager.deleteAgentPolicy.failureSingleNotificationTitle": "エージェント構成「{id}」の削除エラー",
-    "xpack.ingestManager.deleteAgentPolicy.fatalErrorNotificationTitle": "エージェント構成の削除エラー",
-    "xpack.ingestManager.deleteAgentPolicy.successSingleNotificationTitle": "エージェント構成「{id}」を削除しました",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.affectedAgentsMessage": "{agentPolicyName} が一部のエージェントですでに使用されていることをフリートが検出しました。",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.affectedAgentsTitle": "このアクションは {agentsCount} {agentsCount, plural, one {# エージェント} other {# エージェント}}に影響します",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.cancelButtonLabel": "キャンセル",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.confirmButtonLabel": "{agentPoliciesCount, plural, one {個の統合} other {個の統合}}を削除",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.deleteMultipleTitle": "{count, plural, one {個の統合} other {個の統合}}を削除しますか?",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.generalMessage": "このアクションは元に戻せません。続行していいですか？",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.loadingAgentsCountMessage": "影響があるエージェントを確認中...",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.loadingButtonLabel": "読み込み中...",
-    "xpack.ingestManager.deletePackagePolicy.failureMultipleNotificationTitle": "{count}個の統合の削除エラー",
-    "xpack.ingestManager.deletePackagePolicy.failureSingleNotificationTitle": "統合「{id}」の削除エラー",
-    "xpack.ingestManager.deletePackagePolicy.fatalErrorNotificationTitle": "統合の削除エラー",
-    "xpack.ingestManager.deletePackagePolicy.successMultipleNotificationTitle": "{count}個の統合を削除しました",
-    "xpack.ingestManager.deletePackagePolicy.successSingleNotificationTitle": "統合「{id}」を削除しました",
     "xpack.ingestManager.disabledSecurityDescription": "Elastic Fleet を使用するには、Kibana と Elasticsearch でセキュリティを有効にする必要があります。",
     "xpack.ingestManager.disabledSecurityTitle": "セキュリティが有効ではありません",
-    "xpack.ingestManager.editAgentPolicy.cancelButtonText": "キャンセル",
-    "xpack.ingestManager.editAgentPolicy.errorNotificationTitle": "エージェント構成を作成できません",
-    "xpack.ingestManager.editAgentPolicy.saveButtonText": "変更を保存",
-    "xpack.ingestManager.editAgentPolicy.savingButtonText": "保存中…",
-    "xpack.ingestManager.editAgentPolicy.successNotificationTitle": "正常に'{name}'設定を更新しました",
-    "xpack.ingestManager.editAgentPolicy.unsavedChangesText": "保存されていない変更があります",
-    "xpack.ingestManager.editPackagePolicy.cancelButton": "キャンセル",
-    "xpack.ingestManager.editPackagePolicy.errorLoadingDataMessage": "この統合情報の読み込みエラーが発生しました",
-    "xpack.ingestManager.editPackagePolicy.errorLoadingDataTitle": "データの読み込み中にエラーが発生",
-    "xpack.ingestManager.editPackagePolicy.failedConflictNotificationMessage": "データが最新ではありません。最新の構成を取得するには、ページを更新してください。",
-    "xpack.ingestManager.editPackagePolicy.failedNotificationTitle": "「{packagePolicyName}」の更新エラー",
-    "xpack.ingestManager.editPackagePolicy.pageDescription": "統合設定を修正し、選択したエージェント構成に変更をデプロイします。",
-    "xpack.ingestManager.editPackagePolicy.pageTitle": "統合の編集",
-    "xpack.ingestManager.editPackagePolicy.pageTitleWithPackageName": "{packageName}統合の編集",
-    "xpack.ingestManager.editPackagePolicy.saveButton": "統合の保存",
-    "xpack.ingestManager.editPackagePolicy.updatedNotificationMessage": "フリートは'{agentPolicyName}'構成で使用されているすべてのエージェントに更新をデプロイします。",
-    "xpack.ingestManager.editPackagePolicy.updatedNotificationTitle": "正常に「{packagePolicyName}」を更新しました",
     "xpack.ingestManager.enrollemntAPIKeyList.emptyMessage": "登録トークンが見つかりません。",
     "xpack.ingestManager.enrollemntAPIKeyList.loadingTokensMessage": "登録トークンを読み込んでいます...",
-    "xpack.ingestManager.enrollmentStepAgentPolicy.policySelectAriaLabel": "エージェント構成",
-    "xpack.ingestManager.enrollmentStepAgentPolicy.policySelectLabel": "エージェント構成",
-    "xpack.ingestManager.enrollmentStepAgentPolicy.enrollmentTokenSelectLabel": "登録トークン",
-    "xpack.ingestManager.enrollmentStepAgentPolicy.showAuthenticationSettingsButton": "認証設定",
+    "xpack.ingestManager.enrollmentInstructions.descriptionText": "エージェントのディレクトリから、該当するコマンドを実行し、Elasticエージェントを登録して起動します。再度これらのコマンドを実行すれば、複数のコンピューターでエージェントを設定できます。登録ステップは必ずシステムで管理者権限をもつユーザーとして実行してください。",
+    "xpack.ingestManager.enrollmentInstructions.linuxDebRpmTitle": "Linux（.debおよび.rpm）",
+    "xpack.ingestManager.enrollmentInstructions.macLinuxTarInstructions": "エージェントのシステムが再起動する場合は、{command}を実行する必要があります。",
+    "xpack.ingestManager.enrollmentInstructions.macLinuxTarTitle": "macOS / Linux (.tar.gz)",
+    "xpack.ingestManager.enrollmentInstructions.windowsTitle": "Windows",
     "xpack.ingestManager.enrollmentTokenDeleteModal.cancelButton": "キャンセル",
     "xpack.ingestManager.enrollmentTokenDeleteModal.deleteButton": "削除",
     "xpack.ingestManager.enrollmentTokenDeleteModal.description": "{keyName}を削除してよろしいですか？",
     "xpack.ingestManager.enrollmentTokenDeleteModal.title": "登録トークンを削除",
     "xpack.ingestManager.enrollmentTokensList.actionsTitle": "アクション",
     "xpack.ingestManager.enrollmentTokensList.activeTitle": "アクティブ",
-    "xpack.ingestManager.enrollmentTokensList.policyTitle": "エージェント構成",
     "xpack.ingestManager.enrollmentTokensList.createdAtTitle": "作成日時",
+    "xpack.ingestManager.enrollmentTokensList.hideTokenButtonLabel": "トークンを非表示",
     "xpack.ingestManager.enrollmentTokensList.nameTitle": "名前",
     "xpack.ingestManager.enrollmentTokensList.newKeyButton": "新しい登録トークン",
     "xpack.ingestManager.enrollmentTokensList.pageDescription": "これは、エージェントを登録するために使用できる登録トークンのリストです。",
+    "xpack.ingestManager.enrollmentTokensList.revokeTokenButtonLabel": "トークンを取り消す",
     "xpack.ingestManager.enrollmentTokensList.secretTitle": "シークレット",
-    "xpack.ingestManager.epm.addPackagePolicyButtonText": "{packageName}の追加",
+    "xpack.ingestManager.enrollmentTokensList.showTokenButtonLabel": "トークンを表示",
+    "xpack.ingestManager.epm.assetGroupTitle": "{assetType}アセット",
     "xpack.ingestManager.epm.browseAllButtonText": "すべての統合を参照",
     "xpack.ingestManager.epm.illustrationAltText": "統合の例",
     "xpack.ingestManager.epm.loadingIntegrationErrorTitle": "統合詳細の読み込みエラー",
     "xpack.ingestManager.epm.packageDetailsNav.overviewLinkText": "概要",
-    "xpack.ingestManager.epm.packageDetailsNav.packagePoliciesLinkText": "使用",
     "xpack.ingestManager.epm.packageDetailsNav.settingsLinkText": "設定",
     "xpack.ingestManager.epm.pageSubtitle": "一般的なアプリやサービスの統合を参照する",
     "xpack.ingestManager.epm.pageTitle": "統合",
@@ -9507,7 +9269,6 @@
     "xpack.ingestManager.metadataForm.submitButtonText": "追加",
     "xpack.ingestManager.metadataForm.valueLabel": "値",
     "xpack.ingestManager.newEnrollmentKey.cancelButtonLabel": "キャンセル",
-    "xpack.ingestManager.newEnrollmentKey.policyLabel": "構成",
     "xpack.ingestManager.newEnrollmentKey.flyoutTitle": "新しい登録トークンを作成",
     "xpack.ingestManager.newEnrollmentKey.keyCreatedToasts": "登録トークンが作成されました。",
     "xpack.ingestManager.newEnrollmentKey.nameLabel": "名前",
@@ -9518,17 +9279,12 @@
     "xpack.ingestManager.overviewAgentErrorTitle": "エラー",
     "xpack.ingestManager.overviewAgentOfflineTitle": "オフライン",
     "xpack.ingestManager.overviewAgentTotalTitle": "合計エージェント数",
-    "xpack.ingestManager.overviewPolicyTotalTitle": "合計利用可能数",
     "xpack.ingestManager.overviewDatastreamNamespacesTitle": "名前空間",
     "xpack.ingestManager.overviewDatastreamSizeTitle": "合計サイズ",
     "xpack.ingestManager.overviewDatastreamTotalTitle": "データセット",
     "xpack.ingestManager.overviewIntegrationsInstalledTitle": "インストール済み",
     "xpack.ingestManager.overviewIntegrationsTotalTitle": "合計利用可能数",
     "xpack.ingestManager.overviewIntegrationsUpdatesAvailableTitle": "更新が可能です",
-    "xpack.ingestManager.overviewPackagePolicyTitle": "構成された統合",
-    "xpack.ingestManager.overviewPagePoliciesPanelAction": "構成を表示",
-    "xpack.ingestManager.overviewPagePoliciesPanelTitle": "エージェント構成",
-    "xpack.ingestManager.overviewPagePoliciesPanelTooltip": "エージェント構成を使用すると、エージェントが収集するデータを管理できます。",
     "xpack.ingestManager.overviewPageDataStreamsPanelAction": "データセットを表示",
     "xpack.ingestManager.overviewPageDataStreamsPanelTitle": "データセット",
     "xpack.ingestManager.overviewPageDataStreamsPanelTooltip": "エージェントが収集するデータはさまざまなデータセットに整理されます。",
@@ -9541,11 +9297,6 @@
     "xpack.ingestManager.overviewPageIntegrationsPanelTooltip": "Elastic Stackの統合を参照し、インストールします。統合をエージェント構成に追加し、データの送信を開始します。",
     "xpack.ingestManager.overviewPageSubtitle": "Elasticエージェントおよびエージェント構成の集中管理。",
     "xpack.ingestManager.overviewPageTitle": "Ingest Manager",
-    "xpack.ingestManager.packagePolicyValidation.invalidArrayErrorMessage": "無効なフォーマット",
-    "xpack.ingestManager.packagePolicyValidation.invalidYamlFormatErrorMessage": "YAML形式が無効です",
-    "xpack.ingestManager.packagePolicyValidation.nameRequiredErrorMessage": "名前が必要です",
-    "xpack.ingestManager.packagePolicyValidation.namespaceRequiredErrorMessage": "ネームスペースが必要です",
-    "xpack.ingestManager.packagePolicyValidation.requiredErrorMessage": "{fieldName}が必要です",
     "xpack.ingestManager.permissionDeniedErrorMessage": "Ingest Managerにアクセスする権限がありません。Ingest Managerには{roleName}権限が必要です。",
     "xpack.ingestManager.permissionDeniedErrorTitle": "パーミッションが拒否されました",
     "xpack.ingestManager.permissionsRequestErrorMessageDescription": "Ingest Managerアクセス権の確認中に問題が発生しました",
@@ -9590,8 +9341,10 @@
     "xpack.ingestManager.unenrollAgents.confirmModal.confirmButtonLabel": "登録解除",
     "xpack.ingestManager.unenrollAgents.confirmModal.deleteMultipleTitle": "{count, plural, one {# エージェント} other {# エージェント}}の登録を解除しますか？",
     "xpack.ingestManager.unenrollAgents.confirmModal.deleteSingleTitle": "エージェント「{id}」の登録を解除しますか？",
+    "xpack.ingestManager.unenrollAgents.confirmModal.forceDeleteSingleTitle": "強制的にエージェント「{id}」の登録を解除しますか？",
     "xpack.ingestManager.unenrollAgents.confirmModal.loadingButtonLabel": "読み込み中...",
     "xpack.ingestManager.unenrollAgents.fatalErrorNotificationTitle": "エージェントの登録解除エラー",
+    "xpack.ingestManager.unenrollAgents.successForceSingleNotificationTitle": "エージェント「{id}」の登録を解除しました",
     "xpack.ingestManager.unenrollAgents.successSingleNotificationTitle": "エージェント「{id}」を登録解除しています",
     "xpack.ingestPipelines.app.checkingPrivilegesDescription": "権限を確認中…",
     "xpack.ingestPipelines.app.checkingPrivilegesErrorMessage": "サーバーからユーザー特権を取得中にエラーが発生。",
@@ -9715,13 +9468,12 @@
     "xpack.ingestPipelines.pipelineEditor.removeProcessorModal.cancelButtonLabel": "キャンセル",
     "xpack.ingestPipelines.pipelineEditor.removeProcessorModal.confirmationButtonLabel": "プロセッサーの削除",
     "xpack.ingestPipelines.pipelineEditor.removeProcessorModal.titleText": "{type}プロセッサーの削除",
-    "xpack.ingestPipelines.pipelineEditor.setForm.fieldFieldLabel": "フィールド",
-    "xpack.ingestPipelines.pipelineEditor.setForm.fieldRequiredError": "フィールド値が必要です。",
     "xpack.ingestPipelines.pipelineEditor.setForm.overrideFieldLabel": "無効化",
     "xpack.ingestPipelines.pipelineEditor.setForm.valueFieldLabel": "値",
     "xpack.ingestPipelines.pipelineEditor.setForm.valueRequiredError": "設定する値が必要です。",
     "xpack.ingestPipelines.pipelineEditor.settingsForm.learnMoreLabelLink.processor": "{processorLabel}ドキュメント",
     "xpack.ingestPipelines.pipelineEditor.typeField.fieldRequiredError": "タイプが必要です。",
+    "xpack.ingestPipelines.pipelineEditor.typeField.typeFieldComboboxPlaceholder": "入力してエンターキーを押してください",
     "xpack.ingestPipelines.pipelineEditor.typeField.typeFieldLabel": "プロセッサー",
     "xpack.ingestPipelines.processors.label.append": "末尾に追加",
     "xpack.ingestPipelines.processors.label.bytes": "バイト",
@@ -9763,6 +9515,7 @@
     "xpack.ingestPipelines.requestFlyout.unnamedTitle": "リクエスト",
     "xpack.ingestPipelines.settingsFormOnFailureFlyout.addButtonLabel": "追加",
     "xpack.ingestPipelines.settingsFormOnFailureFlyout.cancelButtonLabel": "キャンセル",
+    "xpack.ingestPipelines.settingsFormOnFailureFlyout.updateButtonLabel": "更新",
     "xpack.ingestPipelines.tabs.outputTabTitle": "アウトプット",
     "xpack.ingestPipelines.testPipelineFlyout.documentsForm.documentsFieldLabel": "ドキュメント",
     "xpack.ingestPipelines.testPipelineFlyout.documentsForm.documentsJsonError": "ドキュメントJSONが無効です。",
@@ -9802,7 +9555,6 @@
     "xpack.lens.configure.editConfig": "構成の編集",
     "xpack.lens.configure.emptyConfig": "ここにフィールドをドロップ",
     "xpack.lens.dataPanelWrapper.switchDatasource": "データソースに切り替える",
-    "xpack.lens.datatable.columns": "フィールド",
     "xpack.lens.datatable.conjunctionSign": " と ",
     "xpack.lens.datatable.expressionHelpLabel": "データベースレンダー",
     "xpack.lens.datatable.label": "データテーブル",
@@ -9848,6 +9600,7 @@
     "xpack.lens.functions.renameColumns.idMap.help": "キーが古い列 ID で値が対応する新しい列 ID となるように JSON エンコーディングされたオブジェクトです。他の列 ID はすべてのそのままです。",
     "xpack.lens.includeValueButtonAriaLabel": "{value}を含める",
     "xpack.lens.includeValueButtonTooltip": "値を含める",
+    "xpack.lens.indexPattern.allFieldsLabel": "すべてのフィールド",
     "xpack.lens.indexPattern.availableFieldsLabel": "利用可能なフィールド",
     "xpack.lens.indexPattern.avg": "平均",
     "xpack.lens.indexPattern.avgOf": "{name} の平均",
@@ -9875,6 +9628,8 @@
     "xpack.lens.indexPattern.defaultFormatLabel": "デフォルト",
     "xpack.lens.indexPattern.emptyFieldsLabel": "空のフィールド",
     "xpack.lens.indexpattern.emptyTextColumnValue": "（空）",
+    "xpack.lens.indexPattern.existenceErrorAriaLabel": "存在の取り込みに失敗しました",
+    "xpack.lens.indexPattern.existenceErrorLabel": "フィールド情報を読み込めません",
     "xpack.lens.indexPattern.fieldDistributionLabel": "分布",
     "xpack.lens.indexPattern.fieldItemTooltip": "可視化するには、ドラッグアンドドロップします。",
     "xpack.lens.indexPattern.fieldlessOperationLabel": "この関数を使用するには、フィールドを選択してください。",
@@ -9883,6 +9638,7 @@
     "xpack.lens.indexPattern.fieldStatsButtonLabel": "フィールドプレビューを表示するには、クリックします。可視化するには、ドラッグアンドドロップします。",
     "xpack.lens.indexPattern.fieldStatsCountLabel": "カウント",
     "xpack.lens.indexPattern.fieldStatsDisplayToggle": "次のどちらかを切り替えます:",
+    "xpack.lens.indexPattern.fieldStatsNoData": "表示するデータがありません",
     "xpack.lens.indexPattern.fieldTimeDistributionLabel": "時間分布",
     "xpack.lens.indexPattern.fieldTopValuesLabel": "トップの値",
     "xpack.lens.indexPattern.groupByDropdown": "グループ分けの条件",
@@ -10189,7 +9945,7 @@
     "xpack.maps.aggs.defaultCountLabel": "カウント",
     "xpack.maps.appTitle": "マップ",
     "xpack.maps.blendedVectorLayer.clusteredLayerName": "クラスター化 {displayName}",
-    "xpack.maps.breadCrumbs.unsavedChangesWarning": "保存されていない変更は保存されない可能性があります",
+    "xpack.maps.breadCrumbs.unsavedChangesWarning": "マップには保存されていない変更があります。終了してよろしいですか？",
     "xpack.maps.choropleth.boundaries.elasticsearch": "Elasticsearchの点、線、多角形",
     "xpack.maps.choropleth.boundaries.ems": "Elastic Maps Serviceの行政区画のベクターシェイプ",
     "xpack.maps.choropleth.boundariesLabel": "境界ソース",
@@ -10518,12 +10274,12 @@
     "xpack.maps.source.kbnTMSDescription": "kibana.yml で構成されたマップタイルです",
     "xpack.maps.source.kbnTMSTitle": "カスタムタイルマップサービス",
     "xpack.maps.source.mapSettingsPanel.initialLocationLabel": "マップの初期位置情報",
-    "xpack.maps.source.MVTSingleLayerVectorSource.sourceTitle": ".pbfベクトルタイル",
+    "xpack.maps.source.MVTSingleLayerVectorSource.sourceTitle": "ベクトルタイル",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.dataZoomRangeMessage": "ズーム：",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.fieldsMessage": "フィールド",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.fieldsPostHelpMessage": "これらはツールチップと動的スタイルで使用できます。",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.fieldsPreHelpMessage": "使用可能なフィールド ",
-    "xpack.maps.source.MVTSingleLayerVectorSourceEditor.layerNameMessage": "タイルレイヤー",
+    "xpack.maps.source.MVTSingleLayerVectorSourceEditor.layerNameMessage": "ソースレイヤー",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.urlHelpMessage": ".mvtベクトルタイルサービスのURL。例：{url}",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.urlMessage": "Url",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.zoomRangeHelpMessage": "レイヤーがタイルに存在するズームレベル。これは直接可視性に対応しません。レベルが低いレイヤーデータは常に高いズームレベルで表示できます（ただし逆はありません）。",
@@ -10660,7 +10416,9 @@
     "xpack.maps.visTypeAlias.legacyMapVizWarning": "座標マップと地域マップの代わりに、マップアプリを使用します。\nマップアプリはより機能が豊富で、使いやすくなっています。",
     "xpack.maps.visTypeAlias.title": "マップ",
     "xpack.maps.xyztmssource.attributionLink": "属性テキストにはリンクが必要です",
+    "xpack.maps.xyztmssource.attributionLinkLabel": "属性リンク",
     "xpack.maps.xyztmssource.attributionText": "属性 URL にはテキストが必要です",
+    "xpack.maps.xyztmssource.attributionTextLabel": "属性テキスト",
     "xpack.ml.accessDenied.description": "ML プラグインへのアクセスパーミッションがありません",
     "xpack.ml.accessDenied.label": "パーミッションがありません",
     "xpack.ml.accessDeniedLabel": "アクセスが拒否されました",
@@ -10936,7 +10694,7 @@
     "xpack.ml.dataframe.analytics.create.calloutMessage": "分析フィールドを読み込むには追加のデータが必要です。",
     "xpack.ml.dataframe.analytics.create.calloutTitle": "分析フィールドがありません",
     "xpack.ml.dataframe.analytics.create.chooseSourceTitle": "ソースインデックスパターンを選択してください",
-    "xpack.ml.dataframe.analytics.create.classificationHelpText": "分類ジョブには表のようなデータ構造でマッピングされたソースインデックスが必要で、数値、ブール値、テキスト、キーワード、またはIPフィールドのみがサポートされます。予測フィールド名などのカスタムオプションを適用するには、詳細エディターを使用します。",
+    "xpack.ml.dataframe.analytics.create.classificationHelpText": "分類はデータセットのデータポイントのラベルを予測します。",
     "xpack.ml.dataframe.analytics.create.computeFeatureInfluenceFalseValue": "False",
     "xpack.ml.dataframe.analytics.create.computeFeatureInfluenceLabel": "演算機能影響",
     "xpack.ml.dataframe.analytics.create.computeFeatureInfluenceLabelHelpText": "機能影響演算が有効かどうかを指定します。デフォルトはtrueです。",
@@ -10985,6 +10743,7 @@
     "xpack.ml.dataframe.analytics.create.detailsDetails.editButtonText": "編集",
     "xpack.ml.dataframe.analytics.create.duplicateIndexPatternErrorMessage": "Kibanaインデックスパターンの作成中にエラーが発生しました。",
     "xpack.ml.dataframe.analytics.create.duplicateIndexPatternErrorMessageError": "インデックスパターン{indexPatternName}はすでに作成されています。",
+    "xpack.ml.dataframe.analytics.create.errorCheckingIndexExists": "既存のインデックス名の取得中に次のエラーが発生しました：{error}",
     "xpack.ml.dataframe.analytics.create.errorCreatingDataFrameAnalyticsJob": "データフレーム分析ジョブの作成中にエラーが発生しました。",
     "xpack.ml.dataframe.analytics.create.errorGettingDataFrameAnalyticsList": "既存のデータフレーム分析ジョブIDの取得中にエラーが発生しました。",
     "xpack.ml.dataframe.analytics.create.errorGettingIndexPatternTitles": "既存のインデックスパターンのタイトルの取得中にエラーが発生しました。",
@@ -11000,8 +10759,8 @@
     "xpack.ml.dataframe.analytics.create.gammaInputAriaLabel": "フォレストの個別のツリーのサイズに関連付けられた線形ペナルティを乗算します",
     "xpack.ml.dataframe.analytics.create.gammaLabel": "ガンマ",
     "xpack.ml.dataframe.analytics.create.gammaText": "フォレストの個別のツリーのサイズに関連付けられた線形ペナルティを乗算します。非負の値でなければなりません。",
-    "xpack.ml.dataframe.analytics.create.hyperParametersDetailsTitle": "ハイパーパラメーター",
-    "xpack.ml.dataframe.analytics.create.hyperParametersSectionTitle": "ハイパーパラメーター",
+    "xpack.ml.dataframe.analytics.create.hyperParametersDetailsTitle": "ハイパーパラメータ",
+    "xpack.ml.dataframe.analytics.create.hyperParametersSectionTitle": "ハイパーパラメータ",
     "xpack.ml.dataframe.analytics.create.includedFieldsCount": "{numFields, plural, one {個のフィールド} other {個のフィールド}}が分析に含まれます",
     "xpack.ml.dataframe.analytics.create.includedFieldsLabel": "含まれるフィールド",
     "xpack.ml.dataframe.analytics.create.indexPatternAlreadyExistsError": "このタイトルのインデックスパターンが既に存在します。",
@@ -11045,11 +10804,11 @@
     "xpack.ml.dataframe.analytics.create.numTopFeatureImportanceValuesHelpText": "返すドキュメントごとに機能重要度値の最大数を指定します。",
     "xpack.ml.dataframe.analytics.create.numTopFeatureImportanceValuesInputAriaLabel": "ドキュメントごとの機能重要度値の最大数。",
     "xpack.ml.dataframe.analytics.create.numTopFeatureImportanceValuesLabel": "機能重要度値",
-    "xpack.ml.dataframe.analytics.create.outlierDetectionHelpText": "外れ値検出ジョブは、表に示すようなデータ構造でマッピングされたソースインデックスを必要とし、数字とブール値フィールドのみを分析します。カスタムオプションを構成に追加するには、詳細エディターを使用します。",
+    "xpack.ml.dataframe.analytics.create.outlierDetectionHelpText": "異常値検出により、データセットにおける異常なデータポイントが特定されます。",
     "xpack.ml.dataframe.analytics.create.outlierFractionHelpText": "異常値検出の前に異常であると想定されるデータセットの比率を設定します。",
     "xpack.ml.dataframe.analytics.create.outlierFractionInputAriaLabel": "異常値検出の前に異常であると想定されるデータセットの比率を設定します。",
     "xpack.ml.dataframe.analytics.create.outlierFractionLabel": "異常値割合",
-    "xpack.ml.dataframe.analytics.create.outlierRegressionHelpText": "リグレッションジョブは数値フィールドのみを分析します。予測フィールド名などのカスタムオプションを適用するには、詳細エディターを使用します。",
+    "xpack.ml.dataframe.analytics.create.outlierRegressionHelpText": "回帰はデータセットにおける数値を予測します。",
     "xpack.ml.dataframe.analytics.create.predictionFieldNameHelpText": "結果で予測フィールドの名前を定義します。デフォルトは<dependent_variable>_predictionです。",
     "xpack.ml.dataframe.analytics.create.predictionFieldNameLabel": "予測フィールド名",
     "xpack.ml.dataframe.analytics.create.randomizeSeedInputAriaLabel": "学習で使用されるドキュメントを選択するために使用される乱数生成器のシード",
@@ -11128,6 +10887,7 @@
     "xpack.ml.dataframe.analytics.regressionExploration.trainingErrorTitle": "トレーニングエラー",
     "xpack.ml.dataframe.analytics.regressionExploration.trainingFilterText": ".テストデータをフィルタリングしています。",
     "xpack.ml.dataframe.analyticsList.analyticsDetails.tabs.analyticsMessagesLabel": "ジョブメッセージ",
+    "xpack.ml.dataframe.analyticsList.cloneActionPermissionTooltip": "分析ジョブを複製する権限がありません。",
     "xpack.ml.dataframe.analyticsList.completeBatchAnalyticsToolTip": "{analyticsId}は完了済みの分析ジョブで、再度開始できません。",
     "xpack.ml.dataframe.analyticsList.createDataFrameAnalyticsButton": "ジョブを作成",
     "xpack.ml.dataframe.analyticsList.deleteActionDisabledToolTipContent": "削除するにはデータフレーム分析ジョブを停止してください。",
@@ -11139,7 +10899,6 @@
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexPatternSuccessMessage": "インデックスパターン{destinationIndex}を削除する要求が確認されました。",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexSuccessMessage": "ディスティネーションインデックス{destinationIndex}を削除する要求が確認されました。",
     "xpack.ml.dataframe.analyticsList.deleteDestinationIndexTitle": "ディスティネーションインデックス{indexName}を削除",
-    "xpack.ml.dataframe.analyticsList.deleteModalBody": "この分析ジョブを削除してよろしいですか？",
     "xpack.ml.dataframe.analyticsList.deleteModalCancelButton": "キャンセル",
     "xpack.ml.dataframe.analyticsList.deleteModalDeleteButton": "削除",
     "xpack.ml.dataframe.analyticsList.deleteModalTitle": "{analyticsId}の削除",
@@ -11198,7 +10957,11 @@
     "xpack.ml.dataframe.analyticsList.title": "データフレーム分析ジョブ",
     "xpack.ml.dataframe.analyticsList.type": "タイプ",
     "xpack.ml.dataframe.analyticsList.typeFilter": "タイプ",
+    "xpack.ml.dataframe.analyticsList.viewActionJobFailedToolTipContent": "データフレーム分析ジョブに失敗しました。結果ページがありません。",
+    "xpack.ml.dataframe.analyticsList.viewActionJobNotFinishedToolTipContent": "データフレーム分析ジョブは完了していません。結果ページがありません。",
+    "xpack.ml.dataframe.analyticsList.viewActionJobNotStartedToolTipContent": "データフレーム分析ジョブが開始しませんでした。結果ページがありません。",
     "xpack.ml.dataframe.analyticsList.viewActionName": "表示",
+    "xpack.ml.dataframe.analyticsList.viewActionUnknownJobTypeToolTipContent": "このタイプのデータフレーム分析ジョブでは、結果ページがありません。",
     "xpack.ml.dataframe.stepCreateForm.createDataFrameAnalyticsSuccessMessage": "データフレーム分析 {jobId} の作成リクエストが受け付けられました。",
     "xpack.ml.dataframe.stepDetailsForm.destinationIndexInvalidErrorLink": "インデックス名の制限に関する詳細。",
     "xpack.ml.dataFrameAnalyticsBreadcrumbs.dataFrameExplorationLabel": "探索",
@@ -11277,6 +11040,8 @@
     "xpack.ml.explorer.addToDashboard.selectDashboardsLabel": "ダッシュボードを選択：",
     "xpack.ml.explorer.addToDashboard.selectSwimlanesLabel": "スイムレーンビューを選択：",
     "xpack.ml.explorer.addToDashboardLabel": "ダッシュボードに追加",
+    "xpack.ml.explorer.annotationsErrorCallOutTitle": "注釈の読み込み中にエラーが発生しました。",
+    "xpack.ml.explorer.annotationsErrorTitle": "注釈",
     "xpack.ml.explorer.annotationsTitle": "注釈{badge}",
     "xpack.ml.explorer.annotationsTitleTotalCount": "合計：{count}",
     "xpack.ml.explorer.anomaliesTitle": "異常",
@@ -11406,7 +11171,7 @@
     "xpack.ml.fileDatavisualizer.analysisSummary.timeFormatTitle": "時間 {timestampFormats, plural, zero {format} one {format} other {formats}}",
     "xpack.ml.fileDatavisualizer.bottomBar.backButtonLabel": "戻る",
     "xpack.ml.fileDatavisualizer.bottomBar.cancelButtonLabel": "キャンセル",
-    "xpack.ml.fileDatavisualizer.bottomBar.missingImportPrivilegesMessage": "データをインポートするために必要な権限がありません",
+    "xpack.ml.fileDatavisualizer.bottomBar.missingImportPrivilegesMessage": "データインポートを有効にするには、ingest_adminロールが必要です",
     "xpack.ml.fileDatavisualizer.bottomBar.readMode.cancelButtonLabel": "キャンセル",
     "xpack.ml.fileDatavisualizer.bottomBar.readMode.importButtonLabel": "インポート",
     "xpack.ml.fileDatavisualizer.editFlyout.applyOverrideSettingsButtonLabel": "適用",
@@ -11634,7 +11399,6 @@
     "xpack.ml.jobsList.deleteJobModal.cancelButtonLabel": "キャンセル",
     "xpack.ml.jobsList.deleteJobModal.closeButtonLabel": "閉じる",
     "xpack.ml.jobsList.deleteJobModal.deleteButtonLabel": "削除",
-    "xpack.ml.jobsList.deleteJobModal.deleteJobsDescription": "{jobsCount, plural, one {このジョブ} other {これらのジョブ}}を削除してよろしいですか？",
     "xpack.ml.jobsList.deleteJobModal.deleteJobsTitle": "{jobsCount, plural, one {{jobId}} other {# 件のジョブ}}を削除",
     "xpack.ml.jobsList.deleteJobModal.deleteMultipleJobsDescription": "{jobsCount, plural, one {ジョブ} other {複数ジョブ}}の削除には時間がかかる場合があります。{jobsCount, plural, one {} other {}}バックグラウンドで削除され、ジョブリストからすぐに消えない場合があります",
     "xpack.ml.jobsList.deleteJobModal.deletingJobsStatusLabel": "ジョブを削除中",
@@ -11924,6 +11688,7 @@
     "xpack.ml.navMenu.overviewTabLinkText": "概要",
     "xpack.ml.navMenu.settingsTabLinkText": "設定",
     "xpack.ml.newJob.page.createJob": "ジョブを作成",
+    "xpack.ml.newJob.page.createJob.indexPatternTitle": "インデックスパターン{index}の使用",
     "xpack.ml.newJob.recognize.advancedLabel": "高度な設定",
     "xpack.ml.newJob.recognize.advancedSettingsAriaLabel": "高度な設定",
     "xpack.ml.newJob.recognize.alreadyExistsLabel": "(既に存在します)",
@@ -12303,7 +12068,6 @@
     "xpack.ml.ruleEditor.deleteJobRule.ruleNoLongerExistsErrorMessage": "ジョブ {jobId} の検知器インデックス {detectorIndex} のルールが現在存在しません",
     "xpack.ml.ruleEditor.deleteRuleModal.cancelButtonLabel": "キャンセル",
     "xpack.ml.ruleEditor.deleteRuleModal.deleteButtonLabel": "削除",
-    "xpack.ml.ruleEditor.deleteRuleModal.deleteRuleDescription": "このルールを削除してよろしいですか？",
     "xpack.ml.ruleEditor.deleteRuleModal.deleteRuleLinkText": "ルールを削除",
     "xpack.ml.ruleEditor.deleteRuleModal.deleteRuleTitle": "ルールの削除",
     "xpack.ml.ruleEditor.detectorDescriptionList.detectorTitle": "検知器",
@@ -12397,7 +12161,6 @@
     "xpack.ml.settings.filterLists.deleteFilterListModal.cancelButtonLabel": "キャンセル",
     "xpack.ml.settings.filterLists.deleteFilterListModal.confirmButtonLabel": "削除",
     "xpack.ml.settings.filterLists.deleteFilterListModal.deleteButtonLabel": "削除",
-    "xpack.ml.settings.filterLists.deleteFilterListModal.deleteWarningMessage": "{selectedFilterListsLength, plural, one {このフィルダー} other {これらのフィルター}}を削除してよろしいですか？",
     "xpack.ml.settings.filterLists.deleteFilterListModal.modalTitle": "{selectedFilterListsLength, plural, one {{selectedFilterId}} other {# フィルターリスト}}の削除",
     "xpack.ml.settings.filterLists.deleteFilterLists.deletingErrorMessage": "フィルターリスト {filterListId} の削除中にエラーが発生しました。{respMessage}",
     "xpack.ml.settings.filterLists.deleteFilterLists.deletingNotificationMessage": "{filterListsToDeleteLength, plural, one {{filterListToDeleteId}} other {# フィルターリスト}}を削除しています",
@@ -12467,6 +12230,8 @@
     "xpack.ml.timeSeriesExplorer.annotationFlyout.maxLengthError": "最長 {maxChars} 文字を {charsOver, number} {charsOver, plural, one {文字} other {文字}} 超過",
     "xpack.ml.timeSeriesExplorer.annotationFlyout.noAnnotationTextError": "注釈テキストを入力してください",
     "xpack.ml.timeSeriesExplorer.annotationFlyout.updateButtonLabel": "更新",
+    "xpack.ml.timeSeriesExplorer.annotationsErrorCallOutTitle": "注釈の読み込み中にエラーが発生しました。",
+    "xpack.ml.timeSeriesExplorer.annotationsErrorTitle": "注釈",
     "xpack.ml.timeSeriesExplorer.annotationsLabel": "注釈",
     "xpack.ml.timeSeriesExplorer.annotationsTitle": "注釈{badge}",
     "xpack.ml.timeSeriesExplorer.anomaliesTitle": "異常",
@@ -12719,6 +12484,7 @@
     "xpack.monitoring.alerts.nodesChanged.resolved.internalShortMessage": "{clusterName}のElasticsearchノード変更アラートが解決されました。",
     "xpack.monitoring.alerts.nodesChanged.shortAction": "ノードを追加、削除、または再起動したことを確認してください。",
     "xpack.monitoring.alerts.nodesChanged.ui.addedFiringMessage": "Elasticsearchノード「{added}」がこのクラスターに追加されました。",
+    "xpack.monitoring.alerts.nodesChanged.ui.nothingDetectedFiringMessage": "Elasticsearchノードが変更されました",
     "xpack.monitoring.alerts.nodesChanged.ui.removedFiringMessage": "Elasticsearchノード「{removed}」がこのクラスターから削除されました。",
     "xpack.monitoring.alerts.nodesChanged.ui.resolvedMessage": "このクラスターのElasticsearchノードは変更されていません。",
     "xpack.monitoring.alerts.nodesChanged.ui.restartedFiringMessage": "このクラスターでElasticsearchノード「{restarted}」が再起動しました。",
@@ -13000,6 +12766,7 @@
     "xpack.monitoring.elasticsearch.node.advanced.routeTitle": "Elasticsearch - ノード - {nodeSummaryName} - 高度な設定",
     "xpack.monitoring.elasticsearch.node.overview.routeTitle": "Elasticsearch - ノード - {nodeName} - 概要",
     "xpack.monitoring.elasticsearch.node.statusIconLabel": "ステータス: {status}",
+    "xpack.monitoring.elasticsearch.nodeDetailStatus.alerts": "アラート",
     "xpack.monitoring.elasticsearch.nodeDetailStatus.dataLabel": "データ",
     "xpack.monitoring.elasticsearch.nodeDetailStatus.documentsLabel": "ドキュメント",
     "xpack.monitoring.elasticsearch.nodeDetailStatus.freeDiskSpaceLabel": "空きディスク容量",
@@ -13102,6 +12869,9 @@
     "xpack.monitoring.febLabel": "2月",
     "xpack.monitoring.formatNumbers.notAvailableLabel": "N/A",
     "xpack.monitoring.friLabel": "金",
+    "xpack.monitoring.healthCheck.encryptionErrorAction": "方法を確認してください。",
+    "xpack.monitoring.healthCheck.tlsAndEncryptionError": "アラート機能を使用するには、KibanaとElasticsearchとの間のトランスポート層セキュリティを有効化して、 \n              kibana.ymlファイルで暗号化鍵を構成する必要があります。",
+    "xpack.monitoring.healthCheck.tlsAndEncryptionErrorTitle": "追加の設定が必要です",
     "xpack.monitoring.janLabel": "1月",
     "xpack.monitoring.julLabel": "7月",
     "xpack.monitoring.junLabel": "6月",
@@ -13964,7 +13734,7 @@
     "xpack.observability.emptySection.apps.logs.link": "Filebeatをインストール",
     "xpack.observability.emptySection.apps.logs.title": "ログ",
     "xpack.observability.emptySection.apps.metrics.description": "インフラストラクチャ、アプリ、サービスからメトリックを分析します。傾向、予測動作を発見し、異常などに関するアラートを通知します。",
-    "xpack.observability.emptySection.apps.metrics.link": "メトリックモジュールのインストール",
+    "xpack.observability.emptySection.apps.metrics.link": "Metricbeatのインストール",
     "xpack.observability.emptySection.apps.metrics.title": "メトリック",
     "xpack.observability.emptySection.apps.uptime.description": "サイトとサービスの可用性をアクティブに監視するアラートを受信し、問題をより迅速に解決して、ユーザーエクスペリエンスを最適化します。",
     "xpack.observability.emptySection.apps.uptime.link": "Heartbeatのインストール",
@@ -13976,6 +13746,10 @@
     "xpack.observability.home.sectionsubtitle": "ログ、メトリック、トレースを大規模に、1つのスタックにまとめて、環境内のあらゆる場所で生じるイベントの監視、分析、対応を行います。",
     "xpack.observability.home.sectionTitle": "エコシステム全体の一元的な可視性",
     "xpack.observability.home.title": "オブザーバビリティ",
+    "xpack.observability.ingestManager.beta": "ベータ",
+    "xpack.observability.ingestManager.button": "Ingest Managerベータを試す",
+    "xpack.observability.ingestManager.text": "Elasticエージェントでは、シンプルかつ統合された方法で、ログ、メトリック、他の種類のデータの監視をホストに追加することができます。複数のBeatsと他のエージェントをインストールする必要はありません。このため、インフラストラクチャ全体での構成のデプロイが簡単で高速になりました。",
+    "xpack.observability.ingestManager.title": "新しいIngest Managerをご覧になりましたか?",
     "xpack.observability.landing.breadcrumb": "はじめて使う",
     "xpack.observability.news.readFullStory": "詳細なストーリーを読む",
     "xpack.observability.news.title": "新機能",
@@ -15037,7 +14811,7 @@
     "xpack.securitySolution.add_filter_to_global_search_bar.filterOutValueHoverAction": "値を除外",
     "xpack.securitySolution.alerts.riskScoreMapping.defaultDescriptionLabel": "このルールで生成されたすべてのアラートのリスクスコアを選択します。",
     "xpack.securitySolution.alerts.riskScoreMapping.defaultRiskScoreTitle": "デフォルトリスクスコア",
-    "xpack.securitySolution.alerts.riskScoreMapping.mappingDescriptionLabel": "ソースイベント（スケール1-100）からリスクスコアにフィールドをマッピングします。",
+    "xpack.securitySolution.alerts.riskScoreMapping.mappingDescriptionLabel": "ソースイベント値を使用して、デフォルトリスクスコアを上書きします。",
     "xpack.securitySolution.alerts.riskScoreMapping.mappingDetailsLabel": "値が境界外の場合、またはフィールドがない場合は、デフォルトリスクスコアが使用されます。",
     "xpack.securitySolution.alerts.riskScoreMapping.riskScoreFieldTitle": "signal.rule.risk_score",
     "xpack.securitySolution.alerts.riskScoreMapping.riskScoreMappingTitle": "リスクスコア無効化",
@@ -15045,7 +14819,7 @@
     "xpack.securitySolution.alerts.riskScoreMapping.sourceFieldTitle": "ソースフィールド",
     "xpack.securitySolution.alerts.severityMapping.defaultDescriptionLabel": "このルールで生成されたすべてのアラートの重要度sレベルを選択します。",
     "xpack.securitySolution.alerts.severityMapping.defaultSeverityTitle": "深刻度",
-    "xpack.securitySolution.alerts.severityMapping.mappingDescriptionLabel": "ソースイベントから特定の重要度に値をマッピングします。",
+    "xpack.securitySolution.alerts.severityMapping.mappingDescriptionLabel": "ソースイベント値を使用して、デフォルトの重要度を上書きします。",
     "xpack.securitySolution.alerts.severityMapping.mappingDetailsLabel": "複数の一致がある場合、最高重要度の一致が適用されます。一致がない場合は、デフォルト重要度が使用されます。",
     "xpack.securitySolution.alerts.severityMapping.severityMappingTitle": "重要度無効化",
     "xpack.securitySolution.alerts.severityMapping.severityTitle": "デフォルト重要度",
@@ -15381,8 +15155,8 @@
     "xpack.securitySolution.case.connectors.resilient.orgId": "組織ID",
     "xpack.securitySolution.case.connectors.resilient.requiredApiKeyIdTextField": "APIキーIDが必要です",
     "xpack.securitySolution.case.connectors.resilient.requiredApiKeySecretTextField": "APIキーシークレットが必要です",
-    "xpack.securitySolution.case.connectors.resilient.requiredOrgIdTextField": "組織ID",
-    "xpack.securitySolution.case.connectors.resilient.selectMessageText": "resilientでSIEMケースデータを更新するか、新しいインシデントにプッシュ",
+    "xpack.securitySolution.case.connectors.resilient.requiredOrgIdTextField": "組織IDが必要です",
+    "xpack.securitySolution.case.connectors.resilient.selectMessageText": "Resilientでセキュリティケースデータを更新するか、新しいインシデントにプッシュ",
     "xpack.securitySolution.case.createCase.descriptionFieldRequiredError": "説明が必要です。",
     "xpack.securitySolution.case.createCase.fieldTagsHelpText": "このケースの1つ以上のカスタム識別タグを入力します。新しいタグを開始するには、各タグの後でEnterを押します。",
     "xpack.securitySolution.case.createCase.titleFieldRequiredError": "タイトルが必要です。",
@@ -15395,8 +15169,8 @@
     "xpack.securitySolution.chart.allOthersGroupingLabel": "その他すべて",
     "xpack.securitySolution.chart.dataAllValuesZerosTitle": "すべての値はゼロを返します",
     "xpack.securitySolution.chart.dataNotAvailableTitle": "チャートデータが利用できません",
-    "xpack.securitySolution.chrome.help.appName": "SIEM",
-    "xpack.securitySolution.chrome.helpMenu.documentation": "SIEMドキュメンテーション",
+    "xpack.securitySolution.chrome.help.appName": "セキュリティ",
+    "xpack.securitySolution.chrome.helpMenu.documentation": "セキュリティドキュメント",
     "xpack.securitySolution.chrome.helpMenu.documentation.ecs": "ECSドキュメンテーション",
     "xpack.securitySolution.clipboard.copied": "コピー完了",
     "xpack.securitySolution.clipboard.copy": "コピー",
@@ -15456,7 +15230,7 @@
     "xpack.securitySolution.components.mlPopup.errors.createJobFailureTitle": "ジョブ作成エラー",
     "xpack.securitySolution.components.mlPopup.errors.startJobFailureTitle": "ジョブ開始エラー",
     "xpack.securitySolution.components.mlPopup.hooks.errors.indexPatternFetchFailureTitle": "インデックスパターン取得エラー",
-    "xpack.securitySolution.components.mlPopup.hooks.errors.siemJobFetchFailureTitle": "SIEMジョブ取得エラー",
+    "xpack.securitySolution.components.mlPopup.hooks.errors.siemJobFetchFailureTitle": "セキュリティジョブ取得エラー",
     "xpack.securitySolution.components.mlPopup.jobsTable.createCustomJobButtonLabel": "カスタムジョブを作成",
     "xpack.securitySolution.components.mlPopup.jobsTable.jobNameColumn": "ジョブ名",
     "xpack.securitySolution.components.mlPopup.jobsTable.noItemsDescription": "SIEM機械学習ジョブが見つかりませんでした",
@@ -15534,7 +15308,7 @@
     "xpack.securitySolution.dataProviders.valueAriaLabel": "値",
     "xpack.securitySolution.dataProviders.valuePlaceholder": "値",
     "xpack.securitySolution.detectionEngine.alerts.actions.addEndpointException": "エンドポイント例外の追加",
-    "xpack.securitySolution.detectionEngine.alerts.actions.addException": "例外の追加",
+    "xpack.securitySolution.detectionEngine.alerts.actions.addException": "ルール例外の追加",
     "xpack.securitySolution.detectionEngine.alerts.actions.closeAlertTitle": "アラートを閉じる",
     "xpack.securitySolution.detectionEngine.alerts.actions.inProgressAlertTitle": "実行中に設定",
     "xpack.securitySolution.detectionEngine.alerts.actions.investigateInTimelineTitle": "タイムラインで調査",
@@ -15581,7 +15355,7 @@
     "xpack.securitySolution.detectionEngine.alerts.utilityBar.selectedAlertsTitle": "Selected {selectedAlertsFormatted} {selectedAlerts, plural, =1 {件のアラート} other {件のアラート}}",
     "xpack.securitySolution.detectionEngine.alerts.utilityBar.showingAlertsTitle": "すべての{totalAlertsFormatted} {totalAlerts, plural, =1 {件のアラート} other {件のアラート}}を表示しています",
     "xpack.securitySolution.detectionEngine.alerts.utilityBar.takeActionTitle": "アクションを実行",
-    "xpack.securitySolution.detectionEngine.alertTitle": "外部アラート",
+    "xpack.securitySolution.detectionEngine.alertTitle": "検出アラート",
     "xpack.securitySolution.detectionEngine.buttonManageRules": "検出ルールの管理",
     "xpack.securitySolution.detectionEngine.components.importRuleModal.cancelTitle": "キャンセル",
     "xpack.securitySolution.detectionEngine.components.importRuleModal.importFailedDetailedTitle": "ルールID: {ruleId}\n ステータスコード: {statusCode}\n メッセージ: {message}",
@@ -15604,7 +15378,7 @@
     "xpack.securitySolution.detectionEngine.createRule.savedIdLabel": "保存されたクエリ名",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.descriptionFieldRequiredError": "説明が必要です。",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fiedIndexPatternsLabel": "インデックスパターン",
-    "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAssociatedToEndpointListLabel": "ルールをグローバルエンドポイント例外リストに関連付ける",
+    "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAssociatedToEndpointListLabel": "既存のエンドポイント例外をルールに追加",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAuthorHelpText": "このルールの作成者を1つ以上入力します。新しい作成者を追加するには、各作成者の後でEnterを押します。",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAuthorLabel": "作成者",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldBuildingBlockLabel": "すべての生成されたアラートを「基本」アラートに設定",
@@ -15626,7 +15400,7 @@
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTimelineTemplateLabel": "タイムラインテンプレート",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTimestampOverrideHelpText": "ルールを実行するときに使用されるタイムスタンプフィールドを選択します。入力時間（例：event.ingested）に最も近いタイムスタンプのフィールドを選択します。",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTimestampOverrideLabel": "タイムスタンプ無効化",
-    "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.guideHelpText": "シグナル調査を実施するアナリストに役立つ情報を提供します。このガイドは、ルールの詳細ページとこのルールで生成されたアラートから作成されたタイムラインの両方に表示されます。",
+    "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.guideHelpText": "検出アラートの調査を実施するアナリストに役立つ情報を提供します。このガイドは、ルールの詳細ページとこのルールで生成された検出アラートから（メモとして）作成されたタイムラインに表示されます。",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.guideLabel": "調査ガイド",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.nameFieldRequiredError": "名前が必要です。",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutrule.noteHelpText": "ルール調査ガイドを追加...",
@@ -15634,7 +15408,7 @@
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.addReferenceDescription": "参照URLを追加します",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.advancedSettingsButton": "高度な設定",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.buildingBlockLabel": "基本",
-    "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.endpointExceptionListLabel": "グローバルエンドポイント例外リスト",
+    "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.endpointExceptionListLabel": "Elastic Endpoint例外",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.severityOptionCriticalDescription": "重大",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.severityOptionHighDescription": "高",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.severityOptionLowDescription": "低",
@@ -15652,7 +15426,7 @@
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesCustomDescription": "インデックスのカスタムリストを入力します",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesFromConfigDescription": "セキュリティソリューション詳細設定からElasticsearchインデックスを使用します",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesHelperDescription": "このルールを実行するElasticsearchインデックスのパターンを入力しますデフォルトでは、セキュリティソリューション詳細設定で定義されたインデックスパターンが含まれます。",
-    "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdHelpText": "手始めに使えるように、一般的なジョブがいくつか提供されています。独自のカスタムジョブを追加するには、{machineLearning} アプリケーションでジョブに「siem」のグループを割り当て、ここに表示されるようにします。",
+    "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdHelpText": "手始めに使えるように、一般的なジョブがいくつか提供されています。独自のカスタムジョブを追加するには、{machineLearning} アプリケーションでジョブに「security」のグループを割り当て、ここに表示されるようにします。",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdRequired": "機械学習ジョブが必要です。",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.mlEnableJobWarningTitle": "このMLジョブは現在実行されていません。このルールを有効にする前に、このジョブを「MLジョブ設定」で実行するように設定してください。",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.mlJobSelectPlaceholderText": "ジョブを選択してください",
@@ -15685,6 +15459,7 @@
     "xpack.securitySolution.detectionEngine.details.stepAboutRule.aboutText": "概要",
     "xpack.securitySolution.detectionEngine.details.stepAboutRule.detailsLabel": "詳細",
     "xpack.securitySolution.detectionEngine.details.stepAboutRule.investigationGuideLabel": "調査ガイド",
+    "xpack.securitySolution.detectionEngine.detectionsBreadcrumbTitle": "検出",
     "xpack.securitySolution.detectionEngine.detectionsPageTitle": "検出アラート",
     "xpack.securitySolution.detectionEngine.dismissButton": "閉じる",
     "xpack.securitySolution.detectionEngine.dismissNoApiIntegrationKeyButton": "閉じる",
@@ -15694,6 +15469,7 @@
     "xpack.securitySolution.detectionEngine.editRule.errorMsgDescription": "申し訳ありません",
     "xpack.securitySolution.detectionEngine.editRule.pageTitle": "ルール設定の編集",
     "xpack.securitySolution.detectionEngine.editRule.saveChangeTitle": "変更を保存",
+    "xpack.securitySolution.detectionEngine.emptyActionBeats": "セットアップの手順を表示",
     "xpack.securitySolution.detectionEngine.emptyActionSecondary": "ドキュメントに移動",
     "xpack.securitySolution.detectionEngine.emptyTitle": "セキュリティアプリケーションの検出エンジンに関連したインデックスがないようです",
     "xpack.securitySolution.detectionEngine.goToDocumentationButton": "ドキュメンテーションを表示",
@@ -15985,6 +15761,10 @@
     "xpack.securitySolution.detectionEngine.mitreAttackTechniques.xslScriptProcessingDescription": "XSLスクリプト処理(T1220)",
     "xpack.securitySolution.detectionEngine.mlRulesDisabledMessageTitle": "MLルールにはプラチナライセンスとML管理者権限が必要です",
     "xpack.securitySolution.detectionEngine.mlUnavailableTitle": "{totalRules} {totalRules, plural, =1 {個のルール} other {個のルール}}で機械学習を有効にする必要があります。",
+    "xpack.securitySolution.detectionEngine.needsIndexPermissionsMessage": "検出エンジンを使用するには、必要なクラスターおよびインデックス権限をもつユーザーが最初にこのページにアクセスする必要があります。{additionalContext}ヘルプについては、Elastic Stack管理者にお問い合わせください。",
+    "xpack.securitySolution.detectionEngine.needsListsIndexesMessage": "listsインデックスの権限が必要です。",
+    "xpack.securitySolution.detectionEngine.needsSignalsAndListsIndexesMessage": "signalsおよびlistsインデックスの権限が必要です。",
+    "xpack.securitySolution.detectionEngine.needsSignalsIndexMessage": "signalsインデックスの権限が必要です。",
     "xpack.securitySolution.detectionEngine.noApiIntegrationKeyCallOutMsg": "Kibanaを起動するごとに保存されたオブジェクトの新しい暗号化キーを作成します。永続キーがないと、Kibanaの再起動後にルールを削除または修正することができません。永続キーを設定するには、kibana.ymlファイルに32文字以上のテキスト値を付けてxpack.encryptedSavedObjects.encryptionKey設定を追加してください。",
     "xpack.securitySolution.detectionEngine.noApiIntegrationKeyCallOutTitle": "API統合キーが必要です",
     "xpack.securitySolution.detectionEngine.noIndexTitle": "検出エンジンを設定しましょう",
@@ -16076,9 +15856,9 @@
     "xpack.securitySolution.detectionEngine.rules.optionalFieldDescription": "オプション",
     "xpack.securitySolution.detectionEngine.rules.pageTitle": "検出ルール",
     "xpack.securitySolution.detectionEngine.rules.prePackagedRules.createOwnRuletButton": "独自のルールの作成",
-    "xpack.securitySolution.detectionEngine.rules.prePackagedRules.emptyPromptMessage": "Elasticセキュリティには、バックグラウンドで実行され、条件が合うとアラートを作成する事前構築済み検出ルールがあります。デフォルトでは、すべての事前構築済みルールが無効化されていて、有効化したいルールを選択します。",
+    "xpack.securitySolution.detectionEngine.rules.prePackagedRules.emptyPromptMessage": "Elasticセキュリティには、バックグラウンドで実行され、条件が合うとアラートを作成する事前構築済み検出ルールがあります。デフォルトでは、Elastic Endpoint Securityルールを除くすべての事前構築済みルールが無効になっています。有効にする追加のルールを選択することができます。",
     "xpack.securitySolution.detectionEngine.rules.prePackagedRules.emptyPromptTitle": "Elastic事前構築済み検出ルールを読み込む",
-    "xpack.securitySolution.detectionEngine.rules.prePackagedRules.loadPreBuiltButton": "事前構築済み検知ルールを読み込む",
+    "xpack.securitySolution.detectionEngine.rules.prePackagedRules.loadPreBuiltButton": "事前構築済み検出ルールおよびタイムラインテンプレートを読み込む",
     "xpack.securitySolution.detectionEngine.rules.releaseNotesHelp": "リリースノート",
     "xpack.securitySolution.detectionEngine.rules.reloadMissingPrePackagedRulesAndTimelinesButton": "{missingRules} Elastic事前構築済み{missingRules, plural, =1 {ルール} other {ルール}}と{missingTimelines} Elastic事前構築済み{missingTimelines, plural, =1 {タイムライン} other {タイムライン}}をインストール ",
     "xpack.securitySolution.detectionEngine.rules.reloadMissingPrePackagedRulesButton": "{missingRules} Elasticの事前構築済みの{missingRules, plural, =1 {個のルール} other {個のルール}}をインストール ",
@@ -16107,6 +15887,7 @@
     "xpack.securitySolution.detectionEngine.totalSignalTitle": "合計",
     "xpack.securitySolution.detectionEngine.userUnauthenticatedMsgBody": "検出エンジンを表示するための必要なアクセス権がありません。ヘルプについては、管理者にお問い合わせください。",
     "xpack.securitySolution.detectionEngine.userUnauthenticatedTitle": "検出エンジンアクセス権が必要です",
+    "xpack.securitySolution.detectionEngine.validations.thresholdValueFieldData.numberGreaterThanOrEqualOneErrorMessage": "値は1以上でなければなりません。",
     "xpack.securitySolution.dragAndDrop.addToTimeline": "タイムライン調査に追加",
     "xpack.securitySolution.dragAndDrop.closeButtonLabel": "閉じる",
     "xpack.securitySolution.dragAndDrop.copyToClipboardTooltip": "クリップボードにコピー",
@@ -16128,72 +15909,15 @@
     "xpack.securitySolution.editDataProvider.selectAnOperatorPlaceholder": "演算子を選択",
     "xpack.securitySolution.editDataProvider.valueLabel": "値",
     "xpack.securitySolution.editDataProvider.valuePlaceholder": "値",
-    "xpack.securitySolution.emptyMessage": "Elastic セキュリティは無料かつオープンのElastic SIEMに、Elastic Endpointを搭載。脅威の防御と検知、脅威への対応を支援します。開始するには、セキュリティソリューション関連データをElastic Stackに追加する必要があります。詳細については、ご覧ください ",
+    "xpack.securitySolution.emptyMessage": "Elastic セキュリティは無料かつオープンのElastic SIEMに、Elastic Endpoint Securityを搭載。脅威の防御と検知、脅威への対応を支援します。開始するには、セキュリティソリューション関連データをElastic Stackに追加する必要があります。詳細については、以下をご覧ください ",
     "xpack.securitySolution.emptyString.emptyStringDescription": "空の文字列",
-    "xpack.securitySolution.endpoint.details.endpointVersion": "エンドポイントバージョン",
-    "xpack.securitySolution.endpoint.details.errorBody": "フライアウトを終了して、利用可能なホストを選択してください。",
-    "xpack.securitySolution.endpoint.details.errorTitle": "ホストが見つかりませんでした",
-    "xpack.securitySolution.endpoint.details.hostname": "ホスト名",
-    "xpack.securitySolution.endpoint.details.ipAddress": "IP アドレス",
-    "xpack.securitySolution.endpoint.details.lastSeen": "前回の認識",
-    "xpack.securitySolution.endpoint.details.linkToIngestTitle": "ポリシーの再割り当て",
-    "xpack.securitySolution.endpoint.details.os": "OS",
-    "xpack.securitySolution.endpoint.details.policy": "ポリシー",
-    "xpack.securitySolution.endpoint.details.policyStatus": "ポリシーステータス",
-    "xpack.securitySolution.endpoint.details.policyStatusValue": "{policyStatus, select, success {成功} warning {警告} failure {失敗} other {不明}}",
-    "xpack.securitySolution.endpoint.policyResponse.backLinkTitle": "エンドポイント詳細",
-    "xpack.securitySolution.endpoint.policyResponse.title": "ポリシー応答",
-    "xpack.securitySolution.endpoint.details.noPolicyResponse": "ポリシー応答がありません",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_dns_events": "DNSイベントの構成",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_elasticsearch_connection": "Elastic Search接続の構成",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_file_events": "ファイルイベントの構成",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_imageload_events": "画像読み込みイベントの構成",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_kernel": "カーネルの構成",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_logging": "ロギングの構成",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_malware": "マルウェアの構成",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_network_events": "ネットワークイベントの構成",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_process_events": "プロセスイベントの構成",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_registry_events": "レジストリイベントの構成",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_security_events": "セキュリティイベントの構成",
-    "xpack.securitySolution.endpoint.details.policyResponse.connect_kernel": "カーネルを接続",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_async_image_load_events": "非同期画像読み込みイベントを検出",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_file_open_events": "ファイルオープンイベントを検出",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_file_write_events": "ファイル書き込みイベントを検出",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_network_events": "ネットワークイベントを検出",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_process_events": "プロセスイベントを検出",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_registry_events": "レジストリイベントを検出",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_sync_image_load_events": "同期画像読み込みイベントを検出",
-    "xpack.securitySolution.endpoint.details.policyResponse.download_global_artifacts": "グローバルアーチファクトをダウンロード",
-    "xpack.securitySolution.endpoint.details.policyResponse.download_user_artifacts": "ユーザーアーチファクトをダウンロード",
-    "xpack.securitySolution.endpoint.details.policyResponse.events": "イベント",
-    "xpack.securitySolution.endpoint.details.policyResponse.failed": "失敗",
-    "xpack.securitySolution.endpoint.details.policyResponse.load_config": "構成の読み込み",
-    "xpack.securitySolution.endpoint.details.policyResponse.load_malware_model": "マルウェアモデルの読み込み",
-    "xpack.securitySolution.endpoint.details.policyResponse.logging": "ログ",
-    "xpack.securitySolution.endpoint.details.policyResponse.malware": "マルウェア",
-    "xpack.securitySolution.endpoint.details.policyResponse.read_elasticsearch_config": "Elasticsearch構成を読み取る",
-    "xpack.securitySolution.endpoint.details.policyResponse.read_events_config": "イベント構成を読み取る",
-    "xpack.securitySolution.endpoint.details.policyResponse.read_kernel_config": "カーネル構成を読み取る",
-    "xpack.securitySolution.endpoint.details.policyResponse.read_logging_config": "ロギング構成を読み取る",
-    "xpack.securitySolution.endpoint.details.policyResponse.read_malware_config": "マルウェア構成を読み取る",
-    "xpack.securitySolution.endpoint.details.policyResponse.streaming": "ストリーム中…",
-    "xpack.securitySolution.endpoint.details.policyResponse.success": "成功",
-    "xpack.securitySolution.endpoint.details.policyResponse.warning": "警告",
-    "xpack.securitySolution.endpoint.details.policyResponse.workflow": "ワークフロー",
-    "xpack.securitySolution.endpoint.list.loadingPolicies": "ポリシー構成を読み込んでいます…",
-    "xpack.securitySolution.endpoint.list.noEndpointsInstructions": "セキュリティポリシーを作成しました。以下のステップに従い、エージェントでElastic Endpoint Security機能を有効にする必要があります。",
-    "xpack.securitySolution.endpoint.list.noEndpointsPrompt": "エージェントでElastic Endpoint Securityを有効にする",
-    "xpack.securitySolution.endpoint.list.noPolicies": "ポリシーがありません。",
-    "xpack.securitySolution.endpoint.list.stepOne": "既存のポリシーは以下のリストのとおりです。これは後から変更できます。",
-    "xpack.securitySolution.endpoint.list.stepOneTitle": "ホストの保護で使用するポリシーを選択",
-    "xpack.securitySolution.endpoint.list.stepTwo": "開始するために必要なコマンドが提供されます。",
-    "xpack.securitySolution.endpoint.list.stepTwoTitle": "Ingest Manager経由でEndpoint Securityによって有効にされたエージェントを登録",
-    "xpack.securitySolution.endpoint.ingestManager.createPackagePolicy.endpointConfiguration": "このエージェント構成を使用するすべてのエージェントは基本ポリシーを使用します。セキュリティアプリでこのポリシーを変更できます。Fleetはこれらの変更をエージェントにデプロイします。",
     "xpack.securitySolution.endpoint.ingestToastMessage": "Ingest Managerが設定中に失敗しました。",
     "xpack.securitySolution.endpoint.ingestToastTitle": "アプリを初期化できませんでした",
-    "xpack.securitySolution.endpoint.policy.details.backToListTitle": "ポリシーリストに戻る",
+    "xpack.securitySolution.endpoint.policy.details.backToListTitle": "エンドポイントホストに戻る",
     "xpack.securitySolution.endpoint.policy.details.cancel": "キャンセル",
     "xpack.securitySolution.endpoint.policy.details.detect": "検知",
+    "xpack.securitySolution.endpoint.policy.details.detectionRulesLink": "関連する検出ルール",
+    "xpack.securitySolution.endpoint.policy.details.detectionRulesMessage": "{detectionRulesLink}を表示します。事前構築済みルールは、［検出ルール］ページで「Elastic」というタグが付けられています。",
     "xpack.securitySolution.endpoint.policy.details.eventCollection": "イベント収集",
     "xpack.securitySolution.endpoint.policy.details.eventCollectionsEnabled": "{selected} / {total}件のイベント収集が有効です",
     "xpack.securitySolution.endpoint.policy.details.linux": "Linux",
@@ -16208,9 +15932,9 @@
     "xpack.securitySolution.endpoint.policy.details.updateConfirm.confirmButtonTitle": "変更を保存してデプロイ",
     "xpack.securitySolution.endpoint.policy.details.updateConfirm.message": "この操作は元に戻すことができません。続行していいですか？",
     "xpack.securitySolution.endpoint.policy.details.updateConfirm.title": "変更を保存してデプロイ",
-    "xpack.securitySolution.endpoint.policy.details.updateConfirm.warningMessage": "これらの変更を保存すると、このポリシーに割り当てられたすべての有効なエンドポイントに更新が適用されます。",
+    "xpack.securitySolution.endpoint.policy.details.updateConfirm.warningMessage": "これらの変更を保存すると、このエージェント構成に割り当てられたすべての有効なエンドポイントに更新が適用されます。",
     "xpack.securitySolution.endpoint.policy.details.updateErrorTitle": "失敗しました。",
-    "xpack.securitySolution.endpoint.policy.details.updateSuccessMessage": "ポリシー{name}が更新されました。",
+    "xpack.securitySolution.endpoint.policy.details.updateSuccessMessage": "統合{name}が更新されました。",
     "xpack.securitySolution.endpoint.policy.details.updateSuccessTitle": "成功！",
     "xpack.securitySolution.endpoint.policy.details.windows": "Windows",
     "xpack.securitySolution.endpoint.policy.details.windowsAndMac": "Windows、Mac",
@@ -16237,7 +15961,6 @@
     "xpack.securitySolution.endpoint.policyDetailType": "タイプ",
     "xpack.securitySolution.endpoint.policyList.actionButtonText": "Endpoint Securityを追加",
     "xpack.securitySolution.endpoint.policyList.actionMenu": "開く",
-    "xpack.securitySolution.endpoint.policyList.agentPolicyAction": "エージェント構成を表示",
     "xpack.securitySolution.endpoint.policyList.createdAt": "作成日時",
     "xpack.securitySolution.endpoint.policyList.createdBy": "作成者",
     "xpack.securitySolution.endpoint.policyList.createNewButton": "新しいポリシーを作成",
@@ -16263,6 +15986,7 @@
     "xpack.securitySolution.endpoint.policyList.revision": "rev. {revNumber}",
     "xpack.securitySolution.endpoint.policyList.updatedAt": "最終更新",
     "xpack.securitySolution.endpoint.policyList.updatedBy": "最終更新者",
+    "xpack.securitySolution.endpoint.policyList.versionField": "v{version}",
     "xpack.securitySolution.endpoint.policyList.versionFieldLabel": "バージョン",
     "xpack.securitySolution.endpoint.policyList.viewTitleTotalCount": "{totalItemCount, plural, one {# ポリシー} other {# ポリシー}}",
     "xpack.securitySolution.endpoint.resolver.eitherLineageLimitExceeded": "以下のビジュアライゼーションとイベントリストの一部のプロセスイベントを表示できませんでした。データの上限に達しました。",
@@ -16276,7 +16000,6 @@
     "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.eventDescriptiveName": "{descriptor} {subject}",
     "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.events": "イベント",
     "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.wait": "イベントを待機しています...",
-    "xpack.securitySolution.resolver.panel.nodeList.title": "すべてのプロセスイベント",
     "xpack.securitySolution.endpoint.resolver.panel.relatedCounts.numberOfEventsInCrumb": "{totalCount}件のイベント",
     "xpack.securitySolution.endpoint.resolver.panel.relatedDetail.missing": "関連イベントが見つかりません。",
     "xpack.securitySolution.endpoint.resolver.panel.relatedDetail.wait": "イベントを待機しています...",
@@ -16307,16 +16030,6 @@
     "xpack.securitySolution.endpoint.resolver.runningTrigger": "トリガーの実行中",
     "xpack.securitySolution.endpoint.resolver.terminatedProcess": "プロセスを中断しました",
     "xpack.securitySolution.endpoint.resolver.terminatedTrigger": "トリガーを中断しました",
-    "xpack.securitySolution.endpoint.list.endpointVersion": "バージョン",
-    "xpack.securitySolution.endpoint.list.hostname": "ホスト名",
-    "xpack.securitySolution.endpoint.list.hostStatus": "ホストステータス",
-    "xpack.securitySolution.endpoint.list.hostStatusValue": "{hostStatus, select, online {オンライン} error {エラー} other {オフライン}}",
-    "xpack.securitySolution.endpoint.list.ip": "IP アドレス",
-    "xpack.securitySolution.endpoint.list.lastActive": "前回のアーカイブ",
-    "xpack.securitySolution.endpoint.list.os": "オペレーティングシステム",
-    "xpack.securitySolution.endpoint.list.policy": "ポリシー",
-    "xpack.securitySolution.endpoint.list.policyStatus": "ポリシーステータス",
-    "xpack.securitySolution.endpoint.list.totalCount": "{totalItemCount, plural, one {# ホスト} other {# ホスト}}",
     "xpack.securitySolution.endpointManagement.noPermissionsSubText": "Ingest Managerが無効である可能性があります。この機能を使用するには、Ingest Managerを有効にする必要があります。Ingest Managerを有効にする権限がない場合は、Kibana管理者に連絡してください。",
     "xpack.securitySolution.endpointManagemnet.noPermissionsText": "Elastic Security Administrationを使用するために必要なKibana権限がありません。",
     "xpack.securitySolution.enpdoint.resolver.panelutils.betaBadgeLabel": "BETA",
@@ -16374,33 +16087,48 @@
     "xpack.securitySolution.eventsViewer.footer.loadingEventsDataLabel": "イベントを読み込み中",
     "xpack.securitySolution.eventsViewer.showingLabel": "表示中",
     "xpack.securitySolution.eventsViewer.unit": "{totalCount, plural, =1 {イベント} other {イベント}}",
+    "xpack.securitySolution.exceptions.addException.addEndpointException": "エンドポイント例外の追加",
     "xpack.securitySolution.exceptions.addException.addException": "例外の追加",
-    "xpack.securitySolution.exceptions.addException.bulkCloseLabel": "この例外の属性と一致するすべてのアラートを閉じる",
+    "xpack.securitySolution.exceptions.addException.bulkCloseLabel": "他のルールで生成されたアラートを含む、この例外と一致するすべてのアラートを終了",
     "xpack.securitySolution.exceptions.addException.bulkCloseLabel.disabled": "この例外の属性と一致するすべてのアラートを閉じる（リストと非ECSフィールドはサポートされません）",
     "xpack.securitySolution.exceptions.addException.cancel": "キャンセル",
-    "xpack.securitySolution.exceptions.addException.endpointQuarantineText": "選択した属性と一致する任意のエンドポイントの隔離にあるファイルは、自動的に元の場所に復元されます。",
+    "xpack.securitySolution.exceptions.addException.endpointQuarantineText": "すべてのエンドポイントホストで、例外と一致する隔離されたファイルは、自動的に元の場所に復元されます。この例外はエンドポイント例外を使用するすべてのルールに適用されます。",
     "xpack.securitySolution.exceptions.addException.error": "例外を追加できませんでした",
     "xpack.securitySolution.exceptions.addException.fetchError": "例外リストの取得エラー",
     "xpack.securitySolution.exceptions.addException.fetchError.title": "エラー",
     "xpack.securitySolution.exceptions.addException.infoLabel": "ルールの条件が満たされるときにアラートが生成されます。例外：",
     "xpack.securitySolution.exceptions.addException.success": "正常に例外を追加しました",
     "xpack.securitySolution.exceptions.andDescription": "AND",
+    "xpack.securitySolution.exceptions.builder.addNestedDescription": "ネストされた条件を追加",
+    "xpack.securitySolution.exceptions.builder.addNonNestedDescription": "ネストされていない条件を追加",
+    "xpack.securitySolution.exceptions.builder.exceptionFieldNestedPlaceholderDescription": "ネストされたフィールドを検索",
+    "xpack.securitySolution.exceptions.builder.exceptionFieldPlaceholderDescription": "検索",
+    "xpack.securitySolution.exceptions.builder.exceptionFieldValuePlaceholderDescription": "検索フィールド値...",
+    "xpack.securitySolution.exceptions.builder.exceptionListsPlaceholderDescription": "リストを検索...",
+    "xpack.securitySolution.exceptions.builder.exceptionOperatorPlaceholderDescription": "演算子",
+    "xpack.securitySolution.exceptions.builder.fieldDescription": "フィールド",
+    "xpack.securitySolution.exceptions.builder.operatorDescription": "演算子",
+    "xpack.securitySolution.exceptions.builder.valueDescription": "値",
     "xpack.securitySolution.exceptions.commentEventLabel": "コメントを追加しました",
     "xpack.securitySolution.exceptions.commentLabel": "コメント",
     "xpack.securitySolution.exceptions.createdByLabel": "作成者",
     "xpack.securitySolution.exceptions.dateCreatedLabel": "日付が作成されました",
+    "xpack.securitySolution.exceptions.descriptionLabel": "説明",
     "xpack.securitySolution.exceptions.detectionListLabel": "検出リスト",
     "xpack.securitySolution.exceptions.doesNotExistOperatorLabel": "存在しない",
     "xpack.securitySolution.exceptions.editButtonLabel": "編集",
-    "xpack.securitySolution.exceptions.editException.bulkCloseLabel": "この例外の属性と一致するすべてのアラートを閉じる",
+    "xpack.securitySolution.exceptions.editException.bulkCloseLabel": "他のルールで生成されたアラートを含む、この例外と一致するすべてのアラートを終了",
     "xpack.securitySolution.exceptions.editException.bulkCloseLabel.disabled": "この例外の属性と一致するすべてのアラートを閉じる（リストと非ECSフィールドはサポートされません）",
     "xpack.securitySolution.exceptions.editException.cancel": "キャンセル",
+    "xpack.securitySolution.exceptions.editException.editEndpointExceptionTitle": "エンドポイント例外の編集",
     "xpack.securitySolution.exceptions.editException.editExceptionSaveButton": "保存",
     "xpack.securitySolution.exceptions.editException.editExceptionTitle": "例外の編集",
-    "xpack.securitySolution.exceptions.editException.endpointQuarantineText": "選択した属性と一致する任意のエンドポイントの隔離にあるファイルは、自動的に元の場所に復元されます。",
+    "xpack.securitySolution.exceptions.editException.endpointQuarantineText": "すべてのエンドポイントホストで、例外と一致する隔離されたファイルは、自動的に元の場所に復元されます。この例外はエンドポイント例外を使用するすべてのルールに適用されます。",
     "xpack.securitySolution.exceptions.editException.error": "例外を更新できませんでした",
     "xpack.securitySolution.exceptions.editException.infoLabel": "ルールの条件が満たされるときにアラートが生成されます。例外：",
     "xpack.securitySolution.exceptions.editException.success": "正常に例外を更新しました",
+    "xpack.securitySolution.exceptions.editException.versionConflictDescription": "最初に編集することを選択したときからこの例外が更新されている可能性があります。［キャンセル］をクリックし、もう一度例外を編集してください。",
+    "xpack.securitySolution.exceptions.editException.versionConflictTitle": "申し訳ございません、エラーが発生しました",
     "xpack.securitySolution.exceptions.endpointListLabel": "エンドポイントリスト",
     "xpack.securitySolution.exceptions.exceptionsPaginationLabel": "ページごとの項目数: {items}",
     "xpack.securitySolution.exceptions.existsOperatorLabel": "存在する",
@@ -16423,9 +16151,9 @@
     "xpack.securitySolution.exceptions.valueDescription": "値",
     "xpack.securitySolution.exceptions.viewer.addCommentPlaceholder": "新しいコメントを追加...",
     "xpack.securitySolution.exceptions.viewer.addExceptionLabel": "新しい例外を追加",
-    "xpack.securitySolution.exceptions.viewer.addToClipboard": "クリップボードに追加",
-    "xpack.securitySolution.exceptions.viewer.addToDetectionsListLabel": "検出リストに追加",
-    "xpack.securitySolution.exceptions.viewer.addToEndpointListLabel": "エンドポイントリストに追加",
+    "xpack.securitySolution.exceptions.viewer.addToClipboard": "コメント",
+    "xpack.securitySolution.exceptions.viewer.addToDetectionsListLabel": "ルール例外の追加",
+    "xpack.securitySolution.exceptions.viewer.addToEndpointListLabel": "エンドポイント例外の追加",
     "xpack.securitySolution.exceptions.viewer.deleteExceptionError": "例外の削除エラー",
     "xpack.securitySolution.exceptions.viewer.emptyPromptBody": "例外を追加してルールを微調整し、例外条件が満たされたときに検出アラートが作成されないようにすることができます。例外により検出の精度が改善します。これにより、誤検出数が減ります。",
     "xpack.securitySolution.exceptions.viewer.emptyPromptTitle": "このルールには例外がありません",
@@ -16434,6 +16162,8 @@
     "xpack.securitySolution.exceptions.viewer.exceptionEndpointDetailsDescription": "このルールのすべての例外は、エンドポイントと検出ルールに適用されます。詳細については、{ruleSettings}を確認してください。",
     "xpack.securitySolution.exceptions.viewer.exceptionEndpointDetailsDescription.ruleSettingsLink": "ルール設定",
     "xpack.securitySolution.exceptions.viewer.fetchingListError": "例外の取得エラー",
+    "xpack.securitySolution.exceptions.viewer.fetchTotalsError": "例外項目合計数の取得エラー",
+    "xpack.securitySolution.exceptions.viewer.noSearchResultsPromptBody": "検索結果が見つかりません。",
     "xpack.securitySolution.exceptions.viewer.searchDefaultPlaceholder": "検索フィールド（例：host.name）",
     "xpack.securitySolution.exitFullScreenButton": "全画面を終了",
     "xpack.securitySolution.featureRegistry.linkSecuritySolutionTitle": "セキュリティ",
@@ -16482,11 +16212,12 @@
     "xpack.securitySolution.header.editableTitle.editButtonAria": "クリックすると {title} を編集できます",
     "xpack.securitySolution.header.editableTitle.save": "保存",
     "xpack.securitySolution.headerGlobal.buttonAddData": "データの追加",
+    "xpack.securitySolution.headerGlobal.securitySolution": "セキュリティソリューション",
     "xpack.securitySolution.headerPage.pageSubtitle": "前回のイベント: {beat}",
     "xpack.securitySolution.hooks.useAddToTimeline.addedFieldMessage": "{fieldOrValue}をタイムラインに追加しました",
     "xpack.securitySolution.host.details.architectureLabel": "アーキテクチャー",
-    "xpack.securitySolution.host.details.endpoint.endpointPolicy": "エンドポイントポリシー",
-    "xpack.securitySolution.host.details.endpoint.policyStatus": "ポリシーステータス",
+    "xpack.securitySolution.host.details.endpoint.endpointPolicy": "統合",
+    "xpack.securitySolution.host.details.endpoint.policyStatus": "構成ステータス",
     "xpack.securitySolution.host.details.endpoint.sensorversion": "センサーバージョン",
     "xpack.securitySolution.host.details.firstSeenTitle": "初回の認識",
     "xpack.securitySolution.host.details.lastSeenTitle": "前回の認識",
@@ -16503,8 +16234,6 @@
     "xpack.securitySolution.host.details.overview.platformTitle": "プラットフォーム",
     "xpack.securitySolution.host.details.overview.regionTitle": "地域",
     "xpack.securitySolution.host.details.versionLabel": "バージョン",
-    "xpack.securitySolution.endpoint.list.pageSubTitle": "Elastic Endpoint Securityを実行しているホスト",
-    "xpack.securitySolution.endpoint.list.pageTitle": "ホスト",
     "xpack.securitySolution.hosts.kqlPlaceholder": "例：host.name: \"foo\"",
     "xpack.securitySolution.hosts.navigation.alertsTitle": "外部アラート",
     "xpack.securitySolution.hosts.navigation.allHostsTitle": "すべてのホスト",
@@ -16516,7 +16245,6 @@
     "xpack.securitySolution.hosts.navigaton.matrixHistogram.errorFetchingAuthenticationsData": "認証データをクエリできませんでした",
     "xpack.securitySolution.hosts.navigaton.matrixHistogram.errorFetchingEventsData": "イベントデータをクエリできませんでした",
     "xpack.securitySolution.hosts.pageTitle": "ホスト",
-    "xpack.securitySolution.endpointsTab": "ホスト",
     "xpack.securitySolution.hostsTable.firstLastSeenToolTip": "選択された日付範囲との相関付けです",
     "xpack.securitySolution.hostsTable.hostsTitle": "すべてのホスト",
     "xpack.securitySolution.hostsTable.lastSeenTitle": "前回の認識",
@@ -16561,12 +16289,17 @@
     "xpack.securitySolution.lists.cancelValueListsUploadTitle": "アップロードのキャンセル",
     "xpack.securitySolution.lists.closeValueListsModalTitle": "閉じる",
     "xpack.securitySolution.lists.detectionEngine.rules.uploadValueListsButton": "値リストのアップロード",
-    "xpack.securitySolution.lists.uploadValueListDescription": "ルールまたはルール例外の書き込み中に使用する単一値リストをアップロードします。",
+    "xpack.securitySolution.lists.detectionEngine.rules.uploadValueListsButtonTooltip": "値リストを使用して、フィールド値がリストの値と一致したときに例外を作成します",
+    "xpack.securitySolution.lists.uploadValueListDescription": "ルール例外の書き込み中に使用する単一値リストをアップロードします。",
+    "xpack.securitySolution.lists.uploadValueListExtensionValidationMessage": "ファイルは次の種類のいずれかでなければなりません：[{fileTypes}]",
     "xpack.securitySolution.lists.uploadValueListPrompt": "ファイルを選択するかドラッグ &amp;amp; ドロップしてください",
     "xpack.securitySolution.lists.uploadValueListTitle": "値リストのアップロード",
+    "xpack.securitySolution.lists.valueListsExportError": "値リストのエクスポート中にエラーが発生しました。",
     "xpack.securitySolution.lists.valueListsForm.ipRadioLabel": "IP アドレス",
+    "xpack.securitySolution.lists.valueListsForm.ipRangesRadioLabel": "IP 範囲",
     "xpack.securitySolution.lists.valueListsForm.keywordsRadioLabel": "キーワード",
     "xpack.securitySolution.lists.valueListsForm.listTypesRadioLabel": "値リストのタイプ",
+    "xpack.securitySolution.lists.valueListsForm.textRadioLabel": "テキスト",
     "xpack.securitySolution.lists.valueListsTable.actionsColumn": "アクション",
     "xpack.securitySolution.lists.valueListsTable.createdByColumn": "作成者",
     "xpack.securitySolution.lists.valueListsTable.deleteActionDescription": "値リストの削除",
@@ -16775,8 +16508,8 @@
     "xpack.securitySolution.overview.endpointNotice.dismiss": "メッセージを消去",
     "xpack.securitySolution.overview.endpointNotice.introducing": "導入： ",
     "xpack.securitySolution.overview.endpointNotice.message": "脅威防御、検出、深いセキュリティデータの可視化を実現し、ホストを保護します。",
-    "xpack.securitySolution.overview.endpointNotice.title": "Elastic Endpoint Securityベータ",
-    "xpack.securitySolution.overview.endpointNotice.tryButton": "Elastic Endpoint Securityベータを試す",
+    "xpack.securitySolution.overview.endpointNotice.title": "Elastic Endpoint Security（ベータ）",
+    "xpack.securitySolution.overview.endpointNotice.tryButton": "Elastic Endpoint Security（ベータ）を試す",
     "xpack.securitySolution.overview.eventsTitle": "イベント数",
     "xpack.securitySolution.overview.feedbackText": "Elastic SIEM に関するご意見やご提案は、お気軽に {feedback}",
     "xpack.securitySolution.overview.feedbackText.feedbackLinkText": "フィードバックをオンラインで送信",
@@ -16822,9 +16555,14 @@
     "xpack.securitySolution.overview.viewEventsButtonLabel": "イベントを表示",
     "xpack.securitySolution.overview.winlogbeatMWSysmonOperational": "Microsoft-Windows-Sysmon/Operational",
     "xpack.securitySolution.overview.winlogbeatSecurityTitle": "セキュリティ",
-    "xpack.securitySolution.pages.common.emptyActionEndpoint": "Elasticエージェント（ベータ）でデータを追加",
+    "xpack.securitySolution.pages.common.emptyActionBeats": "Beatsでデータを追加",
+    "xpack.securitySolution.pages.common.emptyActionBeatsDescription": "Lightweight Beatsは数百または数千台のコンピューターとシステムからデータを送信できます",
+    "xpack.securitySolution.pages.common.emptyActionElasticAgent": "Elasticエージェントでデータを追加",
+    "xpack.securitySolution.pages.common.emptyActionElasticAgentDescription": "Elasticエージェントでは、シンプルかつ統合された方法で、監視をホストに追加することができます。",
+    "xpack.securitySolution.pages.common.emptyActionEndpoint": "Elastic Endpoint Securityを追加",
+    "xpack.securitySolution.pages.common.emptyActionEndpointDescription": "脅威防御、検出、深いセキュリティデータの可視化を実現し、ホストを保護します。",
     "xpack.securitySolution.pages.common.emptyActionSecondary": "入門ガイドを表示します。",
-    "xpack.securitySolution.pages.common.emptyTitle": "セキュリティソリューションへようこそ。始めましょう。",
+    "xpack.securitySolution.pages.common.emptyTitle": "Elastic Securityへようこそ。始めましょう。",
     "xpack.securitySolution.pages.fourohfour.noContentFoundDescription": "コンテンツがありません",
     "xpack.securitySolution.paginatedTable.rowsButtonLabel": "ページごとの行数",
     "xpack.securitySolution.paginatedTable.showingSubtitle": "表示中",
@@ -16928,7 +16666,7 @@
     "xpack.securitySolution.timeline.body.renderers.endgame.withSpecialPrivilegesDescription": "割り当てられた特別な権限",
     "xpack.securitySolution.timeline.body.sort.sortedAscendingTooltip": "昇順で並べ替えます",
     "xpack.securitySolution.timeline.body.sort.sortedDescendingTooltip": "降順で並べ替えます",
-    "xpack.securitySolution.timeline.callOut.immutable.message.description": "タイムラインを引き続き使用して、セキュリティイベントの検索とフィルターはできますが、このタイムラインは変わらないため、セキュリティアプリケーションで保存することはできません。",
+    "xpack.securitySolution.timeline.callOut.immutable.message.description": "この事前構築済みタイムラインテンプレートを修正することはできません。変更するには、このテンプレートを複製し、複製したテンプレートを修正します。",
     "xpack.securitySolution.timeline.callOut.unauthorized.message.description": "タイムラインを使用すると、イベントを調査することができますが、今後使用する目的でタイムラインを保存するために必要な権限がありません。タイムラインを保存する必要がある場合は、Kibana管理者に連絡してください。",
     "xpack.securitySolution.timeline.categoryTooltip": "カテゴリー",
     "xpack.securitySolution.timeline.defaultTimelineDescription": "新しいタイムラインを作成するときにデフォルトで提供されるタイムライン。",
@@ -16950,6 +16688,7 @@
     "xpack.securitySolution.timeline.flyoutTimelineTemplateLabel": "タイムラインテンプレート",
     "xpack.securitySolution.timeline.fullScreenButton": "全画面",
     "xpack.securitySolution.timeline.graphOverlay.backToEventsButton": "&lt; イベントに戻る",
+    "xpack.securitySolution.timeline.properties.attachTimelineToCaseTooltip": "ケースに関連付けるには、タイムラインのタイトルを入力してください",
     "xpack.securitySolution.timeline.properties.attachToExistingCaseButtonLabel": "既存のケースに添付...",
     "xpack.securitySolution.timeline.properties.attachToNewCaseButtonLabel": "新しいケースに添付",
     "xpack.securitySolution.timeline.properties.descriptionPlaceholder": "説明",
@@ -17859,8 +17598,13 @@
     "xpack.spaces.management.confirmDeleteModal.deletingSpaceWarningMessage": "スペースを削除すると、スペースと {allContents} が永久に削除されます。この操作は元に戻すことができません。",
     "xpack.spaces.management.confirmDeleteModal.redirectAfterDeletingCurrentSpaceWarningMessage": "現在のスペース {name} を削除しようとしています。続行すると、別のスペースを選択する画面に移動します。",
     "xpack.spaces.management.confirmDeleteModal.spaceNamesDoNoMatchErrorMessage": "スペース名が一致していません。",
+    "xpack.spaces.management.copyToSpace.actionDescription": "この保存されたオブジェクトを1つまたは複数のスペースにコピーします。",
+    "xpack.spaces.management.copyToSpace.actionTitle": "スペースにコピー",
     "xpack.spaces.management.copyToSpace.copyErrorTitle": "保存されたオブジェクトのコピー中にエラーが発生",
+    "xpack.spaces.management.copyToSpace.copyResultsLabel": "コピー結果",
     "xpack.spaces.management.copyToSpace.copyStatus.conflictsMessage": "このスペースには同じID({id})の保存されたオブジェクトが既に存在します。",
+    "xpack.spaces.management.copyToSpace.copyStatus.conflictsOverwriteMessage": "「上書き」をクリックしてこのバージョンをコピーされたバージョンに置き換えます。",
+    "xpack.spaces.management.copyToSpace.copyStatus.pendingOverwriteMessage": "保存されたオブジェクトは上書きされます。「スキップ」をクリックしてこの操作をキャンセルします。",
     "xpack.spaces.management.copyToSpace.copyStatus.successMessage": "保存されたオブジェクトがコピーされました。",
     "xpack.spaces.management.copyToSpace.copyStatus.unresolvableErrorMessage": "この保存されたオブジェクトのコピー中にエラーが発生しました。",
     "xpack.spaces.management.copyToSpace.copyStatusSummary.conflictsMessage": "{space}スペースに1つまたは複数の矛盾が検出されました。解決するにはこのセクションを拡張してください。",
@@ -17868,17 +17612,24 @@
     "xpack.spaces.management.copyToSpace.copyStatusSummary.successMessage": "{space}スペースにコピーされました。",
     "xpack.spaces.management.copyToSpace.copyToSpacesButton": "{spaceCount} {spaceCount, plural, one {スペース} other {スペース}}にコピー",
     "xpack.spaces.management.copyToSpace.disabledCopyToSpacesButton": "コピー",
+    "xpack.spaces.management.copyToSpace.dontIncludeRelatedLabel": "関連性のある保存されたオブジェクトを含みません",
+    "xpack.spaces.management.copyToSpace.dontOverwriteLabel": "保存されたオブジェクトを上書きしません",
     "xpack.spaces.management.copyToSpace.finishCopyToSpacesButton": "終了",
     "xpack.spaces.management.copyToSpace.finishedButtonLabel": "コピーが完了しました。",
+    "xpack.spaces.management.copyToSpace.finishPendingOverwritesCopyToSpacesButton": "{overwriteCount}件のオブジェクトを上書き",
+    "xpack.spaces.management.copyToSpace.includeRelatedLabel": "関連性のある保存されたオブジェクトを含みます",
     "xpack.spaces.management.copyToSpace.inProgressButtonLabel": "コピーが進行中です。お待ちください。",
     "xpack.spaces.management.copyToSpace.noSpacesBody": "コピーできるスペースがありません。",
     "xpack.spaces.management.copyToSpace.noSpacesTitle": "スペースがありません",
     "xpack.spaces.management.copyToSpace.overwriteLabel": "保存されたオブジェクトを自動的に上書きしています",
     "xpack.spaces.management.copyToSpace.resolveCopyErrorTitle": "保存されたオブジェクトの矛盾の解決中にエラーが発生",
+    "xpack.spaces.management.copyToSpace.resolveCopySuccessTitle": "上書き成功",
+    "xpack.spaces.management.copyToSpace.selectSpacesLabel": "コピー先のスペースを選択してください",
     "xpack.spaces.management.copyToSpace.spacesLoadErrorTitle": "利用可能なスペースを読み込み中にエラーが発生",
     "xpack.spaces.management.copyToSpaceFlyoutFooter.errorCount": "エラー",
     "xpack.spaces.management.copyToSpaceFlyoutFooter.pendingCount": "保留中",
     "xpack.spaces.management.copyToSpaceFlyoutFooter.successCount": "コピー完了",
+    "xpack.spaces.management.copyToSpaceFlyoutHeader": "保存されたオブジェクトのスペースへのコピー",
     "xpack.spaces.management.createSpaceBreadcrumb": "作成",
     "xpack.spaces.management.customizeSpaceAvatar.colorFormRowLabel": "色",
     "xpack.spaces.management.customizeSpaceAvatar.imageUrl": "カスタム画像",
@@ -18358,6 +18109,7 @@
     "xpack.triggersActionsUI.components.builtinActionTypes.serviceNow.titleFieldLabel": "短い説明",
     "xpack.triggersActionsUI.components.builtinActionTypes.serviceNow.urgencySelectFieldLabel": "緊急",
     "xpack.triggersActionsUI.components.builtinActionTypes.servicenow.usernameTextFieldLabel": "ユーザー名",
+    "xpack.triggersActionsUI.components.builtinActionTypes.serviceNowAction.apiUrlHelpLabel": "Personal Developer Instance for ServiceNowの構成",
     "xpack.triggersActionsUI.components.builtinActionTypes.slackAction.actionTypeTitle": "Slack に送信",
     "xpack.triggersActionsUI.components.builtinActionTypes.slackAction.error.requiredWebhookUrlText": "Web フック URL が必要です。",
     "xpack.triggersActionsUI.components.builtinActionTypes.slackAction.messageTextAreaFieldLabel": "メッセージ",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index ffd7d0cfb0f87f..bd30703dd5bd6c 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -253,31 +253,6 @@
     "charts.controls.rangeErrorMessage": "值必须是在 {min} 到 {max} 的范围内",
     "charts.controls.vislibBasicOptions.legendPositionLabel": "图例位置",
     "charts.controls.vislibBasicOptions.showTooltipLabel": "显示工具提示",
-    "common.ui.flotCharts.aprLabel": "四月",
-    "common.ui.flotCharts.augLabel": "八月",
-    "common.ui.flotCharts.decLabel": "十二月",
-    "common.ui.flotCharts.febLabel": "二月",
-    "common.ui.flotCharts.friLabel": "周五",
-    "common.ui.flotCharts.janLabel": "一月",
-    "common.ui.flotCharts.julLabel": "七月",
-    "common.ui.flotCharts.junLabel": "六月",
-    "common.ui.flotCharts.marLabel": "三月",
-    "common.ui.flotCharts.mayLabel": "五月",
-    "common.ui.flotCharts.monLabel": "周一",
-    "common.ui.flotCharts.novLabel": "十一月",
-    "common.ui.flotCharts.octLabel": "十月",
-    "common.ui.flotCharts.pie.unableToDrawLabelsInsideCanvasErrorMessage": "无法用画布内包含的标签绘制饼图",
-    "common.ui.flotCharts.satLabel": "周六",
-    "common.ui.flotCharts.sepLabel": "九月",
-    "common.ui.flotCharts.sunLabel": "周日",
-    "common.ui.flotCharts.thuLabel": "周四",
-    "common.ui.flotCharts.tueLabel": "周二",
-    "common.ui.flotCharts.wedLabel": "周三",
-    "common.ui.stateManagement.unableToParseUrlErrorMessage": "无法解析 URL",
-    "common.ui.stateManagement.unableToRestoreUrlErrorMessage": "无法完整还原 URL，确保使用共享功能。",
-    "common.ui.stateManagement.unableToStoreHistoryInSessionErrorMessage": "Kibana 无法将历史记录项存储在您的会话中，因为其已满，并且似乎没有任何可安全删除的项。\n\n通常可通过移至新的标签页来解决此问题，但这会导致更大的问题。如果您有规律地看到此消息，请在 {gitHubIssuesUrl} 提交问题。",
-    "common.ui.url.replacementFailedErrorMessage": "替换失败，未解析的表达式：{expr}",
-    "common.ui.url.savedObjectIsMissingNotificationMessage": "已保存对象缺失",
     "console.autocomplete.addMethodMetaText": "方法",
     "console.consoleDisplayName": "控制台",
     "console.consoleMenu.copyAsCurlMessage": "请求已复制为 cURL",
@@ -526,47 +501,6 @@
     "core.ui.securityNavList.label": "安全",
     "core.ui.welcomeErrorMessage": "Elastic 未正确加载。检查服务器输出以了解详情。",
     "core.ui.welcomeMessage": "正在加载 Elastic",
-    "core.ui_settings.params.darkModeText": "为 Kibana UI 启用深色模式需要刷新页面，才能应用设置。",
-    "core.ui_settings.params.darkModeTitle": "深色模式",
-    "core.ui_settings.params.dateFormat.dayOfWeekText": "一周从哪一日开始？",
-    "core.ui_settings.params.dateFormat.dayOfWeekTitle": "周内日",
-    "core.ui_settings.params.dateFormat.optionsLinkText": "格式",
-    "core.ui_settings.params.dateFormat.scaled.intervalsLinkText": "ISO8601 时间间隔",
-    "core.ui_settings.params.dateFormat.scaledText": "定义在基于时间的数据按顺序呈现且格式化时间戳应适应度量时间间隔时所用格式的值。键是 {intervalsLink}。",
-    "core.ui_settings.params.dateFormat.scaledTitle": "缩放的日期格式",
-    "core.ui_settings.params.dateFormat.timezoneText": "应使用哪个时区。{defaultOption} 将使用您的浏览器检测到的时区。",
-    "core.ui_settings.params.dateFormat.timezoneTitle": "用于设置日期格式的时区",
-    "core.ui_settings.params.dateFormatText": "显示格式正确的日期时，请使用此{formatLink}",
-    "core.ui_settings.params.dateFormatTitle": "日期格式",
-    "core.ui_settings.params.dateNanosFormatText": "用于 Elasticsearch 的 {dateNanosLink} 数据类型",
-    "core.ui_settings.params.dateNanosFormatTitle": "纳秒格式的日期",
-    "core.ui_settings.params.dateNanosLinkTitle": "date_nanos",
-    "core.ui_settings.params.defaultRoute.defaultRouteIsRelativeValidationMessage": "必须是相对 URL。",
-    "core.ui_settings.params.defaultRoute.defaultRouteText": "此设置指定打开 Kibana 时的默认路由。您可以使用此设置修改打开 Kibana 时的登陆页面。路由必须是相对 URL。",
-    "core.ui_settings.params.defaultRoute.defaultRouteTitle": "默认路由",
-    "core.ui_settings.params.disableAnimationsText": "在 Kibana UI 中关闭所有没有必要的动画。刷新页面以应用更改。",
-    "core.ui_settings.params.disableAnimationsTitle": "禁用动画",
-    "core.ui_settings.params.maxCellHeightText": "表中单元格应占用的最大高度。设置为 0 可禁用截短",
-    "core.ui_settings.params.maxCellHeightTitle": "最大表单元格高度",
-    "core.ui_settings.params.notifications.banner.markdownLinkText": "Markdown 受支持",
-    "core.ui_settings.params.notifications.bannerLifetimeText": "在屏幕上显示横幅通知的时间（毫秒）。设置为 {infinityValue} 将禁用倒计时。",
-    "core.ui_settings.params.notifications.bannerLifetimeTitle": "横幅通知生存时间",
-    "core.ui_settings.params.notifications.bannerText": "用于向所有用户发送临时通知的定制横幅。{markdownLink}",
-    "core.ui_settings.params.notifications.bannerTitle": "定制横幅通知",
-    "core.ui_settings.params.notifications.errorLifetimeText": "在屏幕上显示错误通知的时间（毫秒）。设置为 {infinityValue} 将禁用。",
-    "core.ui_settings.params.notifications.errorLifetimeTitle": "错误通知生存时间",
-    "core.ui_settings.params.notifications.infoLifetimeText": "在屏幕上显示信息通知的时间（毫秒）。设置为 {infinityValue} 将禁用。",
-    "core.ui_settings.params.notifications.infoLifetimeTitle": "信息通知生存时间",
-    "core.ui_settings.params.notifications.warningLifetimeText": "在屏幕上显示警告通知的时间（毫秒）。设置为 {infinityValue} 将禁用。",
-    "core.ui_settings.params.notifications.warningLifetimeTitle": "警告通知生存时间",
-    "core.ui_settings.params.pageNavigationDesc": "更改导航样式",
-    "core.ui_settings.params.pageNavigationLegacy": "旧版",
-    "core.ui_settings.params.pageNavigationModern": "现代",
-    "core.ui_settings.params.pageNavigationName": "侧边导航样式",
-    "core.ui_settings.params.themeVersionText": "在用于 Kibana 当前和下一版本的主题间切换。需要刷新页面，才能应用设置。",
-    "core.ui_settings.params.themeVersionTitle": "主题版本",
-    "core.ui_settings.params.storeUrlText": "URL 有时会变得过长，以使得某些浏览器无法处理。为此，我们正在测试将 URL 的各个组成部分存储在会话存储中是否会有帮助。请告知我们这样做的效果！",
-    "core.ui_settings.params.storeUrlTitle": "将 URL 存储在会话存储中",
     "dashboard.actions.toggleExpandPanelMenuItem.expandedDisplayName": "最小化",
     "dashboard.actions.toggleExpandPanelMenuItem.notExpandedDisplayName": "全屏",
     "dashboard.addExistingVisualizationLinkText": "将现有",
@@ -739,8 +673,6 @@
     "data.advancedSettings.timepicker.refreshIntervalDefaultsText": "时间筛选的默认刷新时间间隔。需要使用毫秒单位指定“值”。",
     "data.advancedSettings.timepicker.refreshIntervalDefaultsTitle": "时间筛选刷新时间间隔",
     "data.advancedSettings.timepicker.thisWeek": "本周",
-    "data.advancedSettings.timepicker.timeDefaultsText": "未使用时间筛选启动 Kibana 时要使用的时间筛选选择",
-    "data.advancedSettings.timepicker.timeDefaultsTitle": "时间筛选默认值",
     "data.advancedSettings.timepicker.today": "今日",
     "data.aggTypes.buckets.ranges.rangesFormatMessage": "{gte} {from} 和 {lt} {to}",
     "data.common.kql.errors.endOfInputText": "输入结束",
@@ -1672,7 +1604,6 @@
     "home.loadTutorials.unableToLoadErrorMessage": "无法加载教程",
     "home.pageTitle": "主页",
     "home.recentlyAccessed.recentlyViewedTitle": "最近查看",
-    "home.sampleData.ecommerceSpec.averageSalesPerRegionTitle": "[电子商务] 每地区平均销售额",
     "home.sampleData.ecommerceSpec.averageSalesPriceTitle": "[电子商务] 平均销售价格",
     "home.sampleData.ecommerceSpec.averageSoldQuantityTitle": "[电子商务] 平均销售数量",
     "home.sampleData.ecommerceSpec.controlsTitle": "[电子商务] 控制",
@@ -1703,7 +1634,6 @@
     "home.sampleData.flightsSpec.globalFlightDashboardDescription": "分析 ES-Air、Logstash Airways、Kibana Airlines 和 JetBeats 的模拟航班数据",
     "home.sampleData.flightsSpec.globalFlightDashboardTitle": "[航班] 全球航班仪表板",
     "home.sampleData.flightsSpec.markdownInstructionsTitle": "[航班] Markdown 说明",
-    "home.sampleData.flightsSpec.originCountryTicketPricesTitle": "[航班] 始发国/地区票价",
     "home.sampleData.flightsSpec.originCountryTitle": "[航班] 始发国/地区与到达国/地区",
     "home.sampleData.flightsSpec.totalFlightCancellationsTitle": "[航班] 航班取消总数",
     "home.sampleData.flightsSpec.totalFlightDelaysTitle": "[航班] 航班延误总数",
@@ -1718,7 +1648,6 @@
     "home.sampleData.logsSpec.markdownInstructionsTitle": "[日志] Markdown 说明",
     "home.sampleData.logsSpec.responseCodesOverTimeTitle": "[日志] 时移响应代码 + 注释",
     "home.sampleData.logsSpec.sourceAndDestinationSankeyChartTitle": "[日志] 始发地和到达地 Sankey 图",
-    "home.sampleData.logsSpec.uniqueVisitorsByCountryTitle": "[日志] 按国家/地区划分的独立访客",
     "home.sampleData.logsSpec.uniqueVisitorsTitle": "[日志] 独立访客与平均字节数",
     "home.sampleData.logsSpec.visitorOSTitle": "[日志] 按 OS 划分的访客",
     "home.sampleData.logsSpec.webTrafficDescription": "分析 Elastic 网站的模拟 Web 流量日志数据",
@@ -4459,8 +4388,6 @@
     "visualizations.newVisWizard.searchSelection.savedObjectType.search": "已保存搜索",
     "visualizations.newVisWizard.selectVisType": "选择可视化类型",
     "visualizations.newVisWizard.title": "新建可视化",
-    "visualizations.newVisWizard.visTypeAliasDescription": "打开 Visualize 外部的 Kibana 应用程序。",
-    "visualizations.newVisWizard.visTypeAliasTitle": "Kibana 应用程序",
     "visualizations.savedObjectName": "可视化",
     "visualizations.visualizationTypeInvalidMessage": "无效的可视化类型“{visType}”",
     "visualize.badge.readOnly.text": "只读",
@@ -4559,7 +4486,6 @@
     "xpack.actions.serverSideErrors.predefinedActionUpdateDisabled": "不允许更新预配置的操作 {id}。",
     "xpack.actions.serverSideErrors.unavailableLicenseErrorMessage": "操作类型 {actionTypeId} 已禁用，因为许可证信息当前不可用。",
     "xpack.actions.serverSideErrors.unavailableLicenseInformationErrorMessage": "操作不可用 - 许可信息当前不可用。",
-    "xpack.actions.urlAllowedHostsConfigurationError": "目标 {field}“{value}”在 Kibana 配置 xpack.actions.allowedHosts 中未列入白名单",
     "xpack.alertingBuiltins.indexThreshold.actionGroupThresholdMetTitle": "阈值已达到",
     "xpack.alertingBuiltins.indexThreshold.actionVariableContextDateLabel": "告警超过阈值的日期。",
     "xpack.alertingBuiltins.indexThreshold.actionVariableContextGroupLabel": "超过阈值的组。",
@@ -4705,12 +4631,17 @@
     "xpack.apm.agentMetrics.java.threadCountMax": "最大计数",
     "xpack.apm.alertTypes.errorRate": "错误率",
     "xpack.apm.alertTypes.transactionDuration": "事务持续时间",
+    "xpack.apm.anomaly_detection.error.invalid_license": "要使用异常检测，必须订阅 Elastic 白金级许可证。有了该许可证，您便可借助 Machine Learning 监测服务。",
+    "xpack.apm.anomaly_detection.error.missing_read_privileges": "必须对 Machine Learning 和 APM 具有“读”权限，才能查看“异常检测”作业",
+    "xpack.apm.anomaly_detection.error.missing_write_privileges": "必须对 Machine Learning 和 APM 具有“写”权限，才能创建“异常检测”作业",
+    "xpack.apm.anomaly_detection.error.not_available": "Machine Learning 不可用",
+    "xpack.apm.anomaly_detection.error.not_available_in_space": "Machine learning 在选定工作区内不可用",
     "xpack.apm.anomalyDetection.createJobs.failed.text": "为 APM 服务环境 [{environments}] 创建一个或多个异常检测作业时出现问题。错误：“{errorMessage}”",
     "xpack.apm.anomalyDetection.createJobs.failed.title": "无法创建异常检测作业",
     "xpack.apm.anomalyDetection.createJobs.succeeded.text": "APM 服务环境 [{environments}] 的异常检测作业已成功创建。Machine Learning 要过一些时间才会开始分析流量以发现异常。",
     "xpack.apm.anomalyDetection.createJobs.succeeded.title": "异常检测作业已创建",
     "xpack.apm.anomalyDetectionSetup.linkLabel": "异常检测",
-    "xpack.apm.anomalyDetectionSetup.notEnabledForEnvironmentText": "还没有为“{currentEnvironment}”环境启用异常检测。单击以继续设置。",
+    "xpack.apm.anomalyDetectionSetup.notEnabledForEnvironmentText": "尚未针对环境“{currentEnvironment}”启用异常检测。单击可继续设置。",
     "xpack.apm.anomalyDetectionSetup.notEnabledText": "异常检测尚未启用。单击以继续设置。",
     "xpack.apm.apmDescription": "自动从您的应用程序内收集深入全面的性能指标和错误。",
     "xpack.apm.applyFilter": "应用 {title} 筛选",
@@ -4752,7 +4683,7 @@
     "xpack.apm.errorGroupDetails.logMessageLabel": "日志消息",
     "xpack.apm.errorGroupDetails.noErrorsLabel": "未找到任何错误",
     "xpack.apm.errorGroupDetails.occurrencesChartLabel": "发生次数",
-    "xpack.apm.errorGroupDetails.occurrencesLongLabel": "{occCount} 次发生",
+    "xpack.apm.errorGroupDetails.occurrencesLongLabel": "{occCount} 次{occCount, plural, one {出现} other {出现}}",
     "xpack.apm.errorGroupDetails.occurrencesShortLabel": "{occCount} 次发生",
     "xpack.apm.errorGroupDetails.relatedTransactionSample": "相关的事务样本",
     "xpack.apm.errorGroupDetails.unhandledLabel": "未处理",
@@ -4779,7 +4710,6 @@
     "xpack.apm.fetcher.error.title": "提取资源时出错",
     "xpack.apm.fetcher.error.url": "URL",
     "xpack.apm.filter.environment.label": "环境",
-    "xpack.apm.filter.environment.allLabel": "全部",
     "xpack.apm.filter.environment.notDefinedLabel": "未定义",
     "xpack.apm.filter.environment.selectEnvironmentLabel": "选择环境",
     "xpack.apm.formatters.hoursTimeUnitLabel": "h",
@@ -4902,7 +4832,10 @@
     "xpack.apm.serviceMap.anomalyDetectionPopoverScoreMetric": "分数（最大）",
     "xpack.apm.serviceMap.anomalyDetectionPopoverTitle": "异常检测",
     "xpack.apm.serviceMap.anomalyDetectionPopoverTooltip": "服务运行状况指示由 Machine Learning 中的异常检测功能提供",
+    "xpack.apm.serviceMap.avgCpuUsagePopoverStat": "CPU 使用率（平均值）",
+    "xpack.apm.serviceMap.avgMemoryUsagePopoverStat": "内存使用率（平均值）",
     "xpack.apm.serviceMap.avgReqPerMinutePopoverMetric": "每分钟请求数（平均）",
+    "xpack.apm.serviceMap.avgTransDurationPopoverStat": "事务持续时间（平均值）",
     "xpack.apm.serviceMap.betaBadge": "公测版",
     "xpack.apm.serviceMap.betaTooltipMessage": "此功能当前为公测版。如果遇到任何错误或有任何反馈，请报告问题或访问我们的论坛。",
     "xpack.apm.serviceMap.center": "中",
@@ -4910,10 +4843,13 @@
     "xpack.apm.serviceMap.emptyBanner.docsLink": "在文档中了解详情",
     "xpack.apm.serviceMap.emptyBanner.message": "如果可以检测到连接的服务和外部请求，便将在地图上绘出它们。请确保运行最新版本的 APM 代理。",
     "xpack.apm.serviceMap.emptyBanner.title": "似乎仅有一个服务。",
+    "xpack.apm.serviceMap.errorRatePopoverStat": "事务错误率（平均值）",
     "xpack.apm.serviceMap.focusMapButtonText": "聚焦地图",
     "xpack.apm.serviceMap.invalidLicenseMessage": "要访问服务地图，必须订阅 Elastic 白金级许可证。使用该许可证，您将能够可视化整个应用程序堆栈以及 APM 数据。",
     "xpack.apm.serviceMap.popoverMetrics.noDataText": "选定的环境没有数据。请尝试切换到其他环境。",
     "xpack.apm.serviceMap.serviceDetailsButtonText": "服务详情",
+    "xpack.apm.serviceMap.subtypePopoverStat": "子类型",
+    "xpack.apm.serviceMap.typePopoverStat": "类型",
     "xpack.apm.serviceMap.viewFullMap": "查看完整的服务地图",
     "xpack.apm.serviceMap.zoomIn": "放大",
     "xpack.apm.serviceMap.zoomOut": "缩小",
@@ -5069,7 +5005,6 @@
     "xpack.apm.transactionActionMenu.viewInUptime": "状态",
     "xpack.apm.transactionActionMenu.viewSampleDocumentLinkLabel": "查看样例文档",
     "xpack.apm.transactionBreakdown.chartTitle": "跨度类型花费的时间",
-    "xpack.apm.transactionBreakdown.noData": "此时间范围内没有数据。",
     "xpack.apm.transactionCardinalityWarning.body": "唯一事务名称的数目超过 {bucketSize} 的已配置值。尝试重新配置您的代理以对类似的事务分组或增大 {codeBlock} 的值",
     "xpack.apm.transactionCardinalityWarning.docsLink": "在文档中了解详情",
     "xpack.apm.transactionCardinalityWarning.title": "此视图显示已报告事务的子集。",
@@ -5434,7 +5369,7 @@
     "xpack.canvas.elementSettings.dataTabLabel": "数据",
     "xpack.canvas.elementSettings.displayTabLabel": "显示",
     "xpack.canvas.embedObject.noMatchingObjectsMessage": "未找到任何匹配对象。",
-    "xpack.canvas.embedObject.titleText": "从 Visualize 库添加",
+    "xpack.canvas.embedObject.titleText": "从 Kibana 添加",
     "xpack.canvas.error.actionsElements.invaludArgIndexErrorMessage": "无效的参数索引：{index}",
     "xpack.canvas.error.downloadWorkpad.downloadFailureErrorMessage": "无法下载 Workpad",
     "xpack.canvas.error.downloadWorkpad.downloadRenderedWorkpadFailureErrorMessage": "无法下载已呈现 Workpad",
@@ -6322,7 +6257,7 @@
     "xpack.canvas.workpadHeaderElementMenu.chartMenuItemLabel": "图表",
     "xpack.canvas.workpadHeaderElementMenu.elementMenuButtonLabel": "添加元素",
     "xpack.canvas.workpadHeaderElementMenu.elementMenuLabel": "添加元素",
-    "xpack.canvas.workpadHeaderElementMenu.embedObjectMenuItemLabel": "从 Visualize 库添加",
+    "xpack.canvas.workpadHeaderElementMenu.embedObjectMenuItemLabel": "从 Kibana 添加",
     "xpack.canvas.workpadHeaderElementMenu.filterMenuItemLabel": "筛选",
     "xpack.canvas.workpadHeaderElementMenu.imageMenuItemLabel": "图像",
     "xpack.canvas.workpadHeaderElementMenu.manageAssetsMenuItemLabel": "管理资产",
@@ -6774,6 +6709,9 @@
     "xpack.enterpriseSearch.errorConnectingState.description4": "阅读设置指南或查看服务器日志中的 {pluginLog} 日志消息。",
     "xpack.enterpriseSearch.errorConnectingState.setupGuideCta": "阅读设置指南",
     "xpack.enterpriseSearch.errorConnectingState.title": "无法连接",
+    "xpack.enterpriseSearch.errorConnectingState.troubleshootAuth": "检查您的用户身份验证：",
+    "xpack.enterpriseSearch.errorConnectingState.troubleshootAuthNative": "必须使用 Elasticsearch 本机身份验证或 SSO/SAML 执行身份验证。",
+    "xpack.enterpriseSearch.errorConnectingState.troubleshootAuthSAML": "如果使用的是 SSO/SAML，则还必须在“企业搜索”中设置 SAML 领域。",
     "xpack.enterpriseSearch.setupGuide.step1.instruction1": "在 {configFile} 文件中，将 {configSetting} 设置为 {productName} 实例的 URL。例如：",
     "xpack.enterpriseSearch.setupGuide.step1.title": "将 {productName} 主机 URL 添加到 Kibana 配置",
     "xpack.enterpriseSearch.setupGuide.step2.instruction1": "重新启动 Kibana 以应用上一步骤中的配置更改。",
@@ -8129,7 +8067,6 @@
     "xpack.indexLifecycleMgmt.editPolicy.learnAboutShardAllocationLink": "了解分片分配",
     "xpack.indexLifecycleMgmt.editPolicy.learnAboutTimingText": "了解计时",
     "xpack.indexLifecycleMgmt.editPolicy.lifecyclePolicyDescriptionText": "使用索引策略自动化索引生命周期的四个阶段，从频繁地写入到索引到删除索引。",
-    "xpack.indexLifecycleMgmt.editPolicy.loadPolicyErrorMessage": "加载策略时出错",
     "xpack.indexLifecycleMgmt.editPolicy.maximumAgeMissingError": "最大存在时间必填。",
     "xpack.indexLifecycleMgmt.editPolicy.maximumDocumentsMissingError": "最大文档数必填。",
     "xpack.indexLifecycleMgmt.editPolicy.maximumIndexSizeMissingError": "最大索引大小必填。",
@@ -8268,7 +8205,6 @@
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.title": "将策略 “{name}” 添加到索引模板",
     "xpack.indexLifecycleMgmt.policyTable.addPolicyToTemplateButtonText": "将策略添加到索引模板",
     "xpack.indexLifecycleMgmt.policyTable.captionText": "下面是包含 {count, plural, one {# 行} other {# 行}}（共 {total} 行）的索引生命周期策略表。",
-    "xpack.indexLifecycleMgmt.policyTable.deletedPoliciesText": "已删除 {numSelected} 个{numSelected, plural, one {策略} other {策略}}",
     "xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonDisabledTooltip": "您无法删除索引正在使用的策略",
     "xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonText": "删除策略",
     "xpack.indexLifecycleMgmt.policyTable.emptyPrompt.createButtonLabel": "创建策略",
@@ -8493,6 +8429,7 @@
     "xpack.infra.logs.analysis.anomalySectionLogRateChartNoData": "没有要显示的日志速率数据。",
     "xpack.infra.logs.analysis.anomalySectionNoDataBody": "您可能想调整时间范围。",
     "xpack.infra.logs.analysis.anomalySectionNoDataTitle": "没有可显示的数据。",
+    "xpack.infra.logs.analysis.createJobButtonLabel": "创建 ML 作业",
     "xpack.infra.logs.analysis.datasetFilterPlaceholder": "按数据集筛选",
     "xpack.infra.logs.analysis.enableAnomalyDetectionButtonLabel": "启用异常检测",
     "xpack.infra.logs.analysis.jobConfigurationOutdatedCalloutMessage": "创建 {moduleName} ML 作业时所使用的源配置不同。重新创建作业以应用当前配置。这将移除以前检测到的异常。",
@@ -8508,6 +8445,9 @@
     "xpack.infra.logs.analysis.logEntryRateModuleDescription": "使用 Machine Learning 自动检测异常日志条目速率。",
     "xpack.infra.logs.analysis.logEntryRateModuleName": "日志速率",
     "xpack.infra.logs.analysis.manageMlJobsButtonLabel": "管理 ML 作业",
+    "xpack.infra.logs.analysis.missingMlPrivilegesTitle": "需要其他 Machine Learning 权限",
+    "xpack.infra.logs.analysis.missingMlResultsPrivilegesDescription": "此功能使用 Machine Learning 作业，这需要对 Machine Learning 应用至少有读权限，才能访问这些作业的状态和结果。",
+    "xpack.infra.logs.analysis.missingMlSetupPrivilegesDescription": "此功能使用 Machine Learning 作业，这需要对 Machine Learning 应用具有所有权限，才能进行相应的设置。",
     "xpack.infra.logs.analysis.mlAppButton": "打开 Machine Learning",
     "xpack.infra.logs.analysis.mlUnavailableBody": "查看 {machineLearningAppLink} 以获取更多信息。",
     "xpack.infra.logs.analysis.mlUnavailableTitle": "此功能需要 Machine Learning",
@@ -8558,7 +8498,7 @@
     "xpack.infra.logs.logAnalysis.splash.loadingMessage": "正在检查许可证......",
     "xpack.infra.logs.logAnalysis.splash.splashImageAlt": "占位符图像",
     "xpack.infra.logs.logAnalysis.splash.startTrialCta": "开始试用",
-    "xpack.infra.logs.logAnalysis.splash.startTrialDescription": "我们为期 14 天的免费试用包含 Machine Learning 功能，允许您在日志中检测异常。",
+    "xpack.infra.logs.logAnalysis.splash.startTrialDescription": "我们的免费试用版包含 Machine Learning 功能，可用于检测日志中的异常。",
     "xpack.infra.logs.logAnalysis.splash.startTrialTitle": "要使用异常检测，请开始免费的试用",
     "xpack.infra.logs.logAnalysis.splash.updateSubscriptionCta": "升级订阅",
     "xpack.infra.logs.logAnalysis.splash.updateSubscriptionDescription": "必须具有白金级订阅，才能使用 Machine Learning 功能。",
@@ -8757,11 +8697,12 @@
     "xpack.infra.metrics.alertFlyout.alertName": "指标阈值",
     "xpack.infra.metrics.alertFlyout.alertOnNoData": "没数据时提醒我",
     "xpack.infra.metrics.alertFlyout.alertPreviewError": "尝试预览此告警条件时发生错误",
+    "xpack.infra.metrics.alertFlyout.alertPreviewErrorDesc": "请稍后重试或查看详情了解更多信息。",
     "xpack.infra.metrics.alertFlyout.alertPreviewErrorResult": "尝试评估部分数据时发生错误。",
-    "xpack.infra.metrics.alertFlyout.alertPreviewGroups": "{numberOfGroups} 个{groupName}",
+    "xpack.infra.metrics.alertFlyout.alertPreviewGroups": "{numberOfGroups, plural, one {# 个 {groupName}} other {# 个 {groupName}}}",
     "xpack.infra.metrics.alertFlyout.alertPreviewGroupsAcross": "在",
-    "xpack.infra.metrics.alertFlyout.alertPreviewNoDataResult": "存在 {boldedResultsNumber} 个无数据结果。",
-    "xpack.infra.metrics.alertFlyout.alertPreviewNoDataResultNumber": "{noData}",
+    "xpack.infra.metrics.alertFlyout.alertPreviewNoDataResult": "存在 {boldedResultsNumber}无数据结果。",
+    "xpack.infra.metrics.alertFlyout.alertPreviewNoDataResultNumber": "{noData, plural, one {# 个} other {# 个}}",
     "xpack.infra.metrics.alertFlyout.alertPreviewResult": "此告警将发生 {firedTimes}",
     "xpack.infra.metrics.alertFlyout.alertPreviewResultLookback": "在过去 {lookback}。",
     "xpack.infra.metrics.alertFlyout.conditions": "条件",
@@ -8773,6 +8714,7 @@
     "xpack.infra.metrics.alertFlyout.error.thresholdRequired": "“阈值”必填。",
     "xpack.infra.metrics.alertFlyout.error.thresholdTypeRequired": "阈值必须包含有效数字。",
     "xpack.infra.metrics.alertFlyout.error.timeRequred": "“时间大小”必填。",
+    "xpack.infra.metrics.alertFlyout.errorDetails": "详情",
     "xpack.infra.metrics.alertFlyout.expandRowLabel": "展开行。",
     "xpack.infra.metrics.alertFlyout.expression.for.descriptionLabel": "对于",
     "xpack.infra.metrics.alertFlyout.expression.for.popoverTitle": "库存类型",
@@ -8799,8 +8741,12 @@
     "xpack.infra.metrics.alertFlyout.tooManyBucketsErrorDescription": "尝试选择较短的预览长度或在“{forTheLast}”字段中增大时间量。",
     "xpack.infra.metrics.alertFlyout.tooManyBucketsErrorTitle": "数据过多（>{maxBuckets} 个结果）",
     "xpack.infra.metrics.alertFlyout.weekLabel": "周",
+    "xpack.infra.metrics.alerting.alertStateActionVariableDescription": "告警的当前状态",
+    "xpack.infra.metrics.alerting.groupActionVariableDescription": "报告数据的组名称",
     "xpack.infra.metrics.alerting.inventory.threshold.defaultActionMessage": "\\{\\{alertName\\}\\} - \\{\\{context.group\\}\\} 处于 \\{\\{context.alertState\\}\\} 状态\n\n原因：\n\\{\\{context.reason\\}\\}\n",
     "xpack.infra.metrics.alerting.inventory.threshold.fired": "已触发",
+    "xpack.infra.metrics.alerting.metricActionVariableDescription": "指定条件中的指标名称。用法：(ctx.metric.condition0, ctx.metric.condition1, 诸如此类)。",
+    "xpack.infra.metrics.alerting.reasonActionVariableDescription": "描述告警处于此状态的原因，包括哪些指标已超过哪些阈值",
     "xpack.infra.metrics.alerting.threshold.aboveRecovery": "高于",
     "xpack.infra.metrics.alerting.threshold.alertState": "告警",
     "xpack.infra.metrics.alerting.threshold.belowRecovery": "低于",
@@ -8821,6 +8767,9 @@
     "xpack.infra.metrics.alerting.threshold.outsideRangeComparator": "不介于",
     "xpack.infra.metrics.alerting.threshold.recoveredAlertReason": "{metric} 现在{comparator}阈值 {threshold}（当前值为 {currentValue}）",
     "xpack.infra.metrics.alerting.threshold.thresholdRange": "{a} 和 {b}",
+    "xpack.infra.metrics.alerting.thresholdActionVariableDescription": "指定条件中的指标阈值。用法：(ctx.threshold.condition0, ctx.threshold.condition1, 诸如此类)。",
+    "xpack.infra.metrics.alerting.timestampDescription": "检测到告警时的时间戳。",
+    "xpack.infra.metrics.alerting.valueActionVariableDescription": "指定条件中的指标值。用法：(ctx.value.condition0, ctx.value.condition1, 诸如此类)。",
     "xpack.infra.metrics.alerts.dataTimeRangeLabel": "过去 {lookback} {timeLabel}",
     "xpack.infra.metrics.alerts.dataTimeRangeLabelWithGrouping": "{id} 过去 {lookback} {timeLabel}的数据",
     "xpack.infra.metrics.alerts.loadingMessage": "正在加载",
@@ -8839,7 +8788,6 @@
     "xpack.infra.metrics.missingTSVBModelError": "{nodeType} 的 {metricId} TSVB 模型不存在",
     "xpack.infra.metrics.pluginTitle": "指标",
     "xpack.infra.metrics.refetchButtonLabel": "检查新数据",
-    "xpack.infra.metricsExplorer.everything": "所有内容",
     "xpack.infra.metricsExplorer.actionsLabel.aria": "适用于 {grouping} 的操作",
     "xpack.infra.metricsExplorer.actionsLabel.button": "操作",
     "xpack.infra.metricsExplorer.aggregationLabel": "的",
@@ -8931,7 +8879,7 @@
     "xpack.infra.savedView.manageViews": "管理视图",
     "xpack.infra.savedView.saveNewView": "保存新视图",
     "xpack.infra.savedView.searchPlaceholder": "搜索已保存视图",
-    "xpack.infra.savedView.unknownView": "未知",
+    "xpack.infra.savedView.unknownView": "未选择视图",
     "xpack.infra.savedView.updateView": "更新视图",
     "xpack.infra.snapshot.missingSnapshotMetricError": "{nodeType} 的 {metric} 聚合不可用。",
     "xpack.infra.sourceConfiguration.addLogColumnButtonLabel": "添加列",
@@ -9082,54 +9030,11 @@
     "xpack.infra.waffle.unableToSelectMetricErrorTitle": "无法选择指标选项或指标值。",
     "xpack.infra.waffleTime.autoRefreshButtonLabel": "自动刷新",
     "xpack.infra.waffleTime.stopRefreshingButtonLabel": "停止刷新",
-    "xpack.ingestManager.agentPolicy.confirmModalCalloutDescription": "Fleet 检测到所选代理配置 {policyName} 已由您的部分代理使用。由于此操作，Fleet 会将更新部署到使用此配置的所有代理。",
-    "xpack.ingestManager.agentPolicy.confirmModalCancelButtonLabel": "取消",
-    "xpack.ingestManager.agentPolicy.confirmModalConfirmButtonLabel": "保存并部署更改",
-    "xpack.ingestManager.agentPolicy.confirmModalDescription": "此操作无法撤消。是否确定要继续？",
-    "xpack.ingestManager.agentPolicy.confirmModalTitle": "保存并部署更改",
-    "xpack.ingestManager.agentPolicy.linkedAgentCountText": "{count, plural, one {# 个代理} other {# 个代理}}",
-    "xpack.ingestManager.agentPolicyActionMenu.buttonText": "操作",
-    "xpack.ingestManager.agentPolicyActionMenu.copyPolicyActionText": "复制配置",
-    "xpack.ingestManager.agentPolicyActionMenu.enrollAgentActionText": "添加代理",
-    "xpack.ingestManager.agentPolicyActionMenu.viewPolicyText": "查看配置",
-    "xpack.ingestManager.agentPolicyForm.advancedOptionsToggleLabel": "高级选项",
-    "xpack.ingestManager.agentPolicyForm.descriptionFieldLabel": "描述",
-    "xpack.ingestManager.agentPolicyForm.descriptionFieldPlaceholder": "此配置将如何使用？",
-    "xpack.ingestManager.agentPolicyForm.monitoringDescription": "收集有关代理的数据，以排查和跟踪性能。",
-    "xpack.ingestManager.agentPolicyForm.monitoringLabel": "代理监测",
-    "xpack.ingestManager.agentPolicyForm.monitoringLogsFieldLabel": "收集代理日志",
-    "xpack.ingestManager.agentPolicyForm.monitoringMetricsFieldLabel": "收集代理指标",
-    "xpack.ingestManager.agentPolicyForm.nameFieldLabel": "名称",
-    "xpack.ingestManager.agentPolicyForm.nameFieldPlaceholder": "选择名称",
-    "xpack.ingestManager.agentPolicyForm.nameRequiredErrorMessage": "“代理配置名称”必填",
-    "xpack.ingestManager.agentPolicyForm.namespaceFieldDescription": "将默认命名空间应用于使用此配置的集成。集成可以指定自己的命名空间。",
-    "xpack.ingestManager.agentPolicyForm.namespaceFieldLabel": "默认命名空间",
-    "xpack.ingestManager.agentPolicyForm.namespaceRequiredErrorMessage": "命名空间必填",
-    "xpack.ingestManager.agentPolicyForm.systemMonitoringFieldLabel": "可选",
-    "xpack.ingestManager.agentPolicyForm.systemMonitoringText": "收集系统指标",
-    "xpack.ingestManager.agentPolicyForm.systemMonitoringTooltipText": "启用此选项可使用收集系统指标和信息的集成启动您的配置。",
-    "xpack.ingestManager.agentPolicyList.actionsColumnTitle": "操作",
-    "xpack.ingestManager.agentPolicyList.addButton": "创建代理配置",
-    "xpack.ingestManager.agentPolicyList.agentsColumnTitle": "代理",
-    "xpack.ingestManager.agentPolicyList.clearFiltersLinkText": "清除筛选",
-    "xpack.ingestManager.agentPolicyList.descriptionColumnTitle": "描述",
-    "xpack.ingestManager.agentPolicyList.loadingAgentPoliciesMessage": "正在加载代理配置……",
-    "xpack.ingestManager.agentPolicyList.nameColumnTitle": "名称",
-    "xpack.ingestManager.agentPolicyList.noAgentPoliciesPrompt": "无代理配置",
-    "xpack.ingestManager.agentPolicyList.noFilteredAgentPoliciesPrompt": "找不到代理配置。{clearFiltersLink}",
-    "xpack.ingestManager.agentPolicyList.packagePoliciesCountColumnTitle": "集成",
-    "xpack.ingestManager.agentPolicyList.pageSubtitle": "使用代理配置管理代理和它们收集的数据。",
-    "xpack.ingestManager.agentPolicyList.pageTitle": "代理配置",
-    "xpack.ingestManager.agentPolicyList.reloadAgentPoliciesButtonText": "重新加载",
-    "xpack.ingestManager.agentPolicyList.revisionNumber": "修订 {revNumber}",
-    "xpack.ingestManager.agentPolicyList.updatedOnColumnTitle": "最后更新时间",
     "xpack.ingestManager.agentDetails.actionsButton": "操作",
-    "xpack.ingestManager.agentDetails.agentPolicyLabel": "代理配置",
     "xpack.ingestManager.agentDetails.agentDetailsTitle": "代理“{id}”",
     "xpack.ingestManager.agentDetails.agentNotFoundErrorDescription": "找不到代理 ID {agentId}",
     "xpack.ingestManager.agentDetails.agentNotFoundErrorTitle": "未找到代理",
-    "xpack.ingestManager.agentDetails.policyLabel": "配置",
-    "xpack.ingestManager.agentDetails.hostIdLabel": "主机 ID",
+    "xpack.ingestManager.agentDetails.hostIdLabel": "代理 ID",
     "xpack.ingestManager.agentDetails.hostNameLabel": "主机名",
     "xpack.ingestManager.agentDetails.localMetadataSectionSubtitle": "本地元数据",
     "xpack.ingestManager.agentDetails.metadataSectionTitle": "元数据",
@@ -9143,21 +9048,16 @@
     "xpack.ingestManager.agentDetails.viewAgentListTitle": "查看所有代理",
     "xpack.ingestManager.agentEnrollment.cancelButtonLabel": "取消",
     "xpack.ingestManager.agentEnrollment.continueButtonLabel": "继续",
-    "xpack.ingestManager.agentEnrollment.copyPolicyButton": "复制到剪贴板",
     "xpack.ingestManager.agentEnrollment.copyRunInstructionsButton": "复制到剪贴板",
-    "xpack.ingestManager.agentEnrollment.downloadPolicyButton": "下载配置",
     "xpack.ingestManager.agentEnrollment.downloadDescription": "在主机计算机上下载 Elastic 代理。可以从 Elastic 代理下载页面访问代理二进制文件及其验证签名。",
     "xpack.ingestManager.agentEnrollment.downloadLink": "前往 elastic.co/downloads",
     "xpack.ingestManager.agentEnrollment.enrollFleetTabLabel": "注册到 Fleet",
     "xpack.ingestManager.agentEnrollment.enrollStandaloneTabLabel": "独立模式",
     "xpack.ingestManager.agentEnrollment.fleetNotInitializedText": "注册代理前需要设置 Fleet。{link}",
     "xpack.ingestManager.agentEnrollment.flyoutTitle": "添加代理",
-    "xpack.ingestManager.agentEnrollment.goToFleetButton": "前往 Fleet。",
     "xpack.ingestManager.agentEnrollment.managedDescription": "无论是需要一个代理还是需要数以千计的代理，Fleet 允许您轻松地集中管理并部署代理的更新。按照下面的说明下载 Elastic 代理并将代理注册到 Fleet。",
     "xpack.ingestManager.agentEnrollment.standaloneDescription": "如果希望对以独立模式运行的代理进行配置更改，则需要手动更新。按照下面的说明下载并设置独立模式的 Elastic 代理。",
-    "xpack.ingestManager.agentEnrollment.stepCheckForDataDescription": "启动代理后，代理应开始发送数据。您可以在采集管理器的数据集页面查看此数据。",
     "xpack.ingestManager.agentEnrollment.stepCheckForDataTitle": "检查数据",
-    "xpack.ingestManager.agentEnrollment.stepChooseAgentPolicyTitle": "选择代理配置",
     "xpack.ingestManager.agentEnrollment.stepConfigureAgentDescription": "在安装 Elastic 代理的系统上复制此配置并将其放入名为 {fileName} 的文件中。切勿忘记修改配置文件中 {outputSection} 部分的{ESUsernameVariable} 和 {ESPasswordVariable}，以便其使用您的实际 Elasticsearch 凭据。",
     "xpack.ingestManager.agentEnrollment.stepConfigureAgentTitle": "配置代理",
     "xpack.ingestManager.agentEnrollment.stepDownloadAgentTitle": "下载 Elastic 代理",
@@ -9175,8 +9075,8 @@
     "xpack.ingestManager.agentEventsList.timestampColumnTitle": "时间戳",
     "xpack.ingestManager.agentEventsList.typeColumnTitle": "类型",
     "xpack.ingestManager.agentEventSubtype.acknowledgedLabel": "已确认",
-    "xpack.ingestManager.agentEventSubtype.policyLabel": "配置",
     "xpack.ingestManager.agentEventSubtype.dataDumpLabel": "数据转储",
+    "xpack.ingestManager.agentEventSubtype.degradedLabel": "已降级",
     "xpack.ingestManager.agentEventSubtype.failedLabel": "失败",
     "xpack.ingestManager.agentEventSubtype.inProgressLabel": "进行中",
     "xpack.ingestManager.agentEventSubtype.runningLabel": "正在运行",
@@ -9201,9 +9101,8 @@
     "xpack.ingestManager.agentList.actionsColumnTitle": "操作",
     "xpack.ingestManager.agentList.addButton": "添加代理",
     "xpack.ingestManager.agentList.clearFiltersLinkText": "清除筛选",
-    "xpack.ingestManager.agentList.policyColumnTitle": "代理配置",
-    "xpack.ingestManager.agentList.policyFilterText": "代理配置",
     "xpack.ingestManager.agentList.enrollButton": "添加代理",
+    "xpack.ingestManager.agentList.forceUnenrollOneButton": "强制取消注册",
     "xpack.ingestManager.agentList.hostColumnTitle": "主机",
     "xpack.ingestManager.agentList.lastCheckinTitle": "上次活动",
     "xpack.ingestManager.agentList.loadingAgentsMessage": "正在加载代理……",
@@ -9225,13 +9124,6 @@
     "xpack.ingestManager.agentListStatus.offlineLabel": "脱机",
     "xpack.ingestManager.agentListStatus.onlineLabel": "联机",
     "xpack.ingestManager.agentListStatus.totalLabel": "代理",
-    "xpack.ingestManager.agentReassignPolicy.cancelButtonLabel": "取消",
-    "xpack.ingestManager.agentReassignPolicy.policyDescription": "选定代理配置将收集 {count, plural, one {{countValue} 个集成} other {{countValue} 个集成}}的数据：",
-    "xpack.ingestManager.agentReassignPolicy.continueButtonLabel": "分配配置",
-    "xpack.ingestManager.agentReassignPolicy.flyoutDescription": "选择要为选定代理分配的新代理配置。",
-    "xpack.ingestManager.agentReassignPolicy.flyoutTitle": "分配新代理配置",
-    "xpack.ingestManager.agentReassignPolicy.selectPolicyLabel": "代理配置",
-    "xpack.ingestManager.agentReassignPolicy.successSingleNotificationTitle": "代理配置已重新分配",
     "xpack.ingestManager.alphaMessageDescription": "不推荐在生产环境中使用采集管理器。",
     "xpack.ingestManager.alphaMessageLinkText": "查看更多详情。",
     "xpack.ingestManager.alphaMessageTitle": "公测版",
@@ -9241,7 +9133,6 @@
     "xpack.ingestManager.alphaMessaging.forumLink": "讨论论坛",
     "xpack.ingestManager.alphaMessaging.introText": "采集管理器仍处于开发状态，不适用于生产环境。此公测版用于用户测试采集管理器和新 Elastic 代理并提供相关反馈。此插件不受支持 SLA 的约束。",
     "xpack.ingestManager.alphaMessging.closeFlyoutLabel": "关闭",
-    "xpack.ingestManager.appNavigation.policiesLinkText": "配置",
     "xpack.ingestManager.appNavigation.dataStreamsLinkText": "数据集",
     "xpack.ingestManager.appNavigation.epmLinkText": "集成",
     "xpack.ingestManager.appNavigation.fleetLinkText": "Fleet",
@@ -9251,102 +9142,15 @@
     "xpack.ingestManager.appTitle": "Ingest Manager",
     "xpack.ingestManager.betaBadge.labelText": "公测版",
     "xpack.ingestManager.betaBadge.tooltipText": "不推荐在生产环境中使用此插件。请在我们讨论论坛中报告错误。",
-    "xpack.ingestManager.breadcrumbs.addPackagePolicyPageTitle": "添加集成",
     "xpack.ingestManager.breadcrumbs.allIntegrationsPageTitle": "全部",
     "xpack.ingestManager.breadcrumbs.appTitle": "采集管理器",
-    "xpack.ingestManager.breadcrumbs.policiesPageTitle": "配置",
     "xpack.ingestManager.breadcrumbs.datastreamsPageTitle": "数据集",
-    "xpack.ingestManager.breadcrumbs.editPackagePolicyPageTitle": "编辑集成",
     "xpack.ingestManager.breadcrumbs.fleetAgentsPageTitle": "代理",
     "xpack.ingestManager.breadcrumbs.fleetEnrollmentTokensPageTitle": "注册令牌",
     "xpack.ingestManager.breadcrumbs.fleetPageTitle": "Fleet",
     "xpack.ingestManager.breadcrumbs.installedIntegrationsPageTitle": "已安装",
     "xpack.ingestManager.breadcrumbs.integrationsPageTitle": "集成",
     "xpack.ingestManager.breadcrumbs.overviewPageTitle": "概览",
-    "xpack.ingestManager.policyDetails.addPackagePolicyButtonText": "添加集成",
-    "xpack.ingestManager.policyDetails.policyDetailsTitle": "配置“{id}”",
-    "xpack.ingestManager.policyDetails.policyNotFoundErrorTitle": "未找到配置“{id}”",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.actionsColumnTitle": "操作",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.deleteActionTitle": "删除集成",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.descriptionColumnTitle": "描述",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.editActionTitle": "编辑集成",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.nameColumnTitle": "名称",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.namespaceColumnTitle": "命名空间",
-    "xpack.ingestManager.policyDetails.packagePoliciesTable.packageNameColumnTitle": "集成",
-    "xpack.ingestManager.policyDetails.subTabs.packagePoliciesTabText": "集成",
-    "xpack.ingestManager.policyDetails.subTabs.settingsTabText": "设置",
-    "xpack.ingestManager.policyDetails.summary.lastUpdated": "最后更新时间",
-    "xpack.ingestManager.policyDetails.summary.integrations": "集成",
-    "xpack.ingestManager.policyDetails.summary.revision": "修订",
-    "xpack.ingestManager.policyDetails.summary.usedBy": "使用者",
-    "xpack.ingestManager.policyDetails.unexceptedErrorTitle": "加载配置时发生错误",
-    "xpack.ingestManager.policyDetails.viewAgentListTitle": "查看所有代理配置",
-    "xpack.ingestManager.policyDetails.yamlDownloadButtonLabel": "下载配置",
-    "xpack.ingestManager.policyDetails.yamlFlyoutCloseButtonLabel": "关闭",
-    "xpack.ingestManager.policyDetails.yamlflyoutTitleWithName": "“{name}”代理配置",
-    "xpack.ingestManager.policyDetails.yamlflyoutTitleWithoutName": "代理配置",
-    "xpack.ingestManager.policyDetailsPackagePolicies.createFirstButtonText": "添加集成",
-    "xpack.ingestManager.policyDetailsPackagePolicies.createFirstMessage": "此配置尚未有任何集成。",
-    "xpack.ingestManager.policyDetailsPackagePolicies.createFirstTitle": "添加您的首个集成",
-    "xpack.ingestManager.policyForm.deletePolicyActionText": "删除配置",
-    "xpack.ingestManager.policyForm.deletePolicyGroupDescription": "将不会删除现有数据。",
-    "xpack.ingestManager.policyForm.deletePolicyGroupTitle": "删除配置",
-    "xpack.ingestManager.policyForm.generalSettingsGroupDescription": "为您的代理配置选择名称和描述。",
-    "xpack.ingestManager.policyForm.generalSettingsGroupTitle": "常规设置",
-    "xpack.ingestManager.policyForm.unableToDeleteDefaultPolicyText": "无法删除默认配置",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.cancelButtonLabel": "取消",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.confirmButtonLabel": "复制配置",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.copyPolicyPrompt": "为您的新代理配置选择名称和描述。",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.copyPolicyTitle": "复制“{name}”代理配置",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.defaultNewPolicyName": "{name}（副本）",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.newDescriptionLabel": "描述",
-    "xpack.ingestManager.copyAgentPolicy.confirmModal.newNameLabel": "新配置名称",
-    "xpack.ingestManager.copyAgentPolicy.failureNotificationTitle": "复制代理配置“{id}”时出错",
-    "xpack.ingestManager.copyAgentPolicy.fatalErrorNotificationTitle": "复制代理配置时出错",
-    "xpack.ingestManager.copyAgentPolicy.successNotificationTitle": "代理配置已复制",
-    "xpack.ingestManager.createAgentPolicy.cancelButtonLabel": "取消",
-    "xpack.ingestManager.createAgentPolicy.errorNotificationTitle": "无法创建代理配置",
-    "xpack.ingestManager.createAgentPolicy.flyoutTitle": "创建代理配置",
-    "xpack.ingestManager.createAgentPolicy.flyoutTitleDescription": "代理配置用于管理整个代理组的设置。您可以将集成添加到代理配置以指定代理收集的数据。编辑代理配置时，可以使用 Fleet 将更新部署到指定的代理组。",
-    "xpack.ingestManager.createAgentPolicy.submitButtonLabel": "创建代理配置",
-    "xpack.ingestManager.createAgentPolicy.successNotificationTitle": "代理配置“{name}”已创建",
-    "xpack.ingestManager.createPackagePolicy.addedNotificationMessage": "Fleet 会将更新部署到所有使用配置“{agentPolicyName}”的代理",
-    "xpack.ingestManager.createPackagePolicy.addedNotificationTitle": "已成功添加“{packagePolicyName}”",
-    "xpack.ingestManager.createPackagePolicy.agentPolicyNameLabel": "代理配置",
-    "xpack.ingestManager.createPackagePolicy.cancelButton": "取消",
-    "xpack.ingestManager.createPackagePolicy.cancelLinkText": "取消",
-    "xpack.ingestManager.createPackagePolicy.errorOnSaveText": "您的集成配置有错误。请在保存前进行修复。",
-    "xpack.ingestManager.createPackagePolicy.pageDescriptionfromPolicy": "配置选定代理配置的集成。",
-    "xpack.ingestManager.createPackagePolicy.pageDescriptionfromPackage": "按照下面的说明将此集成添加到代理配置。",
-    "xpack.ingestManager.createPackagePolicy.pageTitle": "添加集成",
-    "xpack.ingestManager.createPackagePolicy.pageTitleWithPackageName": "添加 {packageName} 集成",
-    "xpack.ingestManager.createPackagePolicy.saveButton": "保存集成",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.advancedOptionsToggleLinkText": "高级选项",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.errorCountText": "{count, plural, one {# 个错误} other {# 个错误}}",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.hideStreamsAriaLabel": "隐藏 {type} 输入",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.inputSettingsDescription": "以下设置适用于下面的所有输入。",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.inputSettingsTitle": "设置",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.inputVarFieldOptionalLabel": "可选",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.integrationSettingsSectionDescription": "选择有助于确定如何使用此集成的名称和描述。",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.integrationSettingsSectionTitle": "集成设置",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.noPolicyOptionsMessage": "没有可配置的内容",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.packagePolicyDescriptionInputLabel": "描述",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.packagePolicyNameInputLabel": "集成名称",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.packagePolicyNamespaceInputLabel": "命名空间",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.showStreamsAriaLabel": "显示 {type} 输入",
-    "xpack.ingestManager.createPackagePolicy.stepConfigure.toggleAdvancedOptionsButtonText": "高级选项",
-    "xpack.ingestManager.createPackagePolicy.stepConfigurePackagePolicyTitle": "配置集成",
-    "xpack.ingestManager.createPackagePolicy.stepSelectAgentPolicyTitle": "选择代理配置",
-    "xpack.ingestManager.createPackagePolicy.StepSelectPolicy.addButton": "新建代理配置",
-    "xpack.ingestManager.createPackagePolicy.StepSelectPolicy.agentPolicyAgentsCountText": "{count, plural, one {# 个代理} other {# 个代理}}",
-    "xpack.ingestManager.createPackagePolicy.StepSelectPolicy.errorLoadingAgentPoliciesTitle": "加载代理配置时出错",
-    "xpack.ingestManager.createPackagePolicy.StepSelectPolicy.errorLoadingPackageTitle": "加载软件包信息时出错",
-    "xpack.ingestManager.createPackagePolicy.StepSelectPolicy.errorLoadingSelectedAgentPolicyTitle": "加载选定代理配置时出错",
-    "xpack.ingestManager.createPackagePolicy.stepSelectPackage.errorLoadingPolicyTitle": "加载代理配置信息时出错",
-    "xpack.ingestManager.createPackagePolicy.stepSelectPackage.errorLoadingPackagesTitle": "加载集成时出错",
-    "xpack.ingestManager.createPackagePolicy.stepSelectPackage.errorLoadingSelectedPackageTitle": "加载选定集成时出错",
-    "xpack.ingestManager.createPackagePolicy.stepSelectPackage.filterPackagesInputPlaceholder": "搜索集成",
-    "xpack.ingestManager.createPackagePolicy.stepSelectPackageTitle": "选择集成",
     "xpack.ingestManager.dataStreamList.actionsColumnTitle": "操作",
     "xpack.ingestManager.dataStreamList.datasetColumnTitle": "数据集",
     "xpack.ingestManager.dataStreamList.integrationColumnTitle": "集成",
@@ -9365,73 +9169,34 @@
     "xpack.ingestManager.dataStreamList.viewDashboardsActionText": "查看仪表板",
     "xpack.ingestManager.dataStreamList.viewDashboardsPanelTitle": "查看仪表板",
     "xpack.ingestManager.defaultSearchPlaceholderText": "搜索",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.affectedAgentsMessage": "{agentsCount, plural, one {# 个代理} other {# 个代理}}已分配给此代理配置。在删除此配置之前请取消分配这些代理。",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.affectedAgentsTitle": "配置已被用",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.cancelButtonLabel": "取消",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.confirmButtonLabel": "删除配置",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.deletePolicyTitle": "删除此代理配置？",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.irreversibleMessage": "此操作无法撤消。",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.loadingAgentsCountMessage": "正在检查受影响代理数量……",
-    "xpack.ingestManager.deleteAgentPolicy.confirmModal.loadingButtonLabel": "正在加载……",
-    "xpack.ingestManager.deleteAgentPolicy.failureSingleNotificationTitle": "删除代理配置“{id}”时出错",
-    "xpack.ingestManager.deleteAgentPolicy.fatalErrorNotificationTitle": "删除代理配置时出错",
-    "xpack.ingestManager.deleteAgentPolicy.successSingleNotificationTitle": "已删除代理配置“{id}”",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.affectedAgentsMessage": "Fleet 已检测到 {agentPolicyName} 已由您的部分代理使用。",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.affectedAgentsTitle": "此操作将影响 {agentsCount} 个{agentsCount, plural, one {代理} other {代理}}。",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.cancelButtonLabel": "取消",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.confirmButtonLabel": "删除{agentPoliciesCount, plural, one {集成} other {集成}}",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.deleteMultipleTitle": "删除{count, plural, one {集成} other {# 个集成}}？",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.generalMessage": "此操作无法撤消。是否确定要继续？",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.loadingAgentsCountMessage": "正在检查受影响的代理……",
-    "xpack.ingestManager.deletePackagePolicy.confirmModal.loadingButtonLabel": "正在加载……",
-    "xpack.ingestManager.deletePackagePolicy.failureMultipleNotificationTitle": "删除 {count} 个集成时出错",
-    "xpack.ingestManager.deletePackagePolicy.failureSingleNotificationTitle": "删除集成“{id}”时出错",
-    "xpack.ingestManager.deletePackagePolicy.fatalErrorNotificationTitle": "删除集成时出错",
-    "xpack.ingestManager.deletePackagePolicy.successMultipleNotificationTitle": "已删除 {count} 个集成",
-    "xpack.ingestManager.deletePackagePolicy.successSingleNotificationTitle": "已删除集成“{id}”",
     "xpack.ingestManager.disabledSecurityDescription": "必须在 Kibana 和 Elasticsearch 启用安全性，才能使用 Elastic Fleet。",
     "xpack.ingestManager.disabledSecurityTitle": "安全性未启用",
-    "xpack.ingestManager.editAgentPolicy.cancelButtonText": "取消",
-    "xpack.ingestManager.editAgentPolicy.errorNotificationTitle": "无法更新代理配置",
-    "xpack.ingestManager.editAgentPolicy.saveButtonText": "保存更改",
-    "xpack.ingestManager.editAgentPolicy.savingButtonText": "正在保存……",
-    "xpack.ingestManager.editAgentPolicy.successNotificationTitle": "已成功更新“{name}”设置",
-    "xpack.ingestManager.editAgentPolicy.unsavedChangesText": "您有未保存更改",
-    "xpack.ingestManager.editPackagePolicy.cancelButton": "取消",
-    "xpack.ingestManager.editPackagePolicy.errorLoadingDataMessage": "加载此集成信息时出错",
-    "xpack.ingestManager.editPackagePolicy.errorLoadingDataTitle": "加载数据时出错",
-    "xpack.ingestManager.editPackagePolicy.failedConflictNotificationMessage": "数据已过时。刷新页面以获取最新的配置。",
-    "xpack.ingestManager.editPackagePolicy.failedNotificationTitle": "更新“{packagePolicyName}”时出错",
-    "xpack.ingestManager.editPackagePolicy.pageDescription": "修改集成设置并将更改部署到选定代理配置。",
-    "xpack.ingestManager.editPackagePolicy.pageTitle": "编辑集成",
-    "xpack.ingestManager.editPackagePolicy.pageTitleWithPackageName": "编辑 {packageName} 集成",
-    "xpack.ingestManager.editPackagePolicy.saveButton": "保存集成",
-    "xpack.ingestManager.editPackagePolicy.updatedNotificationMessage": "Fleet 会将更新部署到所有使用配置“{agentPolicyName}”的代理",
-    "xpack.ingestManager.editPackagePolicy.updatedNotificationTitle": "已成功更新“{packagePolicyName}”",
     "xpack.ingestManager.enrollemntAPIKeyList.emptyMessage": "未找到任何注册令牌。",
     "xpack.ingestManager.enrollemntAPIKeyList.loadingTokensMessage": "正在加载注册令牌......",
-    "xpack.ingestManager.enrollmentStepAgentPolicy.policySelectAriaLabel": "代理配置",
-    "xpack.ingestManager.enrollmentStepAgentPolicy.policySelectLabel": "代理配置",
-    "xpack.ingestManager.enrollmentStepAgentPolicy.enrollmentTokenSelectLabel": "注册令牌",
-    "xpack.ingestManager.enrollmentStepAgentPolicy.showAuthenticationSettingsButton": "身份验证设置",
+    "xpack.ingestManager.enrollmentInstructions.descriptionText": "从代理的目录，运行相应命令以注册并启动 Elastic 代理。您可以重复使用这些命令在多台机器上设置代理。请务必以具有系统“管理员”权限的用户身份执行注册步骤。",
+    "xpack.ingestManager.enrollmentInstructions.linuxDebRpmTitle": "Linux（.deb 和 .rpm）",
+    "xpack.ingestManager.enrollmentInstructions.macLinuxTarInstructions": "如果代理的系统重新启动，您需要运行 {command}。",
+    "xpack.ingestManager.enrollmentInstructions.macLinuxTarTitle": "macOS/Linux (.tar.gz)",
+    "xpack.ingestManager.enrollmentInstructions.windowsTitle": "Windows",
     "xpack.ingestManager.enrollmentTokenDeleteModal.cancelButton": "取消",
     "xpack.ingestManager.enrollmentTokenDeleteModal.deleteButton": "删除",
     "xpack.ingestManager.enrollmentTokenDeleteModal.description": "确定要删除 {keyName}。",
     "xpack.ingestManager.enrollmentTokenDeleteModal.title": "删除注册令牌",
     "xpack.ingestManager.enrollmentTokensList.actionsTitle": "操作",
     "xpack.ingestManager.enrollmentTokensList.activeTitle": "活动",
-    "xpack.ingestManager.enrollmentTokensList.policyTitle": "代理配置",
     "xpack.ingestManager.enrollmentTokensList.createdAtTitle": "创建日期",
+    "xpack.ingestManager.enrollmentTokensList.hideTokenButtonLabel": "隐藏令牌",
     "xpack.ingestManager.enrollmentTokensList.nameTitle": "名称",
     "xpack.ingestManager.enrollmentTokensList.newKeyButton": "新建注册令牌",
     "xpack.ingestManager.enrollmentTokensList.pageDescription": "这是可用于注册代理的注册令牌列表。",
+    "xpack.ingestManager.enrollmentTokensList.revokeTokenButtonLabel": "撤销令牌",
     "xpack.ingestManager.enrollmentTokensList.secretTitle": "密钥",
-    "xpack.ingestManager.epm.addPackagePolicyButtonText": "添加 {packageName}",
+    "xpack.ingestManager.enrollmentTokensList.showTokenButtonLabel": "显示令牌",
+    "xpack.ingestManager.epm.assetGroupTitle": "{assetType} 资产",
     "xpack.ingestManager.epm.browseAllButtonText": "浏览所有集成",
     "xpack.ingestManager.epm.illustrationAltText": "集成的图示",
     "xpack.ingestManager.epm.loadingIntegrationErrorTitle": "加载集成详情时出错",
     "xpack.ingestManager.epm.packageDetailsNav.overviewLinkText": "概览",
-    "xpack.ingestManager.epm.packageDetailsNav.packagePoliciesLinkText": "使用情况",
     "xpack.ingestManager.epm.packageDetailsNav.settingsLinkText": "设置",
     "xpack.ingestManager.epm.pageSubtitle": "浏览集成以了解热门应用和服务。",
     "xpack.ingestManager.epm.pageTitle": "集成",
@@ -9510,7 +9275,6 @@
     "xpack.ingestManager.metadataForm.submitButtonText": "添加",
     "xpack.ingestManager.metadataForm.valueLabel": "值",
     "xpack.ingestManager.newEnrollmentKey.cancelButtonLabel": "取消",
-    "xpack.ingestManager.newEnrollmentKey.policyLabel": "配置",
     "xpack.ingestManager.newEnrollmentKey.flyoutTitle": "创建新的注册令牌",
     "xpack.ingestManager.newEnrollmentKey.keyCreatedToasts": "注册令牌已创建。",
     "xpack.ingestManager.newEnrollmentKey.nameLabel": "名称",
@@ -9521,17 +9285,12 @@
     "xpack.ingestManager.overviewAgentErrorTitle": "错误",
     "xpack.ingestManager.overviewAgentOfflineTitle": "脱机",
     "xpack.ingestManager.overviewAgentTotalTitle": "代理总数",
-    "xpack.ingestManager.overviewPolicyTotalTitle": "可用总计",
     "xpack.ingestManager.overviewDatastreamNamespacesTitle": "命名空间",
     "xpack.ingestManager.overviewDatastreamSizeTitle": "总大小",
     "xpack.ingestManager.overviewDatastreamTotalTitle": "数据集",
     "xpack.ingestManager.overviewIntegrationsInstalledTitle": "安装时间",
     "xpack.ingestManager.overviewIntegrationsTotalTitle": "可用总计",
     "xpack.ingestManager.overviewIntegrationsUpdatesAvailableTitle": "可用更新",
-    "xpack.ingestManager.overviewPackagePolicyTitle": "已配置集成",
-    "xpack.ingestManager.overviewPagePoliciesPanelAction": "查看配置",
-    "xpack.ingestManager.overviewPagePoliciesPanelTitle": "代理配置",
-    "xpack.ingestManager.overviewPagePoliciesPanelTooltip": "使用代理配置控制您的代理收集的数据。",
     "xpack.ingestManager.overviewPageDataStreamsPanelAction": "查看数据集",
     "xpack.ingestManager.overviewPageDataStreamsPanelTitle": "数据集",
     "xpack.ingestManager.overviewPageDataStreamsPanelTooltip": "您的代理收集的数据组织到各种数据集中。",
@@ -9544,11 +9303,6 @@
     "xpack.ingestManager.overviewPageIntegrationsPanelTooltip": "浏览并安装 Elastic Stack 的集成。将集成添加到您的代理配置以开始发送数据。",
     "xpack.ingestManager.overviewPageSubtitle": "Elastic 代理和代理配置的集中管理。",
     "xpack.ingestManager.overviewPageTitle": "Ingest Manager",
-    "xpack.ingestManager.packagePolicyValidation.invalidArrayErrorMessage": "格式无效",
-    "xpack.ingestManager.packagePolicyValidation.invalidYamlFormatErrorMessage": "YAML 格式无效",
-    "xpack.ingestManager.packagePolicyValidation.nameRequiredErrorMessage": "“名称”必填",
-    "xpack.ingestManager.packagePolicyValidation.namespaceRequiredErrorMessage": "命名空间必填",
-    "xpack.ingestManager.packagePolicyValidation.requiredErrorMessage": "“{fieldName}”必填",
     "xpack.ingestManager.permissionDeniedErrorMessage": "您无权访问 Ingest Manager。Ingest Manager 需要{roleName}权限。",
     "xpack.ingestManager.permissionDeniedErrorTitle": "权限被拒绝",
     "xpack.ingestManager.permissionsRequestErrorMessageDescription": "检查 Ingest Manager 权限时出现问题",
@@ -9593,8 +9347,10 @@
     "xpack.ingestManager.unenrollAgents.confirmModal.confirmButtonLabel": "取消注册",
     "xpack.ingestManager.unenrollAgents.confirmModal.deleteMultipleTitle": "取消注册 {count, plural, one {# 个代理} other {# 个代理}}？",
     "xpack.ingestManager.unenrollAgents.confirmModal.deleteSingleTitle": "取消注册“{id}”？",
+    "xpack.ingestManager.unenrollAgents.confirmModal.forceDeleteSingleTitle": "强制取消注册代理“{id}”？",
     "xpack.ingestManager.unenrollAgents.confirmModal.loadingButtonLabel": "正在加载……",
     "xpack.ingestManager.unenrollAgents.fatalErrorNotificationTitle": "取消注册代理时出错",
+    "xpack.ingestManager.unenrollAgents.successForceSingleNotificationTitle": "代理“{id}”已取消注册",
     "xpack.ingestManager.unenrollAgents.successSingleNotificationTitle": "取消注册代理“{id}”",
     "xpack.ingestPipelines.app.checkingPrivilegesDescription": "正在检查权限……",
     "xpack.ingestPipelines.app.checkingPrivilegesErrorMessage": "从服务器获取用户权限时出错。",
@@ -9718,13 +9474,12 @@
     "xpack.ingestPipelines.pipelineEditor.removeProcessorModal.cancelButtonLabel": "取消",
     "xpack.ingestPipelines.pipelineEditor.removeProcessorModal.confirmationButtonLabel": "删除处理器",
     "xpack.ingestPipelines.pipelineEditor.removeProcessorModal.titleText": "删除 {type} 处理器",
-    "xpack.ingestPipelines.pipelineEditor.setForm.fieldFieldLabel": "字段",
-    "xpack.ingestPipelines.pipelineEditor.setForm.fieldRequiredError": "字段值必填。",
     "xpack.ingestPipelines.pipelineEditor.setForm.overrideFieldLabel": "覆盖",
     "xpack.ingestPipelines.pipelineEditor.setForm.valueFieldLabel": "值",
     "xpack.ingestPipelines.pipelineEditor.setForm.valueRequiredError": "需要设置值。",
     "xpack.ingestPipelines.pipelineEditor.settingsForm.learnMoreLabelLink.processor": "{processorLabel}文档",
     "xpack.ingestPipelines.pipelineEditor.typeField.fieldRequiredError": "类型必填。",
+    "xpack.ingestPipelines.pipelineEditor.typeField.typeFieldComboboxPlaceholder": "键入后按“ENTER”键",
     "xpack.ingestPipelines.pipelineEditor.typeField.typeFieldLabel": "处理器",
     "xpack.ingestPipelines.processors.label.append": "追加",
     "xpack.ingestPipelines.processors.label.bytes": "字节",
@@ -9734,7 +9489,7 @@
     "xpack.ingestPipelines.processors.label.date": "日期",
     "xpack.ingestPipelines.processors.label.dateIndexName": "日期索引名称",
     "xpack.ingestPipelines.processors.label.dissect": "分解",
-    "xpack.ingestPipelines.processors.label.dotExpander": "点扩展器",
+    "xpack.ingestPipelines.processors.label.dotExpander": "点扩展",
     "xpack.ingestPipelines.processors.label.drop": "丢弃",
     "xpack.ingestPipelines.processors.label.enrich": "扩充",
     "xpack.ingestPipelines.processors.label.fail": "失败",
@@ -9742,7 +9497,7 @@
     "xpack.ingestPipelines.processors.label.geoip": "GeoIP",
     "xpack.ingestPipelines.processors.label.grok": "Grok",
     "xpack.ingestPipelines.processors.label.gsub": "Gsub",
-    "xpack.ingestPipelines.processors.label.htmlStrip": "HTML 剥离",
+    "xpack.ingestPipelines.processors.label.htmlStrip": "HTML 标记移除",
     "xpack.ingestPipelines.processors.label.inference": "推理",
     "xpack.ingestPipelines.processors.label.join": "联接",
     "xpack.ingestPipelines.processors.label.json": "JSON",
@@ -9766,6 +9521,7 @@
     "xpack.ingestPipelines.requestFlyout.unnamedTitle": "请求",
     "xpack.ingestPipelines.settingsFormOnFailureFlyout.addButtonLabel": "添加",
     "xpack.ingestPipelines.settingsFormOnFailureFlyout.cancelButtonLabel": "取消",
+    "xpack.ingestPipelines.settingsFormOnFailureFlyout.updateButtonLabel": "更新",
     "xpack.ingestPipelines.tabs.outputTabTitle": "输出",
     "xpack.ingestPipelines.testPipelineFlyout.documentsForm.documentsFieldLabel": "文档",
     "xpack.ingestPipelines.testPipelineFlyout.documentsForm.documentsJsonError": "文档 JSON 无效。",
@@ -9805,7 +9561,6 @@
     "xpack.lens.configure.editConfig": "编辑配置",
     "xpack.lens.configure.emptyConfig": "将字段拖放到此处",
     "xpack.lens.dataPanelWrapper.switchDatasource": "切换到数据源",
-    "xpack.lens.datatable.columns": "字段",
     "xpack.lens.datatable.conjunctionSign": " &amp; ",
     "xpack.lens.datatable.expressionHelpLabel": "数据表呈现器",
     "xpack.lens.datatable.label": "数据表",
@@ -9851,6 +9606,7 @@
     "xpack.lens.functions.renameColumns.idMap.help": "旧列 ID 为键且相应新列 ID 为值的 JSON 编码对象。所有其他列 ID 都将保留。",
     "xpack.lens.includeValueButtonAriaLabel": "包括 {value}",
     "xpack.lens.includeValueButtonTooltip": "包括值",
+    "xpack.lens.indexPattern.allFieldsLabel": "所有字段",
     "xpack.lens.indexPattern.availableFieldsLabel": "可用字段",
     "xpack.lens.indexPattern.avg": "平均值",
     "xpack.lens.indexPattern.avgOf": "{name} 的平均值",
@@ -9878,6 +9634,8 @@
     "xpack.lens.indexPattern.defaultFormatLabel": "默认值",
     "xpack.lens.indexPattern.emptyFieldsLabel": "空字段",
     "xpack.lens.indexpattern.emptyTextColumnValue": "（空）",
+    "xpack.lens.indexPattern.existenceErrorAriaLabel": "现有内容提取失败",
+    "xpack.lens.indexPattern.existenceErrorLabel": "无法加载字段信息",
     "xpack.lens.indexPattern.fieldDistributionLabel": "分布",
     "xpack.lens.indexPattern.fieldItemTooltip": "拖放以可视化。",
     "xpack.lens.indexPattern.fieldlessOperationLabel": "要使用此函数，请选择字段。",
@@ -9886,6 +9644,7 @@
     "xpack.lens.indexPattern.fieldStatsButtonLabel": "单击以进行字段预览，或拖放以进行可视化。",
     "xpack.lens.indexPattern.fieldStatsCountLabel": "计数",
     "xpack.lens.indexPattern.fieldStatsDisplayToggle": "切换",
+    "xpack.lens.indexPattern.fieldStatsNoData": "没有可显示的数据",
     "xpack.lens.indexPattern.fieldTimeDistributionLabel": "时间分布",
     "xpack.lens.indexPattern.fieldTopValuesLabel": "排名最前值",
     "xpack.lens.indexPattern.groupByDropdown": "分组依据",
@@ -10192,7 +9951,7 @@
     "xpack.maps.aggs.defaultCountLabel": "计数",
     "xpack.maps.appTitle": "Maps",
     "xpack.maps.blendedVectorLayer.clusteredLayerName": "集群 {displayName}",
-    "xpack.maps.breadCrumbs.unsavedChangesWarning": "可能不会保存您未保存的更改",
+    "xpack.maps.breadCrumbs.unsavedChangesWarning": "您的地图中包含未保存的更改。是否确定要离开？",
     "xpack.maps.choropleth.boundaries.elasticsearch": "Elasticsearch 的点、线和多边形",
     "xpack.maps.choropleth.boundaries.ems": "来自 Elastic Maps Service 的管理边界",
     "xpack.maps.choropleth.boundariesLabel": "边界源",
@@ -10521,12 +10280,12 @@
     "xpack.maps.source.kbnTMSDescription": "在 kibana.yml 中配置的地图磁贴",
     "xpack.maps.source.kbnTMSTitle": "定制磁贴地图服务",
     "xpack.maps.source.mapSettingsPanel.initialLocationLabel": "初始地图位置",
-    "xpack.maps.source.MVTSingleLayerVectorSource.sourceTitle": ".pbf 矢量磁贴",
+    "xpack.maps.source.MVTSingleLayerVectorSource.sourceTitle": "矢量磁贴",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.dataZoomRangeMessage": "缩放",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.fieldsMessage": "字段",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.fieldsPostHelpMessage": "这可以用于工具提示和动态样式。",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.fieldsPreHelpMessage": "可用的字段，于 ",
-    "xpack.maps.source.MVTSingleLayerVectorSourceEditor.layerNameMessage": "磁帖图层",
+    "xpack.maps.source.MVTSingleLayerVectorSourceEditor.layerNameMessage": "源图层",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.urlHelpMessage": ".mvt 矢量磁帖服务的 URL。例如 {url}",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.urlMessage": "URL",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.zoomRangeHelpMessage": "磁帖中存在该图层的缩放级别。这不直接对应于可见性。较低级别的图层数据始终可以显示在较高缩放级别（反之却不然）。",
@@ -10663,7 +10422,9 @@
     "xpack.maps.visTypeAlias.legacyMapVizWarning": "使用 Maps 应用而非坐标地图和区域地图。\nMaps 应用提供更多的功能并更加易用。",
     "xpack.maps.visTypeAlias.title": "Maps",
     "xpack.maps.xyztmssource.attributionLink": "属性文本必须附带链接",
+    "xpack.maps.xyztmssource.attributionLinkLabel": "属性链接",
     "xpack.maps.xyztmssource.attributionText": "属性 url 必须附带文本",
+    "xpack.maps.xyztmssource.attributionTextLabel": "属性文本",
     "xpack.ml.accessDenied.description": "您无权访问 ML 插件",
     "xpack.ml.accessDenied.label": "权限不足",
     "xpack.ml.accessDeniedLabel": "访问被拒绝",
@@ -10939,7 +10700,7 @@
     "xpack.ml.dataframe.analytics.create.calloutMessage": "加载分析字段的其他数据。",
     "xpack.ml.dataframe.analytics.create.calloutTitle": "分析字段不可用",
     "xpack.ml.dataframe.analytics.create.chooseSourceTitle": "选择源索引模式",
-    "xpack.ml.dataframe.analytics.create.classificationHelpText": "分类作业需要映射为表状数据结构的源索引，并支持数值、布尔、文本、关键字或 IP 字段。使用高级编辑器来应用定制选项，如预测字段名称。",
+    "xpack.ml.dataframe.analytics.create.classificationHelpText": "分类用于预测数据集中的数据点的标签。",
     "xpack.ml.dataframe.analytics.create.computeFeatureInfluenceFalseValue": "False",
     "xpack.ml.dataframe.analytics.create.computeFeatureInfluenceLabel": "计算功能影响",
     "xpack.ml.dataframe.analytics.create.computeFeatureInfluenceLabelHelpText": "指定是否启用功能影响计算。默认为 true。",
@@ -10988,6 +10749,7 @@
     "xpack.ml.dataframe.analytics.create.detailsDetails.editButtonText": "编辑",
     "xpack.ml.dataframe.analytics.create.duplicateIndexPatternErrorMessage": "创建 Kibana 索引模式时发生错误：",
     "xpack.ml.dataframe.analytics.create.duplicateIndexPatternErrorMessageError": "索引模式 {indexPatternName} 已存在。",
+    "xpack.ml.dataframe.analytics.create.errorCheckingIndexExists": "获取现有索引名称时发生以下错误：{error}",
     "xpack.ml.dataframe.analytics.create.errorCreatingDataFrameAnalyticsJob": "创建数据帧分析作业时发生错误：",
     "xpack.ml.dataframe.analytics.create.errorGettingDataFrameAnalyticsList": "获取现有数据帧分析作业 ID 时发生错误：",
     "xpack.ml.dataframe.analytics.create.errorGettingIndexPatternTitles": "获取现有索引模式标题时发生错误：",
@@ -11048,11 +10810,11 @@
     "xpack.ml.dataframe.analytics.create.numTopFeatureImportanceValuesHelpText": "指定要返回的每文档功能重要性值最大数目。",
     "xpack.ml.dataframe.analytics.create.numTopFeatureImportanceValuesInputAriaLabel": "每文档功能重要性值最大数目。",
     "xpack.ml.dataframe.analytics.create.numTopFeatureImportanceValuesLabel": "功能重要性值",
-    "xpack.ml.dataframe.analytics.create.outlierDetectionHelpText": "离群值检测作业需要映射为表状数据结构的源索引，并仅分析数值和布尔值字段。使用高级编辑器将定制选项添加到配置。",
+    "xpack.ml.dataframe.analytics.create.outlierDetectionHelpText": "异常值检测用于识别数据集中的异常数据点。",
     "xpack.ml.dataframe.analytics.create.outlierFractionHelpText": "设置在离群值检测之前被假设为离群的数据集比例。",
     "xpack.ml.dataframe.analytics.create.outlierFractionInputAriaLabel": "设置在离群值检测之前被假设为离群的数据集比例。",
     "xpack.ml.dataframe.analytics.create.outlierFractionLabel": "离群值比例",
-    "xpack.ml.dataframe.analytics.create.outlierRegressionHelpText": "回归作业仅分析数值字段。使用高级编辑器来应用定制选项，如预测字段名称。",
+    "xpack.ml.dataframe.analytics.create.outlierRegressionHelpText": "回归用于预测数据集中的数值。",
     "xpack.ml.dataframe.analytics.create.predictionFieldNameHelpText": "定义结果中预测字段的名称。默认为 <dependent_variable>_prediction。",
     "xpack.ml.dataframe.analytics.create.predictionFieldNameLabel": "预测字段名称",
     "xpack.ml.dataframe.analytics.create.randomizeSeedInputAriaLabel": "用于选取哪个文档用于训练的随机生成器种子",
@@ -11131,6 +10893,7 @@
     "xpack.ml.dataframe.analytics.regressionExploration.trainingErrorTitle": "训练误差",
     "xpack.ml.dataframe.analytics.regressionExploration.trainingFilterText": ".筛留测试数据。",
     "xpack.ml.dataframe.analyticsList.analyticsDetails.tabs.analyticsMessagesLabel": "作业消息",
+    "xpack.ml.dataframe.analyticsList.cloneActionPermissionTooltip": "您无权克隆分析作业。",
     "xpack.ml.dataframe.analyticsList.completeBatchAnalyticsToolTip": "{analyticsId} 为已完成的分析作业，无法重新启动。",
     "xpack.ml.dataframe.analyticsList.createDataFrameAnalyticsButton": "创建作业",
     "xpack.ml.dataframe.analyticsList.deleteActionDisabledToolTipContent": "停止数据帧分析作业，以便将其删除。",
@@ -11142,7 +10905,6 @@
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexPatternSuccessMessage": "删除索引模式 {destinationIndex} 的请求已确认。",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexSuccessMessage": "删除目标索引 {destinationIndex} 的请求已确认。",
     "xpack.ml.dataframe.analyticsList.deleteDestinationIndexTitle": "删除目标索引 {indexName}",
-    "xpack.ml.dataframe.analyticsList.deleteModalBody": "是否确定要删除此分析作业？",
     "xpack.ml.dataframe.analyticsList.deleteModalCancelButton": "取消",
     "xpack.ml.dataframe.analyticsList.deleteModalDeleteButton": "删除",
     "xpack.ml.dataframe.analyticsList.deleteModalTitle": "删除 {analyticsId}",
@@ -11202,7 +10964,11 @@
     "xpack.ml.dataframe.analyticsList.title": "数据帧分析作业",
     "xpack.ml.dataframe.analyticsList.type": "类型",
     "xpack.ml.dataframe.analyticsList.typeFilter": "类型",
+    "xpack.ml.dataframe.analyticsList.viewActionJobFailedToolTipContent": "数据帧分析作业失败。没有可用的结果页面。",
+    "xpack.ml.dataframe.analyticsList.viewActionJobNotFinishedToolTipContent": "未完成数据帧分析作业。没有可用的结果页面。",
+    "xpack.ml.dataframe.analyticsList.viewActionJobNotStartedToolTipContent": "数据帧分析作业尚未启动。没有可用的结果页面。",
     "xpack.ml.dataframe.analyticsList.viewActionName": "查看",
+    "xpack.ml.dataframe.analyticsList.viewActionUnknownJobTypeToolTipContent": "没有可用于此类型数据帧分析作业的结果页面。",
     "xpack.ml.dataframe.stepCreateForm.createDataFrameAnalyticsSuccessMessage": "数据帧分析 {jobId} 创建请求已确认。",
     "xpack.ml.dataframe.stepDetailsForm.destinationIndexInvalidErrorLink": "详细了解索引名称限制。",
     "xpack.ml.dataFrameAnalyticsBreadcrumbs.dataFrameExplorationLabel": "探查",
@@ -11281,6 +11047,8 @@
     "xpack.ml.explorer.addToDashboard.selectDashboardsLabel": "选择仪表板：",
     "xpack.ml.explorer.addToDashboard.selectSwimlanesLabel": "选择泳道视图：",
     "xpack.ml.explorer.addToDashboardLabel": "添加到仪表板",
+    "xpack.ml.explorer.annotationsErrorCallOutTitle": "加载注释时发生错误：",
+    "xpack.ml.explorer.annotationsErrorTitle": "注释",
     "xpack.ml.explorer.annotationsTitle": "标注 {badge}",
     "xpack.ml.explorer.annotationsTitleTotalCount": "总计：{count}",
     "xpack.ml.explorer.anomaliesTitle": "异常",
@@ -11410,7 +11178,7 @@
     "xpack.ml.fileDatavisualizer.analysisSummary.timeFormatTitle": "时间 {timestampFormats, plural, zero {格式} one {format} 其他 {formats}}",
     "xpack.ml.fileDatavisualizer.bottomBar.backButtonLabel": "上一步",
     "xpack.ml.fileDatavisualizer.bottomBar.cancelButtonLabel": "取消",
-    "xpack.ml.fileDatavisualizer.bottomBar.missingImportPrivilegesMessage": "您没有所需的权限，无法导入数据",
+    "xpack.ml.fileDatavisualizer.bottomBar.missingImportPrivilegesMessage": "您需要具有 ingest_admin 角色才能启用数据导入",
     "xpack.ml.fileDatavisualizer.bottomBar.readMode.cancelButtonLabel": "取消",
     "xpack.ml.fileDatavisualizer.bottomBar.readMode.importButtonLabel": "导入",
     "xpack.ml.fileDatavisualizer.editFlyout.applyOverrideSettingsButtonLabel": "应用",
@@ -11638,7 +11406,6 @@
     "xpack.ml.jobsList.deleteJobModal.cancelButtonLabel": "取消",
     "xpack.ml.jobsList.deleteJobModal.closeButtonLabel": "关闭",
     "xpack.ml.jobsList.deleteJobModal.deleteButtonLabel": "删除",
-    "xpack.ml.jobsList.deleteJobModal.deleteJobsDescription": "是否确定要删除{jobsCount, plural, one {此作业} other {这些作业}}？",
     "xpack.ml.jobsList.deleteJobModal.deleteJobsTitle": "删除 {jobsCount, plural, one {{jobId}} other {# 个作业}}",
     "xpack.ml.jobsList.deleteJobModal.deleteMultipleJobsDescription": "删除{jobsCount, plural, one {一个作业} other {多个作业}}会非常耗时。将在后台删除{jobsCount, plural, one {该作业} other {这些作业}}，但删除的作业可能不会立即从作业列表中消失",
     "xpack.ml.jobsList.deleteJobModal.deletingJobsStatusLabel": "正在删除作业",
@@ -11928,6 +11695,7 @@
     "xpack.ml.navMenu.overviewTabLinkText": "概览",
     "xpack.ml.navMenu.settingsTabLinkText": "设置",
     "xpack.ml.newJob.page.createJob": "创建作业",
+    "xpack.ml.newJob.page.createJob.indexPatternTitle": "使用索引模式 {index}",
     "xpack.ml.newJob.recognize.advancedLabel": "高级",
     "xpack.ml.newJob.recognize.advancedSettingsAriaLabel": "高级设置",
     "xpack.ml.newJob.recognize.alreadyExistsLabel": "（已存在）",
@@ -12307,7 +12075,6 @@
     "xpack.ml.ruleEditor.deleteJobRule.ruleNoLongerExistsErrorMessage": "作业 {jobId} 中不再存在检测工具索引 {detectorIndex} 的规则",
     "xpack.ml.ruleEditor.deleteRuleModal.cancelButtonLabel": "取消",
     "xpack.ml.ruleEditor.deleteRuleModal.deleteButtonLabel": "删除",
-    "xpack.ml.ruleEditor.deleteRuleModal.deleteRuleDescription": "是否确定要删除此规则？",
     "xpack.ml.ruleEditor.deleteRuleModal.deleteRuleLinkText": "删除规则",
     "xpack.ml.ruleEditor.deleteRuleModal.deleteRuleTitle": "删除规则",
     "xpack.ml.ruleEditor.detectorDescriptionList.detectorTitle": "检测工具",
@@ -12401,7 +12168,6 @@
     "xpack.ml.settings.filterLists.deleteFilterListModal.cancelButtonLabel": "取消",
     "xpack.ml.settings.filterLists.deleteFilterListModal.confirmButtonLabel": "删除",
     "xpack.ml.settings.filterLists.deleteFilterListModal.deleteButtonLabel": "删除",
-    "xpack.ml.settings.filterLists.deleteFilterListModal.deleteWarningMessage": "是否确定要删除{selectedFilterListsLength, plural, one {此筛选列表} other {这些筛选列表}}",
     "xpack.ml.settings.filterLists.deleteFilterListModal.modalTitle": "删除 {selectedFilterListsLength, plural, one {{selectedFilterId}} other {# 个筛选列表}}",
     "xpack.ml.settings.filterLists.deleteFilterLists.deletingErrorMessage": "删除筛选列表 {filterListId} 时出错。{respMessage}",
     "xpack.ml.settings.filterLists.deleteFilterLists.deletingNotificationMessage": "正在删除 {filterListsToDeleteLength, plural, one {{filterListToDeleteId}} other {# 个筛选列表}}",
@@ -12471,6 +12237,8 @@
     "xpack.ml.timeSeriesExplorer.annotationFlyout.maxLengthError": "超过最大长度 ({maxChars} 个字符) {charsOver, number} {charsOver, plural, one {个字符} other {}}",
     "xpack.ml.timeSeriesExplorer.annotationFlyout.noAnnotationTextError": "输入注释文本",
     "xpack.ml.timeSeriesExplorer.annotationFlyout.updateButtonLabel": "更新",
+    "xpack.ml.timeSeriesExplorer.annotationsErrorCallOutTitle": "加载注释时发生错误：",
+    "xpack.ml.timeSeriesExplorer.annotationsErrorTitle": "注释",
     "xpack.ml.timeSeriesExplorer.annotationsLabel": "注释",
     "xpack.ml.timeSeriesExplorer.annotationsTitle": "标注 {badge}",
     "xpack.ml.timeSeriesExplorer.anomaliesTitle": "异常",
@@ -12725,6 +12493,7 @@
     "xpack.monitoring.alerts.nodesChanged.resolved.internalShortMessage": "已为 {clusterName} 解决 Elasticsearch 节点已更改告警。",
     "xpack.monitoring.alerts.nodesChanged.shortAction": "确认您已添加、移除或重新启动节点。",
     "xpack.monitoring.alerts.nodesChanged.ui.addedFiringMessage": "Elasticsearch 节点“{added}”已添加到此集群。",
+    "xpack.monitoring.alerts.nodesChanged.ui.nothingDetectedFiringMessage": "Elasticsearch 节点已更改",
     "xpack.monitoring.alerts.nodesChanged.ui.removedFiringMessage": "Elasticsearch 节点“{removed}”已从此集群中移除。",
     "xpack.monitoring.alerts.nodesChanged.ui.resolvedMessage": "此集群的 Elasticsearch 节点中没有更改。",
     "xpack.monitoring.alerts.nodesChanged.ui.restartedFiringMessage": "此集群中 Elasticsearch 节点“{restarted}”已重新启动。",
@@ -13006,6 +12775,7 @@
     "xpack.monitoring.elasticsearch.node.advanced.routeTitle": "Elasticsearch - 节点 - {nodeSummaryName} - 高级",
     "xpack.monitoring.elasticsearch.node.overview.routeTitle": "Elasticsearch - 节点 - {nodeName} - 概览",
     "xpack.monitoring.elasticsearch.node.statusIconLabel": "状态：{status}",
+    "xpack.monitoring.elasticsearch.nodeDetailStatus.alerts": "告警",
     "xpack.monitoring.elasticsearch.nodeDetailStatus.dataLabel": "数据",
     "xpack.monitoring.elasticsearch.nodeDetailStatus.documentsLabel": "文档",
     "xpack.monitoring.elasticsearch.nodeDetailStatus.freeDiskSpaceLabel": "可用磁盘空间",
@@ -13108,6 +12878,9 @@
     "xpack.monitoring.febLabel": "二月",
     "xpack.monitoring.formatNumbers.notAvailableLabel": "不适用",
     "xpack.monitoring.friLabel": "周五",
+    "xpack.monitoring.healthCheck.encryptionErrorAction": "了解操作方法。",
+    "xpack.monitoring.healthCheck.tlsAndEncryptionError": "必须在 Kibana 与 Elasticsearch 之间启用传输层安全， \n              并在 kibana.yml 文件中配置加密密钥，才能使用 Alerting 功能。",
+    "xpack.monitoring.healthCheck.tlsAndEncryptionErrorTitle": "需要其他设置",
     "xpack.monitoring.janLabel": "一月",
     "xpack.monitoring.julLabel": "七月",
     "xpack.monitoring.junLabel": "六月",
@@ -13970,7 +13743,7 @@
     "xpack.observability.emptySection.apps.logs.link": "安装 Filebeat",
     "xpack.observability.emptySection.apps.logs.title": "日志",
     "xpack.observability.emptySection.apps.metrics.description": "分析您的基础设施、应用和服务的指标。发现趋势、预测行为、接收异常告警等等。",
-    "xpack.observability.emptySection.apps.metrics.link": "安装指标模块",
+    "xpack.observability.emptySection.apps.metrics.link": "安装 Metricbeat",
     "xpack.observability.emptySection.apps.metrics.title": "指标",
     "xpack.observability.emptySection.apps.uptime.description": "主动监测站点和服务的可用性。接收告警并更快地解决问题，从而优化用户体验。",
     "xpack.observability.emptySection.apps.uptime.link": "安装 Heartbeat",
@@ -13982,6 +13755,10 @@
     "xpack.observability.home.sectionsubtitle": "通过根据需要将日志、指标和跟踪都置于单个堆栈上，来监测、分析和响应环境中任何位置发生的事件。",
     "xpack.observability.home.sectionTitle": "整个生态系统的统一可见性",
     "xpack.observability.home.title": "可观测性",
+    "xpack.observability.ingestManager.beta": "公测版",
+    "xpack.observability.ingestManager.button": "试用采集管理器公测版",
+    "xpack.observability.ingestManager.text": "通过 Elastic 代理，可以简单统一的方式将日志、指标和其他类型数据的监测添加到主机。不再需要安装多个 Beats 和其他代理，这简化和加快了将配置部署到整个基础设施的过程。",
+    "xpack.observability.ingestManager.title": "是否见过我们的新型采集管理器？",
     "xpack.observability.landing.breadcrumb": "入门",
     "xpack.observability.news.readFullStory": "详细了解",
     "xpack.observability.news.title": "最近的新闻",
@@ -15043,7 +14820,7 @@
     "xpack.securitySolution.add_filter_to_global_search_bar.filterOutValueHoverAction": "筛除值",
     "xpack.securitySolution.alerts.riskScoreMapping.defaultDescriptionLabel": "选择此规则生成的所有告警的风险分数。",
     "xpack.securitySolution.alerts.riskScoreMapping.defaultRiskScoreTitle": "默认风险分数",
-    "xpack.securitySolution.alerts.riskScoreMapping.mappingDescriptionLabel": "将字段从源事件（刻度值 1-100）映射到风险分数。",
+    "xpack.securitySolution.alerts.riskScoreMapping.mappingDescriptionLabel": "使用源事件值覆盖默认风险分数。",
     "xpack.securitySolution.alerts.riskScoreMapping.mappingDetailsLabel": "如果值超出范围，或字段不存在，将使用默认风险分数。",
     "xpack.securitySolution.alerts.riskScoreMapping.riskScoreFieldTitle": "signal.rule.risk_score",
     "xpack.securitySolution.alerts.riskScoreMapping.riskScoreMappingTitle": "风险分数覆盖",
@@ -15051,7 +14828,7 @@
     "xpack.securitySolution.alerts.riskScoreMapping.sourceFieldTitle": "源字段",
     "xpack.securitySolution.alerts.severityMapping.defaultDescriptionLabel": "选择此规则生成的所有告警的严重性级别。",
     "xpack.securitySolution.alerts.severityMapping.defaultSeverityTitle": "严重性",
-    "xpack.securitySolution.alerts.severityMapping.mappingDescriptionLabel": "将值从源事件映射到特定严重性。",
+    "xpack.securitySolution.alerts.severityMapping.mappingDescriptionLabel": "使用源事件值覆盖默认严重性。",
     "xpack.securitySolution.alerts.severityMapping.mappingDetailsLabel": "对于多匹配，最高严重性匹配将适用。如果未找到匹配，将使用默认严重性。",
     "xpack.securitySolution.alerts.severityMapping.severityMappingTitle": "严重性覆盖",
     "xpack.securitySolution.alerts.severityMapping.severityTitle": "默认严重性",
@@ -15384,11 +15161,11 @@
     "xpack.securitySolution.case.connectors.resilient.actionTypeTitle": "IBM Resilient",
     "xpack.securitySolution.case.connectors.resilient.apiKeyId": "API 密钥 ID",
     "xpack.securitySolution.case.connectors.resilient.apiKeySecret": "API 密钥密码",
-    "xpack.securitySolution.case.connectors.resilient.orgId": "组织 Id",
+    "xpack.securitySolution.case.connectors.resilient.orgId": "组织 ID",
     "xpack.securitySolution.case.connectors.resilient.requiredApiKeyIdTextField": "“API 密钥 ID”必填",
     "xpack.securitySolution.case.connectors.resilient.requiredApiKeySecretTextField": "“API 密钥密码”必填",
-    "xpack.securitySolution.case.connectors.resilient.requiredOrgIdTextField": "组织 Id",
-    "xpack.securitySolution.case.connectors.resilient.selectMessageText": "将 SIEM 案例数据推送或更新到 Resilient 中的新问题",
+    "xpack.securitySolution.case.connectors.resilient.requiredOrgIdTextField": "“组织 ID”必填",
+    "xpack.securitySolution.case.connectors.resilient.selectMessageText": "将 Security 案例数据推送或更新到 Resilient 中的新问题",
     "xpack.securitySolution.case.createCase.descriptionFieldRequiredError": "描述必填。",
     "xpack.securitySolution.case.createCase.fieldTagsHelpText": "为此案例键入一个或多个定制识别标记。在每个标记后按 Enter 键可开始新的标记。",
     "xpack.securitySolution.case.createCase.titleFieldRequiredError": "标题必填。",
@@ -15401,8 +15178,8 @@
     "xpack.securitySolution.chart.allOthersGroupingLabel": "所有其他",
     "xpack.securitySolution.chart.dataAllValuesZerosTitle": "所有值返回了零",
     "xpack.securitySolution.chart.dataNotAvailableTitle": "图表数据不可用",
-    "xpack.securitySolution.chrome.help.appName": "SIEM",
-    "xpack.securitySolution.chrome.helpMenu.documentation": "SIEM 文档",
+    "xpack.securitySolution.chrome.help.appName": "Security",
+    "xpack.securitySolution.chrome.helpMenu.documentation": "Security 文档",
     "xpack.securitySolution.chrome.helpMenu.documentation.ecs": "ECS 文档",
     "xpack.securitySolution.clipboard.copied": "已复制",
     "xpack.securitySolution.clipboard.copy": "复制",
@@ -15462,7 +15239,7 @@
     "xpack.securitySolution.components.mlPopup.errors.createJobFailureTitle": "创建作业失败",
     "xpack.securitySolution.components.mlPopup.errors.startJobFailureTitle": "启动作业失败",
     "xpack.securitySolution.components.mlPopup.hooks.errors.indexPatternFetchFailureTitle": "索引模式提取失败",
-    "xpack.securitySolution.components.mlPopup.hooks.errors.siemJobFetchFailureTitle": "SIEM 作业提取失败",
+    "xpack.securitySolution.components.mlPopup.hooks.errors.siemJobFetchFailureTitle": "Security 作业提取失败",
     "xpack.securitySolution.components.mlPopup.jobsTable.createCustomJobButtonLabel": "创建定制作业",
     "xpack.securitySolution.components.mlPopup.jobsTable.jobNameColumn": "作业名称",
     "xpack.securitySolution.components.mlPopup.jobsTable.noItemsDescription": "未找到任何 SIEM Machine Learning 作业",
@@ -15540,7 +15317,7 @@
     "xpack.securitySolution.dataProviders.valueAriaLabel": "值",
     "xpack.securitySolution.dataProviders.valuePlaceholder": "值",
     "xpack.securitySolution.detectionEngine.alerts.actions.addEndpointException": "添加终端例外",
-    "xpack.securitySolution.detectionEngine.alerts.actions.addException": "添加例外",
+    "xpack.securitySolution.detectionEngine.alerts.actions.addException": "添加规则例外",
     "xpack.securitySolution.detectionEngine.alerts.actions.closeAlertTitle": "关闭告警",
     "xpack.securitySolution.detectionEngine.alerts.actions.inProgressAlertTitle": "标记为进行中",
     "xpack.securitySolution.detectionEngine.alerts.actions.investigateInTimelineTitle": "在时间线中调查",
@@ -15587,7 +15364,7 @@
     "xpack.securitySolution.detectionEngine.alerts.utilityBar.selectedAlertsTitle": "已选择 {selectedAlertsFormatted} 个{selectedAlerts, plural, =1 {告警} other {告警}}",
     "xpack.securitySolution.detectionEngine.alerts.utilityBar.showingAlertsTitle": "正在显示 {totalAlertsFormatted} 个{totalAlerts, plural, =1 {告警} other {告警}}",
     "xpack.securitySolution.detectionEngine.alerts.utilityBar.takeActionTitle": "采取操作",
-    "xpack.securitySolution.detectionEngine.alertTitle": "外部告警",
+    "xpack.securitySolution.detectionEngine.alertTitle": "检测告警",
     "xpack.securitySolution.detectionEngine.buttonManageRules": "管理检测规则",
     "xpack.securitySolution.detectionEngine.components.importRuleModal.cancelTitle": "取消",
     "xpack.securitySolution.detectionEngine.components.importRuleModal.importFailedDetailedTitle": "规则 ID：{ruleId}\n 状态代码：{statusCode}\n 消息：{message}",
@@ -15610,7 +15387,7 @@
     "xpack.securitySolution.detectionEngine.createRule.savedIdLabel": "已保存查询名称",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.descriptionFieldRequiredError": "描述必填。",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fiedIndexPatternsLabel": "索引模式",
-    "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAssociatedToEndpointListLabel": "将规则关联到全局终端异常列表",
+    "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAssociatedToEndpointListLabel": "将现有的终端例外添加到规则",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAuthorHelpText": "为此规则键入一个或多个作者。键入每个作者后按 Enter 键以添加新作者。",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAuthorLabel": "作者",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldBuildingBlockLabel": "将所有生成的告警标记为“构建块”告警",
@@ -15632,7 +15409,7 @@
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTimelineTemplateLabel": "时间线模板",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTimestampOverrideHelpText": "选择执行规则时使用的时间戳字段。选取时间戳最接近于采集时间的字段（例如 event.ingested）。",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTimestampOverrideLabel": "时间戳覆盖",
-    "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.guideHelpText": "为执行信号调查的分析师提供有用信息。此指南将显示在规则详情页面上以及从此规则所生成的告警创建的时间线中。",
+    "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.guideHelpText": "为正在调查检测告警的分析人员提供有用的信息。本指南（作为备注）将显示在规则详情页面上以及从此规则所生成的检测告警创建的时间线中。",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.guideLabel": "调查指南",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRule.nameFieldRequiredError": "名称必填。",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutrule.noteHelpText": "添加规则调查指南......",
@@ -15640,7 +15417,7 @@
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.addReferenceDescription": "添加引用 URL",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.advancedSettingsButton": "高级设置",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.buildingBlockLabel": "构建块",
-    "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.endpointExceptionListLabel": "全局终端异常列表",
+    "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.endpointExceptionListLabel": "Elastic 终端例外",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.severityOptionCriticalDescription": "紧急",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.severityOptionHighDescription": "高",
     "xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.severityOptionLowDescription": "低",
@@ -15658,7 +15435,7 @@
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesCustomDescription": "提供定制的索引列表",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesFromConfigDescription": "使用 Security Solution 高级设置中的 Elasticsearch 索引",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesHelperDescription": "输入要运行此规则的 Elasticsearch 索引的模式。默认情况下，将包括 Security Solution 高级设置中定义的索引模式。",
-    "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdHelpText": "我们提供若干帮助您入门的常规作业。要添加自己的定制规则，请在 {machineLearning} 应用程序中将一组“siem”分配给这些作业，以使它们显示在此处。",
+    "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdHelpText": "我们提供了一些常见作业来帮助您入门。要添加自己的定制规则，请在 {machineLearning} 应用程序中将一组“security”分配给这些作业，以使其显示在此处。",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdRequired": "Machine Learning 作业必填。",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.mlEnableJobWarningTitle": "此 ML 作业当前未运行。在激活此规则之前请通过“ML 作业设置”设置此作业以使其运行。",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.mlJobSelectPlaceholderText": "选择作业",
@@ -15691,6 +15468,7 @@
     "xpack.securitySolution.detectionEngine.details.stepAboutRule.aboutText": "关于",
     "xpack.securitySolution.detectionEngine.details.stepAboutRule.detailsLabel": "详情",
     "xpack.securitySolution.detectionEngine.details.stepAboutRule.investigationGuideLabel": "调查指南",
+    "xpack.securitySolution.detectionEngine.detectionsBreadcrumbTitle": "检测",
     "xpack.securitySolution.detectionEngine.detectionsPageTitle": "检测告警",
     "xpack.securitySolution.detectionEngine.dismissButton": "关闭",
     "xpack.securitySolution.detectionEngine.dismissNoApiIntegrationKeyButton": "关闭",
@@ -15700,6 +15478,7 @@
     "xpack.securitySolution.detectionEngine.editRule.errorMsgDescription": "抱歉",
     "xpack.securitySolution.detectionEngine.editRule.pageTitle": "编辑规则设置",
     "xpack.securitySolution.detectionEngine.editRule.saveChangeTitle": "保存更改",
+    "xpack.securitySolution.detectionEngine.emptyActionBeats": "查看设置说明",
     "xpack.securitySolution.detectionEngine.emptyActionSecondary": "前往文档",
     "xpack.securitySolution.detectionEngine.emptyTitle": "似乎在 Security 应用程序中没有与检测引擎相关的索引",
     "xpack.securitySolution.detectionEngine.goToDocumentationButton": "查看文档",
@@ -15991,6 +15770,10 @@
     "xpack.securitySolution.detectionEngine.mitreAttackTechniques.xslScriptProcessingDescription": "XSL Script Processing (T1220)",
     "xpack.securitySolution.detectionEngine.mlRulesDisabledMessageTitle": "ML 规则需要白金级许可证以及 ML 管理员权限",
     "xpack.securitySolution.detectionEngine.mlUnavailableTitle": "{totalRules} 个{totalRules, plural, =1 {规则需要} other {规则需要}}启用 Machine Learning。",
+    "xpack.securitySolution.detectionEngine.needsIndexPermissionsMessage": "要使用检测引擎，具有所需集群和索引权限的用户必须首先访问此页面。{additionalContext}如欲获得更多帮助，请联系 Elastic Stack 管理员。",
+    "xpack.securitySolution.detectionEngine.needsListsIndexesMessage": "您需要具有列表索引的权限。",
+    "xpack.securitySolution.detectionEngine.needsSignalsAndListsIndexesMessage": "您需要具有信号索引和列表索引的权限。",
+    "xpack.securitySolution.detectionEngine.needsSignalsIndexMessage": "您需要具有信号索引的权限。",
     "xpack.securitySolution.detectionEngine.noApiIntegrationKeyCallOutMsg": "每次启动 Kibana，都会为已保存对象生成新的加密密钥。没有持久性密钥，在 Kibana 重新启动后，将无法删除或修改规则。要设置持久性密钥，请将文本值为 32 个或更多任意字符的 xpack.encryptedSavedObjects.encryptionKey 设置添加到 kibana.yml 文件。",
     "xpack.securitySolution.detectionEngine.noApiIntegrationKeyCallOutTitle": "需要 API 集成密钥",
     "xpack.securitySolution.detectionEngine.noIndexTitle": "让我们来设置您的检测引擎",
@@ -16082,9 +15865,9 @@
     "xpack.securitySolution.detectionEngine.rules.optionalFieldDescription": "可选",
     "xpack.securitySolution.detectionEngine.rules.pageTitle": "检测规则",
     "xpack.securitySolution.detectionEngine.rules.prePackagedRules.createOwnRuletButton": "创建自己的规则",
-    "xpack.securitySolution.detectionEngine.rules.prePackagedRules.emptyPromptMessage": "Elastic Security 提供预构建检测规则，它们运行在后台并在条件满足时创建告警。默认情况下，所有预构建规则处于禁用状态，请选择您要激活的规则。",
+    "xpack.securitySolution.detectionEngine.rules.prePackagedRules.emptyPromptMessage": "Elastic Security 附带预置检测规则，这些规则在后台运行，并在条件满足时创建告警。默认情况下，除 Elastic Endpoint Security 规则外，所有预置规则都处于禁用状态。您可以选择其他要激活的规则。",
     "xpack.securitySolution.detectionEngine.rules.prePackagedRules.emptyPromptTitle": "加载 Elastic 预构建检测规则",
-    "xpack.securitySolution.detectionEngine.rules.prePackagedRules.loadPreBuiltButton": "加载预构建检测规则",
+    "xpack.securitySolution.detectionEngine.rules.prePackagedRules.loadPreBuiltButton": "加载预置检测规则和时间线模板",
     "xpack.securitySolution.detectionEngine.rules.releaseNotesHelp": "发行说明",
     "xpack.securitySolution.detectionEngine.rules.reloadMissingPrePackagedRulesAndTimelinesButton": "安装 {missingRules} 个 Elastic 预构建{missingRules, plural, =1 {规则} other {规则}}以及 {missingTimelines} 个 Elastic 预构建{missingTimelines, plural, =1 {时间线} other {时间线}} ",
     "xpack.securitySolution.detectionEngine.rules.reloadMissingPrePackagedRulesButton": "安装 {missingRules} 个 Elastic 预构建{missingRules, plural, =1 {规则} other {规则}} ",
@@ -16113,6 +15896,7 @@
     "xpack.securitySolution.detectionEngine.totalSignalTitle": "合计",
     "xpack.securitySolution.detectionEngine.userUnauthenticatedMsgBody": "您没有所需的权限，无法查看检测引擎。若需要更多帮助，请联系您的管理员。",
     "xpack.securitySolution.detectionEngine.userUnauthenticatedTitle": "需要检测引擎权限",
+    "xpack.securitySolution.detectionEngine.validations.thresholdValueFieldData.numberGreaterThanOrEqualOneErrorMessage": "值必须大于或等于 1。",
     "xpack.securitySolution.dragAndDrop.addToTimeline": "添加到时间线调查",
     "xpack.securitySolution.dragAndDrop.closeButtonLabel": "关闭",
     "xpack.securitySolution.dragAndDrop.copyToClipboardTooltip": "复制到剪贴板",
@@ -16136,70 +15920,13 @@
     "xpack.securitySolution.editDataProvider.valuePlaceholder": "值",
     "xpack.securitySolution.emptyMessage": "Elastic Security 将免费且开放的 Elastic SIEM 和 Elastic Endpoint Security 整合在一起，从而防御、检测并响应威胁。首先，您需要将安全解决方案相关数据添加到 Elastic Stack。有关更多信息，请查看我们的 ",
     "xpack.securitySolution.emptyString.emptyStringDescription": "空字符串",
-    "xpack.securitySolution.endpoint.details.endpointVersion": "Endpoint 版本",
-    "xpack.securitySolution.endpoint.details.errorBody": "请退出浮出控件并选择可用主机。",
-    "xpack.securitySolution.endpoint.details.errorTitle": "找不到主机",
-    "xpack.securitySolution.endpoint.details.hostname": "主机名",
-    "xpack.securitySolution.endpoint.details.ipAddress": "IP 地址",
-    "xpack.securitySolution.endpoint.details.lastSeen": "最后看到时间",
-    "xpack.securitySolution.endpoint.details.linkToIngestTitle": "重新分配策略",
-    "xpack.securitySolution.endpoint.details.os": "OS",
-    "xpack.securitySolution.endpoint.details.policy": "政策",
-    "xpack.securitySolution.endpoint.details.policyStatus": "策略状态",
-    "xpack.securitySolution.endpoint.details.policyStatusValue": "{policyStatus, select, success {成功} warning {警告} failure {失败} other {未知}}",
-    "xpack.securitySolution.endpoint.policyResponse.backLinkTitle": "终端详情",
-    "xpack.securitySolution.endpoint.policyResponse.title": "策略响应",
-    "xpack.securitySolution.endpoint.details.noPolicyResponse": "没有可用的策略响应",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_dns_events": "配置 DNS 事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_elasticsearch_connection": "配置 Elastic 搜索连接",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_file_events": "配置文件事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_imageload_events": "配置映像加载事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_kernel": "配置内核",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_logging": "配置日志记录",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_malware": "配置恶意软件",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_network_events": "配置网络事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_process_events": "配置进程事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_registry_events": "配置注册表事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.configure_security_events": "配置安全事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.connect_kernel": "连接内核",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_async_image_load_events": "检测异步映像加载事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_file_open_events": "检测文件打开事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_file_write_events": "检测文件写入事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_network_events": "检测网络事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_process_events": "检测进程事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_registry_events": "检测注册表事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.detect_sync_image_load_events": "检测同步映像加载事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.download_global_artifacts": "下载全局项目",
-    "xpack.securitySolution.endpoint.details.policyResponse.download_user_artifacts": "下面用户项目",
-    "xpack.securitySolution.endpoint.details.policyResponse.events": "事件",
-    "xpack.securitySolution.endpoint.details.policyResponse.failed": "失败",
-    "xpack.securitySolution.endpoint.details.policyResponse.load_config": "加载配置",
-    "xpack.securitySolution.endpoint.details.policyResponse.load_malware_model": "加载恶意软件模型",
-    "xpack.securitySolution.endpoint.details.policyResponse.logging": "日志",
-    "xpack.securitySolution.endpoint.details.policyResponse.malware": "恶意软件",
-    "xpack.securitySolution.endpoint.details.policyResponse.read_elasticsearch_config": "读取 ElasticSearch 配置",
-    "xpack.securitySolution.endpoint.details.policyResponse.read_events_config": "读取时间配置",
-    "xpack.securitySolution.endpoint.details.policyResponse.read_kernel_config": "读取内核配置",
-    "xpack.securitySolution.endpoint.details.policyResponse.read_logging_config": "读取日志配置",
-    "xpack.securitySolution.endpoint.details.policyResponse.read_malware_config": "读取恶意软件配置",
-    "xpack.securitySolution.endpoint.details.policyResponse.streaming": "流式传输",
-    "xpack.securitySolution.endpoint.details.policyResponse.success": "成功",
-    "xpack.securitySolution.endpoint.details.policyResponse.warning": "警告",
-    "xpack.securitySolution.endpoint.details.policyResponse.workflow": "工作流",
-    "xpack.securitySolution.endpoint.list.loadingPolicies": "正在加载政策配置",
-    "xpack.securitySolution.endpoint.list.noEndpointsInstructions": "您已创建安全策略。现在您需要按照下面的步骤在代理上启用 Elastic Endpoint Security 功能。",
-    "xpack.securitySolution.endpoint.list.noEndpointsPrompt": "在您的代理上启用 Elastic Endpoint Security",
-    "xpack.securitySolution.endpoint.list.noPolicies": "没有策略。",
-    "xpack.securitySolution.endpoint.list.stepOne": "现有策略在下面列出。之后可以对其进行更改。",
-    "xpack.securitySolution.endpoint.list.stepOneTitle": "选择要用于保护主机的策略",
-    "xpack.securitySolution.endpoint.list.stepTwo": "为了让您入门，将会为您提供必要的命令。",
-    "xpack.securitySolution.endpoint.list.stepTwoTitle": "通过采集管理器注册启用 Endpoint Security 的代理",
-    "xpack.securitySolution.endpoint.ingestManager.createPackagePolicy.endpointConfiguration": "使用此代理配置的任何代理都会使用基本策略。可以在 Security 应用中对此策略进行更改，Fleet 会将这些更改部署到代理。",
     "xpack.securitySolution.endpoint.ingestToastMessage": "采集管理器在其设置期间失败。",
     "xpack.securitySolution.endpoint.ingestToastTitle": "应用无法初始化",
-    "xpack.securitySolution.endpoint.policy.details.backToListTitle": "返回到策略列表",
+    "xpack.securitySolution.endpoint.policy.details.backToListTitle": "返回到终端主机",
     "xpack.securitySolution.endpoint.policy.details.cancel": "取消",
     "xpack.securitySolution.endpoint.policy.details.detect": "检测",
+    "xpack.securitySolution.endpoint.policy.details.detectionRulesLink": "相关检测规则",
+    "xpack.securitySolution.endpoint.policy.details.detectionRulesMessage": "请查看{detectionRulesLink}。在“检测规则”页面上，预置规则标记有“Elastic”。",
     "xpack.securitySolution.endpoint.policy.details.eventCollection": "事件收集",
     "xpack.securitySolution.endpoint.policy.details.eventCollectionsEnabled": "{selected} / {total} 事件收集已启用",
     "xpack.securitySolution.endpoint.policy.details.linux": "Linux",
@@ -16214,10 +15941,10 @@
     "xpack.securitySolution.endpoint.policy.details.updateConfirm.confirmButtonTitle": "保存并部署更改",
     "xpack.securitySolution.endpoint.policy.details.updateConfirm.message": "此操作无法撤消。是否确定要继续？",
     "xpack.securitySolution.endpoint.policy.details.updateConfirm.title": "保存并部署更改",
-    "xpack.securitySolution.endpoint.policy.details.updateConfirm.warningMessage": "保存这些更改会将更新应用到分配给此策略的所有活动终端",
+    "xpack.securitySolution.endpoint.policy.details.updateConfirm.warningMessage": "保存这些更改会将更新应用于分配到此代理配置的所有终端。",
     "xpack.securitySolution.endpoint.policy.details.updateConfirm.warningTitle": "此操作将更新 {hostCount, plural, one {# 个主机} other {# 个主机}}",
     "xpack.securitySolution.endpoint.policy.details.updateErrorTitle": "失败！",
-    "xpack.securitySolution.endpoint.policy.details.updateSuccessMessage": "策略 {name} 已更新。",
+    "xpack.securitySolution.endpoint.policy.details.updateSuccessMessage": "集成 {name} 已更新。",
     "xpack.securitySolution.endpoint.policy.details.updateSuccessTitle": "成功！",
     "xpack.securitySolution.endpoint.policy.details.windows": "Windows",
     "xpack.securitySolution.endpoint.policy.details.windowsAndMac": "Windows、Mac",
@@ -16244,7 +15971,6 @@
     "xpack.securitySolution.endpoint.policyDetailType": "类型",
     "xpack.securitySolution.endpoint.policyList.actionButtonText": "添加 Endpoint Security",
     "xpack.securitySolution.endpoint.policyList.actionMenu": "打开",
-    "xpack.securitySolution.endpoint.policyList.agentPolicyAction": "查看代理配置",
     "xpack.securitySolution.endpoint.policyList.createdAt": "创建日期",
     "xpack.securitySolution.endpoint.policyList.createdBy": "创建者",
     "xpack.securitySolution.endpoint.policyList.createNewButton": "创建新策略",
@@ -16270,6 +15996,7 @@
     "xpack.securitySolution.endpoint.policyList.revision": "修订 {revNumber}",
     "xpack.securitySolution.endpoint.policyList.updatedAt": "最后更新时间",
     "xpack.securitySolution.endpoint.policyList.updatedBy": "最后更新者",
+    "xpack.securitySolution.endpoint.policyList.versionField": "v{version}",
     "xpack.securitySolution.endpoint.policyList.versionFieldLabel": "版本",
     "xpack.securitySolution.endpoint.policyList.viewTitleTotalCount": "{totalItemCount, plural, one {# 个策略} other {# 个策略}}",
     "xpack.securitySolution.endpoint.resolver.eitherLineageLimitExceeded": "下面可视化和事件列表中的一些进程事件无法显示，因为已达到数据限制。",
@@ -16283,7 +16010,6 @@
     "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.eventDescriptiveName": "{descriptor} {subject}",
     "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.events": "事件",
     "xpack.securitySolution.endpoint.resolver.panel.processEventListByType.wait": "等候事件......",
-    "xpack.securitySolution.resolver.panel.nodeList.title": "所有进程事件",
     "xpack.securitySolution.endpoint.resolver.panel.relatedCounts.numberOfEventsInCrumb": "{totalCount} 个事件",
     "xpack.securitySolution.endpoint.resolver.panel.relatedDetail.missing": "找不到相关事件。",
     "xpack.securitySolution.endpoint.resolver.panel.relatedDetail.wait": "等候事件......",
@@ -16314,16 +16040,6 @@
     "xpack.securitySolution.endpoint.resolver.runningTrigger": "正在运行的触发器",
     "xpack.securitySolution.endpoint.resolver.terminatedProcess": "已终止进程",
     "xpack.securitySolution.endpoint.resolver.terminatedTrigger": "已终止触发器",
-    "xpack.securitySolution.endpoint.list.endpointVersion": "版本",
-    "xpack.securitySolution.endpoint.list.hostname": "主机名",
-    "xpack.securitySolution.endpoint.list.hostStatus": "主机状态",
-    "xpack.securitySolution.endpoint.list.hostStatusValue": "{hostStatus, select, online {联机} error {错误} other {脱机}}",
-    "xpack.securitySolution.endpoint.list.ip": "IP 地址",
-    "xpack.securitySolution.endpoint.list.lastActive": "上次活动时间",
-    "xpack.securitySolution.endpoint.list.os": "操作系统",
-    "xpack.securitySolution.endpoint.list.policy": "政策",
-    "xpack.securitySolution.endpoint.list.policyStatus": "策略状态",
-    "xpack.securitySolution.endpoint.list.totalCount": "{totalItemCount, plural, one {# 个主机} other {# 个主机}}",
     "xpack.securitySolution.endpointManagement.noPermissionsSubText": "似乎采集管理器已禁用。必须启用采集管理器，才能使用此功能。如果您无权启用采集管理器，请联系您的 Kibana 管理员。",
     "xpack.securitySolution.endpointManagemnet.noPermissionsText": "您没有所需的 Kibana 权限，无法使用 Elastic Security 管理",
     "xpack.securitySolution.enpdoint.resolver.panelutils.betaBadgeLabel": "公测版",
@@ -16381,33 +16097,48 @@
     "xpack.securitySolution.eventsViewer.footer.loadingEventsDataLabel": "正在加载事件",
     "xpack.securitySolution.eventsViewer.showingLabel": "正在显示",
     "xpack.securitySolution.eventsViewer.unit": "{totalCount, plural, =1 {事件} other {事件}}",
+    "xpack.securitySolution.exceptions.addException.addEndpointException": "添加终端例外",
     "xpack.securitySolution.exceptions.addException.addException": "添加例外",
-    "xpack.securitySolution.exceptions.addException.bulkCloseLabel": "关闭匹配此例外中的属性的所有告警",
+    "xpack.securitySolution.exceptions.addException.bulkCloseLabel": "关闭所有与此例外匹配的告警，包括其他规则所生成的告警",
     "xpack.securitySolution.exceptions.addException.bulkCloseLabel.disabled": "关闭匹配此例外中的属性的所有告警（不支持列表和非 ECS 字段）",
     "xpack.securitySolution.exceptions.addException.cancel": "取消",
-    "xpack.securitySolution.exceptions.addException.endpointQuarantineText": "在任何终端上匹配选定属性的任何隔离文件将自动还原到其原始位置",
+    "xpack.securitySolution.exceptions.addException.endpointQuarantineText": "在所有终端主机上，与该例外匹配的已隔离文件会自动还原到其原始位置。此例外适用于使用终端例外的所有规则。",
     "xpack.securitySolution.exceptions.addException.error": "添加例外失败",
     "xpack.securitySolution.exceptions.addException.fetchError": "提取例外列表时出错",
     "xpack.securitySolution.exceptions.addException.fetchError.title": "错误",
     "xpack.securitySolution.exceptions.addException.infoLabel": "满足规则的条件时生成告警，但以下情况除外：",
     "xpack.securitySolution.exceptions.addException.success": "已成功添加例外",
     "xpack.securitySolution.exceptions.andDescription": "且",
+    "xpack.securitySolution.exceptions.builder.addNestedDescription": "添加嵌套条件",
+    "xpack.securitySolution.exceptions.builder.addNonNestedDescription": "添加非嵌套条件",
+    "xpack.securitySolution.exceptions.builder.exceptionFieldNestedPlaceholderDescription": "搜索嵌套字段",
+    "xpack.securitySolution.exceptions.builder.exceptionFieldPlaceholderDescription": "搜索",
+    "xpack.securitySolution.exceptions.builder.exceptionFieldValuePlaceholderDescription": "搜索字段值......",
+    "xpack.securitySolution.exceptions.builder.exceptionListsPlaceholderDescription": "搜索列表......",
+    "xpack.securitySolution.exceptions.builder.exceptionOperatorPlaceholderDescription": "运算符",
+    "xpack.securitySolution.exceptions.builder.fieldDescription": "字段",
+    "xpack.securitySolution.exceptions.builder.operatorDescription": "运算符",
+    "xpack.securitySolution.exceptions.builder.valueDescription": "值",
     "xpack.securitySolution.exceptions.commentEventLabel": "已添加注释",
     "xpack.securitySolution.exceptions.commentLabel": "注释",
     "xpack.securitySolution.exceptions.createdByLabel": "创建者",
     "xpack.securitySolution.exceptions.dateCreatedLabel": "创建日期",
+    "xpack.securitySolution.exceptions.descriptionLabel": "描述",
     "xpack.securitySolution.exceptions.detectionListLabel": "检测列表",
     "xpack.securitySolution.exceptions.doesNotExistOperatorLabel": "不存在",
     "xpack.securitySolution.exceptions.editButtonLabel": "编辑",
-    "xpack.securitySolution.exceptions.editException.bulkCloseLabel": "关闭匹配此例外中的属性的所有告警",
+    "xpack.securitySolution.exceptions.editException.bulkCloseLabel": "关闭所有与此例外匹配的告警，包括其他规则所生成的告警",
     "xpack.securitySolution.exceptions.editException.bulkCloseLabel.disabled": "关闭匹配此例外中的属性的所有告警（不支持列表和非 ECS 字段）",
     "xpack.securitySolution.exceptions.editException.cancel": "取消",
+    "xpack.securitySolution.exceptions.editException.editEndpointExceptionTitle": "编辑终端例外",
     "xpack.securitySolution.exceptions.editException.editExceptionSaveButton": "保存",
     "xpack.securitySolution.exceptions.editException.editExceptionTitle": "编辑例外",
-    "xpack.securitySolution.exceptions.editException.endpointQuarantineText": "在任何终端上匹配选定属性的任何隔离文件将自动还原到其原始位置",
+    "xpack.securitySolution.exceptions.editException.endpointQuarantineText": "在所有终端主机上，与该例外匹配的已隔离文件会自动还原到其原始位置。此例外适用于使用终端例外的所有规则。",
     "xpack.securitySolution.exceptions.editException.error": "更新例外失败",
     "xpack.securitySolution.exceptions.editException.infoLabel": "满足规则的条件时生成告警，但以下情况除外：",
     "xpack.securitySolution.exceptions.editException.success": "已成功更新例外",
+    "xpack.securitySolution.exceptions.editException.versionConflictDescription": "此例外可能自您首次选择编辑后已更新。尝试单击“取消”，重新编辑该例外。",
+    "xpack.securitySolution.exceptions.editException.versionConflictTitle": "抱歉，有错误",
     "xpack.securitySolution.exceptions.endpointListLabel": "终端列表",
     "xpack.securitySolution.exceptions.exceptionsPaginationLabel": "每页项数：{items}",
     "xpack.securitySolution.exceptions.existsOperatorLabel": "存在",
@@ -16430,9 +16161,9 @@
     "xpack.securitySolution.exceptions.valueDescription": "值",
     "xpack.securitySolution.exceptions.viewer.addCommentPlaceholder": "添加新注释......",
     "xpack.securitySolution.exceptions.viewer.addExceptionLabel": "添加新例外",
-    "xpack.securitySolution.exceptions.viewer.addToClipboard": "添加到剪贴板",
-    "xpack.securitySolution.exceptions.viewer.addToDetectionsListLabel": "添加到检测列表",
-    "xpack.securitySolution.exceptions.viewer.addToEndpointListLabel": "添加到终端列表",
+    "xpack.securitySolution.exceptions.viewer.addToClipboard": "注释",
+    "xpack.securitySolution.exceptions.viewer.addToDetectionsListLabel": "添加规则例外",
+    "xpack.securitySolution.exceptions.viewer.addToEndpointListLabel": "添加终端例外",
     "xpack.securitySolution.exceptions.viewer.deleteExceptionError": "删除例外时出错",
     "xpack.securitySolution.exceptions.viewer.emptyPromptBody": "可以添加例外以微调规则，以便在满足例外条件时不创建检测告警。例外提升检测精确性，从而可以减少误报数。",
     "xpack.securitySolution.exceptions.viewer.emptyPromptTitle": "此规则没有例外",
@@ -16441,6 +16172,8 @@
     "xpack.securitySolution.exceptions.viewer.exceptionEndpointDetailsDescription": "此规则的所有例外将应用到终端和检测规则。查看{ruleSettings}以了解详情。",
     "xpack.securitySolution.exceptions.viewer.exceptionEndpointDetailsDescription.ruleSettingsLink": "规则设置",
     "xpack.securitySolution.exceptions.viewer.fetchingListError": "提取例外时出错",
+    "xpack.securitySolution.exceptions.viewer.fetchTotalsError": "获取例外项总数时出错",
+    "xpack.securitySolution.exceptions.viewer.noSearchResultsPromptBody": "找不到搜索结果。",
     "xpack.securitySolution.exceptions.viewer.searchDefaultPlaceholder": "搜索字段（例如：host.name）",
     "xpack.securitySolution.exitFullScreenButton": "退出全屏",
     "xpack.securitySolution.featureRegistry.linkSecuritySolutionTitle": "安全",
@@ -16489,11 +16222,12 @@
     "xpack.securitySolution.header.editableTitle.editButtonAria": "通过单击，可以编辑 {title}",
     "xpack.securitySolution.header.editableTitle.save": "保存",
     "xpack.securitySolution.headerGlobal.buttonAddData": "添加数据",
+    "xpack.securitySolution.headerGlobal.securitySolution": "安全解决方案",
     "xpack.securitySolution.headerPage.pageSubtitle": "上一事件：{beat}",
     "xpack.securitySolution.hooks.useAddToTimeline.addedFieldMessage": "已将 {fieldOrValue} 添加到时间线",
     "xpack.securitySolution.host.details.architectureLabel": "架构",
-    "xpack.securitySolution.host.details.endpoint.endpointPolicy": "终端策略",
-    "xpack.securitySolution.host.details.endpoint.policyStatus": "策略状态",
+    "xpack.securitySolution.host.details.endpoint.endpointPolicy": "集成",
+    "xpack.securitySolution.host.details.endpoint.policyStatus": "配置状态",
     "xpack.securitySolution.host.details.endpoint.sensorversion": "感应器版本",
     "xpack.securitySolution.host.details.firstSeenTitle": "首次看到时间",
     "xpack.securitySolution.host.details.lastSeenTitle": "最后看到时间",
@@ -16510,8 +16244,6 @@
     "xpack.securitySolution.host.details.overview.platformTitle": "平台",
     "xpack.securitySolution.host.details.overview.regionTitle": "地区",
     "xpack.securitySolution.host.details.versionLabel": "版本",
-    "xpack.securitySolution.endpoint.list.pageSubTitle": "运行 Elastic Endpoint Security 的主机",
-    "xpack.securitySolution.endpoint.list.pageTitle": "主机",
     "xpack.securitySolution.hosts.kqlPlaceholder": "例如 host.name：“foo”",
     "xpack.securitySolution.hosts.navigation.alertsTitle": "外部告警",
     "xpack.securitySolution.hosts.navigation.allHostsTitle": "所有主机",
@@ -16523,7 +16255,6 @@
     "xpack.securitySolution.hosts.navigaton.matrixHistogram.errorFetchingAuthenticationsData": "无法查询身份验证数据",
     "xpack.securitySolution.hosts.navigaton.matrixHistogram.errorFetchingEventsData": "无法查询事件数据",
     "xpack.securitySolution.hosts.pageTitle": "主机",
-    "xpack.securitySolution.endpointsTab": "主机",
     "xpack.securitySolution.hostsTable.firstLastSeenToolTip": "相对于选定日期范围",
     "xpack.securitySolution.hostsTable.hostsTitle": "所有主机",
     "xpack.securitySolution.hostsTable.lastSeenTitle": "最后看到时间",
@@ -16568,12 +16299,17 @@
     "xpack.securitySolution.lists.cancelValueListsUploadTitle": "取消上传",
     "xpack.securitySolution.lists.closeValueListsModalTitle": "关闭",
     "xpack.securitySolution.lists.detectionEngine.rules.uploadValueListsButton": "上传值列表",
-    "xpack.securitySolution.lists.uploadValueListDescription": "上传编写规则或规则例外时要使用的单值列表。",
+    "xpack.securitySolution.lists.detectionEngine.rules.uploadValueListsButtonTooltip": "在字段值与列表中找到的值匹配时，使用值列表创建例外",
+    "xpack.securitySolution.lists.uploadValueListDescription": "上传编写规则例外时要使用的单值列表。",
+    "xpack.securitySolution.lists.uploadValueListExtensionValidationMessage": "文件必须属于以下类型之一：[{fileTypes}]",
     "xpack.securitySolution.lists.uploadValueListPrompt": "选择或拖放文件",
     "xpack.securitySolution.lists.uploadValueListTitle": "上传值列表",
+    "xpack.securitySolution.lists.valueListsExportError": "导出值列表时出错。",
     "xpack.securitySolution.lists.valueListsForm.ipRadioLabel": "IP 地址",
+    "xpack.securitySolution.lists.valueListsForm.ipRangesRadioLabel": "IP 范围",
     "xpack.securitySolution.lists.valueListsForm.keywordsRadioLabel": "关键字",
     "xpack.securitySolution.lists.valueListsForm.listTypesRadioLabel": "值列表类型",
+    "xpack.securitySolution.lists.valueListsForm.textRadioLabel": "文本",
     "xpack.securitySolution.lists.valueListsTable.actionsColumn": "操作",
     "xpack.securitySolution.lists.valueListsTable.createdByColumn": "创建者",
     "xpack.securitySolution.lists.valueListsTable.deleteActionDescription": "删除值列表",
@@ -16782,8 +16518,8 @@
     "xpack.securitySolution.overview.endpointNotice.dismiss": "关闭消息",
     "xpack.securitySolution.overview.endpointNotice.introducing": "即将引入： ",
     "xpack.securitySolution.overview.endpointNotice.message": "使用威胁防御、检测和深度安全数据可见性来保护您的主机。",
-    "xpack.securitySolution.overview.endpointNotice.title": "Elastic Endpoint Security 公测版",
-    "xpack.securitySolution.overview.endpointNotice.tryButton": "试用 Elastic Endpoint Security 公测版",
+    "xpack.securitySolution.overview.endpointNotice.title": "Elastic Endpoint Security（公测版）",
+    "xpack.securitySolution.overview.endpointNotice.tryButton": "试用 Elastic Endpoint Security（公测版）",
     "xpack.securitySolution.overview.eventsTitle": "事件计数",
     "xpack.securitySolution.overview.feedbackText": "如果您对 Elastic SIEM 体验有任何建议，请随时{feedback}。",
     "xpack.securitySolution.overview.feedbackText.feedbackLinkText": "在线提交反馈",
@@ -16829,9 +16565,14 @@
     "xpack.securitySolution.overview.viewEventsButtonLabel": "查看事件",
     "xpack.securitySolution.overview.winlogbeatMWSysmonOperational": "Microsoft-Windows-Sysmon/Operational",
     "xpack.securitySolution.overview.winlogbeatSecurityTitle": "安全",
-    "xpack.securitySolution.pages.common.emptyActionEndpoint": "使用 Elastic 代理添加数据（公测版）",
+    "xpack.securitySolution.pages.common.emptyActionBeats": "使用 Beats 添加数据",
+    "xpack.securitySolution.pages.common.emptyActionBeatsDescription": "轻量型 Beats 可以发送来自成百上千的机器和系统中的数据",
+    "xpack.securitySolution.pages.common.emptyActionElasticAgent": "使用 Elastic 代理添加数据",
+    "xpack.securitySolution.pages.common.emptyActionElasticAgentDescription": "通过 Elastic 代理，可以简单统一的方式将监测添加到主机。",
+    "xpack.securitySolution.pages.common.emptyActionEndpoint": "添加 Elastic Endpoint Security",
+    "xpack.securitySolution.pages.common.emptyActionEndpointDescription": "使用威胁防御、检测和深度安全数据可见性功能保护您的主机。",
     "xpack.securitySolution.pages.common.emptyActionSecondary": "入门指南。",
-    "xpack.securitySolution.pages.common.emptyTitle": "欢迎使用安全解决方案。让我们教您如何入门。",
+    "xpack.securitySolution.pages.common.emptyTitle": "欢迎使用 Elastic Security。让我们帮您如何入门。",
     "xpack.securitySolution.pages.fourohfour.noContentFoundDescription": "未找到任何内容",
     "xpack.securitySolution.paginatedTable.rowsButtonLabel": "每页行数",
     "xpack.securitySolution.paginatedTable.showingSubtitle": "正在显示",
@@ -16935,7 +16676,7 @@
     "xpack.securitySolution.timeline.body.renderers.endgame.withSpecialPrivilegesDescription": "使用特殊权限，",
     "xpack.securitySolution.timeline.body.sort.sortedAscendingTooltip": "已升序",
     "xpack.securitySolution.timeline.body.sort.sortedDescendingTooltip": "已降序",
-    "xpack.securitySolution.timeline.callOut.immutable.message.description": "此时间线不可变，因此不允许在 Security 应用程序中进行保存，但您可以继续使用该时间线搜索并筛选安全事件",
+    "xpack.securitySolution.timeline.callOut.immutable.message.description": "此预置时间线模板无法修改。要执行更改，请复制此模板，然后修改复制的模板。",
     "xpack.securitySolution.timeline.callOut.unauthorized.message.description": "可以使用“时间线”调查事件，但您没有所需的权限来保存时间线以供将来使用。如果需要保存时间线，请联系您的 Kibana 管理员。",
     "xpack.securitySolution.timeline.categoryTooltip": "类别",
     "xpack.securitySolution.timeline.defaultTimelineDescription": "创建新的时间线时默认提供的时间线。",
@@ -16957,6 +16698,7 @@
     "xpack.securitySolution.timeline.flyoutTimelineTemplateLabel": "时间线模板",
     "xpack.securitySolution.timeline.fullScreenButton": "全屏",
     "xpack.securitySolution.timeline.graphOverlay.backToEventsButton": "&lt; 返回至事件",
+    "xpack.securitySolution.timeline.properties.attachTimelineToCaseTooltip": "请为您的时间线提供标题，以便将其附加到案例",
     "xpack.securitySolution.timeline.properties.attachToExistingCaseButtonLabel": "附加到现有案例......",
     "xpack.securitySolution.timeline.properties.attachToNewCaseButtonLabel": "附加到新案例",
     "xpack.securitySolution.timeline.properties.descriptionPlaceholder": "描述",
@@ -17866,8 +17608,13 @@
     "xpack.spaces.management.confirmDeleteModal.deletingSpaceWarningMessage": "删除空间会永久删除空间及其 {allContents}。此操作无法撤消。",
     "xpack.spaces.management.confirmDeleteModal.redirectAfterDeletingCurrentSpaceWarningMessage": "您即将删除当前空间 {name}。如果继续，系统会将您重定向到选择其他空间的位置。",
     "xpack.spaces.management.confirmDeleteModal.spaceNamesDoNoMatchErrorMessage": "空间名称不匹配。",
+    "xpack.spaces.management.copyToSpace.actionDescription": "将此已保存对象复制到一个或多个工作区",
+    "xpack.spaces.management.copyToSpace.actionTitle": "复制到工作区",
     "xpack.spaces.management.copyToSpace.copyErrorTitle": "复制已保存对象时出错",
+    "xpack.spaces.management.copyToSpace.copyResultsLabel": "复制结果",
     "xpack.spaces.management.copyToSpace.copyStatus.conflictsMessage": "具有匹配 ID ({id}) 的已保存对象在此工作区中已存在。",
+    "xpack.spaces.management.copyToSpace.copyStatus.conflictsOverwriteMessage": "单击“覆盖”可将此版本替换为复制的版本。",
+    "xpack.spaces.management.copyToSpace.copyStatus.pendingOverwriteMessage": "已保存对象将被覆盖。单击“跳过”可取消此操作。",
     "xpack.spaces.management.copyToSpace.copyStatus.successMessage": "已保存对象成功复制。",
     "xpack.spaces.management.copyToSpace.copyStatus.unresolvableErrorMessage": "复制此已保存对象时出错。",
     "xpack.spaces.management.copyToSpace.copyStatusSummary.conflictsMessage": "在 {space} 工作区中检测到一个或多个冲突。展开此部分以进行解决。",
@@ -17875,17 +17622,24 @@
     "xpack.spaces.management.copyToSpace.copyStatusSummary.successMessage": "已成功复制到 {space} 工作区。",
     "xpack.spaces.management.copyToSpace.copyToSpacesButton": "复制到 {spaceCount} {spaceCount, plural, one {个工作区} other {个工作区}}",
     "xpack.spaces.management.copyToSpace.disabledCopyToSpacesButton": "复制",
+    "xpack.spaces.management.copyToSpace.dontIncludeRelatedLabel": "不包括相关已保存对象",
+    "xpack.spaces.management.copyToSpace.dontOverwriteLabel": "未覆盖已保存对象",
     "xpack.spaces.management.copyToSpace.finishCopyToSpacesButton": "完成",
     "xpack.spaces.management.copyToSpace.finishedButtonLabel": "复制已完成。",
+    "xpack.spaces.management.copyToSpace.finishPendingOverwritesCopyToSpacesButton": "覆盖 {overwriteCount} 个对象",
+    "xpack.spaces.management.copyToSpace.includeRelatedLabel": "包括相关已保存对象",
     "xpack.spaces.management.copyToSpace.inProgressButtonLabel": "复制正在进行中。请稍候。",
     "xpack.spaces.management.copyToSpace.noSpacesBody": "没有可向其中进行复制的合格工作区。",
     "xpack.spaces.management.copyToSpace.noSpacesTitle": "没有可用的工作区",
     "xpack.spaces.management.copyToSpace.overwriteLabel": "正在自动覆盖已保存对象",
     "xpack.spaces.management.copyToSpace.resolveCopyErrorTitle": "解决已保存对象冲突时出错",
+    "xpack.spaces.management.copyToSpace.resolveCopySuccessTitle": "覆盖成功",
+    "xpack.spaces.management.copyToSpace.selectSpacesLabel": "选择要向其中进行复制的工作区",
     "xpack.spaces.management.copyToSpace.spacesLoadErrorTitle": "加载可用工作区时出错",
     "xpack.spaces.management.copyToSpaceFlyoutFooter.errorCount": "错误",
     "xpack.spaces.management.copyToSpaceFlyoutFooter.pendingCount": "待处理",
     "xpack.spaces.management.copyToSpaceFlyoutFooter.successCount": "已复制",
+    "xpack.spaces.management.copyToSpaceFlyoutHeader": "将已保存对象复制到工作区",
     "xpack.spaces.management.createSpaceBreadcrumb": "创建",
     "xpack.spaces.management.customizeSpaceAvatar.colorFormRowLabel": "颜色",
     "xpack.spaces.management.customizeSpaceAvatar.imageUrl": "定制图像",
@@ -18365,6 +18119,7 @@
     "xpack.triggersActionsUI.components.builtinActionTypes.serviceNow.titleFieldLabel": "简短描述",
     "xpack.triggersActionsUI.components.builtinActionTypes.serviceNow.urgencySelectFieldLabel": "紧急度",
     "xpack.triggersActionsUI.components.builtinActionTypes.servicenow.usernameTextFieldLabel": "用户名",
+    "xpack.triggersActionsUI.components.builtinActionTypes.serviceNowAction.apiUrlHelpLabel": "配置 ServiceNow 的个人开发人员实例",
     "xpack.triggersActionsUI.components.builtinActionTypes.slackAction.actionTypeTitle": "发送到 Slack",
     "xpack.triggersActionsUI.components.builtinActionTypes.slackAction.error.requiredWebhookUrlText": "Webhook URL 必填。",
     "xpack.triggersActionsUI.components.builtinActionTypes.slackAction.messageTextAreaFieldLabel": "消息",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index.test.tsx
index 417a9e09086a2c..b56ae35df5d06a 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index.test.tsx
@@ -72,17 +72,31 @@ describe('index connector validation with minimal config', () => {
 describe('action params validation', () => {
   test('action params validation succeeds when action params is valid', () => {
     const actionParams = {
-      documents: ['test'],
+      documents: [{ test: 1234 }],
     };
 
     expect(actionTypeModel.validateParams(actionParams)).toEqual({
-      errors: {},
+      errors: {
+        documents: [],
+      },
     });
 
     const emptyActionParams = {};
 
     expect(actionTypeModel.validateParams(emptyActionParams)).toEqual({
-      errors: {},
+      errors: {
+        documents: ['Document is required and should be a valid JSON object.'],
+      },
+    });
+
+    const invalidDocumentActionParams = {
+      documents: [{}],
+    };
+
+    expect(actionTypeModel.validateParams(invalidDocumentActionParams)).toEqual({
+      errors: {
+        documents: ['Document is required and should be a valid JSON object.'],
+      },
     });
   });
 });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index.tsx
index 3ee663a5fc8a06..c0255650e0f37e 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index.tsx
@@ -44,8 +44,23 @@ export function getActionType(): ActionTypeModel<EsIndexActionConnector, IndexAc
     },
     actionConnectorFields: lazy(() => import('./es_index_connector')),
     actionParamsFields: lazy(() => import('./es_index_params')),
-    validateParams: (): ValidationResult => {
-      return { errors: {} };
+    validateParams: (actionParams: IndexActionParams): ValidationResult => {
+      const validationResult = { errors: {} };
+      const errors = {
+        documents: new Array<string>(),
+      };
+      validationResult.errors = errors;
+      if (!actionParams.documents?.length || Object.keys(actionParams.documents[0]).length === 0) {
+        errors.documents.push(
+          i18n.translate(
+            'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredDocumentJson',
+            {
+              defaultMessage: 'Document is required and should be a valid JSON object.',
+            }
+          )
+        );
+      }
+      return validationResult;
     },
   };
 }
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_params.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_params.tsx
index e8e8cc582512e5..495707db4975cf 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_params.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_params.tsx
@@ -17,6 +17,7 @@ export const IndexParamsFields = ({
   editAction,
   messageVariables,
   docLinks,
+  errors,
 }: ActionParamsProps<IndexActionParams>) => {
   const { documents } = actionParams;
 
@@ -24,8 +25,10 @@ export const IndexParamsFields = ({
     try {
       const documentsJSON = JSON.parse(updatedDocuments);
       editAction('documents', [documentsJSON], index);
-      // eslint-disable-next-line no-empty
-    } catch (e) {}
+    } catch (e) {
+      // set document as empty to turn on the validation for non empty valid JSON object
+      editAction('documents', [{}], index);
+    }
   };
 
   return (
@@ -34,7 +37,7 @@ export const IndexParamsFields = ({
         messageVariables={messageVariables}
         paramsProperty={'documents'}
         inputTargetValue={
-          documents && documents.length > 0 ? ((documents[0] as unknown) as string) : ''
+          documents && documents.length > 0 ? ((documents[0] as unknown) as string) : undefined
         }
         label={i18n.translate(
           'xpack.triggersActionsUI.components.builtinActionTypes.indexAction.documentsFieldLabel',
@@ -48,6 +51,7 @@ export const IndexParamsFields = ({
             defaultMessage: 'Code editor',
           }
         )}
+        errors={errors.documents as string[]}
         onDocumentsChange={onDocumentsChange}
         helpText={
           <EuiLink
@@ -60,6 +64,14 @@ export const IndexParamsFields = ({
             />
           </EuiLink>
         }
+        onBlur={() => {
+          if (
+            !(documents && documents.length > 0 ? ((documents[0] as unknown) as string) : undefined)
+          ) {
+            // set document as empty to turn on the validation for non empty valid JSON object
+            onDocumentsChange('{}');
+          }
+        }}
       />
     </>
   );
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts
index f5670f432d4d45..48544945836d9e 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts
@@ -9,7 +9,7 @@ import { i18n } from '@kbn/i18n';
 export const SERVICENOW_DESC = i18n.translate(
   'xpack.triggersActionsUI.components.builtinActionTypes.servicenow.selectMessageText',
   {
-    defaultMessage: 'Push or update data to a new incident in ServiceNow.',
+    defaultMessage: 'Create an incident in ServiceNow.',
   }
 );
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_params.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_params.tsx
index 1dfd9e3edc2c5a..ff9ad936f224ff 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_params.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_params.tsx
@@ -21,7 +21,7 @@ const WebhookParamsFields: React.FunctionComponent<ActionParamsProps<WebhookActi
     <JsonEditorWithMessageVariables
       messageVariables={messageVariables}
       paramsProperty={'body'}
-      inputTargetValue={body || ''}
+      inputTargetValue={body}
       label={i18n.translate(
         'xpack.triggersActionsUI.components.builtinActionTypes.webhookAction.bodyFieldLabel',
         {
@@ -38,6 +38,11 @@ const WebhookParamsFields: React.FunctionComponent<ActionParamsProps<WebhookActi
       onDocumentsChange={(json: string) => {
         editAction('body', json, index);
       }}
+      onBlur={() => {
+        if (!body) {
+          editAction('body', '', index);
+        }
+      }}
     />
   );
 };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/json_editor_with_message_variables.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/json_editor_with_message_variables.tsx
index 0b8184fc441fdc..5ea15deb53161d 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/json_editor_with_message_variables.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/json_editor_with_message_variables.tsx
@@ -14,12 +14,13 @@ import { ActionVariable } from '../../types';
 interface Props {
   messageVariables?: ActionVariable[];
   paramsProperty: string;
-  inputTargetValue: string;
+  inputTargetValue?: string;
   label: string;
   errors?: string[];
   areaLabel?: string;
   onDocumentsChange: (data: string) => void;
   helpText?: JSX.Element;
+  onBlur?: () => void;
 }
 
 export const JsonEditorWithMessageVariables: React.FunctionComponent<Props> = ({
@@ -31,6 +32,7 @@ export const JsonEditorWithMessageVariables: React.FunctionComponent<Props> = ({
   areaLabel,
   onDocumentsChange,
   helpText,
+  onBlur,
 }) => {
   const [cursorPosition, setCursorPosition] = useState<any>(null);
 
@@ -84,6 +86,7 @@ export const JsonEditorWithMessageVariables: React.FunctionComponent<Props> = ({
           onDocumentsChange(convertToJson(xjson));
         }}
         onCursorChange={(_value: any) => onClickWithMessageVariable(_value)}
+        onBlur={onBlur}
       />
     </EuiFormRow>
   );
diff --git a/x-pack/plugins/ui_actions_enhanced/public/can_inherit_time_range.test.ts b/x-pack/plugins/ui_actions_enhanced/public/can_inherit_time_range.test.ts
index 5f2e9d07c4bcba..9fb3a54d5a1825 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/can_inherit_time_range.test.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/can_inherit_time_range.test.ts
@@ -10,8 +10,6 @@ import { HelloWorldEmbeddable } from '../../../../examples/embeddable_examples/p
 /** eslint-enable */
 import { TimeRangeEmbeddable, TimeRangeContainer } from './test_helpers';
 
-jest.mock('ui/new_platform');
-
 test('canInheritTimeRange returns false if embeddable is inside container without a time range', () => {
   const embeddable = new TimeRangeEmbeddable(
     { id: '1234', timeRange: { from: 'noxw-15m', to: 'now' } },
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx
index 78252dccd20d24..9cc64defc17952 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.test.tsx
@@ -15,7 +15,7 @@ import {
   urlDrilldownActionFactory,
 } from './test_data';
 import { ActionFactory } from '../../dynamic_actions';
-import { licenseMock } from '../../../../licensing/common/licensing.mock';
+import { licensingMock } from '../../../../licensing/public/mocks';
 
 // TODO: afterEach is not available for it globally during setup
 // https://github.com/elastic/kibana/issues/59469
@@ -68,8 +68,12 @@ test('If not enough license, button is disabled', () => {
     {
       ...urlDrilldownActionFactory,
       minimalLicense: 'gold',
+      licenseFeatureName: 'Url Drilldown',
     },
-    () => licenseMock.createLicense()
+    {
+      getLicense: () => licensingMock.createLicense(),
+      getFeatureUsageStart: () => licensingMock.createStart().featureUsage,
+    }
   );
   const screen = render(<Demo actionFactories={[dashboardFactory, urlWithGoldLicense]} />);
 
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
index 7e4fe1de8be8dc..16d0250c5721ec 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
@@ -21,7 +21,12 @@ import {
   EuiLink,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { txtChangeButton, txtTriggerPickerHelpText, txtTriggerPickerLabel } from './i18n';
+import {
+  txtChangeButton,
+  txtTriggerPickerHelpText,
+  txtTriggerPickerLabel,
+  txtTriggerPickerHelpTooltip,
+} from './i18n';
 import './action_wizard.scss';
 import { ActionFactory, BaseActionFactoryContext } from '../../dynamic_actions';
 import { Trigger, TriggerId } from '../../../../../../src/plugins/ui_actions/public';
@@ -93,7 +98,7 @@ export const ActionWizard: React.FC<ActionWizardProps> = ({
   if (
     !currentActionFactory &&
     actionFactories.length === 1 &&
-    actionFactories[0].isCompatibleLicence()
+    actionFactories[0].isCompatibleLicense()
   ) {
     onActionFactoryChange(actionFactories[0]);
   }
@@ -157,14 +162,17 @@ const TriggerPicker: React.FC<TriggerPickerProps> = ({
   const selectedTrigger = selectedTriggers ? selectedTriggers[0] : undefined;
   return (
     <EuiFormFieldset
+      data-test-subj={`triggerPicker`}
       legend={{
         children: (
           <EuiText size="s">
             <h5>
               <span>{txtTriggerPickerLabel}</span>{' '}
-              <EuiLink href={triggerPickerDocsLink} target={'blank'} external>
-                {txtTriggerPickerHelpText}
-              </EuiLink>
+              <EuiToolTip content={txtTriggerPickerHelpTooltip}>
+                <EuiLink href={triggerPickerDocsLink} target={'blank'} external>
+                  {txtTriggerPickerHelpText}
+                </EuiLink>
+              </EuiToolTip>
             </h5>
           </EuiText>
         ),
@@ -271,7 +279,7 @@ const SelectedActionFactory: React.FC<SelectedActionFactoryProps> = ({
           />
         </>
       )}
-      <EuiSpacer size="l" />
+      <EuiSpacer size="m" />
       <div>
         <actionFactory.ReactCollectConfig
           config={config}
@@ -314,8 +322,8 @@ const ActionFactorySelector: React.FC<ActionFactorySelectorProps> = ({
    * make sure not compatible factories are in the end
    */
   const ensureOrder = (factories: ActionFactory[]) => {
-    const compatibleLicense = factories.filter((f) => f.isCompatibleLicence());
-    const notCompatibleLicense = factories.filter((f) => !f.isCompatibleLicence());
+    const compatibleLicense = factories.filter((f) => f.isCompatibleLicense());
+    const notCompatibleLicense = factories.filter((f) => !f.isCompatibleLicense());
     return [
       ...compatibleLicense.sort((f1, f2) => f2.order - f1.order),
       ...notCompatibleLicense.sort((f1, f2) => f2.order - f1.order),
@@ -328,7 +336,7 @@ const ActionFactorySelector: React.FC<ActionFactorySelectorProps> = ({
         <EuiFlexItem grow={false} key={actionFactory.id}>
           <EuiToolTip
             content={
-              !actionFactory.isCompatibleLicence() && (
+              !actionFactory.isCompatibleLicense() && (
                 <FormattedMessage
                   defaultMessage="Insufficient license level"
                   id="xpack.uiActionsEnhanced.components.actionWizard.insufficientLicenseLevelTooltip"
@@ -341,7 +349,7 @@ const ActionFactorySelector: React.FC<ActionFactorySelectorProps> = ({
               label={actionFactory.getDisplayName(context)}
               data-test-subj={`${TEST_SUBJ_ACTION_FACTORY_ITEM}-${actionFactory.id}`}
               onClick={() => onActionFactorySelected(actionFactory)}
-              disabled={!actionFactory.isCompatibleLicence()}
+              disabled={!actionFactory.isCompatibleLicense()}
             >
               {actionFactory.getIconType(context) && (
                 <EuiIcon type={actionFactory.getIconType(context)!} size="m" />
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/i18n.ts
index 678457f9794f3e..f494ecfb51f32a 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/i18n.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/i18n.ts
@@ -16,13 +16,20 @@ export const txtChangeButton = i18n.translate(
 export const txtTriggerPickerLabel = i18n.translate(
   'xpack.uiActionsEnhanced.components.actionWizard.triggerPickerLabel',
   {
-    defaultMessage: 'Pick a trigger:',
+    defaultMessage: 'Show option on:',
   }
 );
 
 export const txtTriggerPickerHelpText = i18n.translate(
-  'xpack.uiActionsEnhanced.components.actionWizard.helpText',
+  'xpack.uiActionsEnhanced.components.actionWizard.triggerPickerHelpText',
   {
     defaultMessage: "What's this?",
   }
 );
+
+export const txtTriggerPickerHelpTooltip = i18n.translate(
+  'xpack.uiActionsEnhanced.components.actionWizard.triggerPickerHelpTooltip',
+  {
+    defaultMessage: 'Determines when the drilldown appears in context menu',
+  }
+);
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/test_data.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/test_data.tsx
index d48cb13b1a4705..71286e9a59c06e 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/test_data.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/test_data.tsx
@@ -10,7 +10,7 @@ import { reactToUiComponent } from '../../../../../../src/plugins/kibana_react/p
 import { ActionWizard } from './action_wizard';
 import { ActionFactory, ActionFactoryDefinition } from '../../dynamic_actions';
 import { CollectConfigProps } from '../../../../../../src/plugins/kibana_utils/public';
-import { licenseMock } from '../../../../licensing/common/licensing.mock';
+import { licensingMock } from '../../../../licensing/public/mocks';
 import {
   APPLY_FILTER_TRIGGER,
   SELECT_RANGE_TRIGGER,
@@ -116,9 +116,10 @@ export const dashboardDrilldownActionFactory: ActionFactoryDefinition<
   },
 };
 
-export const dashboardFactory = new ActionFactory(dashboardDrilldownActionFactory, () =>
-  licenseMock.createLicense()
-);
+export const dashboardFactory = new ActionFactory(dashboardDrilldownActionFactory, {
+  getLicense: () => licensingMock.createLicense(),
+  getFeatureUsageStart: () => licensingMock.createStart().featureUsage,
+});
 
 interface UrlDrilldownConfig {
   url: string;
@@ -176,9 +177,10 @@ export const urlDrilldownActionFactory: ActionFactoryDefinition<UrlDrilldownConf
   },
 };
 
-export const urlFactory = new ActionFactory(urlDrilldownActionFactory, () =>
-  licenseMock.createLicense()
-);
+export const urlFactory = new ActionFactory(urlDrilldownActionFactory, {
+  getLicense: () => licensingMock.createLicense(),
+  getFeatureUsageStart: () => licensingMock.createStart().featureUsage,
+});
 
 export const mockSupportedTriggers: TriggerId[] = [
   VALUE_CLICK_TRIGGER,
diff --git a/x-pack/plugins/ui_actions_enhanced/public/custom_time_range_action.test.ts b/x-pack/plugins/ui_actions_enhanced/public/custom_time_range_action.test.ts
index 7919d2d2482ae6..9af79c9ac52597 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/custom_time_range_action.test.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/custom_time_range_action.test.ts
@@ -21,8 +21,6 @@ import {
 import { nextTick } from 'test_utils/enzyme_helpers';
 import { ReactElement } from 'react';
 
-jest.mock('ui/new_platform');
-
 const createOpenModalMock = () => {
   const mock = jest.fn();
   mock.mockReturnValue({ close: jest.fn() });
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx
index 9fca785ec90722..8154ec45b8ae1b 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx
@@ -30,7 +30,7 @@ import {
   SerializedAction,
   SerializedEvent,
 } from '../../../dynamic_actions';
-import { ExtraActionFactoryContext } from '../types';
+import { ActionFactoryPlaceContext } from '../types';
 
 interface ConnectedFlyoutManageDrilldownsProps<
   ActionFactoryContext extends BaseActionFactoryContext = BaseActionFactoryContext
@@ -47,7 +47,7 @@ interface ConnectedFlyoutManageDrilldownsProps<
   /**
    * Extra action factory context passed into action factories CollectConfig, getIconType, getDisplayName and etc...
    */
-  extraContext?: ExtraActionFactoryContext<ActionFactoryContext>;
+  placeContext?: ActionFactoryPlaceContext<ActionFactoryContext>;
 }
 
 /**
@@ -81,8 +81,8 @@ export function createFlyoutManageDrilldowns({
     const isCreateOnly = props.viewMode === 'create';
 
     const factoryContext: BaseActionFactoryContext = useMemo(
-      () => ({ ...props.extraContext, triggers: props.supportedTriggers }),
-      [props.extraContext, props.supportedTriggers]
+      () => ({ ...props.placeContext, triggers: props.supportedTriggers }),
+      [props.placeContext, props.supportedTriggers]
     );
     const actionFactories = useCompatibleActionFactoriesForCurrentContext(
       allActionFactories,
@@ -137,7 +137,7 @@ export function createFlyoutManageDrilldowns({
     function mapToDrilldownToDrilldownListItem(drilldown: SerializedEvent): DrilldownListItem {
       const actionFactory = allActionFactoriesById[drilldown.action.factoryId];
       const drilldownFactoryContext: BaseActionFactoryContext = {
-        ...props.extraContext,
+        ...props.placeContext,
         triggers: drilldown.triggers as TriggerId[],
       };
       return {
@@ -148,7 +148,7 @@ export function createFlyoutManageDrilldowns({
         icon: actionFactory?.getIconType(drilldownFactoryContext),
         error: !actionFactory
           ? invalidDrilldownType(drilldown.action.factoryId) // this shouldn't happen for the end user, but useful during development
-          : !actionFactory.isCompatibleLicence()
+          : !actionFactory.isCompatibleLicense()
           ? insufficientLicenseLevel
           : undefined,
         triggers: drilldown.triggers.map((trigger) => getTrigger(trigger as TriggerId)),
@@ -204,7 +204,7 @@ export function createFlyoutManageDrilldowns({
               setRoute(Routes.Manage);
               setCurrentEditId(null);
             }}
-            extraActionFactoryContext={props.extraContext}
+            actionFactoryPlaceContext={props.placeContext}
             initialDrilldownWizardConfig={resolveInitialDrilldownWizardConfig()}
             supportedTriggers={props.supportedTriggers}
             getTrigger={getTrigger}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/flyout_drilldown_wizard.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/flyout_drilldown_wizard.tsx
index a908d53bf6ae75..c8e3f454bd53db 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/flyout_drilldown_wizard.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/flyout_drilldown_wizard.tsx
@@ -18,7 +18,7 @@ import {
 import { DrilldownHelloBar } from '../drilldown_hello_bar';
 import { ActionFactory, BaseActionFactoryContext } from '../../../dynamic_actions';
 import { Trigger, TriggerId } from '../../../../../../../src/plugins/ui_actions/public';
-import { ExtraActionFactoryContext } from '../types';
+import { ActionFactoryPlaceContext } from '../types';
 
 export interface DrilldownWizardConfig<ActionConfig extends object = object> {
   name: string;
@@ -44,7 +44,7 @@ export interface FlyoutDrilldownWizardProps<
   showWelcomeMessage?: boolean;
   onWelcomeHideClick?: () => void;
 
-  extraActionFactoryContext?: ExtraActionFactoryContext<ActionFactoryContext>;
+  actionFactoryPlaceContext?: ActionFactoryPlaceContext<ActionFactoryContext>;
 
   docsLink?: string;
 
@@ -143,7 +143,7 @@ export function FlyoutDrilldownWizard<CurrentActionConfig extends object = objec
   showWelcomeMessage = true,
   onWelcomeHideClick,
   drilldownActionFactories,
-  extraActionFactoryContext,
+  actionFactoryPlaceContext,
   docsLink,
   getTrigger,
   supportedTriggers,
@@ -152,16 +152,16 @@ export function FlyoutDrilldownWizard<CurrentActionConfig extends object = objec
     wizardConfig,
     { setActionFactory, setActionConfig, setName, setSelectedTriggers },
   ] = useWizardConfigState(
-    { ...extraActionFactoryContext, triggers: supportedTriggers },
+    { ...actionFactoryPlaceContext, triggers: supportedTriggers },
     initialDrilldownWizardConfig
   );
 
   const actionFactoryContext: BaseActionFactoryContext = useMemo(
     () => ({
-      ...extraActionFactoryContext,
+      ...actionFactoryPlaceContext,
       triggers: wizardConfig.selectedTriggers ?? [],
     }),
-    [extraActionFactoryContext, wizardConfig.selectedTriggers]
+    [actionFactoryPlaceContext, wizardConfig.selectedTriggers]
   );
 
   const isActionValid = (
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.tsx
index bb3eb89d8f1996..d7f94a52088b7f 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.tsx
@@ -75,7 +75,7 @@ export const FormDrilldownWizard: React.FC<FormDrilldownWizardProps> = ({
   );
 
   const hasNotCompatibleLicenseFactory = () =>
-    actionFactories?.some((f) => !f.isCompatibleLicence());
+    actionFactories?.some((f) => !f.isCompatibleLicense());
 
   const renderGetMoreActionsLink = () => (
     <EuiText size="s">
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/types.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/types.ts
index 870b55c24fb581..811680bf380f70 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/types.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/types.ts
@@ -10,6 +10,6 @@ import { BaseActionFactoryContext } from '../../dynamic_actions';
  * Interface used as piece of ActionFactoryContext that is passed in from drilldown wizard component to action factories
  * Omitted values are added inside the wizard and then full {@link BaseActionFactoryContext} passed into action factory methods
  */
-export type ExtraActionFactoryContext<
+export type ActionFactoryPlaceContext<
   ActionFactoryContext extends BaseActionFactoryContext = BaseActionFactoryContext
 > = Omit<ActionFactoryContext, 'triggers'>;
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts
index ff455c6ae45b66..8faccc088a3279 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_definition.ts
@@ -37,11 +37,18 @@ export interface DrilldownDefinition<
   id: string;
 
   /**
-   * Minimal licence level
+   * Minimal license level
    * Empty means no restrictions
    */
   minimalLicense?: LicenseType;
 
+  /**
+   * Required when `minimalLicense` is used.
+   * Is a user-facing string. Has to be unique. Doesn't need i18n.
+   * The feature's name will be displayed to Cloud end-users when they're billed based on their feature usage.
+   */
+  licenseFeatureName?: string;
+
   /**
    * Determines the display order of the drilldowns in the flyout picker.
    * Higher numbers are displayed first.
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/README.md b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/README.md
new file mode 100644
index 00000000000000..acad968fa46c24
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/README.md
@@ -0,0 +1 @@
+This directory contains reusable building blocks for creating custom URL drilldowns
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/index.ts
new file mode 100644
index 00000000000000..70399617136bd8
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { UrlDrilldownCollectConfig } from './url_drilldown_collect_config/url_drilldown_collect_config';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/i18n.ts
new file mode 100644
index 00000000000000..78f7218dce22e2
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/i18n.ts
@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const txtUrlTemplatePlaceholder = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.urlTemplatePlaceholderText',
+  {
+    defaultMessage: 'Example: {exampleUrl}',
+    values: {
+      exampleUrl: 'https://www.my-url.com/?{{event.key}}={{event.value}}',
+    },
+  }
+);
+
+export const txtUrlPreviewHelpText = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.urlPreviewHelpText',
+  {
+    defaultMessage: 'Please note that \\{\\{event.*\\}\\} variables replaced by dummy values.',
+  }
+);
+
+export const txtAddVariableButtonTitle = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.addVariableButtonTitle',
+  {
+    defaultMessage: 'Add variable',
+  }
+);
+
+export const txtUrlTemplateLabel = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.urlTemplateLabel',
+  {
+    defaultMessage: 'Enter URL template:',
+  }
+);
+
+export const txtUrlTemplateSyntaxHelpLinkText = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.urlTemplateSyntaxHelpLinkText',
+  {
+    defaultMessage: 'Syntax help',
+  }
+);
+
+export const txtUrlTemplateVariablesHelpLinkText = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.urlTemplateVariablesHelpLinkText',
+  {
+    defaultMessage: 'Help',
+  }
+);
+
+export const txtUrlTemplateVariablesFilterPlaceholderText = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.urlTemplateVariablesFilterPlaceholderText',
+  {
+    defaultMessage: 'Filter variables',
+  }
+);
+
+export const txtUrlTemplatePreviewLabel = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.urlPreviewLabel',
+  {
+    defaultMessage: 'URL preview:',
+  }
+);
+
+export const txtUrlTemplatePreviewLinkText = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.urlPreviewLinkText',
+  {
+    defaultMessage: 'Preview',
+  }
+);
+
+export const txtUrlTemplateOpenInNewTab = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.openInNewTabLabel',
+  {
+    defaultMessage: 'Open in new tab',
+  }
+);
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/index.scss b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/index.scss
new file mode 100644
index 00000000000000..475c3f2a915ea3
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/index.scss
@@ -0,0 +1,5 @@
+.uaeUrlDrilldownCollectConfig__urlTemplateFormRow {
+  .euiFormRow__label {
+    align-self: flex-end;
+  }
+}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/test_samples/demo.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/test_samples/demo.tsx
new file mode 100644
index 00000000000000..e6c9797623e9fc
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/test_samples/demo.tsx
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { UrlDrilldownConfig, UrlDrilldownScope } from '../../../types';
+import { UrlDrilldownCollectConfig } from '../url_drilldown_collect_config';
+
+export const Demo = () => {
+  const [config, onConfig] = React.useState<UrlDrilldownConfig>({
+    openInNewTab: false,
+    url: { template: '' },
+  });
+
+  const fakeScope: UrlDrilldownScope = {
+    kibanaUrl: 'http://localhost:5601/',
+    context: {
+      filters: [
+        {
+          query: { match: { extension: { query: 'jpg', type: 'phrase' } } },
+          meta: { index: 'logstash-*', negate: false, disabled: false, alias: null },
+        },
+        {
+          query: { match: { '@tags': { query: 'info', type: 'phrase' } } },
+          meta: { index: 'logstash-*', negate: false, disabled: false, alias: null },
+        },
+        {
+          query: { match: { _type: { query: 'nginx', type: 'phrase' } } },
+          meta: { index: 'logstash-*', negate: false, disabled: false, alias: null },
+        },
+      ],
+    },
+    event: {
+      key: 'fakeKey',
+      value: 'fakeValue',
+    },
+  };
+
+  return (
+    <>
+      <UrlDrilldownCollectConfig config={config} onConfig={onConfig} scope={fakeScope} />
+      {JSON.stringify(config)}
+    </>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/url_drilldown_collect_config.story.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/url_drilldown_collect_config.story.tsx
new file mode 100644
index 00000000000000..244ea9bd2a97e5
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/url_drilldown_collect_config.story.tsx
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { Demo } from './test_samples/demo';
+
+storiesOf('UrlDrilldownCollectConfig', module).add('default', () => <Demo />);
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/url_drilldown_collect_config.test.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/url_drilldown_collect_config.test.tsx
new file mode 100644
index 00000000000000..f55818379ef3f2
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/url_drilldown_collect_config.test.tsx
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Demo } from './test_samples/demo';
+import { cleanup, fireEvent, render } from '@testing-library/react/pure';
+import React from 'react';
+
+afterEach(cleanup);
+
+test('configure valid URL template', () => {
+  const screen = render(<Demo />);
+
+  const urlTemplate = 'https://elastic.co/?{{event.key}}={{event.value}}';
+  fireEvent.change(screen.getByLabelText(/Enter URL template/i), {
+    target: { value: urlTemplate },
+  });
+
+  const preview = screen.getByLabelText(/URL preview/i) as HTMLTextAreaElement;
+  expect(preview.value).toMatchInlineSnapshot(`"https://elastic.co/?fakeKey=fakeValue"`);
+  expect(preview.disabled).toEqual(true);
+  const previewLink = screen.getByText('Preview') as HTMLAnchorElement;
+  expect(previewLink.href).toMatchInlineSnapshot(`"https://elastic.co/?fakeKey=fakeValue"`);
+  expect(previewLink.target).toMatchInlineSnapshot(`"_blank"`);
+});
+
+test('configure invalid URL template', () => {
+  const screen = render(<Demo />);
+
+  const urlTemplate = 'https://elastic.co/?{{event.wrongKey}}={{event.wrongValue}}';
+  fireEvent.change(screen.getByLabelText(/Enter URL template/i), {
+    target: { value: urlTemplate },
+  });
+
+  const previewTextArea = screen.getByLabelText(/URL preview/i) as HTMLTextAreaElement;
+  expect(previewTextArea.disabled).toEqual(true);
+  expect(previewTextArea.value).toEqual(urlTemplate);
+  expect(screen.getByText(/invalid format/i)).toBeInTheDocument(); // check that error is shown
+
+  const previewLink = screen.getByText('Preview') as HTMLAnchorElement;
+  expect(previewLink.href).toEqual(urlTemplate);
+  expect(previewLink.target).toMatchInlineSnapshot(`"_blank"`);
+});
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/url_drilldown_collect_config.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/url_drilldown_collect_config.tsx
new file mode 100644
index 00000000000000..dabf09e4b6e9f7
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/url_drilldown_collect_config.tsx
@@ -0,0 +1,226 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useRef, useState } from 'react';
+import {
+  EuiCheckbox,
+  EuiFormRow,
+  EuiIcon,
+  EuiLink,
+  EuiPopover,
+  EuiPopoverFooter,
+  EuiPopoverTitle,
+  EuiSelectable,
+  EuiText,
+  EuiTextArea,
+  EuiSelectableOption,
+} from '@elastic/eui';
+import { UrlDrilldownConfig, UrlDrilldownScope } from '../../types';
+import { compile } from '../../url_template';
+import { validateUrlTemplate } from '../../url_validation';
+import { buildScopeSuggestions } from '../../url_drilldown_scope';
+import './index.scss';
+import {
+  txtAddVariableButtonTitle,
+  txtUrlPreviewHelpText,
+  txtUrlTemplateSyntaxHelpLinkText,
+  txtUrlTemplateVariablesHelpLinkText,
+  txtUrlTemplateVariablesFilterPlaceholderText,
+  txtUrlTemplateLabel,
+  txtUrlTemplateOpenInNewTab,
+  txtUrlTemplatePlaceholder,
+  txtUrlTemplatePreviewLabel,
+  txtUrlTemplatePreviewLinkText,
+} from './i18n';
+
+export interface UrlDrilldownCollectConfig {
+  config: UrlDrilldownConfig;
+  onConfig: (newConfig: UrlDrilldownConfig) => void;
+  scope: UrlDrilldownScope;
+  syntaxHelpDocsLink?: string;
+}
+
+export const UrlDrilldownCollectConfig: React.FC<UrlDrilldownCollectConfig> = ({
+  config,
+  onConfig,
+  scope,
+  syntaxHelpDocsLink,
+}) => {
+  const textAreaRef = useRef<HTMLTextAreaElement>(null);
+  const urlTemplate = config.url.template ?? '';
+  const compiledUrl = React.useMemo(() => {
+    try {
+      return compile(urlTemplate, scope);
+    } catch {
+      return urlTemplate;
+    }
+  }, [urlTemplate, scope]);
+  const scopeVariables = React.useMemo(() => buildScopeSuggestions(scope), [scope]);
+
+  function updateUrlTemplate(newUrlTemplate: string) {
+    if (config.url.template !== newUrlTemplate) {
+      onConfig({
+        ...config,
+        url: {
+          ...config.url,
+          template: newUrlTemplate,
+        },
+      });
+    }
+  }
+  const { error, isValid } = React.useMemo(
+    () => validateUrlTemplate({ template: urlTemplate }, scope),
+    [urlTemplate, scope]
+  );
+  const isEmpty = !urlTemplate;
+  const isInvalid = !isValid && !isEmpty;
+  return (
+    <>
+      <EuiFormRow
+        fullWidth
+        isInvalid={isInvalid}
+        error={error}
+        className={'uaeUrlDrilldownCollectConfig__urlTemplateFormRow'}
+        label={txtUrlTemplateLabel}
+        helpText={
+          syntaxHelpDocsLink && (
+            <EuiLink external target={'_blank'} href={syntaxHelpDocsLink}>
+              {txtUrlTemplateSyntaxHelpLinkText}
+            </EuiLink>
+          )
+        }
+        labelAppend={
+          <AddVariableButton
+            variables={scopeVariables}
+            variablesHelpLink={syntaxHelpDocsLink}
+            onSelect={(variable: string) => {
+              if (textAreaRef.current) {
+                updateUrlTemplate(
+                  urlTemplate.substr(0, textAreaRef.current!.selectionStart) +
+                    `{{${variable}}}` +
+                    urlTemplate.substr(textAreaRef.current!.selectionEnd)
+                );
+              } else {
+                updateUrlTemplate(urlTemplate + `{{${variable}}}`);
+              }
+            }}
+          />
+        }
+      >
+        <EuiTextArea
+          fullWidth
+          isInvalid={isInvalid}
+          name="url"
+          data-test-subj="urlInput"
+          value={urlTemplate}
+          placeholder={txtUrlTemplatePlaceholder}
+          onChange={(event) => updateUrlTemplate(event.target.value)}
+          rows={3}
+          inputRef={textAreaRef}
+        />
+      </EuiFormRow>
+      <EuiFormRow
+        fullWidth
+        label={txtUrlTemplatePreviewLabel}
+        labelAppend={
+          <EuiText size="xs">
+            <EuiLink href={compiledUrl} target="_blank" external>
+              {txtUrlTemplatePreviewLinkText}
+            </EuiLink>
+          </EuiText>
+        }
+        helpText={txtUrlPreviewHelpText}
+      >
+        <EuiTextArea
+          fullWidth
+          name="urlPreview"
+          data-test-subj="urlPreview"
+          value={compiledUrl}
+          disabled={true}
+          rows={3}
+        />
+      </EuiFormRow>
+      <EuiFormRow hasChildLabel={false}>
+        <EuiCheckbox
+          id="openInNewTab"
+          name="openInNewTab"
+          label={txtUrlTemplateOpenInNewTab}
+          checked={config.openInNewTab}
+          onChange={() => onConfig({ ...config, openInNewTab: !config.openInNewTab })}
+        />
+      </EuiFormRow>
+    </>
+  );
+};
+
+function AddVariableButton({
+  variables,
+  onSelect,
+  variablesHelpLink,
+}: {
+  variables: string[];
+  onSelect: (variable: string) => void;
+  variablesHelpLink?: string;
+}) {
+  const [isVariablesPopoverOpen, setIsVariablesPopoverOpen] = useState<boolean>(false);
+  const closePopover = () => setIsVariablesPopoverOpen(false);
+
+  const options: EuiSelectableOption[] = variables.map((variable: string) => ({
+    key: variable,
+    label: variable,
+  }));
+
+  return (
+    <EuiPopover
+      ownFocus={true}
+      button={
+        <EuiText size="xs">
+          <EuiLink onClick={() => setIsVariablesPopoverOpen(true)}>
+            {txtAddVariableButtonTitle} <EuiIcon type="indexOpen" />
+          </EuiLink>
+        </EuiText>
+      }
+      isOpen={isVariablesPopoverOpen}
+      closePopover={closePopover}
+      panelPaddingSize="none"
+      anchorPosition="downLeft"
+      withTitle
+    >
+      <EuiSelectable
+        singleSelection={true}
+        searchable
+        searchProps={{
+          placeholder: txtUrlTemplateVariablesFilterPlaceholderText,
+          compressed: true,
+        }}
+        options={options}
+        onChange={(newOptions) => {
+          const selected = newOptions.find((o) => o.checked === 'on');
+          if (!selected) return;
+          onSelect(selected.key!);
+          closePopover();
+        }}
+        listProps={{
+          showIcons: false,
+        }}
+      >
+        {(list, search) => (
+          <div style={{ width: 320 }}>
+            <EuiPopoverTitle>{search}</EuiPopoverTitle>
+            {list}
+            {variablesHelpLink && (
+              <EuiPopoverFooter className={'eui-textRight'}>
+                <EuiLink external href={variablesHelpLink} target="_blank">
+                  {txtUrlTemplateVariablesHelpLinkText}
+                </EuiLink>
+              </EuiPopoverFooter>
+            )}
+          </div>
+        )}
+      </EuiSelectable>
+    </EuiPopover>
+  );
+}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/index.ts
new file mode 100644
index 00000000000000..7b7a850050c410
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/index.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { UrlDrilldownConfig, UrlDrilldownGlobalScope, UrlDrilldownScope } from './types';
+export { UrlDrilldownCollectConfig } from './components';
+export {
+  validateUrlTemplate as urlDrilldownValidateUrlTemplate,
+  validateUrl as urlDrilldownValidateUrl,
+} from './url_validation';
+export { compile as urlDrilldownCompileUrl } from './url_template';
+export { globalScopeProvider as urlDrilldownGlobalScopeProvider } from './url_drilldown_global_scope';
+export {
+  buildScope as urlDrilldownBuildScope,
+  buildScopeSuggestions as urlDrilldownBuildScopeSuggestions,
+} from './url_drilldown_scope';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/types.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/types.ts
new file mode 100644
index 00000000000000..31c7481c9d63eb
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/types.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface UrlDrilldownConfig {
+  url: { format?: 'handlebars_v1'; template: string };
+  openInNewTab: boolean;
+}
+
+/**
+ * URL drilldown has 3 sources for variables: global, context and event variables
+ */
+export interface UrlDrilldownScope<
+  ContextScope extends object = object,
+  EventScope extends object = object
+> extends UrlDrilldownGlobalScope {
+  /**
+   * Dynamic variables that are differ depending on where drilldown is created and used,
+   * For example: variables extracted from embeddable panel
+   */
+  context?: ContextScope;
+
+  /**
+   * Variables extracted from trigger context
+   */
+  event?: EventScope;
+}
+
+/**
+ * Global static variables like, for example, `kibanaUrl`
+ * Such variables won’t change depending on a place where url drilldown is used.
+ */
+export interface UrlDrilldownGlobalScope {
+  kibanaUrl: string;
+}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_global_scope.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_global_scope.ts
new file mode 100644
index 00000000000000..afc7fa590a2f0f
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_global_scope.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CoreSetup } from 'kibana/public';
+import { UrlDrilldownGlobalScope } from './types';
+
+interface UrlDrilldownGlobalScopeDeps {
+  core: CoreSetup;
+}
+
+export function globalScopeProvider({
+  core,
+}: UrlDrilldownGlobalScopeDeps): () => UrlDrilldownGlobalScope {
+  return () => ({
+    kibanaUrl: window.location.origin + core.http.basePath.get(),
+  });
+}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.test.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.test.ts
new file mode 100644
index 00000000000000..f95fc5e70ae000
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.test.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { buildScope, buildScopeSuggestions } from './url_drilldown_scope';
+
+test('buildScopeSuggestions', () => {
+  expect(
+    buildScopeSuggestions(
+      buildScope({
+        globalScope: {
+          kibanaUrl: 'http://localhost:5061/',
+        },
+        eventScope: {
+          key: '__testKey__',
+          value: '__testValue__',
+        },
+        contextScope: {
+          filters: [
+            {
+              query: { match: { extension: { query: 'jpg', type: 'phrase' } } },
+              meta: { index: 'logstash-*', negate: false, disabled: false, alias: null },
+            },
+            {
+              query: { match: { '@tags': { query: 'info', type: 'phrase' } } },
+              meta: { index: 'logstash-*', negate: false, disabled: false, alias: null },
+            },
+            {
+              query: { match: { _type: { query: 'nginx', type: 'phrase' } } },
+              meta: { index: 'logstash-*', negate: false, disabled: false, alias: null },
+            },
+          ],
+          query: {
+            query: '',
+            language: 'kquery',
+          },
+        },
+      })
+    )
+  ).toMatchInlineSnapshot(`
+    Array [
+      "event.key",
+      "event.value",
+      "context.filters",
+      "context.query.language",
+      "context.query.query",
+      "kibanaUrl",
+    ]
+  `);
+});
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.ts
new file mode 100644
index 00000000000000..d499812a9d5aeb
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import partition from 'lodash/partition';
+import { UrlDrilldownGlobalScope, UrlDrilldownScope } from './types';
+import { getFlattenedObject } from '../../../../../../src/core/public';
+
+export function buildScope<
+  ContextScope extends object = object,
+  EventScope extends object = object
+>({
+  globalScope,
+  contextScope,
+  eventScope,
+}: {
+  globalScope: UrlDrilldownGlobalScope;
+  contextScope?: ContextScope;
+  eventScope?: EventScope;
+}): UrlDrilldownScope<ContextScope, EventScope> {
+  return {
+    ...globalScope,
+    context: contextScope,
+    event: eventScope,
+  };
+}
+
+/**
+ * Builds list of variables for suggestion from scope
+ * keys sorted alphabetically, except {{event.$}} variables are pulled to the top
+ * @param scope
+ */
+export function buildScopeSuggestions(scope: UrlDrilldownGlobalScope): string[] {
+  const allKeys = Object.keys(getFlattenedObject(scope)).sort();
+  const [eventKeys, otherKeys] = partition(allKeys, (key) => key.startsWith('event'));
+  return [...eventKeys, ...otherKeys];
+}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_template.test.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_template.test.ts
new file mode 100644
index 00000000000000..64b8cc49292b31
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_template.test.ts
@@ -0,0 +1,141 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { compile } from './url_template';
+import moment from 'moment-timezone';
+
+test('should compile url without variables', () => {
+  const url = 'https://elastic.co';
+  expect(compile(url, {})).toBe(url);
+});
+
+test('should fail on unknown syntax', () => {
+  const url = 'https://elastic.co/{{}';
+  expect(() => compile(url, {})).toThrowError();
+});
+
+test('should fail on not existing variable', () => {
+  const url = 'https://elastic.co/{{fake}}';
+  expect(() => compile(url, {})).toThrowError();
+});
+
+test('should fail on not existing nested variable', () => {
+  const url = 'https://elastic.co/{{fake.fake}}';
+  expect(() => compile(url, { fake: {} })).toThrowError();
+});
+
+test('should replace existing variable', () => {
+  const url = 'https://elastic.co/{{foo}}';
+  expect(compile(url, { foo: 'bar' })).toMatchInlineSnapshot(`"https://elastic.co/bar"`);
+});
+
+test('should fail on unknown helper', () => {
+  const url = 'https://elastic.co/{{fake foo}}';
+  expect(() => compile(url, { foo: 'bar' })).toThrowError();
+});
+
+describe('json helper', () => {
+  test('should replace with json', () => {
+    const url = 'https://elastic.co/{{json foo bar}}';
+    expect(compile(url, { foo: { foo: 'bar' }, bar: { bar: 'foo' } })).toMatchInlineSnapshot(
+      `"https://elastic.co/%5B%7B%22foo%22:%22bar%22%7D,%7B%22bar%22:%22foo%22%7D%5D"`
+    );
+  });
+  test('should replace with json and skip encoding', () => {
+    const url = 'https://elastic.co/{{{json foo bar}}}';
+    expect(compile(url, { foo: { foo: 'bar' }, bar: { bar: 'foo' } })).toMatchInlineSnapshot(
+      `"https://elastic.co/%5B%7B%22foo%22:%22bar%22%7D,%7B%22bar%22:%22foo%22%7D%5D"`
+    );
+  });
+  test('should throw on unknown key', () => {
+    const url = 'https://elastic.co/{{{json fake}}}';
+    expect(() => compile(url, { foo: { foo: 'bar' }, bar: { bar: 'foo' } })).toThrowError();
+  });
+});
+
+describe('rison helper', () => {
+  test('should replace with rison', () => {
+    const url = 'https://elastic.co/{{rison foo bar}}';
+    expect(compile(url, { foo: { foo: 'bar' }, bar: { bar: 'foo' } })).toMatchInlineSnapshot(
+      `"https://elastic.co/!((foo:bar),(bar:foo))"`
+    );
+  });
+  test('should replace with rison and skip encoding', () => {
+    const url = 'https://elastic.co/{{{rison foo bar}}}';
+    expect(compile(url, { foo: { foo: 'bar' }, bar: { bar: 'foo' } })).toMatchInlineSnapshot(
+      `"https://elastic.co/!((foo:bar),(bar:foo))"`
+    );
+  });
+  test('should throw on unknown key', () => {
+    const url = 'https://elastic.co/{{{rison fake}}}';
+    expect(() => compile(url, { foo: { foo: 'bar' }, bar: { bar: 'foo' } })).toThrowError();
+  });
+});
+
+describe('date helper', () => {
+  let spy: jest.SpyInstance;
+  const date = new Date('2020-08-18T14:45:00.000Z');
+  beforeAll(() => {
+    spy = jest.spyOn(global.Date, 'now').mockImplementation(() => date.valueOf());
+    moment.tz.setDefault('UTC');
+  });
+  afterAll(() => {
+    spy.mockRestore();
+    moment.tz.setDefault('Browser');
+  });
+
+  test('uses datemath', () => {
+    const url = 'https://elastic.co/{{date time}}';
+    expect(compile(url, { time: 'now' })).toMatchInlineSnapshot(
+      `"https://elastic.co/2020-08-18T14:45:00.000Z"`
+    );
+  });
+
+  test('can use format', () => {
+    const url = 'https://elastic.co/{{date time "dddd, MMMM Do YYYY, h:mm:ss a"}}';
+    expect(compile(url, { time: 'now' })).toMatchInlineSnapshot(
+      `"https://elastic.co/Tuesday,%20August%2018th%202020,%202:45:00%20pm"`
+    );
+  });
+
+  test('throws if missing variable', () => {
+    const url = 'https://elastic.co/{{date time}}';
+    expect(() => compile(url, {})).toThrowError();
+  });
+
+  test("doesn't throw if non valid date", () => {
+    const url = 'https://elastic.co/{{date time}}';
+    expect(compile(url, { time: 'fake' })).toMatchInlineSnapshot(`"https://elastic.co/fake"`);
+  });
+
+  test("doesn't throw on boolean or number", () => {
+    const url = 'https://elastic.co/{{date time}}';
+    expect(compile(url, { time: false })).toMatchInlineSnapshot(`"https://elastic.co/false"`);
+    expect(compile(url, { time: 24 })).toMatchInlineSnapshot(
+      `"https://elastic.co/1970-01-01T00:00:00.024Z"`
+    );
+  });
+
+  test('works with ISO string', () => {
+    const url = 'https://elastic.co/{{date time}}';
+    expect(compile(url, { time: date.toISOString() })).toMatchInlineSnapshot(
+      `"https://elastic.co/2020-08-18T14:45:00.000Z"`
+    );
+  });
+
+  test('works with ts', () => {
+    const url = 'https://elastic.co/{{date time}}';
+    expect(compile(url, { time: date.valueOf() })).toMatchInlineSnapshot(
+      `"https://elastic.co/2020-08-18T14:45:00.000Z"`
+    );
+  });
+  test('works with ts string', () => {
+    const url = 'https://elastic.co/{{date time}}';
+    expect(compile(url, { time: String(date.valueOf()) })).toMatchInlineSnapshot(
+      `"https://elastic.co/2020-08-18T14:45:00.000Z"`
+    );
+  });
+});
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_template.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_template.ts
new file mode 100644
index 00000000000000..2c3537636b9dae
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_template.ts
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { create as createHandlebars, HelperDelegate, HelperOptions } from 'handlebars';
+import { encode, RisonValue } from 'rison-node';
+import dateMath from '@elastic/datemath';
+import moment, { Moment } from 'moment';
+
+const handlebars = createHandlebars();
+
+function createSerializationHelper(
+  fnName: string,
+  serializeFn: (value: unknown) => string
+): HelperDelegate {
+  return (...args) => {
+    const { hash } = args.slice(-1)[0] as HelperOptions;
+    const hasHash = Object.keys(hash).length > 0;
+    const hasValues = args.length > 1;
+    if (hasHash && hasValues) {
+      throw new Error(`[${fnName}]: both value list and hash are not supported`);
+    }
+    if (hasHash) {
+      if (Object.values(hash).some((v) => typeof v === 'undefined'))
+        throw new Error(`[${fnName}]: unknown variable`);
+      return serializeFn(hash);
+    } else {
+      const values = args.slice(0, -1) as unknown[];
+      if (values.some((value) => typeof value === 'undefined'))
+        throw new Error(`[${fnName}]: unknown variable`);
+      if (values.length === 0) throw new Error(`[${fnName}]: unknown variable`);
+      if (values.length === 1) return serializeFn(values[0]);
+      return serializeFn(values);
+    }
+  };
+}
+
+handlebars.registerHelper('json', createSerializationHelper('json', JSON.stringify));
+handlebars.registerHelper(
+  'rison',
+  createSerializationHelper('rison', (v) => encode(v as RisonValue))
+);
+
+handlebars.registerHelper('date', (...args) => {
+  const values = args.slice(0, -1) as [string | Date, string | undefined];
+  // eslint-disable-next-line prefer-const
+  let [date, format] = values;
+  if (typeof date === 'undefined') throw new Error(`[date]: unknown variable`);
+  let momentDate: Moment | undefined;
+  if (typeof date === 'string') {
+    momentDate = dateMath.parse(date);
+    if (!momentDate || !momentDate.isValid()) {
+      const ts = Number(date);
+      if (!Number.isNaN(ts)) {
+        momentDate = moment(ts);
+      }
+    }
+  } else {
+    momentDate = moment(date);
+  }
+
+  if (!momentDate || !momentDate.isValid()) {
+    // do not throw error here, because it could be that in preview `__testValue__` is not parsable,
+    // but in runtime it is
+    return date;
+  }
+  return format ? momentDate.format(format) : momentDate.toISOString();
+});
+
+export function compile(url: string, context: object): string {
+  const template = handlebars.compile(url, { strict: true, noEscape: true });
+  return encodeURI(template(context));
+}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_validation.test.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_validation.test.ts
new file mode 100644
index 00000000000000..cb6f4a28402d1c
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_validation.test.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { validateUrl, validateUrlTemplate } from './url_validation';
+
+describe('validateUrl', () => {
+  describe('unsafe urls', () => {
+    const unsafeUrls = [
+      // eslint-disable-next-line no-script-url
+      'javascript:evil()',
+      // eslint-disable-next-line no-script-url
+      'JavaScript:abc',
+      'evilNewProtocol:abc',
+      ' \n Java\n Script:abc',
+      '&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;',
+      '&#106&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;',
+      '&#106 &#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;',
+      '&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058',
+      '&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A;',
+      'jav&#x09;ascript:alert();',
+      // 'jav\u0000ascript:alert();', CI fails on this one
+      'data:;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/',
+      'data:,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/',
+      'data:iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/',
+      'data:text/javascript;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/',
+      'data:application/x-msdownload;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/',
+    ];
+
+    for (const url of unsafeUrls) {
+      test(`unsafe ${url}`, () => {
+        expect(validateUrl(url).isValid).toBe(false);
+      });
+    }
+  });
+
+  describe('invalid urls', () => {
+    const invalidUrls = ['elastic.co', 'www.elastic.co', 'test', '', ' ', 'https://'];
+    for (const url of invalidUrls) {
+      test(`invalid ${url}`, () => {
+        expect(validateUrl(url).isValid).toBe(false);
+      });
+    }
+  });
+
+  describe('valid urls', () => {
+    const validUrls = [
+      'https://elastic.co',
+      'https://www.elastic.co',
+      'http://elastic',
+      'mailto:someone',
+    ];
+    for (const url of validUrls) {
+      test(`valid ${url}`, () => {
+        expect(validateUrl(url).isValid).toBe(true);
+      });
+    }
+  });
+});
+
+describe('validateUrlTemplate', () => {
+  test('domain in variable is allowed', () => {
+    expect(
+      validateUrlTemplate(
+        { template: '{{kibanaUrl}}/test' },
+        { kibanaUrl: 'http://localhost:5601/app' }
+      ).isValid
+    ).toBe(true);
+  });
+
+  test('unsafe domain in variable is not allowed', () => {
+    expect(
+      // eslint-disable-next-line no-script-url
+      validateUrlTemplate({ template: '{{kibanaUrl}}/test' }, { kibanaUrl: 'javascript:evil()' })
+        .isValid
+    ).toBe(false);
+  });
+
+  test('if missing variable then invalid', () => {
+    expect(
+      validateUrlTemplate({ template: '{{url}}/test' }, { kibanaUrl: 'http://localhost:5601/app' })
+        .isValid
+    ).toBe(false);
+  });
+});
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_validation.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_validation.ts
new file mode 100644
index 00000000000000..b32f5d84c67755
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_validation.ts
@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { UrlDrilldownConfig, UrlDrilldownScope } from './types';
+import { compile } from './url_template';
+
+const generalFormatError = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.urlDrilldownValidation.urlFormatGeneralErrorMessage',
+  {
+    defaultMessage: 'Invalid format. Example: {exampleUrl}',
+    values: {
+      exampleUrl: 'https://www.my-url.com/?{{event.key}}={{event.value}}',
+    },
+  }
+);
+
+const formatError = (message: string) =>
+  i18n.translate(
+    'xpack.uiActionsEnhanced.drilldowns.urlDrilldownValidation.urlFormatErrorMessage',
+    {
+      defaultMessage: 'Invalid format: {message}',
+      values: {
+        message,
+      },
+    }
+  );
+
+const SAFE_URL_PATTERN = /^(?:(?:https?|mailto):|[^&:/?#]*(?:[/?#]|$))/gi;
+export function validateUrl(url: string): { isValid: boolean; error?: string } {
+  if (!url)
+    return {
+      isValid: false,
+      error: generalFormatError,
+    };
+
+  try {
+    new URL(url);
+    if (!url.match(SAFE_URL_PATTERN)) throw new Error();
+    return { isValid: true };
+  } catch (e) {
+    return {
+      isValid: false,
+      error: generalFormatError,
+    };
+  }
+}
+
+export function validateUrlTemplate(
+  urlTemplate: UrlDrilldownConfig['url'],
+  scope: UrlDrilldownScope
+): { isValid: boolean; error?: string } {
+  if (!urlTemplate.template)
+    return {
+      isValid: false,
+      error: generalFormatError,
+    };
+
+  try {
+    const compiledUrl = compile(urlTemplate.template, scope);
+    return validateUrl(compiledUrl);
+  } catch (e) {
+    return {
+      isValid: false,
+      error: formatError(e.message),
+    };
+  }
+}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts
index a07fed8486438a..032a4a63fe2e9d 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.test.ts
@@ -7,6 +7,7 @@
 import { ActionFactory } from './action_factory';
 import { ActionFactoryDefinition } from './action_factory_definition';
 import { licensingMock } from '../../../licensing/public/mocks';
+import { PublicLicense } from '../../../licensing/public';
 
 const def: ActionFactoryDefinition = {
   id: 'ACTION_FACTORY_1',
@@ -22,34 +23,94 @@ const def: ActionFactoryDefinition = {
   supportedTriggers: () => [],
 };
 
+const featureUsage = licensingMock.createStart().featureUsage;
+
+const createActionFactory = (
+  defOverride: Partial<ActionFactoryDefinition> = {},
+  license?: Partial<PublicLicense>
+) => {
+  return new ActionFactory(
+    { ...def, ...defOverride },
+    {
+      getLicense: () => licensingMock.createLicense({ license }),
+      getFeatureUsageStart: () => featureUsage,
+    }
+  );
+};
+
 describe('License & ActionFactory', () => {
   test('no license requirements', async () => {
-    const factory = new ActionFactory(def, () => licensingMock.createLicense());
+    const factory = createActionFactory();
     expect(await factory.isCompatible({ triggers: [] })).toBe(true);
-    expect(factory.isCompatibleLicence()).toBe(true);
+    expect(factory.isCompatibleLicense()).toBe(true);
   });
 
   test('not enough license level', async () => {
-    const factory = new ActionFactory({ ...def, minimalLicense: 'gold' }, () =>
-      licensingMock.createLicense()
-    );
+    const factory = createActionFactory({ minimalLicense: 'gold', licenseFeatureName: 'Feature' });
     expect(await factory.isCompatible({ triggers: [] })).toBe(true);
-    expect(factory.isCompatibleLicence()).toBe(false);
+    expect(factory.isCompatibleLicense()).toBe(false);
   });
 
-  test('licence has expired', async () => {
-    const factory = new ActionFactory({ ...def, minimalLicense: 'gold' }, () =>
-      licensingMock.createLicense({ license: { type: 'gold', status: 'expired' } })
+  test('license has expired', async () => {
+    const factory = createActionFactory(
+      { minimalLicense: 'gold', licenseFeatureName: 'Feature' },
+      { type: 'gold', status: 'expired' }
     );
     expect(await factory.isCompatible({ triggers: [] })).toBe(true);
-    expect(factory.isCompatibleLicence()).toBe(false);
+    expect(factory.isCompatibleLicense()).toBe(false);
   });
 
   test('enough license level', async () => {
-    const factory = new ActionFactory({ ...def, minimalLicense: 'gold' }, () =>
-      licensingMock.createLicense({ license: { type: 'gold' } })
+    const factory = createActionFactory(
+      { minimalLicense: 'gold', licenseFeatureName: 'Feature' },
+      { type: 'gold' }
     );
+
     expect(await factory.isCompatible({ triggers: [] })).toBe(true);
-    expect(factory.isCompatibleLicence()).toBe(true);
+    expect(factory.isCompatibleLicense()).toBe(true);
+  });
+
+  describe('licenseFeatureName', () => {
+    test('licenseFeatureName is required, if minimalLicense is provided', () => {
+      expect(() => {
+        createActionFactory();
+      }).not.toThrow();
+
+      expect(() => {
+        createActionFactory({ minimalLicense: 'gold', licenseFeatureName: 'feature' });
+      }).not.toThrow();
+
+      expect(() => {
+        createActionFactory({ minimalLicense: 'gold' });
+      }).toThrow();
+    });
+
+    test('"licenseFeatureName"', () => {
+      expect(
+        createActionFactory({ minimalLicense: 'gold', licenseFeatureName: 'feature' })
+          .licenseFeatureName
+      ).toBe('feature');
+      expect(createActionFactory().licenseFeatureName).toBeUndefined();
+    });
+  });
+
+  describe('notifyFeatureUsage', () => {
+    const spy = jest.spyOn(featureUsage, 'notifyUsage');
+    beforeEach(() => {
+      spy.mockClear();
+    });
+    test('is not called if no license requirements', async () => {
+      const action = createActionFactory().create({ name: 'fake', config: {} });
+      await action.execute({});
+      expect(spy).not.toBeCalled();
+    });
+    test('is called if has license requirements', async () => {
+      const action = createActionFactory({
+        minimalLicense: 'gold',
+        licenseFeatureName: 'feature',
+      }).create({ name: 'fake', config: {} });
+      await action.execute({});
+      expect(spy).toBeCalledWith('feature');
+    });
   });
 });
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
index 35e06ab036fc97..35a82adf9896dd 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
@@ -13,9 +13,14 @@ import {
 import { ActionFactoryDefinition } from './action_factory_definition';
 import { Configurable } from '../../../../../src/plugins/kibana_utils/public';
 import { BaseActionFactoryContext, SerializedAction } from './types';
-import { ILicense } from '../../../licensing/public';
+import { ILicense, LicensingPluginStart } from '../../../licensing/public';
 import { UiActionsActionDefinition as ActionDefinition } from '../../../../../src/plugins/ui_actions/public';
 
+export interface ActionFactoryDeps {
+  readonly getLicense: () => ILicense;
+  readonly getFeatureUsageStart: () => LicensingPluginStart['featureUsage'];
+}
+
 export class ActionFactory<
   Config extends object = object,
   SupportedTriggers extends TriggerId = TriggerId,
@@ -31,11 +36,18 @@ export class ActionFactory<
       FactoryContext,
       ActionContext
     >,
-    protected readonly getLicence: () => ILicense
-  ) {}
+    protected readonly deps: ActionFactoryDeps
+  ) {
+    if (def.minimalLicense && !def.licenseFeatureName) {
+      throw new Error(
+        `ActionFactory [actionFactory.id = ${def.id}] "licenseFeatureName" is required, if "minimalLicense" is provided`
+      );
+    }
+  }
 
   public readonly id = this.def.id;
   public readonly minimalLicense = this.def.minimalLicense;
+  public readonly licenseFeatureName = this.def.licenseFeatureName;
   public readonly order = this.def.order || 0;
   public readonly MenuItem? = this.def.MenuItem;
   public readonly ReactMenuItem? = this.MenuItem ? uiToReactComponent(this.MenuItem) : undefined;
@@ -65,13 +77,13 @@ export class ActionFactory<
   }
 
   /**
-   * Does this action factory licence requirements
+   * Does this action factory license requirements
    * compatible with current license?
    */
-  public isCompatibleLicence() {
+  public isCompatibleLicense() {
     if (!this.minimalLicense) return true;
-    const licence = this.getLicence();
-    return licence.isAvailable && licence.isActive && licence.hasAtLeast(this.minimalLicense);
+    const license = this.deps.getLicense();
+    return license.isAvailable && license.isActive && license.hasAtLeast(this.minimalLicense);
   }
 
   public create(
@@ -81,14 +93,31 @@ export class ActionFactory<
     return {
       ...action,
       isCompatible: async (context: ActionContext): Promise<boolean> => {
-        if (!this.isCompatibleLicence()) return false;
+        if (!this.isCompatibleLicense()) return false;
         if (!action.isCompatible) return true;
         return action.isCompatible(context);
       },
+      execute: async (context: ActionContext): Promise<void> => {
+        this.notifyFeatureUsage();
+        return action.execute(context);
+      },
     };
   }
 
   public supportedTriggers(): SupportedTriggers[] {
     return this.def.supportedTriggers();
   }
+
+  private notifyFeatureUsage(): void {
+    if (!this.minimalLicense || !this.licenseFeatureName) return;
+    this.deps
+      .getFeatureUsageStart()
+      .notifyUsage(this.licenseFeatureName)
+      .catch(() => {
+        // eslint-disable-next-line no-console
+        console.warn(
+          `ActionFactory [actionFactory.id = ${this.def.id}] fail notify feature usage.`
+        );
+      });
+  }
 }
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts
index d79614e47ccd4e..91b8c8ec1e5eff 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory_definition.ts
@@ -34,11 +34,18 @@ export interface ActionFactoryDefinition<
   id: string;
 
   /**
-   * Minimal licence level
-   * Empty means no licence restrictions
+   * Minimal license level
+   * Empty means no license restrictions
    */
   readonly minimalLicense?: LicenseType;
 
+  /**
+   * Required when `minimalLicense` is used.
+   * Is a user-facing string. Has to be unique. Doesn't need i18n.
+   * The feature's name will be displayed to Cloud end-users when they're billed based on their feature usage.
+   */
+  licenseFeatureName?: string;
+
   /**
    * This method should return a definition of a new action, normally used to
    * register it in `ui_actions` registry.
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.test.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.test.ts
index 0b0cd39e35e25f..39d9dfeca2fd6c 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.test.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.test.ts
@@ -87,7 +87,9 @@ const setup = (
     actions,
   });
   const uiActionsEnhancements = new UiActionsServiceEnhancements({
-    getLicenseInfo,
+    getLicense: getLicenseInfo,
+    featureUsageSetup: licensingMock.createSetup().featureUsage,
+    getFeatureUsageStart: () => licensingMock.createStart().featureUsage,
   });
   const manager = new DynamicActionManager({
     isCompatible,
@@ -671,11 +673,13 @@ describe('DynamicActionManager', () => {
     const basicActionFactory: ActionFactoryDefinition = {
       ...actionFactoryDefinition1,
       minimalLicense: 'basic',
+      licenseFeatureName: 'Feature 1',
     };
 
     const goldActionFactory: ActionFactoryDefinition = {
       ...actionFactoryDefinition2,
       minimalLicense: 'gold',
+      licenseFeatureName: 'Feature 2',
     };
 
     uiActions.registerActionFactory(basicActionFactory);
diff --git a/x-pack/plugins/ui_actions_enhanced/public/index.ts b/x-pack/plugins/ui_actions_enhanced/public/index.ts
index a255bc28f5c68e..4a899b24852a96 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/index.ts
@@ -32,3 +32,4 @@ export {
 } from './dynamic_actions';
 
 export { DrilldownDefinition as UiActionsEnhancedDrilldownDefinition } from './drilldowns';
+export * from './drilldowns/url_drilldown';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/mocks.ts b/x-pack/plugins/ui_actions_enhanced/public/mocks.ts
index ff07d6e74a9c0b..17a6fc1b955dff 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/mocks.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/mocks.ts
@@ -11,6 +11,7 @@ import { embeddablePluginMock } from '../../../../src/plugins/embeddable/public/
 import { AdvancedUiActionsSetup, AdvancedUiActionsStart } from '.';
 import { plugin as pluginInitializer } from '.';
 import { licensingMock } from '../../licensing/public/mocks';
+import { StartDependencies } from './plugin';
 
 export type Setup = jest.Mocked<AdvancedUiActionsSetup>;
 export type Start = jest.Mocked<AdvancedUiActionsStart>;
@@ -35,7 +36,7 @@ const createStartContract = (): Start => {
 };
 
 const createPlugin = (
-  coreSetup: CoreSetup = coreMock.createSetup(),
+  coreSetup: CoreSetup<StartDependencies> = coreMock.createSetup(),
   coreStart: CoreStart = coreMock.createStart()
 ) => {
   const pluginInitializerContext = coreMock.createPluginInitializerContext();
@@ -47,6 +48,7 @@ const createPlugin = (
   const setup = plugin.setup(coreSetup, {
     uiActions: uiActions.setup,
     embeddable: embeddable.setup,
+    licensing: licensingMock.createSetup(),
   });
 
   return {
diff --git a/x-pack/plugins/ui_actions_enhanced/public/plugin.ts b/x-pack/plugins/ui_actions_enhanced/public/plugin.ts
index 5069b485b198d0..015531aab97437 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/plugin.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/plugin.ts
@@ -36,16 +36,17 @@ import {
 } from './custom_time_range_badge';
 import { CommonlyUsedRange } from './types';
 import { UiActionsServiceEnhancements } from './services';
-import { ILicense, LicensingPluginStart } from '../../licensing/public';
+import { ILicense, LicensingPluginSetup, LicensingPluginStart } from '../../licensing/public';
 import { createFlyoutManageDrilldowns } from './drilldowns';
-import { Storage } from '../../../../src/plugins/kibana_utils/public';
+import { createStartServicesGetter, Storage } from '../../../../src/plugins/kibana_utils/public';
 
 interface SetupDependencies {
   embeddable: EmbeddableSetup; // Embeddable are needed because they register basic triggers/actions.
   uiActions: UiActionsSetup;
+  licensing: LicensingPluginSetup;
 }
 
-interface StartDependencies {
+export interface StartDependencies {
   embeddable: EmbeddableStart;
   uiActions: UiActionsStart;
   licensing: LicensingPluginStart;
@@ -70,23 +71,30 @@ declare module '../../../../src/plugins/ui_actions/public' {
 
 export class AdvancedUiActionsPublicPlugin
   implements Plugin<SetupContract, StartContract, SetupDependencies, StartDependencies> {
-  readonly licenceInfo = new BehaviorSubject<ILicense | undefined>(undefined);
+  readonly licenseInfo = new BehaviorSubject<ILicense | undefined>(undefined);
   private getLicenseInfo(): ILicense {
-    if (!this.licenceInfo.getValue()) {
+    if (!this.licenseInfo.getValue()) {
       throw new Error(
-        'AdvancedUiActionsPublicPlugin: Licence is not ready! Licence becomes available only after setup.'
+        'AdvancedUiActionsPublicPlugin: License is not ready! License becomes available only after setup.'
       );
     }
-    return this.licenceInfo.getValue()!;
+    return this.licenseInfo.getValue()!;
   }
-  private readonly enhancements = new UiActionsServiceEnhancements({
-    getLicenseInfo: () => this.getLicenseInfo(),
-  });
+  private enhancements?: UiActionsServiceEnhancements;
   private subs: Subscription[] = [];
 
   constructor(initializerContext: PluginInitializerContext) {}
 
-  public setup(core: CoreSetup, { uiActions }: SetupDependencies): SetupContract {
+  public setup(
+    core: CoreSetup<StartDependencies>,
+    { uiActions, licensing }: SetupDependencies
+  ): SetupContract {
+    const startServices = createStartServicesGetter(core.getStartServices);
+    this.enhancements = new UiActionsServiceEnhancements({
+      getLicense: () => this.getLicenseInfo(),
+      featureUsageSetup: licensing.featureUsage,
+      getFeatureUsageStart: () => startServices().plugins.licensing.featureUsage,
+    });
     return {
       ...uiActions,
       ...this.enhancements,
@@ -94,7 +102,7 @@ export class AdvancedUiActionsPublicPlugin
   }
 
   public start(core: CoreStart, { uiActions, licensing }: StartDependencies): StartContract {
-    this.subs.push(licensing.license$.subscribe(this.licenceInfo));
+    this.subs.push(licensing.license$.subscribe(this.licenseInfo));
 
     const dateFormat = core.uiSettings.get('dateFormat') as string;
     const commonlyUsedRanges = core.uiSettings.get(
@@ -117,9 +125,9 @@ export class AdvancedUiActionsPublicPlugin
 
     return {
       ...uiActions,
-      ...this.enhancements,
+      ...this.enhancements!,
       FlyoutManageDrilldowns: createFlyoutManageDrilldowns({
-        actionFactories: this.enhancements.getActionFactories(),
+        actionFactories: this.enhancements!.getActionFactories(),
         getTrigger: (triggerId: TriggerId) => uiActions.getTrigger(triggerId),
         storage: new Storage(window?.localStorage),
         toastService: core.notifications.toasts,
diff --git a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.test.ts b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.test.ts
index 08823833b9af28..3a0b65d2ed8446 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.test.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.test.ts
@@ -4,11 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { UiActionsServiceEnhancements } from './ui_actions_service_enhancements';
+import {
+  UiActionsServiceEnhancements,
+  UiActionsServiceEnhancementsParams,
+} from './ui_actions_service_enhancements';
 import { ActionFactoryDefinition, ActionFactory } from '../dynamic_actions';
 import { licensingMock } from '../../../licensing/public/mocks';
 
-const getLicenseInfo = () => licensingMock.createLicense();
+const deps: UiActionsServiceEnhancementsParams = {
+  getLicense: () => licensingMock.createLicense(),
+  featureUsageSetup: licensingMock.createSetup().featureUsage,
+  getFeatureUsageStart: () => licensingMock.createStart().featureUsage,
+};
 
 describe('UiActionsService', () => {
   describe('action factories', () => {
@@ -34,7 +41,7 @@ describe('UiActionsService', () => {
     };
 
     test('.getActionFactories() returns empty array if no action factories registered', () => {
-      const service = new UiActionsServiceEnhancements({ getLicenseInfo });
+      const service = new UiActionsServiceEnhancements(deps);
 
       const factories = service.getActionFactories();
 
@@ -42,7 +49,7 @@ describe('UiActionsService', () => {
     });
 
     test('can register and retrieve an action factory', () => {
-      const service = new UiActionsServiceEnhancements({ getLicenseInfo });
+      const service = new UiActionsServiceEnhancements(deps);
 
       service.registerActionFactory(factoryDefinition1);
 
@@ -53,7 +60,7 @@ describe('UiActionsService', () => {
     });
 
     test('can retrieve all action factories', () => {
-      const service = new UiActionsServiceEnhancements({ getLicenseInfo });
+      const service = new UiActionsServiceEnhancements(deps);
 
       service.registerActionFactory(factoryDefinition1);
       service.registerActionFactory(factoryDefinition2);
@@ -67,7 +74,7 @@ describe('UiActionsService', () => {
     });
 
     test('throws when retrieving action factory that does not exist', () => {
-      const service = new UiActionsServiceEnhancements({ getLicenseInfo });
+      const service = new UiActionsServiceEnhancements(deps);
 
       service.registerActionFactory(factoryDefinition1);
 
@@ -77,7 +84,7 @@ describe('UiActionsService', () => {
     });
 
     test('isCompatible from definition is used on registered factory', async () => {
-      const service = new UiActionsServiceEnhancements({ getLicenseInfo });
+      const service = new UiActionsServiceEnhancements(deps);
 
       service.registerActionFactory({
         ...factoryDefinition1,
@@ -88,5 +95,27 @@ describe('UiActionsService', () => {
         service.getActionFactory(factoryDefinition1.id).isCompatible({ triggers: [] })
       ).resolves.toBe(false);
     });
+
+    describe('registerFeature for licensing', () => {
+      const spy = jest.spyOn(deps.featureUsageSetup, 'register');
+      beforeEach(() => {
+        spy.mockClear();
+      });
+      test('registerFeature is not called if no license requirements', () => {
+        const service = new UiActionsServiceEnhancements(deps);
+        service.registerActionFactory(factoryDefinition1);
+        expect(spy).not.toBeCalled();
+      });
+
+      test('registerFeature is called if has license requirements', () => {
+        const service = new UiActionsServiceEnhancements(deps);
+        service.registerActionFactory({
+          ...factoryDefinition1,
+          minimalLicense: 'gold',
+          licenseFeatureName: 'a name',
+        });
+        expect(spy).toBeCalledWith('a name', 'gold');
+      });
+    });
   });
 });
diff --git a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
index 95753295148356..b8086c16f5e714 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
@@ -13,19 +13,22 @@ import {
 import { DrilldownDefinition } from '../drilldowns';
 import { ILicense } from '../../../licensing/common/types';
 import { TriggerContextMapping, TriggerId } from '../../../../../src/plugins/ui_actions/public';
+import { LicensingPluginSetup, LicensingPluginStart } from '../../../licensing/public';
 
 export interface UiActionsServiceEnhancementsParams {
   readonly actionFactories?: ActionFactoryRegistry;
-  readonly getLicenseInfo: () => ILicense;
+  readonly getLicense: () => ILicense;
+  readonly featureUsageSetup: LicensingPluginSetup['featureUsage'];
+  readonly getFeatureUsageStart: () => LicensingPluginStart['featureUsage'];
 }
 
 export class UiActionsServiceEnhancements {
   protected readonly actionFactories: ActionFactoryRegistry;
-  protected readonly getLicenseInfo: () => ILicense;
+  protected readonly deps: Omit<UiActionsServiceEnhancementsParams, 'actionFactories'>;
 
-  constructor({ actionFactories = new Map(), getLicenseInfo }: UiActionsServiceEnhancementsParams) {
+  constructor({ actionFactories = new Map(), ...deps }: UiActionsServiceEnhancementsParams) {
     this.actionFactories = actionFactories;
-    this.getLicenseInfo = getLicenseInfo;
+    this.deps = deps;
   }
 
   /**
@@ -51,9 +54,10 @@ export class UiActionsServiceEnhancements {
       SupportedTriggers,
       FactoryContext,
       ActionContext
-    >(definition, this.getLicenseInfo);
+    >(definition, this.deps);
 
     this.actionFactories.set(actionFactory.id, actionFactory as ActionFactory<any, any, any>);
+    this.registerFeatureUsage(definition);
   };
 
   public readonly getActionFactory = (actionFactoryId: string): ActionFactory => {
@@ -94,6 +98,7 @@ export class UiActionsServiceEnhancements {
     execute,
     getHref,
     minimalLicense,
+    licenseFeatureName,
     supportedTriggers,
     isCompatible,
   }: DrilldownDefinition<Config, SupportedTriggers, FactoryContext, ExecutionContext>): void => {
@@ -105,6 +110,7 @@ export class UiActionsServiceEnhancements {
     > = {
       id: factoryId,
       minimalLicense,
+      licenseFeatureName,
       order,
       CollectConfig,
       createConfig,
@@ -128,4 +134,19 @@ export class UiActionsServiceEnhancements {
 
     this.registerActionFactory(actionFactory);
   };
+
+  private registerFeatureUsage = (definition: ActionFactoryDefinition<any, any, any>): void => {
+    if (!definition.minimalLicense || !definition.licenseFeatureName) return;
+
+    // Intentionally don't wait for response because
+    // happens in setup phase and has to be sync
+    this.deps.featureUsageSetup
+      .register(definition.licenseFeatureName, definition.minimalLicense)
+      .catch(() => {
+        // eslint-disable-next-line no-console
+        console.warn(
+          `ActionFactory [actionFactory.id = ${definition.id}] fail to register feature for featureUsage.`
+        );
+      });
+  };
 }
diff --git a/x-pack/plugins/ui_actions_enhanced/scripts/storybook.js b/x-pack/plugins/ui_actions_enhanced/scripts/storybook.js
index 1e3ab0d96b81c8..bf43167a3ae517 100644
--- a/x-pack/plugins/ui_actions_enhanced/scripts/storybook.js
+++ b/x-pack/plugins/ui_actions_enhanced/scripts/storybook.js
@@ -9,8 +9,5 @@ import { join } from 'path';
 // eslint-disable-next-line
 require('@kbn/storybook').runStorybookCli({
   name: 'ui_actions_enhanced',
-  storyGlobs: [
-    join(__dirname, '..', 'public', 'components', '**', '*.story.tsx'),
-    join(__dirname, '..', 'public', 'drilldowns', 'components', '**', '*.story.tsx'),
-  ],
+  storyGlobs: [join(__dirname, '..', 'public', '**', '*.story.tsx')],
 });
diff --git a/x-pack/plugins/uptime/public/breadcrumbs.ts b/x-pack/plugins/uptime/public/breadcrumbs.ts
deleted file mode 100644
index 41bc2aa2588073..00000000000000
--- a/x-pack/plugins/uptime/public/breadcrumbs.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
diff --git a/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/donut_chart.test.tsx.snap b/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/donut_chart.test.tsx.snap
index cf80d2de38b3f8..261f3a016d4db5 100644
--- a/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/donut_chart.test.tsx.snap
+++ b/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/donut_chart.test.tsx.snap
@@ -44,18 +44,23 @@ exports[`DonutChart component passes correct props without errors for valid prop
             },
           },
           "axes": Object {
-            "axisLineStyle": Object {
+            "axisLine": Object {
               "stroke": "#eaeaea",
               "strokeWidth": 1,
+              "visible": true,
             },
-            "axisTitleStyle": Object {
+            "axisTitle": Object {
               "fill": "#333",
               "fontFamily": "sans-serif",
               "fontSize": 12,
               "fontStyle": "bold",
-              "padding": 8,
+              "padding": Object {
+                "inner": 8,
+                "outer": 0,
+              },
+              "visible": true,
             },
-            "gridLineStyle": Object {
+            "gridLine": Object {
               "horizontal": Object {
                 "dash": Array [
                   0,
@@ -64,7 +69,7 @@ exports[`DonutChart component passes correct props without errors for valid prop
                 "opacity": 1,
                 "stroke": "#D3DAE6",
                 "strokeWidth": 1,
-                "visible": true,
+                "visible": false,
               },
               "vertical": Object {
                 "dash": Array [
@@ -74,17 +79,30 @@ exports[`DonutChart component passes correct props without errors for valid prop
                 "opacity": 1,
                 "stroke": "#D3DAE6",
                 "strokeWidth": 1,
-                "visible": true,
+                "visible": false,
               },
             },
-            "tickLabelStyle": Object {
+            "tickLabel": Object {
+              "alignment": Object {
+                "horizontal": "near",
+                "vertical": "near",
+              },
               "fill": "#777",
               "fontFamily": "sans-serif",
               "fontSize": 10,
               "fontStyle": "normal",
-              "padding": 4,
+              "offset": Object {
+                "reference": "local",
+                "x": 0,
+                "y": 0,
+              },
+              "padding": 0,
+              "rotation": 0,
+              "visible": true,
             },
-            "tickLineStyle": Object {
+            "tickLine": Object {
+              "padding": 10,
+              "size": 10,
               "stroke": "#eaeaea",
               "strokeWidth": 1,
               "visible": true,
@@ -164,6 +182,7 @@ exports[`DonutChart component passes correct props without errors for valid prop
           },
           "legend": Object {
             "horizontalHeight": 64,
+            "margin": 0,
             "spacingBuffer": 10,
             "verticalWidth": 200,
           },
@@ -217,17 +236,20 @@ exports[`DonutChart component passes correct props without errors for valid prop
             },
           },
           "axes": Object {
-            "axisLineStyle": Object {
+            "axisLine": Object {
               "stroke": "rgba(238, 240, 243, 1)",
             },
-            "axisTitleStyle": Object {
+            "axisTitle": Object {
               "fill": "rgba(52, 55, 65, 1)",
               "fontFamily": "'Inter UI', -apple-system, BlinkMacSystemFont,
   'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'",
               "fontSize": 12,
-              "padding": 10,
+              "padding": Object {
+                "inner": 10,
+                "outer": 0,
+              },
             },
-            "gridLineStyle": Object {
+            "gridLine": Object {
               "horizontal": Object {
                 "dash": Array [
                   0,
@@ -249,14 +271,17 @@ exports[`DonutChart component passes correct props without errors for valid prop
                 "visible": true,
               },
             },
-            "tickLabelStyle": Object {
+            "tickLabel": Object {
               "fill": "rgba(105, 112, 125, 1)",
               "fontFamily": "'Inter UI', -apple-system, BlinkMacSystemFont,
   'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'",
               "fontSize": 10,
-              "padding": 8,
+              "padding": Object {
+                "inner": 10,
+                "outer": 8,
+              },
             },
-            "tickLineStyle": Object {
+            "tickLine": Object {
               "stroke": "rgba(238, 240, 243, 1)",
               "strokeWidth": 1,
               "visible": false,
diff --git a/x-pack/plugins/uptime/server/lib/alerts/duration_anomaly.ts b/x-pack/plugins/uptime/server/lib/alerts/duration_anomaly.ts
index 9ed453d2862854..568b0873b8dbb8 100644
--- a/x-pack/plugins/uptime/server/lib/alerts/duration_anomaly.ts
+++ b/x-pack/plugins/uptime/server/lib/alerts/duration_anomaly.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { KibanaRequest } from 'kibana/server';
 import moment from 'moment';
 import { schema } from '@kbn/config-schema';
-import { ILegacyScopedClusterClient } from 'kibana/server';
 import { updateState } from './common';
 import { ACTION_GROUP_DEFINITIONS } from '../../../common/constants/alerts';
 import { commonStateTranslations, durationAnomalyTranslations } from './translations';
@@ -36,13 +36,11 @@ export const getAnomalySummary = (anomaly: AnomaliesTableRecord, monitorInfo: Pi
 
 const getAnomalies = async (
   plugins: UptimeCorePlugins,
-  mlClusterClient: ILegacyScopedClusterClient,
   params: Record<any, any>,
   lastCheckedAt: string
 ) => {
-  const { getAnomaliesTableData } = plugins.ml.resultsServiceProvider(mlClusterClient, {
-    params: 'DummyKibanaRequest',
-  } as any);
+  const fakeRequest = {} as KibanaRequest;
+  const { getAnomaliesTableData } = plugins.ml.resultsServiceProvider(fakeRequest);
 
   return await getAnomaliesTableData(
     [getMLJobId(params.monitorId)],
@@ -82,23 +80,12 @@ export const durationAnomalyAlertFactory: UptimeAlertTypeFactory = (_server, _li
   producer: 'uptime',
   async executor(options) {
     const {
-      services: {
-        alertInstanceFactory,
-        callCluster,
-        savedObjectsClient,
-        getLegacyScopedClusterClient,
-      },
+      services: { alertInstanceFactory, callCluster, savedObjectsClient },
       state,
       params,
     } = options;
 
-    const { anomalies } =
-      (await getAnomalies(
-        plugins,
-        getLegacyScopedClusterClient(plugins.ml.mlClient),
-        params,
-        state.lastCheckedAt
-      )) ?? {};
+    const { anomalies } = (await getAnomalies(plugins, params, state.lastCheckedAt)) ?? {};
 
     const foundAnomalies = anomalies?.length > 0;
 
diff --git a/x-pack/plugins/watcher/public/application/lib/api.ts b/x-pack/plugins/watcher/public/application/lib/api.ts
index 82ec2925ba6dca..4f42b26d51c46d 100644
--- a/x-pack/plugins/watcher/public/application/lib/api.ts
+++ b/x-pack/plugins/watcher/public/application/lib/api.ts
@@ -35,44 +35,53 @@ export const getSavedObjectsClient = () => savedObjectsClient;
 
 const basePath = ROUTES.API_ROOT;
 
+const loadWatchesDeserializer = ({ watches = [] }: { watches: any[] }) => {
+  return watches.map((watch: any) => Watch.fromUpstreamJson(watch));
+};
+
 export const useLoadWatches = (pollIntervalMs: number) => {
   return useRequest({
     path: `${basePath}/watches`,
     method: 'get',
     pollIntervalMs,
-    deserializer: ({ watches = [] }: { watches: any[] }) => {
-      return watches.map((watch: any) => Watch.fromUpstreamJson(watch));
-    },
+    deserializer: loadWatchesDeserializer,
   });
 };
 
+const loadWatchDetailDeserializer = ({ watch = {} }: { watch: any }) =>
+  Watch.fromUpstreamJson(watch);
+
 export const useLoadWatchDetail = (id: string) => {
   return useRequest({
     path: `${basePath}/watch/${id}`,
     method: 'get',
-    deserializer: ({ watch = {} }: { watch: any }) => Watch.fromUpstreamJson(watch),
+    deserializer: loadWatchDetailDeserializer,
   });
 };
 
+const loadWatchHistoryDeserializer = ({ watchHistoryItems = [] }: { watchHistoryItems: any }) => {
+  return watchHistoryItems.map((historyItem: any) =>
+    WatchHistoryItem.fromUpstreamJson(historyItem)
+  );
+};
+
 export const useLoadWatchHistory = (id: string, startTime: string) => {
   return useRequest({
     query: startTime ? { startTime } : undefined,
     path: `${basePath}/watch/${id}/history`,
     method: 'get',
-    deserializer: ({ watchHistoryItems = [] }: { watchHistoryItems: any }) => {
-      return watchHistoryItems.map((historyItem: any) =>
-        WatchHistoryItem.fromUpstreamJson(historyItem)
-      );
-    },
+    deserializer: loadWatchHistoryDeserializer,
   });
 };
 
+const loadWatchHistoryDetailDeserializer = ({ watchHistoryItem }: { watchHistoryItem: any }) =>
+  WatchHistoryItem.fromUpstreamJson(watchHistoryItem);
+
 export const useLoadWatchHistoryDetail = (id: string | undefined) => {
   return useRequest({
     path: !id ? '' : `${basePath}/history/${id}`,
     method: 'get',
-    deserializer: ({ watchHistoryItem }: { watchHistoryItem: any }) =>
-      WatchHistoryItem.fromUpstreamJson(watchHistoryItem),
+    deserializer: loadWatchHistoryDetailDeserializer,
   });
 };
 
@@ -148,6 +157,8 @@ export const loadIndexPatterns = async () => {
   return savedObjects;
 };
 
+const getWatchVisualizationDataDeserializer = (data: { visualizeData: any }) => data?.visualizeData;
+
 export const useGetWatchVisualizationData = (watchModel: BaseWatch, visualizeOptions: any) => {
   return useRequest({
     path: `${basePath}/watch/visualize`,
@@ -156,21 +167,23 @@ export const useGetWatchVisualizationData = (watchModel: BaseWatch, visualizeOpt
       watch: watchModel.upstreamJson,
       options: visualizeOptions.upstreamJson,
     }),
-    deserializer: (data: { visualizeData: any }) => data?.visualizeData,
+    deserializer: getWatchVisualizationDataDeserializer,
   });
 };
 
+const loadSettingsDeserializer = (data: {
+  action_types: {
+    [key: string]: {
+      enabled: boolean;
+    };
+  };
+}) => Settings.fromUpstreamJson(data);
+
 export const useLoadSettings = () => {
   return useRequest({
     path: `${basePath}/settings`,
     method: 'get',
-    deserializer: (data: {
-      action_types: {
-        [key: string]: {
-          enabled: boolean;
-        };
-      };
-    }) => Settings.fromUpstreamJson(data),
+    deserializer: loadSettingsDeserializer,
   });
 };
 
diff --git a/x-pack/plugins/watcher/public/application/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx b/x-pack/plugins/watcher/public/application/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx
index c0d906114277e5..2ff0f53d07e916 100644
--- a/x-pack/plugins/watcher/public/application/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx
+++ b/x-pack/plugins/watcher/public/application/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { Fragment, useContext, useEffect } from 'react';
+import React, { Fragment, useContext, useEffect, useMemo } from 'react';
 import {
   AnnotationDomainTypes,
   Axis,
@@ -105,7 +105,9 @@ export const WatchVisualization = () => {
     threshold,
   } = watch;
 
-  const domain = getDomain(watch);
+  // Only recalculate the domain if the watch configuration changes. This prevents the visualization
+  // request's resolution from re-triggering itself in an infinite loop.
+  const domain = useMemo(() => getDomain(watch), [watch]);
   const timeBuckets = createTimeBuckets();
   timeBuckets.setBounds(domain);
   const interval = timeBuckets.getInterval().expression;
diff --git a/x-pack/plugins/watcher/public/application/shared_imports.ts b/x-pack/plugins/watcher/public/application/shared_imports.ts
index a9e07b80a9b221..766e8e659c8aeb 100644
--- a/x-pack/plugins/watcher/public/application/shared_imports.ts
+++ b/x-pack/plugins/watcher/public/application/shared_imports.ts
@@ -10,6 +10,6 @@ export {
   UseRequestConfig,
   sendRequest,
   useRequest,
-} from '../../../../../src/plugins/es_ui_shared/public/';
+} from '../../../../../src/plugins/es_ui_shared/public';
 
 export { useXJsonMode } from '../../../../../src/plugins/es_ui_shared/static/ace_x_json/hooks';
diff --git a/x-pack/scripts/functional_tests.js b/x-pack/scripts/functional_tests.js
index 421e709444d0f7..6271c4b6013071 100644
--- a/x-pack/scripts/functional_tests.js
+++ b/x-pack/scripts/functional_tests.js
@@ -56,7 +56,6 @@ const onlyNotInCoverageTests = [
   require.resolve('../test/upgrade_assistant_integration/config.js'),
   require.resolve('../test/licensing_plugin/config.ts'),
   require.resolve('../test/licensing_plugin/config.public.ts'),
-  require.resolve('../test/licensing_plugin/config.legacy.ts'),
   require.resolve('../test/endpoint_api_integration_no_ingest/config.ts'),
   require.resolve('../test/reporting_api_integration/reporting_and_security.config.ts'),
   require.resolve('../test/reporting_api_integration/reporting_without_security.config.ts'),
diff --git a/x-pack/test/alerting_api_integration/common/config.ts b/x-pack/test/alerting_api_integration/common/config.ts
index 67dd8c877e378f..f9fdfaed1c79b9 100644
--- a/x-pack/test/alerting_api_integration/common/config.ts
+++ b/x-pack/test/alerting_api_integration/common/config.ts
@@ -63,7 +63,7 @@ export function createTestConfig(name: string, options: CreateTestConfigOptions)
     const actionsProxyUrl = options.enableActionsProxy
       ? [
           `--xpack.actions.proxyUrl=http://localhost:${proxyPort}`,
-          '--xpack.actions.rejectUnauthorizedCertificates=false',
+          '--xpack.actions.proxyRejectUnauthorizedCertificates=false',
         ]
       : [];
 
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
index b927b563eb54a5..78ca2af12ec3f8 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
@@ -28,5 +28,8 @@ export default function alertingTests({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./alerts_space1'));
     loadTestFile(require.resolve('./alerts_default_space'));
     loadTestFile(require.resolve('./builtin_alert_types'));
+
+    // note that this test will destroy existing spaces
+    loadTestFile(require.resolve('./migrations'));
   });
 }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/migrations.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/migrations.ts
new file mode 100644
index 00000000000000..81f7c8c97ba8cc
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/migrations.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { getUrlPrefix } from '../../../common/lib';
+import { FtrProviderContext } from '../../../common/ftr_provider_context';
+
+// eslint-disable-next-line import/no-default-export
+export default function createGetTests({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
+
+  describe('migrations', () => {
+    before(async () => {
+      await esArchiver.load('alerts');
+    });
+
+    after(async () => {
+      await esArchiver.unload('alerts');
+    });
+
+    it('7.10.0 migrates the `alerting` consumer to be the `alerts`', async () => {
+      const response = await supertest.get(
+        `${getUrlPrefix(``)}/api/alerts/alert/74f3e6d7-b7bb-477d-ac28-92ee22728e6e`
+      );
+
+      expect(response.status).to.eql(200);
+      expect(response.body.consumer).to.equal('alerts');
+    });
+
+    it('7.10.0 migrates the `metrics` consumer to be the `infrastructure`', async () => {
+      const response = await supertest.get(
+        `${getUrlPrefix(``)}/api/alerts/alert/74f3e6d7-b7bb-477d-ac28-fdf248d5f2a4`
+      );
+
+      expect(response.status).to.eql(200);
+      expect(response.body.consumer).to.equal('infrastructure');
+    });
+  });
+}
diff --git a/x-pack/test/api_integration/apis/logstash/pipeline/delete.ts b/x-pack/test/api_integration/apis/logstash/pipeline/delete.ts
index 2a8cde85ee3cd9..e3d68ef690359e 100644
--- a/x-pack/test/api_integration/apis/logstash/pipeline/delete.ts
+++ b/x-pack/test/api_integration/apis/logstash/pipeline/delete.ts
@@ -18,7 +18,6 @@ export default function ({ getService }: FtrProviderContext) {
         .put('/api/logstash/pipeline/fast_generator')
         .set('kbn-xsrf', 'xxx')
         .send({
-          id: 'fast_generator',
           description: 'foobar baz',
           pipeline: 'input { generator {} }\n\n output { stdout {} }',
         })
diff --git a/x-pack/test/api_integration/apis/logstash/pipeline/save.ts b/x-pack/test/api_integration/apis/logstash/pipeline/save.ts
index f44c5e6252d5f6..1c2f23e81eafc0 100644
--- a/x-pack/test/api_integration/apis/logstash/pipeline/save.ts
+++ b/x-pack/test/api_integration/apis/logstash/pipeline/save.ts
@@ -26,7 +26,6 @@ export default function ({ getService }: FtrProviderContext) {
         .put('/api/logstash/pipeline/fast_generator')
         .set('kbn-xsrf', 'xxx')
         .send({
-          id: 'fast_generator',
           description: 'foobar baz',
           pipeline: 'input { generator {} }\n\n output { stdout {} }',
         })
diff --git a/x-pack/test/api_integration/apis/maps/get_tile.js b/x-pack/test/api_integration/apis/maps/get_tile.js
new file mode 100644
index 00000000000000..7219fc858e059c
--- /dev/null
+++ b/x-pack/test/api_integration/apis/maps/get_tile.js
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export default function ({ getService }) {
+  const supertest = getService('supertest');
+
+  describe('getTile', () => {
+    it('should validate params', async () => {
+      await supertest
+        .get(
+          `/api/maps/mvt/getTile?x=15&y=11&z=5&geometryFieldName=coordinates&index=logstash*&requestBody=(_source:(includes:!(coordinates)),docvalue_fields:!(),query:(bool:(filter:!((match_all:())),must:!(),must_not:!(),should:!())),script_fields:(),size:10000,stored_fields:!(coordinates))`
+        )
+        .set('kbn-xsrf', 'kibana')
+        .expect(200);
+    });
+
+    it('should not validate when required params are missing', async () => {
+      await supertest
+        .get(
+          `/api/maps/mvt/getTile?&index=logstash*&requestBody=(_source:(includes:!(coordinates)),docvalue_fields:!(),query:(bool:(filter:!((match_all:())),must:!(),must_not:!(),should:!())),script_fields:(),size:10000,stored_fields:!(coordinates))`
+        )
+        .set('kbn-xsrf', 'kibana')
+        .expect(400);
+    });
+  });
+}
diff --git a/x-pack/test/api_integration/apis/maps/index.js b/x-pack/test/api_integration/apis/maps/index.js
index f9dff19229645a..6c213380dd64e1 100644
--- a/x-pack/test/api_integration/apis/maps/index.js
+++ b/x-pack/test/api_integration/apis/maps/index.js
@@ -16,6 +16,7 @@ export default function ({ loadTestFile, getService }) {
       loadTestFile(require.resolve('./fonts_api'));
       loadTestFile(require.resolve('./index_settings'));
       loadTestFile(require.resolve('./migrations'));
+      loadTestFile(require.resolve('./get_tile'));
     });
   });
 }
diff --git a/x-pack/test/api_integration/apis/ml/data_frame_analytics/update.ts b/x-pack/test/api_integration/apis/ml/data_frame_analytics/update.ts
index f4964308cd8c95..7aa5c180c5a02c 100644
--- a/x-pack/test/api_integration/apis/ml/data_frame_analytics/update.ts
+++ b/x-pack/test/api_integration/apis/ml/data_frame_analytics/update.ts
@@ -258,7 +258,7 @@ export default ({ getService }: FtrProviderContext) => {
           description: 'Not found',
         };
         const id = `${jobId}_invalid`;
-        const message = `[resource_not_found_exception] No known data frame analytics with id [${id}]`;
+        const message = 'resource_not_found_exception';
 
         const { body } = await supertest
           .post(`/api/ml/data_frame/analytics/${id}/_update`)
diff --git a/x-pack/test/api_integration/apis/ml/data_visualizer/get_field_histograms.ts b/x-pack/test/api_integration/apis/ml/data_visualizer/get_field_histograms.ts
index 299f5f93fd2812..a5969bdffbf8a7 100644
--- a/x-pack/test/api_integration/apis/ml/data_visualizer/get_field_histograms.ts
+++ b/x-pack/test/api_integration/apis/ml/data_visualizer/get_field_histograms.ts
@@ -60,8 +60,7 @@ export default ({ getService }: FtrProviderContext) => {
       responseBody: {
         statusCode: 404,
         error: 'Not Found',
-        message:
-          '[index_not_found_exception] no such index [ft_farequote_not_exists], with { resource.type="index_or_alias" & resource.id="ft_farequote_not_exists" & index_uuid="_na_" & index="ft_farequote_not_exists" }',
+        message: 'index_not_found_exception',
       },
     },
   };
diff --git a/x-pack/test/api_integration/apis/ml/data_visualizer/get_field_stats.ts b/x-pack/test/api_integration/apis/ml/data_visualizer/get_field_stats.ts
index 5795eac9637b1e..4ec8ae0429a6bb 100644
--- a/x-pack/test/api_integration/apis/ml/data_visualizer/get_field_stats.ts
+++ b/x-pack/test/api_integration/apis/ml/data_visualizer/get_field_stats.ts
@@ -152,8 +152,7 @@ export default ({ getService }: FtrProviderContext) => {
       responseBody: {
         statusCode: 404,
         error: 'Not Found',
-        message:
-          '[index_not_found_exception] no such index [ft_farequote_not_exists], with { resource.type="index_or_alias" & resource.id="ft_farequote_not_exists" & index_uuid="_na_" & index="ft_farequote_not_exists" }',
+        message: 'index_not_found_exception',
       },
     },
   };
diff --git a/x-pack/test/api_integration/apis/ml/data_visualizer/get_overall_stats.ts b/x-pack/test/api_integration/apis/ml/data_visualizer/get_overall_stats.ts
index fa83807be161a6..af2c53c5772539 100644
--- a/x-pack/test/api_integration/apis/ml/data_visualizer/get_overall_stats.ts
+++ b/x-pack/test/api_integration/apis/ml/data_visualizer/get_overall_stats.ts
@@ -116,8 +116,7 @@ export default ({ getService }: FtrProviderContext) => {
         responseBody: {
           statusCode: 404,
           error: 'Not Found',
-          message:
-            '[index_not_found_exception] no such index [ft_farequote_not_exist], with { resource.type="index_or_alias" & resource.id="ft_farequote_not_exist" & index_uuid="_na_" & index="ft_farequote_not_exist" }',
+          message: 'index_not_found_exception',
         },
       },
     },
diff --git a/x-pack/test/api_integration/apis/ml/fields_service/field_cardinality.ts b/x-pack/test/api_integration/apis/ml/fields_service/field_cardinality.ts
index 627d9454beeb6f..7dbb4a9d03e4f8 100644
--- a/x-pack/test/api_integration/apis/ml/fields_service/field_cardinality.ts
+++ b/x-pack/test/api_integration/apis/ml/fields_service/field_cardinality.ts
@@ -78,8 +78,7 @@ export default ({ getService }: FtrProviderContext) => {
         responseBody: {
           statusCode: 404,
           error: 'Not Found',
-          message:
-            '[index_not_found_exception] no such index [ft_ecommerce_not_exist], with { resource.type="index_or_alias" & resource.id="ft_ecommerce_not_exist" & index_uuid="_na_" & index="ft_ecommerce_not_exist" }',
+          message: 'index_not_found_exception',
         },
       },
     },
diff --git a/x-pack/test/api_integration/apis/ml/fields_service/time_field_range.ts b/x-pack/test/api_integration/apis/ml/fields_service/time_field_range.ts
index b1c086ddbb456e..6588d4df570b75 100644
--- a/x-pack/test/api_integration/apis/ml/fields_service/time_field_range.ts
+++ b/x-pack/test/api_integration/apis/ml/fields_service/time_field_range.ts
@@ -81,8 +81,7 @@ export default ({ getService }: FtrProviderContext) => {
         responseBody: {
           statusCode: 404,
           error: 'Not Found',
-          message:
-            '[index_not_found_exception] no such index [ft_ecommerce_not_exist], with { resource.type="index_or_alias" & resource.id="ft_ecommerce_not_exist" & index_uuid="_na_" & index="ft_ecommerce_not_exist" }',
+          message: 'index_not_found_exception',
         },
       },
     },
diff --git a/x-pack/test/api_integration/apis/ml/filters/create_filters.ts b/x-pack/test/api_integration/apis/ml/filters/create_filters.ts
index dfec7798ffc0ce..598fab2cb7fa6d 100644
--- a/x-pack/test/api_integration/apis/ml/filters/create_filters.ts
+++ b/x-pack/test/api_integration/apis/ml/filters/create_filters.ts
@@ -73,7 +73,7 @@ export default ({ getService }: FtrProviderContext) => {
         responseCode: 400,
         responseBody: {
           error: 'Bad Request',
-          message: 'Invalid filter_id',
+          message: 'status_exception',
         },
       },
     },
diff --git a/x-pack/test/api_integration/apis/ml/filters/get_filters.ts b/x-pack/test/api_integration/apis/ml/filters/get_filters.ts
index 5d7900ea5e9d93..4a3589634ded93 100644
--- a/x-pack/test/api_integration/apis/ml/filters/get_filters.ts
+++ b/x-pack/test/api_integration/apis/ml/filters/get_filters.ts
@@ -91,7 +91,7 @@ export default ({ getService }: FtrProviderContext) => {
         .set(COMMON_REQUEST_HEADERS)
         .expect(400);
       expect(body.error).to.eql('Bad Request');
-      expect(body.message).to.contain('Unable to find filter');
+      expect(body.message).to.contain('resource_not_found_exception');
     });
   });
 };
diff --git a/x-pack/test/api_integration/apis/ml/filters/update_filters.ts b/x-pack/test/api_integration/apis/ml/filters/update_filters.ts
index fbbb94d54c035f..6f421ad120b510 100644
--- a/x-pack/test/api_integration/apis/ml/filters/update_filters.ts
+++ b/x-pack/test/api_integration/apis/ml/filters/update_filters.ts
@@ -111,7 +111,7 @@ export default ({ getService }: FtrProviderContext) => {
         .send(updateFilterRequestBody)
         .expect(400);
 
-      expect(body.message).to.contain('No filter with id');
+      expect(body.message).to.contain('resource_not_found_exception');
     });
   });
 };
diff --git a/x-pack/test/api_integration/apis/ml/jobs/close_jobs.ts b/x-pack/test/api_integration/apis/ml/jobs/close_jobs.ts
index 5b9c5393e81d91..0b7f9cf927d26b 100644
--- a/x-pack/test/api_integration/apis/ml/jobs/close_jobs.ts
+++ b/x-pack/test/api_integration/apis/ml/jobs/close_jobs.ts
@@ -47,8 +47,8 @@ export default ({ getService }: FtrProviderContext) => {
         responseCode: 200,
 
         responseBody: {
-          [SINGLE_METRIC_JOB_CONFIG.job_id]: { closed: false, error: { statusCode: 409 } },
-          [MULTI_METRIC_JOB_CONFIG.job_id]: { closed: false, error: { statusCode: 409 } },
+          [SINGLE_METRIC_JOB_CONFIG.job_id]: { closed: false, error: { status: 409 } },
+          [MULTI_METRIC_JOB_CONFIG.job_id]: { closed: false, error: { status: 409 } },
         },
       },
     },
@@ -162,9 +162,7 @@ export default ({ getService }: FtrProviderContext) => {
 
           expectedRspJobIds.forEach((id) => {
             expect(body[id].closed).to.eql(testData.expected.responseBody[id].closed);
-            expect(body[id].error.statusCode).to.eql(
-              testData.expected.responseBody[id].error.statusCode
-            );
+            expect(body[id].error.status).to.eql(testData.expected.responseBody[id].error.status);
           });
 
           // ensure jobs are still open
diff --git a/x-pack/test/api_integration/apis/security_solution/hosts.ts b/x-pack/test/api_integration/apis/security_solution/hosts.ts
index 2904935719d2ca..621718013db7f2 100644
--- a/x-pack/test/api_integration/apis/security_solution/hosts.ts
+++ b/x-pack/test/api_integration/apis/security_solution/hosts.ts
@@ -13,7 +13,7 @@ import {
   GetHostsTableQuery,
   HostsFields,
 } from '../../../../plugins/security_solution/public/graphql/types';
-import { HostOverviewQuery } from '../../../../plugins/security_solution/public/hosts/containers/hosts/overview/host_overview.gql_query';
+import { HostOverviewQuery } from '../../../../plugins/security_solution/public/hosts/containers/hosts/details/host_overview.gql_query';
 import { HostFirstLastSeenGqlQuery } from '../../../../plugins/security_solution/public/hosts/containers/hosts/first_last_seen/first_last_seen.gql_query';
 import { HostsTableQuery } from '../../../../plugins/security_solution/public/hosts/containers/hosts/hosts_table.gql_query';
 import { FtrProviderContext } from '../../ftr_provider_context';
diff --git a/x-pack/test/apm_api_integration/basic/fixtures/es_archiver/8.0.0/data.json.gz b/x-pack/test/apm_api_integration/basic/fixtures/es_archiver/8.0.0/data.json.gz
index e9360878b7bb72..aaa6232b0579aa 100644
Binary files a/x-pack/test/apm_api_integration/basic/fixtures/es_archiver/8.0.0/data.json.gz and b/x-pack/test/apm_api_integration/basic/fixtures/es_archiver/8.0.0/data.json.gz differ
diff --git a/x-pack/test/apm_api_integration/basic/tests/settings/agent_configuration.ts b/x-pack/test/apm_api_integration/basic/tests/settings/agent_configuration.ts
index 283540201b9b57..27023d16f57caa 100644
--- a/x-pack/test/apm_api_integration/basic/tests/settings/agent_configuration.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/settings/agent_configuration.ts
@@ -130,13 +130,24 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
 
       it('returns all services', async () => {
         const { body } = await getServices();
-        expect(body).to.eql(['ALL_OPTION_VALUE', 'client', 'opbeans-java', 'opbeans-node']);
+        expect(body).to.eql([
+          'ALL_OPTION_VALUE',
+          'client',
+          'opbeans-dotnet',
+          'opbeans-go',
+          'opbeans-java',
+          'opbeans-node',
+          'opbeans-python',
+          'opbeans-ruby',
+          'opbeans-rum',
+        ]);
       });
 
       it('returns the environments', async () => {
         const { body } = await getEnvironments('opbeans-node');
         expect(body).to.eql([
           { name: 'ALL_OPTION_VALUE', alreadyConfigured: false },
+          { name: 'testing', alreadyConfigured: false },
           { name: 'production', alreadyConfigured: false },
         ]);
       });
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts
index 5b61112a374c12..0b94abaa158909 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts
@@ -6,7 +6,6 @@
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 import expectedBreakdown from './expectation/breakdown.json';
-import expectedBreakdownWithTransactionName from './expectation/breakdown_transaction_name.json';
 
 export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
@@ -25,7 +24,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           `/api/apm/services/opbeans-node/transaction_groups/breakdown?start=${start}&end=${end}&uiFilters=${uiFilters}&transactionType=${transactionType}`
         );
         expect(response.status).to.be(200);
-        expect(response.body).to.eql({ kpis: [], timeseries: [] });
+        expect(response.body).to.eql({ timeseries: [] });
       });
     });
 
@@ -47,15 +46,32 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         );
 
         expect(response.status).to.be(200);
-        expect(response.body).to.eql(expectedBreakdownWithTransactionName);
+        const { timeseries } = response.body;
+        const { title, color, type, data, hideLegend, legendValue } = timeseries[0];
+        expect(data).to.eql([
+          { x: 1593413100000, y: null },
+          { x: 1593413130000, y: null },
+          { x: 1593413160000, y: null },
+          { x: 1593413190000, y: null },
+          { x: 1593413220000, y: null },
+          { x: 1593413250000, y: null },
+          { x: 1593413280000, y: null },
+          { x: 1593413310000, y: 1 },
+          { x: 1593413340000, y: null },
+        ]);
+        expect(title).to.be('app');
+        expect(color).to.be('#54b399');
+        expect(type).to.be('areaStacked');
+        expect(hideLegend).to.be(false);
+        expect(legendValue).to.be('100%');
       });
-      it('returns the top 4 by percentage and sorts them by name', async () => {
+      it('returns the transaction breakdown sorted by name', async () => {
         const response = await supertest.get(
           `/api/apm/services/opbeans-node/transaction_groups/breakdown?start=${start}&end=${end}&uiFilters=${uiFilters}&transactionType=${transactionType}`
         );
 
         expect(response.status).to.be(200);
-        expect(response.body.kpis.map((kpi: { name: string }) => kpi.name)).to.eql([
+        expect(response.body.timeseries.map((serie: { title: string }) => serie.title)).to.eql([
           'app',
           'http',
           'postgresql',
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/error_rate.ts b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/error_rate.ts
index 2c22cbbcce7800..9aa10d2b307b69 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/error_rate.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/error_rate.ts
@@ -4,23 +4,23 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import expect from '@kbn/expect';
+import { first, last } from 'lodash';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
-import expectedErrorRate from './expectation/error_rate.json';
 
 export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
   // url parameters
-  const start = encodeURIComponent('2020-06-29T06:45:00.000Z');
-  const end = encodeURIComponent('2020-06-29T06:49:00.000Z');
+  const start = encodeURIComponent('2020-08-26T11:00:00.000Z');
+  const end = encodeURIComponent('2020-08-26T11:30:00.000Z');
   const uiFilters = encodeURIComponent(JSON.stringify({}));
 
   describe('Error rate', () => {
     describe('when data is not loaded', () => {
       it('handles the empty state', async () => {
         const response = await supertest.get(
-          `/api/apm/services/opbeans-node/transaction_groups/error_rate?start=${start}&end=${end}&uiFilters=${uiFilters}`
+          `/api/apm/services/opbeans-java/transaction_groups/error_rate?start=${start}&end=${end}&uiFilters=${uiFilters}`
         );
         expect(response.status).to.be(200);
         expect(response.body).to.eql({
@@ -34,13 +34,37 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       before(() => esArchiver.load('8.0.0'));
       after(() => esArchiver.unload('8.0.0'));
 
-      it('returns the transaction error rate', async () => {
-        const response = await supertest.get(
-          `/api/apm/services/opbeans-node/transaction_groups/error_rate?start=${start}&end=${end}&uiFilters=${uiFilters}`
-        );
+      describe('returns the transaction error rate', () => {
+        let errorRateResponse: {
+          erroneousTransactionsRate: Array<{ x: number; y: number | null }>;
+          average: number;
+        };
+        before(async () => {
+          const response = await supertest.get(
+            `/api/apm/services/opbeans-java/transaction_groups/error_rate?start=${start}&end=${end}&uiFilters=${uiFilters}`
+          );
+          errorRateResponse = response.body;
+        });
 
-        expect(response.status).to.be(200);
-        expect(response.body).to.eql(expectedErrorRate);
+        it('has the correct start date', async () => {
+          expect(first(errorRateResponse.erroneousTransactionsRate)?.x).to.be(1598439600000);
+        });
+
+        it('has the correct end date', async () => {
+          expect(last(errorRateResponse.erroneousTransactionsRate)?.x).to.be(1598441400000);
+        });
+
+        it('has the correct number of buckets', async () => {
+          expect(errorRateResponse.erroneousTransactionsRate.length).to.be(61);
+        });
+
+        it('has the correct calculation for average', async () => {
+          expect(errorRateResponse.average).to.be(0.18894993894993897);
+        });
+
+        it('has the correct error rate', async () => {
+          expect(first(errorRateResponse.erroneousTransactionsRate)?.y).to.be(0.5);
+        });
       });
     });
   });
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown.json b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown.json
index 3b884a9eb7907d..8ffbba64ec7aba 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown.json
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown.json
@@ -1,26 +1,4 @@
 {
-  "kpis":[
-     {
-        "name":"app",
-        "percentage":0.16700861715223636,
-        "color":"#54b399"
-     },
-     {
-        "name":"http",
-        "percentage":0.7702092736971686,
-        "color":"#6092c0"
-     },
-     {
-        "name":"postgresql",
-        "percentage":0.0508822322527698,
-        "color":"#d36086"
-     },
-     {
-        "name":"redis",
-        "percentage":0.011899876897825195,
-        "color":"#9170b8"
-     }
-  ],
   "timeseries":[
      {
         "title":"app",
@@ -64,7 +42,8 @@
               "y":null
            }
         ],
-        "hideLegend":true
+        "hideLegend":false,
+        "legendValue": "17%"
      },
      {
         "title":"http",
@@ -108,7 +87,8 @@
               "y":null
            }
         ],
-        "hideLegend":true
+        "hideLegend":false,
+        "legendValue": "77%"
      },
      {
         "title":"postgresql",
@@ -152,7 +132,8 @@
               "y":null
            }
         ],
-        "hideLegend":true
+        "hideLegend":false,
+        "legendValue": "5.1%"
      },
      {
         "title":"redis",
@@ -196,7 +177,8 @@
               "y":null
            }
         ],
-        "hideLegend":true
+        "hideLegend":false,
+        "legendValue": "1.2%"
      }
   ]
 }
\ No newline at end of file
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown_transaction_name.json b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown_transaction_name.json
deleted file mode 100644
index b4f8e376d36094..00000000000000
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown_transaction_name.json
+++ /dev/null
@@ -1,55 +0,0 @@
-{
-  "kpis":[
-     {
-        "name":"app",
-        "percentage":1,
-        "color":"#54b399"
-     }
-  ],
-  "timeseries":[
-     {
-        "title":"app",
-        "color":"#54b399",
-        "type":"areaStacked",
-        "data":[
-           {
-              "x":1593413100000,
-              "y":null
-           },
-           {
-              "x":1593413130000,
-              "y":null
-           },
-           {
-              "x":1593413160000,
-              "y":null
-           },
-           {
-              "x":1593413190000,
-              "y":null
-           },
-           {
-              "x":1593413220000,
-              "y":null
-           },
-           {
-              "x":1593413250000,
-              "y":null
-           },
-           {
-              "x":1593413280000,
-              "y":null
-           },
-           {
-              "x":1593413310000,
-              "y":1
-           },
-           {
-              "x":1593413340000,
-              "y":null
-           }
-        ],
-        "hideLegend":true
-     }
-  ]
-}
\ No newline at end of file
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/error_rate.json b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/error_rate.json
deleted file mode 100644
index e448729f44a98b..00000000000000
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/error_rate.json
+++ /dev/null
@@ -1,970 +0,0 @@
-{
-   "noHits": false,
-   "erroneousTransactionsRate": [
-      {
-         "x": 1593413100000,
-         "y": null
-      },
-      {
-         "x": 1593413101000,
-         "y": null
-      },
-      {
-         "x": 1593413102000,
-         "y": null
-      },
-      {
-         "x": 1593413103000,
-         "y": null
-      },
-      {
-         "x": 1593413104000,
-         "y": null
-      },
-      {
-         "x": 1593413105000,
-         "y": null
-      },
-      {
-         "x": 1593413106000,
-         "y": null
-      },
-      {
-         "x": 1593413107000,
-         "y": null
-      },
-      {
-         "x": 1593413108000,
-         "y": null
-      },
-      {
-         "x": 1593413109000,
-         "y": null
-      },
-      {
-         "x": 1593413110000,
-         "y": null
-      },
-      {
-         "x": 1593413111000,
-         "y": null
-      },
-      {
-         "x": 1593413112000,
-         "y": null
-      },
-      {
-         "x": 1593413113000,
-         "y": null
-      },
-      {
-         "x": 1593413114000,
-         "y": null
-      },
-      {
-         "x": 1593413115000,
-         "y": null
-      },
-      {
-         "x": 1593413116000,
-         "y": null
-      },
-      {
-         "x": 1593413117000,
-         "y": null
-      },
-      {
-         "x": 1593413118000,
-         "y": null
-      },
-      {
-         "x": 1593413119000,
-         "y": null
-      },
-      {
-         "x": 1593413120000,
-         "y": null
-      },
-      {
-         "x": 1593413121000,
-         "y": null
-      },
-      {
-         "x": 1593413122000,
-         "y": null
-      },
-      {
-         "x": 1593413123000,
-         "y": null
-      },
-      {
-         "x": 1593413124000,
-         "y": null
-      },
-      {
-         "x": 1593413125000,
-         "y": null
-      },
-      {
-         "x": 1593413126000,
-         "y": null
-      },
-      {
-         "x": 1593413127000,
-         "y": null
-      },
-      {
-         "x": 1593413128000,
-         "y": null
-      },
-      {
-         "x": 1593413129000,
-         "y": null
-      },
-      {
-         "x": 1593413130000,
-         "y": null
-      },
-      {
-         "x": 1593413131000,
-         "y": null
-      },
-      {
-         "x": 1593413132000,
-         "y": null
-      },
-      {
-         "x": 1593413133000,
-         "y": null
-      },
-      {
-         "x": 1593413134000,
-         "y": null
-      },
-      {
-         "x": 1593413135000,
-         "y": null
-      },
-      {
-         "x": 1593413136000,
-         "y": null
-      },
-      {
-         "x": 1593413137000,
-         "y": null
-      },
-      {
-         "x": 1593413138000,
-         "y": null
-      },
-      {
-         "x": 1593413139000,
-         "y": null
-      },
-      {
-         "x": 1593413140000,
-         "y": null
-      },
-      {
-         "x": 1593413141000,
-         "y": null
-      },
-      {
-         "x": 1593413142000,
-         "y": null
-      },
-      {
-         "x": 1593413143000,
-         "y": null
-      },
-      {
-         "x": 1593413144000,
-         "y": null
-      },
-      {
-         "x": 1593413145000,
-         "y": null
-      },
-      {
-         "x": 1593413146000,
-         "y": null
-      },
-      {
-         "x": 1593413147000,
-         "y": null
-      },
-      {
-         "x": 1593413148000,
-         "y": null
-      },
-      {
-         "x": 1593413149000,
-         "y": null
-      },
-      {
-         "x": 1593413150000,
-         "y": null
-      },
-      {
-         "x": 1593413151000,
-         "y": null
-      },
-      {
-         "x": 1593413152000,
-         "y": null
-      },
-      {
-         "x": 1593413153000,
-         "y": null
-      },
-      {
-         "x": 1593413154000,
-         "y": null
-      },
-      {
-         "x": 1593413155000,
-         "y": null
-      },
-      {
-         "x": 1593413156000,
-         "y": null
-      },
-      {
-         "x": 1593413157000,
-         "y": null
-      },
-      {
-         "x": 1593413158000,
-         "y": null
-      },
-      {
-         "x": 1593413159000,
-         "y": null
-      },
-      {
-         "x": 1593413160000,
-         "y": null
-      },
-      {
-         "x": 1593413161000,
-         "y": null
-      },
-      {
-         "x": 1593413162000,
-         "y": null
-      },
-      {
-         "x": 1593413163000,
-         "y": null
-      },
-      {
-         "x": 1593413164000,
-         "y": null
-      },
-      {
-         "x": 1593413165000,
-         "y": null
-      },
-      {
-         "x": 1593413166000,
-         "y": null
-      },
-      {
-         "x": 1593413167000,
-         "y": null
-      },
-      {
-         "x": 1593413168000,
-         "y": null
-      },
-      {
-         "x": 1593413169000,
-         "y": null
-      },
-      {
-         "x": 1593413170000,
-         "y": null
-      },
-      {
-         "x": 1593413171000,
-         "y": null
-      },
-      {
-         "x": 1593413172000,
-         "y": null
-      },
-      {
-         "x": 1593413173000,
-         "y": null
-      },
-      {
-         "x": 1593413174000,
-         "y": null
-      },
-      {
-         "x": 1593413175000,
-         "y": null
-      },
-      {
-         "x": 1593413176000,
-         "y": null
-      },
-      {
-         "x": 1593413177000,
-         "y": null
-      },
-      {
-         "x": 1593413178000,
-         "y": null
-      },
-      {
-         "x": 1593413179000,
-         "y": null
-      },
-      {
-         "x": 1593413180000,
-         "y": null
-      },
-      {
-         "x": 1593413181000,
-         "y": null
-      },
-      {
-         "x": 1593413182000,
-         "y": null
-      },
-      {
-         "x": 1593413183000,
-         "y": null
-      },
-      {
-         "x": 1593413184000,
-         "y": null
-      },
-      {
-         "x": 1593413185000,
-         "y": null
-      },
-      {
-         "x": 1593413186000,
-         "y": null
-      },
-      {
-         "x": 1593413187000,
-         "y": null
-      },
-      {
-         "x": 1593413188000,
-         "y": null
-      },
-      {
-         "x": 1593413189000,
-         "y": null
-      },
-      {
-         "x": 1593413190000,
-         "y": null
-      },
-      {
-         "x": 1593413191000,
-         "y": null
-      },
-      {
-         "x": 1593413192000,
-         "y": null
-      },
-      {
-         "x": 1593413193000,
-         "y": null
-      },
-      {
-         "x": 1593413194000,
-         "y": null
-      },
-      {
-         "x": 1593413195000,
-         "y": null
-      },
-      {
-         "x": 1593413196000,
-         "y": null
-      },
-      {
-         "x": 1593413197000,
-         "y": null
-      },
-      {
-         "x": 1593413198000,
-         "y": null
-      },
-      {
-         "x": 1593413199000,
-         "y": null
-      },
-      {
-         "x": 1593413200000,
-         "y": null
-      },
-      {
-         "x": 1593413201000,
-         "y": null
-      },
-      {
-         "x": 1593413202000,
-         "y": null
-      },
-      {
-         "x": 1593413203000,
-         "y": null
-      },
-      {
-         "x": 1593413204000,
-         "y": null
-      },
-      {
-         "x": 1593413205000,
-         "y": null
-      },
-      {
-         "x": 1593413206000,
-         "y": null
-      },
-      {
-         "x": 1593413207000,
-         "y": null
-      },
-      {
-         "x": 1593413208000,
-         "y": null
-      },
-      {
-         "x": 1593413209000,
-         "y": null
-      },
-      {
-         "x": 1593413210000,
-         "y": null
-      },
-      {
-         "x": 1593413211000,
-         "y": null
-      },
-      {
-         "x": 1593413212000,
-         "y": null
-      },
-      {
-         "x": 1593413213000,
-         "y": null
-      },
-      {
-         "x": 1593413214000,
-         "y": null
-      },
-      {
-         "x": 1593413215000,
-         "y": null
-      },
-      {
-         "x": 1593413216000,
-         "y": null
-      },
-      {
-         "x": 1593413217000,
-         "y": null
-      },
-      {
-         "x": 1593413218000,
-         "y": null
-      },
-      {
-         "x": 1593413219000,
-         "y": null
-      },
-      {
-         "x": 1593413220000,
-         "y": null
-      },
-      {
-         "x": 1593413221000,
-         "y": null
-      },
-      {
-         "x": 1593413222000,
-         "y": null
-      },
-      {
-         "x": 1593413223000,
-         "y": null
-      },
-      {
-         "x": 1593413224000,
-         "y": null
-      },
-      {
-         "x": 1593413225000,
-         "y": null
-      },
-      {
-         "x": 1593413226000,
-         "y": null
-      },
-      {
-         "x": 1593413227000,
-         "y": null
-      },
-      {
-         "x": 1593413228000,
-         "y": null
-      },
-      {
-         "x": 1593413229000,
-         "y": null
-      },
-      {
-         "x": 1593413230000,
-         "y": null
-      },
-      {
-         "x": 1593413231000,
-         "y": null
-      },
-      {
-         "x": 1593413232000,
-         "y": null
-      },
-      {
-         "x": 1593413233000,
-         "y": null
-      },
-      {
-         "x": 1593413234000,
-         "y": null
-      },
-      {
-         "x": 1593413235000,
-         "y": null
-      },
-      {
-         "x": 1593413236000,
-         "y": null
-      },
-      {
-         "x": 1593413237000,
-         "y": null
-      },
-      {
-         "x": 1593413238000,
-         "y": null
-      },
-      {
-         "x": 1593413239000,
-         "y": null
-      },
-      {
-         "x": 1593413240000,
-         "y": null
-      },
-      {
-         "x": 1593413241000,
-         "y": null
-      },
-      {
-         "x": 1593413242000,
-         "y": null
-      },
-      {
-         "x": 1593413243000,
-         "y": null
-      },
-      {
-         "x": 1593413244000,
-         "y": null
-      },
-      {
-         "x": 1593413245000,
-         "y": null
-      },
-      {
-         "x": 1593413246000,
-         "y": null
-      },
-      {
-         "x": 1593413247000,
-         "y": null
-      },
-      {
-         "x": 1593413248000,
-         "y": null
-      },
-      {
-         "x": 1593413249000,
-         "y": null
-      },
-      {
-         "x": 1593413250000,
-         "y": null
-      },
-      {
-         "x": 1593413251000,
-         "y": null
-      },
-      {
-         "x": 1593413252000,
-         "y": null
-      },
-      {
-         "x": 1593413253000,
-         "y": null
-      },
-      {
-         "x": 1593413254000,
-         "y": null
-      },
-      {
-         "x": 1593413255000,
-         "y": null
-      },
-      {
-         "x": 1593413256000,
-         "y": null
-      },
-      {
-         "x": 1593413257000,
-         "y": null
-      },
-      {
-         "x": 1593413258000,
-         "y": null
-      },
-      {
-         "x": 1593413259000,
-         "y": null
-      },
-      {
-         "x": 1593413260000,
-         "y": null
-      },
-      {
-         "x": 1593413261000,
-         "y": null
-      },
-      {
-         "x": 1593413262000,
-         "y": null
-      },
-      {
-         "x": 1593413263000,
-         "y": null
-      },
-      {
-         "x": 1593413264000,
-         "y": null
-      },
-      {
-         "x": 1593413265000,
-         "y": null
-      },
-      {
-         "x": 1593413266000,
-         "y": null
-      },
-      {
-         "x": 1593413267000,
-         "y": null
-      },
-      {
-         "x": 1593413268000,
-         "y": null
-      },
-      {
-         "x": 1593413269000,
-         "y": null
-      },
-      {
-         "x": 1593413270000,
-         "y": null
-      },
-      {
-         "x": 1593413271000,
-         "y": null
-      },
-      {
-         "x": 1593413272000,
-         "y": 0
-      },
-      {
-         "x": 1593413273000,
-         "y": 0
-      },
-      {
-         "x": 1593413274000,
-         "y": null
-      },
-      {
-         "x": 1593413275000,
-         "y": null
-      },
-      {
-         "x": 1593413276000,
-         "y": null
-      },
-      {
-         "x": 1593413277000,
-         "y": 0
-      },
-      {
-         "x": 1593413278000,
-         "y": null
-      },
-      {
-         "x": 1593413279000,
-         "y": null
-      },
-      {
-         "x": 1593413280000,
-         "y": null
-      },
-      {
-         "x": 1593413281000,
-         "y": 0
-      },
-      {
-         "x": 1593413282000,
-         "y": null
-      },
-      {
-         "x": 1593413283000,
-         "y": null
-      },
-      {
-         "x": 1593413284000,
-         "y": 0
-      },
-      {
-         "x": 1593413285000,
-         "y": 0
-      },
-      {
-         "x": 1593413286000,
-         "y": 0.125
-      },
-      {
-         "x": 1593413287000,
-         "y": 0.5
-      },
-      {
-         "x": 1593413288000,
-         "y": 0
-      },
-      {
-         "x": 1593413289000,
-         "y": 0.5
-      },
-      {
-         "x": 1593413290000,
-         "y": 0
-      },
-      {
-         "x": 1593413291000,
-         "y": 0
-      },
-      {
-         "x": 1593413292000,
-         "y": 0.5
-      },
-      {
-         "x": 1593413293000,
-         "y": 0
-      },
-      {
-         "x": 1593413294000,
-         "y": 0
-      },
-      {
-         "x": 1593413295000,
-         "y": 0
-      },
-      {
-         "x": 1593413296000,
-         "y": 0
-      },
-      {
-         "x": 1593413297000,
-         "y": 0
-      },
-      {
-         "x": 1593413298000,
-         "y": 0
-      },
-      {
-         "x": 1593413299000,
-         "y": 0.5
-      },
-      {
-         "x": 1593413300000,
-         "y": 0.3333333333333333
-      },
-      {
-         "x": 1593413301000,
-         "y": 0.14285714285714285
-      },
-      {
-         "x": 1593413302000,
-         "y": 0
-      },
-      {
-         "x": 1593413303000,
-         "y": 0
-      },
-      {
-         "x": 1593413304000,
-         "y": 0
-      },
-      {
-         "x": 1593413305000,
-         "y": 0.6666666666666666
-      },
-      {
-         "x": 1593413306000,
-         "y": 0
-      },
-      {
-         "x": 1593413307000,
-         "y": 0
-      },
-      {
-         "x": 1593413308000,
-         "y": 0.3333333333333333
-      },
-      {
-         "x": 1593413309000,
-         "y": 0.3333333333333333
-      },
-      {
-         "x": 1593413310000,
-         "y": 0.3333333333333333
-      },
-      {
-         "x": 1593413311000,
-         "y": 0.5
-      },
-      {
-         "x": 1593413312000,
-         "y": 0
-      },
-      {
-         "x": 1593413313000,
-         "y": 0
-      },
-      {
-         "x": 1593413314000,
-         "y": 0
-      },
-      {
-         "x": 1593413315000,
-         "y": 0.5
-      },
-      {
-         "x": 1593413316000,
-         "y": 0
-      },
-      {
-         "x": 1593413317000,
-         "y": 0
-      },
-      {
-         "x": 1593413318000,
-         "y": 0
-      },
-      {
-         "x": 1593413319000,
-         "y": 0
-      },
-      {
-         "x": 1593413320000,
-         "y": 0.3333333333333333
-      },
-      {
-         "x": 1593413321000,
-         "y": 0
-      },
-      {
-         "x": 1593413322000,
-         "y": 0.5
-      },
-      {
-         "x": 1593413323000,
-         "y": null
-      },
-      {
-         "x": 1593413324000,
-         "y": null
-      },
-      {
-         "x": 1593413325000,
-         "y": null
-      },
-      {
-         "x": 1593413326000,
-         "y": null
-      },
-      {
-         "x": 1593413327000,
-         "y": null
-      },
-      {
-         "x": 1593413328000,
-         "y": null
-      },
-      {
-         "x": 1593413329000,
-         "y": null
-      },
-      {
-         "x": 1593413330000,
-         "y": null
-      },
-      {
-         "x": 1593413331000,
-         "y": null
-      },
-      {
-         "x": 1593413332000,
-         "y": null
-      },
-      {
-         "x": 1593413333000,
-         "y": null
-      },
-      {
-         "x": 1593413334000,
-         "y": null
-      },
-      {
-         "x": 1593413335000,
-         "y": null
-      },
-      {
-         "x": 1593413336000,
-         "y": null
-      },
-      {
-         "x": 1593413337000,
-         "y": null
-      },
-      {
-         "x": 1593413338000,
-         "y": null
-      },
-      {
-         "x": 1593413339000,
-         "y": null
-      },
-      {
-         "x": 1593413340000,
-         "y": null
-      }
-   ],
-   "average": 0.14188815060908083
-}
diff --git a/x-pack/test/apm_api_integration/trial/fixtures/es_archiver/ml_8.0.0/data.json.gz b/x-pack/test/apm_api_integration/trial/fixtures/es_archiver/ml_8.0.0/data.json.gz
new file mode 100644
index 00000000000000..d23b9e51d734da
Binary files /dev/null and b/x-pack/test/apm_api_integration/trial/fixtures/es_archiver/ml_8.0.0/data.json.gz differ
diff --git a/x-pack/test/apm_api_integration/trial/fixtures/es_archiver/ml_8.0.0/mappings.json b/x-pack/test/apm_api_integration/trial/fixtures/es_archiver/ml_8.0.0/mappings.json
new file mode 100644
index 00000000000000..5a5d48464b8b19
--- /dev/null
+++ b/x-pack/test/apm_api_integration/trial/fixtures/es_archiver/ml_8.0.0/mappings.json
@@ -0,0 +1,63452 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".ml-annotations-read": {
+        "is_hidden": true
+      },
+      ".ml-annotations-write": {
+        "is_hidden": true
+      }
+    },
+    "index": ".ml-annotations-6",
+    "mappings": {
+      "_meta": {
+        "version": "8.0.0"
+      },
+      "properties": {
+        "annotation": {
+          "type": "text"
+        },
+        "by_field_name": {
+          "type": "keyword"
+        },
+        "by_field_value": {
+          "type": "keyword"
+        },
+        "create_time": {
+          "type": "date"
+        },
+        "create_username": {
+          "type": "keyword"
+        },
+        "detector_index": {
+          "type": "integer"
+        },
+        "end_timestamp": {
+          "type": "date"
+        },
+        "event": {
+          "type": "keyword"
+        },
+        "job_id": {
+          "type": "keyword"
+        },
+        "modified_time": {
+          "type": "date"
+        },
+        "modified_username": {
+          "type": "keyword"
+        },
+        "over_field_name": {
+          "type": "keyword"
+        },
+        "over_field_value": {
+          "type": "keyword"
+        },
+        "partition_field_name": {
+          "type": "keyword"
+        },
+        "partition_field_value": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "hidden": "true",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".ml-anomalies-.write-android_homepage_high_latency_by_geo": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-apm-environment_not_defined-7ed6-high_mean_transaction_duration": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-apm-production-229a-high_mean_transaction_duration": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-apm-testing-d457-high_mean_transaction_duration": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-auto_http_0x73c4bc9426fb6908_high_latency_by_geo": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-kibana-logs-ui-default-default-log-entry-categories-count": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-.write-kibana-logs-ui-default-default-log-entry-rate": {
+        "is_hidden": true
+      },
+      ".ml-anomalies-android_homepage_high_latency_by_geo": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "android_homepage_high_latency_by_geo"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-apm-environment_not_defined-7ed6-high_mean_transaction_duration": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "apm-environment_not_defined-7ed6-high_mean_transaction_duration"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-apm-production-229a-high_mean_transaction_duration": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "apm-production-229a-high_mean_transaction_duration"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-apm-testing-d457-high_mean_transaction_duration": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "apm-testing-d457-high_mean_transaction_duration"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-auto_http_0x73c4bc9426fb6908_high_latency_by_geo": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "auto_http_0x73c4bc9426fb6908_high_latency_by_geo"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-kibana-logs-ui-default-default-log-entry-categories-count": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "kibana-logs-ui-default-default-log-entry-categories-count"
+            }
+          }
+        },
+        "is_hidden": true
+      },
+      ".ml-anomalies-kibana-logs-ui-default-default-log-entry-rate": {
+        "filter": {
+          "term": {
+            "job_id": {
+              "boost": 1,
+              "value": "kibana-logs-ui-default-default-log-entry-rate"
+            }
+          }
+        },
+        "is_hidden": true
+      }
+    },
+    "index": ".ml-anomalies-shared",
+    "mappings": {
+      "_meta": {
+        "version": "8.0.0"
+      },
+      "dynamic_templates": [
+        {
+          "strings_as_keywords": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match": "*"
+          }
+        }
+      ],
+      "properties": {
+        "actual": {
+          "type": "double"
+        },
+        "all_field_values": {
+          "analyzer": "whitespace",
+          "type": "text"
+        },
+        "anomaly_score": {
+          "type": "double"
+        },
+        "average_bucket_processing_time_ms": {
+          "type": "double"
+        },
+        "bucket_allocation_failures_count": {
+          "type": "long"
+        },
+        "bucket_count": {
+          "type": "long"
+        },
+        "bucket_influencers": {
+          "properties": {
+            "anomaly_score": {
+              "type": "double"
+            },
+            "bucket_span": {
+              "type": "long"
+            },
+            "influencer_field_name": {
+              "type": "keyword"
+            },
+            "initial_anomaly_score": {
+              "type": "double"
+            },
+            "is_interim": {
+              "type": "boolean"
+            },
+            "job_id": {
+              "type": "keyword"
+            },
+            "probability": {
+              "type": "double"
+            },
+            "raw_anomaly_score": {
+              "type": "double"
+            },
+            "result_type": {
+              "type": "keyword"
+            },
+            "timestamp": {
+              "type": "date"
+            }
+          },
+          "type": "nested"
+        },
+        "bucket_span": {
+          "type": "long"
+        },
+        "by_field_name": {
+          "type": "keyword"
+        },
+        "by_field_value": {
+          "copy_to": [
+            "all_field_values"
+          ],
+          "type": "keyword"
+        },
+        "categorization_status": {
+          "type": "keyword"
+        },
+        "categorized_doc_count": {
+          "type": "keyword"
+        },
+        "category_id": {
+          "type": "long"
+        },
+        "causes": {
+          "properties": {
+            "actual": {
+              "type": "double"
+            },
+            "by_field_name": {
+              "type": "keyword"
+            },
+            "by_field_value": {
+              "copy_to": [
+                "all_field_values"
+              ],
+              "type": "keyword"
+            },
+            "correlated_by_field_value": {
+              "copy_to": [
+                "all_field_values"
+              ],
+              "type": "keyword"
+            },
+            "field_name": {
+              "type": "keyword"
+            },
+            "function": {
+              "type": "keyword"
+            },
+            "function_description": {
+              "type": "keyword"
+            },
+            "geo_results": {
+              "properties": {
+                "actual_point": {
+                  "type": "geo_point"
+                },
+                "typical_point": {
+                  "type": "geo_point"
+                }
+              }
+            },
+            "over_field_name": {
+              "type": "keyword"
+            },
+            "over_field_value": {
+              "copy_to": [
+                "all_field_values"
+              ],
+              "type": "keyword"
+            },
+            "partition_field_name": {
+              "type": "keyword"
+            },
+            "partition_field_value": {
+              "copy_to": [
+                "all_field_values"
+              ],
+              "type": "keyword"
+            },
+            "probability": {
+              "type": "double"
+            },
+            "typical": {
+              "type": "double"
+            }
+          },
+          "type": "nested"
+        },
+        "dead_category_count": {
+          "type": "keyword"
+        },
+        "description": {
+          "type": "text"
+        },
+        "detector_index": {
+          "type": "integer"
+        },
+        "earliest_record_timestamp": {
+          "type": "date"
+        },
+        "empty_bucket_count": {
+          "type": "long"
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "keyword"
+            }
+          }
+        },
+        "event_count": {
+          "type": "long"
+        },
+        "examples": {
+          "type": "text"
+        },
+        "exponential_average_bucket_processing_time_ms": {
+          "type": "double"
+        },
+        "exponential_average_calculation_context": {
+          "properties": {
+            "incremental_metric_value_ms": {
+              "type": "double"
+            },
+            "latest_timestamp": {
+              "type": "date"
+            },
+            "previous_exponential_average_ms": {
+              "type": "double"
+            }
+          }
+        },
+        "failed_category_count": {
+          "type": "keyword"
+        },
+        "field_name": {
+          "type": "keyword"
+        },
+        "forecast_create_timestamp": {
+          "type": "date"
+        },
+        "forecast_end_timestamp": {
+          "type": "date"
+        },
+        "forecast_expiry_timestamp": {
+          "type": "date"
+        },
+        "forecast_id": {
+          "type": "keyword"
+        },
+        "forecast_lower": {
+          "type": "double"
+        },
+        "forecast_memory_bytes": {
+          "type": "long"
+        },
+        "forecast_messages": {
+          "type": "keyword"
+        },
+        "forecast_prediction": {
+          "type": "double"
+        },
+        "forecast_progress": {
+          "type": "double"
+        },
+        "forecast_start_timestamp": {
+          "type": "date"
+        },
+        "forecast_status": {
+          "type": "keyword"
+        },
+        "forecast_upper": {
+          "type": "double"
+        },
+        "frequent_category_count": {
+          "type": "keyword"
+        },
+        "function": {
+          "type": "keyword"
+        },
+        "function_description": {
+          "type": "keyword"
+        },
+        "geo_results": {
+          "properties": {
+            "actual_point": {
+              "type": "geo_point"
+            },
+            "typical_point": {
+              "type": "geo_point"
+            }
+          }
+        },
+        "influencer_field_name": {
+          "type": "keyword"
+        },
+        "influencer_field_value": {
+          "copy_to": [
+            "all_field_values"
+          ],
+          "type": "keyword"
+        },
+        "influencer_score": {
+          "type": "double"
+        },
+        "influencers": {
+          "properties": {
+            "influencer_field_name": {
+              "type": "keyword"
+            },
+            "influencer_field_values": {
+              "copy_to": [
+                "all_field_values"
+              ],
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "initial_anomaly_score": {
+          "type": "double"
+        },
+        "initial_influencer_score": {
+          "type": "double"
+        },
+        "initial_record_score": {
+          "type": "double"
+        },
+        "input_bytes": {
+          "type": "long"
+        },
+        "input_field_count": {
+          "type": "long"
+        },
+        "input_record_count": {
+          "type": "long"
+        },
+        "invalid_date_count": {
+          "type": "long"
+        },
+        "is_interim": {
+          "type": "boolean"
+        },
+        "job_id": {
+          "copy_to": [
+            "all_field_values"
+          ],
+          "type": "keyword"
+        },
+        "last_data_time": {
+          "type": "date"
+        },
+        "latest_empty_bucket_timestamp": {
+          "type": "date"
+        },
+        "latest_record_time_stamp": {
+          "type": "date"
+        },
+        "latest_record_timestamp": {
+          "type": "date"
+        },
+        "latest_result_time_stamp": {
+          "type": "date"
+        },
+        "latest_sparse_bucket_timestamp": {
+          "type": "date"
+        },
+        "log_time": {
+          "type": "date"
+        },
+        "max_matching_length": {
+          "type": "long"
+        },
+        "maximum_bucket_processing_time_ms": {
+          "type": "double"
+        },
+        "memory_status": {
+          "type": "keyword"
+        },
+        "min_version": {
+          "type": "keyword"
+        },
+        "minimum_bucket_processing_time_ms": {
+          "type": "double"
+        },
+        "missing_field_count": {
+          "type": "long"
+        },
+        "mlcategory": {
+          "type": "keyword"
+        },
+        "model_bytes": {
+          "type": "long"
+        },
+        "model_bytes_exceeded": {
+          "type": "keyword"
+        },
+        "model_bytes_memory_limit": {
+          "type": "keyword"
+        },
+        "model_feature": {
+          "type": "keyword"
+        },
+        "model_lower": {
+          "type": "double"
+        },
+        "model_median": {
+          "type": "double"
+        },
+        "model_size_stats": {
+          "properties": {
+            "bucket_allocation_failures_count": {
+              "type": "long"
+            },
+            "categorization_status": {
+              "type": "keyword"
+            },
+            "categorized_doc_count": {
+              "type": "keyword"
+            },
+            "dead_category_count": {
+              "type": "keyword"
+            },
+            "failed_category_count": {
+              "type": "keyword"
+            },
+            "frequent_category_count": {
+              "type": "keyword"
+            },
+            "job_id": {
+              "type": "keyword"
+            },
+            "log_time": {
+              "type": "date"
+            },
+            "memory_status": {
+              "type": "keyword"
+            },
+            "model_bytes": {
+              "type": "long"
+            },
+            "model_bytes_exceeded": {
+              "type": "keyword"
+            },
+            "model_bytes_memory_limit": {
+              "type": "keyword"
+            },
+            "peak_model_bytes": {
+              "type": "long"
+            },
+            "rare_category_count": {
+              "type": "keyword"
+            },
+            "result_type": {
+              "type": "keyword"
+            },
+            "timestamp": {
+              "type": "date"
+            },
+            "total_by_field_count": {
+              "type": "long"
+            },
+            "total_category_count": {
+              "type": "keyword"
+            },
+            "total_over_field_count": {
+              "type": "long"
+            },
+            "total_partition_field_count": {
+              "type": "long"
+            }
+          }
+        },
+        "model_upper": {
+          "type": "double"
+        },
+        "monitor": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "multi_bucket_impact": {
+          "type": "double"
+        },
+        "num_matches": {
+          "type": "long"
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "name": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "out_of_order_timestamp_count": {
+          "type": "long"
+        },
+        "over_field_name": {
+          "type": "keyword"
+        },
+        "over_field_value": {
+          "copy_to": [
+            "all_field_values"
+          ],
+          "type": "keyword"
+        },
+        "partition_field_name": {
+          "type": "keyword"
+        },
+        "partition_field_value": {
+          "copy_to": [
+            "all_field_values"
+          ],
+          "type": "keyword"
+        },
+        "peak_model_bytes": {
+          "type": "keyword"
+        },
+        "preferred_to_categories": {
+          "type": "long"
+        },
+        "probability": {
+          "type": "double"
+        },
+        "processed_field_count": {
+          "type": "long"
+        },
+        "processed_record_count": {
+          "type": "long"
+        },
+        "processing_time_ms": {
+          "type": "long"
+        },
+        "quantiles": {
+          "enabled": false,
+          "type": "object"
+        },
+        "rare_category_count": {
+          "type": "keyword"
+        },
+        "raw_anomaly_score": {
+          "type": "double"
+        },
+        "record_score": {
+          "type": "double"
+        },
+        "regex": {
+          "type": "keyword"
+        },
+        "result_type": {
+          "type": "keyword"
+        },
+        "retain": {
+          "type": "boolean"
+        },
+        "scheduled_events": {
+          "type": "keyword"
+        },
+        "search_count": {
+          "type": "long"
+        },
+        "service": {
+          "properties": {
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "snapshot_doc_count": {
+          "type": "integer"
+        },
+        "snapshot_id": {
+          "type": "keyword"
+        },
+        "sparse_bucket_count": {
+          "type": "long"
+        },
+        "terms": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "total_by_field_count": {
+          "type": "long"
+        },
+        "total_category_count": {
+          "type": "keyword"
+        },
+        "total_over_field_count": {
+          "type": "long"
+        },
+        "total_partition_field_count": {
+          "type": "long"
+        },
+        "total_search_time_ms": {
+          "type": "double"
+        },
+        "transaction": {
+          "properties": {
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "typical": {
+          "type": "double"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "hidden": "true",
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "translog": {
+          "durability": "async"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": ".ml-config",
+    "mappings": {
+      "_meta": {
+        "version": "8.0.0"
+      },
+      "dynamic_templates": [
+        {
+          "strings_as_keywords": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match": "*"
+          }
+        }
+      ],
+      "properties": {
+        "aggregations": {
+          "enabled": false,
+          "type": "object"
+        },
+        "allow_lazy_open": {
+          "type": "keyword"
+        },
+        "analysis": {
+          "properties": {
+            "classification": {
+              "properties": {
+                "class_assignment_objective": {
+                  "type": "keyword"
+                },
+                "dependent_variable": {
+                  "type": "keyword"
+                },
+                "eta": {
+                  "type": "double"
+                },
+                "feature_bag_fraction": {
+                  "type": "double"
+                },
+                "gamma": {
+                  "type": "double"
+                },
+                "lambda": {
+                  "type": "double"
+                },
+                "max_trees": {
+                  "type": "integer"
+                },
+                "num_top_classes": {
+                  "type": "integer"
+                },
+                "num_top_feature_importance_values": {
+                  "type": "integer"
+                },
+                "prediction_field_name": {
+                  "type": "keyword"
+                },
+                "training_percent": {
+                  "type": "double"
+                }
+              }
+            },
+            "outlier_detection": {
+              "properties": {
+                "feature_influence_threshold": {
+                  "type": "double"
+                },
+                "method": {
+                  "type": "keyword"
+                },
+                "n_neighbors": {
+                  "type": "integer"
+                }
+              }
+            },
+            "regression": {
+              "properties": {
+                "dependent_variable": {
+                  "type": "keyword"
+                },
+                "eta": {
+                  "type": "double"
+                },
+                "feature_bag_fraction": {
+                  "type": "double"
+                },
+                "gamma": {
+                  "type": "double"
+                },
+                "lambda": {
+                  "type": "double"
+                },
+                "loss_function": {
+                  "type": "keyword"
+                },
+                "loss_function_parameter": {
+                  "type": "double"
+                },
+                "max_trees": {
+                  "type": "integer"
+                },
+                "num_top_feature_importance_values": {
+                  "type": "integer"
+                },
+                "prediction_field_name": {
+                  "type": "keyword"
+                },
+                "training_percent": {
+                  "type": "double"
+                }
+              }
+            }
+          }
+        },
+        "analysis_config": {
+          "properties": {
+            "bucket_span": {
+              "type": "keyword"
+            },
+            "categorization_analyzer": {
+              "enabled": false,
+              "type": "object"
+            },
+            "categorization_field_name": {
+              "type": "keyword"
+            },
+            "categorization_filters": {
+              "type": "keyword"
+            },
+            "detectors": {
+              "properties": {
+                "by_field_name": {
+                  "type": "keyword"
+                },
+                "custom_rules": {
+                  "properties": {
+                    "actions": {
+                      "type": "keyword"
+                    },
+                    "conditions": {
+                      "properties": {
+                        "applies_to": {
+                          "type": "keyword"
+                        },
+                        "operator": {
+                          "type": "keyword"
+                        },
+                        "value": {
+                          "type": "double"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "scope": {
+                      "enabled": false,
+                      "type": "object"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "detector_description": {
+                  "type": "text"
+                },
+                "detector_index": {
+                  "type": "integer"
+                },
+                "exclude_frequent": {
+                  "type": "keyword"
+                },
+                "field_name": {
+                  "type": "keyword"
+                },
+                "function": {
+                  "type": "keyword"
+                },
+                "over_field_name": {
+                  "type": "keyword"
+                },
+                "partition_field_name": {
+                  "type": "keyword"
+                },
+                "use_null": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "influencers": {
+              "type": "keyword"
+            },
+            "latency": {
+              "type": "keyword"
+            },
+            "multivariate_by_fields": {
+              "type": "boolean"
+            },
+            "per_partition_categorization": {
+              "properties": {
+                "enabled": {
+                  "type": "boolean"
+                },
+                "stop_on_warn": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "summary_count_field_name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "analysis_limits": {
+          "properties": {
+            "categorization_examples_limit": {
+              "type": "long"
+            },
+            "model_memory_limit": {
+              "type": "keyword"
+            }
+          }
+        },
+        "analyzed_fields": {
+          "enabled": false,
+          "type": "object"
+        },
+        "background_persist_interval": {
+          "type": "keyword"
+        },
+        "chunking_config": {
+          "properties": {
+            "mode": {
+              "type": "keyword"
+            },
+            "time_span": {
+              "type": "keyword"
+            }
+          }
+        },
+        "config_type": {
+          "type": "keyword"
+        },
+        "create_time": {
+          "type": "date"
+        },
+        "custom_settings": {
+          "enabled": false,
+          "type": "object"
+        },
+        "daily_model_snapshot_retention_after_days": {
+          "type": "long"
+        },
+        "data_description": {
+          "properties": {
+            "field_delimiter": {
+              "type": "keyword"
+            },
+            "format": {
+              "type": "keyword"
+            },
+            "quote_character": {
+              "type": "keyword"
+            },
+            "time_field": {
+              "type": "keyword"
+            },
+            "time_format": {
+              "type": "keyword"
+            }
+          }
+        },
+        "datafeed_id": {
+          "type": "keyword"
+        },
+        "delayed_data_check_config": {
+          "properties": {
+            "check_window": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            }
+          }
+        },
+        "deleting": {
+          "type": "keyword"
+        },
+        "description": {
+          "type": "text"
+        },
+        "dest": {
+          "properties": {
+            "index": {
+              "type": "keyword"
+            },
+            "results_field": {
+              "type": "keyword"
+            }
+          }
+        },
+        "finished_time": {
+          "type": "date"
+        },
+        "frequency": {
+          "type": "keyword"
+        },
+        "groups": {
+          "type": "keyword"
+        },
+        "headers": {
+          "enabled": false,
+          "type": "object"
+        },
+        "id": {
+          "type": "keyword"
+        },
+        "indices": {
+          "type": "keyword"
+        },
+        "indices_options": {
+          "enabled": false,
+          "type": "object"
+        },
+        "job_id": {
+          "type": "keyword"
+        },
+        "job_type": {
+          "type": "keyword"
+        },
+        "job_version": {
+          "type": "keyword"
+        },
+        "max_empty_searches": {
+          "type": "keyword"
+        },
+        "max_num_threads": {
+          "type": "integer"
+        },
+        "model_plot_config": {
+          "properties": {
+            "annotations_enabled": {
+              "type": "boolean"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "terms": {
+              "type": "keyword"
+            }
+          }
+        },
+        "model_snapshot_id": {
+          "type": "keyword"
+        },
+        "model_snapshot_min_version": {
+          "type": "keyword"
+        },
+        "model_snapshot_retention_days": {
+          "type": "long"
+        },
+        "query": {
+          "enabled": false,
+          "type": "object"
+        },
+        "query_delay": {
+          "type": "keyword"
+        },
+        "renormalization_window_days": {
+          "type": "long"
+        },
+        "results_index_name": {
+          "type": "keyword"
+        },
+        "results_retention_days": {
+          "type": "long"
+        },
+        "script_fields": {
+          "enabled": false,
+          "type": "object"
+        },
+        "scroll_size": {
+          "type": "long"
+        },
+        "source": {
+          "properties": {
+            "_source": {
+              "enabled": false,
+              "type": "object"
+            },
+            "index": {
+              "type": "keyword"
+            },
+            "query": {
+              "enabled": false,
+              "type": "object"
+            }
+          }
+        },
+        "version": {
+          "type": "keyword"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "max_result_window": "10000",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".ml-state-write": {
+        "is_hidden": true
+      }
+    },
+    "index": ".ml-state-000001",
+    "mappings": {
+      "_meta": {
+        "version": "8000099"
+      },
+      "enabled": false
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "hidden": "true",
+        "lifecycle": {
+          "name": "ml-size-based-ilm-policy",
+          "rollover_alias": ".ml-state-write"
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-error": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-error-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-error"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-error": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-error-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-error"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-error": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-error-2020.07.31-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-error"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-error": {
+        "is_write_index": true
+      }
+    },
+    "index": "apm-8.0.0-error-2020.07.31-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-error"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-metric": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-metric-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "golang": {
+          "properties": {
+            "goroutines": {
+              "type": "long"
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "active": {
+                      "type": "float"
+                    },
+                    "allocated": {
+                      "type": "float"
+                    },
+                    "frees": {
+                      "type": "float"
+                    },
+                    "idle": {
+                      "type": "float"
+                    },
+                    "mallocs": {
+                      "type": "float"
+                    },
+                    "objects": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "gc": {
+                  "properties": {
+                    "cpu_fraction": {
+                      "type": "float"
+                    },
+                    "next_gc_limit": {
+                      "type": "float"
+                    },
+                    "total_count": {
+                      "type": "long"
+                    },
+                    "total_pause": {
+                      "properties": {
+                        "ns": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                },
+                "system": {
+                  "properties": {
+                    "obtained": {
+                      "type": "float"
+                    },
+                    "released": {
+                      "type": "float"
+                    },
+                    "stack": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jvm": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "alloc": {
+                  "type": "float"
+                },
+                "count": {
+                  "type": "long"
+                },
+                "time": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "float"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "non_heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            },
+            "thread": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "env": {
+              "type": "keyword"
+            },
+            "hostname": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "nodejs": {
+          "properties": {
+            "eventloop": {
+              "properties": {
+                "delay": {
+                  "properties": {
+                    "avg": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "ns": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "handles": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "allocated": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "requests": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ruby": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "slots": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    },
+                    "live": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "threads": {
+              "type": "long"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "system": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "user": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-metric"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-metric": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-metric-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "golang": {
+          "properties": {
+            "goroutines": {
+              "type": "long"
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "active": {
+                      "type": "float"
+                    },
+                    "allocated": {
+                      "type": "float"
+                    },
+                    "frees": {
+                      "type": "long"
+                    },
+                    "idle": {
+                      "type": "float"
+                    },
+                    "mallocs": {
+                      "type": "long"
+                    },
+                    "objects": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "gc": {
+                  "properties": {
+                    "cpu_fraction": {
+                      "type": "float"
+                    },
+                    "next_gc_limit": {
+                      "type": "float"
+                    },
+                    "total_count": {
+                      "type": "long"
+                    },
+                    "total_pause": {
+                      "properties": {
+                        "ns": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                },
+                "system": {
+                  "properties": {
+                    "obtained": {
+                      "type": "float"
+                    },
+                    "released": {
+                      "type": "float"
+                    },
+                    "stack": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jvm": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "alloc": {
+                  "type": "float"
+                },
+                "count": {
+                  "type": "long"
+                },
+                "time": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "float"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "non_heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            },
+            "thread": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "env": {
+              "type": "keyword"
+            },
+            "hostname": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "nodejs": {
+          "properties": {
+            "eventloop": {
+              "properties": {
+                "delay": {
+                  "properties": {
+                    "avg": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "ns": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "handles": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "arrayBuffers": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "external": {
+                  "properties": {
+                    "bytes": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "heap": {
+                  "properties": {
+                    "allocated": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "requests": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ruby": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "slots": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    },
+                    "live": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "threads": {
+              "type": "long"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "system": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "user": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-metric"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-metric": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-metric-2020.07.31-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "clr": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "gen0size": {
+                  "type": "float"
+                },
+                "gen1size": {
+                  "type": "float"
+                },
+                "gen2size": {
+                  "type": "float"
+                },
+                "gen3size": {
+                  "type": "float"
+                }
+              }
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "golang": {
+          "properties": {
+            "goroutines": {
+              "type": "long"
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "active": {
+                      "type": "float"
+                    },
+                    "allocated": {
+                      "type": "float"
+                    },
+                    "frees": {
+                      "type": "long"
+                    },
+                    "idle": {
+                      "type": "float"
+                    },
+                    "mallocs": {
+                      "type": "long"
+                    },
+                    "objects": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "gc": {
+                  "properties": {
+                    "cpu_fraction": {
+                      "type": "float"
+                    },
+                    "next_gc_limit": {
+                      "type": "float"
+                    },
+                    "total_count": {
+                      "type": "long"
+                    },
+                    "total_pause": {
+                      "properties": {
+                        "ns": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "system": {
+                  "properties": {
+                    "obtained": {
+                      "type": "float"
+                    },
+                    "released": {
+                      "type": "float"
+                    },
+                    "stack": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jvm": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "alloc": {
+                  "type": "float"
+                },
+                "count": {
+                  "type": "long"
+                },
+                "time": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "float"
+                    },
+                    "pool": {
+                      "properties": {
+                        "committed": {
+                          "type": "float"
+                        },
+                        "max": {
+                          "type": "float"
+                        },
+                        "used": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "non_heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            },
+            "thread": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "env": {
+              "type": "keyword"
+            },
+            "hostname": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "nodejs": {
+          "properties": {
+            "eventloop": {
+              "properties": {
+                "delay": {
+                  "properties": {
+                    "avg": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "ns": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "handles": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "arrayBuffers": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "external": {
+                  "properties": {
+                    "bytes": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "heap": {
+                  "properties": {
+                    "allocated": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "requests": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ruby": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "total": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "slots": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    },
+                    "live": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "threads": {
+              "type": "long"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cgroup": {
+                  "properties": {
+                    "memory": {
+                      "properties": {
+                        "mem": {
+                          "properties": {
+                            "limit": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            },
+                            "usage": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            }
+                          }
+                        },
+                        "stats": {
+                          "properties": {
+                            "inactive_file": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "cpu": {
+                  "properties": {
+                    "system": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "user": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-metric"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-metric": {
+        "is_write_index": true
+      }
+    },
+    "index": "apm-8.0.0-metric-2020.07.31-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "clr": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "gen0size": {
+                  "type": "float"
+                },
+                "gen1size": {
+                  "type": "float"
+                },
+                "gen2size": {
+                  "type": "float"
+                },
+                "gen3size": {
+                  "type": "float"
+                }
+              }
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "golang": {
+          "properties": {
+            "goroutines": {
+              "type": "long"
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "active": {
+                      "type": "float"
+                    },
+                    "allocated": {
+                      "type": "float"
+                    },
+                    "frees": {
+                      "type": "float"
+                    },
+                    "idle": {
+                      "type": "float"
+                    },
+                    "mallocs": {
+                      "type": "float"
+                    },
+                    "objects": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "gc": {
+                  "properties": {
+                    "cpu_fraction": {
+                      "type": "float"
+                    },
+                    "next_gc_limit": {
+                      "type": "float"
+                    },
+                    "total_count": {
+                      "type": "long"
+                    },
+                    "total_pause": {
+                      "properties": {
+                        "ns": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                },
+                "system": {
+                  "properties": {
+                    "obtained": {
+                      "type": "float"
+                    },
+                    "released": {
+                      "type": "float"
+                    },
+                    "stack": {
+                      "type": "long"
+                    },
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jvm": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "alloc": {
+                  "type": "float"
+                },
+                "count": {
+                  "type": "long"
+                },
+                "time": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "float"
+                    },
+                    "pool": {
+                      "properties": {
+                        "committed": {
+                          "type": "float"
+                        },
+                        "max": {
+                          "type": "float"
+                        },
+                        "used": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "non_heap": {
+                  "properties": {
+                    "committed": {
+                      "type": "float"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "used": {
+                      "type": "float"
+                    }
+                  }
+                }
+              }
+            },
+            "thread": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "env": {
+              "type": "keyword"
+            },
+            "hostname": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "nodejs": {
+          "properties": {
+            "eventloop": {
+              "properties": {
+                "delay": {
+                  "properties": {
+                    "avg": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "ns": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "handles": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "arrayBuffers": {
+                  "properties": {
+                    "bytes": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "external": {
+                  "properties": {
+                    "bytes": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "heap": {
+                  "properties": {
+                    "allocated": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "used": {
+                      "properties": {
+                        "bytes": {
+                          "type": "float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "requests": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ruby": {
+          "properties": {
+            "gc": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "heap": {
+              "properties": {
+                "allocations": {
+                  "properties": {
+                    "total": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "slots": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    },
+                    "live": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "threads": {
+              "type": "long"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cgroup": {
+                  "properties": {
+                    "memory": {
+                      "properties": {
+                        "mem": {
+                          "properties": {
+                            "limit": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            },
+                            "usage": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            }
+                          }
+                        },
+                        "stats": {
+                          "properties": {
+                            "inactive_file": {
+                              "properties": {
+                                "bytes": {
+                                  "type": "float"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "cpu": {
+                  "properties": {
+                    "system": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "user": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-metric"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-span": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-span-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "foo": {
+              "type": "keyword"
+            },
+            "productId": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-span"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-span": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-span-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "foo": {
+              "type": "keyword"
+            },
+            "productId": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-span"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-span": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-span-2020.07.31-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "foo": {
+              "type": "keyword"
+            },
+            "productId": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-span"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-span": {
+        "is_write_index": true
+      }
+    },
+    "index": "apm-8.0.0-span-2020.07.31-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "foo": {
+              "type": "keyword"
+            },
+            "productId": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-span"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-transaction": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-transaction-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_email": {
+              "type": "keyword"
+            },
+            "customer_name": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "served_from_cache": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                },
+                "agent": {
+                  "properties": {
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "firstContentfulPaint": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "largestContentfulPaint": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "timeToFirstByte": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                },
+                "navigationTiming": {
+                  "properties": {
+                    "connectEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "connectStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domLoading": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "fetchStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "requestStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-transaction"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-transaction": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-transaction-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_email": {
+              "type": "keyword"
+            },
+            "customer_name": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            },
+            "served_from_cache": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                },
+                "agent": {
+                  "properties": {
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "firstContentfulPaint": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "largestContentfulPaint": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "timeToFirstByte": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                },
+                "navigationTiming": {
+                  "properties": {
+                    "connectEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "connectStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domLoading": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "fetchStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "requestStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "false",
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-transaction"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "50",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-transaction": {
+        "is_write_index": false
+      }
+    },
+    "index": "apm-8.0.0-transaction-2020.07.31-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_email": {
+              "type": "keyword"
+            },
+            "customer_name": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            },
+            "served_from_cache": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                },
+                "agent": {
+                  "properties": {
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "timeToFirstByte": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                },
+                "navigationTiming": {
+                  "properties": {
+                    "connectEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "connectStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domLoading": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "fetchStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "requestStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-transaction"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "apm-8.0.0-transaction": {
+        "is_write_index": true
+      }
+    },
+    "index": "apm-8.0.0-transaction-2020.07.31-000002",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "properties": {
+            "company": {
+              "type": "keyword"
+            },
+            "customer_email": {
+              "type": "keyword"
+            },
+            "customer_name": {
+              "type": "keyword"
+            },
+            "customer_tier": {
+              "type": "keyword"
+            },
+            "foo": {
+              "type": "keyword"
+            },
+            "lorem": {
+              "type": "keyword"
+            },
+            "multi-line": {
+              "type": "keyword"
+            },
+            "request_id": {
+              "type": "keyword"
+            },
+            "served_from_cache": {
+              "type": "keyword"
+            },
+            "this-is-a-very-long-tag-name-without-any-spaces": {
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                },
+                "agent": {
+                  "properties": {
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "timeToFirstByte": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                },
+                "navigationTiming": {
+                  "properties": {
+                    "connectEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "connectStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domComplete": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domContentLoadedEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domInteractive": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domLoading": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "domainLookupStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "fetchStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "loadEventStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "requestStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseEnd": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    },
+                    "responseStart": {
+                      "scaling_factor": 1000000,
+                      "type": "scaled_float"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "lifecycle": {
+          "name": "apm-rollover-30-days",
+          "rollover_alias": "apm-8.0.0-transaction"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "priority": "100",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts b/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts
index 4002e8cff5badb..aadff2c31a17ba 100644
--- a/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts
+++ b/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts
@@ -285,5 +285,37 @@ export default function serviceMapsApiTests({ getService }: FtrProviderContext)
         });
       });
     });
+
+    describe('when there is data with anomalies', () => {
+      before(() => esArchiver.load('ml_8.0.0'));
+      after(() => esArchiver.unload('ml_8.0.0'));
+
+      it('returns service map elements', async () => {
+        const response = await supertest.get(
+          '/api/apm/service-map?start=2020-08-26T11%3A00%3A00.000Z&end=2020-08-26T11%3A30%3A00.000Z'
+        );
+
+        expect(response.status).to.be(200);
+        const opbeansJavaWithAnomaly = response.body.elements.filter(
+          (el: { data: { id: string } }) => el.data.id === 'opbeans-java'
+        );
+        expect(opbeansJavaWithAnomaly).to.eql([
+          {
+            data: {
+              id: 'opbeans-java',
+              'service.environment': 'production',
+              'service.name': 'opbeans-java',
+              'agent.name': 'java',
+              serviceAnomalyStats: {
+                transactionType: 'request',
+                anomalyScore: 0.21359169006333134,
+                actualValue: 1526662.1320754716,
+                jobId: 'apm-production-229a-high_mean_transaction_duration',
+              },
+            },
+          },
+        ]);
+      });
+    });
   });
 }
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
index a022b7c79c0795..c682c1f1f46402 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
@@ -49,7 +49,7 @@ export default ({ getService }: FtrProviderContext): void => {
         await deleteAllTimelines(es);
       });
 
-      it('should contain two output keys of rules_installed and rules_updated', async () => {
+      it('should contain rules_installed, rules_updated, timelines_installed, and timelines_updated', async () => {
         const { body } = await supertest
           .put(DETECTION_ENGINE_PREPACKAGED_URL)
           .set('kbn-xsrf', 'true')
@@ -74,6 +74,16 @@ export default ({ getService }: FtrProviderContext): void => {
         expect(body.rules_installed).to.be.greaterThan(0);
       });
 
+      it('should create the prepackaged timelines and return a count greater than zero', async () => {
+        const { body } = await supertest
+          .put(DETECTION_ENGINE_PREPACKAGED_URL)
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+
+        expect(body.timelines_installed).to.be.greaterThan(0);
+      });
+
       it('should create the prepackaged rules that the rules_updated is of size zero', async () => {
         const { body } = await supertest
           .put(DETECTION_ENGINE_PREPACKAGED_URL)
@@ -84,6 +94,16 @@ export default ({ getService }: FtrProviderContext): void => {
         expect(body.rules_updated).to.eql(0);
       });
 
+      it('should create the prepackaged timelines and the timelines_updated is of size zero', async () => {
+        const { body } = await supertest
+          .put(DETECTION_ENGINE_PREPACKAGED_URL)
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+
+        expect(body.timelines_updated).to.eql(0);
+      });
+
       it('should be possible to call the API twice and the second time the number of rules installed should be zero', async () => {
         await supertest
           .put(DETECTION_ENGINE_PREPACKAGED_URL)
@@ -109,6 +129,30 @@ export default ({ getService }: FtrProviderContext): void => {
 
         expect(body.rules_installed).to.eql(0);
       });
+
+      it('should be possible to call the API twice and the second time the number of timelines installed should be zero', async () => {
+        await supertest
+          .put(DETECTION_ENGINE_PREPACKAGED_URL)
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+
+        await waitFor(async () => {
+          const { body } = await supertest
+            .get(`${DETECTION_ENGINE_PREPACKAGED_URL}/_status`)
+            .set('kbn-xsrf', 'true')
+            .expect(200);
+          return body.timelines_not_installed === 0;
+        });
+
+        const { body } = await supertest
+          .put(DETECTION_ENGINE_PREPACKAGED_URL)
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+
+        expect(body.timelines_installed).to.eql(0);
+      });
     });
   });
 };
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/import_timelines.ts b/x-pack/test/detection_engine_api_integration/basic/tests/import_timelines.ts
new file mode 100644
index 00000000000000..209c7974a7c2a3
--- /dev/null
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/import_timelines.ts
@@ -0,0 +1,403 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+
+import { TIMELINE_IMPORT_URL } from '../../../../plugins/security_solution/common/constants';
+
+import { FtrProviderContext } from '../../common/ftr_provider_context';
+import { deleteAllTimelines } from '../../utils';
+
+// eslint-disable-next-line import/no-default-export
+export default ({ getService }: FtrProviderContext): void => {
+  const supertest = getService('supertest');
+  const es = getService('es');
+
+  describe('import timelines', () => {
+    describe('creating a timeline', () => {
+      const getTimeline = () => {
+        return Buffer.from(
+          JSON.stringify({
+            savedObjectId: '67664480-d191-11ea-ae67-4f4be8c1847b',
+            version: 'WzU1NSwxXQ==',
+            columns: [
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: '@timestamp',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'message',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'event.category',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'event.action',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'host.name',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'source.ip',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'destination.ip',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'user.name',
+                searchable: null,
+              },
+            ],
+            dataProviders: [],
+            description: '',
+            eventType: 'all',
+            filters: [],
+            kqlMode: 'filter',
+            timelineType: 'default',
+            kqlQuery: {
+              filterQuery: {
+                serializedQuery:
+                  '{"bool":{"should":[{"exists":{"field":"@timestamp"}}],"minimum_should_match":1}}',
+                kuery: {
+                  expression: '@timestamp : * ',
+                  kind: 'kuery',
+                },
+              },
+            },
+            title: 'x2',
+            sort: {
+              columnId: '@timestamp',
+              sortDirection: 'desc',
+            },
+            created: 1596036895488,
+            createdBy: 'angela',
+            updated: 1596491470411,
+            updatedBy: 'elastic',
+            templateTimelineId: null,
+            templateTimelineVersion: null,
+            dateRange: {
+              start: '2020-04-10T14:10:58.373Z',
+              end: '2020-05-30T14:16:58.373Z',
+            },
+            savedQueryId: null,
+            eventNotes: [
+              {
+                noteId: '7d875ba0-d5d3-11ea-9899-ebec3d084fe0',
+                version: 'WzU1NiwxXQ==',
+                eventId: '8KtMKnIBOS_moQ_K9fAe',
+                note: 'hi Xavier',
+                timelineId: '67664480-d191-11ea-ae67-4f4be8c1847b',
+                created: 1596491490806,
+                createdBy: 'elastic',
+                updated: 1596491490806,
+                updatedBy: 'elastic',
+              },
+            ],
+            globalNotes: [],
+            pinnedEventIds: [
+              'K99zy3EBDTDlbwBfpf6x',
+              'GKpFKnIBOS_moQ_Ke5AO',
+              '8KtMKnIBOS_moQ_K9fAe',
+            ],
+          })
+        );
+      };
+      beforeEach(async () => {});
+
+      afterEach(async () => {
+        await deleteAllTimelines(es);
+      });
+
+      it("if it doesn't exists", async () => {
+        const { body } = await supertest
+          .post(`${TIMELINE_IMPORT_URL}`)
+          .set('kbn-xsrf', 'true')
+          .attach('file', getTimeline(), 'timelines.ndjson')
+          .expect(200);
+        expect(body).to.eql({
+          errors: [],
+          success: true,
+          success_count: 1,
+          timelines_installed: 1,
+          timelines_updated: 0,
+        });
+      });
+    });
+
+    describe('creating a timeline template', () => {
+      const getTimelineTemplate = () => {
+        return Buffer.from(
+          JSON.stringify({
+            savedObjectId: 'cab434d0-d26c-11ea-b887-3b103296472a',
+            version: 'WzQ0NSwxXQ==',
+            columns: [
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: '@timestamp',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'message',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'event.category',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'event.action',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'host.name',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'source.ip',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'destination.ip',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'user.name',
+                searchable: null,
+              },
+            ],
+            dataProviders: [],
+            description: 'desc',
+            eventType: 'all',
+            filters: [],
+            kqlMode: 'filter',
+            timelineType: 'template',
+            kqlQuery: { filterQuery: null },
+            title: 'my t template',
+            sort: { columnId: '@timestamp', sortDirection: 'desc' },
+            templateTimelineId: '46a50505-0a48-49cb-9ab2-d15d683efa3b',
+            templateTimelineVersion: 1,
+            created: 1596473742379,
+            createdBy: 'elastic',
+            updated: 1596473909169,
+            updatedBy: 'elastic',
+            dateRange: { start: '2020-08-02T16:55:22.160Z', end: '2020-08-03T16:55:22.161Z' },
+            savedQueryId: null,
+            eventNotes: [],
+            globalNotes: [
+              {
+                noteId: '358f45c0-d5aa-11ea-9b6d-53d136d390dc',
+                version: 'WzQzOCwxXQ==',
+                note: 'I have a global note',
+                timelineId: 'cab434d0-d26c-11ea-b887-3b103296472a',
+                created: 1596473760688,
+                createdBy: 'elastic',
+                updated: 1596473760688,
+                updatedBy: 'elastic',
+              },
+            ],
+            pinnedEventIds: [],
+          })
+        );
+      };
+
+      afterEach(async () => {
+        await deleteAllTimelines(es);
+      });
+
+      it("if it doesn't exists", async () => {
+        const { body } = await supertest
+          .post(`${TIMELINE_IMPORT_URL}`)
+          .set('kbn-xsrf', 'true')
+          .attach('file', getTimelineTemplate(), 'timelines.ndjson')
+          .expect(200);
+        expect(body).to.eql({
+          errors: [],
+          success: true,
+          success_count: 1,
+          timelines_installed: 1,
+          timelines_updated: 0,
+        });
+      });
+    });
+
+    describe('Updating a timeline template', () => {
+      const getTimelineTemplate = (templateTimelineVersion: number) => {
+        return Buffer.from(
+          JSON.stringify({
+            savedObjectId: 'cab434d0-d26c-11ea-b887-3b103296472a',
+            version: 'WzQ0NSwxXQ==',
+            columns: [
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: '@timestamp',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'message',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'event.category',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'event.action',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'host.name',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'source.ip',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'destination.ip',
+                searchable: null,
+              },
+              {
+                indexes: null,
+                name: null,
+                columnHeaderType: 'not-filtered',
+                id: 'user.name',
+                searchable: null,
+              },
+            ],
+            dataProviders: [],
+            description: 'desc',
+            eventType: 'all',
+            filters: [],
+            kqlMode: 'filter',
+            timelineType: 'template',
+            kqlQuery: { filterQuery: null },
+            title: 'my t template',
+            sort: { columnId: '@timestamp', sortDirection: 'desc' },
+            templateTimelineId: '46a50505-0a48-49cb-9ab2-d15d683efa3b',
+            templateTimelineVersion,
+            created: 1596473742379,
+            createdBy: 'elastic',
+            updated: 1596473909169,
+            updatedBy: 'elastic',
+            dateRange: { start: '2020-08-02T16:55:22.160Z', end: '2020-08-03T16:55:22.161Z' },
+            savedQueryId: null,
+            eventNotes: [],
+            globalNotes: [
+              {
+                noteId: '358f45c0-d5aa-11ea-9b6d-53d136d390dc',
+                version: 'WzQzOCwxXQ==',
+                note: 'I have a global note',
+                timelineId: 'cab434d0-d26c-11ea-b887-3b103296472a',
+                created: 1596473760688,
+                createdBy: 'elastic',
+                updated: 1596473760688,
+                updatedBy: 'elastic',
+              },
+            ],
+            pinnedEventIds: [],
+          })
+        );
+      };
+
+      afterEach(async () => {
+        await deleteAllTimelines(es);
+      });
+
+      it("if it doesn't exists", async () => {
+        await supertest
+          .post(`${TIMELINE_IMPORT_URL}`)
+          .set('kbn-xsrf', 'true')
+          .attach('file', getTimelineTemplate(1), 'timelines.ndjson')
+          .expect(200);
+        const { body } = await supertest
+          .post(`${TIMELINE_IMPORT_URL}`)
+          .set('kbn-xsrf', 'true')
+          .attach('file', getTimelineTemplate(2), 'timelines.ndjson')
+          .expect(200);
+        expect(body).to.eql({
+          errors: [],
+          success: true,
+          success_count: 1,
+          timelines_installed: 0,
+          timelines_updated: 1,
+        });
+      });
+    });
+  });
+};
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/index.ts b/x-pack/test/detection_engine_api_integration/basic/tests/index.ts
index a480e63ff4a923..09feb7ac5e0ec3 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/index.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/index.ts
@@ -28,5 +28,6 @@ export default ({ loadTestFile }: FtrProviderContext): void => {
     loadTestFile(require.resolve('./patch_rules'));
     loadTestFile(require.resolve('./query_signals'));
     loadTestFile(require.resolve('./open_close_signals'));
+    loadTestFile(require.resolve('./import_timelines'));
   });
 };
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/install_prepackaged_timelines.ts b/x-pack/test/detection_engine_api_integration/basic/tests/install_prepackaged_timelines.ts
new file mode 100644
index 00000000000000..556217877968b6
--- /dev/null
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/install_prepackaged_timelines.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+
+import { TIMELINE_PREPACKAGED_URL } from '../../../../plugins/security_solution/common/constants';
+import { FtrProviderContext } from '../../common/ftr_provider_context';
+import {
+  createSignalsIndex,
+  deleteAllAlerts,
+  deleteAllTimelines,
+  deleteSignalsIndex,
+  waitFor,
+} from '../../utils';
+
+// eslint-disable-next-line import/no-default-export
+export default ({ getService }: FtrProviderContext): void => {
+  const supertest = getService('supertest');
+  const es = getService('es');
+
+  describe('install_prepackaged_timelines', () => {
+    describe('creating prepackaged rules', () => {
+      beforeEach(async () => {
+        await createSignalsIndex(supertest);
+      });
+
+      afterEach(async () => {
+        await deleteSignalsIndex(supertest);
+        await deleteAllAlerts(es);
+        await deleteAllTimelines(es);
+      });
+
+      it('should contain timelines_installed, and timelines_updated', async () => {
+        const { body } = await supertest
+          .put(TIMELINE_PREPACKAGED_URL)
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+
+        expect(Object.keys(body)).to.eql(['timelines_installed', 'timelines_updated']);
+      });
+
+      it('should create the prepackaged timelines and return a count greater than zero', async () => {
+        const { body } = await supertest
+          .put(TIMELINE_PREPACKAGED_URL)
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+
+        expect(body.timelines_installed).to.be.greaterThan(0);
+      });
+
+      it('should create the prepackaged timelines and the timelines_updated is of size zero', async () => {
+        const { body } = await supertest
+          .put(TIMELINE_PREPACKAGED_URL)
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+
+        expect(body.timelines_updated).to.eql(0);
+      });
+
+      it('should be possible to call the API twice and the second time the number of timelines installed should be zero', async () => {
+        await supertest.put(TIMELINE_PREPACKAGED_URL).set('kbn-xsrf', 'true').send().expect(200);
+
+        await waitFor(async () => {
+          const { body } = await supertest
+            .get(`${TIMELINE_PREPACKAGED_URL}/_status`)
+            .set('kbn-xsrf', 'true')
+            .expect(200);
+          return body.timelines_not_installed === 0;
+        });
+
+        const { body } = await supertest
+          .put(TIMELINE_PREPACKAGED_URL)
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+
+        expect(body.timelines_installed).to.eql(0);
+      });
+    });
+  });
+};
diff --git a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_drilldowns.ts b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_drilldowns.ts
deleted file mode 100644
index 29ead0db1c6349..00000000000000
--- a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_drilldowns.ts
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import { FtrProviderContext } from '../../../ftr_provider_context';
-
-const DRILLDOWN_TO_PIE_CHART_NAME = 'Go to pie chart dashboard';
-const DRILLDOWN_TO_AREA_CHART_NAME = 'Go to area chart dashboard';
-
-export default function ({ getService, getPageObjects }: FtrProviderContext) {
-  const dashboardPanelActions = getService('dashboardPanelActions');
-  const dashboardDrilldownPanelActions = getService('dashboardDrilldownPanelActions');
-  const dashboardDrilldownsManage = getService('dashboardDrilldownsManage');
-  const PageObjects = getPageObjects(['dashboard', 'common', 'header', 'timePicker']);
-  const pieChart = getService('pieChart');
-  const log = getService('log');
-  const browser = getService('browser');
-  const retry = getService('retry');
-  const testSubjects = getService('testSubjects');
-  const filterBar = getService('filterBar');
-
-  describe('Dashboard Drilldowns', function () {
-    before(async () => {
-      log.debug('Dashboard Drilldowns:initTests');
-      await PageObjects.common.navigateToApp('dashboard');
-      await PageObjects.dashboard.preserveCrossAppState();
-    });
-
-    it('should create dashboard to dashboard drilldown, use it, and then delete it', async () => {
-      await PageObjects.dashboard.gotoDashboardEditMode(
-        dashboardDrilldownsManage.DASHBOARD_WITH_PIE_CHART_NAME
-      );
-
-      // create drilldown
-      await dashboardPanelActions.openContextMenu();
-      await dashboardDrilldownPanelActions.expectExistsCreateDrilldownAction();
-      await dashboardDrilldownPanelActions.clickCreateDrilldown();
-      await dashboardDrilldownsManage.expectsCreateDrilldownFlyoutOpen();
-      await dashboardDrilldownsManage.fillInDashboardToDashboardDrilldownWizard({
-        drilldownName: DRILLDOWN_TO_AREA_CHART_NAME,
-        destinationDashboardTitle: dashboardDrilldownsManage.DASHBOARD_WITH_AREA_CHART_NAME,
-      });
-      await dashboardDrilldownsManage.saveChanges();
-      await dashboardDrilldownsManage.expectsCreateDrilldownFlyoutClose();
-
-      // check that drilldown notification badge is shown
-      expect(await PageObjects.dashboard.getPanelDrilldownCount()).to.be(1);
-
-      // save dashboard, navigate to view mode
-      await PageObjects.dashboard.saveDashboard(
-        dashboardDrilldownsManage.DASHBOARD_WITH_PIE_CHART_NAME,
-        {
-          saveAsNew: false,
-          waitDialogIsClosed: true,
-        }
-      );
-
-      // trigger drilldown action by clicking on a pie and picking drilldown action by it's name
-      await pieChart.clickOnPieSlice('40,000');
-      await dashboardDrilldownPanelActions.expectMultipleActionsMenuOpened();
-
-      const href = await dashboardDrilldownPanelActions.getActionHrefByText(
-        DRILLDOWN_TO_AREA_CHART_NAME
-      );
-      expect(typeof href).to.be('string'); // checking that action has a href
-      const dashboardIdFromHref = PageObjects.dashboard.getDashboardIdFromUrl(href);
-
-      await navigateWithinDashboard(async () => {
-        await dashboardDrilldownPanelActions.clickActionByText(DRILLDOWN_TO_AREA_CHART_NAME);
-      });
-      // checking that href is at least pointing to the same dashboard that we are navigated to by regular click
-      expect(dashboardIdFromHref).to.be(await PageObjects.dashboard.getDashboardIdFromCurrentUrl());
-
-      // check that we drilled-down with filter from pie chart
-      expect(await filterBar.getFilterCount()).to.be(1);
-
-      const originalTimeRangeDurationHours = await PageObjects.timePicker.getTimeDurationInHours();
-
-      // brush area chart and drilldown back to pie chat dashboard
-      await brushAreaChart();
-      await dashboardDrilldownPanelActions.expectMultipleActionsMenuOpened();
-
-      await navigateWithinDashboard(async () => {
-        await dashboardDrilldownPanelActions.clickActionByText(DRILLDOWN_TO_PIE_CHART_NAME);
-      });
-
-      // because filters are preserved during navigation, we expect that only one slice is displayed (filter is still applied)
-      expect(await filterBar.getFilterCount()).to.be(1);
-      await pieChart.expectPieSliceCount(1);
-
-      // check that new time range duration was applied
-      const newTimeRangeDurationHours = await PageObjects.timePicker.getTimeDurationInHours();
-      expect(newTimeRangeDurationHours).to.be.lessThan(originalTimeRangeDurationHours);
-
-      // delete drilldown
-      await PageObjects.dashboard.switchToEditMode();
-      await dashboardPanelActions.openContextMenu();
-      await dashboardDrilldownPanelActions.expectExistsManageDrilldownsAction();
-      await dashboardDrilldownPanelActions.clickManageDrilldowns();
-      await dashboardDrilldownsManage.expectsManageDrilldownsFlyoutOpen();
-
-      await dashboardDrilldownsManage.deleteDrilldownsByTitles([DRILLDOWN_TO_AREA_CHART_NAME]);
-      await dashboardDrilldownsManage.closeFlyout();
-
-      // check that drilldown notification badge is shown
-      expect(await PageObjects.dashboard.getPanelDrilldownCount()).to.be(0);
-    });
-
-    it('browser back/forward navigation works after drilldown navigation', async () => {
-      await PageObjects.dashboard.loadSavedDashboard(
-        dashboardDrilldownsManage.DASHBOARD_WITH_AREA_CHART_NAME
-      );
-      const originalTimeRangeDurationHours = await PageObjects.timePicker.getTimeDurationInHours();
-      await brushAreaChart();
-      await dashboardDrilldownPanelActions.expectMultipleActionsMenuOpened();
-      await navigateWithinDashboard(async () => {
-        await dashboardDrilldownPanelActions.clickActionByText(DRILLDOWN_TO_PIE_CHART_NAME);
-      });
-      // check that new time range duration was applied
-      const newTimeRangeDurationHours = await PageObjects.timePicker.getTimeDurationInHours();
-      expect(newTimeRangeDurationHours).to.be.lessThan(originalTimeRangeDurationHours);
-
-      await navigateWithinDashboard(async () => {
-        await browser.goBack();
-      });
-
-      expect(await PageObjects.timePicker.getTimeDurationInHours()).to.be(
-        originalTimeRangeDurationHours
-      );
-    });
-  });
-
-  // utils which shouldn't be a part of test flow, but also too specific to be moved to pageobject or service
-  async function brushAreaChart() {
-    const areaChart = await testSubjects.find('visualizationLoader');
-    expect(await areaChart.getAttribute('data-title')).to.be('Visualization漢字 AreaChart');
-    await browser.dragAndDrop(
-      {
-        location: areaChart,
-        offset: {
-          x: -100,
-          y: 0,
-        },
-      },
-      {
-        location: areaChart,
-        offset: {
-          x: 100,
-          y: 0,
-        },
-      }
-    );
-  }
-
-  async function navigateWithinDashboard(navigationTrigger: () => Promise<void>) {
-    // before executing action which would trigger navigation: remember current dashboard id in url
-    const oldDashboardId = await PageObjects.dashboard.getDashboardIdFromCurrentUrl();
-    // execute navigation action
-    await navigationTrigger();
-    // wait until dashboard navigates to a new dashboard with area chart
-    await retry.waitFor('navigate to different dashboard', async () => {
-      const newDashboardId = await PageObjects.dashboard.getDashboardIdFromCurrentUrl();
-      return typeof newDashboardId === 'string' && oldDashboardId !== newDashboardId;
-    });
-    await PageObjects.header.waitUntilLoadingHasFinished();
-    await PageObjects.dashboard.waitForRenderComplete();
-  }
-}
diff --git a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_dashboard_drilldown.ts b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_dashboard_drilldown.ts
new file mode 100644
index 00000000000000..c300412c393bcb
--- /dev/null
+++ b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_dashboard_drilldown.ts
@@ -0,0 +1,171 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+const DRILLDOWN_TO_PIE_CHART_NAME = 'Go to pie chart dashboard';
+const DRILLDOWN_TO_AREA_CHART_NAME = 'Go to area chart dashboard';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const dashboardPanelActions = getService('dashboardPanelActions');
+  const dashboardDrilldownPanelActions = getService('dashboardDrilldownPanelActions');
+  const dashboardDrilldownsManage = getService('dashboardDrilldownsManage');
+  const PageObjects = getPageObjects(['dashboard', 'common', 'header', 'timePicker']);
+  const pieChart = getService('pieChart');
+  const log = getService('log');
+  const browser = getService('browser');
+  const retry = getService('retry');
+  const testSubjects = getService('testSubjects');
+  const filterBar = getService('filterBar');
+
+  describe('Dashboard to dashboard drilldown', function () {
+    before(async () => {
+      log.debug('Dashboard Drilldowns:initTests');
+      await PageObjects.common.navigateToApp('dashboard');
+      await PageObjects.dashboard.preserveCrossAppState();
+    });
+
+    it('should create dashboard to dashboard drilldown, use it, and then delete it', async () => {
+      await PageObjects.dashboard.gotoDashboardEditMode(
+        dashboardDrilldownsManage.DASHBOARD_WITH_PIE_CHART_NAME
+      );
+
+      // create drilldown
+      await dashboardPanelActions.openContextMenu();
+      await dashboardDrilldownPanelActions.expectExistsCreateDrilldownAction();
+      await dashboardDrilldownPanelActions.clickCreateDrilldown();
+      await dashboardDrilldownsManage.expectsCreateDrilldownFlyoutOpen();
+      await dashboardDrilldownsManage.fillInDashboardToDashboardDrilldownWizard({
+        drilldownName: DRILLDOWN_TO_AREA_CHART_NAME,
+        destinationDashboardTitle: dashboardDrilldownsManage.DASHBOARD_WITH_AREA_CHART_NAME,
+      });
+      await dashboardDrilldownsManage.saveChanges();
+      await dashboardDrilldownsManage.expectsCreateDrilldownFlyoutClose();
+
+      // check that drilldown notification badge is shown
+      expect(await PageObjects.dashboard.getPanelDrilldownCount()).to.be(1);
+
+      // save dashboard, navigate to view mode
+      await PageObjects.dashboard.saveDashboard(
+        dashboardDrilldownsManage.DASHBOARD_WITH_PIE_CHART_NAME,
+        {
+          saveAsNew: false,
+          waitDialogIsClosed: true,
+        }
+      );
+
+      // trigger drilldown action by clicking on a pie and picking drilldown action by it's name
+      await pieChart.clickOnPieSlice('40,000');
+      await dashboardDrilldownPanelActions.expectMultipleActionsMenuOpened();
+
+      const href = await dashboardDrilldownPanelActions.getActionHrefByText(
+        DRILLDOWN_TO_AREA_CHART_NAME
+      );
+      expect(typeof href).to.be('string'); // checking that action has a href
+      const dashboardIdFromHref = PageObjects.dashboard.getDashboardIdFromUrl(href);
+
+      await navigateWithinDashboard(async () => {
+        await dashboardDrilldownPanelActions.clickActionByText(DRILLDOWN_TO_AREA_CHART_NAME);
+      });
+      // checking that href is at least pointing to the same dashboard that we are navigated to by regular click
+      expect(dashboardIdFromHref).to.be(await PageObjects.dashboard.getDashboardIdFromCurrentUrl());
+
+      // check that we drilled-down with filter from pie chart
+      expect(await filterBar.getFilterCount()).to.be(1);
+
+      const originalTimeRangeDurationHours = await PageObjects.timePicker.getTimeDurationInHours();
+
+      // brush area chart and drilldown back to pie chat dashboard
+      await brushAreaChart();
+      await dashboardDrilldownPanelActions.expectMultipleActionsMenuOpened();
+
+      await navigateWithinDashboard(async () => {
+        await dashboardDrilldownPanelActions.clickActionByText(DRILLDOWN_TO_PIE_CHART_NAME);
+      });
+
+      // because filters are preserved during navigation, we expect that only one slice is displayed (filter is still applied)
+      expect(await filterBar.getFilterCount()).to.be(1);
+      await pieChart.expectPieSliceCount(1);
+
+      // check that new time range duration was applied
+      const newTimeRangeDurationHours = await PageObjects.timePicker.getTimeDurationInHours();
+      expect(newTimeRangeDurationHours).to.be.lessThan(originalTimeRangeDurationHours);
+
+      // delete drilldown
+      await PageObjects.dashboard.switchToEditMode();
+      await dashboardPanelActions.openContextMenu();
+      await dashboardDrilldownPanelActions.expectExistsManageDrilldownsAction();
+      await dashboardDrilldownPanelActions.clickManageDrilldowns();
+      await dashboardDrilldownsManage.expectsManageDrilldownsFlyoutOpen();
+
+      await dashboardDrilldownsManage.deleteDrilldownsByTitles([DRILLDOWN_TO_AREA_CHART_NAME]);
+      await dashboardDrilldownsManage.closeFlyout();
+
+      // check that drilldown notification badge is shown
+      expect(await PageObjects.dashboard.getPanelDrilldownCount()).to.be(0);
+    });
+
+    it('browser back/forward navigation works after drilldown navigation', async () => {
+      await PageObjects.dashboard.loadSavedDashboard(
+        dashboardDrilldownsManage.DASHBOARD_WITH_AREA_CHART_NAME
+      );
+      const originalTimeRangeDurationHours = await PageObjects.timePicker.getTimeDurationInHours();
+      await brushAreaChart();
+      await dashboardDrilldownPanelActions.expectMultipleActionsMenuOpened();
+      await navigateWithinDashboard(async () => {
+        await dashboardDrilldownPanelActions.clickActionByText(DRILLDOWN_TO_PIE_CHART_NAME);
+      });
+      // check that new time range duration was applied
+      const newTimeRangeDurationHours = await PageObjects.timePicker.getTimeDurationInHours();
+      expect(newTimeRangeDurationHours).to.be.lessThan(originalTimeRangeDurationHours);
+
+      await navigateWithinDashboard(async () => {
+        await browser.goBack();
+      });
+
+      expect(await PageObjects.timePicker.getTimeDurationInHours()).to.be(
+        originalTimeRangeDurationHours
+      );
+    });
+  });
+
+  // utils which shouldn't be a part of test flow, but also too specific to be moved to pageobject or service
+  async function brushAreaChart() {
+    const areaChart = await testSubjects.find('visualizationLoader');
+    expect(await areaChart.getAttribute('data-title')).to.be('Visualization漢字 AreaChart');
+    await browser.dragAndDrop(
+      {
+        location: areaChart,
+        offset: {
+          x: -100,
+          y: 0,
+        },
+      },
+      {
+        location: areaChart,
+        offset: {
+          x: 100,
+          y: 0,
+        },
+      }
+    );
+  }
+
+  async function navigateWithinDashboard(navigationTrigger: () => Promise<void>) {
+    // before executing action which would trigger navigation: remember current dashboard id in url
+    const oldDashboardId = await PageObjects.dashboard.getDashboardIdFromCurrentUrl();
+    // execute navigation action
+    await navigationTrigger();
+    // wait until dashboard navigates to a new dashboard with area chart
+    await retry.waitFor('navigate to different dashboard', async () => {
+      const newDashboardId = await PageObjects.dashboard.getDashboardIdFromCurrentUrl();
+      return typeof newDashboardId === 'string' && oldDashboardId !== newDashboardId;
+    });
+    await PageObjects.header.waitUntilLoadingHasFinished();
+    await PageObjects.dashboard.waitForRenderComplete();
+  }
+}
diff --git a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_url_drilldown.ts b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_url_drilldown.ts
new file mode 100644
index 00000000000000..12de29c4fde108
--- /dev/null
+++ b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_url_drilldown.ts
@@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+const DRILLDOWN_TO_DISCOVER_URL = 'Go to discover';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const dashboardPanelActions = getService('dashboardPanelActions');
+  const dashboardDrilldownPanelActions = getService('dashboardDrilldownPanelActions');
+  const dashboardDrilldownsManage = getService('dashboardDrilldownsManage');
+  const PageObjects = getPageObjects(['dashboard', 'common', 'header', 'timePicker', 'discover']);
+  const log = getService('log');
+  const browser = getService('browser');
+  const testSubjects = getService('testSubjects');
+
+  describe('Dashboard to URL drilldown', function () {
+    before(async () => {
+      log.debug('Dashboard to URL:initTests');
+      await PageObjects.common.navigateToApp('dashboard');
+      await PageObjects.dashboard.preserveCrossAppState();
+    });
+
+    it('should create dashboard to URL drilldown and use it to navigate to discover', async () => {
+      await PageObjects.dashboard.gotoDashboardEditMode(
+        dashboardDrilldownsManage.DASHBOARD_WITH_AREA_CHART_NAME
+      );
+
+      // create drilldown
+      await dashboardPanelActions.openContextMenu();
+      await dashboardDrilldownPanelActions.expectExistsCreateDrilldownAction();
+      await dashboardDrilldownPanelActions.clickCreateDrilldown();
+      await dashboardDrilldownsManage.expectsCreateDrilldownFlyoutOpen();
+
+      const urlTemplate = `{{kibanaUrl}}/app/discover#/?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:'{{event.from}}',to:'{{event.to}}'))&_a=(columns:!(_source),filters:{{rison context.panel.filters}},index:'{{context.panel.indexPatternId}}',interval:auto,query:(language:{{context.panel.query.language}},query:'{{context.panel.query.query}}'),sort:!())`;
+
+      await dashboardDrilldownsManage.fillInDashboardToURLDrilldownWizard({
+        drilldownName: DRILLDOWN_TO_DISCOVER_URL,
+        destinationURLTemplate: urlTemplate,
+        trigger: 'SELECT_RANGE_TRIGGER',
+      });
+      await dashboardDrilldownsManage.saveChanges();
+      await dashboardDrilldownsManage.expectsCreateDrilldownFlyoutClose();
+
+      // check that drilldown notification badge is shown
+      expect(await PageObjects.dashboard.getPanelDrilldownCount()).to.be(2);
+
+      // save dashboard, navigate to view mode
+      await PageObjects.dashboard.saveDashboard(
+        dashboardDrilldownsManage.DASHBOARD_WITH_AREA_CHART_NAME,
+        {
+          saveAsNew: false,
+          waitDialogIsClosed: true,
+        }
+      );
+
+      const originalTimeRangeDurationHours = await PageObjects.timePicker.getTimeDurationInHours();
+
+      await brushAreaChart();
+      await dashboardDrilldownPanelActions.expectMultipleActionsMenuOpened();
+      await dashboardDrilldownPanelActions.clickActionByText(DRILLDOWN_TO_DISCOVER_URL);
+
+      await PageObjects.discover.waitForDiscoverAppOnScreen();
+
+      // check that new time range duration was applied
+      const newTimeRangeDurationHours = await PageObjects.timePicker.getTimeDurationInHours();
+      expect(newTimeRangeDurationHours).to.be.lessThan(originalTimeRangeDurationHours);
+    });
+  });
+
+  // utils which shouldn't be a part of test flow, but also too specific to be moved to pageobject or service
+  async function brushAreaChart() {
+    const areaChart = await testSubjects.find('visualizationLoader');
+    expect(await areaChart.getAttribute('data-title')).to.be('Visualization漢字 AreaChart');
+    await browser.dragAndDrop(
+      {
+        location: areaChart,
+        offset: {
+          x: -100,
+          y: 0,
+        },
+      },
+      {
+        location: areaChart,
+        offset: {
+          x: 100,
+          y: 0,
+        },
+      }
+    );
+  }
+}
diff --git a/x-pack/test/functional/apps/dashboard/drilldowns/index.ts b/x-pack/test/functional/apps/dashboard/drilldowns/index.ts
index ff604b18e1d517..57454f50266daf 100644
--- a/x-pack/test/functional/apps/dashboard/drilldowns/index.ts
+++ b/x-pack/test/functional/apps/dashboard/drilldowns/index.ts
@@ -22,7 +22,8 @@ export default function ({ loadTestFile, getService }: FtrProviderContext) {
       await esArchiver.unload('dashboard/drilldowns');
     });
 
-    loadTestFile(require.resolve('./dashboard_drilldowns'));
+    loadTestFile(require.resolve('./dashboard_to_dashboard_drilldown'));
+    loadTestFile(require.resolve('./dashboard_to_url_drilldown'));
     loadTestFile(require.resolve('./explore_data_panel_action'));
 
     // Disabled for now as it requires xpack.discoverEnhanced.actions.exploreDataInChart.enabled
diff --git a/x-pack/test/functional/apps/infra/home_page.ts b/x-pack/test/functional/apps/infra/home_page.ts
index 04f289b69bb71d..82aba0503fb9d0 100644
--- a/x-pack/test/functional/apps/infra/home_page.ts
+++ b/x-pack/test/functional/apps/infra/home_page.ts
@@ -21,7 +21,8 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const pageObjects = getPageObjects(['common', 'infraHome']);
   const supertest = getService('supertest');
 
-  describe('Home page', function () {
+  // FLAKY: https://github.com/elastic/kibana/issues/75724
+  describe.skip('Home page', function () {
     this.tags('includeFirefox');
     before(async () => {
       await esArchiver.load('empty_kibana');
diff --git a/x-pack/test/functional/apps/maps/index.js b/x-pack/test/functional/apps/maps/index.js
index 4bbe38367d0a21..ef8b4ad4c0f190 100644
--- a/x-pack/test/functional/apps/maps/index.js
+++ b/x-pack/test/functional/apps/maps/index.js
@@ -46,6 +46,7 @@ export default function ({ loadTestFile, getService }) {
       loadTestFile(require.resolve('./es_geo_grid_source'));
       loadTestFile(require.resolve('./es_pew_pew_source'));
       loadTestFile(require.resolve('./joins'));
+      loadTestFile(require.resolve('./mvt_scaling'));
       loadTestFile(require.resolve('./add_layer_panel'));
       loadTestFile(require.resolve('./import_geojson'));
       loadTestFile(require.resolve('./layer_errors'));
diff --git a/x-pack/test/functional/apps/maps/joins.js b/x-pack/test/functional/apps/maps/joins.js
index e447996a08dfe1..1139ae204aefd2 100644
--- a/x-pack/test/functional/apps/maps/joins.js
+++ b/x-pack/test/functional/apps/maps/joins.js
@@ -5,7 +5,6 @@
  */
 
 import expect from '@kbn/expect';
-import { set } from '@elastic/safer-lodash-set';
 
 import { MAPBOX_STYLES } from './mapbox_styles';
 
@@ -21,6 +20,7 @@ const VECTOR_SOURCE_ID = 'n1t6f';
 const CIRCLE_STYLE_LAYER_INDEX = 0;
 const FILL_STYLE_LAYER_INDEX = 2;
 const LINE_STYLE_LAYER_INDEX = 3;
+const TOO_MANY_FEATURES_LAYER_INDEX = 4;
 
 export default function ({ getPageObjects, getService }) {
   const PageObjects = getPageObjects(['maps']);
@@ -87,28 +87,32 @@ export default function ({ getPageObjects, getService }) {
       });
     });
 
-    it('should style fills, points and lines independently', async () => {
+    it('should style fills, points, lines, and bounding-boxes independently', async () => {
       const mapboxStyle = await PageObjects.maps.getMapboxStyle();
       const layersForVectorSource = mapboxStyle.layers.filter((mbLayer) => {
         return mbLayer.id.startsWith(VECTOR_SOURCE_ID);
       });
 
-      // Color is dynamically obtained from eui source lib
-      const dynamicColor =
-        layersForVectorSource[CIRCLE_STYLE_LAYER_INDEX].paint['circle-stroke-color'];
-
       //circle layer for points
-      expect(layersForVectorSource[CIRCLE_STYLE_LAYER_INDEX]).to.eql(
-        set(MAPBOX_STYLES.POINT_LAYER, 'paint.circle-stroke-color', dynamicColor)
-      );
+      expect(layersForVectorSource[CIRCLE_STYLE_LAYER_INDEX]).to.eql(MAPBOX_STYLES.POINT_LAYER);
 
       //fill layer
       expect(layersForVectorSource[FILL_STYLE_LAYER_INDEX]).to.eql(MAPBOX_STYLES.FILL_LAYER);
 
       //line layer for borders
-      expect(layersForVectorSource[LINE_STYLE_LAYER_INDEX]).to.eql(
-        set(MAPBOX_STYLES.LINE_LAYER, 'paint.line-color', dynamicColor)
-      );
+      expect(layersForVectorSource[LINE_STYLE_LAYER_INDEX]).to.eql(MAPBOX_STYLES.LINE_LAYER);
+
+      //Too many features layer (this is a static style config)
+      expect(layersForVectorSource[TOO_MANY_FEATURES_LAYER_INDEX]).to.eql({
+        id: 'n1t6f_toomanyfeatures',
+        type: 'fill',
+        source: 'n1t6f',
+        minzoom: 0,
+        maxzoom: 24,
+        filter: ['==', ['get', '__kbn_too_many_features__'], true],
+        layout: { visibility: 'visible' },
+        paint: { 'fill-pattern': '__kbn_too_many_features_image_id__', 'fill-opacity': 0.75 },
+      });
     });
 
     it('should flag only the joined features as visible', async () => {
diff --git a/x-pack/test/functional/apps/maps/mapbox_styles.js b/x-pack/test/functional/apps/maps/mapbox_styles.js
index 744eb4ac74bf65..78720fa1689ec6 100644
--- a/x-pack/test/functional/apps/maps/mapbox_styles.js
+++ b/x-pack/test/functional/apps/maps/mapbox_styles.js
@@ -14,7 +14,11 @@ export const MAPBOX_STYLES = {
     filter: [
       'all',
       ['==', ['get', '__kbn_isvisibleduetojoin__'], true],
-      ['any', ['==', ['geometry-type'], 'Point'], ['==', ['geometry-type'], 'MultiPoint']],
+      [
+        'all',
+        ['!=', ['get', '__kbn_too_many_features__'], true],
+        ['any', ['==', ['geometry-type'], 'Point'], ['==', ['geometry-type'], 'MultiPoint']],
+      ],
     ],
     layout: { visibility: 'visible' },
     paint: {
@@ -84,7 +88,11 @@ export const MAPBOX_STYLES = {
     filter: [
       'all',
       ['==', ['get', '__kbn_isvisibleduetojoin__'], true],
-      ['any', ['==', ['geometry-type'], 'Polygon'], ['==', ['geometry-type'], 'MultiPolygon']],
+      [
+        'all',
+        ['!=', ['get', '__kbn_too_many_features__'], true],
+        ['any', ['==', ['geometry-type'], 'Polygon'], ['==', ['geometry-type'], 'MultiPolygon']],
+      ],
     ],
     layout: { visibility: 'visible' },
     paint: {
@@ -151,20 +159,18 @@ export const MAPBOX_STYLES = {
       'all',
       ['==', ['get', '__kbn_isvisibleduetojoin__'], true],
       [
-        'any',
-        ['==', ['geometry-type'], 'Polygon'],
-        ['==', ['geometry-type'], 'MultiPolygon'],
-        ['==', ['geometry-type'], 'LineString'],
-        ['==', ['geometry-type'], 'MultiLineString'],
+        'all',
+        ['!=', ['get', '__kbn_too_many_features__'], true],
+        [
+          'any',
+          ['==', ['geometry-type'], 'Polygon'],
+          ['==', ['geometry-type'], 'MultiPolygon'],
+          ['==', ['geometry-type'], 'LineString'],
+          ['==', ['geometry-type'], 'MultiLineString'],
+        ],
       ],
     ],
-    layout: {
-      visibility: 'visible',
-    },
-    paint: {
-      /* 'line-color': '' */ // Obtained dynamically
-      'line-opacity': 0.75,
-      'line-width': 1,
-    },
+    layout: { visibility: 'visible' },
+    paint: { 'line-color': '#41937c', 'line-opacity': 0.75, 'line-width': 1 },
   },
 };
diff --git a/x-pack/test/functional/apps/maps/mvt_scaling.js b/x-pack/test/functional/apps/maps/mvt_scaling.js
new file mode 100644
index 00000000000000..e50b72658fb435
--- /dev/null
+++ b/x-pack/test/functional/apps/maps/mvt_scaling.js
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+
+const VECTOR_SOURCE_ID = 'caffa63a-ebfb-466d-8ff6-d797975b88ab';
+
+export default function ({ getPageObjects, getService }) {
+  const PageObjects = getPageObjects(['maps']);
+  const inspector = getService('inspector');
+
+  describe('mvt geoshape layer', () => {
+    before(async () => {
+      await PageObjects.maps.loadSavedMap('geo_shape_mvt');
+    });
+
+    after(async () => {
+      await inspector.close();
+    });
+
+    it('should render with mvt-source', async () => {
+      const mapboxStyle = await PageObjects.maps.getMapboxStyle();
+
+      //Source should be correct
+      expect(mapboxStyle.sources[VECTOR_SOURCE_ID].tiles[0]).to.equal(
+        '/api/maps/mvt/getTile?x={x}&y={y}&z={z}&geometryFieldName=geometry&index=geo_shapes*&requestBody=(_source:(includes:!(geometry,prop1)),docvalue_fields:!(prop1),query:(bool:(filter:!((match_all:())),must:!(),must_not:!(),should:!())),script_fields:(),size:10000,stored_fields:!(geometry,prop1))'
+      );
+
+      //Should correctly load meta for style-rule (sigma is set to 1, opacity to 1)
+      const fillLayer = mapboxStyle.layers.find((layer) => layer.id === VECTOR_SOURCE_ID + '_fill');
+      expect(fillLayer.paint).to.eql({
+        'fill-color': [
+          'interpolate',
+          ['linear'],
+          [
+            'coalesce',
+            [
+              'case',
+              ['==', ['get', 'prop1'], null],
+              0.3819660112501051,
+              [
+                'max',
+                ['min', ['to-number', ['get', 'prop1']], 3.618033988749895],
+                1.381966011250105,
+              ],
+            ],
+            0.3819660112501051,
+          ],
+          0.3819660112501051,
+          'rgba(0,0,0,0)',
+          1.381966011250105,
+          '#ecf1f7',
+          1.6614745084375788,
+          '#d9e3ef',
+          1.9409830056250525,
+          '#c5d5e7',
+          2.2204915028125263,
+          '#b2c7df',
+          2.5,
+          '#9eb9d8',
+          2.7795084971874737,
+          '#8bacd0',
+          3.0590169943749475,
+          '#769fc8',
+          3.338525491562421,
+          '#6092c0',
+        ],
+        'fill-opacity': 1,
+      });
+    });
+  });
+}
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts
index 18a7a4b26a7528..3fbe101d4ff191 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
@@ -433,9 +432,7 @@ export default function ({ getService }: FtrProviderContext) {
             'job creation displays the created job in the job list'
           );
           await ml.jobTable.refreshJobList();
-          await ml.jobTable.filterWithSearchString(testData.jobId);
-          const rows = await ml.jobTable.parseJobTable();
-          expect(rows.filter((row) => row.id === testData.jobId)).to.have.length(1);
+          await ml.jobTable.filterWithSearchString(testData.jobId, 1);
 
           await ml.testExecution.logTestStep(
             'job creation displays details for the created job in the job list'
@@ -651,9 +648,7 @@ export default function ({ getService }: FtrProviderContext) {
             'job cloning displays the created job in the job list'
           );
           await ml.jobTable.refreshJobList();
-          await ml.jobTable.filterWithSearchString(testData.jobIdClone);
-          const rows = await ml.jobTable.parseJobTable();
-          expect(rows.filter((row) => row.id === testData.jobIdClone)).to.have.length(1);
+          await ml.jobTable.filterWithSearchString(testData.jobIdClone, 1);
 
           await ml.testExecution.logTestStep(
             'job cloning displays details for the created job in the job list'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/annotations.ts b/x-pack/test/functional/apps/ml/anomaly_detection/annotations.ts
index 9e48c71ab0eba5..5353f53e74d0ba 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/annotations.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/annotations.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 import { Job, Datafeed } from '../../../../../plugins/ml/common/types/anomaly_detection_jobs';
@@ -62,9 +61,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.navigation.navigateToJobManagement();
 
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(JOB_CONFIG.job_id);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === JOB_CONFIG.job_id)).to.have.length(1);
+      await ml.jobTable.filterWithSearchString(JOB_CONFIG.job_id, 1);
 
       await ml.jobTable.clickOpenJobInSingleMetricViewerButton(JOB_CONFIG.job_id);
       await ml.commonUI.waitForMlLoadingIndicatorToDisappear();
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/anomaly_explorer.ts b/x-pack/test/functional/apps/ml/anomaly_detection/anomaly_explorer.ts
index cfbebd478fcb86..4fdbda6e548939 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/anomaly_explorer.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/anomaly_explorer.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 import { Job, Datafeed } from '../../../../../plugins/ml/common/types/anomaly_detection_jobs';
@@ -86,9 +85,7 @@ export default function ({ getService }: FtrProviderContext) {
 
           await ml.testExecution.logTestStep('open job in anomaly explorer');
           await ml.jobTable.waitForJobsToLoad();
-          await ml.jobTable.filterWithSearchString(testData.jobConfig.job_id);
-          const rows = await ml.jobTable.parseJobTable();
-          expect(rows.filter((row) => row.id === testData.jobConfig.job_id)).to.have.length(1);
+          await ml.jobTable.filterWithSearchString(testData.jobConfig.job_id, 1);
 
           await ml.jobTable.clickOpenJobInAnomalyExplorerButton(testData.jobConfig.job_id);
           await ml.commonUI.waitForMlLoadingIndicatorToDisappear();
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
index c410aff292ffaf..2524d0486171b0 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 import { CATEGORY_EXAMPLES_VALIDATION_STATUS } from '../../../../../plugins/ml/common/constants/categorization_job';
@@ -202,9 +201,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.navigation.navigateToJobManagement();
 
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(jobId);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === jobId)).to.have.length(1);
+      await ml.jobTable.filterWithSearchString(jobId, 1);
 
       await ml.testExecution.logTestStep(
         'job creation displays details for the created job in the job list'
@@ -320,9 +317,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.navigation.navigateToJobManagement();
 
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(jobIdClone);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === jobIdClone)).to.have.length(1);
+      await ml.jobTable.filterWithSearchString(jobIdClone, 1);
 
       await ml.testExecution.logTestStep(
         'job cloning displays details for the created job in the job list'
@@ -353,9 +348,7 @@ export default function ({ getService }: FtrProviderContext) {
         'job deletion does not display the deleted job in the job list any more'
       );
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(jobIdClone);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === jobIdClone)).to.have.length(0);
+      await ml.jobTable.filterWithSearchString(jobIdClone, 0);
 
       await ml.testExecution.logTestStep(
         'job deletion does not have results for the deleted job any more'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts
index 22b4c4a1fdfe3e..af30946ee08ce5 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
@@ -315,9 +314,7 @@ export default function ({ getService }: FtrProviderContext) {
             'job creation displays the created job in the job list'
           );
           await ml.jobTable.refreshJobList();
-          await ml.jobTable.filterWithSearchString(testData.jobId);
-          const rows = await ml.jobTable.parseJobTable();
-          expect(rows.filter((row) => row.id === testData.jobId)).to.have.length(1);
+          await ml.jobTable.filterWithSearchString(testData.jobId, 1);
 
           await ml.testExecution.logTestStep(
             'job creation displays details for the created job in the job list'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/multi_metric_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/multi_metric_job.ts
index 8702cfd7344543..5324890b269bcd 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/multi_metric_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/multi_metric_job.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
@@ -205,9 +204,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.navigation.navigateToJobManagement();
 
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(jobId);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === jobId)).to.have.length(1);
+      await ml.jobTable.filterWithSearchString(jobId, 1);
 
       await ml.testExecution.logTestStep(
         'job creation displays details for the created job in the job list'
@@ -340,9 +337,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.navigation.navigateToJobManagement();
 
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(jobIdClone);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === jobIdClone)).to.have.length(1);
+      await ml.jobTable.filterWithSearchString(jobIdClone, 1);
 
       await ml.testExecution.logTestStep(
         'job cloning displays details for the created job in the job list'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/population_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/population_job.ts
index 3ec78eccf3de48..4797334ee57af6 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/population_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/population_job.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
@@ -231,9 +230,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.navigation.navigateToJobManagement();
 
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(jobId);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === jobId)).to.have.length(1);
+      await ml.jobTable.filterWithSearchString(jobId, 1);
 
       await ml.testExecution.logTestStep(
         'job creation displays details for the created job in the job list'
@@ -377,9 +374,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.navigation.navigateToJobManagement();
 
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(jobIdClone);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === jobIdClone)).to.have.length(1);
+      await ml.jobTable.filterWithSearchString(jobIdClone, 1);
 
       await ml.testExecution.logTestStep(
         'job cloning displays details for the created job in the job list'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
index 170b88efd70f5f..ea3a42e2f27c80 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
@@ -410,9 +409,7 @@ export default function ({ getService }: FtrProviderContext) {
           await ml.navigation.navigateToJobManagement();
 
           await ml.jobTable.waitForJobsToLoad();
-          await ml.jobTable.filterWithSearchString(testData.jobId);
-          const rows = await ml.jobTable.parseJobTable();
-          expect(rows.filter((row) => row.id === testData.jobId)).to.have.length(1);
+          await ml.jobTable.filterWithSearchString(testData.jobId, 1);
 
           await ml.testExecution.logTestStep(
             'job creation displays details for the created job in the job list'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_job.ts
index ba5628661bfc24..89612e51eee139 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_job.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
@@ -184,9 +183,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.navigation.navigateToJobManagement();
 
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(jobId);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === jobId)).to.have.length(1);
+      await ml.jobTable.filterWithSearchString(jobId, 1);
 
       await ml.testExecution.logTestStep(
         'job creation displays details for the created job in the job list'
@@ -303,9 +300,7 @@ export default function ({ getService }: FtrProviderContext) {
       await ml.navigation.navigateToJobManagement();
 
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(jobIdClone);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === jobIdClone)).to.have.length(1);
+      await ml.jobTable.filterWithSearchString(jobIdClone, 1);
 
       await ml.testExecution.logTestStep(
         'job cloning displays details for the created job in the job list'
@@ -336,9 +331,7 @@ export default function ({ getService }: FtrProviderContext) {
         'job deletion does not display the deleted job in the job list any more'
       );
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(jobIdClone);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === jobIdClone)).to.have.length(0);
+      await ml.jobTable.filterWithSearchString(jobIdClone, 0);
 
       await ml.testExecution.logTestStep(
         'job deletion does not have results for the deleted job any more'
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_viewer.ts b/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_viewer.ts
index e1ab3f8e092c37..1dc4708c57dbcd 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_viewer.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/single_metric_viewer.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 import { Job, Datafeed } from '../../../../../plugins/ml/common/types/anomaly_detection_jobs';
@@ -60,9 +59,7 @@ export default function ({ getService }: FtrProviderContext) {
 
       await ml.testExecution.logTestStep('open job in single metric viewer');
       await ml.jobTable.waitForJobsToLoad();
-      await ml.jobTable.filterWithSearchString(JOB_CONFIG.job_id);
-      const rows = await ml.jobTable.parseJobTable();
-      expect(rows.filter((row) => row.id === JOB_CONFIG.job_id)).to.have.length(1);
+      await ml.jobTable.filterWithSearchString(JOB_CONFIG.job_id, 1);
 
       await ml.jobTable.clickOpenJobInSingleMetricViewerButton(JOB_CONFIG.job_id);
       await ml.commonUI.waitForMlLoadingIndicatorToDisappear();
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts
index 6beefaafa37926..e12c853a0be83f 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
@@ -147,13 +146,7 @@ export default function ({ getService }: FtrProviderContext) {
 
           await ml.testExecution.logTestStep('displays the created job in the analytics table');
           await ml.dataFrameAnalyticsTable.refreshAnalyticsTable();
-          await ml.dataFrameAnalyticsTable.filterWithSearchString(testData.jobId);
-          const rows = await ml.dataFrameAnalyticsTable.parseAnalyticsTable();
-          const filteredRows = rows.filter((row) => row.id === testData.jobId);
-          expect(filteredRows).to.have.length(
-            1,
-            `Filtered analytics table should have 1 row for job id '${testData.jobId}' (got matching items '${filteredRows}')`
-          );
+          await ml.dataFrameAnalyticsTable.filterWithSearchString(testData.jobId, 1);
 
           await ml.testExecution.logTestStep(
             'displays details for the created job in the analytics table'
@@ -208,9 +201,11 @@ export default function ({ getService }: FtrProviderContext) {
           await ml.api.assertIndicesNotEmpty(testData.destinationIndex);
 
           await ml.testExecution.logTestStep('displays the results view for created job');
-          await ml.dataFrameAnalyticsTable.openResultsView();
-          await ml.dataFrameAnalytics.assertClassificationEvaluatePanelElementsExists();
-          await ml.dataFrameAnalytics.assertClassificationTablePanelExists();
+          await ml.dataFrameAnalyticsTable.openResultsView(testData.jobId);
+          await ml.dataFrameAnalyticsResults.assertClassificationEvaluatePanelElementsExists();
+          await ml.dataFrameAnalyticsResults.assertClassificationTablePanelExists();
+          await ml.dataFrameAnalyticsResults.assertResultsTableExists();
+          await ml.dataFrameAnalyticsResults.assertResultsTableNotEmpty();
         });
       });
     }
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/cloning.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/cloning.ts
index 5494f2f963d375..532de930bc1a16 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/cloning.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/cloning.ts
@@ -148,7 +148,7 @@ export default function ({ getService }: FtrProviderContext) {
           await ml.navigation.navigateToMl();
           await ml.navigation.navigateToDataFrameAnalytics();
           await ml.dataFrameAnalyticsTable.waitForAnalyticsToLoad();
-          await ml.dataFrameAnalyticsTable.filterWithSearchString(testData.job.id as string);
+          await ml.dataFrameAnalyticsTable.filterWithSearchString(testData.job.id as string, 1);
           await ml.dataFrameAnalyticsTable.cloneJob(testData.job.id as string);
         });
 
@@ -217,13 +217,7 @@ export default function ({ getService }: FtrProviderContext) {
           );
           await ml.dataFrameAnalyticsCreation.navigateToJobManagementPage();
           await ml.dataFrameAnalyticsTable.refreshAnalyticsTable();
-          await ml.dataFrameAnalyticsTable.filterWithSearchString(cloneJobId);
-          const rows = await ml.dataFrameAnalyticsTable.parseAnalyticsTable();
-          const filteredRows = rows.filter((row) => row.id === cloneJobId);
-          expect(filteredRows).to.have.length(
-            1,
-            `Filtered analytics table should have 1 row for job id '${cloneJobId}' (got matching items '${filteredRows}')`
-          );
+          await ml.dataFrameAnalyticsTable.filterWithSearchString(cloneJobId, 1);
         });
       });
     }
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts
index e4bc7b940aaea1..b5b0f4c94f2621 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
@@ -163,13 +162,7 @@ export default function ({ getService }: FtrProviderContext) {
 
           await ml.testExecution.logTestStep('displays the created job in the analytics table');
           await ml.dataFrameAnalyticsTable.refreshAnalyticsTable();
-          await ml.dataFrameAnalyticsTable.filterWithSearchString(testData.jobId);
-          const rows = await ml.dataFrameAnalyticsTable.parseAnalyticsTable();
-          const filteredRows = rows.filter((row) => row.id === testData.jobId);
-          expect(filteredRows).to.have.length(
-            1,
-            `Filtered analytics table should have 1 row for job id '${testData.jobId}' (got matching items '${filteredRows}')`
-          );
+          await ml.dataFrameAnalyticsTable.filterWithSearchString(testData.jobId, 1);
 
           await ml.testExecution.logTestStep(
             'displays details for the created job in the analytics table'
@@ -224,8 +217,10 @@ export default function ({ getService }: FtrProviderContext) {
           await ml.api.assertIndicesNotEmpty(testData.destinationIndex);
 
           await ml.testExecution.logTestStep('displays the results view for created job');
-          await ml.dataFrameAnalyticsTable.openResultsView();
-          await ml.dataFrameAnalytics.assertOutlierTablePanelExists();
+          await ml.dataFrameAnalyticsTable.openResultsView(testData.jobId);
+          await ml.dataFrameAnalyticsResults.assertOutlierTablePanelExists();
+          await ml.dataFrameAnalyticsResults.assertResultsTableExists();
+          await ml.dataFrameAnalyticsResults.assertResultsTableNotEmpty();
         });
       });
     }
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts
index af9c5417e48265..c58220f2d1ad25 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
@@ -147,13 +146,7 @@ export default function ({ getService }: FtrProviderContext) {
 
           await ml.testExecution.logTestStep('displays the created job in the analytics table');
           await ml.dataFrameAnalyticsTable.refreshAnalyticsTable();
-          await ml.dataFrameAnalyticsTable.filterWithSearchString(testData.jobId);
-          const rows = await ml.dataFrameAnalyticsTable.parseAnalyticsTable();
-          const filteredRows = rows.filter((row) => row.id === testData.jobId);
-          expect(filteredRows).to.have.length(
-            1,
-            `Filtered analytics table should have 1 row for job id '${testData.jobId}' (got matching items '${filteredRows}')`
-          );
+          await ml.dataFrameAnalyticsTable.filterWithSearchString(testData.jobId, 1);
 
           await ml.testExecution.logTestStep(
             'displays details for the created job in the analytics table'
@@ -208,9 +201,11 @@ export default function ({ getService }: FtrProviderContext) {
           await ml.api.assertIndicesNotEmpty(testData.destinationIndex);
 
           await ml.testExecution.logTestStep('displays the results view for created job');
-          await ml.dataFrameAnalyticsTable.openResultsView();
-          await ml.dataFrameAnalytics.assertRegressionEvaluatePanelElementsExists();
-          await ml.dataFrameAnalytics.assertRegressionTablePanelExists();
+          await ml.dataFrameAnalyticsTable.openResultsView(testData.jobId);
+          await ml.dataFrameAnalyticsResults.assertRegressionEvaluatePanelElementsExists();
+          await ml.dataFrameAnalyticsResults.assertRegressionTablePanelExists();
+          await ml.dataFrameAnalyticsResults.assertResultsTableExists();
+          await ml.dataFrameAnalyticsResults.assertResultsTableNotEmpty();
         });
       });
     }
diff --git a/x-pack/test/functional/apps/ml/index.ts b/x-pack/test/functional/apps/ml/index.ts
index 2d8aac3b8dddf8..e224f5c8bb1285 100644
--- a/x-pack/test/functional/apps/ml/index.ts
+++ b/x-pack/test/functional/apps/ml/index.ts
@@ -20,10 +20,8 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
     after(async () => {
       await ml.securityCommon.cleanMlUsers();
       await ml.securityCommon.cleanMlRoles();
-
       await ml.testResources.deleteSavedSearches();
       await ml.testResources.deleteDashboards();
-
       await ml.testResources.deleteIndexPatternByTitle('ft_farequote');
       await ml.testResources.deleteIndexPatternByTitle('ft_ecommerce');
       await ml.testResources.deleteIndexPatternByTitle('ft_categorization');
@@ -31,7 +29,6 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
       await ml.testResources.deleteIndexPatternByTitle('ft_bank_marketing');
       await ml.testResources.deleteIndexPatternByTitle('ft_ihp_outlier');
       await ml.testResources.deleteIndexPatternByTitle('ft_egs_regression');
-
       await esArchiver.unload('ml/farequote');
       await esArchiver.unload('ml/ecommerce');
       await esArchiver.unload('ml/categorization');
@@ -39,11 +36,12 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
       await esArchiver.unload('ml/bm_classification');
       await esArchiver.unload('ml/ihp_outlier');
       await esArchiver.unload('ml/egs_regression');
-
       await ml.testResources.resetKibanaTimeZone();
+      await ml.securityUI.logout();
     });
 
     loadTestFile(require.resolve('./feature_controls'));
+    loadTestFile(require.resolve('./permissions'));
     loadTestFile(require.resolve('./pages'));
     loadTestFile(require.resolve('./anomaly_detection'));
     loadTestFile(require.resolve('./data_visualizer'));
diff --git a/x-pack/test/functional/apps/ml/pages.ts b/x-pack/test/functional/apps/ml/pages.ts
index 5d084d5abe11e8..27b61a7dbc0f8d 100644
--- a/x-pack/test/functional/apps/ml/pages.ts
+++ b/x-pack/test/functional/apps/ml/pages.ts
@@ -17,7 +17,7 @@ export default function ({ getService }: FtrProviderContext) {
     });
 
     it('loads the ML pages', async () => {
-      await ml.testExecution.logTestStep('home');
+      await ml.testExecution.logTestStep('loads the ML home page');
       await ml.navigation.navigateToMl();
 
       await ml.testExecution.logTestStep('loads the overview page');
@@ -34,10 +34,10 @@ export default function ({ getService }: FtrProviderContext) {
 
       await ml.testExecution.logTestStep('loads the settings page');
       await ml.navigation.navigateToSettings();
-      await ml.settings.assertSettingsManageCalendarsLinkExists();
-      await ml.settings.assertSettingsCreateCalendarLinkExists();
-      await ml.settings.assertSettingsManageFilterListsLinkExists();
-      await ml.settings.assertSettingsCreateFilterListLinkExists();
+      await ml.settings.assertManageCalendarsLinkExists();
+      await ml.settings.assertCreateCalendarLinkExists();
+      await ml.settings.assertManageFilterListsLinkExists();
+      await ml.settings.assertCreateFilterListLinkExists();
 
       await ml.testExecution.logTestStep('loads the data frame analytics page');
       await ml.navigation.navigateToDataFrameAnalytics();
diff --git a/x-pack/test/functional/apps/ml/permissions/full_ml_access.ts b/x-pack/test/functional/apps/ml/permissions/full_ml_access.ts
new file mode 100644
index 00000000000000..eed7489b09fe63
--- /dev/null
+++ b/x-pack/test/functional/apps/ml/permissions/full_ml_access.ts
@@ -0,0 +1,480 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import path from 'path';
+
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+import { USER } from '../../../services/ml/security_common';
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const ml = getService('ml');
+
+  const testUsers = [USER.ML_POWERUSER, USER.ML_POWERUSER_SPACES];
+
+  describe('for user with full ML access', function () {
+    this.tags(['skipFirefox', 'mlqa']);
+
+    describe('with no data loaded', function () {
+      for (const user of testUsers) {
+        describe(`(${user})`, function () {
+          before(async () => {
+            await ml.securityUI.loginAs(user);
+            await ml.api.cleanMlIndices();
+          });
+
+          after(async () => {
+            await ml.securityUI.logout();
+          });
+
+          it('should display the ML file data vis link on the Kibana home page', async () => {
+            await ml.testExecution.logTestStep('should load the Kibana home page');
+            await ml.navigation.navigateToKibanaHome();
+
+            await ml.testExecution.logTestStep('should display the ML file data vis link');
+            await ml.commonUI.assertKibanaHomeFileDataVisLinkExists();
+          });
+
+          it('should display the ML entry in Kibana app menu', async () => {
+            await ml.testExecution.logTestStep('should open the Kibana app menu');
+            await ml.navigation.openKibanaNav();
+
+            await ml.testExecution.logTestStep('should display the ML nav link');
+            await ml.navigation.assertKibanaNavMLEntryExists();
+          });
+
+          it('should display elements on ML Overview page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the ML overview page');
+            await ml.navigation.navigateToMl();
+            await ml.navigation.navigateToOverview();
+
+            await ml.testExecution.logTestStep('should display enabled AD create job button');
+            await ml.overviewPage.assertADCreateJobButtonExists();
+            await ml.overviewPage.assertADCreateJobButtonEnabled(true);
+
+            await ml.testExecution.logTestStep('should display enabled DFA create job button');
+            await ml.overviewPage.assertDFACreateJobButtonExists();
+            await ml.overviewPage.assertDFACreateJobButtonEnabled(true);
+          });
+        });
+      }
+    });
+
+    describe('with data loaded', function () {
+      const adJobId = 'fq_single_permission';
+      const dfaJobId = 'iph_outlier_permission';
+      const calendarId = 'calendar_permission';
+      const eventDescription = 'calendar_event_permission';
+      const filterId = 'filter_permission';
+      const filterItems = ['filter_item_permission'];
+
+      const ecIndexPattern = 'ft_module_sample_ecommerce';
+      const ecExpectedTotalCount = 287;
+      const ecExpectedFieldPanelCount = 2;
+      const ecExpectedModuleId = 'sample_data_ecommerce';
+
+      const uploadFilePath = path.join(
+        __dirname,
+        '..',
+        'data_visualizer',
+        'files_to_import',
+        'artificial_server_log'
+      );
+      const expectedUploadFileTitle = 'artificial_server_log';
+
+      before(async () => {
+        await esArchiver.loadIfNeeded('ml/farequote');
+        await esArchiver.loadIfNeeded('ml/ihp_outlier');
+        await esArchiver.loadIfNeeded('ml/module_sample_ecommerce');
+        await ml.testResources.createIndexPatternIfNeeded('ft_farequote', '@timestamp');
+        await ml.testResources.createIndexPatternIfNeeded('ft_ihp_outlier', '@timestamp');
+        await ml.testResources.createIndexPatternIfNeeded(ecIndexPattern, 'order_date');
+        await ml.testResources.setKibanaTimeZoneToUTC();
+
+        await ml.api.createAndRunAnomalyDetectionLookbackJob(
+          ml.commonConfig.getADFqMultiMetricJobConfig(adJobId),
+          ml.commonConfig.getADFqDatafeedConfig(adJobId)
+        );
+
+        await ml.api.createAndRunDFAJob(
+          ml.commonConfig.getDFAIhpOutlierDetectionJobConfig(dfaJobId)
+        );
+
+        await ml.api.createCalendar(calendarId, {
+          calendar_id: calendarId,
+          job_ids: [],
+          description: 'Test calendar',
+        });
+        await ml.api.createCalendarEvents(calendarId, [
+          {
+            description: eventDescription,
+            start_time: 1513641600000,
+            end_time: 1513728000000,
+          },
+        ]);
+
+        await ml.api.createFilter(filterId, {
+          description: 'Test filter list',
+          items: filterItems,
+        });
+      });
+
+      after(async () => {
+        await ml.api.cleanMlIndices();
+        await ml.api.deleteIndices(`user-${dfaJobId}`);
+        await ml.api.deleteCalendar(calendarId);
+        await ml.api.deleteFilter(filterId);
+      });
+
+      for (const user of testUsers) {
+        describe(`(${user})`, function () {
+          before(async () => {
+            await ml.securityUI.loginAs(user);
+          });
+
+          after(async () => {
+            await ml.securityUI.logout();
+          });
+
+          it('should display elements on Anomaly Detection page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the AD job management page');
+            await ml.navigation.navigateToMl();
+            await ml.navigation.navigateToAnomalyDetection();
+
+            await ml.testExecution.logTestStep('should display the stats bar and the AD job table');
+            await ml.jobManagement.assertJobStatsBarExists();
+            await ml.jobManagement.assertJobTableExists();
+
+            await ml.testExecution.logTestStep('should display an enabled "Create job" button');
+            await ml.jobManagement.assertCreateNewJobButtonExists();
+            await ml.jobManagement.assertCreateNewJobButtonEnabled(true);
+
+            await ml.testExecution.logTestStep('should display the AD job in the list');
+            await ml.jobTable.filterWithSearchString(adJobId, 1);
+
+            await ml.testExecution.logTestStep('should display enabled AD job result links');
+            await ml.jobTable.assertJobActionSingleMetricViewerButtonEnabled(adJobId, true);
+            await ml.jobTable.assertJobActionAnomalyExplorerButtonEnabled(adJobId, true);
+
+            await ml.testExecution.logTestStep('should display enabled AD job row action buttons');
+            await ml.jobTable.assertJobActionsMenuButtonEnabled(adJobId, true);
+            await ml.jobTable.assertJobActionStartDatafeedButtonEnabled(adJobId, true);
+            await ml.jobTable.assertJobActionCloneJobButtonEnabled(adJobId, true);
+            await ml.jobTable.assertJobActionEditJobButtonEnabled(adJobId, true);
+            await ml.jobTable.assertJobActionDeleteJobButtonEnabled(adJobId, true);
+
+            await ml.testExecution.logTestStep('should select the job');
+            await ml.jobTable.selectJobRow(adJobId);
+
+            await ml.testExecution.logTestStep('should display enabled multi select result links');
+            await ml.jobTable.assertMultiSelectActionSingleMetricViewerButtonEnabled(true);
+            await ml.jobTable.assertMultiSelectActionAnomalyExplorerButtonEnabled(true);
+
+            await ml.testExecution.logTestStep(
+              'should display enabled multi select action buttons'
+            );
+            await ml.jobTable.assertMultiSelectManagementActionsButtonEnabled(true);
+            await ml.jobTable.assertMultiSelectStartDatafeedActionButtonEnabled(true);
+            await ml.jobTable.assertMultiSelectDeleteJobActionButtonEnabled(true);
+            await ml.jobTable.deselectJobRow(adJobId);
+          });
+
+          it('should display elements on Single Metric Viewer page correctly', async () => {
+            await ml.testExecution.logTestStep('should open AD job in the single metric viewer');
+            await ml.jobTable.clickOpenJobInSingleMetricViewerButton(adJobId);
+            await ml.commonUI.waitForMlLoadingIndicatorToDisappear();
+
+            await ml.testExecution.logTestStep('should pre-fill the AD job selection');
+            await ml.jobSelection.assertJobSelection([adJobId]);
+
+            await ml.testExecution.logTestStep('should pre-fill the detector input');
+            await ml.singleMetricViewer.assertDetectorInputExsist();
+            await ml.singleMetricViewer.assertDetectorInputValue('0');
+
+            await ml.testExecution.logTestStep('should input the airline entity value');
+            await ml.singleMetricViewer.assertEntityInputExsist('airline');
+            await ml.singleMetricViewer.assertEntityInputSelection('airline', []);
+            await ml.singleMetricViewer.selectEntityValue('airline', 'AAL');
+
+            await ml.testExecution.logTestStep('should display the chart');
+            await ml.singleMetricViewer.assertChartExsist();
+
+            await ml.testExecution.logTestStep('should display the annotations section');
+            await ml.singleMetricViewer.assertAnnotationsExists('loaded');
+
+            await ml.testExecution.logTestStep('should display the anomalies table with entries');
+            await ml.anomaliesTable.assertTableExists();
+            await ml.anomaliesTable.assertTableNotEmpty();
+
+            await ml.testExecution.logTestStep('should display enabled anomaly row action buttons');
+            await ml.anomaliesTable.assertAnomalyActionsMenuButtonExists(0);
+            await ml.anomaliesTable.assertAnomalyActionsMenuButtonEnabled(0, true);
+            await ml.anomaliesTable.assertAnomalyActionConfigureRulesButtonEnabled(0, true);
+
+            await ml.testExecution.logTestStep(
+              'should display the forecast modal with enabled run button'
+            );
+            await ml.singleMetricViewer.assertForecastButtonExists();
+            await ml.singleMetricViewer.assertForecastButtonEnabled(true);
+            await ml.singleMetricViewer.openForecastModal();
+            await ml.singleMetricViewer.assertForecastModalRunButtonEnabled(true);
+            await ml.singleMetricViewer.closeForecastModal();
+          });
+
+          it('should display elements on Anomaly Explorer page correctly', async () => {
+            await ml.testExecution.logTestStep('should open AD job in the anomaly explorer');
+            await ml.singleMetricViewer.openAnomalyExplorer();
+            await ml.commonUI.waitForMlLoadingIndicatorToDisappear();
+
+            await ml.testExecution.logTestStep('should pre-fill the AD job selection');
+            await ml.jobSelection.assertJobSelection([adJobId]);
+
+            await ml.testExecution.logTestStep('should display the influencers list');
+            await ml.anomalyExplorer.assertInfluencerListExists();
+            await ml.anomalyExplorer.assertInfluencerFieldListNotEmpty('airline');
+
+            await ml.testExecution.logTestStep('should display the swim lanes');
+            await ml.anomalyExplorer.assertOverallSwimlaneExists();
+            await ml.anomalyExplorer.assertSwimlaneViewByExists();
+
+            await ml.testExecution.logTestStep('should display the annotations panel');
+            await ml.anomalyExplorer.assertAnnotationsPanelExists('loaded');
+
+            await ml.testExecution.logTestStep('should display the anomalies table with entries');
+            await ml.anomaliesTable.assertTableExists();
+            await ml.anomaliesTable.assertTableNotEmpty();
+
+            await ml.testExecution.logTestStep('should display enabled anomaly row action button');
+            await ml.anomaliesTable.assertAnomalyActionsMenuButtonExists(0);
+            await ml.anomaliesTable.assertAnomalyActionsMenuButtonEnabled(0, true);
+
+            await ml.testExecution.logTestStep(
+              'should display enabled configure rules action button'
+            );
+            await ml.anomaliesTable.assertAnomalyActionConfigureRulesButtonEnabled(0, true);
+
+            await ml.testExecution.logTestStep('should display enabled view series action button');
+            await ml.anomaliesTable.assertAnomalyActionViewSeriesButtonEnabled(0, true);
+          });
+
+          it('should display elements on Data Frame Analytics page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the DFA job management page');
+            await ml.navigation.navigateToDataFrameAnalytics();
+
+            await ml.testExecution.logTestStep(
+              'should display the stats bar and the analytics table'
+            );
+            await ml.dataFrameAnalytics.assertAnalyticsStatsBarExists();
+            await ml.dataFrameAnalytics.assertAnalyticsTableExists();
+
+            await ml.testExecution.logTestStep('should display an enabled "Create job" button');
+            await ml.dataFrameAnalytics.assertCreateNewAnalyticsButtonExists();
+            await ml.dataFrameAnalytics.assertCreateNewAnalyticsButtonEnabled(true);
+
+            await ml.testExecution.logTestStep('should display the DFA job in the list');
+            await ml.dataFrameAnalyticsTable.filterWithSearchString(dfaJobId, 1);
+
+            await ml.testExecution.logTestStep(
+              'should display enabled DFA job view and action menu'
+            );
+            await ml.dataFrameAnalyticsTable.assertJobRowViewButtonEnabled(dfaJobId, true);
+            await ml.dataFrameAnalyticsTable.assertJowRowActionsMenuButtonEnabled(dfaJobId, true);
+            await ml.dataFrameAnalyticsTable.assertJobActionViewButtonEnabled(dfaJobId, true);
+
+            await ml.testExecution.logTestStep('should display enabled DFA job row action buttons');
+            await ml.dataFrameAnalyticsTable.assertJobActionStartButtonEnabled(dfaJobId, false); // job already completed
+            await ml.dataFrameAnalyticsTable.assertJobActionEditButtonEnabled(dfaJobId, true);
+            await ml.dataFrameAnalyticsTable.assertJobActionCloneButtonEnabled(dfaJobId, true);
+            await ml.dataFrameAnalyticsTable.assertJobActionDeleteButtonEnabled(dfaJobId, true);
+            await ml.dataFrameAnalyticsTable.ensureJobActionsMenuClosed(dfaJobId);
+          });
+
+          it('should display elements on Data Frame Analytics results view page correctly', async () => {
+            await ml.testExecution.logTestStep('displays the results view for created job');
+            await ml.dataFrameAnalyticsTable.openResultsView(dfaJobId);
+            await ml.dataFrameAnalyticsResults.assertOutlierTablePanelExists();
+            await ml.dataFrameAnalyticsResults.assertResultsTableExists();
+            await ml.dataFrameAnalyticsResults.assertResultsTableNotEmpty();
+          });
+
+          it('should display elements on Data Visualizer home page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the data visualizer page');
+            await ml.navigation.navigateToDataVisualizer();
+
+            await ml.testExecution.logTestStep(
+              'should display the "import data" card with enabled button'
+            );
+            await ml.dataVisualizer.assertDataVisualizerImportDataCardExists();
+            await ml.dataVisualizer.assertUploadFileButtonEnabled(true);
+
+            await ml.testExecution.logTestStep(
+              'should display the "select index pattern" card with enabled button'
+            );
+            await ml.dataVisualizer.assertDataVisualizerIndexDataCardExists();
+            await ml.dataVisualizer.assertSelectIndexButtonEnabled(true);
+          });
+
+          it('should display elements on Index Data Visualizer page correctly', async () => {
+            await ml.testExecution.logTestStep(
+              'should load an index into the data visualizer page'
+            );
+            await ml.dataVisualizer.navigateToIndexPatternSelection();
+            await ml.jobSourceSelection.selectSourceForIndexBasedDataVisualizer(ecIndexPattern);
+
+            await ml.testExecution.logTestStep('should display the time range step');
+            await ml.dataVisualizerIndexBased.assertTimeRangeSelectorSectionExists();
+
+            await ml.testExecution.logTestStep('should load data for full time range');
+            await ml.dataVisualizerIndexBased.clickUseFullDataButton(ecExpectedTotalCount);
+
+            await ml.testExecution.logTestStep('should display the panels of fields');
+            await ml.dataVisualizerIndexBased.assertFieldsPanelsExist(ecExpectedFieldPanelCount);
+
+            await ml.testExecution.logTestStep('should display the actions panel with cards');
+            await ml.dataVisualizerIndexBased.assertActionsPanelExists();
+            await ml.dataVisualizerIndexBased.assertCreateAdvancedJobCardExists();
+            await ml.dataVisualizerIndexBased.assertRecognizerCardExists(ecExpectedModuleId);
+          });
+
+          it('should display elements on File Data Visualizer page correctly', async () => {
+            await ml.testExecution.logTestStep(
+              'should load the file data visualizer file selection'
+            );
+            await ml.navigation.navigateToDataVisualizer();
+            await ml.dataVisualizer.navigateToFileUpload();
+
+            await ml.testExecution.logTestStep(
+              'should select a file and load visualizer result page'
+            );
+            await ml.dataVisualizerFileBased.selectFile(uploadFilePath);
+
+            await ml.testExecution.logTestStep(
+              'should displays components of the file details page'
+            );
+            await ml.dataVisualizerFileBased.assertFileTitle(expectedUploadFileTitle);
+            await ml.dataVisualizerFileBased.assertFileContentPanelExists();
+            await ml.dataVisualizerFileBased.assertSummaryPanelExists();
+            await ml.dataVisualizerFileBased.assertFileStatsPanelExists();
+            await ml.dataVisualizerFileBased.assertImportButtonEnabled(true);
+          });
+
+          it('should display elements on Settings home page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the settings page');
+            await ml.navigation.navigateToSettings();
+
+            await ml.testExecution.logTestStep('should display enabled calendar controls');
+            await ml.settings.assertManageCalendarsLinkExists();
+            await ml.settings.assertManageCalendarsLinkEnabled(true);
+            await ml.settings.assertCreateCalendarLinkExists();
+            await ml.settings.assertCreateCalendarLinkEnabled(true);
+
+            await ml.testExecution.logTestStep('should display enabled filter list controls');
+            await ml.settings.assertManageFilterListsLinkExists();
+            await ml.settings.assertManageFilterListsLinkEnabled(true);
+            await ml.settings.assertCreateFilterListLinkExists();
+            await ml.settings.assertCreateFilterListLinkEnabled(true);
+          });
+
+          it('should display elements on Calendar management page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the calendar management page');
+            await ml.settings.navigateToCalendarManagement();
+
+            await ml.testExecution.logTestStep('should display enabled create calendar button');
+            await ml.settingsCalendar.assertCreateCalendarButtonEnabled(true);
+
+            await ml.testExecution.logTestStep('should display the calendar in the list');
+            await ml.settingsCalendar.filterWithSearchString(calendarId, 1);
+
+            await ml.testExecution.logTestStep('should enable delete calendar button on selection');
+            await ml.settingsCalendar.assertDeleteCalendarButtonEnabled(false);
+            await ml.settingsCalendar.selectCalendarRow(calendarId);
+            await ml.settingsCalendar.assertDeleteCalendarButtonEnabled(true);
+
+            await ml.testExecution.logTestStep('should load the calendar edit page');
+            await ml.settingsCalendar.openCalendarEditForm(calendarId);
+
+            await ml.testExecution.logTestStep(
+              'should display enabled elements of the edit calendar page'
+            );
+            await ml.settingsCalendar.assertApplyToAllJobsSwitchEnabled(true);
+            await ml.settingsCalendar.assertJobSelectionEnabled(true);
+            await ml.settingsCalendar.assertJobGroupSelectionEnabled(true);
+            await ml.settingsCalendar.assertNewEventButtonEnabled(true);
+            await ml.settingsCalendar.assertImportEventsButtonEnabled(true);
+
+            await ml.testExecution.logTestStep('should display the event in the list');
+            await ml.settingsCalendar.assertEventRowExists(eventDescription);
+
+            await ml.testExecution.logTestStep('should display enabled delete event button');
+            await ml.settingsCalendar.assertDeleteEventButtonEnabled(eventDescription, true);
+          });
+
+          it('should display elements on Filter Lists management page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the filter list management page');
+            await ml.navigation.navigateToSettings();
+            await ml.settings.navigateToFilterListsManagement();
+
+            await ml.testExecution.logTestStep('should display enabled create filter list button');
+            await ml.settingsFilterList.assertCreateFilterListButtonEnabled(true);
+
+            await ml.testExecution.logTestStep('should display the filter list in the table');
+            await ml.settingsFilterList.filterWithSearchString(filterId, 1);
+
+            await ml.testExecution.logTestStep(
+              'should enable delete filter list button on selection'
+            );
+            await ml.settingsFilterList.assertDeleteFilterListButtonEnabled(false);
+            await ml.settingsFilterList.selectFilterListRow(filterId);
+            await ml.settingsFilterList.assertDeleteFilterListButtonEnabled(true);
+
+            await ml.testExecution.logTestStep('should load the filter list edit page');
+            await ml.settingsFilterList.openFilterListEditForm(filterId);
+
+            await ml.testExecution.logTestStep(
+              'should display enabled elements of the edit calendar page'
+            );
+            await ml.settingsFilterList.assertEditDescriptionButtonEnabled(true);
+            await ml.settingsFilterList.assertAddItemButtonEnabled(true);
+
+            await ml.testExecution.logTestStep('should display the filter item in the list');
+            await ml.settingsFilterList.assertFilterItemExists(filterItems[0]);
+
+            await ml.testExecution.logTestStep(
+              'should enable delete filter item button on selection'
+            );
+            await ml.settingsFilterList.assertDeleteItemButtonEnabled(false);
+            await ml.settingsFilterList.selectFilterItem(filterItems[0]);
+            await ml.settingsFilterList.assertDeleteItemButtonEnabled(true);
+          });
+
+          it('should display elements on Stack Management ML page correctly', async () => {
+            await ml.testExecution.logTestStep(
+              'should load the stack management with the ML menu item being present'
+            );
+            await ml.navigation.navigateToStackManagement();
+
+            await ml.testExecution.logTestStep(
+              'should load the jobs list page in stack management'
+            );
+            await ml.navigation.navigateToStackManagementJobsListPage();
+
+            await ml.testExecution.logTestStep('should display the AD job in the list');
+            await ml.jobTable.filterWithSearchString(adJobId, 1);
+
+            await ml.testExecution.logTestStep(
+              'should load the analytics jobs list page in stack management'
+            );
+            await ml.navigation.navigateToStackManagementJobsListPageAnalyticsTab();
+
+            await ml.testExecution.logTestStep('should display the DFA job in the list');
+            await ml.dataFrameAnalyticsTable.filterWithSearchString(dfaJobId, 1);
+          });
+        });
+      }
+    });
+  });
+}
diff --git a/x-pack/test/functional/apps/ml/permissions/index.ts b/x-pack/test/functional/apps/ml/permissions/index.ts
new file mode 100644
index 00000000000000..2d415b1d094a46
--- /dev/null
+++ b/x-pack/test/functional/apps/ml/permissions/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('permissions', function () {
+    this.tags(['skipFirefox']);
+
+    loadTestFile(require.resolve('./full_ml_access'));
+    loadTestFile(require.resolve('./read_ml_access'));
+    loadTestFile(require.resolve('./no_ml_access'));
+  });
+}
diff --git a/x-pack/test/functional/apps/ml/permissions/no_ml_access.ts b/x-pack/test/functional/apps/ml/permissions/no_ml_access.ts
new file mode 100644
index 00000000000000..6fd78458a6ce53
--- /dev/null
+++ b/x-pack/test/functional/apps/ml/permissions/no_ml_access.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+import { USER } from '../../../services/ml/security_common';
+
+export default function ({ getPageObjects, getService }: FtrProviderContext) {
+  const PageObjects = getPageObjects(['common', 'error']);
+  const ml = getService('ml');
+
+  const testUsers = [USER.ML_UNAUTHORIZED, USER.ML_UNAUTHORIZED_SPACES];
+
+  describe('for user with no ML access', function () {
+    this.tags(['skipFirefox', 'mlqa']);
+
+    for (const user of testUsers) {
+      describe(`(${user})`, function () {
+        before(async () => {
+          await ml.securityUI.loginAs(user);
+        });
+
+        after(async () => {
+          await ml.securityUI.logout();
+        });
+
+        it('should not allow to access the ML app', async () => {
+          await ml.testExecution.logTestStep('should not load the ML overview page');
+          await PageObjects.common.navigateToUrl('ml', '', {
+            shouldLoginIfPrompted: false,
+            ensureCurrentUrl: false,
+          });
+
+          await PageObjects.error.expectNotFound();
+        });
+
+        it('should not display the ML file data vis link on the Kibana home page', async () => {
+          await ml.testExecution.logTestStep('should load the Kibana home page');
+          await ml.navigation.navigateToKibanaHome();
+
+          await ml.testExecution.logTestStep('should not display the ML file data vis link');
+          await ml.commonUI.assertKibanaHomeFileDataVisLinkNotExists();
+        });
+
+        it('should not display the ML entry in Kibana app menu', async () => {
+          await ml.testExecution.logTestStep('should open the Kibana app menu');
+          await ml.navigation.openKibanaNav();
+
+          await ml.testExecution.logTestStep('should not display the ML nav link');
+          await ml.navigation.assertKibanaNavMLEntryNotExists();
+        });
+
+        it('should not allow to access the Stack Management ML page', async () => {
+          await ml.testExecution.logTestStep(
+            'should load the stack management with the ML menu item being present'
+          );
+          await ml.navigation.navigateToStackManagement();
+
+          await ml.testExecution.logTestStep(
+            'should display the access denied page in stack management'
+          );
+          await ml.navigation.navigateToStackManagementJobsListPage({
+            expectAccessDenied: true,
+          });
+        });
+      });
+    }
+  });
+}
diff --git a/x-pack/test/functional/apps/ml/permissions/read_ml_access.ts b/x-pack/test/functional/apps/ml/permissions/read_ml_access.ts
new file mode 100644
index 00000000000000..a358e57f792c75
--- /dev/null
+++ b/x-pack/test/functional/apps/ml/permissions/read_ml_access.ts
@@ -0,0 +1,426 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import path from 'path';
+
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+import { USER } from '../../../services/ml/security_common';
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const ml = getService('ml');
+
+  const testUsers = [USER.ML_VIEWER, USER.ML_VIEWER_SPACES];
+
+  describe('for user with read ML access', function () {
+    this.tags(['skipFirefox', 'mlqa']);
+
+    describe('with no data loaded', function () {
+      for (const user of testUsers) {
+        describe(`(${user})`, function () {
+          before(async () => {
+            await ml.securityUI.loginAs(user);
+            await ml.api.cleanMlIndices();
+          });
+
+          after(async () => {
+            await ml.securityUI.logout();
+          });
+
+          it('should not display the ML file data vis link on the Kibana home page', async () => {
+            await ml.testExecution.logTestStep('should load the Kibana home page');
+            await ml.navigation.navigateToKibanaHome();
+
+            await ml.testExecution.logTestStep('should not display the ML file data vis link');
+            await ml.commonUI.assertKibanaHomeFileDataVisLinkNotExists();
+          });
+
+          it('should display the ML entry in Kibana app menu', async () => {
+            await ml.testExecution.logTestStep('should open the Kibana app menu');
+            await ml.navigation.openKibanaNav();
+
+            await ml.testExecution.logTestStep('should display the ML nav link');
+            await ml.navigation.assertKibanaNavMLEntryExists();
+          });
+
+          it('should display elements on ML Overview page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the ML overview page');
+            await ml.navigation.navigateToMl();
+            await ml.navigation.navigateToOverview();
+
+            await ml.testExecution.logTestStep('should display disabled AD create job button');
+            await ml.overviewPage.assertADCreateJobButtonExists();
+            await ml.overviewPage.assertADCreateJobButtonEnabled(false);
+
+            await ml.testExecution.logTestStep('should display disabled DFA create job button');
+            await ml.overviewPage.assertDFACreateJobButtonExists();
+            await ml.overviewPage.assertDFACreateJobButtonEnabled(false);
+          });
+        });
+      }
+    });
+
+    describe('with no data loaded', function () {
+      const adJobId = 'fq_single_permission';
+      const dfaJobId = 'iph_outlier_permission';
+      const calendarId = 'calendar_permission';
+      const eventDescription = 'calendar_event_permission';
+      const filterId = 'filter_permission';
+      const filterItems = ['filter_item_permission'];
+
+      const ecIndexPattern = 'ft_module_sample_ecommerce';
+      const ecExpectedTotalCount = 287;
+      const ecExpectedFieldPanelCount = 2;
+
+      const uploadFilePath = path.join(
+        __dirname,
+        '..',
+        'data_visualizer',
+        'files_to_import',
+        'artificial_server_log'
+      );
+      const expectedUploadFileTitle = 'artificial_server_log';
+
+      before(async () => {
+        await esArchiver.loadIfNeeded('ml/farequote');
+        await esArchiver.loadIfNeeded('ml/ihp_outlier');
+        await esArchiver.loadIfNeeded('ml/module_sample_ecommerce');
+        await ml.testResources.createIndexPatternIfNeeded('ft_farequote', '@timestamp');
+        await ml.testResources.createIndexPatternIfNeeded('ft_ihp_outlier', '@timestamp');
+        await ml.testResources.createIndexPatternIfNeeded(ecIndexPattern, 'order_date');
+        await ml.testResources.setKibanaTimeZoneToUTC();
+
+        await ml.api.createAndRunAnomalyDetectionLookbackJob(
+          ml.commonConfig.getADFqMultiMetricJobConfig(adJobId),
+          ml.commonConfig.getADFqDatafeedConfig(adJobId)
+        );
+
+        await ml.api.createAndRunDFAJob(
+          ml.commonConfig.getDFAIhpOutlierDetectionJobConfig(dfaJobId)
+        );
+
+        await ml.api.createCalendar(calendarId, {
+          calendar_id: calendarId,
+          job_ids: [],
+          description: 'Test calendar',
+        });
+        await ml.api.createCalendarEvents(calendarId, [
+          {
+            description: eventDescription,
+            start_time: 1513641600000,
+            end_time: 1513728000000,
+          },
+        ]);
+
+        await ml.api.createFilter(filterId, {
+          description: 'Test filter list',
+          items: filterItems,
+        });
+      });
+
+      after(async () => {
+        await ml.api.cleanMlIndices();
+        await ml.api.deleteIndices(`user-${dfaJobId}`);
+        await ml.api.deleteCalendar(calendarId);
+        await ml.api.deleteFilter(filterId);
+      });
+
+      for (const user of testUsers) {
+        describe(`(${user})`, function () {
+          before(async () => {
+            await ml.securityUI.loginAs(user);
+          });
+
+          after(async () => {
+            await ml.securityUI.logout();
+          });
+
+          it('should display elements on Anomaly Detection page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the AD job management page');
+            await ml.navigation.navigateToMl();
+            await ml.navigation.navigateToAnomalyDetection();
+
+            await ml.testExecution.logTestStep('should display the stats bar and the AD job table');
+            await ml.jobManagement.assertJobStatsBarExists();
+            await ml.jobManagement.assertJobTableExists();
+
+            await ml.testExecution.logTestStep('should display a disabled "Create job" button');
+            await ml.jobManagement.assertCreateNewJobButtonExists();
+            await ml.jobManagement.assertCreateNewJobButtonEnabled(false);
+
+            await ml.testExecution.logTestStep('should display the AD job in the list');
+            await ml.jobTable.filterWithSearchString(adJobId, 1);
+
+            await ml.testExecution.logTestStep('should display enabled AD job result links');
+            await ml.jobTable.assertJobActionSingleMetricViewerButtonEnabled(adJobId, true);
+            await ml.jobTable.assertJobActionAnomalyExplorerButtonEnabled(adJobId, true);
+
+            await ml.testExecution.logTestStep('should display disabled AD job row action button');
+            await ml.jobTable.assertJobActionsMenuButtonEnabled(adJobId, false);
+
+            await ml.testExecution.logTestStep('should select the job');
+            await ml.jobTable.selectJobRow(adJobId);
+
+            await ml.testExecution.logTestStep('should display enabled multi select result links');
+            await ml.jobTable.assertMultiSelectActionSingleMetricViewerButtonEnabled(true);
+            await ml.jobTable.assertMultiSelectActionAnomalyExplorerButtonEnabled(true);
+
+            await ml.testExecution.logTestStep(
+              'should display disabled multi select action button'
+            );
+            await ml.jobTable.assertMultiSelectManagementActionsButtonEnabled(false);
+            await ml.jobTable.deselectJobRow(adJobId);
+          });
+
+          it('should display elements on Single Metric Viewer page correctly', async () => {
+            await ml.testExecution.logTestStep('should open AD job in the single metric viewer');
+            await ml.jobTable.clickOpenJobInSingleMetricViewerButton(adJobId);
+            await ml.commonUI.waitForMlLoadingIndicatorToDisappear();
+
+            await ml.testExecution.logTestStep('should pre-fill the AD job selection');
+            await ml.jobSelection.assertJobSelection([adJobId]);
+
+            await ml.testExecution.logTestStep('should pre-fill the detector input');
+            await ml.singleMetricViewer.assertDetectorInputExsist();
+            await ml.singleMetricViewer.assertDetectorInputValue('0');
+
+            await ml.testExecution.logTestStep('should input the airline entity value');
+            await ml.singleMetricViewer.assertEntityInputExsist('airline');
+            await ml.singleMetricViewer.assertEntityInputSelection('airline', []);
+            await ml.singleMetricViewer.selectEntityValue('airline', 'AAL');
+
+            await ml.testExecution.logTestStep('should display the chart');
+            await ml.singleMetricViewer.assertChartExsist();
+
+            await ml.testExecution.logTestStep('should display the annotations section');
+            await ml.singleMetricViewer.assertAnnotationsExists('loaded');
+
+            await ml.testExecution.logTestStep('should display the anomalies table with entries');
+            await ml.anomaliesTable.assertTableExists();
+            await ml.anomaliesTable.assertTableNotEmpty();
+
+            await ml.testExecution.logTestStep('should not display the anomaly row action button');
+            await ml.anomaliesTable.assertAnomalyActionsMenuButtonNotExists(0);
+
+            await ml.testExecution.logTestStep(
+              'should display the forecast modal with disabled run button'
+            );
+            await ml.singleMetricViewer.assertForecastButtonExists();
+            await ml.singleMetricViewer.assertForecastButtonEnabled(true);
+            await ml.singleMetricViewer.openForecastModal();
+            await ml.singleMetricViewer.assertForecastModalRunButtonEnabled(false);
+            await ml.singleMetricViewer.closeForecastModal();
+          });
+
+          it('should display elements on Anomaly Explorer page correctly', async () => {
+            await ml.testExecution.logTestStep('should open AD job in the anomaly explorer');
+            await ml.singleMetricViewer.openAnomalyExplorer();
+            await ml.commonUI.waitForMlLoadingIndicatorToDisappear();
+
+            await ml.testExecution.logTestStep('should pre-fill the AD job selection');
+            await ml.jobSelection.assertJobSelection([adJobId]);
+
+            await ml.testExecution.logTestStep('should display the influencers list');
+            await ml.anomalyExplorer.assertInfluencerListExists();
+            await ml.anomalyExplorer.assertInfluencerFieldListNotEmpty('airline');
+
+            await ml.testExecution.logTestStep('should display the swim lanes');
+            await ml.anomalyExplorer.assertOverallSwimlaneExists();
+            await ml.anomalyExplorer.assertSwimlaneViewByExists();
+
+            await ml.testExecution.logTestStep('should display the annotations panel');
+            await ml.anomalyExplorer.assertAnnotationsPanelExists('loaded');
+
+            await ml.testExecution.logTestStep('should display the anomalies table with entries');
+            await ml.anomaliesTable.assertTableExists();
+            await ml.anomaliesTable.assertTableNotEmpty();
+
+            await ml.testExecution.logTestStep('should display enabled anomaly row action button');
+            await ml.anomaliesTable.assertAnomalyActionsMenuButtonExists(0);
+            await ml.anomaliesTable.assertAnomalyActionsMenuButtonEnabled(0, true);
+
+            await ml.testExecution.logTestStep('should not display configure rules action button');
+            await ml.anomaliesTable.assertAnomalyActionConfigureRulesButtonNotExists(0);
+
+            await ml.testExecution.logTestStep('should display enabled view series action button');
+            await ml.anomaliesTable.assertAnomalyActionViewSeriesButtonEnabled(0, true);
+          });
+
+          it('should display elements on Data Frame Analytics page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the DFA job management page');
+            await ml.navigation.navigateToDataFrameAnalytics();
+
+            await ml.testExecution.logTestStep(
+              'should display the stats bar and the analytics table'
+            );
+            await ml.dataFrameAnalytics.assertAnalyticsStatsBarExists();
+            await ml.dataFrameAnalytics.assertAnalyticsTableExists();
+
+            await ml.testExecution.logTestStep('should display a disabled "Create job" button');
+            await ml.dataFrameAnalytics.assertCreateNewAnalyticsButtonExists();
+            await ml.dataFrameAnalytics.assertCreateNewAnalyticsButtonEnabled(false);
+
+            await ml.testExecution.logTestStep('should display the DFA job in the list');
+            await ml.dataFrameAnalyticsTable.filterWithSearchString(dfaJobId, 1);
+
+            await ml.testExecution.logTestStep(
+              'should display enabled DFA job view and action menu'
+            );
+            await ml.dataFrameAnalyticsTable.assertJobRowViewButtonEnabled(dfaJobId, true);
+            await ml.dataFrameAnalyticsTable.assertJowRowActionsMenuButtonEnabled(dfaJobId, true);
+            await ml.dataFrameAnalyticsTable.assertJobActionViewButtonEnabled(dfaJobId, true);
+
+            await ml.testExecution.logTestStep(
+              'should display disabled DFA job row action buttons'
+            );
+            await ml.dataFrameAnalyticsTable.assertJobActionStartButtonEnabled(dfaJobId, false); // job already completed
+            await ml.dataFrameAnalyticsTable.assertJobActionEditButtonEnabled(dfaJobId, false);
+            await ml.dataFrameAnalyticsTable.assertJobActionCloneButtonEnabled(dfaJobId, false);
+            await ml.dataFrameAnalyticsTable.assertJobActionDeleteButtonEnabled(dfaJobId, false);
+            await ml.dataFrameAnalyticsTable.ensureJobActionsMenuClosed(dfaJobId);
+          });
+
+          it('should display elements on Data Frame Analytics results view page correctly', async () => {
+            await ml.testExecution.logTestStep('displays the results view for created job');
+            await ml.dataFrameAnalyticsTable.openResultsView(dfaJobId);
+            await ml.dataFrameAnalyticsResults.assertOutlierTablePanelExists();
+            await ml.dataFrameAnalyticsResults.assertResultsTableExists();
+            await ml.dataFrameAnalyticsResults.assertResultsTableNotEmpty();
+          });
+
+          it('should display elements on Data Visualizer home page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the data visualizer page');
+            await ml.navigation.navigateToDataVisualizer();
+
+            await ml.testExecution.logTestStep(
+              'should display the "import data" card with enabled button'
+            );
+            await ml.dataVisualizer.assertDataVisualizerImportDataCardExists();
+            await ml.dataVisualizer.assertUploadFileButtonEnabled(true);
+
+            await ml.testExecution.logTestStep(
+              'should display the "select index pattern" card with enabled button'
+            );
+            await ml.dataVisualizer.assertDataVisualizerIndexDataCardExists();
+            await ml.dataVisualizer.assertSelectIndexButtonEnabled(true);
+          });
+
+          it('should display elements on Index Data Visualizer page correctly', async () => {
+            await ml.testExecution.logTestStep(
+              'should load an index into the data visualizer page'
+            );
+            await ml.dataVisualizer.navigateToIndexPatternSelection();
+            await ml.jobSourceSelection.selectSourceForIndexBasedDataVisualizer(ecIndexPattern);
+
+            await ml.testExecution.logTestStep('should display the time range step');
+            await ml.dataVisualizerIndexBased.assertTimeRangeSelectorSectionExists();
+
+            await ml.testExecution.logTestStep('should load data for full time range');
+            await ml.dataVisualizerIndexBased.clickUseFullDataButton(ecExpectedTotalCount);
+
+            await ml.testExecution.logTestStep('should display the panels of fields');
+            await ml.dataVisualizerIndexBased.assertFieldsPanelsExist(ecExpectedFieldPanelCount);
+
+            await ml.testExecution.logTestStep('should not display the actions panel');
+            await ml.dataVisualizerIndexBased.assertActionsPanelNotExists();
+          });
+
+          it('should display elements on File Data Visualizer page correctly', async () => {
+            await ml.testExecution.logTestStep(
+              'should load the file data visualizer file selection'
+            );
+            await ml.navigation.navigateToDataVisualizer();
+            await ml.dataVisualizer.navigateToFileUpload();
+
+            await ml.testExecution.logTestStep(
+              'should select a file and load visualizer result page'
+            );
+            await ml.dataVisualizerFileBased.selectFile(uploadFilePath);
+
+            await ml.testExecution.logTestStep(
+              'should displays components of the file details page'
+            );
+            await ml.dataVisualizerFileBased.assertFileTitle(expectedUploadFileTitle);
+            await ml.dataVisualizerFileBased.assertFileContentPanelExists();
+            await ml.dataVisualizerFileBased.assertSummaryPanelExists();
+            await ml.dataVisualizerFileBased.assertFileStatsPanelExists();
+            await ml.dataVisualizerFileBased.assertImportButtonEnabled(false);
+          });
+
+          it('should display elements on Settings home page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the settings page');
+            await ml.navigation.navigateToSettings();
+
+            await ml.testExecution.logTestStep(
+              'should display enabled calendar management and disabled calendar create links'
+            );
+            await ml.settings.assertManageCalendarsLinkExists();
+            await ml.settings.assertManageCalendarsLinkEnabled(true);
+            await ml.settings.assertCreateCalendarLinkExists();
+            await ml.settings.assertCreateCalendarLinkEnabled(false);
+
+            await ml.testExecution.logTestStep('should display disabled filter list controls');
+            await ml.settings.assertManageFilterListsLinkExists();
+            await ml.settings.assertManageFilterListsLinkEnabled(false);
+            await ml.settings.assertCreateFilterListLinkExists();
+            await ml.settings.assertCreateFilterListLinkEnabled(false);
+          });
+
+          it('should display elements on Calendar management page correctly', async () => {
+            await ml.testExecution.logTestStep('should load the calendar management page');
+            await ml.settings.navigateToCalendarManagement();
+
+            await ml.testExecution.logTestStep('should display disabled create calendar button');
+            await ml.settingsCalendar.assertCreateCalendarButtonEnabled(false);
+
+            await ml.testExecution.logTestStep('should display the calendar in the list');
+            await ml.settingsCalendar.filterWithSearchString(calendarId, 1);
+
+            await ml.testExecution.logTestStep(
+              'should not enable delete calendar button on selection'
+            );
+            await ml.settingsCalendar.assertDeleteCalendarButtonEnabled(false);
+            await ml.settingsCalendar.selectCalendarRow(calendarId);
+            await ml.settingsCalendar.assertDeleteCalendarButtonEnabled(false);
+
+            await ml.testExecution.logTestStep('should load the calendar edit page');
+            await ml.settingsCalendar.openCalendarEditForm(calendarId);
+
+            await ml.testExecution.logTestStep(
+              'should display disabled elements of the edit calendar page'
+            );
+            await ml.settingsCalendar.assertApplyToAllJobsSwitchEnabled(false);
+            await ml.settingsCalendar.assertJobSelectionEnabled(false);
+            await ml.settingsCalendar.assertJobGroupSelectionEnabled(false);
+            await ml.settingsCalendar.assertNewEventButtonEnabled(false);
+            await ml.settingsCalendar.assertImportEventsButtonEnabled(false);
+
+            await ml.testExecution.logTestStep('should display the event in the list');
+            await ml.settingsCalendar.assertEventRowExists(eventDescription);
+
+            await ml.testExecution.logTestStep('should display enabled delete event button');
+            await ml.settingsCalendar.assertDeleteEventButtonEnabled(eventDescription, false);
+          });
+
+          it('should display elements on Stack Management ML page correctly', async () => {
+            await ml.testExecution.logTestStep(
+              'should load the stack management with the ML menu item being present'
+            );
+            await ml.navigation.navigateToStackManagement();
+
+            await ml.testExecution.logTestStep(
+              'should display the access denied page in stack management'
+            );
+            await ml.navigation.navigateToStackManagementJobsListPage({
+              expectAccessDenied: true,
+            });
+          });
+        });
+      }
+    });
+  });
+}
diff --git a/x-pack/test/functional/apps/monitoring/enable_monitoring/index.js b/x-pack/test/functional/apps/monitoring/enable_monitoring/index.js
index fefad214736e6f..70f7e0559d0346 100644
--- a/x-pack/test/functional/apps/monitoring/enable_monitoring/index.js
+++ b/x-pack/test/functional/apps/monitoring/enable_monitoring/index.js
@@ -10,6 +10,7 @@ export default function ({ getService, getPageObjects }) {
   const PageObjects = getPageObjects(['monitoring', 'common', 'header']);
   const esSupertest = getService('esSupertest');
   const noData = getService('monitoringNoData');
+  const testSubjects = getService('testSubjects');
   const clusterOverview = getService('monitoringClusterOverview');
   const retry = getService('retry');
 
@@ -46,8 +47,10 @@ export default function ({ getService, getPageObjects }) {
       });
 
       // Here we are checking that once Monitoring is enabled,
-      //it moves on to the cluster overview page.
-      await retry.try(async () => {
+      // it moves on to the cluster overview page.
+      await retry.tryForTime(10000, async () => {
+        // Click the refresh button
+        await testSubjects.click('querySubmitButton');
         expect(await clusterOverview.isOnClusterOverview()).to.be(true);
       });
     });
diff --git a/x-pack/test/functional/apps/monitoring/time_filter.js b/x-pack/test/functional/apps/monitoring/time_filter.js
index 11557d995218e8..127c7d8889bc4f 100644
--- a/x-pack/test/functional/apps/monitoring/time_filter.js
+++ b/x-pack/test/functional/apps/monitoring/time_filter.js
@@ -7,8 +7,6 @@
 import expect from '@kbn/expect';
 import { getLifecycleMethods } from './_get_lifecycle_methods';
 
-const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
 export default function ({ getService, getPageObjects }) {
   const PageObjects = getPageObjects(['header', 'timePicker']);
   const testSubjects = getService('testSubjects');
@@ -36,12 +34,9 @@ export default function ({ getService, getPageObjects }) {
       expect(isLoading).to.be(true);
     });
 
-    it('should send another request when changing the time picker', async () => {
-      /**
-       * TODO: The value should either be removed or lowered after:
-       * https://github.com/elastic/kibana/issues/72997 is resolved
-       */
-      await delay(3000);
+    // TODO: [cr] I'm not sure this test is any better than the above one, we might need to rely solely on unit tests
+    // for this functionality
+    it.skip('should send another request when changing the time picker', async () => {
       await PageObjects.timePicker.setAbsoluteRange(
         'Aug 15, 2016 @ 21:00:00.000',
         'Aug 16, 2016 @ 00:00:00.000'
diff --git a/x-pack/test/functional/apps/rollup_job/hybrid_index_pattern.js b/x-pack/test/functional/apps/rollup_job/hybrid_index_pattern.js
index d6ed6ce13391e2..b4eaff7f3ddcfb 100644
--- a/x-pack/test/functional/apps/rollup_job/hybrid_index_pattern.js
+++ b/x-pack/test/functional/apps/rollup_job/hybrid_index_pattern.js
@@ -11,6 +11,7 @@ import mockRolledUpData, { mockIndices } from './hybrid_index_helper';
 export default function ({ getService, getPageObjects }) {
   const es = getService('legacyEs');
   const esArchiver = getService('esArchiver');
+  const find = getService('find');
   const retry = getService('retry');
   const PageObjects = getPageObjects(['common', 'settings']);
 
@@ -88,6 +89,15 @@ export default function ({ getService, getPageObjects }) {
         (i) => i.includes(rollupIndexPatternName) && i.includes('Rollup')
       );
       expect(filteredIndexPatternNames.length).to.be(1);
+
+      // make sure there are no toasts which might be showing unexpected errors
+      const toastShown = await find.existsByCssSelector('.euiToast');
+      expect(toastShown).to.be(false);
+
+      // ensure all fields are available
+      await PageObjects.settings.clickIndexPatternByName(rollupIndexPatternName);
+      const fields = await PageObjects.settings.getFieldNames();
+      expect(fields).to.eql(['_source', '_id', '_type', '_index', '_score', '@timestamp']);
     });
 
     after(async () => {
diff --git a/x-pack/test/functional/apps/transform/cloning.ts b/x-pack/test/functional/apps/transform/cloning.ts
index d5c972cb8bd1f0..b6ccd68bb20963 100644
--- a/x-pack/test/functional/apps/transform/cloning.ts
+++ b/x-pack/test/functional/apps/transform/cloning.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { TransformPivotConfig } from '../../../../plugins/transform/public/app/common';
@@ -99,9 +98,7 @@ export default function ({ getService }: FtrProviderContext) {
             'should display the original transform in the transform list'
           );
           await transform.table.refreshTransformList();
-          await transform.table.filterWithSearchString(transformConfig.id);
-          const rows = await transform.table.parseTransformTable();
-          expect(rows.filter((row) => row.id === transformConfig.id)).to.have.length(1);
+          await transform.table.filterWithSearchString(transformConfig.id, 1);
 
           await transform.testExecution.logTestStep('should show the actions popover');
           await transform.table.assertTransformRowActions(false);
@@ -212,9 +209,7 @@ export default function ({ getService }: FtrProviderContext) {
             'should display the created transform in the transform list'
           );
           await transform.table.refreshTransformList();
-          await transform.table.filterWithSearchString(testData.transformId);
-          const rows = await transform.table.parseTransformTable();
-          expect(rows.filter((row) => row.id === testData.transformId)).to.have.length(1);
+          await transform.table.filterWithSearchString(testData.transformId, 1);
         });
       });
     }
diff --git a/x-pack/test/functional/apps/transform/creation_index_pattern.ts b/x-pack/test/functional/apps/transform/creation_index_pattern.ts
index daecc26186ac12..4e2b832838b7d9 100644
--- a/x-pack/test/functional/apps/transform/creation_index_pattern.ts
+++ b/x-pack/test/functional/apps/transform/creation_index_pattern.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../ftr_provider_context';
 
@@ -402,9 +401,7 @@ export default function ({ getService }: FtrProviderContext) {
             'displays the created transform in the transform list'
           );
           await transform.table.refreshTransformList();
-          await transform.table.filterWithSearchString(testData.transformId);
-          const rows = await transform.table.parseTransformTable();
-          expect(rows.filter((row) => row.id === testData.transformId)).to.have.length(1);
+          await transform.table.filterWithSearchString(testData.transformId, 1);
 
           await transform.testExecution.logTestStep(
             'transform creation displays details for the created transform in the transform list'
diff --git a/x-pack/test/functional/apps/transform/creation_saved_search.ts b/x-pack/test/functional/apps/transform/creation_saved_search.ts
index d3cbc1159a9c7c..229ff97782362c 100644
--- a/x-pack/test/functional/apps/transform/creation_saved_search.ts
+++ b/x-pack/test/functional/apps/transform/creation_saved_search.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../ftr_provider_context';
 
@@ -208,9 +207,7 @@ export default function ({ getService }: FtrProviderContext) {
             'displays the created transform in the transform list'
           );
           await transform.table.refreshTransformList();
-          await transform.table.filterWithSearchString(testData.transformId);
-          const rows = await transform.table.parseTransformTable();
-          expect(rows.filter((row) => row.id === testData.transformId)).to.have.length(1);
+          await transform.table.filterWithSearchString(testData.transformId, 1);
 
           await transform.testExecution.logTestStep(
             'transform creation displays details for the created transform in the transform list'
diff --git a/x-pack/test/functional/apps/transform/editing.ts b/x-pack/test/functional/apps/transform/editing.ts
index 5582d279833e7c..460e7c5b24a988 100644
--- a/x-pack/test/functional/apps/transform/editing.ts
+++ b/x-pack/test/functional/apps/transform/editing.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { TransformPivotConfig } from '../../../../plugins/transform/public/app/common';
@@ -73,9 +72,7 @@ export default function ({ getService }: FtrProviderContext) {
           'should display the original transform in the transform list'
         );
         await transform.table.refreshTransformList();
-        await transform.table.filterWithSearchString(transformConfig.id);
-        const rows = await transform.table.parseTransformTable();
-        expect(rows.filter((row) => row.id === transformConfig.id)).to.have.length(1);
+        await transform.table.filterWithSearchString(transformConfig.id, 1);
 
         await transform.testExecution.logTestStep('should show the actions popover');
         await transform.table.assertTransformRowActions(false);
@@ -127,9 +124,7 @@ export default function ({ getService }: FtrProviderContext) {
           'should display the updated transform in the transform list'
         );
         await transform.table.refreshTransformList();
-        await transform.table.filterWithSearchString(transformConfig.id);
-        const rows = await transform.table.parseTransformTable();
-        expect(rows.filter((row) => row.id === transformConfig.id)).to.have.length(1);
+        await transform.table.filterWithSearchString(transformConfig.id, 1);
 
         await transform.testExecution.logTestStep(
           'should display the updated transform in the transform list row cells'
diff --git a/x-pack/test/functional/apps/transform/index.ts b/x-pack/test/functional/apps/transform/index.ts
index 6dd22a1f4a204d..a01f3fa5d53a53 100644
--- a/x-pack/test/functional/apps/transform/index.ts
+++ b/x-pack/test/functional/apps/transform/index.ts
@@ -5,10 +5,9 @@
  */
 import { FtrProviderContext } from '../../ftr_provider_context';
 
-export default function ({ getService, loadTestFile, getPageObjects }: FtrProviderContext) {
+export default function ({ getService, loadTestFile }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const transform = getService('transform');
-  const PageObjects = getPageObjects(['security']);
 
   describe('transform', function () {
     this.tags(['ciGroup9', 'transform']);
@@ -31,7 +30,7 @@ export default function ({ getService, loadTestFile, getPageObjects }: FtrProvid
       await esArchiver.unload('ml/ecommerce');
 
       await transform.testResources.resetKibanaTimeZone();
-      await PageObjects.security.logout();
+      await transform.securityUI.logout();
     });
 
     loadTestFile(require.resolve('./creation_index_pattern'));
diff --git a/x-pack/test/functional/es_archives/endpoint/resolver/signals/data.json.gz b/x-pack/test/functional/es_archives/endpoint/resolver/signals/data.json.gz
new file mode 100644
index 00000000000000..e1b9c01101f6e2
Binary files /dev/null and b/x-pack/test/functional/es_archives/endpoint/resolver/signals/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/endpoint/resolver/signals/mappings.json b/x-pack/test/functional/es_archives/endpoint/resolver/signals/mappings.json
new file mode 100644
index 00000000000000..ad77961a41445f
--- /dev/null
+++ b/x-pack/test/functional/es_archives/endpoint/resolver/signals/mappings.json
@@ -0,0 +1,3239 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".siem-signals-default": {
+        "is_write_index": true
+      }
+    },
+    "index": ".siem-signals-default-000001",
+    "mappings": {
+      "dynamic": "false",
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "doc_values": false,
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "integer"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "signal": {
+          "properties": {
+            "ancestors": {
+              "properties": {
+                "depth": {
+                  "type": "long"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "rule": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "original_event": {
+              "properties": {
+                "action": {
+                  "type": "keyword"
+                },
+                "category": {
+                  "type": "keyword"
+                },
+                "code": {
+                  "type": "keyword"
+                },
+                "created": {
+                  "type": "date"
+                },
+                "dataset": {
+                  "type": "keyword"
+                },
+                "duration": {
+                  "type": "long"
+                },
+                "end": {
+                  "type": "date"
+                },
+                "hash": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "kind": {
+                  "type": "keyword"
+                },
+                "module": {
+                  "type": "keyword"
+                },
+                "original": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "keyword"
+                },
+                "outcome": {
+                  "type": "keyword"
+                },
+                "provider": {
+                  "type": "keyword"
+                },
+                "risk_score": {
+                  "type": "float"
+                },
+                "risk_score_norm": {
+                  "type": "float"
+                },
+                "sequence": {
+                  "type": "long"
+                },
+                "severity": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "timezone": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "original_time": {
+              "type": "date"
+            },
+            "parent": {
+              "properties": {
+                "depth": {
+                  "type": "long"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "index": {
+                  "type": "keyword"
+                },
+                "rule": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "rule": {
+              "properties": {
+                "author": {
+                  "type": "keyword"
+                },
+                "building_block_type": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "date"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "description": {
+                  "type": "keyword"
+                },
+                "enabled": {
+                  "type": "keyword"
+                },
+                "false_positives": {
+                  "type": "keyword"
+                },
+                "filters": {
+                  "type": "object"
+                },
+                "from": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "immutable": {
+                  "type": "keyword"
+                },
+                "index": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "keyword"
+                },
+                "language": {
+                  "type": "keyword"
+                },
+                "license": {
+                  "type": "keyword"
+                },
+                "max_signals": {
+                  "type": "keyword"
+                },
+                "name": {
+                  "type": "keyword"
+                },
+                "note": {
+                  "type": "text"
+                },
+                "output_index": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "type": "keyword"
+                },
+                "references": {
+                  "type": "keyword"
+                },
+                "risk_score": {
+                  "type": "float"
+                },
+                "risk_score_mapping": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "rule_id": {
+                  "type": "keyword"
+                },
+                "rule_name_override": {
+                  "type": "keyword"
+                },
+                "saved_id": {
+                  "type": "keyword"
+                },
+                "severity": {
+                  "type": "keyword"
+                },
+                "severity_mapping": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "severity": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "size": {
+                  "type": "keyword"
+                },
+                "tags": {
+                  "type": "keyword"
+                },
+                "threat": {
+                  "properties": {
+                    "framework": {
+                      "type": "keyword"
+                    },
+                    "tactic": {
+                      "properties": {
+                        "id": {
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "type": "keyword"
+                        },
+                        "reference": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "technique": {
+                      "properties": {
+                        "id": {
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "type": "keyword"
+                        },
+                        "reference": {
+                          "type": "keyword"
+                        }
+                      }
+                    }
+                  }
+                },
+                "threshold": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "timeline_id": {
+                  "type": "keyword"
+                },
+                "timeline_title": {
+                  "type": "keyword"
+                },
+                "timestamp_override": {
+                  "type": "keyword"
+                },
+                "to": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "date"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "threshold_count": {
+              "type": "float"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "transaction": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "lifecycle": {
+          "name": ".siem-signals-default",
+          "rollover_alias": ".siem-signals-default"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "routing": {
+          "allocation": {
+            "include": {
+              "_tier": "data_hot"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/x-pack/test/functional/es_archives/maps/kibana/data.json b/x-pack/test/functional/es_archives/maps/kibana/data.json
index 0f1fd3c09d7065..f756d73484198f 100644
--- a/x-pack/test/functional/es_archives/maps/kibana/data.json
+++ b/x-pack/test/functional/es_archives/maps/kibana/data.json
@@ -1008,6 +1008,40 @@
   }
 }
 
+{
+  "type": "doc",
+  "value": {
+    "id": "map:bff99716-e3dc-11ea-87d0-0242ac130003",
+    "index": ".kibana",
+    "source": {
+      "map" : {
+        "description":"shapes with mvt scaling",
+        "layerListJSON":"[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true},\"id\":\"76b9fc1d-1e8a-4d2f-9f9e-6ba2b19f24bb\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\"},{\"sourceDescriptor\":{\"geoField\":\"geometry\",\"filterByMapBounds\":true,\"scalingType\":\"MVT\",\"topHitsSize\":1,\"id\":\"97f8555e-8db0-4bd8-8b18-22e32f468667\",\"type\":\"ES_SEARCH\",\"tooltipProperties\":[],\"sortField\":\"\",\"sortOrder\":\"desc\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"id\":\"caffa63a-ebfb-466d-8ff6-d797975b88ab\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Blues\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"prop1\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":1},\"type\":\"ORDINAL\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#41937c\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":6}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"STATIC\",\"options\":{\"value\":\"\"}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"type\":\"TILED_VECTOR\",\"joins\":[]}]",
+        "mapStateJSON":"{\"zoom\":3.75,\"center\":{\"lon\":80.01106,\"lat\":3.65009},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showSpatialFilters\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}",
+        "title":"geo_shape_mvt",
+        "uiStateJSON":"{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}"
+      },
+      "type" : "map",
+      "references" : [
+        {
+          "id":"561253e0-f731-11e8-8487-11b9dd924f96",
+          "name":"layer_1_source_index_pattern",
+          "type":"index-pattern"
+        }
+      ],
+      "migrationVersion" : {
+        "map" : "7.9.0"
+      },
+      "updated_at" : "2020-08-10T18:27:39.805Z"
+    }
+  }
+}
+
+
+
+
+
+
 {
   "type": "doc",
   "value": {
diff --git a/x-pack/test/functional/es_archives/monitoring/apm/mappings.json b/x-pack/test/functional/es_archives/monitoring/apm/mappings.json
index d5f68e6642a2d9..df00072edd669e 100644
--- a/x-pack/test/functional/es_archives/monitoring/apm/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/apm/mappings.json
@@ -1,719 +1,311 @@
 {
-    "type": "index",
-    "value": {
-        "aliases": {},
-        "index": ".monitoring-beats-6-2018.08.31",
-        "mappings": {
-            "dynamic": false,
-            "properties": {
-                "beats_state": {
-                    "properties": {
-                        "beat": {
-                            "properties": {
-                                "host": {
-                                    "type": "keyword"
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": ".monitoring-beats-6-2018.08.31",
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "beats_state": {
+          "properties": {
+            "timestamp": {
+              "format": "date_time",
+              "type": "date"
+            }
+          }
+        },
+        "beats_stats": {
+          "properties": {
+            "beat": {
+              "properties": {
+                "type": {
+                  "type": "keyword"
+                },
+                "uuid": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "metrics": {
+              "properties": {
+                "apm-server": {
+                  "properties": {
+                    "processor": {
+                      "properties": {
+                        "error": {
+                          "properties": {
+                            "transformations": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "metric": {
+                          "properties": {
+                            "transformations": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "span": {
+                          "properties": {
+                            "transformations": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "transaction": {
+                          "properties": {
+                            "transformations": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "server": {
+                      "properties": {
+                        "request": {
+                          "properties": {
+                            "count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "response": {
+                          "properties": {
+                            "count": {
+                              "type": "long"
+                            },
+                            "errors": {
+                              "properties": {
+                                "closed": {
+                                  "type": "long"
                                 },
-                                "name": {
-                                    "type": "keyword"
+                                "concurrency": {
+                                  "type": "long"
                                 },
-                                "type": {
-                                    "type": "keyword"
+                                "decode": {
+                                  "type": "long"
                                 },
-                                "uuid": {
-                                    "type": "keyword"
+                                "forbidden": {
+                                  "type": "long"
                                 },
-                                "version": {
-                                    "type": "keyword"
-                                }
-                            }
-                        },
-                        "state": {
-                            "properties": {
-                                "beat": {
-                                    "properties": {
-                                        "name": {
-                                            "type": "keyword"
-                                        }
-                                    }
+                                "internal": {
+                                  "type": "long"
+                                },
+                                "method": {
+                                  "type": "long"
                                 },
-                                "host": {
-                                    "properties": {
-                                        "architecture": {
-                                            "type": "keyword"
-                                        },
-                                        "name": {
-                                            "type": "keyword"
-                                        },
-                                        "hostname": {
-                                            "type": "keyword"
-                                        },
-                                        "os": {
-                                            "properties": {
-                                                "build": {
-                                                    "type": "keyword"
-                                                },
-                                                "family": {
-                                                    "type": "keyword"
-                                                },
-                                                "platform": {
-                                                    "type": "keyword"
-                                                },
-                                                "version": {
-                                                    "type": "keyword"
-                                                }
-                                            }
-                                        }
-                                    }
+                                "queue": {
+                                  "type": "long"
                                 },
-                                "input": {
-                                    "properties": {
-                                        "count": {
-                                            "type": "long"
-                                        },
-                                        "names": {
-                                            "type": "keyword"
-                                        }
-                                    }
+                                "ratelimit": {
+                                  "type": "long"
                                 },
-                                "module": {
-                                    "properties": {
-                                        "count": {
-                                            "type": "long"
-                                        },
-                                        "names": {
-                                            "type": "keyword"
-                                        }
-                                    }
+                                "toolarge": {
+                                  "type": "long"
                                 },
-                                "output": {
-                                    "properties": {
-                                        "name": {
-                                            "type": "keyword"
-                                        }
-                                    }
+                                "unauthorized": {
+                                  "type": "long"
                                 },
-                                "service": {
-                                    "properties": {
-                                        "id": {
-                                            "type": "keyword"
-                                        },
-                                        "name": {
-                                            "type": "keyword"
-                                        },
-                                        "version": {
-                                            "type": "keyword"
-                                        }
-                                    }
+                                "validate": {
+                                  "type": "long"
                                 }
+                              }
+                            },
+                            "valid": {
+                              "properties": {
+                                "accepted": {
+                                  "type": "long"
+                                },
+                                "ok": {
+                                  "type": "long"
+                                }
+                              }
                             }
-                        },
-                        "timestamp": {
-                            "format": "date_time",
-                            "type": "date"
+                          }
                         }
+                      }
                     }
+                  }
                 },
-                "beats_stats": {
-                    "properties": {
-                        "beat": {
-                            "properties": {
-                                "host": {
-                                    "type": "keyword"
-                                },
-                                "name": {
-                                    "type": "keyword"
-                                },
-                                "type": {
-                                    "type": "keyword"
-                                },
-                                "uuid": {
-                                    "type": "keyword"
-                                },
-                                "version": {
-                                    "type": "keyword"
-                                }
+                "beat": {
+                  "properties": {
+                    "cpu": {
+                      "properties": {
+                        "total": {
+                          "properties": {
+                            "value": {
+                              "type": "long"
                             }
+                          }
+                        }
+                      }
+                    },
+                    "handles": {
+                      "properties": {
+                        "open": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "info": {
+                      "properties": {
+                        "ephemeral_id": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "memstats": {
+                      "properties": {
+                        "gc_next": {
+                          "type": "long"
                         },
-                        "metrics": {
-                            "properties": {
-                                "beat": {
-                                    "properties": {
-                                        "cpu": {
-                                            "properties": {
-                                                "system": {
-                                                    "properties": {
-                                                        "ticks": {
-                                                            "type": "long"
-                                                        },
-                                                        "time": {
-                                                            "properties": {
-                                                                "ms": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        }
-                                                    }
-                                                },
-                                                "total": {
-                                                    "properties": {
-                                                        "value": {
-                                                            "type": "long"
-                                                        },
-                                                        "ticks": {
-                                                            "type": "long"
-                                                        },
-                                                        "time": {
-                                                            "properties": {
-                                                                "ms": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        }
-                                                    }
-                                                },
-                                                "user": {
-                                                    "properties": {
-                                                        "ticks": {
-                                                            "type": "long"
-                                                        },
-                                                        "time": {
-                                                            "properties": {
-                                                                "ms": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        },
-                                        "info": {
-                                            "properties": {
-                                                "ephemeral_id": {
-                                                    "type": "keyword"
-                                                },
-                                                "uptime": {
-                                                    "properties": {
-                                                        "ms": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        },
-                                        "memstats": {
-                                            "properties": {
-                                                "gc_next": {
-                                                    "type": "long"
-                                                },
-                                                "memory_alloc": {
-                                                    "type": "long"
-                                                },
-                                                "memory_total": {
-                                                    "type": "long"
-                                                },
-                                                "rss": {
-                                                    "type": "long"
-                                                }
-                                            }
-                                        },
-                                        "handles": {
-                                            "properties": {
-                                                "open": {
-                                                    "type": "long"
-                                                },
-                                                "limit": {
-                                                    "properties": {
-                                                        "hard": {
-                                                            "type": "long"
-                                                        },
-                                                        "soft": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    }
-                                },
-                                "apm-server": {
-                                    "properties": {
-                                        "server": {
-                                            "properties": {
-                                                "request": {
-                                                    "properties": {
-                                                        "count": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "concurrent": {
-                                                    "properties": {
-                                                        "wait": {
-                                                            "properties": {
-                                                                "ms": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        }
-                                                    }
-                                                },
-                                                "response": {
-                                                    "properties": {
-                                                        "count": {
-                                                            "type": "long"
-                                                        },
-                                                        "errors": {
-                                                            "properties": {
-                                                                "count": {
-                                                                    "type": "long"
-                                                                },
-                                                                "toolarge": {
-                                                                    "type": "long"
-                                                                },
-                                                                "validate": {
-                                                                    "type": "long"
-                                                                },
-                                                                "ratelimit": {
-                                                                    "type": "long"
-                                                                },
-                                                                "queue": {
-                                                                    "type": "long"
-                                                                },
-                                                                "closed": {
-                                                                    "type": "long"
-                                                                },
-                                                                "forbidden": {
-                                                                    "type": "long"
-                                                                },
-                                                                "concurrency": {
-                                                                    "type": "long"
-                                                                },
-                                                                "unauthorized": {
-                                                                    "type": "long"
-                                                                },
-                                                                "internal": {
-                                                                    "type": "long"
-                                                                },
-                                                                "decode": {
-                                                                    "type": "long"
-                                                                },
-                                                                "method": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        },
-                                                        "valid": {
-                                                            "properties": {
-                                                                "ok": {
-                                                                    "type": "long"
-                                                                },
-                                                                "accepted": {
-                                                                    "type": "long"
-                                                                },
-                                                                "count": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        },
-                                        "decoder": {
-                                            "properties": {
-                                                "deflate": {
-                                                    "properties": {
-                                                        "content-length": {
-                                                            "type": "long"
-                                                        },
-                                                        "count": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "gzip": {
-                                                    "properties": {
-                                                        "content-length": {
-                                                            "type": "long"
-                                                        },
-                                                        "count": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "uncompressed": {
-                                                    "properties": {
-                                                        "content-length": {
-                                                            "type": "long"
-                                                        },
-                                                        "count": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "reader": {
-                                                    "properties": {
-                                                        "size": {
-                                                            "type": "long"
-                                                        },
-                                                        "count": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "missing-content-length": {
-                                                    "properties": {
-                                                        "count": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        },
-                                        "processor": {
-                                            "properties": {
-                                                "metric": {
-                                                    "properties": {
-                                                        "decoding": {
-                                                            "properties": {
-                                                                "errors": {
-                                                                    "type": "long"
-                                                                },
-                                                                "count": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        },
-                                                        "validation": {
-                                                            "properties": {
-                                                                "errors": {
-                                                                    "type": "long"
-                                                                },
-                                                                "count": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        },
-                                                        "transformations": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "sourcemap": {
-                                                    "properties": {
-                                                        "counter": {
-                                                            "type": "long"
-                                                        },
-                                                        "decoding": {
-                                                            "properties": {
-                                                                "errors": {
-                                                                    "type": "long"
-                                                                },
-                                                                "count": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        },
-                                                        "validation": {
-                                                            "properties": {
-                                                                "errors": {
-                                                                    "type": "long"
-                                                                },
-                                                                "count": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        }
-                                                    }
-                                                },
-                                                "transaction": {
-                                                    "properties": {
-                                                        "decoding": {
-                                                            "properties": {
-                                                                "errors": {
-                                                                    "type": "long"
-                                                                },
-                                                                "count": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        },
-                                                        "validation": {
-                                                            "properties": {
-                                                                "errors": {
-                                                                    "type": "long"
-                                                                },
-                                                                "count": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        },
-                                                        "transformations": {
-                                                            "type": "long"
-                                                        },
-                                                        "transactions": {
-                                                            "type": "long"
-                                                        },
-                                                        "spans": {
-                                                            "type": "long"
-                                                        },
-                                                        "stacktraces": {
-                                                            "type": "long"
-                                                        },
-                                                        "frames": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "error": {
-                                                    "properties": {
-                                                        "decoding": {
-                                                            "properties": {
-                                                                "errors": {
-                                                                    "type": "long"
-                                                                },
-                                                                "count": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        },
-                                                        "validation": {
-                                                            "properties": {
-                                                                "errors": {
-                                                                    "type": "long"
-                                                                },
-                                                                "count": {
-                                                                    "type": "long"
-                                                                }
-                                                            }
-                                                        },
-                                                        "transformations": {
-                                                            "type": "long"
-                                                        },
-                                                        "errors": {
-                                                            "type": "long"
-                                                        },
-                                                        "stacktraces": {
-                                                            "type": "long"
-                                                        },
-                                                        "frames": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "span": {
-                                                    "properties": {
-                                                        "transformations": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    }
-                                },
-                                "libbeat": {
-                                    "properties": {
-                                        "config": {
-                                            "properties": {
-                                                "module": {
-                                                    "properties": {
-                                                        "running": {
-                                                            "type": "long"
-                                                        },
-                                                        "starts": {
-                                                            "type": "long"
-                                                        },
-                                                        "stops": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "reloads": {
-                                                    "type": "long"
-                                                }
-                                            }
-                                        },
-                                        "output": {
-                                            "properties": {
-                                                "events": {
-                                                    "properties": {
-                                                        "acked": {
-                                                            "type": "long"
-                                                        },
-                                                        "active": {
-                                                            "type": "long"
-                                                        },
-                                                        "batches": {
-                                                            "type": "long"
-                                                        },
-                                                        "dropped": {
-                                                            "type": "long"
-                                                        },
-                                                        "duplicates": {
-                                                            "type": "long"
-                                                        },
-                                                        "failed": {
-                                                            "type": "long"
-                                                        },
-                                                        "total": {
-                                                            "type": "long"
-                                                        },
-                                                        "toomany": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "read": {
-                                                    "properties": {
-                                                        "bytes": {
-                                                            "type": "long"
-                                                        },
-                                                        "errors": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "type": {
-                                                    "type": "keyword"
-                                                },
-                                                "write": {
-                                                    "properties": {
-                                                        "bytes": {
-                                                            "type": "long"
-                                                        },
-                                                        "errors": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        },
-                                        "pipeline": {
-                                            "properties": {
-                                                "clients": {
-                                                    "type": "long"
-                                                },
-                                                "events": {
-                                                    "properties": {
-                                                        "active": {
-                                                            "type": "long"
-                                                        },
-                                                        "dropped": {
-                                                            "type": "long"
-                                                        },
-                                                        "failed": {
-                                                            "type": "long"
-                                                        },
-                                                        "filtered": {
-                                                            "type": "long"
-                                                        },
-                                                        "published": {
-                                                            "type": "long"
-                                                        },
-                                                        "retry": {
-                                                            "type": "long"
-                                                        },
-                                                        "total": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                },
-                                                "queue": {
-                                                    "properties": {
-                                                        "acked": {
-                                                            "type": "long"
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    }
-                                },
-                                "system": {
-                                    "properties": {
-                                        "load": {
-                                            "properties": {
-                                                "1": {
-                                                    "type": "double"
-                                                },
-                                                "5": {
-                                                    "type": "double"
-                                                },
-                                                "15": {
-                                                    "type": "double"
-                                                },
-                                                "norm": {
-                                                    "properties": {
-                                                        "1": {
-                                                            "type": "double"
-                                                        },
-                                                        "5": {
-                                                            "type": "double"
-                                                        },
-                                                        "15": {
-                                                            "type": "double"
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
+                        "memory_alloc": {
+                          "type": "long"
                         },
-                        "tags": {
-                            "type": "keyword"
+                        "memory_total": {
+                          "type": "long"
                         },
-                        "timestamp": {
-                            "format": "date_time",
-                            "type": "date"
+                        "rss": {
+                          "type": "long"
                         }
+                      }
                     }
+                  }
                 },
-                "cluster_uuid": {
-                    "type": "keyword"
-                },
-                "interval_ms": {
-                    "type": "long"
-                },
-                "source_node": {
-                    "properties": {
-                        "host": {
-                            "type": "keyword"
+                "libbeat": {
+                  "properties": {
+                    "output": {
+                      "properties": {
+                        "events": {
+                          "properties": {
+                            "acked": {
+                              "type": "long"
+                            },
+                            "active": {
+                              "type": "long"
+                            },
+                            "dropped": {
+                              "type": "long"
+                            },
+                            "failed": {
+                              "type": "long"
+                            },
+                            "total": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "ip": {
-                            "type": "keyword"
+                        "read": {
+                          "properties": {
+                            "bytes": {
+                              "type": "long"
+                            },
+                            "errors": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "name": {
-                            "type": "keyword"
+                        "write": {
+                          "properties": {
+                            "bytes": {
+                              "type": "long"
+                            },
+                            "errors": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "pipeline": {
+                      "properties": {
+                        "events": {
+                          "properties": {
+                            "dropped": {
+                              "type": "long"
+                            },
+                            "failed": {
+                              "type": "long"
+                            },
+                            "published": {
+                              "type": "long"
+                            },
+                            "retry": {
+                              "type": "long"
+                            },
+                            "total": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "system": {
+                  "properties": {
+                    "load": {
+                      "properties": {
+                        "1": {
+                          "type": "double"
                         },
-                        "transport_address": {
-                            "type": "keyword"
+                        "15": {
+                          "type": "double"
                         },
-                        "uuid": {
-                            "type": "keyword"
+                        "5": {
+                          "type": "double"
                         }
+                      }
                     }
-                },
-                "timestamp": {
-                    "format": "date_time",
-                    "type": "date"
-                },
-                "type": {
-                    "type": "keyword"
+                  }
                 }
+              }
+            },
+            "timestamp": {
+              "format": "date_time",
+              "type": "date"
             }
+          }
+        },
+        "cluster_uuid": {
+          "type": "keyword"
         },
-        "settings": {
-            "index": {
-                "auto_expand_replicas": "0-1",
-                "codec": "best_compression",
-                "format": "6",
-                "number_of_replicas": "0",
-                "number_of_shards": "1"
+        "metricset": {
+          "properties": {
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
+          }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "codec": "best_compression",
+        "format": "6",
+        "number_of_replicas": "0",
+        "number_of_shards": "1"
+      }
     }
+  }
 }
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/monitoring/basic_6.3.x/mappings.json b/x-pack/test/functional/es_archives/monitoring/basic_6.3.x/mappings.json
index 9abc5c6381e45b..4909b73909186e 100644
--- a/x-pack/test/functional/es_archives/monitoring/basic_6.3.x/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/basic_6.3.x/mappings.json
@@ -1,7 +1,8 @@
 {
   "type": "index",
   "value": {
-    "aliases": {},
+    "aliases": {
+    },
     "index": ".monitoring-kibana-6-2018.07.23",
     "mappings": {
       "dynamic": false,
@@ -9,95 +10,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -105,47 +32,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -155,36 +63,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -192,9 +73,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -208,10 +86,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -230,121 +122,54 @@
 {
   "type": "index",
   "value": {
-    "aliases": {},
+    "aliases": {
+    },
     "index": ".monitoring-es-6-2018.07.23",
     "mappings": {
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -359,125 +184,43 @@
                     }
                   }
                 },
-                "fielddata": {
+                "indexing": {
                   "properties": {
-                    "memory_size_in_bytes": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "evictions": {
+                    "index_total": {
+                      "type": "long"
+                    },
+                    "throttle_time_in_millis": {
                       "type": "long"
                     }
                   }
                 },
-                "store": {
+                "merges": {
                   "properties": {
-                    "size_in_bytes": {
+                    "total_size_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "indexing": {
+                "refresh": {
                   "properties": {
-                    "index_total": {
-                      "type": "long"
-                    },
-                    "index_time_in_millis": {
-                      "type": "long"
-                    },
-                    "throttle_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
                 },
-                "merges": {
+                "segments": {
                   "properties": {
-                    "total_size_in_bytes": {
-                      "type": "long"
+                    "count": {
+                      "type": "integer"
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "segments": {
-                  "properties": {
-                    "count": {
-                      "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -486,36 +229,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -534,14 +260,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -550,24 +274,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -577,41 +292,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -620,68 +335,92 @@
             }
           }
         },
-        "cluster_stats": {
+        "indices_stats": {
           "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
+            "_all": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -702,15 +441,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -718,15 +448,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -745,116 +466,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -870,16 +572,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -891,12 +587,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -906,12 +596,6 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
@@ -921,71 +605,10 @@
                 }
               }
             },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
             "thread_pool": {
               "properties": {
                 "bulk": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -996,9 +619,6 @@
                 },
                 "get": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1009,22 +629,6 @@
                 },
                 "index": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1035,22 +639,6 @@
                 },
                 "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1073,246 +661,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/beats-with-restarted-instance/mappings.json b/x-pack/test/functional/es_archives/monitoring/beats-with-restarted-instance/mappings.json
index f616ffc1d3aec8..a8017ee6631b0f 100644
--- a/x-pack/test/functional/es_archives/monitoring/beats-with-restarted-instance/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/beats-with-restarted-instance/mappings.json
@@ -7,105 +7,6 @@
       "properties": {
         "beats_state": {
           "properties": {
-            "beat": {
-              "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "uuid": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "properties": {
-                "beat": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "host": {
-                  "properties": {
-                    "architecture": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "hostname": {
-                      "type": "keyword"
-                    },
-                    "os": {
-                      "properties": {
-                        "build": {
-                          "type": "keyword"
-                        },
-                        "family": {
-                          "type": "keyword"
-                        },
-                        "platform": {
-                          "type": "keyword"
-                        },
-                        "version": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "input": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "module": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "output": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "service": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "version": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -116,12 +17,6 @@
           "properties": {
             "beat": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
                 "type": {
                   "type": "keyword"
                 },
@@ -135,108 +30,40 @@
             },
             "metrics": {
               "properties": {
-                "beat": {
+                "apm-server": {
                   "properties": {
-                    "cpu": {
+                    "processor": {
                       "properties": {
-                        "system": {
+                        "error": {
                           "properties": {
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
-                        "total": {
+                        "metric": {
                           "properties": {
-                            "value": {
-                              "type": "long"
-                            },
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
-                        "user": {
+                        "span": {
                           "properties": {
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
-                        }
-                      }
-                    },
-                    "info": {
-                      "properties": {
-                        "ephemeral_id": {
-                          "type": "keyword"
                         },
-                        "uptime": {
+                        "transaction": {
                           "properties": {
-                            "ms": {
+                            "transformations": {
                               "type": "long"
                             }
                           }
                         }
                       }
                     },
-                    "memstats": {
-                      "properties": {
-                        "gc_next": {
-                          "type": "long"
-                        },
-                        "memory_alloc": {
-                          "type": "long"
-                        },
-                        "memory_total": {
-                          "type": "long"
-                        },
-                        "rss": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "handles": {
-                      "properties": {
-                        "open": {
-                          "type": "long"
-                        },
-                        "limit": {
-                          "properties": {
-                            "hard": {
-                              "type": "long"
-                            },
-                            "soft": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "apm-server": {
-                  "properties": {
                     "server": {
                       "properties": {
                         "request": {
@@ -246,17 +73,6 @@
                             }
                           }
                         },
-                        "concurrent": {
-                          "properties": {
-                            "wait": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "response": {
                           "properties": {
                             "count": {
@@ -264,53 +80,47 @@
                             },
                             "errors": {
                               "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "toolarge": {
+                                "closed": {
                                   "type": "long"
                                 },
-                                "validate": {
+                                "concurrency": {
                                   "type": "long"
                                 },
-                                "ratelimit": {
+                                "decode": {
                                   "type": "long"
                                 },
-                                "queue": {
+                                "forbidden": {
                                   "type": "long"
                                 },
-                                "closed": {
+                                "internal": {
                                   "type": "long"
                                 },
-                                "forbidden": {
+                                "method": {
                                   "type": "long"
                                 },
-                                "concurrency": {
+                                "queue": {
                                   "type": "long"
                                 },
-                                "unauthorized": {
+                                "ratelimit": {
                                   "type": "long"
                                 },
-                                "internal": {
+                                "toolarge": {
                                   "type": "long"
                                 },
-                                "decode": {
+                                "unauthorized": {
                                   "type": "long"
                                 },
-                                "method": {
+                                "validate": {
                                   "type": "long"
                                 }
                               }
                             },
                             "valid": {
                               "properties": {
-                                "ok": {
-                                  "type": "long"
-                                },
                                 "accepted": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "ok": {
                                   "type": "long"
                                 }
                               }
@@ -318,296 +128,109 @@
                           }
                         }
                       }
-                    },
-                    "decoder": {
+                    }
+                  }
+                },
+                "beat": {
+                  "properties": {
+                    "cpu": {
                       "properties": {
-                        "deflate": {
+                        "total": {
                           "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
+                            "value": {
                               "type": "long"
                             }
                           }
+                        }
+                      }
+                    },
+                    "handles": {
+                      "properties": {
+                        "open": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "info": {
+                      "properties": {
+                        "ephemeral_id": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "memstats": {
+                      "properties": {
+                        "gc_next": {
+                          "type": "long"
+                        },
+                        "memory_alloc": {
+                          "type": "long"
+                        },
+                        "memory_total": {
+                          "type": "long"
                         },
-                        "gzip": {
+                        "rss": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "libbeat": {
+                  "properties": {
+                    "output": {
+                      "properties": {
+                        "events": {
                           "properties": {
-                            "content-length": {
+                            "acked": {
                               "type": "long"
                             },
-                            "count": {
+                            "active": {
                               "type": "long"
-                            }
-                          }
-                        },
-                        "uncompressed": {
-                          "properties": {
-                            "content-length": {
+                            },
+                            "dropped": {
                               "type": "long"
                             },
-                            "count": {
+                            "failed": {
+                              "type": "long"
+                            },
+                            "total": {
                               "type": "long"
                             }
                           }
                         },
-                        "reader": {
+                        "read": {
                           "properties": {
-                            "size": {
+                            "bytes": {
                               "type": "long"
                             },
-                            "count": {
+                            "errors": {
                               "type": "long"
                             }
                           }
                         },
-                        "missing-content-length": {
+                        "write": {
                           "properties": {
-                            "count": {
+                            "bytes": {
+                              "type": "long"
+                            },
+                            "errors": {
                               "type": "long"
                             }
                           }
                         }
                       }
                     },
-                    "processor": {
+                    "pipeline": {
                       "properties": {
-                        "metric": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "sourcemap": {
-                          "properties": {
-                            "counter": {
-                              "type": "long"
-                            },
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "transaction": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            },
-                            "transactions": {
-                              "type": "long"
-                            },
-                            "spans": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "error": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            },
-                            "errors": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "span": {
-                          "properties": {
-                            "transformations": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "libbeat": {
-                  "properties": {
-                    "config": {
-                      "properties": {
-                        "module": {
-                          "properties": {
-                            "running": {
-                              "type": "long"
-                            },
-                            "starts": {
-                              "type": "long"
-                            },
-                            "stops": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reloads": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "output": {
-                      "properties": {
-                        "events": {
-                          "properties": {
-                            "acked": {
-                              "type": "long"
-                            },
-                            "active": {
-                              "type": "long"
-                            },
-                            "batches": {
-                              "type": "long"
-                            },
-                            "dropped": {
-                              "type": "long"
-                            },
-                            "duplicates": {
-                              "type": "long"
-                            },
-                            "failed": {
-                              "type": "long"
-                            },
-                            "total": {
-                              "type": "long"
-                            },
-                            "toomany": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "read": {
-                          "properties": {
-                            "bytes": {
-                              "type": "long"
-                            },
-                            "errors": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "type": {
-                          "type": "keyword"
-                        },
-                        "write": {
-                          "properties": {
-                            "bytes": {
-                              "type": "long"
-                            },
-                            "errors": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "pipeline": {
-                      "properties": {
-                        "clients": {
-                          "type": "long"
-                        },
                         "events": {
                           "properties": {
-                            "active": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
                             "failed": {
                               "type": "long"
                             },
-                            "filtered": {
-                              "type": "long"
-                            },
                             "published": {
                               "type": "long"
                             },
@@ -618,13 +241,6 @@
                               "type": "long"
                             }
                           }
-                        },
-                        "queue": {
-                          "properties": {
-                            "acked": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     }
@@ -637,24 +253,11 @@
                         "1": {
                           "type": "double"
                         },
-                        "5": {
-                          "type": "double"
-                        },
                         "15": {
                           "type": "double"
                         },
-                        "norm": {
-                          "properties": {
-                            "1": {
-                              "type": "double"
-                            },
-                            "5": {
-                              "type": "double"
-                            },
-                            "15": {
-                              "type": "double"
-                            }
-                          }
+                        "5": {
+                          "type": "double"
                         }
                       }
                     }
@@ -662,9 +265,6 @@
                 }
               }
             },
-            "tags": {
-              "type": "keyword"
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -674,25 +274,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
@@ -725,115 +316,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -848,29 +371,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -885,44 +391,9 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "refresh": {
                   "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -931,42 +402,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -975,36 +416,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -1023,14 +447,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -1039,24 +461,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -1066,41 +479,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -1109,68 +522,92 @@
             }
           }
         },
-        "cluster_stats": {
-          "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
-            }
-          }
-        },
-        "cluster_state": {
-          "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
-            }
-          }
-        },
-        "node_stats": {
+        "indices_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "_all": {
               "properties": {
-                "docs": {
+                "primaries": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "job_stats": {
+          "properties": {
+            "job_id": {
+              "type": "keyword"
+            }
+          }
+        },
+        "node_stats": {
+          "properties": {
+            "fs": {
+              "properties": {
+                "io_stats": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1191,15 +628,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1207,15 +635,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1234,116 +653,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1359,16 +759,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -1380,12 +774,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -1395,12 +783,6 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
@@ -1410,398 +792,97 @@
                 }
               }
             },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "thread_pool": {
-              "properties": {
-                "bulk": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "get": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "index": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "write": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "index_recovery": {
-          "type": "object"
-        },
-        "shard": {
-          "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
-            "index": {
-              "type": "keyword"
-            },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
-            "node": {
-              "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
-            },
-            "state": {
-              "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "ccr_stats": {
-          "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
-              "type": "keyword"
-            },
-            "follower_index": {
-              "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
+            "thread_pool": {
               "properties": {
-                "from_seq_no": {
-                  "type": "long"
+                "bulk": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 },
-                "retries": {
-                  "type": "integer"
+                "get": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 },
-                "exception": {
-                  "type": "object",
+                "index": {
                   "properties": {
-                    "type": {
-                      "type": "keyword"
+                    "queue": {
+                      "type": "integer"
                     },
-                    "reason": {
-                      "type": "text"
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "search": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
                     }
                   }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
                 },
-                "reason": {
-                  "type": "text"
+                "write": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 }
               }
             }
           }
         },
-        "ccr_auto_follow_stats": {
+        "shard": {
           "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
+            "index": {
+              "type": "keyword"
             },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
+            "node": {
+              "type": "keyword"
             },
-            "number_of_successful_follow_indices": {
-              "type": "long"
+            "primary": {
+              "type": "boolean"
             },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
+            "state": {
+              "type": "keyword"
+            }
+          }
+        },
+        "source_node": {
+          "properties": {
+            "name": {
+              "type": "keyword"
             },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
+            "uuid": {
+              "type": "keyword"
             }
           }
+        },
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -1824,24 +905,9 @@
     "mappings": {
       "dynamic": false,
       "properties": {
-        "timestamp": {
-          "type": "date"
-        },
-        "update_timestamp": {
-          "type": "date"
-        },
-        "resolved_timestamp": {
-          "type": "date"
-        },
-        "prefix": {
-          "type": "text"
-        },
         "message": {
           "type": "text"
         },
-        "suffix": {
-          "type": "text"
-        },
         "metadata": {
           "properties": {
             "cluster_uuid": {
@@ -1863,6 +929,21 @@
               "type": "keyword"
             }
           }
+        },
+        "prefix": {
+          "type": "text"
+        },
+        "resolved_timestamp": {
+          "type": "date"
+        },
+        "suffix": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "update_timestamp": {
+          "type": "date"
         }
       }
     },
@@ -1888,95 +969,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -1984,47 +991,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -2034,36 +1022,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -2071,9 +1032,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -2087,10 +1045,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/beats/mappings.json b/x-pack/test/functional/es_archives/monitoring/beats/mappings.json
index e9e03d6ff2a164..2ea26547e767b8 100644
--- a/x-pack/test/functional/es_archives/monitoring/beats/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/beats/mappings.json
@@ -6,115 +6,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -129,29 +61,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -166,44 +81,9 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "refresh": {
                   "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -212,42 +92,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -256,36 +106,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -304,14 +137,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -320,24 +151,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -347,41 +169,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -390,68 +212,92 @@
             }
           }
         },
-        "cluster_stats": {
+        "indices_stats": {
           "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
+            "_all": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -472,15 +318,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -488,15 +325,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -515,116 +343,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -640,16 +449,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -661,12 +464,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -676,12 +473,6 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
@@ -691,110 +482,30 @@
                 }
               }
             },
-            "jvm": {
+            "thread_pool": {
               "properties": {
-                "mem": {
+                "bulk": {
                   "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
+                    "queue": {
+                      "type": "integer"
                     },
-                    "heap_used_percent": {
-                      "type": "half_float"
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "get": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
                     },
-                    "heap_max_in_bytes": {
+                    "rejected": {
                       "type": "long"
                     }
                   }
                 },
-                "gc": {
+                "index": {
                   "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "thread_pool": {
-              "properties": {
-                "bulk": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "get": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "index": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -805,22 +516,6 @@
                 },
                 "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -843,368 +538,64 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
-          "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
-              "type": "keyword"
-            },
-            "follower_index": {
-              "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
-            }
-          }
-        },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "codec": "best_compression",
-        "format": "6",
-        "number_of_replicas": "1",
-        "number_of_shards": "1"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "index": ".monitoring-beats-6-2017.12.19",
-    "mappings": {
-      "dynamic": false,
-      "properties": {
-        "beats_state": {
+        "source_node": {
           "properties": {
-            "beat": {
-              "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "uuid": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "properties": {
-                "beat": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "host": {
-                  "properties": {
-                    "architecture": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "hostname": {
-                      "type": "keyword"
-                    },
-                    "os": {
-                      "properties": {
-                        "build": {
-                          "type": "keyword"
-                        },
-                        "family": {
-                          "type": "keyword"
-                        },
-                        "platform": {
-                          "type": "keyword"
-                        },
-                        "version": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "input": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "module": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "output": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "service": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "version": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
+            "name": {
+              "type": "keyword"
             },
+            "uuid": {
+              "type": "keyword"
+            }
+          }
+        },
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "format": "6",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "index": ".monitoring-beats-6-2017.12.19",
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "beats_state": {
+          "properties": {
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -1215,12 +606,6 @@
           "properties": {
             "beat": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
                 "type": {
                   "type": "keyword"
                 },
@@ -1234,108 +619,40 @@
             },
             "metrics": {
               "properties": {
-                "beat": {
+                "apm-server": {
                   "properties": {
-                    "cpu": {
+                    "processor": {
                       "properties": {
-                        "system": {
+                        "error": {
                           "properties": {
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
-                        "total": {
+                        "metric": {
                           "properties": {
-                            "value": {
-                              "type": "long"
-                            },
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
-                        "user": {
+                        "span": {
                           "properties": {
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
-                        }
-                      }
-                    },
-                    "info": {
-                      "properties": {
-                        "ephemeral_id": {
-                          "type": "keyword"
                         },
-                        "uptime": {
+                        "transaction": {
                           "properties": {
-                            "ms": {
+                            "transformations": {
                               "type": "long"
                             }
                           }
                         }
                       }
                     },
-                    "memstats": {
-                      "properties": {
-                        "gc_next": {
-                          "type": "long"
-                        },
-                        "memory_alloc": {
-                          "type": "long"
-                        },
-                        "memory_total": {
-                          "type": "long"
-                        },
-                        "rss": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "handles": {
-                      "properties": {
-                        "open": {
-                          "type": "long"
-                        },
-                        "limit": {
-                          "properties": {
-                            "hard": {
-                              "type": "long"
-                            },
-                            "soft": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "apm-server": {
-                  "properties": {
                     "server": {
                       "properties": {
                         "request": {
@@ -1345,17 +662,6 @@
                             }
                           }
                         },
-                        "concurrent": {
-                          "properties": {
-                            "wait": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "response": {
                           "properties": {
                             "count": {
@@ -1363,247 +669,50 @@
                             },
                             "errors": {
                               "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "toolarge": {
-                                  "type": "long"
-                                },
-                                "validate": {
-                                  "type": "long"
-                                },
-                                "ratelimit": {
-                                  "type": "long"
-                                },
-                                "queue": {
-                                  "type": "long"
-                                },
                                 "closed": {
                                   "type": "long"
                                 },
-                                "forbidden": {
-                                  "type": "long"
-                                },
                                 "concurrency": {
                                   "type": "long"
                                 },
-                                "unauthorized": {
-                                  "type": "long"
-                                },
-                                "internal": {
-                                  "type": "long"
-                                },
                                 "decode": {
                                   "type": "long"
                                 },
-                                "method": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "valid": {
-                              "properties": {
-                                "ok": {
-                                  "type": "long"
-                                },
-                                "accepted": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "decoder": {
-                      "properties": {
-                        "deflate": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "gzip": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "uncompressed": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reader": {
-                          "properties": {
-                            "size": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "missing-content-length": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "processor": {
-                      "properties": {
-                        "metric": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
+                                "forbidden": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "sourcemap": {
-                          "properties": {
-                            "counter": {
-                              "type": "long"
-                            },
-                            "decoding": {
-                              "properties": {
-                                "errors": {
+                                "internal": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
+                                "method": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "transaction": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
+                                "queue": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
+                                "ratelimit": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "toolarge": {
                                   "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            },
-                            "transactions": {
-                              "type": "long"
-                            },
-                            "spans": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "error": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
+                                },
+                                "unauthorized": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "validate": {
                                   "type": "long"
                                 }
                               }
                             },
-                            "validation": {
+                            "valid": {
                               "properties": {
-                                "errors": {
+                                "accepted": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "ok": {
                                   "type": "long"
                                 }
                               }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            },
-                            "errors": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "span": {
-                          "properties": {
-                            "transformations": {
-                              "type": "long"
                             }
                           }
                         }
@@ -1611,28 +720,53 @@
                     }
                   }
                 },
-                "libbeat": {
+                "beat": {
                   "properties": {
-                    "config": {
+                    "cpu": {
                       "properties": {
-                        "module": {
+                        "total": {
                           "properties": {
-                            "running": {
-                              "type": "long"
-                            },
-                            "starts": {
-                              "type": "long"
-                            },
-                            "stops": {
+                            "value": {
                               "type": "long"
                             }
                           }
-                        },
-                        "reloads": {
+                        }
+                      }
+                    },
+                    "handles": {
+                      "properties": {
+                        "open": {
                           "type": "long"
                         }
                       }
                     },
+                    "info": {
+                      "properties": {
+                        "ephemeral_id": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "memstats": {
+                      "properties": {
+                        "gc_next": {
+                          "type": "long"
+                        },
+                        "memory_alloc": {
+                          "type": "long"
+                        },
+                        "memory_total": {
+                          "type": "long"
+                        },
+                        "rss": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "libbeat": {
+                  "properties": {
                     "output": {
                       "properties": {
                         "events": {
@@ -1643,23 +777,14 @@
                             "active": {
                               "type": "long"
                             },
-                            "batches": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
-                            "duplicates": {
-                              "type": "long"
-                            },
                             "failed": {
                               "type": "long"
                             },
                             "total": {
                               "type": "long"
-                            },
-                            "toomany": {
-                              "type": "long"
                             }
                           }
                         },
@@ -1673,9 +798,6 @@
                             }
                           }
                         },
-                        "type": {
-                          "type": "keyword"
-                        },
                         "write": {
                           "properties": {
                             "bytes": {
@@ -1690,23 +812,14 @@
                     },
                     "pipeline": {
                       "properties": {
-                        "clients": {
-                          "type": "long"
-                        },
                         "events": {
                           "properties": {
-                            "active": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
                             "failed": {
                               "type": "long"
                             },
-                            "filtered": {
-                              "type": "long"
-                            },
                             "published": {
                               "type": "long"
                             },
@@ -1717,13 +830,6 @@
                               "type": "long"
                             }
                           }
-                        },
-                        "queue": {
-                          "properties": {
-                            "acked": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     }
@@ -1736,24 +842,11 @@
                         "1": {
                           "type": "double"
                         },
-                        "5": {
-                          "type": "double"
-                        },
                         "15": {
                           "type": "double"
                         },
-                        "norm": {
-                          "properties": {
-                            "1": {
-                              "type": "double"
-                            },
-                            "5": {
-                              "type": "double"
-                            },
-                            "15": {
-                              "type": "double"
-                            }
-                          }
+                        "5": {
+                          "type": "double"
                         }
                       }
                     }
@@ -1761,9 +854,6 @@
                 }
               }
             },
-            "tags": {
-              "type": "keyword"
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -1773,25 +863,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
@@ -1823,95 +904,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -1919,47 +926,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -1969,36 +957,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -2006,9 +967,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -2022,10 +980,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/ccr/mappings.json b/x-pack/test/functional/es_archives/monitoring/ccr/mappings.json
index c034852554a44d..4a941d9bd0d77f 100644
--- a/x-pack/test/functional/es_archives/monitoring/ccr/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/ccr/mappings.json
@@ -1,121 +1,54 @@
 {
   "type": "index",
   "value": {
-    "aliases": {},
+    "aliases": {
+    },
     "index": ".monitoring-es-6-2018.09.19",
     "mappings": {
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -130,29 +63,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -167,44 +83,9 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "refresh": {
                   "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -213,42 +94,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -257,36 +108,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -305,14 +139,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -321,24 +153,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -348,41 +171,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -391,68 +214,92 @@
             }
           }
         },
-        "cluster_stats": {
+        "indices_stats": {
           "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
+            "_all": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -473,15 +320,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -489,15 +327,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -516,116 +345,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -641,16 +451,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -662,12 +466,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -677,12 +475,6 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
@@ -692,71 +484,10 @@
                 }
               }
             },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
             "thread_pool": {
               "properties": {
                 "bulk": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -767,9 +498,6 @@
                 },
                 "get": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -780,22 +508,6 @@
                 },
                 "index": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -806,22 +518,6 @@
                 },
                 "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -844,246 +540,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/logs/data.json.gz b/x-pack/test/functional/es_archives/monitoring/logs/data.json.gz
index 7f48fca2ea8a82..851db319e9ecf3 100644
Binary files a/x-pack/test/functional/es_archives/monitoring/logs/data.json.gz and b/x-pack/test/functional/es_archives/monitoring/logs/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/monitoring/logs/mappings.json b/x-pack/test/functional/es_archives/monitoring/logs/mappings.json
index 6dbecb8d503fdc..b392c18e4e49b4 100644
--- a/x-pack/test/functional/es_archives/monitoring/logs/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/logs/mappings.json
@@ -8,93 +8,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -104,112 +25,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -224,16 +63,6 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
                     "index_time_in_millis": {
@@ -254,22 +83,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -277,66 +90,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -351,18 +108,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -390,17 +137,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -413,17 +151,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -491,13 +220,6 @@
               "properties": {
                 "primaries": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
                         "index_time_in_millis": {
@@ -507,33 +229,13 @@
                           "type": "long"
                         }
                       }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
                     }
                   }
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -555,58 +257,10 @@
             }
           }
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "job_stats": {
           "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -614,13 +268,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -628,15 +275,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -648,12 +289,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -661,18 +296,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -693,33 +318,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -769,13 +376,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -824,15 +424,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -842,9 +436,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -862,26 +453,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -889,14 +464,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -912,12 +481,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -930,22 +493,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -956,9 +503,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -969,22 +513,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -995,22 +523,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1039,12 +551,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -1052,22 +558,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
diff --git a/x-pack/test/functional/es_archives/monitoring/logs_multiple_clusters/mappings.json b/x-pack/test/functional/es_archives/monitoring/logs_multiple_clusters/mappings.json
index ccea50f7478009..2d6c2f885f8314 100644
--- a/x-pack/test/functional/es_archives/monitoring/logs_multiple_clusters/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/logs_multiple_clusters/mappings.json
@@ -8,96 +8,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "follower_aliases_version": {
-              "type": "long"
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -107,112 +25,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -227,16 +63,6 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
                     "index_time_in_millis": {
@@ -257,22 +83,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -280,66 +90,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -354,18 +108,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -393,17 +137,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -416,17 +151,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -494,13 +220,6 @@
               "properties": {
                 "primaries": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
                         "index_time_in_millis": {
@@ -510,33 +229,13 @@
                           "type": "long"
                         }
                       }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
                     }
                   }
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -558,58 +257,10 @@
             }
           }
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "job_stats": {
           "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -617,13 +268,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -631,15 +275,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -651,12 +289,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -664,18 +296,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -696,33 +318,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -772,13 +376,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -827,15 +424,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -845,9 +436,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -865,26 +453,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -892,14 +464,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -915,12 +481,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -933,22 +493,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -959,9 +503,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -972,22 +513,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -998,22 +523,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1042,12 +551,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -1055,22 +558,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
diff --git a/x-pack/test/functional/es_archives/monitoring/logstash-pipelines/mappings.json b/x-pack/test/functional/es_archives/monitoring/logstash-pipelines/mappings.json
index aa3aff8b5c41ab..98303a4b29d679 100644
--- a/x-pack/test/functional/es_archives/monitoring/logstash-pipelines/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/logstash-pipelines/mappings.json
@@ -8,83 +8,25 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
-        "logstash_stats": {
-          "type": "object",
+        "logstash_state": {
           "properties": {
-            "logstash": {
+            "pipeline": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "http_address": {
-                  "type": "keyword"
-                },
-                "version": {
+                "hash": {
                   "type": "keyword"
                 },
-                "snapshot": {
-                  "type": "boolean"
-                },
-                "status": {
+                "id": {
                   "type": "keyword"
-                },
-                "pipeline": {
-                  "properties": {
-                    "workers": {
-                      "type": "short"
-                    },
-                    "batch_size": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
-            },
+            }
+          }
+        },
+        "logstash_stats": {
+          "properties": {
             "events": {
               "properties": {
-                "filtered": {
+                "duration_in_millis": {
                   "type": "long"
                 },
                 "in": {
@@ -92,48 +34,11 @@
                 },
                 "out": {
                   "type": "long"
-                },
-                "duration_in_millis": {
-                  "type": "long"
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "jvm": {
               "properties": {
-                "uptime_in_millis": {
-                  "type": "long"
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
                 "mem": {
                   "properties": {
                     "heap_max_in_bytes": {
@@ -141,50 +46,30 @@
                     },
                     "heap_used_in_bytes": {
                       "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "long"
                     }
                   }
+                },
+                "uptime_in_millis": {
+                  "type": "long"
                 }
               }
             },
-            "os": {
+            "logstash": {
               "properties": {
-                "cpu": {
-                  "properties": {
-                    "load_average": {
-                      "properties": {
-                        "1m": {
-                          "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
-                        }
-                      }
-                    }
-                  }
+                "uuid": {
+                  "type": "keyword"
                 },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "os": {
+              "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -199,103 +84,70 @@
                           }
                         }
                       }
+                    },
+                    "cpuacct": {
+                      "properties": {
+                        "usage_nanos": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
-                }
-              }
-            },
-            "process": {
-              "properties": {
+                },
                 "cpu": {
                   "properties": {
-                    "percent": {
-                      "type": "long"
+                    "load_average": {
+                      "properties": {
+                        "15m": {
+                          "type": "half_float"
+                        },
+                        "1m": {
+                          "type": "half_float"
+                        },
+                        "5m": {
+                          "type": "half_float"
+                        }
+                      }
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
-                }
-              }
-            },
-            "reloads": {
-              "properties": {
-                "failures": {
-                  "type": "long"
-                },
-                "successes": {
-                  "type": "long"
-                }
-              }
-            },
-            "queue": {
-              "properties": {
-                "events_count": {
-                  "type": "long"
-                },
-                "type": {
-                  "type": "keyword"
                 }
               }
             },
             "pipelines": {
-              "type": "nested",
               "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "hash": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
                 "events": {
                   "properties": {
-                    "in": {
-                      "type": "long"
-                    },
-                    "filtered": {
-                      "type": "long"
-                    },
-                    "out": {
-                      "type": "long"
-                    },
                     "duration_in_millis": {
                       "type": "long"
                     },
-                    "queue_push_duration_in_millis": {
+                    "out": {
                       "type": "long"
                     }
                   }
                 },
+                "hash": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
                 "queue": {
                   "properties": {
-                    "events_count": {
-                      "type": "long"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    },
                     "max_queue_size_in_bytes": {
                       "type": "long"
                     },
                     "queue_size_in_bytes": {
                       "type": "long"
+                    },
+                    "type": {
+                      "type": "keyword"
                     }
                   }
                 },
                 "vertices": {
-                  "type": "nested",
                   "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "pipeline_ephemeral_id": {
-                      "type": "keyword"
+                    "duration_in_millis": {
+                      "type": "long"
                     },
                     "events_in": {
                       "type": "long"
@@ -303,111 +155,63 @@
                     "events_out": {
                       "type": "long"
                     },
-                    "duration_in_millis": {
-                      "type": "long"
-                    },
-                    "queue_push_duration_in_millis": {
-                      "type": "long"
+                    "id": {
+                      "type": "keyword"
                     },
-                    "long_counters": {
-                      "type": "nested",
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "long"
-                        }
-                      }
+                    "pipeline_ephemeral_id": {
+                      "type": "keyword"
                     },
-                    "double_gauges": {
-                      "type": "nested",
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      }
+                    "queue_push_duration_in_millis": {
+                      "type": "float"
                     }
-                  }
-                },
-                "reloads": {
+                  },
+                  "type": "nested"
+                }
+              },
+              "type": "nested"
+            },
+            "process": {
+              "properties": {
+                "cpu": {
                   "properties": {
-                    "failures": {
-                      "type": "long"
-                    },
-                    "successes": {
+                    "percent": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "workers": {
-              "type": "short"
+            "queue": {
+              "properties": {
+                "events_count": {
+                  "type": "long"
+                }
+              }
             },
-            "batch_size": {
-              "type": "integer"
+            "timestamp": {
+              "type": "date"
             }
           }
         },
-        "logstash_state": {
+        "metricset": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "http_address": {
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
-            },
-            "snapshot": {
-              "type": "boolean"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "pipeline": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "hash": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "workers": {
-                  "type": "short"
-                },
-                "batch_size": {
-                  "type": "integer"
-                },
-                "format": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
                   "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "representation": {
-                  "enabled": false
                 }
-              }
+              },
+              "type": "text"
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -431,115 +235,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -554,29 +290,64 @@
                     }
                   }
                 },
-                "fielddata": {
+                "indexing": {
                   "properties": {
-                    "memory_size_in_bytes": {
+                    "index_time_in_millis": {
+                      "type": "long"
+                    },
+                    "index_total": {
                       "type": "long"
                     },
-                    "evictions": {
+                    "throttle_time_in_millis": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "merges": {
+                  "properties": {
+                    "total_size_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
                 },
+                "segments": {
+                  "properties": {
+                    "count": {
+                      "type": "integer"
+                    }
+                  }
+                },
                 "store": {
                   "properties": {
                     "size_in_bytes": {
                       "type": "long"
                     }
                   }
+                }
+              }
+            },
+            "total": {
+              "properties": {
+                "fielddata": {
+                  "properties": {
+                    "memory_size_in_bytes": {
+                      "type": "long"
+                    }
+                  }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -595,14 +366,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -611,24 +380,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -638,176 +398,85 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
-            },
-            "total": {
+            }
+          }
+        },
+        "indices_stats": {
+          "properties": {
+            "_all": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "fielddata": {
+                "primaries": {
                   "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "indexing": {
-                  "properties": {
-                    "index_total": {
-                      "type": "long"
-                    },
-                    "index_time_in_millis": {
-                      "type": "long"
-                    },
-                    "throttle_time_in_millis": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "merges": {
-                  "properties": {
-                    "total_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
-                      "type": "long"
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
-                "segments": {
+                "total": {
                   "properties": {
-                    "count": {
-                      "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
                     },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "refresh": {
-                  "properties": {
-                    "total_time_in_millis": {
-                      "type": "long"
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 }
@@ -815,68 +484,49 @@
             }
           }
         },
-        "cluster_stats": {
-          "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
-            }
-          }
-        },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -897,15 +547,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -913,15 +554,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -940,116 +572,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1065,16 +678,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -1086,12 +693,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -1101,12 +702,6 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
@@ -1116,71 +711,10 @@
                 }
               }
             },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
             "thread_pool": {
               "properties": {
                 "bulk": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1191,9 +725,6 @@
                 },
                 "get": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1204,22 +735,6 @@
                 },
                 "index": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1230,22 +745,6 @@
                 },
                 "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1268,246 +767,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/logstash/changing_pipelines/mappings.json b/x-pack/test/functional/es_archives/monitoring/logstash/changing_pipelines/mappings.json
index 28c3c0e1b9e87b..3c7511f426e2c1 100644
--- a/x-pack/test/functional/es_archives/monitoring/logstash/changing_pipelines/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/logstash/changing_pipelines/mappings.json
@@ -71,96 +71,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "follower_aliases_version": {
-              "type": "long"
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -170,112 +88,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -290,16 +126,6 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
                     "index_time_in_millis": {
@@ -320,22 +146,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -343,66 +153,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -417,18 +171,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -456,17 +200,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -479,17 +214,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -557,13 +283,6 @@
               "properties": {
                 "primaries": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
                         "index_time_in_millis": {
@@ -573,33 +292,13 @@
                           "type": "long"
                         }
                       }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
                     }
                   }
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -621,58 +320,10 @@
             }
           }
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "job_stats": {
           "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -680,13 +331,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -694,15 +338,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -714,12 +352,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -727,18 +359,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -759,33 +381,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -835,13 +439,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -890,15 +487,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -908,9 +499,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -928,26 +516,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -955,14 +527,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -978,12 +544,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -996,22 +556,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1022,9 +566,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1035,22 +576,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1061,22 +586,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1105,12 +614,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -1118,22 +621,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
@@ -1175,79 +665,27 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "logstash_state": {
           "properties": {
-            "ephemeral_id": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "http_address": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
             "pipeline": {
               "properties": {
-                "batch_size": {
-                  "type": "integer"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "format": {
-                  "type": "keyword"
-                },
                 "hash": {
                   "type": "keyword"
                 },
                 "id": {
                   "type": "keyword"
-                },
-                "representation": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "workers": {
-                  "type": "short"
                 }
               }
-            },
-            "snapshot": {
-              "type": "boolean"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
             }
           }
         },
         "logstash_stats": {
           "properties": {
-            "batch_size": {
-              "type": "integer"
-            },
             "events": {
               "properties": {
                 "duration_in_millis": {
                   "type": "long"
                 },
-                "filtered": {
-                  "type": "long"
-                },
                 "in": {
                   "type": "long"
                 },
@@ -1258,34 +696,6 @@
             },
             "jvm": {
               "properties": {
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
                 "mem": {
                   "properties": {
                     "heap_max_in_bytes": {
@@ -1293,9 +703,6 @@
                     },
                     "heap_used_in_bytes": {
                       "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1306,34 +713,6 @@
             },
             "logstash": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "http_address": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "pipeline": {
-                  "properties": {
-                    "batch_size": {
-                      "type": "long"
-                    },
-                    "workers": {
-                      "type": "short"
-                    }
-                  }
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -1348,9 +727,6 @@
                   "properties": {
                     "cpu": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1368,9 +744,6 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
@@ -1399,25 +772,13 @@
             },
             "pipelines": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
                 "events": {
                   "properties": {
                     "duration_in_millis": {
                       "type": "long"
                     },
-                    "filtered": {
-                      "type": "long"
-                    },
-                    "in": {
-                      "type": "long"
-                    },
                     "out": {
                       "type": "long"
-                    },
-                    "queue_push_duration_in_millis": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1429,9 +790,6 @@
                 },
                 "queue": {
                   "properties": {
-                    "events_count": {
-                      "type": "long"
-                    },
                     "max_queue_size_in_bytes": {
                       "type": "long"
                     },
@@ -1443,29 +801,8 @@
                     }
                   }
                 },
-                "reloads": {
-                  "properties": {
-                    "failures": {
-                      "type": "long"
-                    },
-                    "successes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "vertices": {
                   "properties": {
-                    "double_gauges": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "duration_in_millis": {
                       "type": "long"
                     },
@@ -1478,22 +815,11 @@
                     "id": {
                       "type": "keyword"
                     },
-                    "long_counters": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "long"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "pipeline_ephemeral_id": {
                       "type": "keyword"
                     },
                     "queue_push_duration_in_millis": {
-                      "type": "long"
+                      "type": "float"
                     }
                   },
                   "type": "nested"
@@ -1509,12 +835,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -1522,50 +842,24 @@
               "properties": {
                 "events_count": {
                   "type": "long"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "reloads": {
-              "properties": {
-                "failures": {
-                  "type": "long"
-                },
-                "successes": {
-                  "type": "long"
                 }
               }
             },
             "timestamp": {
               "type": "date"
-            },
-            "workers": {
-              "type": "short"
             }
           }
         },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
diff --git a/x-pack/test/functional/es_archives/monitoring/logstash_pipelines_multicluster/mappings.json b/x-pack/test/functional/es_archives/monitoring/logstash_pipelines_multicluster/mappings.json
index f2a7cca4efd8b0..de13ddf620d776 100644
--- a/x-pack/test/functional/es_archives/monitoring/logstash_pipelines_multicluster/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/logstash_pipelines_multicluster/mappings.json
@@ -71,96 +71,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "follower_aliases_version": {
-              "type": "long"
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -170,112 +88,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -290,16 +126,6 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
                     "index_time_in_millis": {
@@ -320,22 +146,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -343,66 +153,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -417,18 +171,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -456,17 +200,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -479,17 +214,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -557,13 +283,6 @@
               "properties": {
                 "primaries": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
                         "index_time_in_millis": {
@@ -573,33 +292,13 @@
                           "type": "long"
                         }
                       }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
                     }
                   }
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -621,58 +320,10 @@
             }
           }
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "job_stats": {
           "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -680,13 +331,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -694,15 +338,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -714,12 +352,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -727,18 +359,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -759,33 +381,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -835,13 +439,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -890,15 +487,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -908,9 +499,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -928,26 +516,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -955,14 +527,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -978,12 +544,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -996,22 +556,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1022,9 +566,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1035,22 +576,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1061,22 +586,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1105,12 +614,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -1118,22 +621,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
@@ -1175,79 +665,27 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "logstash_state": {
           "properties": {
-            "ephemeral_id": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "http_address": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
             "pipeline": {
               "properties": {
-                "batch_size": {
-                  "type": "integer"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "format": {
-                  "type": "keyword"
-                },
                 "hash": {
                   "type": "keyword"
                 },
                 "id": {
                   "type": "keyword"
-                },
-                "representation": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "workers": {
-                  "type": "short"
                 }
               }
-            },
-            "snapshot": {
-              "type": "boolean"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
             }
           }
         },
         "logstash_stats": {
           "properties": {
-            "batch_size": {
-              "type": "integer"
-            },
             "events": {
               "properties": {
                 "duration_in_millis": {
                   "type": "long"
                 },
-                "filtered": {
-                  "type": "long"
-                },
                 "in": {
                   "type": "long"
                 },
@@ -1258,34 +696,6 @@
             },
             "jvm": {
               "properties": {
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
                 "mem": {
                   "properties": {
                     "heap_max_in_bytes": {
@@ -1293,9 +703,6 @@
                     },
                     "heap_used_in_bytes": {
                       "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1306,34 +713,6 @@
             },
             "logstash": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "http_address": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "pipeline": {
-                  "properties": {
-                    "batch_size": {
-                      "type": "long"
-                    },
-                    "workers": {
-                      "type": "short"
-                    }
-                  }
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -1348,9 +727,6 @@
                   "properties": {
                     "cpu": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1368,9 +744,6 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
@@ -1399,25 +772,13 @@
             },
             "pipelines": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
                 "events": {
                   "properties": {
                     "duration_in_millis": {
                       "type": "long"
                     },
-                    "filtered": {
-                      "type": "long"
-                    },
-                    "in": {
-                      "type": "long"
-                    },
                     "out": {
                       "type": "long"
-                    },
-                    "queue_push_duration_in_millis": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1429,9 +790,6 @@
                 },
                 "queue": {
                   "properties": {
-                    "events_count": {
-                      "type": "long"
-                    },
                     "max_queue_size_in_bytes": {
                       "type": "long"
                     },
@@ -1443,29 +801,8 @@
                     }
                   }
                 },
-                "reloads": {
-                  "properties": {
-                    "failures": {
-                      "type": "long"
-                    },
-                    "successes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "vertices": {
                   "properties": {
-                    "double_gauges": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "duration_in_millis": {
                       "type": "long"
                     },
@@ -1478,22 +815,11 @@
                     "id": {
                       "type": "keyword"
                     },
-                    "long_counters": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "long"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "pipeline_ephemeral_id": {
                       "type": "keyword"
                     },
                     "queue_push_duration_in_millis": {
-                      "type": "long"
+                      "type": "float"
                     }
                   },
                   "type": "nested"
@@ -1509,12 +835,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -1522,50 +842,24 @@
               "properties": {
                 "events_count": {
                   "type": "long"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "reloads": {
-              "properties": {
-                "failures": {
-                  "type": "long"
-                },
-                "successes": {
-                  "type": "long"
                 }
               }
             },
             "timestamp": {
               "type": "date"
-            },
-            "workers": {
-              "type": "short"
             }
           }
         },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
diff --git a/x-pack/test/functional/es_archives/monitoring/multi-basic/mappings.json b/x-pack/test/functional/es_archives/monitoring/multi-basic/mappings.json
index 75bb2602f1a15a..76717c0a61bbae 100644
--- a/x-pack/test/functional/es_archives/monitoring/multi-basic/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/multi-basic/mappings.json
@@ -5,24 +5,9 @@
     "mappings": {
       "dynamic": false,
       "properties": {
-        "timestamp": {
-          "type": "date"
-        },
-        "update_timestamp": {
-          "type": "date"
-        },
-        "resolved_timestamp": {
-          "type": "date"
-        },
-        "prefix": {
-          "type": "text"
-        },
         "message": {
           "type": "text"
         },
-        "suffix": {
-          "type": "text"
-        },
         "metadata": {
           "properties": {
             "cluster_uuid": {
@@ -44,6 +29,21 @@
               "type": "keyword"
             }
           }
+        },
+        "prefix": {
+          "type": "text"
+        },
+        "resolved_timestamp": {
+          "type": "date"
+        },
+        "suffix": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "update_timestamp": {
+          "type": "date"
         }
       }
     },
@@ -68,95 +68,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -164,47 +90,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -214,36 +121,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -251,9 +131,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -267,10 +144,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -293,136 +184,92 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
+            "nodes_hash": {
+              "type": "integer"
+            }
+          }
+        },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
+        "index_stats": {
+          "properties": {
+            "index": {
+              "type": "keyword"
+            },
+            "primaries": {
               "properties": {
-                "primaries": {
+                "docs": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
+                    "count": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "indexing": {
+                  "properties": {
+                    "index_time_in_millis": {
+                      "type": "long"
                     },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
+                    "index_total": {
+                      "type": "long"
                     },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
+                    "throttle_time_in_millis": {
+                      "type": "long"
                     }
                   }
                 },
-                "total": {
+                "merges": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
+                    "total_size_in_bytes": {
+                      "type": "long"
                     }
                   }
-                }
-              }
-            }
-          }
-        },
-        "index_stats": {
-          "properties": {
-            "index": {
-              "type": "keyword"
-            },
-            "primaries": {
-              "properties": {
-                "docs": {
+                },
+                "refresh": {
                   "properties": {
-                    "count": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
                 },
-                "fielddata": {
+                "segments": {
                   "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
+                    "count": {
+                      "type": "integer"
                     }
                   }
                 },
@@ -432,13 +279,24 @@
                       "type": "long"
                     }
                   }
+                }
+              }
+            },
+            "total": {
+              "properties": {
+                "fielddata": {
+                  "properties": {
+                    "memory_size_in_bytes": {
+                      "type": "long"
+                    }
+                  }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -457,14 +315,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -473,24 +329,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -500,79 +347,144 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
-            },
-            "total": {
+            }
+          }
+        },
+        "indices_stats": {
+          "properties": {
+            "_all": {
               "properties": {
-                "docs": {
+                "primaries": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
-                "fielddata": {
+                "total": {
                   "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
                     },
-                    "evictions": {
-                      "type": "long"
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "job_stats": {
+          "properties": {
+            "job_id": {
+              "type": "keyword"
+            }
+          }
+        },
+        "node_stats": {
+          "properties": {
+            "fs": {
+              "properties": {
+                "io_stats": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
-                "store": {
+                "total": {
                   "properties": {
-                    "size_in_bytes": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
+                "fielddata": {
+                  "properties": {
+                    "memory_size_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -580,26 +492,10 @@
                     }
                   }
                 },
-                "merges": {
-                  "properties": {
-                    "total_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "query_cache": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -607,24 +503,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -634,284 +521,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "refresh": {
-                  "properties": {
-                    "total_time_in_millis": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "nodes": {
-              "type": "object"
             },
-            "indices": {
-              "type": "object"
-            }
-          }
-        },
-        "cluster_state": {
-          "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
-            }
-          }
-        },
-        "node_stats": {
-          "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "jvm": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "indexing": {
-                  "properties": {
-                    "index_time_in_millis": {
-                      "type": "long"
-                    },
-                    "index_total": {
-                      "type": "long"
-                    },
-                    "throttle_time_in_millis": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "gc": {
                   "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
+                    "collectors": {
+                      "properties": {
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
                     }
                   }
                 },
-                "segments": {
+                "mem": {
                   "properties": {
-                    "count": {
-                      "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
+                    "heap_max_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "heap_used_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
+                    "heap_used_percent": {
+                      "type": "half_float"
                     }
                   }
                 }
               }
             },
-            "fs": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
-                        "write_kilobytes": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "node_id": {
+              "type": "keyword"
             },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -927,16 +627,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -948,127 +642,28 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "cpu": {
-                  "properties": {
-                    "percent": {
-                      "type": "half_float"
-                    }
-                  }
-                }
-              }
-            },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     }
-                  }
-                }
-              }
-            },
-            "thread_pool": {
-              "properties": {
-                "bulk": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "get": {
+                  }
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
+                    "percent": {
+                      "type": "half_float"
                     }
                   }
-                },
-                "index": {
+                }
+              }
+            },
+            "thread_pool": {
+              "properties": {
+                "bulk": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1077,11 +672,8 @@
                     }
                   }
                 },
-                "management": {
+                "get": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1090,11 +682,8 @@
                     }
                   }
                 },
-                "search": {
+                "index": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1103,11 +692,8 @@
                     }
                   }
                 },
-                "watcher": {
+                "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1130,246 +716,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -1394,83 +775,25 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
-        "logstash_stats": {
-          "type": "object",
+        "logstash_state": {
           "properties": {
-            "logstash": {
+            "pipeline": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "http_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
-                "status": {
+                "hash": {
+                  "type": "keyword"
+                },
+                "id": {
                   "type": "keyword"
-                },
-                "pipeline": {
-                  "properties": {
-                    "workers": {
-                      "type": "short"
-                    },
-                    "batch_size": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
-            },
+            }
+          }
+        },
+        "logstash_stats": {
+          "properties": {
             "events": {
               "properties": {
-                "filtered": {
+                "duration_in_millis": {
                   "type": "long"
                 },
                 "in": {
@@ -1478,48 +801,11 @@
                 },
                 "out": {
                   "type": "long"
-                },
-                "duration_in_millis": {
-                  "type": "long"
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "jvm": {
               "properties": {
-                "uptime_in_millis": {
-                  "type": "long"
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
                 "mem": {
                   "properties": {
                     "heap_max_in_bytes": {
@@ -1527,50 +813,30 @@
                     },
                     "heap_used_in_bytes": {
                       "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "long"
                     }
                   }
+                },
+                "uptime_in_millis": {
+                  "type": "long"
                 }
               }
             },
-            "os": {
+            "logstash": {
               "properties": {
-                "cpu": {
-                  "properties": {
-                    "load_average": {
-                      "properties": {
-                        "1m": {
-                          "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
-                        }
-                      }
-                    }
-                  }
+                "uuid": {
+                  "type": "keyword"
                 },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "os": {
+              "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1585,103 +851,70 @@
                           }
                         }
                       }
+                    },
+                    "cpuacct": {
+                      "properties": {
+                        "usage_nanos": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
-                }
-              }
-            },
-            "process": {
-              "properties": {
+                },
                 "cpu": {
                   "properties": {
-                    "percent": {
-                      "type": "long"
+                    "load_average": {
+                      "properties": {
+                        "15m": {
+                          "type": "half_float"
+                        },
+                        "1m": {
+                          "type": "half_float"
+                        },
+                        "5m": {
+                          "type": "half_float"
+                        }
+                      }
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
-                }
-              }
-            },
-            "reloads": {
-              "properties": {
-                "failures": {
-                  "type": "long"
-                },
-                "successes": {
-                  "type": "long"
-                }
-              }
-            },
-            "queue": {
-              "properties": {
-                "events_count": {
-                  "type": "long"
-                },
-                "type": {
-                  "type": "keyword"
                 }
               }
             },
             "pipelines": {
-              "type": "nested",
               "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "hash": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
                 "events": {
                   "properties": {
-                    "in": {
-                      "type": "long"
-                    },
-                    "filtered": {
-                      "type": "long"
-                    },
-                    "out": {
-                      "type": "long"
-                    },
                     "duration_in_millis": {
                       "type": "long"
                     },
-                    "queue_push_duration_in_millis": {
+                    "out": {
                       "type": "long"
                     }
                   }
                 },
+                "hash": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
                 "queue": {
                   "properties": {
-                    "events_count": {
-                      "type": "long"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    },
                     "max_queue_size_in_bytes": {
                       "type": "long"
                     },
                     "queue_size_in_bytes": {
                       "type": "long"
+                    },
+                    "type": {
+                      "type": "keyword"
                     }
                   }
                 },
                 "vertices": {
-                  "type": "nested",
                   "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "pipeline_ephemeral_id": {
-                      "type": "keyword"
+                    "duration_in_millis": {
+                      "type": "long"
                     },
                     "events_in": {
                       "type": "long"
@@ -1689,111 +922,63 @@
                     "events_out": {
                       "type": "long"
                     },
-                    "duration_in_millis": {
-                      "type": "long"
-                    },
-                    "queue_push_duration_in_millis": {
-                      "type": "long"
+                    "id": {
+                      "type": "keyword"
                     },
-                    "long_counters": {
-                      "type": "nested",
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "long"
-                        }
-                      }
+                    "pipeline_ephemeral_id": {
+                      "type": "keyword"
                     },
-                    "double_gauges": {
-                      "type": "nested",
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      }
+                    "queue_push_duration_in_millis": {
+                      "type": "float"
                     }
-                  }
-                },
-                "reloads": {
+                  },
+                  "type": "nested"
+                }
+              },
+              "type": "nested"
+            },
+            "process": {
+              "properties": {
+                "cpu": {
                   "properties": {
-                    "failures": {
-                      "type": "long"
-                    },
-                    "successes": {
+                    "percent": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "workers": {
-              "type": "short"
+            "queue": {
+              "properties": {
+                "events_count": {
+                  "type": "long"
+                }
+              }
             },
-            "batch_size": {
-              "type": "integer"
+            "timestamp": {
+              "type": "date"
             }
           }
         },
-        "logstash_state": {
+        "metricset": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "http_address": {
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
-            },
-            "snapshot": {
-              "type": "boolean"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "pipeline": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "hash": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "workers": {
-                  "type": "short"
-                },
-                "batch_size": {
-                  "type": "integer"
-                },
-                "format": {
-                  "type": "keyword"
-                },
-                "version": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
                   "type": "keyword"
-                },
-                "representation": {
-                  "enabled": false
                 }
-              }
+              },
+              "type": "text"
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/multicluster/mappings.json b/x-pack/test/functional/es_archives/monitoring/multicluster/mappings.json
index 7ba6fd939afa82..7e7084698b7889 100644
--- a/x-pack/test/functional/es_archives/monitoring/multicluster/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/multicluster/mappings.json
@@ -1,121 +1,54 @@
 {
   "type": "index",
   "value": {
-    "aliases": {},
+    "aliases": {
+    },
     "index": ".monitoring-es-6-2017.08.15",
     "mappings": {
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -130,29 +63,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -167,44 +83,9 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "refresh": {
                   "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -213,42 +94,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -257,36 +108,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -305,14 +139,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -321,24 +153,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -348,41 +171,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -391,68 +214,92 @@
             }
           }
         },
-        "cluster_stats": {
+        "indices_stats": {
           "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
+            "_all": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -473,15 +320,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -489,15 +327,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -516,116 +345,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -641,16 +451,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -662,12 +466,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -677,12 +475,6 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
@@ -692,136 +484,40 @@
                 }
               }
             },
-            "jvm": {
+            "thread_pool": {
               "properties": {
-                "mem": {
+                "bulk": {
                   "properties": {
-                    "heap_used_in_bytes": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
                       "type": "long"
+                    }
+                  }
+                },
+                "get": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
                     },
-                    "heap_used_percent": {
-                      "type": "half_float"
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "index": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
                     },
-                    "heap_max_in_bytes": {
+                    "rejected": {
                       "type": "long"
                     }
                   }
                 },
-                "gc": {
+                "search": {
                   "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "thread_pool": {
-              "properties": {
-                "bulk": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "get": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "index": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -844,246 +540,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -1102,7 +593,8 @@
 {
   "type": "index",
   "value": {
-    "aliases": {},
+    "aliases": {
+    },
     "index": ".monitoring-logstash-6-2017.08.15",
     "mappings": {
       "dynamic": false,
@@ -1110,83 +602,25 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
-        "logstash_stats": {
-          "type": "object",
+        "logstash_state": {
           "properties": {
-            "logstash": {
+            "pipeline": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "http_address": {
-                  "type": "keyword"
-                },
-                "version": {
+                "hash": {
                   "type": "keyword"
                 },
-                "snapshot": {
-                  "type": "boolean"
-                },
-                "status": {
+                "id": {
                   "type": "keyword"
-                },
-                "pipeline": {
-                  "properties": {
-                    "workers": {
-                      "type": "short"
-                    },
-                    "batch_size": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
-            },
+            }
+          }
+        },
+        "logstash_stats": {
+          "properties": {
             "events": {
               "properties": {
-                "filtered": {
+                "duration_in_millis": {
                   "type": "long"
                 },
                 "in": {
@@ -1194,48 +628,11 @@
                 },
                 "out": {
                   "type": "long"
-                },
-                "duration_in_millis": {
-                  "type": "long"
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "jvm": {
               "properties": {
-                "uptime_in_millis": {
-                  "type": "long"
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
                 "mem": {
                   "properties": {
                     "heap_max_in_bytes": {
@@ -1243,50 +640,30 @@
                     },
                     "heap_used_in_bytes": {
                       "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "long"
                     }
                   }
+                },
+                "uptime_in_millis": {
+                  "type": "long"
                 }
               }
             },
-            "os": {
+            "logstash": {
               "properties": {
-                "cpu": {
-                  "properties": {
-                    "load_average": {
-                      "properties": {
-                        "1m": {
-                          "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
-                        }
-                      }
-                    }
-                  }
+                "uuid": {
+                  "type": "keyword"
                 },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "os": {
+              "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1301,103 +678,70 @@
                           }
                         }
                       }
+                    },
+                    "cpuacct": {
+                      "properties": {
+                        "usage_nanos": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
-                }
-              }
-            },
-            "process": {
-              "properties": {
+                },
                 "cpu": {
                   "properties": {
-                    "percent": {
-                      "type": "long"
+                    "load_average": {
+                      "properties": {
+                        "15m": {
+                          "type": "half_float"
+                        },
+                        "1m": {
+                          "type": "half_float"
+                        },
+                        "5m": {
+                          "type": "half_float"
+                        }
+                      }
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
-                }
-              }
-            },
-            "reloads": {
-              "properties": {
-                "failures": {
-                  "type": "long"
-                },
-                "successes": {
-                  "type": "long"
-                }
-              }
-            },
-            "queue": {
-              "properties": {
-                "events_count": {
-                  "type": "long"
-                },
-                "type": {
-                  "type": "keyword"
                 }
               }
             },
             "pipelines": {
-              "type": "nested",
               "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "hash": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
                 "events": {
                   "properties": {
-                    "in": {
-                      "type": "long"
-                    },
-                    "filtered": {
-                      "type": "long"
-                    },
-                    "out": {
-                      "type": "long"
-                    },
                     "duration_in_millis": {
                       "type": "long"
                     },
-                    "queue_push_duration_in_millis": {
+                    "out": {
                       "type": "long"
                     }
                   }
                 },
+                "hash": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
                 "queue": {
                   "properties": {
-                    "events_count": {
-                      "type": "long"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    },
                     "max_queue_size_in_bytes": {
                       "type": "long"
                     },
                     "queue_size_in_bytes": {
                       "type": "long"
+                    },
+                    "type": {
+                      "type": "keyword"
                     }
                   }
                 },
                 "vertices": {
-                  "type": "nested",
                   "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "pipeline_ephemeral_id": {
-                      "type": "keyword"
+                    "duration_in_millis": {
+                      "type": "long"
                     },
                     "events_in": {
                       "type": "long"
@@ -1405,111 +749,63 @@
                     "events_out": {
                       "type": "long"
                     },
-                    "duration_in_millis": {
-                      "type": "long"
-                    },
-                    "queue_push_duration_in_millis": {
-                      "type": "long"
+                    "id": {
+                      "type": "keyword"
                     },
-                    "long_counters": {
-                      "type": "nested",
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "long"
-                        }
-                      }
+                    "pipeline_ephemeral_id": {
+                      "type": "keyword"
                     },
-                    "double_gauges": {
-                      "type": "nested",
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      }
+                    "queue_push_duration_in_millis": {
+                      "type": "float"
                     }
-                  }
-                },
-                "reloads": {
+                  },
+                  "type": "nested"
+                }
+              },
+              "type": "nested"
+            },
+            "process": {
+              "properties": {
+                "cpu": {
                   "properties": {
-                    "failures": {
-                      "type": "long"
-                    },
-                    "successes": {
+                    "percent": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "workers": {
-              "type": "short"
+            "queue": {
+              "properties": {
+                "events_count": {
+                  "type": "long"
+                }
+              }
             },
-            "batch_size": {
-              "type": "integer"
+            "timestamp": {
+              "type": "date"
             }
           }
         },
-        "logstash_state": {
+        "metricset": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "http_address": {
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
-            },
-            "snapshot": {
-              "type": "boolean"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "pipeline": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "hash": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "workers": {
-                  "type": "short"
-                },
-                "batch_size": {
-                  "type": "integer"
-                },
-                "format": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
                   "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "representation": {
-                  "enabled": false
                 }
-              }
+              },
+              "type": "text"
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -1528,7 +824,8 @@
 {
   "type": "index",
   "value": {
-    "aliases": {},
+    "aliases": {
+    },
     "index": ".monitoring-kibana-6-2017.08.15",
     "mappings": {
       "dynamic": false,
@@ -1536,102 +833,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
-            "usage": {
-              "properties": {
-                "index": {
-                  "type": "keyword"
-                }
-              }
+            "concurrent_connections": {
+              "type": "long"
             },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -1639,47 +855,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -1689,36 +886,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -1726,9 +896,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -1742,10 +909,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -1764,29 +945,15 @@
 {
   "type": "index",
   "value": {
-    "aliases": {},
+    "aliases": {
+    },
     "index": ".monitoring-alerts-6",
     "mappings": {
       "dynamic": false,
       "properties": {
-        "timestamp": {
-          "type": "date"
-        },
-        "update_timestamp": {
-          "type": "date"
-        },
-        "resolved_timestamp": {
-          "type": "date"
-        },
-        "prefix": {
-          "type": "text"
-        },
         "message": {
           "type": "text"
         },
-        "suffix": {
-          "type": "text"
-        },
         "metadata": {
           "properties": {
             "cluster_uuid": {
@@ -1808,6 +975,21 @@
               "type": "keyword"
             }
           }
+        },
+        "prefix": {
+          "type": "text"
+        },
+        "resolved_timestamp": {
+          "type": "date"
+        },
+        "suffix": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "update_timestamp": {
+          "type": "date"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/setup/collection/detect_beats/data.json.gz b/x-pack/test/functional/es_archives/monitoring/setup/collection/detect_beats/data.json.gz
index 0548d40cd4f82d..e4cffebf210adb 100644
Binary files a/x-pack/test/functional/es_archives/monitoring/setup/collection/detect_beats/data.json.gz and b/x-pack/test/functional/es_archives/monitoring/setup/collection/detect_beats/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/monitoring/setup/collection/detect_beats/mappings.json b/x-pack/test/functional/es_archives/monitoring/setup/collection/detect_beats/mappings.json
index 2567ef3949ef98..c8c423463e4771 100644
--- a/x-pack/test/functional/es_archives/monitoring/setup/collection/detect_beats/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/setup/collection/detect_beats/mappings.json
@@ -8,93 +8,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -104,112 +25,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -224,16 +63,6 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
                     "index_time_in_millis": {
@@ -254,22 +83,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -277,66 +90,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -351,18 +108,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -390,17 +137,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -413,17 +151,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -491,13 +220,6 @@
               "properties": {
                 "primaries": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
                         "index_time_in_millis": {
@@ -507,33 +229,13 @@
                           "type": "long"
                         }
                       }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
                     }
                   }
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -555,58 +257,10 @@
             }
           }
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "job_stats": {
           "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -614,13 +268,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -628,15 +275,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -648,12 +289,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -661,18 +296,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -693,33 +318,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -769,13 +376,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -824,15 +424,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -842,9 +436,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -862,26 +453,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -889,14 +464,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -912,12 +481,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -930,22 +493,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -956,9 +503,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -969,22 +513,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -995,22 +523,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1039,12 +551,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -1052,22 +558,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
@@ -1107,93 +600,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -1203,112 +617,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -1323,16 +655,6 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
                     "index_time_in_millis": {
@@ -1353,22 +675,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -1376,66 +682,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1450,18 +700,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -1489,17 +729,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1512,17 +743,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1590,13 +812,6 @@
               "properties": {
                 "primaries": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
                         "index_time_in_millis": {
@@ -1606,33 +821,13 @@
                           "type": "long"
                         }
                       }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
                     }
                   }
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -1643,69 +838,21 @@
                         "query_time_in_millis": {
                           "type": "long"
                         },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "job_stats": {
-          "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
                 }
               }
-            },
+            }
+          }
+        },
+        "job_stats": {
+          "properties": {
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -1713,13 +860,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -1727,15 +867,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -1747,12 +881,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -1760,18 +888,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -1792,33 +910,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1868,13 +968,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -1923,15 +1016,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -1941,9 +1028,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1961,26 +1045,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -1988,14 +1056,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -2011,12 +1073,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -2029,22 +1085,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -2055,9 +1095,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -2068,22 +1105,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -2094,22 +1115,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -2138,12 +1143,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -2151,22 +1150,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
@@ -2208,63 +1194,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "kibana_stats": {
           "properties": {
-            "cloud": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "region": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "zone": {
-                  "type": "keyword"
-                }
-              }
-            },
             "concurrent_connections": {
               "type": "long"
             },
             "kibana": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -2287,22 +1226,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -2317,12 +1240,6 @@
                       "properties": {
                         "size_limit": {
                           "type": "float"
-                        },
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
                         }
                       }
                     },
@@ -2330,9 +1247,6 @@
                       "type": "float"
                     }
                   }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -2341,9 +1255,6 @@
                 "disconnects": {
                   "type": "long"
                 },
-                "status_codes": {
-                  "type": "object"
-                },
                 "total": {
                   "type": "long"
                 }
@@ -2359,49 +1270,15 @@
                 }
               }
             },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "timestamp": {
-              "type": "date"
-            }
-          }
-        },
-        "source_node": {
-          "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
             "timestamp": {
-              "format": "date_time",
               "type": "date"
             },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
         },
@@ -15291,4 +14168,4 @@
       }
     }
   }
-}
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/monitoring/setup/collection/es_and_kibana_exclusive_mb/mappings.json b/x-pack/test/functional/es_archives/monitoring/setup/collection/es_and_kibana_exclusive_mb/mappings.json
index ea61a4b7f325f4..211e253ef83d41 100644
--- a/x-pack/test/functional/es_archives/monitoring/setup/collection/es_and_kibana_exclusive_mb/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/setup/collection/es_and_kibana_exclusive_mb/mappings.json
@@ -9,105 +9,6 @@
       "properties": {
         "beats_state": {
           "properties": {
-            "beat": {
-              "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "uuid": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "properties": {
-                "beat": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "host": {
-                  "properties": {
-                    "architecture": {
-                      "type": "keyword"
-                    },
-                    "hostname": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "os": {
-                      "properties": {
-                        "build": {
-                          "type": "keyword"
-                        },
-                        "family": {
-                          "type": "keyword"
-                        },
-                        "platform": {
-                          "type": "keyword"
-                        },
-                        "version": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "input": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "module": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "output": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "service": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "version": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -118,12 +19,6 @@
           "properties": {
             "beat": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
                 "type": {
                   "type": "keyword"
                 },
@@ -139,146 +34,19 @@
               "properties": {
                 "apm-server": {
                   "properties": {
-                    "decoder": {
-                      "properties": {
-                        "deflate": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "gzip": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "missing-content-length": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reader": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            },
-                            "size": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "uncompressed": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    },
                     "processor": {
                       "properties": {
                         "error": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "errors": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
                         "metric": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "sourcemap": {
-                          "properties": {
-                            "counter": {
-                              "type": "long"
-                            },
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
@@ -291,40 +59,8 @@
                         },
                         "transaction": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "frames": {
-                              "type": "long"
-                            },
-                            "spans": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "transactions": {
-                              "type": "long"
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         }
@@ -332,17 +68,6 @@
                     },
                     "server": {
                       "properties": {
-                        "concurrent": {
-                          "properties": {
-                            "wait": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "request": {
                           "properties": {
                             "count": {
@@ -363,9 +88,6 @@
                                 "concurrency": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                },
                                 "decode": {
                                   "type": "long"
                                 },
@@ -400,9 +122,6 @@
                                 "accepted": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                },
                                 "ok": {
                                   "type": "long"
                                 }
@@ -418,65 +137,17 @@
                   "properties": {
                     "cpu": {
                       "properties": {
-                        "system": {
-                          "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "total": {
                           "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            },
                             "value": {
                               "type": "long"
                             }
                           }
-                        },
-                        "user": {
-                          "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
                         }
                       }
                     },
                     "handles": {
                       "properties": {
-                        "limit": {
-                          "properties": {
-                            "hard": {
-                              "type": "long"
-                            },
-                            "soft": {
-                              "type": "long"
-                            }
-                          }
-                        },
                         "open": {
                           "type": "long"
                         }
@@ -486,13 +157,6 @@
                       "properties": {
                         "ephemeral_id": {
                           "type": "keyword"
-                        },
-                        "uptime": {
-                          "properties": {
-                            "ms": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     },
@@ -516,26 +180,6 @@
                 },
                 "libbeat": {
                   "properties": {
-                    "config": {
-                      "properties": {
-                        "module": {
-                          "properties": {
-                            "running": {
-                              "type": "long"
-                            },
-                            "starts": {
-                              "type": "long"
-                            },
-                            "stops": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reloads": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "output": {
                       "properties": {
                         "events": {
@@ -546,21 +190,12 @@
                             "active": {
                               "type": "long"
                             },
-                            "batches": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
-                            "duplicates": {
-                              "type": "long"
-                            },
                             "failed": {
                               "type": "long"
                             },
-                            "toomany": {
-                              "type": "long"
-                            },
                             "total": {
                               "type": "long"
                             }
@@ -576,9 +211,6 @@
                             }
                           }
                         },
-                        "type": {
-                          "type": "keyword"
-                        },
                         "write": {
                           "properties": {
                             "bytes": {
@@ -593,23 +225,14 @@
                     },
                     "pipeline": {
                       "properties": {
-                        "clients": {
-                          "type": "long"
-                        },
                         "events": {
                           "properties": {
-                            "active": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
                             "failed": {
                               "type": "long"
                             },
-                            "filtered": {
-                              "type": "long"
-                            },
                             "published": {
                               "type": "long"
                             },
@@ -620,13 +243,6 @@
                               "type": "long"
                             }
                           }
-                        },
-                        "queue": {
-                          "properties": {
-                            "acked": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     }
@@ -644,19 +260,6 @@
                         },
                         "5": {
                           "type": "double"
-                        },
-                        "norm": {
-                          "properties": {
-                            "1": {
-                              "type": "double"
-                            },
-                            "15": {
-                              "type": "double"
-                            },
-                            "5": {
-                              "type": "double"
-                            }
-                          }
                         }
                       }
                     }
@@ -664,9 +267,6 @@
                 }
               }
             },
-            "tags": {
-              "type": "keyword"
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -676,25 +276,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
@@ -729,93 +320,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -825,112 +337,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -940,17 +370,7 @@
               "properties": {
                 "docs": {
                   "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
+                    "count": {
                       "type": "long"
                     }
                   }
@@ -975,22 +395,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -998,66 +402,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1072,18 +420,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -1111,17 +449,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1134,17 +463,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1212,13 +532,6 @@
               "properties": {
                 "primaries": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
                         "index_time_in_millis": {
@@ -1228,33 +541,13 @@
                           "type": "long"
                         }
                       }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
                     }
                   }
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -1276,58 +569,10 @@
             }
           }
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "job_stats": {
           "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -1335,13 +580,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -1349,15 +587,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -1369,12 +601,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -1382,18 +608,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -1414,33 +630,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1490,13 +688,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -1545,15 +736,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -1563,9 +748,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1583,26 +765,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -1610,14 +776,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -1633,12 +793,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -1651,22 +805,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1677,9 +815,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1690,22 +825,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1715,23 +834,7 @@
                       "type": "integer"
                     },
                     "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
+                      "type": "long"
                     }
                   }
                 },
@@ -1760,12 +863,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -1773,22 +870,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
@@ -1830,63 +914,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "kibana_stats": {
           "properties": {
-            "cloud": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "region": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "zone": {
-                  "type": "keyword"
-                }
-              }
-            },
             "concurrent_connections": {
               "type": "long"
             },
             "kibana": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -1909,22 +946,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -1939,12 +960,6 @@
                       "properties": {
                         "size_limit": {
                           "type": "float"
-                        },
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
                         }
                       }
                     },
@@ -1952,9 +967,6 @@
                       "type": "float"
                     }
                   }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -1963,9 +975,6 @@
                 "disconnects": {
                   "type": "long"
                 },
-                "status_codes": {
-                  "type": "object"
-                },
                 "total": {
                   "type": "long"
                 }
@@ -1981,49 +990,15 @@
                 }
               }
             },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "timestamp": {
-              "type": "date"
-            }
-          }
-        },
-        "source_node": {
-          "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
             "timestamp": {
-              "format": "date_time",
               "type": "date"
             },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
         },
@@ -2060,79 +1035,27 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "logstash_state": {
           "properties": {
-            "ephemeral_id": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "http_address": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
             "pipeline": {
               "properties": {
-                "batch_size": {
-                  "type": "integer"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "format": {
-                  "type": "keyword"
-                },
                 "hash": {
                   "type": "keyword"
                 },
                 "id": {
                   "type": "keyword"
-                },
-                "representation": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "workers": {
-                  "type": "short"
                 }
               }
-            },
-            "snapshot": {
-              "type": "boolean"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
             }
           }
         },
         "logstash_stats": {
           "properties": {
-            "batch_size": {
-              "type": "integer"
-            },
             "events": {
               "properties": {
                 "duration_in_millis": {
                   "type": "long"
                 },
-                "filtered": {
-                  "type": "long"
-                },
                 "in": {
                   "type": "long"
                 },
@@ -2143,34 +1066,6 @@
             },
             "jvm": {
               "properties": {
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
                 "mem": {
                   "properties": {
                     "heap_max_in_bytes": {
@@ -2178,9 +1073,6 @@
                     },
                     "heap_used_in_bytes": {
                       "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2191,34 +1083,6 @@
             },
             "logstash": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "http_address": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "pipeline": {
-                  "properties": {
-                    "batch_size": {
-                      "type": "long"
-                    },
-                    "workers": {
-                      "type": "short"
-                    }
-                  }
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -2233,9 +1097,6 @@
                   "properties": {
                     "cpu": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -2253,9 +1114,6 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
@@ -2284,25 +1142,13 @@
             },
             "pipelines": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
                 "events": {
                   "properties": {
                     "duration_in_millis": {
                       "type": "long"
                     },
-                    "filtered": {
-                      "type": "long"
-                    },
-                    "in": {
-                      "type": "long"
-                    },
                     "out": {
                       "type": "long"
-                    },
-                    "queue_push_duration_in_millis": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2314,9 +1160,6 @@
                 },
                 "queue": {
                   "properties": {
-                    "events_count": {
-                      "type": "long"
-                    },
                     "max_queue_size_in_bytes": {
                       "type": "long"
                     },
@@ -2328,29 +1171,8 @@
                     }
                   }
                 },
-                "reloads": {
-                  "properties": {
-                    "failures": {
-                      "type": "long"
-                    },
-                    "successes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "vertices": {
                   "properties": {
-                    "double_gauges": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "duration_in_millis": {
                       "type": "long"
                     },
@@ -2363,22 +1185,11 @@
                     "id": {
                       "type": "keyword"
                     },
-                    "long_counters": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "long"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "pipeline_ephemeral_id": {
                       "type": "keyword"
                     },
                     "queue_push_duration_in_millis": {
-                      "type": "long"
+                      "type": "float"
                     }
                   },
                   "type": "nested"
@@ -2394,12 +1205,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -2407,50 +1212,24 @@
               "properties": {
                 "events_count": {
                   "type": "long"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "reloads": {
-              "properties": {
-                "failures": {
-                  "type": "long"
-                },
-                "successes": {
-                  "type": "long"
                 }
               }
             },
             "timestamp": {
               "type": "date"
-            },
-            "workers": {
-              "type": "short"
             }
           }
         },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
diff --git a/x-pack/test/functional/es_archives/monitoring/setup/collection/es_and_kibana_mb/mappings.json b/x-pack/test/functional/es_archives/monitoring/setup/collection/es_and_kibana_mb/mappings.json
index ea9313fb87b6ef..f8c55c60c49847 100644
--- a/x-pack/test/functional/es_archives/monitoring/setup/collection/es_and_kibana_mb/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/setup/collection/es_and_kibana_mb/mappings.json
@@ -9,105 +9,6 @@
       "properties": {
         "beats_state": {
           "properties": {
-            "beat": {
-              "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "uuid": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "properties": {
-                "beat": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "host": {
-                  "properties": {
-                    "architecture": {
-                      "type": "keyword"
-                    },
-                    "hostname": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "os": {
-                      "properties": {
-                        "build": {
-                          "type": "keyword"
-                        },
-                        "family": {
-                          "type": "keyword"
-                        },
-                        "platform": {
-                          "type": "keyword"
-                        },
-                        "version": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "input": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "module": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "output": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "service": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "version": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -118,12 +19,6 @@
           "properties": {
             "beat": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
                 "type": {
                   "type": "keyword"
                 },
@@ -139,146 +34,19 @@
               "properties": {
                 "apm-server": {
                   "properties": {
-                    "decoder": {
-                      "properties": {
-                        "deflate": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "gzip": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "missing-content-length": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reader": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            },
-                            "size": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "uncompressed": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    },
                     "processor": {
                       "properties": {
                         "error": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "errors": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
                         "metric": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "sourcemap": {
-                          "properties": {
-                            "counter": {
-                              "type": "long"
-                            },
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
@@ -291,40 +59,8 @@
                         },
                         "transaction": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "frames": {
-                              "type": "long"
-                            },
-                            "spans": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "transactions": {
-                              "type": "long"
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         }
@@ -332,17 +68,6 @@
                     },
                     "server": {
                       "properties": {
-                        "concurrent": {
-                          "properties": {
-                            "wait": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "request": {
                           "properties": {
                             "count": {
@@ -363,9 +88,6 @@
                                 "concurrency": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                },
                                 "decode": {
                                   "type": "long"
                                 },
@@ -400,9 +122,6 @@
                                 "accepted": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                },
                                 "ok": {
                                   "type": "long"
                                 }
@@ -418,65 +137,17 @@
                   "properties": {
                     "cpu": {
                       "properties": {
-                        "system": {
-                          "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "total": {
                           "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            },
                             "value": {
                               "type": "long"
                             }
                           }
-                        },
-                        "user": {
-                          "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
                         }
                       }
                     },
                     "handles": {
                       "properties": {
-                        "limit": {
-                          "properties": {
-                            "hard": {
-                              "type": "long"
-                            },
-                            "soft": {
-                              "type": "long"
-                            }
-                          }
-                        },
                         "open": {
                           "type": "long"
                         }
@@ -486,13 +157,6 @@
                       "properties": {
                         "ephemeral_id": {
                           "type": "keyword"
-                        },
-                        "uptime": {
-                          "properties": {
-                            "ms": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     },
@@ -516,26 +180,6 @@
                 },
                 "libbeat": {
                   "properties": {
-                    "config": {
-                      "properties": {
-                        "module": {
-                          "properties": {
-                            "running": {
-                              "type": "long"
-                            },
-                            "starts": {
-                              "type": "long"
-                            },
-                            "stops": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reloads": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "output": {
                       "properties": {
                         "events": {
@@ -546,21 +190,12 @@
                             "active": {
                               "type": "long"
                             },
-                            "batches": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
-                            "duplicates": {
-                              "type": "long"
-                            },
                             "failed": {
                               "type": "long"
                             },
-                            "toomany": {
-                              "type": "long"
-                            },
                             "total": {
                               "type": "long"
                             }
@@ -576,9 +211,6 @@
                             }
                           }
                         },
-                        "type": {
-                          "type": "keyword"
-                        },
                         "write": {
                           "properties": {
                             "bytes": {
@@ -593,23 +225,14 @@
                     },
                     "pipeline": {
                       "properties": {
-                        "clients": {
-                          "type": "long"
-                        },
                         "events": {
                           "properties": {
-                            "active": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
                             "failed": {
                               "type": "long"
                             },
-                            "filtered": {
-                              "type": "long"
-                            },
                             "published": {
                               "type": "long"
                             },
@@ -620,13 +243,6 @@
                               "type": "long"
                             }
                           }
-                        },
-                        "queue": {
-                          "properties": {
-                            "acked": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     }
@@ -644,19 +260,6 @@
                         },
                         "5": {
                           "type": "double"
-                        },
-                        "norm": {
-                          "properties": {
-                            "1": {
-                              "type": "double"
-                            },
-                            "15": {
-                              "type": "double"
-                            },
-                            "5": {
-                              "type": "double"
-                            }
-                          }
                         }
                       }
                     }
@@ -664,9 +267,6 @@
                 }
               }
             },
-            "tags": {
-              "type": "keyword"
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -676,25 +276,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
@@ -729,93 +320,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -825,132 +337,40 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
               "type": "keyword"
             },
             "primaries": {
-              "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "fielddata": {
+              "properties": {
+                "docs": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
+                    "count": {
                       "type": "long"
                     }
                   }
@@ -975,22 +395,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -998,66 +402,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1072,18 +420,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -1111,17 +449,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1134,17 +463,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1212,13 +532,6 @@
               "properties": {
                 "primaries": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
                         "index_time_in_millis": {
@@ -1228,33 +541,13 @@
                           "type": "long"
                         }
                       }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
                     }
                   }
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -1276,58 +569,10 @@
             }
           }
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "job_stats": {
           "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -1335,13 +580,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -1349,15 +587,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -1369,12 +601,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -1382,18 +608,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -1414,33 +630,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1490,13 +688,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -1545,15 +736,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -1563,9 +748,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1583,26 +765,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -1610,14 +776,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -1630,108 +790,51 @@
                 "cpu": {
                   "properties": {
                     "percent": {
-                      "type": "half_float"
-                    }
-                  }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
-                }
-              }
-            },
-            "thread_pool": {
-              "properties": {
-                "bulk": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "get": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
+                      "type": "half_float"
                     }
                   }
-                },
-                "index": {
+                }
+              }
+            },
+            "thread_pool": {
+              "properties": {
+                "bulk": {
                   "properties": {
                     "queue": {
                       "type": "integer"
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
-                "management": {
+                "get": {
                   "properties": {
                     "queue": {
                       "type": "integer"
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
-                "search": {
+                "index": {
                   "properties": {
                     "queue": {
                       "type": "integer"
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
-                "watcher": {
+                "search": {
                   "properties": {
                     "queue": {
                       "type": "integer"
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1760,12 +863,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -1773,22 +870,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
@@ -1828,93 +912,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -1924,112 +929,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -2044,16 +967,6 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
                     "index_time_in_millis": {
@@ -2074,22 +987,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -2097,66 +994,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2171,18 +1012,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -2210,17 +1041,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2233,17 +1055,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2308,32 +1121,15 @@
         "indices_stats": {
           "properties": {
             "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
-                        "index_total": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
                       "properties": {
-                        "query_time_in_millis": {
+                        "index_time_in_millis": {
                           "type": "long"
                         },
-                        "query_total": {
+                        "index_total": {
                           "type": "long"
                         }
                       }
@@ -2342,18 +1138,8 @@
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -2375,58 +1161,10 @@
             }
           }
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "job_stats": {
           "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -2434,13 +1172,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -2448,15 +1179,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -2468,12 +1193,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -2481,18 +1200,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -2513,33 +1222,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2589,13 +1280,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -2644,15 +1328,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -2662,9 +1340,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -2682,26 +1357,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -2709,14 +1368,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -2732,12 +1385,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -2750,22 +1397,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -2776,9 +1407,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -2789,22 +1417,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -2815,22 +1427,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -2859,12 +1455,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -2872,22 +1462,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
@@ -2929,63 +1506,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "kibana_stats": {
           "properties": {
-            "cloud": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "region": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "zone": {
-                  "type": "keyword"
-                }
-              }
-            },
             "concurrent_connections": {
               "type": "long"
             },
             "kibana": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -3008,22 +1538,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -3038,12 +1552,6 @@
                       "properties": {
                         "size_limit": {
                           "type": "float"
-                        },
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
                         }
                       }
                     },
@@ -3051,9 +1559,6 @@
                       "type": "float"
                     }
                   }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -3062,9 +1567,6 @@
                 "disconnects": {
                   "type": "long"
                 },
-                "status_codes": {
-                  "type": "object"
-                },
                 "total": {
                   "type": "long"
                 }
@@ -3074,55 +1576,21 @@
               "properties": {
                 "average": {
                   "type": "float"
-                },
-                "max": {
-                  "type": "float"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "timestamp": {
-              "type": "date"
-            }
-          }
-        },
-        "source_node": {
-          "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
+                },
+                "max": {
+                  "type": "float"
+                }
+              }
             },
             "timestamp": {
-              "format": "date_time",
               "type": "date"
             },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
         },
@@ -3159,63 +1627,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "kibana_stats": {
           "properties": {
-            "cloud": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "region": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "zone": {
-                  "type": "keyword"
-                }
-              }
-            },
             "concurrent_connections": {
               "type": "long"
             },
             "kibana": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -3238,22 +1659,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -3268,12 +1673,6 @@
                       "properties": {
                         "size_limit": {
                           "type": "float"
-                        },
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
                         }
                       }
                     },
@@ -3281,9 +1680,6 @@
                       "type": "float"
                     }
                   }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -3292,9 +1688,6 @@
                 "disconnects": {
                   "type": "long"
                 },
-                "status_codes": {
-                  "type": "object"
-                },
                 "total": {
                   "type": "long"
                 }
@@ -3310,49 +1703,15 @@
                 }
               }
             },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "timestamp": {
-              "type": "date"
-            }
-          }
-        },
-        "source_node": {
-          "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
             "timestamp": {
-              "format": "date_time",
               "type": "date"
             },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
         },
@@ -3389,79 +1748,27 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "logstash_state": {
           "properties": {
-            "ephemeral_id": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "http_address": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
             "pipeline": {
               "properties": {
-                "batch_size": {
-                  "type": "integer"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "format": {
-                  "type": "keyword"
-                },
                 "hash": {
                   "type": "keyword"
                 },
                 "id": {
                   "type": "keyword"
-                },
-                "representation": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "workers": {
-                  "type": "short"
                 }
               }
-            },
-            "snapshot": {
-              "type": "boolean"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
             }
           }
         },
         "logstash_stats": {
           "properties": {
-            "batch_size": {
-              "type": "integer"
-            },
             "events": {
               "properties": {
                 "duration_in_millis": {
                   "type": "long"
                 },
-                "filtered": {
-                  "type": "long"
-                },
                 "in": {
                   "type": "long"
                 },
@@ -3472,34 +1779,6 @@
             },
             "jvm": {
               "properties": {
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
                 "mem": {
                   "properties": {
                     "heap_max_in_bytes": {
@@ -3507,9 +1786,6 @@
                     },
                     "heap_used_in_bytes": {
                       "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "long"
                     }
                   }
                 },
@@ -3520,34 +1796,6 @@
             },
             "logstash": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "http_address": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "pipeline": {
-                  "properties": {
-                    "batch_size": {
-                      "type": "long"
-                    },
-                    "workers": {
-                      "type": "short"
-                    }
-                  }
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -3562,9 +1810,6 @@
                   "properties": {
                     "cpu": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -3582,9 +1827,6 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
@@ -3613,25 +1855,13 @@
             },
             "pipelines": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
                 "events": {
                   "properties": {
                     "duration_in_millis": {
                       "type": "long"
                     },
-                    "filtered": {
-                      "type": "long"
-                    },
-                    "in": {
-                      "type": "long"
-                    },
                     "out": {
                       "type": "long"
-                    },
-                    "queue_push_duration_in_millis": {
-                      "type": "long"
                     }
                   }
                 },
@@ -3643,9 +1873,6 @@
                 },
                 "queue": {
                   "properties": {
-                    "events_count": {
-                      "type": "long"
-                    },
                     "max_queue_size_in_bytes": {
                       "type": "long"
                     },
@@ -3657,29 +1884,8 @@
                     }
                   }
                 },
-                "reloads": {
-                  "properties": {
-                    "failures": {
-                      "type": "long"
-                    },
-                    "successes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "vertices": {
                   "properties": {
-                    "double_gauges": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "duration_in_millis": {
                       "type": "long"
                     },
@@ -3692,22 +1898,11 @@
                     "id": {
                       "type": "keyword"
                     },
-                    "long_counters": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "long"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "pipeline_ephemeral_id": {
                       "type": "keyword"
                     },
                     "queue_push_duration_in_millis": {
-                      "type": "long"
+                      "type": "float"
                     }
                   },
                   "type": "nested"
@@ -3723,12 +1918,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -3736,50 +1925,24 @@
               "properties": {
                 "events_count": {
                   "type": "long"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "reloads": {
-              "properties": {
-                "failures": {
-                  "type": "long"
-                },
-                "successes": {
-                  "type": "long"
                 }
               }
             },
             "timestamp": {
               "type": "date"
-            },
-            "workers": {
-              "type": "short"
             }
           }
         },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
diff --git a/x-pack/test/functional/es_archives/monitoring/setup/collection/kibana_exclusive_mb/mappings.json b/x-pack/test/functional/es_archives/monitoring/setup/collection/kibana_exclusive_mb/mappings.json
index a3ddceca893c00..4f388b8834b7bc 100644
--- a/x-pack/test/functional/es_archives/monitoring/setup/collection/kibana_exclusive_mb/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/setup/collection/kibana_exclusive_mb/mappings.json
@@ -9,105 +9,6 @@
       "properties": {
         "beats_state": {
           "properties": {
-            "beat": {
-              "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "uuid": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "properties": {
-                "beat": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "host": {
-                  "properties": {
-                    "architecture": {
-                      "type": "keyword"
-                    },
-                    "hostname": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "os": {
-                      "properties": {
-                        "build": {
-                          "type": "keyword"
-                        },
-                        "family": {
-                          "type": "keyword"
-                        },
-                        "platform": {
-                          "type": "keyword"
-                        },
-                        "version": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "input": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "module": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "output": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "service": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "version": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -118,12 +19,6 @@
           "properties": {
             "beat": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
                 "type": {
                   "type": "keyword"
                 },
@@ -139,146 +34,19 @@
               "properties": {
                 "apm-server": {
                   "properties": {
-                    "decoder": {
-                      "properties": {
-                        "deflate": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "gzip": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "missing-content-length": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reader": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            },
-                            "size": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "uncompressed": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    },
                     "processor": {
                       "properties": {
                         "error": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "errors": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
                         "metric": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "sourcemap": {
-                          "properties": {
-                            "counter": {
-                              "type": "long"
-                            },
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
@@ -291,40 +59,8 @@
                         },
                         "transaction": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "frames": {
-                              "type": "long"
-                            },
-                            "spans": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "transactions": {
-                              "type": "long"
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         }
@@ -332,17 +68,6 @@
                     },
                     "server": {
                       "properties": {
-                        "concurrent": {
-                          "properties": {
-                            "wait": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "request": {
                           "properties": {
                             "count": {
@@ -363,9 +88,6 @@
                                 "concurrency": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                },
                                 "decode": {
                                   "type": "long"
                                 },
@@ -400,9 +122,6 @@
                                 "accepted": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                },
                                 "ok": {
                                   "type": "long"
                                 }
@@ -418,65 +137,17 @@
                   "properties": {
                     "cpu": {
                       "properties": {
-                        "system": {
-                          "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "total": {
                           "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            },
                             "value": {
                               "type": "long"
                             }
                           }
-                        },
-                        "user": {
-                          "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
                         }
                       }
                     },
                     "handles": {
                       "properties": {
-                        "limit": {
-                          "properties": {
-                            "hard": {
-                              "type": "long"
-                            },
-                            "soft": {
-                              "type": "long"
-                            }
-                          }
-                        },
                         "open": {
                           "type": "long"
                         }
@@ -486,13 +157,6 @@
                       "properties": {
                         "ephemeral_id": {
                           "type": "keyword"
-                        },
-                        "uptime": {
-                          "properties": {
-                            "ms": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     },
@@ -516,26 +180,6 @@
                 },
                 "libbeat": {
                   "properties": {
-                    "config": {
-                      "properties": {
-                        "module": {
-                          "properties": {
-                            "running": {
-                              "type": "long"
-                            },
-                            "starts": {
-                              "type": "long"
-                            },
-                            "stops": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reloads": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "output": {
                       "properties": {
                         "events": {
@@ -546,21 +190,12 @@
                             "active": {
                               "type": "long"
                             },
-                            "batches": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
-                            "duplicates": {
-                              "type": "long"
-                            },
                             "failed": {
                               "type": "long"
                             },
-                            "toomany": {
-                              "type": "long"
-                            },
                             "total": {
                               "type": "long"
                             }
@@ -576,9 +211,6 @@
                             }
                           }
                         },
-                        "type": {
-                          "type": "keyword"
-                        },
                         "write": {
                           "properties": {
                             "bytes": {
@@ -593,23 +225,14 @@
                     },
                     "pipeline": {
                       "properties": {
-                        "clients": {
-                          "type": "long"
-                        },
                         "events": {
                           "properties": {
-                            "active": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
                             "failed": {
                               "type": "long"
                             },
-                            "filtered": {
-                              "type": "long"
-                            },
                             "published": {
                               "type": "long"
                             },
@@ -620,13 +243,6 @@
                               "type": "long"
                             }
                           }
-                        },
-                        "queue": {
-                          "properties": {
-                            "acked": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     }
@@ -644,19 +260,6 @@
                         },
                         "5": {
                           "type": "double"
-                        },
-                        "norm": {
-                          "properties": {
-                            "1": {
-                              "type": "double"
-                            },
-                            "15": {
-                              "type": "double"
-                            },
-                            "5": {
-                              "type": "double"
-                            }
-                          }
                         }
                       }
                     }
@@ -664,9 +267,6 @@
                 }
               }
             },
-            "tags": {
-              "type": "keyword"
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -676,25 +276,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
@@ -714,108 +305,29 @@
         "format": "7",
         "number_of_replicas": "0",
         "number_of_shards": "1"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-    },
-    "index": ".monitoring-es-7-2019.04.09",
-    "mappings": {
-      "date_detection": false,
-      "dynamic": "false",
-      "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": ".monitoring-es-7-2019.04.09",
+    "mappings": {
+      "date_detection": false,
+      "dynamic": "false",
+      "properties": {
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -825,112 +337,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -945,16 +375,6 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
                     "index_time_in_millis": {
@@ -975,22 +395,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -998,66 +402,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1072,18 +420,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -1111,17 +449,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1134,17 +463,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1212,13 +532,6 @@
               "properties": {
                 "primaries": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
                         "index_time_in_millis": {
@@ -1228,105 +541,37 @@
                           "type": "long"
                         }
                       }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
                     }
                   }
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "job_stats": {
-          "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "job_id": {
-              "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
                 }
               }
-            },
-            "state": {
+            }
+          }
+        },
+        "job_stats": {
+          "properties": {
+            "job_id": {
               "type": "keyword"
             }
           }
@@ -1335,13 +580,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -1349,15 +587,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -1369,12 +601,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -1382,18 +608,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -1414,33 +630,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1490,13 +688,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -1545,15 +736,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -1563,9 +748,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1583,26 +765,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -1610,14 +776,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -1633,12 +793,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -1651,22 +805,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1677,9 +815,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1690,22 +825,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1716,22 +835,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1760,12 +863,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -1773,22 +870,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
@@ -1828,93 +912,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -1924,112 +929,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -2039,17 +962,7 @@
               "properties": {
                 "docs": {
                   "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
+                    "count": {
                       "type": "long"
                     }
                   }
@@ -2074,22 +987,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -2097,66 +994,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2171,18 +1012,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -2210,17 +1041,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2233,17 +1055,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2311,13 +1124,6 @@
               "properties": {
                 "primaries": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
                         "index_time_in_millis": {
@@ -2327,33 +1133,13 @@
                           "type": "long"
                         }
                       }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
                     }
                   }
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -2375,58 +1161,10 @@
             }
           }
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "job_stats": {
           "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -2434,13 +1172,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -2448,15 +1179,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -2468,12 +1193,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -2481,18 +1200,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -2513,33 +1222,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2589,13 +1280,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -2644,15 +1328,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -2662,9 +1340,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -2682,26 +1357,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -2709,14 +1368,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -2732,12 +1385,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -2750,22 +1397,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -2776,9 +1407,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -2789,22 +1417,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -2814,23 +1426,7 @@
                       "type": "integer"
                     },
                     "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
+                      "type": "long"
                     }
                   }
                 },
@@ -2859,12 +1455,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -2872,22 +1462,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
@@ -2929,63 +1506,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "kibana_stats": {
           "properties": {
-            "cloud": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "region": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "zone": {
-                  "type": "keyword"
-                }
-              }
-            },
             "concurrent_connections": {
               "type": "long"
             },
             "kibana": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -3008,22 +1538,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -3038,12 +1552,6 @@
                       "properties": {
                         "size_limit": {
                           "type": "float"
-                        },
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
                         }
                       }
                     },
@@ -3051,9 +1559,6 @@
                       "type": "float"
                     }
                   }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -3062,9 +1567,6 @@
                 "disconnects": {
                   "type": "long"
                 },
-                "status_codes": {
-                  "type": "object"
-                },
                 "total": {
                   "type": "long"
                 }
@@ -3080,49 +1582,15 @@
                 }
               }
             },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "timestamp": {
-              "type": "date"
-            }
-          }
-        },
-        "source_node": {
-          "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
             "timestamp": {
-              "format": "date_time",
               "type": "date"
             },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
         },
@@ -3159,79 +1627,27 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "logstash_state": {
           "properties": {
-            "ephemeral_id": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "http_address": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
             "pipeline": {
               "properties": {
-                "batch_size": {
-                  "type": "integer"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "format": {
-                  "type": "keyword"
-                },
                 "hash": {
                   "type": "keyword"
                 },
                 "id": {
                   "type": "keyword"
-                },
-                "representation": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "workers": {
-                  "type": "short"
                 }
               }
-            },
-            "snapshot": {
-              "type": "boolean"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
             }
           }
         },
         "logstash_stats": {
           "properties": {
-            "batch_size": {
-              "type": "integer"
-            },
             "events": {
               "properties": {
                 "duration_in_millis": {
                   "type": "long"
                 },
-                "filtered": {
-                  "type": "long"
-                },
                 "in": {
                   "type": "long"
                 },
@@ -3242,34 +1658,6 @@
             },
             "jvm": {
               "properties": {
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
                 "mem": {
                   "properties": {
                     "heap_max_in_bytes": {
@@ -3277,9 +1665,6 @@
                     },
                     "heap_used_in_bytes": {
                       "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "long"
                     }
                   }
                 },
@@ -3290,34 +1675,6 @@
             },
             "logstash": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "http_address": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "pipeline": {
-                  "properties": {
-                    "batch_size": {
-                      "type": "long"
-                    },
-                    "workers": {
-                      "type": "short"
-                    }
-                  }
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -3332,9 +1689,6 @@
                   "properties": {
                     "cpu": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -3352,9 +1706,6 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
@@ -3383,25 +1734,13 @@
             },
             "pipelines": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
                 "events": {
                   "properties": {
                     "duration_in_millis": {
                       "type": "long"
                     },
-                    "filtered": {
-                      "type": "long"
-                    },
-                    "in": {
-                      "type": "long"
-                    },
                     "out": {
                       "type": "long"
-                    },
-                    "queue_push_duration_in_millis": {
-                      "type": "long"
                     }
                   }
                 },
@@ -3413,9 +1752,6 @@
                 },
                 "queue": {
                   "properties": {
-                    "events_count": {
-                      "type": "long"
-                    },
                     "max_queue_size_in_bytes": {
                       "type": "long"
                     },
@@ -3427,29 +1763,8 @@
                     }
                   }
                 },
-                "reloads": {
-                  "properties": {
-                    "failures": {
-                      "type": "long"
-                    },
-                    "successes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "vertices": {
                   "properties": {
-                    "double_gauges": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "duration_in_millis": {
                       "type": "long"
                     },
@@ -3462,22 +1777,11 @@
                     "id": {
                       "type": "keyword"
                     },
-                    "long_counters": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "long"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "pipeline_ephemeral_id": {
                       "type": "keyword"
                     },
                     "queue_push_duration_in_millis": {
-                      "type": "long"
+                      "type": "float"
                     }
                   },
                   "type": "nested"
@@ -3493,12 +1797,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -3506,50 +1804,24 @@
               "properties": {
                 "events_count": {
                   "type": "long"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "reloads": {
-              "properties": {
-                "failures": {
-                  "type": "long"
-                },
-                "successes": {
-                  "type": "long"
                 }
               }
             },
             "timestamp": {
               "type": "date"
-            },
-            "workers": {
-              "type": "short"
             }
           }
         },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
diff --git a/x-pack/test/functional/es_archives/monitoring/setup/collection/kibana_mb/mappings.json b/x-pack/test/functional/es_archives/monitoring/setup/collection/kibana_mb/mappings.json
index adbd44d7281b67..03f954f92dd337 100644
--- a/x-pack/test/functional/es_archives/monitoring/setup/collection/kibana_mb/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/setup/collection/kibana_mb/mappings.json
@@ -9,105 +9,6 @@
       "properties": {
         "beats_state": {
           "properties": {
-            "beat": {
-              "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "uuid": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "properties": {
-                "beat": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "host": {
-                  "properties": {
-                    "architecture": {
-                      "type": "keyword"
-                    },
-                    "hostname": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "os": {
-                      "properties": {
-                        "build": {
-                          "type": "keyword"
-                        },
-                        "family": {
-                          "type": "keyword"
-                        },
-                        "platform": {
-                          "type": "keyword"
-                        },
-                        "version": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "input": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "module": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "output": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "service": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "version": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -118,12 +19,6 @@
           "properties": {
             "beat": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
                 "type": {
                   "type": "keyword"
                 },
@@ -139,146 +34,19 @@
               "properties": {
                 "apm-server": {
                   "properties": {
-                    "decoder": {
-                      "properties": {
-                        "deflate": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "gzip": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "missing-content-length": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reader": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            },
-                            "size": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "uncompressed": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    },
                     "processor": {
                       "properties": {
                         "error": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "errors": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
                         "metric": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "sourcemap": {
-                          "properties": {
-                            "counter": {
-                              "type": "long"
-                            },
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
@@ -291,40 +59,8 @@
                         },
                         "transaction": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "frames": {
-                              "type": "long"
-                            },
-                            "spans": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "transactions": {
-                              "type": "long"
-                            },
                             "transformations": {
                               "type": "long"
-                            },
-                            "validation": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "errors": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         }
@@ -332,17 +68,6 @@
                     },
                     "server": {
                       "properties": {
-                        "concurrent": {
-                          "properties": {
-                            "wait": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "request": {
                           "properties": {
                             "count": {
@@ -363,9 +88,6 @@
                                 "concurrency": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                },
                                 "decode": {
                                   "type": "long"
                                 },
@@ -400,9 +122,6 @@
                                 "accepted": {
                                   "type": "long"
                                 },
-                                "count": {
-                                  "type": "long"
-                                },
                                 "ok": {
                                   "type": "long"
                                 }
@@ -418,65 +137,17 @@
                   "properties": {
                     "cpu": {
                       "properties": {
-                        "system": {
-                          "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "total": {
                           "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            },
                             "value": {
                               "type": "long"
                             }
                           }
-                        },
-                        "user": {
-                          "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
                         }
                       }
                     },
                     "handles": {
                       "properties": {
-                        "limit": {
-                          "properties": {
-                            "hard": {
-                              "type": "long"
-                            },
-                            "soft": {
-                              "type": "long"
-                            }
-                          }
-                        },
                         "open": {
                           "type": "long"
                         }
@@ -486,13 +157,6 @@
                       "properties": {
                         "ephemeral_id": {
                           "type": "keyword"
-                        },
-                        "uptime": {
-                          "properties": {
-                            "ms": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     },
@@ -516,26 +180,6 @@
                 },
                 "libbeat": {
                   "properties": {
-                    "config": {
-                      "properties": {
-                        "module": {
-                          "properties": {
-                            "running": {
-                              "type": "long"
-                            },
-                            "starts": {
-                              "type": "long"
-                            },
-                            "stops": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reloads": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "output": {
                       "properties": {
                         "events": {
@@ -546,21 +190,12 @@
                             "active": {
                               "type": "long"
                             },
-                            "batches": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
-                            "duplicates": {
-                              "type": "long"
-                            },
                             "failed": {
                               "type": "long"
                             },
-                            "toomany": {
-                              "type": "long"
-                            },
                             "total": {
                               "type": "long"
                             }
@@ -576,9 +211,6 @@
                             }
                           }
                         },
-                        "type": {
-                          "type": "keyword"
-                        },
                         "write": {
                           "properties": {
                             "bytes": {
@@ -592,24 +224,15 @@
                       }
                     },
                     "pipeline": {
-                      "properties": {
-                        "clients": {
-                          "type": "long"
-                        },
+                      "properties": {
                         "events": {
                           "properties": {
-                            "active": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
                             "failed": {
                               "type": "long"
                             },
-                            "filtered": {
-                              "type": "long"
-                            },
                             "published": {
                               "type": "long"
                             },
@@ -620,13 +243,6 @@
                               "type": "long"
                             }
                           }
-                        },
-                        "queue": {
-                          "properties": {
-                            "acked": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     }
@@ -644,19 +260,6 @@
                         },
                         "5": {
                           "type": "double"
-                        },
-                        "norm": {
-                          "properties": {
-                            "1": {
-                              "type": "double"
-                            },
-                            "15": {
-                              "type": "double"
-                            },
-                            "5": {
-                              "type": "double"
-                            }
-                          }
                         }
                       }
                     }
@@ -664,9 +267,6 @@
                 }
               }
             },
-            "tags": {
-              "type": "keyword"
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -676,25 +276,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
@@ -729,93 +320,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -825,112 +337,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -945,16 +375,6 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
                     "index_time_in_millis": {
@@ -975,22 +395,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -998,66 +402,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1072,18 +420,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -1111,17 +449,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1134,17 +463,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1209,32 +529,15 @@
         "indices_stats": {
           "properties": {
             "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
-                        "index_total": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
                       "properties": {
-                        "query_time_in_millis": {
+                        "index_time_in_millis": {
                           "type": "long"
                         },
-                        "query_total": {
+                        "index_total": {
                           "type": "long"
                         }
                       }
@@ -1243,18 +546,8 @@
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -1276,58 +569,10 @@
             }
           }
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "job_stats": {
           "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -1335,13 +580,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -1349,15 +587,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -1369,12 +601,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -1382,18 +608,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -1414,33 +630,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1490,13 +688,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -1545,15 +736,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -1563,9 +748,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1583,26 +765,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -1610,14 +776,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -1633,12 +793,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -1651,22 +805,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1677,9 +815,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1690,22 +825,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1716,22 +835,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1760,12 +863,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -1773,22 +870,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
@@ -1830,63 +914,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "kibana_stats": {
           "properties": {
-            "cloud": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "region": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "zone": {
-                  "type": "keyword"
-                }
-              }
-            },
             "concurrent_connections": {
               "type": "long"
             },
             "kibana": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -1909,22 +946,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -1939,12 +960,6 @@
                       "properties": {
                         "size_limit": {
                           "type": "float"
-                        },
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
                         }
                       }
                     },
@@ -1952,9 +967,6 @@
                       "type": "float"
                     }
                   }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -1963,9 +975,6 @@
                 "disconnects": {
                   "type": "long"
                 },
-                "status_codes": {
-                  "type": "object"
-                },
                 "total": {
                   "type": "long"
                 }
@@ -1975,55 +984,21 @@
               "properties": {
                 "average": {
                   "type": "float"
-                },
-                "max": {
-                  "type": "float"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "timestamp": {
-              "type": "date"
-            }
-          }
-        },
-        "source_node": {
-          "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
+                },
+                "max": {
+                  "type": "float"
+                }
+              }
             },
             "timestamp": {
-              "format": "date_time",
               "type": "date"
             },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
         },
@@ -2060,63 +1035,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "kibana_stats": {
           "properties": {
-            "cloud": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "region": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "zone": {
-                  "type": "keyword"
-                }
-              }
-            },
             "concurrent_connections": {
               "type": "long"
             },
             "kibana": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -2139,22 +1067,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -2169,12 +1081,6 @@
                       "properties": {
                         "size_limit": {
                           "type": "float"
-                        },
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
                         }
                       }
                     },
@@ -2182,9 +1088,6 @@
                       "type": "float"
                     }
                   }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
@@ -2193,9 +1096,6 @@
                 "disconnects": {
                   "type": "long"
                 },
-                "status_codes": {
-                  "type": "object"
-                },
                 "total": {
                   "type": "long"
                 }
@@ -2211,49 +1111,15 @@
                 }
               }
             },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "timestamp": {
-              "type": "date"
-            }
-          }
-        },
-        "source_node": {
-          "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
             "timestamp": {
-              "format": "date_time",
               "type": "date"
             },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
         },
@@ -2290,79 +1156,27 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "logstash_state": {
           "properties": {
-            "ephemeral_id": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "http_address": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
             "pipeline": {
               "properties": {
-                "batch_size": {
-                  "type": "integer"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "format": {
-                  "type": "keyword"
-                },
                 "hash": {
                   "type": "keyword"
                 },
                 "id": {
                   "type": "keyword"
-                },
-                "representation": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "workers": {
-                  "type": "short"
                 }
               }
-            },
-            "snapshot": {
-              "type": "boolean"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
             }
           }
         },
         "logstash_stats": {
           "properties": {
-            "batch_size": {
-              "type": "integer"
-            },
             "events": {
               "properties": {
                 "duration_in_millis": {
                   "type": "long"
                 },
-                "filtered": {
-                  "type": "long"
-                },
                 "in": {
                   "type": "long"
                 },
@@ -2373,34 +1187,6 @@
             },
             "jvm": {
               "properties": {
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
                 "mem": {
                   "properties": {
                     "heap_max_in_bytes": {
@@ -2408,9 +1194,6 @@
                     },
                     "heap_used_in_bytes": {
                       "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2421,34 +1204,6 @@
             },
             "logstash": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "http_address": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "pipeline": {
-                  "properties": {
-                    "batch_size": {
-                      "type": "long"
-                    },
-                    "workers": {
-                      "type": "short"
-                    }
-                  }
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "type": "keyword"
-                },
                 "uuid": {
                   "type": "keyword"
                 },
@@ -2463,9 +1218,6 @@
                   "properties": {
                     "cpu": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -2483,9 +1235,6 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
@@ -2514,25 +1263,13 @@
             },
             "pipelines": {
               "properties": {
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
                 "events": {
                   "properties": {
                     "duration_in_millis": {
                       "type": "long"
                     },
-                    "filtered": {
-                      "type": "long"
-                    },
-                    "in": {
-                      "type": "long"
-                    },
                     "out": {
                       "type": "long"
-                    },
-                    "queue_push_duration_in_millis": {
-                      "type": "long"
                     }
                   }
                 },
@@ -2544,9 +1281,6 @@
                 },
                 "queue": {
                   "properties": {
-                    "events_count": {
-                      "type": "long"
-                    },
                     "max_queue_size_in_bytes": {
                       "type": "long"
                     },
@@ -2558,29 +1292,8 @@
                     }
                   }
                 },
-                "reloads": {
-                  "properties": {
-                    "failures": {
-                      "type": "long"
-                    },
-                    "successes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "vertices": {
                   "properties": {
-                    "double_gauges": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "duration_in_millis": {
                       "type": "long"
                     },
@@ -2593,22 +1306,11 @@
                     "id": {
                       "type": "keyword"
                     },
-                    "long_counters": {
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "long"
-                        }
-                      },
-                      "type": "nested"
-                    },
                     "pipeline_ephemeral_id": {
                       "type": "keyword"
                     },
                     "queue_push_duration_in_millis": {
-                      "type": "long"
+                      "type": "float"
                     }
                   },
                   "type": "nested"
@@ -2624,12 +1326,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -2637,50 +1333,24 @@
               "properties": {
                 "events_count": {
                   "type": "long"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "reloads": {
-              "properties": {
-                "failures": {
-                  "type": "long"
-                },
-                "successes": {
-                  "type": "long"
                 }
               }
             },
             "timestamp": {
               "type": "date"
-            },
-            "workers": {
-              "type": "short"
             }
           }
         },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
diff --git a/x-pack/test/functional/es_archives/monitoring/singlecluster-basic-beats/mappings.json b/x-pack/test/functional/es_archives/monitoring/singlecluster-basic-beats/mappings.json
index 212391b0384779..ba08a3d9f2460e 100644
--- a/x-pack/test/functional/es_archives/monitoring/singlecluster-basic-beats/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/singlecluster-basic-beats/mappings.json
@@ -7,105 +7,6 @@
       "properties": {
         "beats_state": {
           "properties": {
-            "beat": {
-              "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "uuid": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "properties": {
-                "beat": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "host": {
-                  "properties": {
-                    "architecture": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "hostname": {
-                      "type": "keyword"
-                    },
-                    "os": {
-                      "properties": {
-                        "build": {
-                          "type": "keyword"
-                        },
-                        "family": {
-                          "type": "keyword"
-                        },
-                        "platform": {
-                          "type": "keyword"
-                        },
-                        "version": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "input": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "module": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "output": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "service": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "version": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -116,12 +17,6 @@
           "properties": {
             "beat": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
                 "type": {
                   "type": "keyword"
                 },
@@ -135,108 +30,40 @@
             },
             "metrics": {
               "properties": {
-                "beat": {
+                "apm-server": {
                   "properties": {
-                    "cpu": {
+                    "processor": {
                       "properties": {
-                        "system": {
+                        "error": {
                           "properties": {
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
-                        "total": {
+                        "metric": {
                           "properties": {
-                            "value": {
-                              "type": "long"
-                            },
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
-                        "user": {
+                        "span": {
                           "properties": {
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
-                        }
-                      }
-                    },
-                    "info": {
-                      "properties": {
-                        "ephemeral_id": {
-                          "type": "keyword"
                         },
-                        "uptime": {
+                        "transaction": {
                           "properties": {
-                            "ms": {
+                            "transformations": {
                               "type": "long"
                             }
                           }
                         }
                       }
                     },
-                    "memstats": {
-                      "properties": {
-                        "gc_next": {
-                          "type": "long"
-                        },
-                        "memory_alloc": {
-                          "type": "long"
-                        },
-                        "memory_total": {
-                          "type": "long"
-                        },
-                        "rss": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "handles": {
-                      "properties": {
-                        "open": {
-                          "type": "long"
-                        },
-                        "limit": {
-                          "properties": {
-                            "hard": {
-                              "type": "long"
-                            },
-                            "soft": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "apm-server": {
-                  "properties": {
                     "server": {
                       "properties": {
                         "request": {
@@ -246,17 +73,6 @@
                             }
                           }
                         },
-                        "concurrent": {
-                          "properties": {
-                            "wait": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "response": {
                           "properties": {
                             "count": {
@@ -264,53 +80,47 @@
                             },
                             "errors": {
                               "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "toolarge": {
+                                "closed": {
                                   "type": "long"
                                 },
-                                "validate": {
+                                "concurrency": {
                                   "type": "long"
                                 },
-                                "ratelimit": {
+                                "decode": {
                                   "type": "long"
                                 },
-                                "queue": {
+                                "forbidden": {
                                   "type": "long"
                                 },
-                                "closed": {
+                                "internal": {
                                   "type": "long"
                                 },
-                                "forbidden": {
+                                "method": {
                                   "type": "long"
                                 },
-                                "concurrency": {
+                                "queue": {
                                   "type": "long"
                                 },
-                                "unauthorized": {
+                                "ratelimit": {
                                   "type": "long"
                                 },
-                                "internal": {
+                                "toolarge": {
                                   "type": "long"
                                 },
-                                "decode": {
+                                "unauthorized": {
                                   "type": "long"
                                 },
-                                "method": {
+                                "validate": {
                                   "type": "long"
                                 }
                               }
                             },
                             "valid": {
                               "properties": {
-                                "ok": {
-                                  "type": "long"
-                                },
                                 "accepted": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "ok": {
                                   "type": "long"
                                 }
                               }
@@ -318,296 +128,109 @@
                           }
                         }
                       }
-                    },
-                    "decoder": {
+                    }
+                  }
+                },
+                "beat": {
+                  "properties": {
+                    "cpu": {
                       "properties": {
-                        "deflate": {
+                        "total": {
                           "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
+                            "value": {
                               "type": "long"
                             }
                           }
+                        }
+                      }
+                    },
+                    "handles": {
+                      "properties": {
+                        "open": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "info": {
+                      "properties": {
+                        "ephemeral_id": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "memstats": {
+                      "properties": {
+                        "gc_next": {
+                          "type": "long"
+                        },
+                        "memory_alloc": {
+                          "type": "long"
+                        },
+                        "memory_total": {
+                          "type": "long"
                         },
-                        "gzip": {
+                        "rss": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "libbeat": {
+                  "properties": {
+                    "output": {
+                      "properties": {
+                        "events": {
                           "properties": {
-                            "content-length": {
+                            "acked": {
                               "type": "long"
                             },
-                            "count": {
+                            "active": {
                               "type": "long"
-                            }
-                          }
-                        },
-                        "uncompressed": {
-                          "properties": {
-                            "content-length": {
+                            },
+                            "dropped": {
                               "type": "long"
                             },
-                            "count": {
+                            "failed": {
+                              "type": "long"
+                            },
+                            "total": {
                               "type": "long"
                             }
                           }
                         },
-                        "reader": {
+                        "read": {
                           "properties": {
-                            "size": {
+                            "bytes": {
                               "type": "long"
                             },
-                            "count": {
+                            "errors": {
                               "type": "long"
                             }
                           }
                         },
-                        "missing-content-length": {
+                        "write": {
                           "properties": {
-                            "count": {
+                            "bytes": {
+                              "type": "long"
+                            },
+                            "errors": {
                               "type": "long"
                             }
                           }
                         }
                       }
                     },
-                    "processor": {
-                      "properties": {
-                        "metric": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "sourcemap": {
-                          "properties": {
-                            "counter": {
-                              "type": "long"
-                            },
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "transaction": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            },
-                            "transactions": {
-                              "type": "long"
-                            },
-                            "spans": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "error": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            },
-                            "errors": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "span": {
-                          "properties": {
-                            "transformations": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "libbeat": {
-                  "properties": {
-                    "config": {
-                      "properties": {
-                        "module": {
-                          "properties": {
-                            "running": {
-                              "type": "long"
-                            },
-                            "starts": {
-                              "type": "long"
-                            },
-                            "stops": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reloads": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "output": {
+                    "pipeline": {
                       "properties": {
                         "events": {
                           "properties": {
-                            "acked": {
-                              "type": "long"
-                            },
-                            "active": {
-                              "type": "long"
-                            },
-                            "batches": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
-                            "duplicates": {
-                              "type": "long"
-                            },
                             "failed": {
                               "type": "long"
                             },
-                            "total": {
-                              "type": "long"
-                            },
-                            "toomany": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "read": {
-                          "properties": {
-                            "bytes": {
-                              "type": "long"
-                            },
-                            "errors": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "type": {
-                          "type": "keyword"
-                        },
-                        "write": {
-                          "properties": {
-                            "bytes": {
-                              "type": "long"
-                            },
-                            "errors": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "pipeline": {
-                      "properties": {
-                        "clients": {
-                          "type": "long"
-                        },
-                        "events": {
-                          "properties": {
-                            "active": {
-                              "type": "long"
-                            },
-                            "dropped": {
-                              "type": "long"
-                            },
-                            "failed": {
-                              "type": "long"
-                            },
-                            "filtered": {
-                              "type": "long"
-                            },
                             "published": {
                               "type": "long"
                             },
@@ -618,13 +241,6 @@
                               "type": "long"
                             }
                           }
-                        },
-                        "queue": {
-                          "properties": {
-                            "acked": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     }
@@ -637,24 +253,11 @@
                         "1": {
                           "type": "double"
                         },
-                        "5": {
-                          "type": "double"
-                        },
                         "15": {
                           "type": "double"
                         },
-                        "norm": {
-                          "properties": {
-                            "1": {
-                              "type": "double"
-                            },
-                            "5": {
-                              "type": "double"
-                            },
-                            "15": {
-                              "type": "double"
-                            }
-                          }
+                        "5": {
+                          "type": "double"
                         }
                       }
                     }
@@ -662,9 +265,6 @@
                 }
               }
             },
-            "tags": {
-              "type": "keyword"
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -674,25 +274,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
@@ -727,95 +318,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -823,86 +340,40 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
-                "memory": {
-                  "properties": {
-                    "heap": {
-                      "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
-                        "size_limit": {
-                          "type": "float"
-                        }
-                      }
-                    },
-                    "resident_set_size_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
                 "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
+                  "type": "float"
                 },
-                "https": {
+                "memory": {
                   "properties": {
-                    "total": {
-                      "type": "long"
+                    "heap": {
+                      "properties": {
+                        "size_limit": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "resident_set_size_in_bytes": {
+                      "type": "float"
                     }
                   }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -910,9 +381,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -926,10 +394,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -953,115 +435,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -1076,29 +490,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -1113,44 +510,9 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "refresh": {
                   "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -1159,42 +521,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -1203,36 +535,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -1251,14 +566,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -1267,24 +580,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -1294,41 +598,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -1337,68 +641,92 @@
             }
           }
         },
-        "cluster_stats": {
+        "indices_stats": {
           "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
+            "_all": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1419,15 +747,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1435,15 +754,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1462,116 +772,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1587,16 +878,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -1608,12 +893,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -1623,12 +902,6 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
@@ -1638,71 +911,10 @@
                 }
               }
             },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
             "thread_pool": {
               "properties": {
                 "bulk": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1713,9 +925,6 @@
                 },
                 "get": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1726,22 +935,6 @@
                 },
                 "index": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1752,22 +945,6 @@
                 },
                 "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1790,246 +967,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/singlecluster-green-gold/mappings.json b/x-pack/test/functional/es_archives/monitoring/singlecluster-green-gold/mappings.json
index bd411ee5178e2b..702f8731a31cad 100644
--- a/x-pack/test/functional/es_archives/monitoring/singlecluster-green-gold/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/singlecluster-green-gold/mappings.json
@@ -1,7 +1,8 @@
 {
   "type": "index",
   "value": {
-    "aliases": {},
+    "aliases": {
+    },
     "index": ".monitoring-kibana-6-2017.08.23",
     "mappings": {
       "dynamic": false,
@@ -9,95 +10,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -105,47 +32,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -155,36 +63,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -192,9 +73,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -208,10 +86,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -230,29 +122,15 @@
 {
   "type": "index",
   "value": {
-    "aliases": {},
+    "aliases": {
+    },
     "index": ".monitoring-alerts-6",
     "mappings": {
       "dynamic": false,
       "properties": {
-        "timestamp": {
-          "type": "date"
-        },
-        "update_timestamp": {
-          "type": "date"
-        },
-        "resolved_timestamp": {
-          "type": "date"
-        },
-        "prefix": {
-          "type": "text"
-        },
         "message": {
           "type": "text"
         },
-        "suffix": {
-          "type": "text"
-        },
         "metadata": {
           "properties": {
             "cluster_uuid": {
@@ -274,6 +152,21 @@
               "type": "keyword"
             }
           }
+        },
+        "prefix": {
+          "type": "text"
+        },
+        "resolved_timestamp": {
+          "type": "date"
+        },
+        "suffix": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "update_timestamp": {
+          "type": "date"
         }
       }
     },
@@ -292,7 +185,8 @@
 {
   "type": "index",
   "value": {
-    "aliases": {},
+    "aliases": {
+    },
     "index": ".monitoring-logstash-6-2017.08.23",
     "mappings": {
       "dynamic": false,
@@ -300,83 +194,25 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
-        "logstash_stats": {
-          "type": "object",
+        "logstash_state": {
           "properties": {
-            "logstash": {
+            "pipeline": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "http_address": {
-                  "type": "keyword"
-                },
-                "version": {
+                "hash": {
                   "type": "keyword"
                 },
-                "snapshot": {
-                  "type": "boolean"
-                },
-                "status": {
+                "id": {
                   "type": "keyword"
-                },
-                "pipeline": {
-                  "properties": {
-                    "workers": {
-                      "type": "short"
-                    },
-                    "batch_size": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
-            },
+            }
+          }
+        },
+        "logstash_stats": {
+          "properties": {
             "events": {
               "properties": {
-                "filtered": {
+                "duration_in_millis": {
                   "type": "long"
                 },
                 "in": {
@@ -384,210 +220,120 @@
                 },
                 "out": {
                   "type": "long"
-                },
-                "duration_in_millis": {
-                  "type": "long"
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "jvm": {
               "properties": {
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                },
                 "uptime_in_millis": {
                   "type": "long"
+                }
+              }
+            },
+            "logstash": {
+              "properties": {
+                "uuid": {
+                  "type": "keyword"
                 },
-                "gc": {
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "os": {
+              "properties": {
+                "cgroup": {
                   "properties": {
-                    "collectors": {
+                    "cpu": {
                       "properties": {
-                        "old": {
+                        "stat": {
                           "properties": {
-                            "collection_count": {
+                            "number_of_elapsed_periods": {
                               "type": "long"
                             },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "young": {
-                          "properties": {
-                            "collection_count": {
+                            "number_of_times_throttled": {
                               "type": "long"
                             },
-                            "collection_time_in_millis": {
+                            "time_throttled_nanos": {
                               "type": "long"
                             }
                           }
                         }
                       }
-                    }
-                  }
-                },
-                "mem": {
-                  "properties": {
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_in_bytes": {
-                      "type": "long"
                     },
-                    "heap_used_percent": {
-                      "type": "long"
+                    "cpuacct": {
+                      "properties": {
+                        "usage_nanos": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
-                }
-              }
-            },
-            "os": {
-              "properties": {
+                },
                 "cpu": {
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "1m": {
+                        "15m": {
                           "type": "half_float"
                         },
-                        "5m": {
+                        "1m": {
                           "type": "half_float"
                         },
-                        "15m": {
+                        "5m": {
                           "type": "half_float"
                         }
                       }
                     }
                   }
-                },
-                "cgroup": {
-                  "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "cpu": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "stat": {
-                          "properties": {
-                            "number_of_elapsed_periods": {
-                              "type": "long"
-                            },
-                            "number_of_times_throttled": {
-                              "type": "long"
-                            },
-                            "time_throttled_nanos": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "percent": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
-                }
-              }
-            },
-            "reloads": {
-              "properties": {
-                "failures": {
-                  "type": "long"
-                },
-                "successes": {
-                  "type": "long"
-                }
-              }
-            },
-            "queue": {
-              "properties": {
-                "events_count": {
-                  "type": "long"
-                },
-                "type": {
-                  "type": "keyword"
                 }
               }
             },
             "pipelines": {
-              "type": "nested",
               "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "hash": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
                 "events": {
                   "properties": {
-                    "in": {
-                      "type": "long"
-                    },
-                    "filtered": {
-                      "type": "long"
-                    },
-                    "out": {
-                      "type": "long"
-                    },
                     "duration_in_millis": {
                       "type": "long"
                     },
-                    "queue_push_duration_in_millis": {
+                    "out": {
                       "type": "long"
                     }
                   }
                 },
+                "hash": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
                 "queue": {
                   "properties": {
-                    "events_count": {
-                      "type": "long"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    },
                     "max_queue_size_in_bytes": {
                       "type": "long"
                     },
                     "queue_size_in_bytes": {
                       "type": "long"
+                    },
+                    "type": {
+                      "type": "keyword"
                     }
                   }
                 },
                 "vertices": {
-                  "type": "nested",
                   "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "pipeline_ephemeral_id": {
-                      "type": "keyword"
+                    "duration_in_millis": {
+                      "type": "long"
                     },
                     "events_in": {
                       "type": "long"
@@ -595,111 +341,63 @@
                     "events_out": {
                       "type": "long"
                     },
-                    "duration_in_millis": {
-                      "type": "long"
-                    },
-                    "queue_push_duration_in_millis": {
-                      "type": "long"
+                    "id": {
+                      "type": "keyword"
                     },
-                    "long_counters": {
-                      "type": "nested",
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "long"
-                        }
-                      }
+                    "pipeline_ephemeral_id": {
+                      "type": "keyword"
                     },
-                    "double_gauges": {
-                      "type": "nested",
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      }
+                    "queue_push_duration_in_millis": {
+                      "type": "float"
                     }
-                  }
-                },
-                "reloads": {
+                  },
+                  "type": "nested"
+                }
+              },
+              "type": "nested"
+            },
+            "process": {
+              "properties": {
+                "cpu": {
                   "properties": {
-                    "failures": {
-                      "type": "long"
-                    },
-                    "successes": {
+                    "percent": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "workers": {
-              "type": "short"
+            "queue": {
+              "properties": {
+                "events_count": {
+                  "type": "long"
+                }
+              }
             },
-            "batch_size": {
-              "type": "integer"
+            "timestamp": {
+              "type": "date"
             }
           }
         },
-        "logstash_state": {
+        "metricset": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "http_address": {
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
-            },
-            "snapshot": {
-              "type": "boolean"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "pipeline": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "hash": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "workers": {
-                  "type": "short"
-                },
-                "batch_size": {
-                  "type": "integer"
-                },
-                "format": {
-                  "type": "keyword"
-                },
-                "version": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
                   "type": "keyword"
-                },
-                "representation": {
-                  "enabled": false
                 }
-              }
+              },
+              "type": "text"
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -718,121 +416,54 @@
 {
   "type": "index",
   "value": {
-    "aliases": {},
+    "aliases": {
+    },
     "index": ".monitoring-es-6-2017.08.23",
     "mappings": {
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
+            }
+          }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -847,29 +478,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -884,44 +498,9 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "refresh": {
                   "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -930,42 +509,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -974,36 +523,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -1022,14 +554,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -1038,24 +568,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -1065,41 +586,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -1108,68 +629,92 @@
             }
           }
         },
-        "cluster_stats": {
-          "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
-            }
-          }
-        },
-        "cluster_state": {
-          "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
-            }
-          }
-        },
-        "node_stats": {
+        "indices_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "_all": {
               "properties": {
-                "docs": {
+                "primaries": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "job_stats": {
+          "properties": {
+            "job_id": {
+              "type": "keyword"
+            }
+          }
+        },
+        "node_stats": {
+          "properties": {
+            "fs": {
+              "properties": {
+                "io_stats": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1190,15 +735,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1206,15 +742,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1233,116 +760,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1358,16 +866,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -1379,12 +881,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -1394,12 +890,6 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
@@ -1409,71 +899,10 @@
                 }
               }
             },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
             "thread_pool": {
               "properties": {
                 "bulk": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1484,9 +913,6 @@
                 },
                 "get": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1497,22 +923,6 @@
                 },
                 "index": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1523,22 +933,6 @@
                 },
                 "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1561,246 +955,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/singlecluster-green-platinum/mappings.json b/x-pack/test/functional/es_archives/monitoring/singlecluster-green-platinum/mappings.json
index 0cae1b02ccacac..640b6f07f3470c 100644
--- a/x-pack/test/functional/es_archives/monitoring/singlecluster-green-platinum/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/singlecluster-green-platinum/mappings.json
@@ -8,95 +8,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -104,47 +30,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -154,36 +61,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -191,9 +71,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -207,10 +84,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -235,105 +126,6 @@
       "properties": {
         "beats_state": {
           "properties": {
-            "beat": {
-              "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "uuid": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "properties": {
-                "beat": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "host": {
-                  "properties": {
-                    "architecture": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "hostname": {
-                      "type": "keyword"
-                    },
-                    "os": {
-                      "properties": {
-                        "build": {
-                          "type": "keyword"
-                        },
-                        "family": {
-                          "type": "keyword"
-                        },
-                        "platform": {
-                          "type": "keyword"
-                        },
-                        "version": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "input": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "module": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "output": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "service": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "version": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -344,12 +136,6 @@
           "properties": {
             "beat": {
               "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
                 "type": {
                   "type": "keyword"
                 },
@@ -363,128 +149,49 @@
             },
             "metrics": {
               "properties": {
-                "beat": {
+                "apm-server": {
                   "properties": {
-                    "cpu": {
+                    "processor": {
                       "properties": {
-                        "system": {
+                        "error": {
                           "properties": {
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
-                        "total": {
+                        "metric": {
                           "properties": {
-                            "value": {
-                              "type": "long"
-                            },
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
                         },
-                        "user": {
+                        "span": {
                           "properties": {
-                            "ticks": {
+                            "transformations": {
                               "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
                             }
                           }
-                        }
-                      }
-                    },
-                    "info": {
-                      "properties": {
-                        "ephemeral_id": {
-                          "type": "keyword"
                         },
-                        "uptime": {
+                        "transaction": {
                           "properties": {
-                            "ms": {
+                            "transformations": {
                               "type": "long"
                             }
                           }
                         }
                       }
                     },
-                    "memstats": {
-                      "properties": {
-                        "gc_next": {
-                          "type": "long"
-                        },
-                        "memory_alloc": {
-                          "type": "long"
-                        },
-                        "memory_total": {
-                          "type": "long"
-                        },
-                        "rss": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "handles": {
+                    "server": {
                       "properties": {
-                        "open": {
-                          "type": "long"
-                        },
-                        "limit": {
+                        "request": {
                           "properties": {
-                            "hard": {
-                              "type": "long"
-                            },
-                            "soft": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "apm-server": {
-                  "properties": {
-                    "server": {
-                      "properties": {
-                        "request": {
-                          "properties": {
-                            "count": {
+                            "count": {
                               "type": "long"
                             }
                           }
                         },
-                        "concurrent": {
-                          "properties": {
-                            "wait": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
                         "response": {
                           "properties": {
                             "count": {
@@ -492,53 +199,47 @@
                             },
                             "errors": {
                               "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "toolarge": {
+                                "closed": {
                                   "type": "long"
                                 },
-                                "validate": {
+                                "concurrency": {
                                   "type": "long"
                                 },
-                                "ratelimit": {
+                                "decode": {
                                   "type": "long"
                                 },
-                                "queue": {
+                                "forbidden": {
                                   "type": "long"
                                 },
-                                "closed": {
+                                "internal": {
                                   "type": "long"
                                 },
-                                "forbidden": {
+                                "method": {
                                   "type": "long"
                                 },
-                                "concurrency": {
+                                "queue": {
                                   "type": "long"
                                 },
-                                "unauthorized": {
+                                "ratelimit": {
                                   "type": "long"
                                 },
-                                "internal": {
+                                "toolarge": {
                                   "type": "long"
                                 },
-                                "decode": {
+                                "unauthorized": {
                                   "type": "long"
                                 },
-                                "method": {
+                                "validate": {
                                   "type": "long"
                                 }
                               }
                             },
                             "valid": {
                               "properties": {
-                                "ok": {
-                                  "type": "long"
-                                },
                                 "accepted": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "ok": {
                                   "type": "long"
                                 }
                               }
@@ -546,195 +247,49 @@
                           }
                         }
                       }
-                    },
-                    "decoder": {
+                    }
+                  }
+                },
+                "beat": {
+                  "properties": {
+                    "cpu": {
                       "properties": {
-                        "deflate": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "gzip": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "uncompressed": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reader": {
-                          "properties": {
-                            "size": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "missing-content-length": {
+                        "total": {
                           "properties": {
-                            "count": {
+                            "value": {
                               "type": "long"
                             }
                           }
                         }
                       }
                     },
-                    "processor": {
+                    "handles": {
                       "properties": {
-                        "metric": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "sourcemap": {
-                          "properties": {
-                            "counter": {
-                              "type": "long"
-                            },
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
+                        "open": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "info": {
+                      "properties": {
+                        "ephemeral_id": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "memstats": {
+                      "properties": {
+                        "gc_next": {
+                          "type": "long"
                         },
-                        "transaction": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            },
-                            "transactions": {
-                              "type": "long"
-                            },
-                            "spans": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            }
-                          }
+                        "memory_alloc": {
+                          "type": "long"
                         },
-                        "error": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            },
-                            "errors": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            }
-                          }
+                        "memory_total": {
+                          "type": "long"
                         },
-                        "span": {
-                          "properties": {
-                            "transformations": {
-                              "type": "long"
-                            }
-                          }
+                        "rss": {
+                          "type": "long"
                         }
                       }
                     }
@@ -742,26 +297,6 @@
                 },
                 "libbeat": {
                   "properties": {
-                    "config": {
-                      "properties": {
-                        "module": {
-                          "properties": {
-                            "running": {
-                              "type": "long"
-                            },
-                            "starts": {
-                              "type": "long"
-                            },
-                            "stops": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "reloads": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "output": {
                       "properties": {
                         "events": {
@@ -772,23 +307,14 @@
                             "active": {
                               "type": "long"
                             },
-                            "batches": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
-                            "duplicates": {
-                              "type": "long"
-                            },
                             "failed": {
                               "type": "long"
                             },
                             "total": {
                               "type": "long"
-                            },
-                            "toomany": {
-                              "type": "long"
                             }
                           }
                         },
@@ -802,9 +328,6 @@
                             }
                           }
                         },
-                        "type": {
-                          "type": "keyword"
-                        },
                         "write": {
                           "properties": {
                             "bytes": {
@@ -819,23 +342,14 @@
                     },
                     "pipeline": {
                       "properties": {
-                        "clients": {
-                          "type": "long"
-                        },
                         "events": {
                           "properties": {
-                            "active": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
                             "failed": {
                               "type": "long"
                             },
-                            "filtered": {
-                              "type": "long"
-                            },
                             "published": {
                               "type": "long"
                             },
@@ -846,13 +360,6 @@
                               "type": "long"
                             }
                           }
-                        },
-                        "queue": {
-                          "properties": {
-                            "acked": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     }
@@ -865,24 +372,11 @@
                         "1": {
                           "type": "double"
                         },
-                        "5": {
-                          "type": "double"
-                        },
                         "15": {
                           "type": "double"
                         },
-                        "norm": {
-                          "properties": {
-                            "1": {
-                              "type": "double"
-                            },
-                            "5": {
-                              "type": "double"
-                            },
-                            "15": {
-                              "type": "double"
-                            }
-                          }
+                        "5": {
+                          "type": "double"
                         }
                       }
                     }
@@ -890,9 +384,6 @@
                 }
               }
             },
-            "tags": {
-              "type": "keyword"
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -902,25 +393,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
@@ -953,115 +435,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -1076,29 +490,64 @@
                     }
                   }
                 },
-                "fielddata": {
+                "indexing": {
                   "properties": {
-                    "memory_size_in_bytes": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "evictions": {
+                    "index_total": {
+                      "type": "long"
+                    },
+                    "throttle_time_in_millis": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "merges": {
+                  "properties": {
+                    "total_size_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
                 },
+                "segments": {
+                  "properties": {
+                    "count": {
+                      "type": "integer"
+                    }
+                  }
+                },
                 "store": {
                   "properties": {
                     "size_in_bytes": {
                       "type": "long"
                     }
                   }
+                }
+              }
+            },
+            "total": {
+              "properties": {
+                "fielddata": {
+                  "properties": {
+                    "memory_size_in_bytes": {
+                      "type": "long"
+                    }
+                  }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -1117,14 +566,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -1133,24 +580,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -1160,176 +598,85 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
-            },
-            "total": {
+            }
+          }
+        },
+        "indices_stats": {
+          "properties": {
+            "_all": {
               "properties": {
-                "docs": {
+                "primaries": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
-                "fielddata": {
+                "total": {
                   "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
                     },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "indexing": {
-                  "properties": {
-                    "index_total": {
-                      "type": "long"
-                    },
-                    "index_time_in_millis": {
-                      "type": "long"
-                    },
-                    "throttle_time_in_millis": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "merges": {
-                  "properties": {
-                    "total_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "segments": {
-                  "properties": {
-                    "count": {
-                      "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "refresh": {
-                  "properties": {
-                    "total_time_in_millis": {
-                      "type": "long"
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 }
@@ -1337,68 +684,49 @@
             }
           }
         },
-        "cluster_stats": {
-          "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
-            }
-          }
-        },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1419,15 +747,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1435,15 +754,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -1462,116 +772,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -1587,95 +878,21 @@
                         }
                       }
                     },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "cpu": {
-                  "properties": {
-                    "load_average": {
+                    "cpuacct": {
                       "properties": {
-                        "1m": {
-                          "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
+                        "usage_nanos": {
+                          "type": "long"
                         }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "cpu": {
-                  "properties": {
-                    "percent": {
-                      "type": "half_float"
-                    }
-                  }
-                }
-              }
-            },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
+                      }
+                    }
+                  }
+                },
+                "cpu": {
+                  "properties": {
+                    "load_average": {
+                      "properties": {
+                        "1m": {
+                          "type": "half_float"
                         }
                       }
                     }
@@ -1683,26 +900,21 @@
                 }
               }
             },
-            "thread_pool": {
+            "process": {
               "properties": {
-                "bulk": {
+                "cpu": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
+                    "percent": {
+                      "type": "half_float"
                     }
                   }
-                },
-                "generic": {
+                }
+              }
+            },
+            "thread_pool": {
+              "properties": {
+                "bulk": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1713,9 +925,6 @@
                 },
                 "get": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1726,22 +935,6 @@
                 },
                 "index": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1752,22 +945,6 @@
                 },
                 "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1790,246 +967,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -2052,24 +1024,9 @@
     "mappings": {
       "dynamic": false,
       "properties": {
-        "timestamp": {
-          "type": "date"
-        },
-        "update_timestamp": {
-          "type": "date"
-        },
-        "resolved_timestamp": {
-          "type": "date"
-        },
-        "prefix": {
-          "type": "text"
-        },
         "message": {
           "type": "text"
         },
-        "suffix": {
-          "type": "text"
-        },
         "metadata": {
           "properties": {
             "cluster_uuid": {
@@ -2091,6 +1048,21 @@
               "type": "keyword"
             }
           }
+        },
+        "prefix": {
+          "type": "text"
+        },
+        "resolved_timestamp": {
+          "type": "date"
+        },
+        "suffix": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "update_timestamp": {
+          "type": "date"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/singlecluster-green-trial-two-nodes-one-cgrouped/mappings.json b/x-pack/test/functional/es_archives/monitoring/singlecluster-green-trial-two-nodes-one-cgrouped/mappings.json
index babf4398a8502e..6e6847a5fe30b7 100644
--- a/x-pack/test/functional/es_archives/monitoring/singlecluster-green-trial-two-nodes-one-cgrouped/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/singlecluster-green-trial-two-nodes-one-cgrouped/mappings.json
@@ -8,95 +8,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -104,47 +30,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -154,36 +61,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -191,9 +71,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -207,10 +84,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -234,115 +125,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -357,29 +180,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -394,44 +200,9 @@
                     }
                   }
                 },
-                "query_cache": {
+                "refresh": {
                   "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -440,42 +211,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -484,36 +225,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -532,14 +256,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -548,24 +270,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -575,41 +288,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -618,68 +331,92 @@
             }
           }
         },
-        "cluster_stats": {
+        "indices_stats": {
           "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
+            "_all": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -700,15 +437,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -716,15 +444,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -743,116 +462,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -868,16 +568,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -889,12 +583,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -904,12 +592,6 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
@@ -919,71 +601,10 @@
                 }
               }
             },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
             "thread_pool": {
               "properties": {
                 "bulk": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -994,9 +615,6 @@
                 },
                 "get": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1007,22 +625,6 @@
                 },
                 "index": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1033,22 +635,6 @@
                 },
                 "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1071,246 +657,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/singlecluster-red-platinum/mappings.json b/x-pack/test/functional/es_archives/monitoring/singlecluster-red-platinum/mappings.json
index b835ca4fdaf651..115d2fff4a4ac8 100644
--- a/x-pack/test/functional/es_archives/monitoring/singlecluster-red-platinum/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/singlecluster-red-platinum/mappings.json
@@ -6,115 +6,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -129,29 +61,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -166,44 +81,9 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "refresh": {
                   "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -212,42 +92,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -256,36 +106,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -304,14 +137,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -320,24 +151,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -347,41 +169,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -390,68 +212,92 @@
             }
           }
         },
-        "cluster_stats": {
+        "indices_stats": {
           "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
+            "_all": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -472,15 +318,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -488,15 +325,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -515,116 +343,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -640,16 +449,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -661,12 +464,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -676,413 +473,106 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
                       "type": "half_float"
                     }
-                  }
-                }
-              }
-            },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "thread_pool": {
-              "properties": {
-                "bulk": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "get": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "index": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "write": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "index_recovery": {
-          "type": "object"
-        },
-        "shard": {
-          "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
-            "index": {
-              "type": "keyword"
-            },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
-            "node": {
-              "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
-            },
-            "state": {
-              "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "ccr_stats": {
-          "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
-              "type": "keyword"
-            },
-            "follower_index": {
-              "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
+                  }
+                }
+              }
             },
-            "read_exceptions": {
-              "type": "nested",
+            "thread_pool": {
               "properties": {
-                "from_seq_no": {
-                  "type": "long"
+                "bulk": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 },
-                "retries": {
-                  "type": "integer"
+                "get": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 },
-                "exception": {
-                  "type": "object",
+                "index": {
                   "properties": {
-                    "type": {
-                      "type": "keyword"
+                    "queue": {
+                      "type": "integer"
                     },
-                    "reason": {
-                      "type": "text"
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "search": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
                     }
                   }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
                 },
-                "reason": {
-                  "type": "text"
+                "write": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 }
               }
             }
           }
         },
-        "ccr_auto_follow_stats": {
+        "shard": {
           "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
+            "index": {
+              "type": "keyword"
             },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
+            "node": {
+              "type": "keyword"
             },
-            "number_of_successful_follow_indices": {
-              "type": "long"
+            "primary": {
+              "type": "boolean"
             },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
+            "state": {
+              "type": "keyword"
+            }
+          }
+        },
+        "source_node": {
+          "properties": {
+            "name": {
+              "type": "keyword"
             },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
+            "uuid": {
+              "type": "keyword"
             }
           }
+        },
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -1107,95 +597,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -1203,47 +619,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -1253,36 +650,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -1290,9 +660,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -1306,10 +673,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -1331,24 +712,9 @@
     "mappings": {
       "dynamic": false,
       "properties": {
-        "timestamp": {
-          "type": "date"
-        },
-        "update_timestamp": {
-          "type": "date"
-        },
-        "resolved_timestamp": {
-          "type": "date"
-        },
-        "prefix": {
-          "type": "text"
-        },
         "message": {
           "type": "text"
         },
-        "suffix": {
-          "type": "text"
-        },
         "metadata": {
           "properties": {
             "cluster_uuid": {
@@ -1370,6 +736,21 @@
               "type": "keyword"
             }
           }
+        },
+        "prefix": {
+          "type": "text"
+        },
+        "resolved_timestamp": {
+          "type": "date"
+        },
+        "suffix": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "update_timestamp": {
+          "type": "date"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/singlecluster-three-nodes-shard-relocation/mappings.json b/x-pack/test/functional/es_archives/monitoring/singlecluster-three-nodes-shard-relocation/mappings.json
index d1101b9fb46594..f8edb978c0add0 100644
--- a/x-pack/test/functional/es_archives/monitoring/singlecluster-three-nodes-shard-relocation/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/singlecluster-three-nodes-shard-relocation/mappings.json
@@ -8,95 +8,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -104,47 +30,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -154,36 +61,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -191,9 +71,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -207,10 +84,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -232,24 +123,9 @@
     "mappings": {
       "dynamic": false,
       "properties": {
-        "timestamp": {
-          "type": "date"
-        },
-        "update_timestamp": {
-          "type": "date"
-        },
-        "resolved_timestamp": {
-          "type": "date"
-        },
-        "prefix": {
-          "type": "text"
-        },
         "message": {
           "type": "text"
         },
-        "suffix": {
-          "type": "text"
-        },
         "metadata": {
           "properties": {
             "cluster_uuid": {
@@ -271,6 +147,21 @@
               "type": "keyword"
             }
           }
+        },
+        "prefix": {
+          "type": "text"
+        },
+        "resolved_timestamp": {
+          "type": "date"
+        },
+        "suffix": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "update_timestamp": {
+          "type": "date"
         }
       }
     },
@@ -295,83 +186,25 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
-        "logstash_stats": {
-          "type": "object",
+        "logstash_state": {
           "properties": {
-            "logstash": {
+            "pipeline": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "http_address": {
-                  "type": "keyword"
-                },
-                "version": {
+                "hash": {
                   "type": "keyword"
                 },
-                "snapshot": {
-                  "type": "boolean"
-                },
-                "status": {
+                "id": {
                   "type": "keyword"
-                },
-                "pipeline": {
-                  "properties": {
-                    "workers": {
-                      "type": "short"
-                    },
-                    "batch_size": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
-            },
+            }
+          }
+        },
+        "logstash_stats": {
+          "properties": {
             "events": {
               "properties": {
-                "filtered": {
+                "duration_in_millis": {
                   "type": "long"
                 },
                 "in": {
@@ -379,48 +212,11 @@
                 },
                 "out": {
                   "type": "long"
-                },
-                "duration_in_millis": {
-                  "type": "long"
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "jvm": {
               "properties": {
-                "uptime_in_millis": {
-                  "type": "long"
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
                 "mem": {
                   "properties": {
                     "heap_max_in_bytes": {
@@ -428,50 +224,30 @@
                     },
                     "heap_used_in_bytes": {
                       "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "long"
                     }
                   }
-                }
-              }
+                },
+                "uptime_in_millis": {
+                  "type": "long"
+                }
+              }
             },
-            "os": {
+            "logstash": {
               "properties": {
-                "cpu": {
-                  "properties": {
-                    "load_average": {
-                      "properties": {
-                        "1m": {
-                          "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
-                        }
-                      }
-                    }
-                  }
+                "uuid": {
+                  "type": "keyword"
                 },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "os": {
+              "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -486,103 +262,70 @@
                           }
                         }
                       }
+                    },
+                    "cpuacct": {
+                      "properties": {
+                        "usage_nanos": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
-                }
-              }
-            },
-            "process": {
-              "properties": {
+                },
                 "cpu": {
                   "properties": {
-                    "percent": {
-                      "type": "long"
+                    "load_average": {
+                      "properties": {
+                        "15m": {
+                          "type": "half_float"
+                        },
+                        "1m": {
+                          "type": "half_float"
+                        },
+                        "5m": {
+                          "type": "half_float"
+                        }
+                      }
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
-                }
-              }
-            },
-            "reloads": {
-              "properties": {
-                "failures": {
-                  "type": "long"
-                },
-                "successes": {
-                  "type": "long"
-                }
-              }
-            },
-            "queue": {
-              "properties": {
-                "events_count": {
-                  "type": "long"
-                },
-                "type": {
-                  "type": "keyword"
                 }
               }
             },
             "pipelines": {
-              "type": "nested",
               "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "hash": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
                 "events": {
                   "properties": {
-                    "in": {
-                      "type": "long"
-                    },
-                    "filtered": {
-                      "type": "long"
-                    },
-                    "out": {
-                      "type": "long"
-                    },
                     "duration_in_millis": {
                       "type": "long"
                     },
-                    "queue_push_duration_in_millis": {
+                    "out": {
                       "type": "long"
                     }
                   }
                 },
+                "hash": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
                 "queue": {
                   "properties": {
-                    "events_count": {
-                      "type": "long"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    },
                     "max_queue_size_in_bytes": {
                       "type": "long"
                     },
                     "queue_size_in_bytes": {
                       "type": "long"
+                    },
+                    "type": {
+                      "type": "keyword"
                     }
                   }
                 },
                 "vertices": {
-                  "type": "nested",
                   "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "pipeline_ephemeral_id": {
-                      "type": "keyword"
+                    "duration_in_millis": {
+                      "type": "long"
                     },
                     "events_in": {
                       "type": "long"
@@ -590,111 +333,63 @@
                     "events_out": {
                       "type": "long"
                     },
-                    "duration_in_millis": {
-                      "type": "long"
-                    },
-                    "queue_push_duration_in_millis": {
-                      "type": "long"
+                    "id": {
+                      "type": "keyword"
                     },
-                    "long_counters": {
-                      "type": "nested",
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "long"
-                        }
-                      }
+                    "pipeline_ephemeral_id": {
+                      "type": "keyword"
                     },
-                    "double_gauges": {
-                      "type": "nested",
-                      "properties": {
-                        "name": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      }
+                    "queue_push_duration_in_millis": {
+                      "type": "float"
                     }
-                  }
-                },
-                "reloads": {
+                  },
+                  "type": "nested"
+                }
+              },
+              "type": "nested"
+            },
+            "process": {
+              "properties": {
+                "cpu": {
                   "properties": {
-                    "failures": {
-                      "type": "long"
-                    },
-                    "successes": {
+                    "percent": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "workers": {
-              "type": "short"
+            "queue": {
+              "properties": {
+                "events_count": {
+                  "type": "long"
+                }
+              }
             },
-            "batch_size": {
-              "type": "integer"
+            "timestamp": {
+              "type": "date"
             }
           }
         },
-        "logstash_state": {
+        "metricset": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "http_address": {
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
-            },
-            "snapshot": {
-              "type": "boolean"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "pipeline": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "hash": {
-                  "type": "keyword"
-                },
-                "ephemeral_id": {
-                  "type": "keyword"
-                },
-                "workers": {
-                  "type": "short"
-                },
-                "batch_size": {
-                  "type": "integer"
-                },
-                "format": {
-                  "type": "keyword"
-                },
-                "version": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
                   "type": "keyword"
-                },
-                "representation": {
-                  "enabled": false
                 }
-              }
+              },
+              "type": "text"
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -717,115 +412,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -840,29 +467,64 @@
                     }
                   }
                 },
-                "fielddata": {
+                "indexing": {
                   "properties": {
-                    "memory_size_in_bytes": {
+                    "index_time_in_millis": {
+                      "type": "long"
+                    },
+                    "index_total": {
                       "type": "long"
                     },
-                    "evictions": {
+                    "throttle_time_in_millis": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "merges": {
+                  "properties": {
+                    "total_size_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "segments": {
+                  "properties": {
+                    "count": {
+                      "type": "integer"
+                    }
+                  }
+                },
                 "store": {
                   "properties": {
                     "size_in_bytes": {
                       "type": "long"
                     }
                   }
+                }
+              }
+            },
+            "total": {
+              "properties": {
+                "fielddata": {
+                  "properties": {
+                    "memory_size_in_bytes": {
+                      "type": "long"
+                    }
+                  }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -881,14 +543,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -897,24 +557,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -924,79 +575,144 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
-            },
-            "total": {
+            }
+          }
+        },
+        "indices_stats": {
+          "properties": {
+            "_all": {
               "properties": {
-                "docs": {
+                "primaries": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
-                "fielddata": {
+                "total": {
                   "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
                     },
-                    "evictions": {
-                      "type": "long"
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "job_stats": {
+          "properties": {
+            "job_id": {
+              "type": "keyword"
+            }
+          }
+        },
+        "node_stats": {
+          "properties": {
+            "fs": {
+              "properties": {
+                "io_stats": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
-                "store": {
+                "total": {
                   "properties": {
-                    "size_in_bytes": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
+                "fielddata": {
+                  "properties": {
+                    "memory_size_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -1004,51 +720,26 @@
                     }
                   }
                 },
-                "merges": {
+                "query_cache": {
                   "properties": {
-                    "total_size_in_bytes": {
+                    "memory_size_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "query_cache": {
+                "request_cache": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
-                "request_cache": {
+                "search": {
                   "properties": {
-                    "memory_size_in_bytes": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -1058,178 +749,19 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
                     "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
                     "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "refresh": {
-                  "properties": {
-                    "total_time_in_millis": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
-            }
-          }
-        },
-        "cluster_state": {
-          "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
-            }
-          }
-        },
-        "node_stats": {
-          "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
-              "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
                     },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "indexing": {
-                  "properties": {
-                    "index_time_in_millis": {
-                      "type": "long"
-                    },
-                    "index_total": {
-                      "type": "long"
-                    },
-                    "throttle_time_in_millis": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "segments": {
-                  "properties": {
-                    "count": {
-                      "type": "integer"
                     },
                     "memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
                     "points_memory_in_bytes": {
@@ -1241,232 +773,125 @@
                     "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
                     "version_map_memory_in_bytes": {
                       "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
-                        "write_kilobytes": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "os": {
+            "jvm": {
               "properties": {
-                "cgroup": {
+                "gc": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "cpu": {
+                    "collectors": {
                       "properties": {
-                        "cfs_quota_micros": {
-                          "type": "long"
-                        },
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "stat": {
+                        "old": {
                           "properties": {
-                            "number_of_elapsed_periods": {
+                            "collection_count": {
                               "type": "long"
                             },
-                            "number_of_times_throttled": {
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "young": {
+                          "properties": {
+                            "collection_count": {
                               "type": "long"
                             },
-                            "time_throttled_nanos": {
+                            "collection_time_in_millis": {
                               "type": "long"
                             }
                           }
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "cpu": {
-                  "properties": {
-                    "load_average": {
-                      "properties": {
-                        "1m": {
-                          "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
-                        }
-                      }
                     }
                   }
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
                 },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "cpu": {
-                  "properties": {
-                    "percent": {
-                      "type": "half_float"
-                    }
-                  }
-                }
-              }
-            },
-            "jvm": {
-              "properties": {
                 "mem": {
                   "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
                     "heap_used_in_bytes": {
                       "type": "long"
                     },
                     "heap_used_percent": {
                       "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
                     }
                   }
-                },
-                "gc": {
+                }
+              }
+            },
+            "node_id": {
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "cgroup": {
                   "properties": {
-                    "collectors": {
+                    "cpu": {
                       "properties": {
-                        "young": {
+                        "cfs_quota_micros": {
+                          "type": "long"
+                        },
+                        "stat": {
                           "properties": {
-                            "collection_count": {
+                            "number_of_elapsed_periods": {
                               "type": "long"
                             },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
+                            "number_of_times_throttled": {
                               "type": "long"
                             },
-                            "collection_time_in_millis": {
+                            "time_throttled_nanos": {
                               "type": "long"
                             }
                           }
                         }
                       }
+                    },
+                    "cpuacct": {
+                      "properties": {
+                        "usage_nanos": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "cpu": {
+                  "properties": {
+                    "load_average": {
+                      "properties": {
+                        "1m": {
+                          "type": "half_float"
+                        }
+                      }
                     }
                   }
                 }
               }
             },
-            "thread_pool": {
+            "process": {
               "properties": {
-                "bulk": {
+                "cpu": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
+                    "percent": {
+                      "type": "half_float"
                     }
                   }
-                },
-                "generic": {
+                }
+              }
+            },
+            "thread_pool": {
+              "properties": {
+                "bulk": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1477,9 +902,6 @@
                 },
                 "get": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1490,22 +912,6 @@
                 },
                 "index": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1516,22 +922,6 @@
                 },
                 "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -1554,246 +944,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-basic/mappings.json b/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-basic/mappings.json
index ce8427c5cd657d..0715e68298b16e 100644
--- a/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-basic/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-basic/mappings.json
@@ -6,115 +6,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -129,29 +61,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -166,44 +81,9 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "refresh": {
                   "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -212,42 +92,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -256,36 +106,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -304,14 +137,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -320,24 +151,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -347,41 +169,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -390,68 +212,92 @@
             }
           }
         },
-        "cluster_stats": {
+        "indices_stats": {
           "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
+            "_all": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -472,15 +318,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -488,15 +325,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -515,116 +343,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -640,16 +449,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -661,12 +464,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -676,12 +473,6 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
@@ -691,71 +482,10 @@
                 }
               }
             },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
             "thread_pool": {
               "properties": {
                 "bulk": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -766,9 +496,6 @@
                 },
                 "get": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -779,22 +506,6 @@
                 },
                 "index": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -805,22 +516,6 @@
                 },
                 "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -843,246 +538,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -1104,24 +594,9 @@
     "mappings": {
       "dynamic": false,
       "properties": {
-        "timestamp": {
-          "type": "date"
-        },
-        "update_timestamp": {
-          "type": "date"
-        },
-        "resolved_timestamp": {
-          "type": "date"
-        },
-        "prefix": {
-          "type": "text"
-        },
         "message": {
           "type": "text"
         },
-        "suffix": {
-          "type": "text"
-        },
         "metadata": {
           "properties": {
             "cluster_uuid": {
@@ -1143,6 +618,21 @@
               "type": "keyword"
             }
           }
+        },
+        "prefix": {
+          "type": "text"
+        },
+        "resolved_timestamp": {
+          "type": "date"
+        },
+        "suffix": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "update_timestamp": {
+          "type": "date"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-platinum--with-10-alerts/mappings.json b/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-platinum--with-10-alerts/mappings.json
index 07ba8e2f5b814e..c1552898816b73 100644
--- a/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-platinum--with-10-alerts/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-platinum--with-10-alerts/mappings.json
@@ -6,115 +6,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -129,29 +61,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -166,44 +81,9 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "refresh": {
                   "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -212,42 +92,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -256,36 +106,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -304,14 +137,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -320,24 +151,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -347,41 +169,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -390,68 +212,92 @@
             }
           }
         },
-        "cluster_stats": {
+        "indices_stats": {
           "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
+            "_all": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -472,15 +318,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -488,15 +325,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -515,116 +343,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -640,16 +449,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -661,12 +464,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -676,413 +473,106 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
                       "type": "half_float"
                     }
-                  }
-                }
-              }
-            },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "thread_pool": {
-              "properties": {
-                "bulk": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "get": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "index": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "write": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "index_recovery": {
-          "type": "object"
-        },
-        "shard": {
-          "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
-            "index": {
-              "type": "keyword"
-            },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
-            "node": {
-              "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
-            },
-            "state": {
-              "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "ccr_stats": {
-          "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
-              "type": "keyword"
-            },
-            "follower_index": {
-              "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
+                  }
+                }
+              }
             },
-            "read_exceptions": {
-              "type": "nested",
+            "thread_pool": {
               "properties": {
-                "from_seq_no": {
-                  "type": "long"
+                "bulk": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 },
-                "retries": {
-                  "type": "integer"
+                "get": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 },
-                "exception": {
-                  "type": "object",
+                "index": {
                   "properties": {
-                    "type": {
-                      "type": "keyword"
+                    "queue": {
+                      "type": "integer"
                     },
-                    "reason": {
-                      "type": "text"
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "search": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
                     }
                   }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
                 },
-                "reason": {
-                  "type": "text"
+                "write": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 }
               }
             }
           }
         },
-        "ccr_auto_follow_stats": {
+        "shard": {
           "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
+            "index": {
+              "type": "keyword"
             },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
+            "node": {
+              "type": "keyword"
             },
-            "number_of_successful_follow_indices": {
-              "type": "long"
+            "primary": {
+              "type": "boolean"
             },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
+            "state": {
+              "type": "keyword"
+            }
+          }
+        },
+        "source_node": {
+          "properties": {
+            "name": {
+              "type": "keyword"
             },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
+            "uuid": {
+              "type": "keyword"
             }
           }
+        },
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -1104,24 +594,9 @@
     "mappings": {
       "dynamic": false,
       "properties": {
-        "timestamp": {
-          "type": "date"
-        },
-        "update_timestamp": {
-          "type": "date"
-        },
-        "resolved_timestamp": {
-          "type": "date"
-        },
-        "prefix": {
-          "type": "text"
-        },
         "message": {
           "type": "text"
         },
-        "suffix": {
-          "type": "text"
-        },
         "metadata": {
           "properties": {
             "cluster_uuid": {
@@ -1143,6 +618,21 @@
               "type": "keyword"
             }
           }
+        },
+        "prefix": {
+          "type": "text"
+        },
+        "resolved_timestamp": {
+          "type": "date"
+        },
+        "suffix": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "update_timestamp": {
+          "type": "date"
         }
       }
     },
@@ -1167,95 +657,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -1263,47 +679,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -1313,36 +710,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -1350,9 +720,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -1366,10 +733,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-platinum/mappings.json b/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-platinum/mappings.json
index 07ba8e2f5b814e..c1552898816b73 100644
--- a/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-platinum/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/singlecluster-yellow-platinum/mappings.json
@@ -6,115 +6,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -129,29 +61,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -166,44 +81,9 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "refresh": {
                   "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -212,42 +92,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -256,36 +106,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -304,14 +137,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -320,24 +151,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -347,41 +169,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -390,68 +212,92 @@
             }
           }
         },
-        "cluster_stats": {
+        "indices_stats": {
           "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
+            "_all": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -472,15 +318,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -488,15 +325,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -515,116 +343,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -640,16 +449,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -661,12 +464,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -676,413 +473,106 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
                       "type": "half_float"
                     }
-                  }
-                }
-              }
-            },
-            "jvm": {
-              "properties": {
-                "mem": {
-                  "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
-                    },
-                    "heap_used_percent": {
-                      "type": "half_float"
-                    },
-                    "heap_max_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "thread_pool": {
-              "properties": {
-                "bulk": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "get": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "index": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "write": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "index_recovery": {
-          "type": "object"
-        },
-        "shard": {
-          "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
-            "index": {
-              "type": "keyword"
-            },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
-            "node": {
-              "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
-            },
-            "state": {
-              "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "ccr_stats": {
-          "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
-              "type": "keyword"
-            },
-            "follower_index": {
-              "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
+                  }
+                }
+              }
             },
-            "read_exceptions": {
-              "type": "nested",
+            "thread_pool": {
               "properties": {
-                "from_seq_no": {
-                  "type": "long"
+                "bulk": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 },
-                "retries": {
-                  "type": "integer"
+                "get": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 },
-                "exception": {
-                  "type": "object",
+                "index": {
                   "properties": {
-                    "type": {
-                      "type": "keyword"
+                    "queue": {
+                      "type": "integer"
                     },
-                    "reason": {
-                      "type": "text"
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "search": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
                     }
                   }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
                 },
-                "reason": {
-                  "type": "text"
+                "write": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
                 }
               }
             }
           }
         },
-        "ccr_auto_follow_stats": {
+        "shard": {
           "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
+            "index": {
+              "type": "keyword"
             },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
+            "node": {
+              "type": "keyword"
             },
-            "number_of_successful_follow_indices": {
-              "type": "long"
+            "primary": {
+              "type": "boolean"
             },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
+            "state": {
+              "type": "keyword"
+            }
+          }
+        },
+        "source_node": {
+          "properties": {
+            "name": {
+              "type": "keyword"
             },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
+            "uuid": {
+              "type": "keyword"
             }
           }
+        },
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -1104,24 +594,9 @@
     "mappings": {
       "dynamic": false,
       "properties": {
-        "timestamp": {
-          "type": "date"
-        },
-        "update_timestamp": {
-          "type": "date"
-        },
-        "resolved_timestamp": {
-          "type": "date"
-        },
-        "prefix": {
-          "type": "text"
-        },
         "message": {
           "type": "text"
         },
-        "suffix": {
-          "type": "text"
-        },
         "metadata": {
           "properties": {
             "cluster_uuid": {
@@ -1143,6 +618,21 @@
               "type": "keyword"
             }
           }
+        },
+        "prefix": {
+          "type": "text"
+        },
+        "resolved_timestamp": {
+          "type": "date"
+        },
+        "suffix": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "update_timestamp": {
+          "type": "date"
         }
       }
     },
@@ -1167,95 +657,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -1263,47 +679,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -1313,36 +710,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
-                }
-              }
-            },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -1350,9 +720,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -1366,10 +733,24 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
+            "timestamp": {
+              "type": "date"
+            },
+            "usage": {
+              "properties": {
+                "index": {
+                  "type": "keyword"
+                }
+              }
             }
           }
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
diff --git a/x-pack/test/functional/es_archives/monitoring/singlecluster_lots_of_nodes/mappings.json b/x-pack/test/functional/es_archives/monitoring/singlecluster_lots_of_nodes/mappings.json
index 7b75f0d15292dc..d709a40befe3e7 100644
--- a/x-pack/test/functional/es_archives/monitoring/singlecluster_lots_of_nodes/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/singlecluster_lots_of_nodes/mappings.json
@@ -8,96 +8,14 @@
       "date_detection": false,
       "dynamic": "false",
       "properties": {
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "auto_followed_clusters": {
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            },
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "properties": {
-                "auto_follow_exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                }
-              },
-              "type": "nested"
-            }
-          }
-        },
         "ccr_stats": {
           "properties": {
-            "bytes_read": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "properties": {
-                "reason": {
-                  "type": "text"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "follower_aliases_version": {
-              "type": "long"
-            },
             "follower_global_checkpoint": {
               "type": "long"
             },
             "follower_index": {
               "type": "keyword"
             },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
             "leader_global_checkpoint": {
               "type": "long"
             },
@@ -107,112 +25,30 @@
             "leader_max_seq_no": {
               "type": "long"
             },
-            "operations_read": {
-              "type": "long"
-            },
             "operations_written": {
               "type": "long"
             },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "properties": {
-                "exception": {
-                  "properties": {
-                    "reason": {
-                      "type": "text"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                }
-              },
-              "type": "nested"
-            },
             "remote_cluster": {
               "type": "keyword"
             },
             "shard_id": {
               "type": "integer"
             },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
             "time_since_last_read_millis": {
               "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
             }
           }
         },
         "cluster_state": {
           "properties": {
-            "master_node": {
-              "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
             "nodes_hash": {
               "type": "integer"
-            },
-            "shards": {
-              "type": "object"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "long"
-            }
-          }
-        },
-        "cluster_stats": {
-          "properties": {
-            "indices": {
-              "type": "object"
-            },
-            "nodes": {
-              "type": "object"
             }
           }
         },
         "cluster_uuid": {
           "type": "keyword"
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "index_stats": {
           "properties": {
             "index": {
@@ -227,16 +63,6 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
                     "index_time_in_millis": {
@@ -257,22 +83,6 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "refresh": {
                   "properties": {
                     "total_time_in_millis": {
@@ -280,66 +90,10 @@
                     }
                   }
                 },
-                "request_cache": {
-                  "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
-                  "properties": {
-                    "query_time_in_millis": {
-                      "type": "long"
-                    },
-                    "query_total": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "segments": {
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
@@ -354,18 +108,8 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -393,17 +137,8 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -416,17 +151,8 @@
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -494,13 +220,6 @@
               "properties": {
                 "primaries": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
                         "index_time_in_millis": {
@@ -510,33 +229,13 @@
                           "type": "long"
                         }
                       }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_time_in_millis": {
-                          "type": "long"
-                        },
-                        "query_total": {
-                          "type": "long"
-                        }
-                      }
                     }
                   }
                 },
                 "total": {
                   "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "indexing": {
                       "properties": {
-                        "index_time_in_millis": {
-                          "type": "long"
-                        },
                         "index_total": {
                           "type": "long"
                         }
@@ -558,58 +257,10 @@
             }
           }
         },
-        "interval_ms": {
-          "type": "long"
-        },
         "job_stats": {
           "properties": {
-            "data_counts": {
-              "properties": {
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "input_bytes": {
-                  "type": "long"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                }
-              }
-            },
             "job_id": {
               "type": "keyword"
-            },
-            "model_size_stats": {
-              "properties": {
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                },
-                "model_bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "type": "keyword"
             }
           }
         },
@@ -617,13 +268,6 @@
           "properties": {
             "fs": {
               "properties": {
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
                 "io_stats": {
                   "properties": {
                     "total": {
@@ -631,15 +275,9 @@
                         "operations": {
                           "type": "long"
                         },
-                        "read_kilobytes": {
-                          "type": "long"
-                        },
                         "read_operations": {
                           "type": "long"
                         },
-                        "write_kilobytes": {
-                          "type": "long"
-                        },
                         "write_operations": {
                           "type": "long"
                         }
@@ -651,12 +289,6 @@
                   "properties": {
                     "available_in_bytes": {
                       "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "total_in_bytes": {
-                      "type": "long"
                     }
                   }
                 }
@@ -664,18 +296,8 @@
             },
             "indices": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
                     }
@@ -696,33 +318,15 @@
                 },
                 "query_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "request_cache": {
                   "properties": {
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -772,13 +376,6 @@
                       "type": "long"
                     }
                   }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
                 }
               }
             },
@@ -827,15 +424,9 @@
                 }
               }
             },
-            "mlockall": {
-              "type": "boolean"
-            },
             "node_id": {
               "type": "keyword"
             },
-            "node_master": {
-              "type": "boolean"
-            },
             "os": {
               "properties": {
                 "cgroup": {
@@ -845,9 +436,6 @@
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -865,26 +453,10 @@
                     },
                     "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "usage_nanos": {
                           "type": "long"
                         }
                       }
-                    },
-                    "memory": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
-                        }
-                      }
                     }
                   }
                 },
@@ -892,14 +464,8 @@
                   "properties": {
                     "load_average": {
                       "properties": {
-                        "15m": {
-                          "type": "half_float"
-                        },
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -915,12 +481,6 @@
                       "type": "half_float"
                     }
                   }
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
-                "open_file_descriptors": {
-                  "type": "long"
                 }
               }
             },
@@ -933,22 +493,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -959,9 +503,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -972,22 +513,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -998,22 +523,6 @@
                     },
                     "rejected": {
                       "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    },
-                    "threads": {
-                      "type": "integer"
                     }
                   }
                 },
@@ -1042,12 +551,6 @@
             "primary": {
               "type": "boolean"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "state": {
               "type": "keyword"
             }
@@ -1055,22 +558,9 @@
         },
         "source_node": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
               "type": "keyword"
             },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
             "uuid": {
               "type": "keyword"
             }
diff --git a/x-pack/test/functional/es_archives/monitoring/standalone_cluster/mappings.json b/x-pack/test/functional/es_archives/monitoring/standalone_cluster/mappings.json
index e1b952ef647d9b..9ad3eef67cbd33 100644
--- a/x-pack/test/functional/es_archives/monitoring/standalone_cluster/mappings.json
+++ b/x-pack/test/functional/es_archives/monitoring/standalone_cluster/mappings.json
@@ -6,115 +6,47 @@
       "date_detection": false,
       "dynamic": false,
       "properties": {
-        "cluster_uuid": {
-          "type": "keyword"
-        },
-        "state_uuid": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
+        "ccr_stats": {
           "properties": {
-            "uuid": {
-              "type": "keyword"
+            "follower_global_checkpoint": {
+              "type": "long"
             },
-            "host": {
+            "follower_index": {
               "type": "keyword"
             },
-            "transport_address": {
-              "type": "keyword"
+            "leader_global_checkpoint": {
+              "type": "long"
             },
-            "ip": {
+            "leader_index": {
               "type": "keyword"
             },
-            "name": {
+            "leader_max_seq_no": {
+              "type": "long"
+            },
+            "operations_written": {
+              "type": "long"
+            },
+            "remote_cluster": {
               "type": "keyword"
             },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
+            "shard_id": {
+              "type": "integer"
+            },
+            "time_since_last_read_millis": {
+              "type": "long"
             }
           }
         },
-        "indices_stats": {
+        "cluster_state": {
           "properties": {
-            "_all": {
-              "properties": {
-                "primaries": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "total": {
-                  "properties": {
-                    "docs": {
-                      "properties": {
-                        "count": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "indexing": {
-                      "properties": {
-                        "index_total": {
-                          "type": "long"
-                        },
-                        "index_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "search": {
-                      "properties": {
-                        "query_total": {
-                          "type": "long"
-                        },
-                        "query_time_in_millis": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
+            "nodes_hash": {
+              "type": "integer"
             }
           }
         },
+        "cluster_uuid": {
+          "type": "keyword"
+        },
         "index_stats": {
           "properties": {
             "index": {
@@ -129,29 +61,12 @@
                     }
                   }
                 },
-                "fielddata": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -166,44 +81,9 @@
                     }
                   }
                 },
-                "query_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "request_cache": {
-                  "properties": {
-                    "memory_size_in_bytes": {
-                      "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "search": {
+                "refresh": {
                   "properties": {
-                    "query_total": {
-                      "type": "long"
-                    },
-                    "query_time_in_millis": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -212,42 +92,12 @@
                   "properties": {
                     "count": {
                       "type": "integer"
-                    },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "points_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "stored_fields_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "term_vectors_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "norms_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "doc_values_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "index_writer_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "version_map_memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "fixed_bit_set_memory_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -256,36 +106,19 @@
             },
             "total": {
               "properties": {
-                "docs": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    }
-                  }
-                },
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
-                      "type": "long"
                     }
                   }
                 },
                 "indexing": {
                   "properties": {
-                    "index_total": {
+                    "index_time_in_millis": {
                       "type": "long"
                     },
-                    "index_time_in_millis": {
+                    "index_total": {
                       "type": "long"
                     },
                     "throttle_time_in_millis": {
@@ -304,14 +137,12 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
+                    }
+                  }
+                },
+                "refresh": {
+                  "properties": {
+                    "total_time_in_millis": {
                       "type": "long"
                     }
                   }
@@ -320,24 +151,15 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
                 "search": {
                   "properties": {
-                    "query_total": {
+                    "query_time_in_millis": {
                       "type": "long"
                     },
-                    "query_time_in_millis": {
+                    "query_total": {
                       "type": "long"
                     }
                   }
@@ -347,41 +169,41 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "terms_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "norms_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 },
-                "refresh": {
+                "store": {
                   "properties": {
-                    "total_time_in_millis": {
+                    "size_in_bytes": {
                       "type": "long"
                     }
                   }
@@ -390,68 +212,92 @@
             }
           }
         },
-        "cluster_stats": {
+        "indices_stats": {
           "properties": {
-            "nodes": {
-              "type": "object"
-            },
-            "indices": {
-              "type": "object"
+            "_all": {
+              "properties": {
+                "primaries": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_time_in_millis": {
+                          "type": "long"
+                        },
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "total": {
+                  "properties": {
+                    "indexing": {
+                      "properties": {
+                        "index_total": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "search": {
+                      "properties": {
+                        "query_time_in_millis": {
+                          "type": "long"
+                        },
+                        "query_total": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
-        "cluster_state": {
+        "job_stats": {
           "properties": {
-            "version": {
-              "type": "long"
-            },
-            "nodes_hash": {
-              "type": "integer"
-            },
-            "master_node": {
-              "type": "keyword"
-            },
-            "state_uuid": {
-              "type": "keyword"
-            },
-            "status": {
+            "job_id": {
               "type": "keyword"
-            },
-            "nodes": {
-              "type": "object"
-            },
-            "shards": {
-              "type": "object"
             }
           }
         },
         "node_stats": {
           "properties": {
-            "node_id": {
-              "type": "keyword"
-            },
-            "node_master": {
-              "type": "boolean"
-            },
-            "mlockall": {
-              "type": "boolean"
-            },
-            "indices": {
+            "fs": {
               "properties": {
-                "docs": {
+                "io_stats": {
                   "properties": {
-                    "count": {
-                      "type": "long"
+                    "total": {
+                      "properties": {
+                        "operations": {
+                          "type": "long"
+                        },
+                        "read_operations": {
+                          "type": "long"
+                        },
+                        "write_operations": {
+                          "type": "long"
+                        }
+                      }
                     }
                   }
                 },
+                "total": {
+                  "properties": {
+                    "available_in_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indices": {
+              "properties": {
                 "fielddata": {
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
                     }
                   }
                 },
@@ -472,15 +318,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -488,15 +325,6 @@
                   "properties": {
                     "memory_size_in_bytes": {
                       "type": "long"
-                    },
-                    "evictions": {
-                      "type": "long"
-                    },
-                    "hit_count": {
-                      "type": "long"
-                    },
-                    "miss_count": {
-                      "type": "long"
                     }
                   }
                 },
@@ -515,116 +343,97 @@
                     "count": {
                       "type": "integer"
                     },
-                    "memory_in_bytes": {
-                      "type": "long"
-                    },
-                    "terms_memory_in_bytes": {
+                    "doc_values_memory_in_bytes": {
                       "type": "long"
                     },
-                    "points_memory_in_bytes": {
+                    "fixed_bit_set_memory_in_bytes": {
                       "type": "long"
                     },
-                    "stored_fields_memory_in_bytes": {
+                    "index_writer_memory_in_bytes": {
                       "type": "long"
                     },
-                    "term_vectors_memory_in_bytes": {
+                    "memory_in_bytes": {
                       "type": "long"
                     },
                     "norms_memory_in_bytes": {
                       "type": "long"
                     },
-                    "doc_values_memory_in_bytes": {
+                    "points_memory_in_bytes": {
                       "type": "long"
                     },
-                    "index_writer_memory_in_bytes": {
+                    "stored_fields_memory_in_bytes": {
                       "type": "long"
                     },
-                    "version_map_memory_in_bytes": {
+                    "term_vectors_memory_in_bytes": {
                       "type": "long"
                     },
-                    "fixed_bit_set_memory_in_bytes": {
+                    "terms_memory_in_bytes": {
                       "type": "long"
-                    }
-                  }
-                },
-                "store": {
-                  "properties": {
-                    "size_in_bytes": {
+                    },
+                    "version_map_memory_in_bytes": {
                       "type": "long"
                     }
                   }
                 }
               }
             },
-            "fs": {
+            "jvm": {
               "properties": {
-                "total": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "long"
-                    },
-                    "free_in_bytes": {
-                      "type": "long"
-                    },
-                    "available_in_bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "data": {
-                  "properties": {
-                    "spins": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "io_stats": {
+                "gc": {
                   "properties": {
-                    "total": {
+                    "collectors": {
                       "properties": {
-                        "operations": {
-                          "type": "long"
-                        },
-                        "read_operations": {
-                          "type": "long"
-                        },
-                        "write_operations": {
-                          "type": "long"
-                        },
-                        "read_kilobytes": {
-                          "type": "long"
+                        "old": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         },
-                        "write_kilobytes": {
-                          "type": "long"
+                        "young": {
+                          "properties": {
+                            "collection_count": {
+                              "type": "long"
+                            },
+                            "collection_time_in_millis": {
+                              "type": "long"
+                            }
+                          }
                         }
                       }
                     }
                   }
+                },
+                "mem": {
+                  "properties": {
+                    "heap_max_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_in_bytes": {
+                      "type": "long"
+                    },
+                    "heap_used_percent": {
+                      "type": "half_float"
+                    }
+                  }
                 }
               }
             },
+            "node_id": {
+              "type": "keyword"
+            },
             "os": {
               "properties": {
                 "cgroup": {
                   "properties": {
-                    "cpuacct": {
-                      "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "usage_nanos": {
-                          "type": "long"
-                        }
-                      }
-                    },
                     "cpu": {
                       "properties": {
                         "cfs_quota_micros": {
                           "type": "long"
                         },
-                        "control_group": {
-                          "type": "keyword"
-                        },
                         "stat": {
                           "properties": {
                             "number_of_elapsed_periods": {
@@ -640,16 +449,10 @@
                         }
                       }
                     },
-                    "memory": {
+                    "cpuacct": {
                       "properties": {
-                        "control_group": {
-                          "type": "keyword"
-                        },
-                        "limit_in_bytes": {
-                          "type": "keyword"
-                        },
-                        "usage_in_bytes": {
-                          "type": "keyword"
+                        "usage_nanos": {
+                          "type": "long"
                         }
                       }
                     }
@@ -661,12 +464,6 @@
                       "properties": {
                         "1m": {
                           "type": "half_float"
-                        },
-                        "5m": {
-                          "type": "half_float"
-                        },
-                        "15m": {
-                          "type": "half_float"
                         }
                       }
                     }
@@ -676,12 +473,6 @@
             },
             "process": {
               "properties": {
-                "open_file_descriptors": {
-                  "type": "long"
-                },
-                "max_file_descriptors": {
-                  "type": "long"
-                },
                 "cpu": {
                   "properties": {
                     "percent": {
@@ -691,110 +482,30 @@
                 }
               }
             },
-            "jvm": {
+            "thread_pool": {
               "properties": {
-                "mem": {
+                "bulk": {
                   "properties": {
-                    "heap_used_in_bytes": {
-                      "type": "long"
+                    "queue": {
+                      "type": "integer"
                     },
-                    "heap_used_percent": {
-                      "type": "half_float"
+                    "rejected": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "get": {
+                  "properties": {
+                    "queue": {
+                      "type": "integer"
                     },
-                    "heap_max_in_bytes": {
+                    "rejected": {
                       "type": "long"
                     }
                   }
                 },
-                "gc": {
+                "index": {
                   "properties": {
-                    "collectors": {
-                      "properties": {
-                        "young": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "old": {
-                          "properties": {
-                            "collection_count": {
-                              "type": "long"
-                            },
-                            "collection_time_in_millis": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "thread_pool": {
-              "properties": {
-                "bulk": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "generic": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "get": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "index": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "management": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -805,22 +516,6 @@
                 },
                 "search": {
                   "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
-                    "queue": {
-                      "type": "integer"
-                    },
-                    "rejected": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "watcher": {
-                  "properties": {
-                    "threads": {
-                      "type": "integer"
-                    },
                     "queue": {
                       "type": "integer"
                     },
@@ -843,246 +538,41 @@
             }
           }
         },
-        "index_recovery": {
-          "type": "object"
-        },
         "shard": {
           "properties": {
-            "state": {
-              "type": "keyword"
-            },
-            "primary": {
-              "type": "boolean"
-            },
             "index": {
               "type": "keyword"
             },
-            "relocating_node": {
-              "type": "keyword"
-            },
-            "shard": {
-              "type": "long"
-            },
             "node": {
               "type": "keyword"
-            }
-          }
-        },
-        "job_stats": {
-          "properties": {
-            "job_id": {
-              "type": "keyword"
+            },
+            "primary": {
+              "type": "boolean"
             },
             "state": {
               "type": "keyword"
-            },
-            "data_counts": {
-              "properties": {
-                "input_bytes": {
-                  "type": "long"
-                },
-                "processed_record_count": {
-                  "type": "long"
-                },
-                "empty_bucket_count": {
-                  "type": "long"
-                },
-                "sparse_bucket_count": {
-                  "type": "long"
-                },
-                "bucket_count": {
-                  "type": "long"
-                },
-                "earliest_record_timestamp": {
-                  "type": "date"
-                },
-                "latest_record_timestamp": {
-                  "type": "date"
-                }
-              }
-            },
-            "model_size_stats": {
-              "properties": {
-                "model_bytes": {
-                  "type": "long"
-                },
-                "bucket_allocation_failures_count": {
-                  "type": "long"
-                }
-              }
-            },
-            "node": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
-        "ccr_stats": {
+        "source_node": {
           "properties": {
-            "remote_cluster": {
-              "type": "keyword"
-            },
-            "leader_index": {
+            "name": {
               "type": "keyword"
             },
-            "follower_index": {
+            "uuid": {
               "type": "keyword"
-            },
-            "shard_id": {
-              "type": "integer"
-            },
-            "leader_global_checkpoint": {
-              "type": "long"
-            },
-            "leader_max_seq_no": {
-              "type": "long"
-            },
-            "follower_global_checkpoint": {
-              "type": "long"
-            },
-            "follower_max_seq_no": {
-              "type": "long"
-            },
-            "last_requested_seq_no": {
-              "type": "long"
-            },
-            "outstanding_read_requests": {
-              "type": "long"
-            },
-            "outstanding_write_requests": {
-              "type": "long"
-            },
-            "write_buffer_operation_count": {
-              "type": "long"
-            },
-            "write_buffer_size_in_bytes": {
-              "type": "long"
-            },
-            "follower_mapping_version": {
-              "type": "long"
-            },
-            "follower_settings_version": {
-              "type": "long"
-            },
-            "total_read_time_millis": {
-              "type": "long"
-            },
-            "total_read_remote_exec_time_millis": {
-              "type": "long"
-            },
-            "successful_read_requests": {
-              "type": "long"
-            },
-            "failed_read_requests": {
-              "type": "long"
-            },
-            "operations_read": {
-              "type": "long"
-            },
-            "bytes_read": {
-              "type": "long"
-            },
-            "total_write_time_millis": {
-              "type": "long"
-            },
-            "successful_write_requests": {
-              "type": "long"
-            },
-            "failed_write_requests": {
-              "type": "long"
-            },
-            "operations_written": {
-              "type": "long"
-            },
-            "read_exceptions": {
-              "type": "nested",
-              "properties": {
-                "from_seq_no": {
-                  "type": "long"
-                },
-                "retries": {
-                  "type": "integer"
-                },
-                "exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "time_since_last_read_millis": {
-              "type": "long"
-            },
-            "fatal_exception": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                },
-                "reason": {
-                  "type": "text"
-                }
-              }
             }
           }
         },
-        "ccr_auto_follow_stats": {
-          "properties": {
-            "number_of_failed_follow_indices": {
-              "type": "long"
-            },
-            "number_of_failed_remote_cluster_state_requests": {
-              "type": "long"
-            },
-            "number_of_successful_follow_indices": {
-              "type": "long"
-            },
-            "recent_auto_follow_errors": {
-              "type": "nested",
-              "properties": {
-                "leader_index": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "long"
-                },
-                "auto_follow_exception": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "keyword"
-                    },
-                    "reason": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "auto_followed_clusters": {
-              "type": "nested",
-              "properties": {
-                "cluster_name": {
-                  "type": "keyword"
-                },
-                "time_since_last_check_millis": {
-                  "type": "long"
-                },
-                "last_seen_metadata_version": {
-                  "type": "long"
-                }
-              }
-            }
-          }
+        "state_uuid": {
+          "type": "keyword"
+        },
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
         }
       }
     },
@@ -1104,24 +594,9 @@
     "mappings": {
       "dynamic": false,
       "properties": {
-        "timestamp": {
-          "type": "date"
-        },
-        "update_timestamp": {
-          "type": "date"
-        },
-        "resolved_timestamp": {
-          "type": "date"
-        },
-        "prefix": {
-          "type": "text"
-        },
         "message": {
           "type": "text"
         },
-        "suffix": {
-          "type": "text"
-        },
         "metadata": {
           "properties": {
             "cluster_uuid": {
@@ -1143,6 +618,21 @@
               "type": "keyword"
             }
           }
+        },
+        "prefix": {
+          "type": "text"
+        },
+        "resolved_timestamp": {
+          "type": "date"
+        },
+        "suffix": {
+          "type": "text"
+        },
+        "timestamp": {
+          "type": "date"
+        },
+        "update_timestamp": {
+          "type": "date"
         }
       }
     },
@@ -1167,95 +657,21 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "timestamp": {
-          "type": "date",
-          "format": "date_time"
-        },
-        "interval_ms": {
-          "type": "long"
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "source_node": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            },
-            "host": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date",
-              "format": "date_time"
-            }
-          }
-        },
         "kibana_stats": {
           "properties": {
+            "concurrent_connections": {
+              "type": "long"
+            },
             "kibana": {
               "properties": {
-                "uuid": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "transport_address": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                },
-                "snapshot": {
-                  "type": "boolean"
-                },
                 "status": {
                   "type": "keyword"
                 },
-                "statuses": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "state": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "cloud": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "vm_type": {
-                  "type": "keyword"
-                },
-                "region": {
+                "uuid": {
                   "type": "keyword"
                 },
-                "zone": {
+                "version": {
                   "type": "keyword"
-                },
-                "metadata": {
-                  "type": "object"
                 }
               }
             },
@@ -1263,47 +679,28 @@
               "properties": {
                 "load": {
                   "properties": {
-                    "1m": {
+                    "15m": {
                       "type": "half_float"
                     },
-                    "5m": {
+                    "1m": {
                       "type": "half_float"
                     },
-                    "15m": {
+                    "5m": {
                       "type": "half_float"
                     }
                   }
-                },
-                "memory": {
-                  "properties": {
-                    "total_in_bytes": {
-                      "type": "float"
-                    },
-                    "free_in_bytes": {
-                      "type": "float"
-                    },
-                    "used_in_bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
             "process": {
               "properties": {
+                "event_loop_delay": {
+                  "type": "float"
+                },
                 "memory": {
                   "properties": {
                     "heap": {
                       "properties": {
-                        "total_in_bytes": {
-                          "type": "float"
-                        },
-                        "used_in_bytes": {
-                          "type": "float"
-                        },
                         "size_limit": {
                           "type": "float"
                         }
@@ -1313,36 +710,9 @@
                       "type": "float"
                     }
                   }
-                },
-                "event_loop_delay": {
-                  "type": "float"
-                },
-                "uptime_in_millis": {
-                  "type": "long"
                 }
               }
             },
-            "sockets": {
-              "properties": {
-                "http": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "https": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "timestamp": {
-              "type": "date"
-            },
             "requests": {
               "properties": {
                 "disconnects": {
@@ -1350,9 +720,6 @@
                 },
                 "total": {
                   "type": "long"
-                },
-                "status_codes": {
-                  "type": "object"
                 }
               }
             },
@@ -1366,531 +733,164 @@
                 }
               }
             },
-            "concurrent_connections": {
-              "type": "long"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "codec": "best_compression",
-        "format": "6",
-        "number_of_replicas": "1",
-        "number_of_shards": "1"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "index": ".monitoring-beats-6-2019.02.04",
-    "mappings": {
-      "dynamic": false,
-      "properties": {
-        "beats_state": {
-          "properties": {
-            "beat": {
-              "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "uuid": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
+            "timestamp": {
+              "type": "date"
             },
-            "state": {
+            "usage": {
               "properties": {
-                "beat": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "host": {
-                  "properties": {
-                    "architecture": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "hostname": {
-                      "type": "keyword"
-                    },
-                    "os": {
-                      "properties": {
-                        "build": {
-                          "type": "keyword"
-                        },
-                        "family": {
-                          "type": "keyword"
-                        },
-                        "platform": {
-                          "type": "keyword"
-                        },
-                        "version": {
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "input": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "module": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "names": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "output": {
-                  "properties": {
-                    "name": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "service": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "type": "keyword"
-                    },
-                    "version": {
-                      "type": "keyword"
-                    }
-                  }
+                "index": {
+                  "type": "keyword"
                 }
               }
-            },
-            "timestamp": {
-              "format": "date_time",
-              "type": "date"
             }
           }
         },
-        "beats_stats": {
-          "properties": {
-            "beat": {
-              "properties": {
-                "host": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "uuid": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "metrics": {
-              "properties": {
-                "beat": {
-                  "properties": {
-                    "cpu": {
-                      "properties": {
-                        "system": {
-                          "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "total": {
-                          "properties": {
-                            "value": {
-                              "type": "long"
-                            },
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "user": {
-                          "properties": {
-                            "ticks": {
-                              "type": "long"
-                            },
-                            "time": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "info": {
-                      "properties": {
-                        "ephemeral_id": {
-                          "type": "keyword"
-                        },
-                        "uptime": {
-                          "properties": {
-                            "ms": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "memstats": {
-                      "properties": {
-                        "gc_next": {
-                          "type": "long"
-                        },
-                        "memory_alloc": {
-                          "type": "long"
-                        },
-                        "memory_total": {
-                          "type": "long"
-                        },
-                        "rss": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "handles": {
-                      "properties": {
-                        "open": {
-                          "type": "long"
-                        },
-                        "limit": {
-                          "properties": {
-                            "hard": {
-                              "type": "long"
-                            },
-                            "soft": {
-                              "type": "long"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "apm-server": {
-                  "properties": {
-                    "server": {
-                      "properties": {
-                        "request": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "concurrent": {
-                          "properties": {
-                            "wait": {
-                              "properties": {
-                                "ms": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "response": {
-                          "properties": {
-                            "count": {
-                              "type": "long"
-                            },
-                            "errors": {
-                              "properties": {
-                                "count": {
-                                  "type": "long"
-                                },
-                                "toolarge": {
-                                  "type": "long"
-                                },
-                                "validate": {
-                                  "type": "long"
-                                },
-                                "ratelimit": {
-                                  "type": "long"
-                                },
-                                "queue": {
-                                  "type": "long"
-                                },
-                                "closed": {
-                                  "type": "long"
-                                },
-                                "forbidden": {
-                                  "type": "long"
-                                },
-                                "concurrency": {
-                                  "type": "long"
-                                },
-                                "unauthorized": {
-                                  "type": "long"
-                                },
-                                "internal": {
-                                  "type": "long"
-                                },
-                                "decode": {
-                                  "type": "long"
-                                },
-                                "method": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "valid": {
-                              "properties": {
-                                "ok": {
-                                  "type": "long"
-                                },
-                                "accepted": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "decoder": {
+        "timestamp": {
+          "format": "date_time",
+          "type": "date"
+        },
+        "type": {
+          "type": "keyword"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "format": "6",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "index": ".monitoring-beats-6-2019.02.04",
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "beats_state": {
+          "properties": {
+            "timestamp": {
+              "format": "date_time",
+              "type": "date"
+            }
+          }
+        },
+        "beats_stats": {
+          "properties": {
+            "beat": {
+              "properties": {
+                "type": {
+                  "type": "keyword"
+                },
+                "uuid": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "metrics": {
+              "properties": {
+                "apm-server": {
+                  "properties": {
+                    "processor": {
                       "properties": {
-                        "deflate": {
-                          "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "gzip": {
+                        "error": {
                           "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
+                            "transformations": {
                               "type": "long"
                             }
                           }
                         },
-                        "uncompressed": {
+                        "metric": {
                           "properties": {
-                            "content-length": {
-                              "type": "long"
-                            },
-                            "count": {
+                            "transformations": {
                               "type": "long"
                             }
                           }
                         },
-                        "reader": {
+                        "span": {
                           "properties": {
-                            "size": {
-                              "type": "long"
-                            },
-                            "count": {
+                            "transformations": {
                               "type": "long"
                             }
                           }
                         },
-                        "missing-content-length": {
+                        "transaction": {
                           "properties": {
-                            "count": {
+                            "transformations": {
                               "type": "long"
                             }
                           }
                         }
                       }
                     },
-                    "processor": {
+                    "server": {
                       "properties": {
-                        "metric": {
+                        "request": {
                           "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
-                                  "type": "long"
-                                },
-                                "count": {
-                                  "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
+                            "count": {
                               "type": "long"
                             }
                           }
                         },
-                        "sourcemap": {
+                        "response": {
                           "properties": {
-                            "counter": {
+                            "count": {
                               "type": "long"
                             },
-                            "decoding": {
+                            "errors": {
                               "properties": {
-                                "errors": {
+                                "closed": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "concurrency": {
                                   "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
+                                },
+                                "decode": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "forbidden": {
                                   "type": "long"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "transaction": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
+                                },
+                                "internal": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "method": {
                                   "type": "long"
-                                }
-                              }
-                            },
-                            "validation": {
-                              "properties": {
-                                "errors": {
+                                },
+                                "queue": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "ratelimit": {
                                   "type": "long"
-                                }
-                              }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            },
-                            "transactions": {
-                              "type": "long"
-                            },
-                            "spans": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "error": {
-                          "properties": {
-                            "decoding": {
-                              "properties": {
-                                "errors": {
+                                },
+                                "toolarge": {
+                                  "type": "long"
+                                },
+                                "unauthorized": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "validate": {
                                   "type": "long"
                                 }
                               }
                             },
-                            "validation": {
+                            "valid": {
                               "properties": {
-                                "errors": {
+                                "accepted": {
                                   "type": "long"
                                 },
-                                "count": {
+                                "ok": {
                                   "type": "long"
                                 }
                               }
-                            },
-                            "transformations": {
-                              "type": "long"
-                            },
-                            "errors": {
-                              "type": "long"
-                            },
-                            "stacktraces": {
-                              "type": "long"
-                            },
-                            "frames": {
-                              "type": "long"
-                            }
-                          }
-                        },
-                        "span": {
-                          "properties": {
-                            "transformations": {
-                              "type": "long"
                             }
                           }
                         }
@@ -1898,28 +898,53 @@
                     }
                   }
                 },
-                "libbeat": {
+                "beat": {
                   "properties": {
-                    "config": {
+                    "cpu": {
                       "properties": {
-                        "module": {
+                        "total": {
                           "properties": {
-                            "running": {
-                              "type": "long"
-                            },
-                            "starts": {
-                              "type": "long"
-                            },
-                            "stops": {
+                            "value": {
                               "type": "long"
                             }
                           }
-                        },
-                        "reloads": {
+                        }
+                      }
+                    },
+                    "handles": {
+                      "properties": {
+                        "open": {
                           "type": "long"
                         }
                       }
                     },
+                    "info": {
+                      "properties": {
+                        "ephemeral_id": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "memstats": {
+                      "properties": {
+                        "gc_next": {
+                          "type": "long"
+                        },
+                        "memory_alloc": {
+                          "type": "long"
+                        },
+                        "memory_total": {
+                          "type": "long"
+                        },
+                        "rss": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "libbeat": {
+                  "properties": {
                     "output": {
                       "properties": {
                         "events": {
@@ -1930,23 +955,14 @@
                             "active": {
                               "type": "long"
                             },
-                            "batches": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
-                            "duplicates": {
-                              "type": "long"
-                            },
                             "failed": {
                               "type": "long"
                             },
                             "total": {
                               "type": "long"
-                            },
-                            "toomany": {
-                              "type": "long"
                             }
                           }
                         },
@@ -1960,9 +976,6 @@
                             }
                           }
                         },
-                        "type": {
-                          "type": "keyword"
-                        },
                         "write": {
                           "properties": {
                             "bytes": {
@@ -1977,23 +990,14 @@
                     },
                     "pipeline": {
                       "properties": {
-                        "clients": {
-                          "type": "long"
-                        },
                         "events": {
                           "properties": {
-                            "active": {
-                              "type": "long"
-                            },
                             "dropped": {
                               "type": "long"
                             },
                             "failed": {
                               "type": "long"
                             },
-                            "filtered": {
-                              "type": "long"
-                            },
                             "published": {
                               "type": "long"
                             },
@@ -2004,13 +1008,6 @@
                               "type": "long"
                             }
                           }
-                        },
-                        "queue": {
-                          "properties": {
-                            "acked": {
-                              "type": "long"
-                            }
-                          }
                         }
                       }
                     }
@@ -2023,24 +1020,11 @@
                         "1": {
                           "type": "double"
                         },
-                        "5": {
-                          "type": "double"
-                        },
                         "15": {
                           "type": "double"
                         },
-                        "norm": {
-                          "properties": {
-                            "1": {
-                              "type": "double"
-                            },
-                            "5": {
-                              "type": "double"
-                            },
-                            "15": {
-                              "type": "double"
-                            }
-                          }
+                        "5": {
+                          "type": "double"
                         }
                       }
                     }
@@ -2048,9 +1032,6 @@
                 }
               }
             },
-            "tags": {
-              "type": "keyword"
-            },
             "timestamp": {
               "format": "date_time",
               "type": "date"
@@ -2060,25 +1041,16 @@
         "cluster_uuid": {
           "type": "keyword"
         },
-        "interval_ms": {
-          "type": "long"
-        },
-        "source_node": {
+        "metricset": {
           "properties": {
-            "host": {
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "keyword"
-            },
             "name": {
-              "type": "keyword"
-            },
-            "transport_address": {
-              "type": "keyword"
-            },
-            "uuid": {
-              "type": "keyword"
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
             }
           }
         },
diff --git a/x-pack/test/functional/es_archives/reporting/ecommerce_kibana_spaces/data.json.gz b/x-pack/test/functional/es_archives/reporting/ecommerce_kibana_spaces/data.json.gz
new file mode 100644
index 00000000000000..06e83f8c267d66
Binary files /dev/null and b/x-pack/test/functional/es_archives/reporting/ecommerce_kibana_spaces/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/reporting/ecommerce_kibana_spaces/mappings.json b/x-pack/test/functional/es_archives/reporting/ecommerce_kibana_spaces/mappings.json
new file mode 100644
index 00000000000000..1de04a64398c4d
--- /dev/null
+++ b/x-pack/test/functional/es_archives/reporting/ecommerce_kibana_spaces/mappings.json
@@ -0,0 +1,2635 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana": {
+      }
+    },
+    "index": ".kibana_1",
+    "mappings": {
+      "_meta": {
+        "migrationMappingPropertyHashes": {
+          "action": "6e96ac5e648f57523879661ea72525b7",
+          "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
+          "alert": "7b44fba6773e37c806ce290ea9b7024e",
+          "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
+          "apm-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "app_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_totals": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_transactional": "43b8830d5d0df85a6823d290885fc9fd",
+          "canvas-element": "7390014e1091044523666d97247392fc",
+          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "canvas-workpad-template": "ae2673f678281e2c055d764b153e9715",
+          "cases": "32aa96a6d3855ddda53010ae2048ac22",
+          "cases-comments": "c2061fb929f585df57425102fa928b4b",
+          "cases-configure": "42711cbb311976c0687853f4c1354572",
+          "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
+          "config": "c63748b75f39d0c54de12d12c1ccbc20",
+          "dashboard": "74eb4b909f81222fa1ddeaba2881a37e",
+          "endpoint:user-artifact": "4a11183eee21e6fbad864f7a30b39ad0",
+          "endpoint:user-artifact-manifest": "4b9c0e7cfaf86d82a7ee9ed68065e50d",
+          "epm-packages": "386dc9996a3b74607de64c2ab2171582",
+          "exception-list": "497afa2f881a675d72d58e20057f3d8b",
+          "exception-list-agnostic": "497afa2f881a675d72d58e20057f3d8b",
+          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
+          "fleet-agent-actions": "e520c855577170c24481be05c3ae14ec",
+          "fleet-agent-events": "e20a508b6e805189356be381dbfac8db",
+          "fleet-agents": "6012d61d15e72564e47fc3402332756e",
+          "fleet-enrollment-api-keys": "a69ef7ae661dab31561d6c6f052ef2a7",
+          "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
+          "index-pattern": "45915a1ad866812242df474eb0479052",
+          "infrastructure-ui-source": "2b2809653635caf490c93f090502d04c",
+          "ingest-agent-policies": "8b0733cce189659593659dad8db426f0",
+          "ingest-outputs": "8aa988c376e65443fefc26f1075e93a3",
+          "ingest-package-policies": "f74dfe498e1849267cda41580b2be110",
+          "ingest_manager_settings": "012cf278ec84579495110bb827d1ed09",
+          "inventory-view": "88fc7e12fd1b45b6f0787323ce4f18d2",
+          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
+          "lens": "52346cfec69ff7b47d5f0c12361a2797",
+          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
+          "map": "4a05b35c3a3a58fbc72dd0202dc3487f",
+          "maps-telemetry": "5ef305b18111b77789afefbd36b66171",
+          "metrics-explorer-view": "a8df1d270ee48c969d22d23812d08187",
+          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
+          "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
+          "namespace": "2f4316de49999235636386fe51dc06c1",
+          "namespaces": "2f4316de49999235636386fe51dc06c1",
+          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "references": "7997cf5a56cc02bdc9c93361bde732b0",
+          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
+          "search": "7f9e077078cab612f6a58e3bfdedb71a",
+          "search-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "siem-detection-engine-rule-actions": "6569b288c169539db10cb262bf79de18",
+          "siem-detection-engine-rule-status": "ae783f41c6937db6b7a2ef5c93a9e9b0",
+          "siem-ui-timeline": "94bc38c7a421d15fbfe8ea565370a421",
+          "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
+          "siem-ui-timeline-pinned-event": "20638091112f0e14f0e443d512301c29",
+          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
+          "telemetry": "36a616f7026dfa617d6655df850fe16d",
+          "timelion-sheet": "9a2a2748877c7a7b582fef201ab1d4cf",
+          "tsvb-validation-telemetry": "3a37ef6c8700ae6fc97d5c7da00e9215",
+          "type": "2f4316de49999235636386fe51dc06c1",
+          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
+          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "upgrade-assistant-reindex-operation": "215107c281839ea9b3ad5f6419819763",
+          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
+          "uptime-dynamic-settings": "3d1b76c39bfb2cc8296b024d73854724",
+          "url": "c7f66a0df8b1b52f17c28c4adb111105",
+          "visualization": "44d6bd48a1a653bcb60ea01614b9e3c9",
+          "workplace_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724"
+        }
+      },
+      "dynamic": "strict",
+      "properties": {
+        "action": {
+          "properties": {
+            "actionTypeId": {
+              "type": "keyword"
+            },
+            "config": {
+              "enabled": false,
+              "type": "object"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "secrets": {
+              "type": "binary"
+            }
+          }
+        },
+        "action_task_params": {
+          "properties": {
+            "actionId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            }
+          }
+        },
+        "agent_actions": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "agent_configs": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "agent_events": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "agents": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "alert": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "actionRef": {
+                  "type": "keyword"
+                },
+                "actionTypeId": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              },
+              "type": "nested"
+            },
+            "alertTypeId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "apiKeyOwner": {
+              "type": "keyword"
+            },
+            "consumer": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "muteAll": {
+              "type": "boolean"
+            },
+            "mutedInstanceIds": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            },
+            "schedule": {
+              "properties": {
+                "interval": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "scheduledTaskId": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "throttle": {
+              "type": "keyword"
+            },
+            "updatedBy": {
+              "type": "keyword"
+            }
+          }
+        },
+        "apm-indices": {
+          "properties": {
+            "apm_oss": {
+              "properties": {
+                "errorIndices": {
+                  "type": "keyword"
+                },
+                "metricsIndices": {
+                  "type": "keyword"
+                },
+                "onboardingIndices": {
+                  "type": "keyword"
+                },
+                "sourcemapIndices": {
+                  "type": "keyword"
+                },
+                "spanIndices": {
+                  "type": "keyword"
+                },
+                "transactionIndices": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "apm-services-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "apm-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "app_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "application_usage_totals": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "application_usage_transactional": {
+          "dynamic": "false",
+          "properties": {
+            "timestamp": {
+              "type": "date"
+            }
+          }
+        },
+        "canvas-element": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "content": {
+              "type": "text"
+            },
+            "help": {
+              "type": "text"
+            },
+            "image": {
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad-template": {
+          "dynamic": "false",
+          "properties": {
+            "help": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "tags": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "template_key": {
+              "type": "keyword"
+            }
+          }
+        },
+        "cases": {
+          "properties": {
+            "closed_at": {
+              "type": "date"
+            },
+            "closed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "external_service": {
+              "properties": {
+                "connector_id": {
+                  "type": "keyword"
+                },
+                "connector_name": {
+                  "type": "keyword"
+                },
+                "external_id": {
+                  "type": "keyword"
+                },
+                "external_title": {
+                  "type": "text"
+                },
+                "external_url": {
+                  "type": "text"
+                },
+                "pushed_at": {
+                  "type": "date"
+                },
+                "pushed_by": {
+                  "properties": {
+                    "email": {
+                      "type": "keyword"
+                    },
+                    "full_name": {
+                      "type": "keyword"
+                    },
+                    "username": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-comments": {
+          "properties": {
+            "comment": {
+              "type": "text"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "pushed_at": {
+              "type": "date"
+            },
+            "pushed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-configure": {
+          "properties": {
+            "closure_type": {
+              "type": "keyword"
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "connector_name": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-user-actions": {
+          "properties": {
+            "action": {
+              "type": "keyword"
+            },
+            "action_at": {
+              "type": "date"
+            },
+            "action_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "action_field": {
+              "type": "keyword"
+            },
+            "new_value": {
+              "type": "text"
+            },
+            "old_value": {
+              "type": "text"
+            }
+          }
+        },
+        "config": {
+          "dynamic": "false",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "dashboard": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "doc_values": false,
+              "index": false,
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "optionsJSON": {
+              "index": false,
+              "type": "text"
+            },
+            "panelsJSON": {
+              "index": false,
+              "type": "text"
+            },
+            "refreshInterval": {
+              "properties": {
+                "display": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "keyword"
+                },
+                "pause": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "boolean"
+                },
+                "section": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "integer"
+                },
+                "value": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "integer"
+                }
+              }
+            },
+            "timeFrom": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "timeRestore": {
+              "doc_values": false,
+              "index": false,
+              "type": "boolean"
+            },
+            "timeTo": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "datasources": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "endpoint:user-artifact": {
+          "properties": {
+            "body": {
+              "type": "binary"
+            },
+            "compressionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "decodedSha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "decodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encodedSha256": {
+              "type": "keyword"
+            },
+            "encodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encryptionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "identifier": {
+              "type": "keyword"
+            }
+          }
+        },
+        "endpoint:user-artifact-manifest": {
+          "properties": {
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "ids": {
+              "index": false,
+              "type": "keyword"
+            },
+            "schemaVersion": {
+              "type": "keyword"
+            },
+            "semanticVersion": {
+              "index": false,
+              "type": "keyword"
+            }
+          }
+        },
+        "enrollment_api_keys": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "epm-package": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "epm-packages": {
+          "properties": {
+            "es_index_patterns": {
+              "enabled": false,
+              "type": "object"
+            },
+            "install_started_at": {
+              "type": "date"
+            },
+            "install_status": {
+              "type": "keyword"
+            },
+            "install_version": {
+              "type": "keyword"
+            },
+            "installed_es": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "installed_kibana": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "internal": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "removable": {
+              "type": "boolean"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list-agnostic": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "file-upload-telemetry": {
+          "properties": {
+            "filesUploadedTotalCount": {
+              "type": "long"
+            }
+          }
+        },
+        "fleet-agent-actions": {
+          "properties": {
+            "agent_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "data": {
+              "type": "binary"
+            },
+            "sent_at": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-agent-events": {
+          "properties": {
+            "action_id": {
+              "type": "keyword"
+            },
+            "agent_id": {
+              "type": "keyword"
+            },
+            "data": {
+              "type": "text"
+            },
+            "message": {
+              "type": "text"
+            },
+            "payload": {
+              "type": "text"
+            },
+            "policy_id": {
+              "type": "keyword"
+            },
+            "stream_id": {
+              "type": "keyword"
+            },
+            "subtype": {
+              "type": "keyword"
+            },
+            "timestamp": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-agents": {
+          "properties": {
+            "access_api_key_id": {
+              "type": "keyword"
+            },
+            "active": {
+              "type": "boolean"
+            },
+            "current_error_events": {
+              "index": false,
+              "type": "text"
+            },
+            "default_api_key": {
+              "type": "binary"
+            },
+            "default_api_key_id": {
+              "type": "keyword"
+            },
+            "enrolled_at": {
+              "type": "date"
+            },
+            "last_checkin": {
+              "type": "date"
+            },
+            "last_checkin_status": {
+              "type": "keyword"
+            },
+            "last_updated": {
+              "type": "date"
+            },
+            "local_metadata": {
+              "type": "flattened"
+            },
+            "packages": {
+              "type": "keyword"
+            },
+            "policy_id": {
+              "type": "keyword"
+            },
+            "policy_revision": {
+              "type": "integer"
+            },
+            "shared_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "unenrolled_at": {
+              "type": "date"
+            },
+            "unenrollment_started_at": {
+              "type": "date"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "user_provided_metadata": {
+              "type": "flattened"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-enrollment-api-keys": {
+          "properties": {
+            "active": {
+              "type": "boolean"
+            },
+            "api_key": {
+              "type": "binary"
+            },
+            "api_key_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "expire_at": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "policy_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            }
+          }
+        },
+        "graph-workspace": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "numLinks": {
+              "type": "integer"
+            },
+            "numVertices": {
+              "type": "integer"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "wsState": {
+              "type": "text"
+            }
+          }
+        },
+        "index-pattern": {
+          "dynamic": "false",
+          "properties": {
+            "title": {
+              "type": "text"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "infrastructure-ui-source": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "fields": {
+              "properties": {
+                "container": {
+                  "type": "keyword"
+                },
+                "host": {
+                  "type": "keyword"
+                },
+                "pod": {
+                  "type": "keyword"
+                },
+                "tiebreaker": {
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "inventoryDefaultView": {
+              "type": "keyword"
+            },
+            "logAlias": {
+              "type": "keyword"
+            },
+            "logColumns": {
+              "properties": {
+                "fieldColumn": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "messageColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "timestampColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              },
+              "type": "nested"
+            },
+            "metricAlias": {
+              "type": "keyword"
+            },
+            "metricsExplorerDefaultView": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "text"
+            }
+          }
+        },
+        "ingest-agent-policies": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "monitoring_enabled": {
+              "index": false,
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "package_policies": {
+              "type": "keyword"
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-outputs": {
+          "properties": {
+            "ca_sha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "config": {
+              "type": "flattened"
+            },
+            "fleet_enroll_password": {
+              "type": "binary"
+            },
+            "fleet_enroll_username": {
+              "type": "binary"
+            },
+            "hosts": {
+              "type": "keyword"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-package-policies": {
+          "properties": {
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "inputs": {
+              "enabled": false,
+              "properties": {
+                "config": {
+                  "type": "flattened"
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "streams": {
+                  "properties": {
+                    "compiled_stream": {
+                      "type": "flattened"
+                    },
+                    "config": {
+                      "type": "flattened"
+                    },
+                    "data_stream": {
+                      "properties": {
+                        "dataset": {
+                          "type": "keyword"
+                        },
+                        "type": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "vars": {
+                      "type": "flattened"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "vars": {
+                  "type": "flattened"
+                }
+              },
+              "type": "nested"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "output_id": {
+              "type": "keyword"
+            },
+            "package": {
+              "properties": {
+                "name": {
+                  "type": "keyword"
+                },
+                "title": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "policy_id": {
+              "type": "keyword"
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest_manager_settings": {
+          "properties": {
+            "agent_auto_upgrade": {
+              "type": "keyword"
+            },
+            "has_seen_add_data_notice": {
+              "index": false,
+              "type": "boolean"
+            },
+            "kibana_ca_sha256": {
+              "type": "keyword"
+            },
+            "kibana_url": {
+              "type": "keyword"
+            },
+            "package_auto_upgrade": {
+              "type": "keyword"
+            }
+          }
+        },
+        "inventory-view": {
+          "properties": {
+            "accountId": {
+              "type": "keyword"
+            },
+            "autoBounds": {
+              "type": "boolean"
+            },
+            "autoReload": {
+              "type": "boolean"
+            },
+            "boundsOverride": {
+              "properties": {
+                "max": {
+                  "type": "integer"
+                },
+                "min": {
+                  "type": "integer"
+                }
+              }
+            },
+            "customMetrics": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "customOptions": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "text": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "filterQuery": {
+              "properties": {
+                "expression": {
+                  "type": "keyword"
+                },
+                "kind": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "groupBy": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "legend": {
+              "properties": {
+                "palette": {
+                  "type": "keyword"
+                },
+                "reverseColors": {
+                  "type": "boolean"
+                },
+                "steps": {
+                  "type": "long"
+                }
+              }
+            },
+            "metric": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "nodeType": {
+              "type": "keyword"
+            },
+            "region": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "by": {
+                  "type": "keyword"
+                },
+                "direction": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "time": {
+              "type": "long"
+            },
+            "view": {
+              "type": "keyword"
+            }
+          }
+        },
+        "kql-telemetry": {
+          "properties": {
+            "optInCount": {
+              "type": "long"
+            },
+            "optOutCount": {
+              "type": "long"
+            }
+          }
+        },
+        "lens": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "expression": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "state": {
+              "type": "flattened"
+            },
+            "title": {
+              "type": "text"
+            },
+            "visualizationType": {
+              "type": "keyword"
+            }
+          }
+        },
+        "lens-ui-telemetry": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            },
+            "date": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "map": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "layerListJSON": {
+              "type": "text"
+            },
+            "mapStateJSON": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "maps-telemetry": {
+          "enabled": false,
+          "type": "object"
+        },
+        "metrics-explorer-view": {
+          "properties": {
+            "chartOptions": {
+              "properties": {
+                "stack": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "yAxisMode": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "currentTimerange": {
+              "properties": {
+                "from": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "keyword"
+                },
+                "to": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "options": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "filterQuery": {
+                  "type": "keyword"
+                },
+                "forceInterval": {
+                  "type": "boolean"
+                },
+                "groupBy": {
+                  "type": "keyword"
+                },
+                "limit": {
+                  "type": "integer"
+                },
+                "metrics": {
+                  "properties": {
+                    "aggregation": {
+                      "type": "keyword"
+                    },
+                    "color": {
+                      "type": "keyword"
+                    },
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "label": {
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "source": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "migrationVersion": {
+          "dynamic": "true",
+          "properties": {
+            "config": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "dashboard": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "index-pattern": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "search": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "space": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "visualization": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "ml-telemetry": {
+          "properties": {
+            "file_data_visualizer": {
+              "properties": {
+                "index_creation_count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "namespace": {
+          "type": "keyword"
+        },
+        "namespaces": {
+          "type": "keyword"
+        },
+        "outputs": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "query": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "filters": {
+              "enabled": false,
+              "type": "object"
+            },
+            "query": {
+              "properties": {
+                "language": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "timefilter": {
+              "enabled": false,
+              "type": "object"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "references": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "sample-data-telemetry": {
+          "properties": {
+            "installCount": {
+              "type": "long"
+            },
+            "unInstallCount": {
+              "type": "long"
+            }
+          }
+        },
+        "search": {
+          "properties": {
+            "columns": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "doc_values": false,
+              "index": false,
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "sort": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "search-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "server": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "siem-detection-engine-rule-actions": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "action_type_id": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              }
+            },
+            "alertThrottle": {
+              "type": "keyword"
+            },
+            "ruleAlertId": {
+              "type": "keyword"
+            },
+            "ruleThrottle": {
+              "type": "keyword"
+            }
+          }
+        },
+        "siem-detection-engine-rule-status": {
+          "properties": {
+            "alertId": {
+              "type": "keyword"
+            },
+            "bulkCreateTimeDurations": {
+              "type": "float"
+            },
+            "gap": {
+              "type": "text"
+            },
+            "lastFailureAt": {
+              "type": "date"
+            },
+            "lastFailureMessage": {
+              "type": "text"
+            },
+            "lastLookBackDate": {
+              "type": "date"
+            },
+            "lastSuccessAt": {
+              "type": "date"
+            },
+            "lastSuccessMessage": {
+              "type": "text"
+            },
+            "searchAfterTimeDurations": {
+              "type": "float"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "statusDate": {
+              "type": "date"
+            }
+          }
+        },
+        "siem-ui-timeline": {
+          "properties": {
+            "columns": {
+              "properties": {
+                "aggregatable": {
+                  "type": "boolean"
+                },
+                "category": {
+                  "type": "keyword"
+                },
+                "columnHeaderType": {
+                  "type": "keyword"
+                },
+                "description": {
+                  "type": "text"
+                },
+                "example": {
+                  "type": "text"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "indexes": {
+                  "type": "keyword"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "placeholder": {
+                  "type": "text"
+                },
+                "searchable": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "dataProviders": {
+              "properties": {
+                "and": {
+                  "properties": {
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "excluded": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "kqlQuery": {
+                      "type": "text"
+                    },
+                    "name": {
+                      "type": "text"
+                    },
+                    "queryMatch": {
+                      "properties": {
+                        "displayField": {
+                          "type": "text"
+                        },
+                        "displayValue": {
+                          "type": "text"
+                        },
+                        "field": {
+                          "type": "text"
+                        },
+                        "operator": {
+                          "type": "text"
+                        },
+                        "value": {
+                          "type": "text"
+                        }
+                      }
+                    },
+                    "type": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "excluded": {
+                  "type": "boolean"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "kqlQuery": {
+                  "type": "text"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "queryMatch": {
+                  "properties": {
+                    "displayField": {
+                      "type": "text"
+                    },
+                    "displayValue": {
+                      "type": "text"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "operator": {
+                      "type": "text"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "type": {
+                  "type": "text"
+                }
+              }
+            },
+            "dateRange": {
+              "properties": {
+                "end": {
+                  "type": "date"
+                },
+                "start": {
+                  "type": "date"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "eventType": {
+              "type": "keyword"
+            },
+            "excludedRowRendererIds": {
+              "type": "text"
+            },
+            "favorite": {
+              "properties": {
+                "favoriteDate": {
+                  "type": "date"
+                },
+                "fullName": {
+                  "type": "text"
+                },
+                "keySearch": {
+                  "type": "text"
+                },
+                "userName": {
+                  "type": "text"
+                }
+              }
+            },
+            "filters": {
+              "properties": {
+                "exists": {
+                  "type": "text"
+                },
+                "match_all": {
+                  "type": "text"
+                },
+                "meta": {
+                  "properties": {
+                    "alias": {
+                      "type": "text"
+                    },
+                    "controlledBy": {
+                      "type": "text"
+                    },
+                    "disabled": {
+                      "type": "boolean"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "formattedValue": {
+                      "type": "text"
+                    },
+                    "index": {
+                      "type": "keyword"
+                    },
+                    "key": {
+                      "type": "keyword"
+                    },
+                    "negate": {
+                      "type": "boolean"
+                    },
+                    "params": {
+                      "type": "text"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "missing": {
+                  "type": "text"
+                },
+                "query": {
+                  "type": "text"
+                },
+                "range": {
+                  "type": "text"
+                },
+                "script": {
+                  "type": "text"
+                }
+              }
+            },
+            "kqlMode": {
+              "type": "keyword"
+            },
+            "kqlQuery": {
+              "properties": {
+                "filterQuery": {
+                  "properties": {
+                    "kuery": {
+                      "properties": {
+                        "expression": {
+                          "type": "text"
+                        },
+                        "kind": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "serializedQuery": {
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            },
+            "savedQueryId": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "columnId": {
+                  "type": "keyword"
+                },
+                "sortDirection": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "templateTimelineId": {
+              "type": "text"
+            },
+            "templateTimelineVersion": {
+              "type": "integer"
+            },
+            "timelineType": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-note": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "note": {
+              "type": "text"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-pinned-event": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "space": {
+          "properties": {
+            "_reserved": {
+              "type": "boolean"
+            },
+            "color": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "disabledFeatures": {
+              "type": "keyword"
+            },
+            "imageUrl": {
+              "index": false,
+              "type": "text"
+            },
+            "initials": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "telemetry": {
+          "properties": {
+            "allowChangingOptInStatus": {
+              "type": "boolean"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "lastReported": {
+              "type": "date"
+            },
+            "lastVersionChecked": {
+              "type": "keyword"
+            },
+            "reportFailureCount": {
+              "type": "integer"
+            },
+            "reportFailureVersion": {
+              "type": "keyword"
+            },
+            "sendUsageFrom": {
+              "type": "keyword"
+            },
+            "userHasSeenNotice": {
+              "type": "boolean"
+            }
+          }
+        },
+        "timelion-sheet": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "timelion_chart_height": {
+              "type": "integer"
+            },
+            "timelion_columns": {
+              "type": "integer"
+            },
+            "timelion_interval": {
+              "type": "keyword"
+            },
+            "timelion_other_interval": {
+              "type": "keyword"
+            },
+            "timelion_rows": {
+              "type": "integer"
+            },
+            "timelion_sheet": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "tsvb-validation-telemetry": {
+          "properties": {
+            "failedRequests": {
+              "type": "long"
+            }
+          }
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "ui-metric": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            }
+          }
+        },
+        "updated_at": {
+          "type": "date"
+        },
+        "upgrade-assistant-reindex-operation": {
+          "properties": {
+            "errorMessage": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "indexName": {
+              "type": "keyword"
+            },
+            "lastCompletedStep": {
+              "type": "long"
+            },
+            "locked": {
+              "type": "date"
+            },
+            "newIndexName": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexOptions": {
+              "properties": {
+                "openAndClose": {
+                  "type": "boolean"
+                },
+                "queueSettings": {
+                  "properties": {
+                    "queuedAt": {
+                      "type": "long"
+                    },
+                    "startedAt": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "reindexTaskId": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexTaskPercComplete": {
+              "type": "float"
+            },
+            "runningReindexCount": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "integer"
+            }
+          }
+        },
+        "upgrade-assistant-telemetry": {
+          "properties": {
+            "features": {
+              "properties": {
+                "deprecation_logging": {
+                  "properties": {
+                    "enabled": {
+                      "null_value": true,
+                      "type": "boolean"
+                    }
+                  }
+                }
+              }
+            },
+            "ui_open": {
+              "properties": {
+                "cluster": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "indices": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "overview": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            },
+            "ui_reindex": {
+              "properties": {
+                "close": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "open": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "start": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "stop": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "uptime-dynamic-settings": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "url": {
+          "properties": {
+            "accessCount": {
+              "type": "long"
+            },
+            "accessDate": {
+              "type": "date"
+            },
+            "createDate": {
+              "type": "date"
+            },
+            "url": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "visualization": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "savedSearchRefName": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "index": false,
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "visState": {
+              "index": false,
+              "type": "text"
+            }
+          }
+        },
+        "workplace_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "number_of_replicas": "0",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/services/dashboard/drilldowns_manage.ts b/x-pack/test/functional/services/dashboard/drilldowns_manage.ts
index a01fde3a5233f3..7b66591fcf7642 100644
--- a/x-pack/test/functional/services/dashboard/drilldowns_manage.ts
+++ b/x-pack/test/functional/services/dashboard/drilldowns_manage.ts
@@ -12,6 +12,8 @@ const DASHBOARD_TO_DASHBOARD_ACTION_LIST_ITEM =
   'actionFactoryItem-DASHBOARD_TO_DASHBOARD_DRILLDOWN';
 const DASHBOARD_TO_DASHBOARD_ACTION_WIZARD =
   'selectedActionFactory-DASHBOARD_TO_DASHBOARD_DRILLDOWN';
+const DASHBOARD_TO_URL_ACTION_LIST_ITEM = 'actionFactoryItem-URL_DRILLDOWN';
+const DASHBOARD_TO_URL_ACTION_WIZARD = 'selectedActionFactory-URL_DRILLDOWN';
 const DESTINATION_DASHBOARD_SELECT = 'dashboardDrilldownSelectDashboard';
 const DRILLDOWN_WIZARD_SUBMIT = 'drilldownWizardSubmit';
 
@@ -68,10 +70,32 @@ export function DashboardDrilldownsManageProvider({ getService }: FtrProviderCon
       await this.selectDestinationDashboard(destinationDashboardTitle);
     }
 
+    async fillInDashboardToURLDrilldownWizard({
+      drilldownName,
+      destinationURLTemplate,
+      trigger,
+    }: {
+      drilldownName: string;
+      destinationURLTemplate: string;
+      trigger: 'VALUE_CLICK_TRIGGER' | 'SELECT_RANGE_TRIGGER';
+    }) {
+      await this.fillInDrilldownName(drilldownName);
+      await this.selectDashboardToURLActionIfNeeded();
+      await this.selectTriggerIfNeeded(trigger);
+      await this.fillInURLTemplate(destinationURLTemplate);
+    }
+
     async fillInDrilldownName(name: string) {
       await testSubjects.setValue('drilldownNameInput', name);
     }
 
+    async selectDashboardToURLActionIfNeeded() {
+      if (await testSubjects.exists(DASHBOARD_TO_URL_ACTION_LIST_ITEM)) {
+        await testSubjects.click(DASHBOARD_TO_URL_ACTION_LIST_ITEM);
+      }
+      await testSubjects.existOrFail(DASHBOARD_TO_URL_ACTION_WIZARD);
+    }
+
     async selectDashboardToDashboardActionIfNeeded() {
       if (await testSubjects.exists(DASHBOARD_TO_DASHBOARD_ACTION_LIST_ITEM)) {
         await testSubjects.click(DASHBOARD_TO_DASHBOARD_ACTION_LIST_ITEM);
@@ -83,6 +107,18 @@ export function DashboardDrilldownsManageProvider({ getService }: FtrProviderCon
       await comboBox.set(DESTINATION_DASHBOARD_SELECT, title);
     }
 
+    async selectTriggerIfNeeded(trigger: 'VALUE_CLICK_TRIGGER' | 'SELECT_RANGE_TRIGGER') {
+      if (await testSubjects.exists(`triggerPicker`)) {
+        const container = await testSubjects.find(`triggerPicker-${trigger}`);
+        const radio = await container.findByCssSelector('input[type=radio]');
+        await radio.click();
+      }
+    }
+
+    async fillInURLTemplate(destinationURLTemplate: string) {
+      await testSubjects.setValue('urlInput', destinationURLTemplate);
+    }
+
     async saveChanges() {
       await testSubjects.click(DRILLDOWN_WIZARD_SUBMIT);
     }
diff --git a/x-pack/test/functional/services/ml/anomalies_table.ts b/x-pack/test/functional/services/ml/anomalies_table.ts
index 26af97d008feb9..0231d941fb85f5 100644
--- a/x-pack/test/functional/services/ml/anomalies_table.ts
+++ b/x-pack/test/functional/services/ml/anomalies_table.ts
@@ -3,11 +3,13 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
 import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export function MachineLearningAnomaliesTableProvider({ getService }: FtrProviderContext) {
+  const retry = getService('retry');
   const testSubjects = getService('testSubjects');
 
   return {
@@ -15,12 +17,97 @@ export function MachineLearningAnomaliesTableProvider({ getService }: FtrProvide
       await testSubjects.existOrFail('mlAnomaliesTable');
     },
 
+    async getTableRows() {
+      return await testSubjects.findAll('mlAnomaliesTable > ~mlAnomaliesListRow');
+    },
+
+    async getRowSubjByRowIndex(rowIndex: number) {
+      const tableRows = await this.getTableRows();
+      expect(tableRows.length).to.be.greaterThan(
+        rowIndex,
+        `Expected anomalies table to have at least ${rowIndex + 1} rows (got ${
+          tableRows.length
+        } rows)`
+      );
+      const row = tableRows[rowIndex];
+      const rowSubj = await row.getAttribute('data-test-subj');
+
+      return rowSubj;
+    },
+
     async assertTableNotEmpty() {
-      const tableRows = await testSubjects.findAll('mlAnomaliesTable > ~mlAnomaliesListRow');
+      const tableRows = await this.getTableRows();
       expect(tableRows.length).to.be.greaterThan(
         0,
         `Anomalies table should have at least one row (got '${tableRows.length}')`
       );
     },
+
+    async assertAnomalyActionsMenuButtonExists(rowIndex: number) {
+      const rowSubj = await this.getRowSubjByRowIndex(rowIndex);
+      await testSubjects.existOrFail(`${rowSubj} > mlAnomaliesListRowActionsButton`);
+    },
+
+    async assertAnomalyActionsMenuButtonNotExists(rowIndex: number) {
+      const rowSubj = await this.getRowSubjByRowIndex(rowIndex);
+      await testSubjects.missingOrFail(`${rowSubj} > mlAnomaliesListRowActionsButton`);
+    },
+
+    async assertAnomalyActionsMenuButtonEnabled(rowIndex: number, expectedValue: boolean) {
+      const rowSubj = await this.getRowSubjByRowIndex(rowIndex);
+      const isEnabled = await testSubjects.isEnabled(
+        `${rowSubj} > mlAnomaliesListRowActionsButton`
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected actions menu button for anomalies list entry  #${rowIndex} to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async ensureAnomalyActionsMenuOpen(rowIndex: number) {
+      await retry.tryForTime(30 * 1000, async () => {
+        const rowSubj = await this.getRowSubjByRowIndex(rowIndex);
+        if (!(await testSubjects.exists('mlAnomaliesListRowActionsMenu'))) {
+          await testSubjects.click(`${rowSubj} > mlAnomaliesListRowActionsButton`);
+          await testSubjects.existOrFail('mlAnomaliesListRowActionsMenu', { timeout: 5000 });
+        }
+      });
+    },
+
+    async assertAnomalyActionConfigureRulesButtonExists(rowIndex: number) {
+      await this.ensureAnomalyActionsMenuOpen(rowIndex);
+      await testSubjects.existOrFail('mlAnomaliesListRowActionConfigureRulesButton');
+    },
+
+    async assertAnomalyActionConfigureRulesButtonNotExists(rowIndex: number) {
+      await this.ensureAnomalyActionsMenuOpen(rowIndex);
+      await testSubjects.missingOrFail('mlAnomaliesListRowActionConfigureRulesButton');
+    },
+
+    async assertAnomalyActionConfigureRulesButtonEnabled(rowIndex: number, expectedValue: boolean) {
+      await this.ensureAnomalyActionsMenuOpen(rowIndex);
+      const isEnabled = await testSubjects.isEnabled(
+        'mlAnomaliesListRowActionConfigureRulesButton'
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "configure rules" action button for anomalies list entry  #${rowIndex} to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async assertAnomalyActionViewSeriesButtonEnabled(rowIndex: number, expectedValue: boolean) {
+      await this.ensureAnomalyActionsMenuOpen(rowIndex);
+      const isEnabled = await testSubjects.isEnabled('mlAnomaliesListRowActionViewSeriesButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "view series" action button for anomalies list entry  #${rowIndex} to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
   };
 }
diff --git a/x-pack/test/functional/services/ml/api.ts b/x-pack/test/functional/services/ml/api.ts
index 401a96c5c11bdc..5c9718539f47bc 100644
--- a/x-pack/test/functional/services/ml/api.ts
+++ b/x-pack/test/functional/services/ml/api.ts
@@ -11,7 +11,7 @@ import { Annotation } from '../../../../plugins/ml/common/types/annotations';
 import { DataFrameAnalyticsConfig } from '../../../../plugins/ml/public/application/data_frame_analytics/common';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { DATAFEED_STATE, JOB_STATE } from '../../../../plugins/ml/common/constants/states';
-import { DATA_FRAME_TASK_STATE } from '../../../../plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common';
+import { DATA_FRAME_TASK_STATE } from '../../../../plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/data_frame_task_state';
 import { Datafeed, Job } from '../../../../plugins/ml/common/types/anomaly_detection_jobs';
 export type MlApi = ProvidedType<typeof MachineLearningAPIProvider>;
 import {
@@ -722,5 +722,25 @@ export function MachineLearningAPIProvider({ getService }: FtrProviderContext) {
         }
       });
     },
+
+    async runDFAJob(dfaId: string) {
+      log.debug(`Starting data frame analytics job '${dfaId}'...`);
+      const startResponse = await esSupertest
+        .post(`/_ml/data_frame/analytics/${dfaId}/_start`)
+        .set({ 'Content-Type': 'application/json' })
+        .expect(200)
+        .then((res: any) => res.body);
+
+      expect(startResponse)
+        .to.have.property('acknowledged')
+        .eql(true, 'Response for start data frame analytics job request should be acknowledged');
+    },
+
+    async createAndRunDFAJob(dfaConfig: DataFrameAnalyticsConfig) {
+      await this.createDataFrameAnalyticsJob(dfaConfig);
+      await this.runDFAJob(dfaConfig.id);
+      await this.waitForDFAJobTrainingRecordCountToBePositive(dfaConfig.id);
+      await this.waitForAnalyticsState(dfaConfig.id, DATA_FRAME_TASK_STATE.STOPPED);
+    },
   };
 }
diff --git a/x-pack/test/functional/services/ml/common_config.ts b/x-pack/test/functional/services/ml/common_config.ts
new file mode 100644
index 00000000000000..74538145135bcf
--- /dev/null
+++ b/x-pack/test/functional/services/ml/common_config.ts
@@ -0,0 +1,112 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { DeepPartial } from '../../../../plugins/ml/common/types/common';
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+import { Job, Datafeed } from '../../../../plugins/ml/common/types/anomaly_detection_jobs';
+import { DataFrameAnalyticsConfig } from '../../../../plugins/ml/public/application/data_frame_analytics/common';
+
+const FQ_SM_JOB_CONFIG: Job = {
+  job_id: ``,
+  description: 'mean(responsetime) on farequote dataset with 15m bucket span',
+  groups: ['farequote', 'automated', 'single-metric'],
+  analysis_config: {
+    bucket_span: '15m',
+    influencers: [],
+    detectors: [
+      {
+        function: 'mean',
+        field_name: 'responsetime',
+      },
+    ],
+  },
+  data_description: { time_field: '@timestamp' },
+  analysis_limits: { model_memory_limit: '10mb' },
+  model_plot_config: { enabled: true },
+};
+
+const FQ_MM_JOB_CONFIG: Job = {
+  job_id: `fq_multi_1_ae`,
+  description:
+    'mean/min/max(responsetime) partition=airline on farequote dataset with 1h bucket span',
+  groups: ['farequote', 'automated', 'multi-metric'],
+  analysis_config: {
+    bucket_span: '1h',
+    influencers: ['airline'],
+    detectors: [
+      { function: 'mean', field_name: 'responsetime', partition_field_name: 'airline' },
+      { function: 'min', field_name: 'responsetime', partition_field_name: 'airline' },
+      { function: 'max', field_name: 'responsetime', partition_field_name: 'airline' },
+    ],
+  },
+  data_description: { time_field: '@timestamp' },
+  analysis_limits: { model_memory_limit: '20mb' },
+  model_plot_config: { enabled: true },
+};
+
+const FQ_DATAFEED_CONFIG: Datafeed = {
+  datafeed_id: '',
+  indices: ['ft_farequote'],
+  job_id: '',
+  query: { bool: { must: [{ match_all: {} }] } },
+};
+
+const IHP_OUTLIER_DETECTION_CONFIG: DeepPartial<DataFrameAnalyticsConfig> = {
+  id: '',
+  description: 'Outlier detection job based on the Iowa house prices dataset',
+  source: {
+    index: ['ft_ihp_outlier'],
+    query: {
+      match_all: {},
+    },
+  },
+  dest: {
+    index: '',
+    results_field: 'ml',
+  },
+  analysis: {
+    outlier_detection: {},
+  },
+  analyzed_fields: {
+    includes: [],
+    excludes: [],
+  },
+  model_memory_limit: '5mb',
+};
+
+export function MachineLearningCommonConfigsProvider({}: FtrProviderContext) {
+  return {
+    getADFqSingleMetricJobConfig(jobId: string): Job {
+      const jobConfig = { ...FQ_SM_JOB_CONFIG, job_id: jobId };
+      return jobConfig;
+    },
+
+    getADFqMultiMetricJobConfig(jobId: string): Job {
+      const jobConfig = { ...FQ_MM_JOB_CONFIG, job_id: jobId };
+      return jobConfig;
+    },
+
+    getADFqDatafeedConfig(jobId: string): Datafeed {
+      const datafeedConfig = {
+        ...FQ_DATAFEED_CONFIG,
+        datafeed_id: `datafeed-${jobId}`,
+        job_id: jobId,
+      };
+      return datafeedConfig;
+    },
+
+    getDFAIhpOutlierDetectionJobConfig(dfaId: string): DataFrameAnalyticsConfig {
+      const dfaConfig = {
+        ...IHP_OUTLIER_DETECTION_CONFIG,
+        id: dfaId,
+        dest: { ...IHP_OUTLIER_DETECTION_CONFIG.dest, index: `user-${dfaId}` },
+      };
+      return dfaConfig as DataFrameAnalyticsConfig;
+    },
+  };
+}
diff --git a/x-pack/test/functional/services/ml/common_ui.ts b/x-pack/test/functional/services/ml/common_ui.ts
index b66fd7087654d0..319dc54fa6421d 100644
--- a/x-pack/test/functional/services/ml/common_ui.ts
+++ b/x-pack/test/functional/services/ml/common_ui.ts
@@ -78,5 +78,13 @@ export function MachineLearningCommonUIProvider({ getService }: FtrProviderConte
         await testSubjects.missingOrFail('mlLoadingIndicator');
       });
     },
+
+    async assertKibanaHomeFileDataVisLinkExists() {
+      await testSubjects.existOrFail('homeSynopsisLinkml_file_data_visualizer');
+    },
+
+    async assertKibanaHomeFileDataVisLinkNotExists() {
+      await testSubjects.missingOrFail('homeSynopsisLinkml_file_data_visualizer');
+    },
   };
 }
diff --git a/x-pack/test/functional/services/ml/data_frame_analytics.ts b/x-pack/test/functional/services/ml/data_frame_analytics.ts
index 634b0d4d41fcab..670e16ce4af944 100644
--- a/x-pack/test/functional/services/ml/data_frame_analytics.ts
+++ b/x-pack/test/functional/services/ml/data_frame_analytics.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import expect from '@kbn/expect';
+
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { MlApi } from './api';
 
@@ -32,29 +34,14 @@ export function MachineLearningDataFrameAnalyticsProvider(
       await testSubjects.existOrFail('mlAnalyticsButtonCreate');
     },
 
-    async assertRegressionEvaluatePanelElementsExists() {
-      await testSubjects.existOrFail('mlDFAnalyticsRegressionExplorationEvaluatePanel');
-      await testSubjects.existOrFail('mlDFAnalyticsRegressionGenMSEstat');
-      await testSubjects.existOrFail('mlDFAnalyticsRegressionGenRSquaredStat');
-      await testSubjects.existOrFail('mlDFAnalyticsRegressionTrainingMSEstat');
-      await testSubjects.existOrFail('mlDFAnalyticsRegressionTrainingRSquaredStat');
-    },
-
-    async assertRegressionTablePanelExists() {
-      await testSubjects.existOrFail('mlDFAnalyticsExplorationTablePanel');
-    },
-
-    async assertClassificationEvaluatePanelElementsExists() {
-      await testSubjects.existOrFail('mlDFAnalyticsClassificationExplorationEvaluatePanel');
-      await testSubjects.existOrFail('mlDFAnalyticsClassificationExplorationConfusionMatrix');
-    },
-
-    async assertClassificationTablePanelExists() {
-      await testSubjects.existOrFail('mlDFAnalyticsExplorationTablePanel');
-    },
-
-    async assertOutlierTablePanelExists() {
-      await testSubjects.existOrFail('mlDFAnalyticsOutlierExplorationTablePanel');
+    async assertCreateNewAnalyticsButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlAnalyticsButtonCreate');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected data frame analytics "create" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
     },
 
     async assertAnalyticsStatsBarExists() {
diff --git a/x-pack/test/functional/services/ml/data_frame_analytics_results.ts b/x-pack/test/functional/services/ml/data_frame_analytics_results.ts
new file mode 100644
index 00000000000000..b6a6ff8eb6c637
--- /dev/null
+++ b/x-pack/test/functional/services/ml/data_frame_analytics_results.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export function MachineLearningDataFrameAnalyticsResultsProvider({
+  getService,
+}: FtrProviderContext) {
+  const testSubjects = getService('testSubjects');
+
+  return {
+    async assertRegressionEvaluatePanelElementsExists() {
+      await testSubjects.existOrFail('mlDFAnalyticsRegressionExplorationEvaluatePanel');
+      await testSubjects.existOrFail('mlDFAnalyticsRegressionGenMSEstat');
+      await testSubjects.existOrFail('mlDFAnalyticsRegressionGenRSquaredStat');
+      await testSubjects.existOrFail('mlDFAnalyticsRegressionTrainingMSEstat');
+      await testSubjects.existOrFail('mlDFAnalyticsRegressionTrainingRSquaredStat');
+    },
+
+    async assertRegressionTablePanelExists() {
+      await testSubjects.existOrFail('mlDFAnalyticsExplorationTablePanel');
+    },
+
+    async assertClassificationEvaluatePanelElementsExists() {
+      await testSubjects.existOrFail('mlDFAnalyticsClassificationExplorationEvaluatePanel');
+      await testSubjects.existOrFail('mlDFAnalyticsClassificationExplorationConfusionMatrix');
+    },
+
+    async assertClassificationTablePanelExists() {
+      await testSubjects.existOrFail('mlDFAnalyticsExplorationTablePanel');
+    },
+
+    async assertOutlierTablePanelExists() {
+      await testSubjects.existOrFail('mlDFAnalyticsOutlierExplorationTablePanel');
+    },
+
+    async assertResultsTableExists() {
+      await testSubjects.existOrFail('mlExplorationDataGrid loaded', { timeout: 5000 });
+    },
+
+    async getResultTableRows() {
+      return await testSubjects.findAll('mlExplorationDataGrid loaded > dataGridRow');
+    },
+
+    async assertResultsTableNotEmpty() {
+      const resultTableRows = await this.getResultTableRows();
+      expect(resultTableRows.length).to.be.greaterThan(
+        0,
+        `DFA results table should have at least one row (got '${resultTableRows.length}')`
+      );
+    },
+  };
+}
diff --git a/x-pack/test/functional/services/ml/data_frame_analytics_table.ts b/x-pack/test/functional/services/ml/data_frame_analytics_table.ts
index 608a1f2bee3e10..cd2f26f3a660dc 100644
--- a/x-pack/test/functional/services/ml/data_frame_analytics_table.ts
+++ b/x-pack/test/functional/services/ml/data_frame_analytics_table.ts
@@ -9,8 +9,9 @@ import { WebElementWrapper } from 'test/functional/services/lib/web_element_wrap
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export function MachineLearningDataFrameAnalyticsTableProvider({ getService }: FtrProviderContext) {
-  const testSubjects = getService('testSubjects');
   const find = getService('find');
+  const retry = getService('retry');
+  const testSubjects = getService('testSubjects');
 
   return new (class AnalyticsTable {
     public async parseAnalyticsTable() {
@@ -62,6 +63,11 @@ export function MachineLearningDataFrameAnalyticsTableProvider({ getService }: F
       return rows;
     }
 
+    public rowSelector(analyticsId: string, subSelector?: string) {
+      const row = `~mlAnalyticsTable > ~row-${analyticsId}`;
+      return !subSelector ? row : `${row} > ${subSelector}`;
+    }
+
     public async waitForRefreshButtonLoaded() {
       await testSubjects.existOrFail('~mlAnalyticsRefreshListButton', { timeout: 10 * 1000 });
       await testSubjects.existOrFail('mlAnalyticsRefreshListButton loaded', { timeout: 30 * 1000 });
@@ -84,17 +90,29 @@ export function MachineLearningDataFrameAnalyticsTableProvider({ getService }: F
       return await tableListContainer.findByClassName('euiFieldSearch');
     }
 
-    async assertJobViewButtonExists() {
-      await testSubjects.existOrFail('mlAnalyticsJobViewButton');
+    public async assertJobRowViewButtonExists(analyticsId: string) {
+      await testSubjects.existOrFail(this.rowSelector(analyticsId, 'mlAnalyticsJobViewButton'));
     }
 
-    public async openEditFlyout(analyticsId: string) {
-      await this.openRowActions(analyticsId);
-      await testSubjects.click('mlAnalyticsJobEditButton');
-      await testSubjects.existOrFail('mlAnalyticsEditFlyout', { timeout: 5000 });
+    public async assertJobRowViewButtonEnabled(analyticsId: string, expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled(
+        this.rowSelector(analyticsId, 'mlAnalyticsJobViewButton')
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected data frame analytics row "view results" button for job '${analyticsId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async openResultsView(analyticsId: string) {
+      await this.assertJobRowViewButtonExists(analyticsId);
+      await testSubjects.click(this.rowSelector(analyticsId, 'mlAnalyticsJobViewButton'));
+      await testSubjects.existOrFail('mlPageDataFrameAnalyticsExploration', { timeout: 20 * 1000 });
     }
 
-    async assertAnalyticsSearchInputValue(expectedSearchValue: string) {
+    public async assertAnalyticsSearchInputValue(expectedSearchValue: string) {
       const searchBarInput = await this.getAnalyticsSearchInput();
       const actualSearchValue = await searchBarInput.getAttribute('value');
       expect(actualSearchValue).to.eql(
@@ -103,18 +121,19 @@ export function MachineLearningDataFrameAnalyticsTableProvider({ getService }: F
       );
     }
 
-    public async openResultsView() {
-      await this.assertJobViewButtonExists();
-      await testSubjects.click('mlAnalyticsJobViewButton');
-      await testSubjects.existOrFail('mlPageDataFrameAnalyticsExploration', { timeout: 20 * 1000 });
-    }
-
-    public async filterWithSearchString(filter: string) {
+    public async filterWithSearchString(filter: string, expectedRowCount: number = 1) {
       await this.waitForAnalyticsToLoad();
       const searchBarInput = await this.getAnalyticsSearchInput();
       await searchBarInput.clearValueWithKeyboard();
       await searchBarInput.type(filter);
       await this.assertAnalyticsSearchInputValue(filter);
+
+      const rows = await this.parseAnalyticsTable();
+      const filteredRows = rows.filter((row) => row.id === filter);
+      expect(filteredRows).to.have.length(
+        expectedRowCount,
+        `Filtered DFA job table should have ${expectedRowCount} row(s) for filter '${filter}' (got matching items '${filteredRows}')`
+      );
     }
 
     public async assertAnalyticsRowFields(analyticsId: string, expectedRow: object) {
@@ -129,15 +148,102 @@ export function MachineLearningDataFrameAnalyticsTableProvider({ getService }: F
       );
     }
 
-    public async openRowActions(analyticsId: string) {
-      await find.clickByCssSelector(
-        `[data-test-subj="mlAnalyticsTableRow row-${analyticsId}"] [data-test-subj=euiCollapsedItemActionsButton]`
+    public async assertJowRowActionsMenuButtonEnabled(analyticsId: string, expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled(
+        this.rowSelector(analyticsId, 'euiCollapsedItemActionsButton')
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected row action menu button for DFA job '${analyticsId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async ensureJobActionsMenuOpen(analyticsId: string) {
+      await retry.tryForTime(30 * 1000, async () => {
+        if (!(await testSubjects.exists('mlAnalyticsJobDeleteButton'))) {
+          await testSubjects.click(this.rowSelector(analyticsId, 'euiCollapsedItemActionsButton'));
+          await testSubjects.existOrFail('mlAnalyticsJobDeleteButton', { timeout: 5000 });
+        }
+      });
+    }
+
+    public async ensureJobActionsMenuClosed(analyticsId: string) {
+      await retry.tryForTime(30 * 1000, async () => {
+        if (await testSubjects.exists('mlAnalyticsJobDeleteButton')) {
+          await testSubjects.click(this.rowSelector(analyticsId, 'euiCollapsedItemActionsButton'));
+          await testSubjects.missingOrFail('mlAnalyticsJobDeleteButton', { timeout: 5000 });
+        }
+      });
+    }
+
+    public async assertJobActionViewButtonEnabled(analyticsId: string, expectedValue: boolean) {
+      await this.ensureJobActionsMenuOpen(analyticsId);
+      const actionMenuViewButton = await find.byCssSelector(
+        '[data-test-subj="mlAnalyticsJobViewButton"][class="euiContextMenuItem"]'
+      );
+      const isEnabled = await actionMenuViewButton.isEnabled();
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "view" action menu button for DFA job '${analyticsId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertJobActionStartButtonEnabled(analyticsId: string, expectedValue: boolean) {
+      await this.ensureJobActionsMenuOpen(analyticsId);
+      const isEnabled = await testSubjects.isEnabled('mlAnalyticsJobStartButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "start" action menu button for DFA job '${analyticsId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertJobActionEditButtonEnabled(analyticsId: string, expectedValue: boolean) {
+      await this.ensureJobActionsMenuOpen(analyticsId);
+      const isEnabled = await testSubjects.isEnabled('mlAnalyticsJobEditButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "edit" action menu button for DFA job '${analyticsId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
       );
-      await find.existsByCssSelector('.euiPanel', 20 * 1000);
+    }
+
+    public async assertJobActionCloneButtonEnabled(analyticsId: string, expectedValue: boolean) {
+      await this.ensureJobActionsMenuOpen(analyticsId);
+      const isEnabled = await testSubjects.isEnabled('mlAnalyticsJobCloneButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "clone" action menu button for DFA job '${analyticsId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertJobActionDeleteButtonEnabled(analyticsId: string, expectedValue: boolean) {
+      await this.ensureJobActionsMenuOpen(analyticsId);
+      const isEnabled = await testSubjects.isEnabled('mlAnalyticsJobDeleteButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "delete" action menu button for DFA job '${analyticsId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async openEditFlyout(analyticsId: string) {
+      await this.ensureJobActionsMenuOpen(analyticsId);
+      await testSubjects.click('mlAnalyticsJobEditButton');
+      await testSubjects.existOrFail('mlAnalyticsEditFlyout', { timeout: 5000 });
     }
 
     public async cloneJob(analyticsId: string) {
-      await this.openRowActions(analyticsId);
+      await this.ensureJobActionsMenuOpen(analyticsId);
       await testSubjects.click(`mlAnalyticsJobCloneButton`);
       await testSubjects.existOrFail('mlAnalyticsCreationContainer');
     }
diff --git a/x-pack/test/functional/services/ml/data_visualizer.ts b/x-pack/test/functional/services/ml/data_visualizer.ts
index c60ae29b6b3f40..976410d43a28f4 100644
--- a/x-pack/test/functional/services/ml/data_visualizer.ts
+++ b/x-pack/test/functional/services/ml/data_visualizer.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import expect from '@kbn/expect';
+
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export function MachineLearningDataVisualizerProvider({ getService }: FtrProviderContext) {
@@ -18,6 +20,26 @@ export function MachineLearningDataVisualizerProvider({ getService }: FtrProvide
       await testSubjects.existOrFail('mlDataVisualizerCardIndexData');
     },
 
+    async assertSelectIndexButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlDataVisualizerSelectIndexButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "select index" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
+    async assertUploadFileButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlDataVisualizerUploadFileButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "upload file" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
     async navigateToIndexPatternSelection() {
       await testSubjects.click('mlDataVisualizerSelectIndexButton');
       await testSubjects.existOrFail('mlPageSourceSelection');
diff --git a/x-pack/test/functional/services/ml/data_visualizer_file_based.ts b/x-pack/test/functional/services/ml/data_visualizer_file_based.ts
index 14c6f8de7d3293..61496debb97e28 100644
--- a/x-pack/test/functional/services/ml/data_visualizer_file_based.ts
+++ b/x-pack/test/functional/services/ml/data_visualizer_file_based.ts
@@ -54,6 +54,16 @@ export function MachineLearningDataVisualizerFileBasedProvider(
       await testSubjects.existOrFail('mlFileDataVisFileStatsPanel');
     },
 
+    async assertImportButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlFileDataVisOpenImportPageButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "import" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
     async navigateToFileImport() {
       await testSubjects.click('mlFileDataVisOpenImportPageButton');
       await testSubjects.existOrFail('mlPageFileDataVisImport');
diff --git a/x-pack/test/functional/services/ml/data_visualizer_index_based.ts b/x-pack/test/functional/services/ml/data_visualizer_index_based.ts
index 7789ca78363df4..31cd17e4df826a 100644
--- a/x-pack/test/functional/services/ml/data_visualizer_index_based.ts
+++ b/x-pack/test/functional/services/ml/data_visualizer_index_based.ts
@@ -119,6 +119,30 @@ export function MachineLearningDataVisualizerIndexBasedProvider({
       await this.assertFieldsPanelCardCount(panelFieldTypes, expectedCardCount);
     },
 
+    async assertActionsPanelExists() {
+      await testSubjects.existOrFail('mlDataVisualizerActionsPanel');
+    },
+
+    async assertActionsPanelNotExists() {
+      await testSubjects.missingOrFail('mlDataVisualizerActionsPanel');
+    },
+
+    async assertCreateAdvancedJobCardExists() {
+      await testSubjects.existOrFail('mlDataVisualizerCreateAdvancedJobCard');
+    },
+
+    async assertCreateAdvancedJobCardNotExists() {
+      await testSubjects.missingOrFail('mlDataVisualizerCreateAdvancedJobCard');
+    },
+
+    async assertRecognizerCardExists(moduleId: string) {
+      await testSubjects.existOrFail(`mlRecognizerCard ${moduleId}`);
+    },
+
+    async assertRecognizerCardNotExists(moduleId: string) {
+      await testSubjects.missingOrFail(`mlRecognizerCard ${moduleId}`);
+    },
+
     async clickCreateAdvancedJobButton() {
       await testSubjects.clickWhenNotDisabled('mlDataVisualizerCreateAdvancedJobCard');
     },
diff --git a/x-pack/test/functional/services/ml/index.ts b/x-pack/test/functional/services/ml/index.ts
index d7ff60440bf31e..325ea41ae3977b 100644
--- a/x-pack/test/functional/services/ml/index.ts
+++ b/x-pack/test/functional/services/ml/index.ts
@@ -10,11 +10,13 @@ import { MachineLearningAnomaliesTableProvider } from './anomalies_table';
 import { MachineLearningAnomalyExplorerProvider } from './anomaly_explorer';
 import { MachineLearningAPIProvider } from './api';
 import { MachineLearningCommonAPIProvider } from './common_api';
+import { MachineLearningCommonConfigsProvider } from './common_config';
 import { MachineLearningCommonUIProvider } from './common_ui';
 import { MachineLearningCustomUrlsProvider } from './custom_urls';
 import { MachineLearningDataFrameAnalyticsProvider } from './data_frame_analytics';
 import { MachineLearningDataFrameAnalyticsCreationProvider } from './data_frame_analytics_creation';
 import { MachineLearningDataFrameAnalyticsEditProvider } from './data_frame_analytics_edit';
+import { MachineLearningDataFrameAnalyticsResultsProvider } from './data_frame_analytics_results';
 import { MachineLearningDataFrameAnalyticsTableProvider } from './data_frame_analytics_table';
 import { MachineLearningDataVisualizerProvider } from './data_visualizer';
 import { MachineLearningDataVisualizerFileBasedProvider } from './data_visualizer_file_based';
@@ -30,9 +32,12 @@ import { MachineLearningJobWizardCategorizationProvider } from './job_wizard_cat
 import { MachineLearningJobWizardMultiMetricProvider } from './job_wizard_multi_metric';
 import { MachineLearningJobWizardPopulationProvider } from './job_wizard_population';
 import { MachineLearningNavigationProvider } from './navigation';
+import { MachineLearningOverviewPageProvider } from './overview_page';
 import { MachineLearningSecurityCommonProvider } from './security_common';
 import { MachineLearningSecurityUIProvider } from './security_ui';
 import { MachineLearningSettingsProvider } from './settings';
+import { MachineLearningSettingsCalendarProvider } from './settings_calendar';
+import { MachineLearningSettingsFilterListProvider } from './settings_filter_list';
 import { MachineLearningSingleMetricViewerProvider } from './single_metric_viewer';
 import { MachineLearningTestExecutionProvider } from './test_execution';
 import { MachineLearningTestResourcesProvider } from './test_resources';
@@ -44,6 +49,7 @@ export function MachineLearningProvider(context: FtrProviderContext) {
   const anomaliesTable = MachineLearningAnomaliesTableProvider(context);
   const anomalyExplorer = MachineLearningAnomalyExplorerProvider(context);
   const api = MachineLearningAPIProvider(context);
+  const commonConfig = MachineLearningCommonConfigsProvider(context);
   const customUrls = MachineLearningCustomUrlsProvider(context);
   const dataFrameAnalytics = MachineLearningDataFrameAnalyticsProvider(context, api);
   const dataFrameAnalyticsCreation = MachineLearningDataFrameAnalyticsCreationProvider(
@@ -52,6 +58,7 @@ export function MachineLearningProvider(context: FtrProviderContext) {
     api
   );
   const dataFrameAnalyticsEdit = MachineLearningDataFrameAnalyticsEditProvider(context, commonUI);
+  const dataFrameAnalyticsResults = MachineLearningDataFrameAnalyticsResultsProvider(context);
   const dataFrameAnalyticsTable = MachineLearningDataFrameAnalyticsTableProvider(context);
   const dataVisualizer = MachineLearningDataVisualizerProvider(context);
   const dataVisualizerFileBased = MachineLearningDataVisualizerFileBasedProvider(context, commonUI);
@@ -67,9 +74,12 @@ export function MachineLearningProvider(context: FtrProviderContext) {
   const jobWizardMultiMetric = MachineLearningJobWizardMultiMetricProvider(context);
   const jobWizardPopulation = MachineLearningJobWizardPopulationProvider(context);
   const navigation = MachineLearningNavigationProvider(context);
+  const overviewPage = MachineLearningOverviewPageProvider(context);
   const securityCommon = MachineLearningSecurityCommonProvider(context);
   const securityUI = MachineLearningSecurityUIProvider(context, securityCommon);
   const settings = MachineLearningSettingsProvider(context);
+  const settingsCalendar = MachineLearningSettingsCalendarProvider(context);
+  const settingsFilterList = MachineLearningSettingsFilterListProvider(context);
   const singleMetricViewer = MachineLearningSingleMetricViewerProvider(context);
   const testExecution = MachineLearningTestExecutionProvider(context);
   const testResources = MachineLearningTestResourcesProvider(context);
@@ -79,11 +89,13 @@ export function MachineLearningProvider(context: FtrProviderContext) {
     anomalyExplorer,
     api,
     commonAPI,
+    commonConfig,
     commonUI,
     customUrls,
     dataFrameAnalytics,
     dataFrameAnalyticsCreation,
     dataFrameAnalyticsEdit,
+    dataFrameAnalyticsResults,
     dataFrameAnalyticsTable,
     dataVisualizer,
     dataVisualizerFileBased,
@@ -99,9 +111,12 @@ export function MachineLearningProvider(context: FtrProviderContext) {
     jobWizardMultiMetric,
     jobWizardPopulation,
     navigation,
+    overviewPage,
     securityCommon,
     securityUI,
     settings,
+    settingsCalendar,
+    settingsFilterList,
     singleMetricViewer,
     testExecution,
     testResources,
diff --git a/x-pack/test/functional/services/ml/job_management.ts b/x-pack/test/functional/services/ml/job_management.ts
index 085bb312580121..4c6148ad6fac6f 100644
--- a/x-pack/test/functional/services/ml/job_management.ts
+++ b/x-pack/test/functional/services/ml/job_management.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import expect from '@kbn/expect';
+
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { MlApi } from './api';
 
@@ -29,6 +31,16 @@ export function MachineLearningJobManagementProvider(
       await testSubjects.existOrFail('mlCreateNewJobButton');
     },
 
+    async assertCreateNewJobButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlCreateNewJobButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected AD "Create job" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
     async assertJobStatsBarExists() {
       await testSubjects.existOrFail('~mlJobStatsBar');
     },
diff --git a/x-pack/test/functional/services/ml/job_table.ts b/x-pack/test/functional/services/ml/job_table.ts
index 58a1afad88e111..54c03c876af8a3 100644
--- a/x-pack/test/functional/services/ml/job_table.ts
+++ b/x-pack/test/functional/services/ml/job_table.ts
@@ -158,12 +158,19 @@ export function MachineLearningJobTableProvider({ getService }: FtrProviderConte
       await testSubjects.existOrFail('mlJobListTable loaded', { timeout: 30 * 1000 });
     }
 
-    public async filterWithSearchString(filter: string) {
+    public async filterWithSearchString(filter: string, expectedRowCount: number = 1) {
       await this.waitForJobsToLoad();
       const searchBar = await testSubjects.find('mlJobListSearchBar');
       const searchBarInput = await searchBar.findByTagName('input');
       await searchBarInput.clearValueWithKeyboard();
       await searchBarInput.type(filter);
+
+      const rows = await this.parseJobTable();
+      const filteredRows = rows.filter((row) => row.id === filter);
+      expect(filteredRows).to.have.length(
+        expectedRowCount,
+        `Filtered AD job table should have ${expectedRowCount} row(s) for filter '${filter}' (got matching items '${filteredRows}')`
+      );
     }
 
     public async assertJobRowFields(jobId: string, expectedRow: object) {
@@ -201,7 +208,93 @@ export function MachineLearningJobTableProvider({ getService }: FtrProviderConte
       }
     }
 
-    public async clickActionsMenu(jobId: string) {
+    public async assertJobActionSingleMetricViewerButtonEnabled(
+      jobId: string,
+      expectedValue: boolean
+    ) {
+      const isEnabled = await testSubjects.isEnabled(
+        this.rowSelector(jobId, 'mlOpenJobsInSingleMetricViewerButton')
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "open in single metric viewer" job action button for AD job '${jobId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertJobActionAnomalyExplorerButtonEnabled(
+      jobId: string,
+      expectedValue: boolean
+    ) {
+      const isEnabled = await testSubjects.isEnabled(
+        this.rowSelector(jobId, 'mlOpenJobsInAnomalyExplorerButton')
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "open in anomaly explorer" job action button for AD job '${jobId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertJobActionsMenuButtonEnabled(jobId: string, expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled(
+        this.rowSelector(jobId, 'euiCollapsedItemActionsButton')
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected actions menu button for AD job '${jobId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertJobActionStartDatafeedButtonEnabled(jobId: string, expectedValue: boolean) {
+      await this.ensureJobActionsMenuOpen(jobId);
+      const isEnabled = await testSubjects.isEnabled('mlActionButtonStartDatafeed');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "start datafeed" action button for AD job '${jobId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertJobActionCloneJobButtonEnabled(jobId: string, expectedValue: boolean) {
+      await this.ensureJobActionsMenuOpen(jobId);
+      const isEnabled = await testSubjects.isEnabled('mlActionButtonCloneJob');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "clone job" action button for AD job '${jobId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertJobActionEditJobButtonEnabled(jobId: string, expectedValue: boolean) {
+      await this.ensureJobActionsMenuOpen(jobId);
+      const isEnabled = await testSubjects.isEnabled('mlActionButtonEditJob');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "edit job" action button for AD job '${jobId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertJobActionDeleteJobButtonEnabled(jobId: string, expectedValue: boolean) {
+      await this.ensureJobActionsMenuOpen(jobId);
+      const isEnabled = await testSubjects.isEnabled('mlActionButtonDeleteJob');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "delete job" action button for AD job '${jobId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async ensureJobActionsMenuOpen(jobId: string) {
       await retry.tryForTime(30 * 1000, async () => {
         if (!(await testSubjects.exists('mlActionButtonDeleteJob'))) {
           await testSubjects.click(this.rowSelector(jobId, 'euiCollapsedItemActionsButton'));
@@ -211,13 +304,13 @@ export function MachineLearningJobTableProvider({ getService }: FtrProviderConte
     }
 
     public async clickCloneJobAction(jobId: string) {
-      await this.clickActionsMenu(jobId);
+      await this.ensureJobActionsMenuOpen(jobId);
       await testSubjects.click('mlActionButtonCloneJob');
       await testSubjects.existOrFail('~mlPageJobWizard');
     }
 
     public async clickDeleteJobAction(jobId: string) {
-      await this.clickActionsMenu(jobId);
+      await this.ensureJobActionsMenuOpen(jobId);
       await testSubjects.click('mlActionButtonDeleteJob');
       await testSubjects.existOrFail('mlDeleteJobConfirmModal');
     }
@@ -228,13 +321,138 @@ export function MachineLearningJobTableProvider({ getService }: FtrProviderConte
     }
 
     public async clickOpenJobInSingleMetricViewerButton(jobId: string) {
-      await testSubjects.click(`~openJobsInSingleMetricViewer-${jobId}`);
+      await testSubjects.click(this.rowSelector(jobId, 'mlOpenJobsInSingleMetricViewerButton'));
       await testSubjects.existOrFail('~mlPageSingleMetricViewer');
     }
 
     public async clickOpenJobInAnomalyExplorerButton(jobId: string) {
-      await testSubjects.click(`~openJobsInSingleAnomalyExplorer-${jobId}`);
+      await testSubjects.click(this.rowSelector(jobId, 'mlOpenJobsInAnomalyExplorerButton'));
       await testSubjects.existOrFail('~mlPageAnomalyExplorer');
     }
+
+    public async isJobRowSelected(jobId: string): Promise<boolean> {
+      return await testSubjects.isChecked(this.rowSelector(jobId, `checkboxSelectRow-${jobId}`));
+    }
+
+    public async assertJobRowSelected(jobId: string, expectedValue: boolean) {
+      const isSelected = await this.isJobRowSelected(jobId);
+      expect(isSelected).to.eql(
+        expectedValue,
+        `Expected job row for AD job '${jobId}' to be '${
+          expectedValue ? 'selected' : 'deselected'
+        }' (got '${isSelected ? 'selected' : 'deselected'}')`
+      );
+    }
+
+    public async selectJobRow(jobId: string) {
+      if ((await this.isJobRowSelected(jobId)) === false) {
+        await testSubjects.click(this.rowSelector(jobId, `checkboxSelectRow-${jobId}`));
+      }
+
+      await this.assertJobRowSelected(jobId, true);
+      await this.assertMultiSelectActionsAreaActive();
+    }
+
+    public async deselectJobRow(jobId: string) {
+      if ((await this.isJobRowSelected(jobId)) === true) {
+        await testSubjects.click(this.rowSelector(jobId, `checkboxSelectRow-${jobId}`));
+      }
+
+      await this.assertJobRowSelected(jobId, false);
+      await this.assertMultiSelectActionsAreaInactive();
+    }
+
+    public async assertMultiSelectActionsAreaActive() {
+      await testSubjects.existOrFail('mlADJobListMultiSelectActionsArea active');
+    }
+
+    public async assertMultiSelectActionsAreaInactive() {
+      await testSubjects.existOrFail('mlADJobListMultiSelectActionsArea inactive', {
+        allowHidden: true,
+      });
+    }
+
+    public async assertMultiSelectActionSingleMetricViewerButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled(
+        '~mlADJobListMultiSelectActionsArea > mlOpenJobsInSingleMetricViewerButton'
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected AD jobs multi select "open in single metric viewer" action button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertMultiSelectActionAnomalyExplorerButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled(
+        '~mlADJobListMultiSelectActionsArea > mlOpenJobsInAnomalyExplorerButton'
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected AD jobs multi select "open in anomaly explorer" action button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertMultiSelectActionEditJobGroupsButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled(
+        '~mlADJobListMultiSelectActionsArea > mlADJobListMultiSelectEditJobGroupsButton'
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected AD jobs multi select "edit job groups" action button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertMultiSelectManagementActionsButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled(
+        '~mlADJobListMultiSelectActionsArea > mlADJobListMultiSelectManagementActionsButton'
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected AD jobs multi select "management actions" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertMultiSelectStartDatafeedActionButtonEnabled(expectedValue: boolean) {
+      await this.ensureMultiSelectManagementActionsMenuOpen();
+      const isEnabled = await testSubjects.isEnabled(
+        'mlADJobListMultiSelectStartDatafeedActionButton'
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected AD jobs multi select "management actions" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async assertMultiSelectDeleteJobActionButtonEnabled(expectedValue: boolean) {
+      await this.ensureMultiSelectManagementActionsMenuOpen();
+      const isEnabled = await testSubjects.isEnabled('mlADJobListMultiSelectDeleteJobActionButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected AD jobs multi select "management actions" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
+    public async ensureMultiSelectManagementActionsMenuOpen() {
+      await retry.tryForTime(30 * 1000, async () => {
+        if (!(await testSubjects.exists('mlADJobListMultiSelectDeleteJobActionButton'))) {
+          await testSubjects.click('mlADJobListMultiSelectManagementActionsButton');
+          await testSubjects.existOrFail('mlADJobListMultiSelectDeleteJobActionButton', {
+            timeout: 5000,
+          });
+        }
+      });
+    }
   })();
 }
diff --git a/x-pack/test/functional/services/ml/navigation.ts b/x-pack/test/functional/services/ml/navigation.ts
index 116c9deb7c2dc6..9b53e5ce2f7e7e 100644
--- a/x-pack/test/functional/services/ml/navigation.ts
+++ b/x-pack/test/functional/services/ml/navigation.ts
@@ -84,14 +84,22 @@ export function MachineLearningNavigationProvider({
       await this.navigateToArea('~mlMainTab & ~settings', 'mlPageSettings');
     },
 
-    async navigateToStackManagementJobsListPage() {
+    async navigateToStackManagementJobsListPage({
+      expectAccessDenied = false,
+    }: {
+      expectAccessDenied?: boolean;
+    } = {}) {
       // clicks the jobsListLink and loads the jobs list page
       await testSubjects.click('jobsListLink');
       await retry.tryForTime(60 * 1000, async () => {
-        // verify that the overall page is present
-        await testSubjects.existOrFail('mlPageStackManagementJobsList');
-        // verify that the default tab with the anomaly detection jobs list got loaded
-        await testSubjects.existOrFail('ml-jobs-list');
+        if (expectAccessDenied === true) {
+          await testSubjects.existOrFail('mlPageAccessDenied');
+        } else {
+          // verify that the overall page is present
+          await testSubjects.existOrFail('mlPageStackManagementJobsList');
+          // verify that the default tab with the anomaly detection jobs list got loaded
+          await testSubjects.existOrFail('ml-jobs-list');
+        }
       });
     },
 
@@ -100,7 +108,7 @@ export function MachineLearningNavigationProvider({
       await testSubjects.click('mlStackManagementJobsListAnalyticsTab');
       await retry.tryForTime(60 * 1000, async () => {
         // verify that the empty prompt for analytics jobs list got loaded
-        await testSubjects.existOrFail('mlNoDataFrameAnalyticsFound');
+        await testSubjects.existOrFail('mlAnalyticsJobList');
       });
     },
 
@@ -121,5 +129,35 @@ export function MachineLearningNavigationProvider({
         await testSubjects.existOrFail('mlPageSingleMetricViewer');
       });
     },
+
+    async openKibanaNav() {
+      if (!(await testSubjects.exists('collapsibleNav'))) {
+        await testSubjects.click('toggleNavButton');
+      }
+      await testSubjects.existOrFail('collapsibleNav');
+    },
+
+    async assertKibanaNavMLEntryExists() {
+      const navArea = await testSubjects.find('collapsibleNav');
+      const mlNavLink = await navArea.findAllByCssSelector('[title="Machine Learning"]');
+      if (mlNavLink.length === 0) {
+        throw new Error(`expected ML link in nav menu to exist`);
+      }
+    },
+
+    async assertKibanaNavMLEntryNotExists() {
+      const navArea = await testSubjects.find('collapsibleNav');
+      const mlNavLink = await navArea.findAllByCssSelector('[title="Machine Learning"]');
+      if (mlNavLink.length !== 0) {
+        throw new Error(`expected ML link in nav menu to not exist`);
+      }
+    },
+
+    async navigateToKibanaHome() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await PageObjects.common.navigateToApp('home');
+        await testSubjects.existOrFail('homeApp', { timeout: 2000 });
+      });
+    },
   };
 }
diff --git a/x-pack/test/functional/services/ml/overview_page.ts b/x-pack/test/functional/services/ml/overview_page.ts
new file mode 100644
index 00000000000000..93b95a80cae377
--- /dev/null
+++ b/x-pack/test/functional/services/ml/overview_page.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export function MachineLearningOverviewPageProvider({ getService }: FtrProviderContext) {
+  const testSubjects = getService('testSubjects');
+
+  return {
+    async assertADCreateJobButtonExists() {
+      await testSubjects.existOrFail('mlOverviewCreateADJobButton');
+    },
+
+    async assertADCreateJobButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlOverviewCreateADJobButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected AD "Create job" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
+    async assertDFACreateJobButtonExists() {
+      await testSubjects.existOrFail('mlOverviewCreateDFAJobButton');
+    },
+
+    async assertDFACreateJobButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlOverviewCreateDFAJobButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected AD "Create job" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+  };
+}
diff --git a/x-pack/test/functional/services/ml/security_common.ts b/x-pack/test/functional/services/ml/security_common.ts
index cb331c95accb8e..67a28a0ab96cc4 100644
--- a/x-pack/test/functional/services/ml/security_common.ts
+++ b/x-pack/test/functional/services/ml/security_common.ts
@@ -10,9 +10,12 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 export type MlSecurityCommon = ProvidedType<typeof MachineLearningSecurityCommonProvider>;
 
 export enum USER {
-  ML_POWERUSER = 'ml_poweruser',
-  ML_VIEWER = 'ml_viewer',
-  ML_UNAUTHORIZED = 'ml_unauthorized',
+  ML_POWERUSER = 'ft_ml_poweruser',
+  ML_POWERUSER_SPACES = 'ft_ml_poweruser_spaces',
+  ML_VIEWER = 'ft_ml_viewer',
+  ML_VIEWER_SPACES = 'ft_ml_viewer_spaces',
+  ML_UNAUTHORIZED = 'ft_ml_unauthorized',
+  ML_UNAUTHORIZED_SPACES = 'ft_ml_unauthorized_spaces',
 }
 
 export function MachineLearningSecurityCommonProvider({ getService }: FtrProviderContext) {
@@ -20,53 +23,104 @@ export function MachineLearningSecurityCommonProvider({ getService }: FtrProvide
 
   const roles = [
     {
-      name: 'ml_source',
+      name: 'ft_ml_source',
       elasticsearch: {
         indices: [{ names: ['*'], privileges: ['read', 'view_index_metadata'] }],
       },
       kibana: [],
     },
     {
-      name: 'ml_dest',
+      name: 'ft_ml_source_readonly',
+      elasticsearch: {
+        indices: [{ names: ['*'], privileges: ['read'] }],
+      },
+      kibana: [],
+    },
+    {
+      name: 'ft_ml_dest',
       elasticsearch: {
         indices: [{ names: ['user-*'], privileges: ['read', 'index', 'manage'] }],
       },
       kibana: [],
     },
     {
-      name: 'ml_dest_readonly',
+      name: 'ft_ml_dest_readonly',
       elasticsearch: {
         indices: [{ names: ['user-*'], privileges: ['read'] }],
       },
       kibana: [],
     },
     {
-      name: 'ml_ui_extras',
+      name: 'ft_ml_ui_extras',
       elasticsearch: {
         cluster: ['manage_ingest_pipelines', 'monitor'],
       },
       kibana: [],
     },
+    {
+      name: 'ft_default_space_ml_all',
+      elasticsearch: { cluster: [], indices: [], run_as: [] },
+      kibana: [{ base: [], feature: { ml: ['all'] }, spaces: ['default'] }],
+    },
+    {
+      name: 'ft_default_space_ml_read',
+      elasticsearch: { cluster: [], indices: [], run_as: [] },
+      kibana: [{ base: [], feature: { ml: ['read'] }, spaces: ['default'] }],
+    },
+    {
+      name: 'ft_default_space_ml_none',
+      elasticsearch: { cluster: [], indices: [], run_as: [] },
+      kibana: [{ base: [], feature: { discover: ['read'] }, spaces: ['default'] }],
+    },
   ];
 
   const users = [
     {
-      name: 'ml_poweruser',
+      name: 'ft_ml_poweruser',
       full_name: 'ML Poweruser',
       password: 'mlp001',
-      roles: ['kibana_admin', 'machine_learning_admin', 'ml_source', 'ml_dest', 'ml_ui_extras'],
+      roles: [
+        'kibana_admin',
+        'machine_learning_admin',
+        'ft_ml_source',
+        'ft_ml_dest',
+        'ft_ml_ui_extras',
+      ],
     },
     {
-      name: 'ml_viewer',
+      name: 'ft_ml_poweruser_spaces',
+      full_name: 'ML Poweruser',
+      password: 'mlps001',
+      roles: ['ft_default_space_ml_all', 'ft_ml_source', 'ft_ml_dest', 'ft_ml_ui_extras'],
+    },
+    {
+      name: 'ft_ml_viewer',
       full_name: 'ML Viewer',
       password: 'mlv001',
-      roles: ['kibana_admin', 'machine_learning_user', 'ml_source', 'ml_dest_readonly'],
+      roles: [
+        'kibana_admin',
+        'machine_learning_user',
+        'ft_ml_source_readonly',
+        'ft_ml_dest_readonly',
+      ],
+    },
+    {
+      name: 'ft_ml_viewer_spaces',
+      full_name: 'ML Viewer',
+      password: 'mlvs001',
+      roles: ['ft_default_space_ml_read', 'ft_ml_source_readonly', 'ft_ml_dest_readonly'],
     },
     {
-      name: 'ml_unauthorized',
+      name: 'ft_ml_unauthorized',
       full_name: 'ML Unauthorized',
       password: 'mlu001',
-      roles: ['kibana_admin', 'ml_source'],
+      roles: ['kibana_admin', 'ft_ml_source_readonly'],
+    },
+    {
+      name: 'ft_ml_unauthorized_spaces',
+      full_name: 'ML Unauthorized',
+      password: 'mlus001',
+      roles: ['ft_default_space_ml_none', 'ft_ml_source_readonly'],
     },
   ];
 
diff --git a/x-pack/test/functional/services/ml/security_ui.ts b/x-pack/test/functional/services/ml/security_ui.ts
index 73516ca58dd5de..e09467ff36a34c 100644
--- a/x-pack/test/functional/services/ml/security_ui.ts
+++ b/x-pack/test/functional/services/ml/security_ui.ts
@@ -31,5 +31,9 @@ export function MachineLearningSecurityUIProvider(
     async loginAsMlViewer() {
       await this.loginAs(USER.ML_VIEWER);
     },
+
+    async logout() {
+      await PageObjects.security.forceLogout();
+    },
   };
 }
diff --git a/x-pack/test/functional/services/ml/settings.ts b/x-pack/test/functional/services/ml/settings.ts
index f7428d06899bf9..de77358836fea8 100644
--- a/x-pack/test/functional/services/ml/settings.ts
+++ b/x-pack/test/functional/services/ml/settings.ts
@@ -4,26 +4,78 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import expect from '@kbn/expect';
+
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export function MachineLearningSettingsProvider({ getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
 
   return {
-    async assertSettingsManageCalendarsLinkExists() {
+    async assertManageCalendarsLinkExists() {
       await testSubjects.existOrFail('mlCalendarsMngButton');
     },
 
-    async assertSettingsCreateCalendarLinkExists() {
+    async assertManageCalendarsLinkEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlCalendarsMngButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "manage calendars" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async assertCreateCalendarLinkExists() {
       await testSubjects.existOrFail('mlCalendarsCreateButton');
     },
 
-    async assertSettingsManageFilterListsLinkExists() {
+    async assertCreateCalendarLinkEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlCalendarsCreateButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "create calendars" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async assertManageFilterListsLinkExists() {
       await testSubjects.existOrFail('mlFilterListsMngButton');
     },
 
-    async assertSettingsCreateFilterListLinkExists() {
+    async assertManageFilterListsLinkEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlFilterListsMngButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "manage filter lists" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async assertCreateFilterListLinkExists() {
       await testSubjects.existOrFail('mlFilterListsCreateButton');
     },
+
+    async assertCreateFilterListLinkEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlFilterListsCreateButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "create filter lists" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async navigateToCalendarManagement() {
+      await testSubjects.click('mlCalendarsMngButton');
+      await testSubjects.existOrFail('mlPageCalendarManagement');
+    },
+
+    async navigateToFilterListsManagement() {
+      await testSubjects.click('mlFilterListsMngButton');
+      await testSubjects.existOrFail('mlPageFilterListManagement');
+    },
   };
 }
diff --git a/x-pack/test/functional/services/ml/settings_calendar.ts b/x-pack/test/functional/services/ml/settings_calendar.ts
new file mode 100644
index 00000000000000..34d18c6e12c474
--- /dev/null
+++ b/x-pack/test/functional/services/ml/settings_calendar.ts
@@ -0,0 +1,196 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export function MachineLearningSettingsCalendarProvider({ getService }: FtrProviderContext) {
+  const testSubjects = getService('testSubjects');
+
+  return {
+    async parseCalendarTable() {
+      const table = await testSubjects.find('~mlCalendarTable');
+      const $ = await table.parseDomContent();
+      const rows = [];
+
+      for (const tr of $.findTestSubjects('~mlCalendarListRow').toArray()) {
+        const $tr = $(tr);
+
+        rows.push({
+          id: $tr
+            .findTestSubject('mlCalendarListColumnId')
+            .find('.euiTableCellContent')
+            .text()
+            .trim(),
+          jobs: $tr
+            .findTestSubject('mlCalendarListColumnJobs')
+            .find('.euiTableCellContent')
+            .text()
+            .trim(),
+          events: $tr
+            .findTestSubject('mlCalendarListColumnEvents')
+            .find('.euiTableCellContent')
+            .text()
+            .trim(),
+        });
+      }
+
+      return rows;
+    },
+
+    rowSelector(calendarId: string, subSelector?: string) {
+      const row = `~mlCalendarTable > ~row-${calendarId}`;
+      return !subSelector ? row : `${row} > ${subSelector}`;
+    },
+
+    async filterWithSearchString(filter: string, expectedRowCount: number = 1) {
+      const tableListContainer = await testSubjects.find('mlCalendarTableContainer');
+      const searchBarInput = await tableListContainer.findByClassName('euiFieldSearch');
+      await searchBarInput.clearValueWithKeyboard();
+      await searchBarInput.type(filter);
+
+      const rows = await this.parseCalendarTable();
+      const filteredRows = rows.filter((row) => row.id === filter);
+      expect(filteredRows).to.have.length(
+        expectedRowCount,
+        `Filtered calendar table should have ${expectedRowCount} row(s) for filter '${filter}' (got matching items '${filteredRows}')`
+      );
+    },
+
+    async isCalendarRowSelected(calendarId: string): Promise<boolean> {
+      return await testSubjects.isChecked(
+        this.rowSelector(calendarId, `checkboxSelectRow-${calendarId}`)
+      );
+    },
+
+    async assertCalendarRowSelected(calendarId: string, expectedValue: boolean) {
+      const isSelected = await this.isCalendarRowSelected(calendarId);
+      expect(isSelected).to.eql(
+        expectedValue,
+        `Expected calendar row for calendar '${calendarId}' to be '${
+          expectedValue ? 'selected' : 'deselected'
+        }' (got '${isSelected ? 'selected' : 'deselected'}')`
+      );
+    },
+
+    async selectCalendarRow(calendarId: string) {
+      if ((await this.isCalendarRowSelected(calendarId)) === false) {
+        await testSubjects.click(this.rowSelector(calendarId, `checkboxSelectRow-${calendarId}`));
+      }
+
+      await this.assertCalendarRowSelected(calendarId, true);
+    },
+
+    async deselectCalendarRow(calendarId: string) {
+      if ((await this.isCalendarRowSelected(calendarId)) === true) {
+        await testSubjects.click(this.rowSelector(calendarId, `checkboxSelectRow-${calendarId}`));
+      }
+
+      await this.assertCalendarRowSelected(calendarId, false);
+    },
+
+    async assertCreateCalendarButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlCalendarButtonCreate');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "create calendar" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async assertDeleteCalendarButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlCalendarButtonDelete');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "delete calendar" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async openCalendarEditForm(calendarId: string) {
+      await testSubjects.click(this.rowSelector(calendarId, 'mlEditCalendarLink'));
+      await testSubjects.existOrFail('mlPageCalendarEdit');
+    },
+
+    async assertApplyToAllJobsSwitchEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlCalendarApplyToAllJobsSwitch');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "apply calendar to all jobs" switch to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async assertJobSelectionEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled(
+        'mlCalendarJobSelection > comboBoxToggleListButton'
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "job" selection to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
+    async assertJobGroupSelectionEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled(
+        'mlCalendarJobGroupSelection > comboBoxToggleListButton'
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "job group" selection to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
+    async assertNewEventButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlCalendarNewEventButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "new event" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
+    async assertImportEventsButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlCalendarImportEventsButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "imports events" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
+    eventRowSelector(eventDescription: string, subSelector?: string) {
+      const row = `~mlCalendarEventsTable > ~row-${eventDescription}`;
+      return !subSelector ? row : `${row} > ${subSelector}`;
+    },
+
+    async assertEventRowExists(eventDescription: string) {
+      await testSubjects.existOrFail(this.eventRowSelector(eventDescription));
+    },
+
+    async assertDeleteEventButtonEnabled(eventDescription: string, expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled(
+        this.eventRowSelector(eventDescription, 'mlCalendarEventDeleteButton')
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "delete event" button for event '${eventDescription}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+  };
+}
diff --git a/x-pack/test/functional/services/ml/settings_filter_list.ts b/x-pack/test/functional/services/ml/settings_filter_list.ts
new file mode 100644
index 00000000000000..fb1f203b655628
--- /dev/null
+++ b/x-pack/test/functional/services/ml/settings_filter_list.ts
@@ -0,0 +1,200 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export function MachineLearningSettingsFilterListProvider({ getService }: FtrProviderContext) {
+  const testSubjects = getService('testSubjects');
+
+  return {
+    async parseFilterListTable() {
+      const table = await testSubjects.find('~mlFilterListsTable');
+      const $ = await table.parseDomContent();
+      const rows = [];
+
+      for (const tr of $.findTestSubjects('~mlCalendarListRow').toArray()) {
+        const $tr = $(tr);
+
+        const inUseSubject = $tr
+          .findTestSubject('mlFilterListColumnInUse')
+          .findTestSubject('~mlFilterListUsedByIcon')
+          .attr('data-test-subj');
+        const inUseString = inUseSubject.split(' ')[1];
+        const inUse = inUseString === 'inUse' ? true : false;
+
+        rows.push({
+          id: $tr
+            .findTestSubject('mlFilterListColumnId')
+            .find('.euiTableCellContent')
+            .text()
+            .trim(),
+          description: $tr
+            .findTestSubject('mlFilterListColumnDescription')
+            .find('.euiTableCellContent')
+            .text()
+            .trim(),
+          itemCount: $tr
+            .findTestSubject('mlFilterListColumnItemCount')
+            .find('.euiTableCellContent')
+            .text()
+            .trim(),
+          inUse,
+        });
+      }
+
+      return rows;
+    },
+
+    rowSelector(filterId: string, subSelector?: string) {
+      const row = `~mlFilterListsTable > ~row-${filterId}`;
+      return !subSelector ? row : `${row} > ${subSelector}`;
+    },
+
+    async filterWithSearchString(filter: string, expectedRowCount: number = 1) {
+      const tableListContainer = await testSubjects.find('mlFilterListTableContainer');
+      const searchBarInput = await tableListContainer.findByClassName('euiFieldSearch');
+      await searchBarInput.clearValueWithKeyboard();
+      await searchBarInput.type(filter);
+
+      const rows = await this.parseFilterListTable();
+      const filteredRows = rows.filter((row) => row.id === filter);
+      expect(filteredRows).to.have.length(
+        expectedRowCount,
+        `Filtered filter list table should have ${expectedRowCount} row(s) for filter '${filter}' (got matching items '${filteredRows}')`
+      );
+    },
+
+    async isFilterListRowSelected(filterId: string): Promise<boolean> {
+      return await testSubjects.isChecked(
+        this.rowSelector(filterId, `checkboxSelectRow-${filterId}`)
+      );
+    },
+
+    async assertFilterListRowSelected(filterId: string, expectedValue: boolean) {
+      const isSelected = await this.isFilterListRowSelected(filterId);
+      expect(isSelected).to.eql(
+        expectedValue,
+        `Expected filter list row for filter list '${filterId}' to be '${
+          expectedValue ? 'selected' : 'deselected'
+        }' (got '${isSelected ? 'selected' : 'deselected'}')`
+      );
+    },
+
+    async selectFilterListRow(filterId: string) {
+      if ((await this.isFilterListRowSelected(filterId)) === false) {
+        await testSubjects.click(this.rowSelector(filterId, `checkboxSelectRow-${filterId}`));
+      }
+
+      await this.assertFilterListRowSelected(filterId, true);
+    },
+
+    async deselectFilterListRow(filterId: string) {
+      if ((await this.isFilterListRowSelected(filterId)) === true) {
+        await testSubjects.click(this.rowSelector(filterId, `checkboxSelectRow-${filterId}`));
+      }
+
+      await this.assertFilterListRowSelected(filterId, false);
+    },
+
+    async assertCreateFilterListButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlFilterListsButtonCreate');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "create filter list" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async assertDeleteFilterListButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlFilterListsDeleteButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "delete filter list" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async openFilterListEditForm(filterId: string) {
+      await testSubjects.click(this.rowSelector(filterId, 'mlEditFilterListLink'));
+      await testSubjects.existOrFail('mlPageFilterListEdit');
+    },
+
+    async assertEditDescriptionButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlFilterListEditDescriptionButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "edit filter list description" button to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    },
+
+    async assertAddItemButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlFilterListAddItemButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "add item" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
+    async assertDeleteItemButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlFilterListDeleteItemButton');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "delete item" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
+    filterItemSelector(filterItem: string, subSelector?: string) {
+      const row = `mlGridItem ${filterItem}`;
+      return !subSelector ? row : `${row} > ${subSelector}`;
+    },
+
+    async assertFilterItemExists(filterItem: string) {
+      await testSubjects.existOrFail(this.filterItemSelector(filterItem));
+    },
+
+    async isFilterItemSelected(filterItem: string): Promise<boolean> {
+      return await testSubjects.isChecked(
+        this.filterItemSelector(filterItem, 'mlGridItemCheckbox')
+      );
+    },
+
+    async assertFilterItemSelected(filterItem: string, expectedValue: boolean) {
+      const isSelected = await this.isFilterItemSelected(filterItem);
+      expect(isSelected).to.eql(
+        expectedValue,
+        `Expected filter item '${filterItem}' to be '${
+          expectedValue ? 'selected' : 'deselected'
+        }' (got '${isSelected ? 'selected' : 'deselected'}')`
+      );
+    },
+
+    async selectFilterItem(filterItem: string) {
+      if ((await this.isFilterItemSelected(filterItem)) === false) {
+        await testSubjects.click(this.filterItemSelector(filterItem));
+      }
+
+      await this.assertFilterItemSelected(filterItem, true);
+    },
+
+    async deselectFilterItem(filterItem: string) {
+      if ((await this.isFilterItemSelected(filterItem)) === true) {
+        await testSubjects.click(this.filterItemSelector(filterItem));
+      }
+
+      await this.assertFilterItemSelected(filterItem, false);
+    },
+  };
+}
diff --git a/x-pack/test/functional/services/ml/single_metric_viewer.ts b/x-pack/test/functional/services/ml/single_metric_viewer.ts
index a65ac09a0b0564..c6b912d83fae6a 100644
--- a/x-pack/test/functional/services/ml/single_metric_viewer.ts
+++ b/x-pack/test/functional/services/ml/single_metric_viewer.ts
@@ -8,6 +8,7 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export function MachineLearningSingleMetricViewerProvider({ getService }: FtrProviderContext) {
+  const comboBox = getService('comboBox');
   const testSubjects = getService('testSubjects');
 
   return {
@@ -15,12 +16,24 @@ export function MachineLearningSingleMetricViewerProvider({ getService }: FtrPro
       await testSubjects.existOrFail('mlNoSingleMetricJobsFound');
     },
 
-    async assertForecastButtonExistsExsist() {
+    async assertForecastButtonExists() {
       await testSubjects.existOrFail(
         'mlSingleMetricViewerSeriesControls > mlSingleMetricViewerButtonForecast'
       );
     },
 
+    async assertForecastButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled(
+        'mlSingleMetricViewerSeriesControls > mlSingleMetricViewerButtonForecast'
+      );
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected "forecast" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
     async assertDetectorInputExsist() {
       await testSubjects.existOrFail(
         'mlSingleMetricViewerSeriesControls > mlSingleMetricViewerDetectorSelect'
@@ -46,6 +59,28 @@ export function MachineLearningSingleMetricViewerProvider({ getService }: FtrPro
       await this.assertDetectorInputValue(detectorOptionValue);
     },
 
+    async assertEntityInputExsist(entityFieldName: string) {
+      await testSubjects.existOrFail(`mlSingleMetricViewerEntitySelection ${entityFieldName}`);
+    },
+
+    async assertEntityInputSelection(entityFieldName: string, expectedIdentifier: string[]) {
+      const comboBoxSelectedOptions = await comboBox.getComboBoxSelectedOptions(
+        `mlSingleMetricViewerEntitySelection ${entityFieldName}  > comboBoxInput`
+      );
+      expect(comboBoxSelectedOptions).to.eql(
+        expectedIdentifier,
+        `Expected entity field selection for '${entityFieldName}' to be '${expectedIdentifier}' (got '${comboBoxSelectedOptions}')`
+      );
+    },
+
+    async selectEntityValue(entityFieldName: string, entityFieldValue: string) {
+      await comboBox.set(
+        `mlSingleMetricViewerEntitySelection ${entityFieldName}  > comboBoxInput`,
+        entityFieldValue
+      );
+      await this.assertEntityInputSelection(entityFieldName, [entityFieldValue]);
+    },
+
     async assertChartExsist() {
       await testSubjects.existOrFail('mlSingleMetricViewerChart');
     },
@@ -55,5 +90,32 @@ export function MachineLearningSingleMetricViewerProvider({ getService }: FtrPro
         timeout: 30 * 1000,
       });
     },
+
+    async openForecastModal() {
+      await testSubjects.click(
+        'mlSingleMetricViewerSeriesControls > mlSingleMetricViewerButtonForecast'
+      );
+      await testSubjects.existOrFail('mlModalForecast');
+    },
+
+    async closeForecastModal() {
+      await testSubjects.click('mlModalForecast > mlModalForecastButtonClose');
+      await testSubjects.missingOrFail('mlModalForecast');
+    },
+
+    async assertForecastModalRunButtonEnabled(expectedValue: boolean) {
+      const isEnabled = await testSubjects.isEnabled('mlModalForecast > mlModalForecastButtonRun');
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected forecast "run" button to be '${expectedValue ? 'enabled' : 'disabled'}' (got '${
+          isEnabled ? 'enabled' : 'disabled'
+        }')`
+      );
+    },
+
+    async openAnomalyExplorer() {
+      await testSubjects.click('mlAnomalyResultsViewSelectorExplorer');
+      await testSubjects.existOrFail('mlPageAnomalyExplorer');
+    },
   };
 }
diff --git a/x-pack/test/functional/services/transform/security_ui.ts b/x-pack/test/functional/services/transform/security_ui.ts
index 9c167e429941f6..ced4625d0eb0e2 100644
--- a/x-pack/test/functional/services/transform/security_ui.ts
+++ b/x-pack/test/functional/services/transform/security_ui.ts
@@ -31,5 +31,9 @@ export function TransformSecurityUIProvider(
     async loginAsTransformViewer() {
       await this.loginAs(USER.TRANSFORM_VIEWER);
     },
+
+    async logout() {
+      await PageObjects.security.forceLogout();
+    },
   };
 }
diff --git a/x-pack/test/functional/services/transform/transform_table.ts b/x-pack/test/functional/services/transform/transform_table.ts
index 37d8b6e51072ff..77e52b642261bb 100644
--- a/x-pack/test/functional/services/transform/transform_table.ts
+++ b/x-pack/test/functional/services/transform/transform_table.ts
@@ -116,12 +116,19 @@ export function TransformTableProvider({ getService }: FtrProviderContext) {
       await testSubjects.existOrFail('transformListTable loaded', { timeout: 30 * 1000 });
     }
 
-    public async filterWithSearchString(filter: string) {
+    public async filterWithSearchString(filter: string, expectedRowCount: number = 1) {
       await this.waitForTransformsToLoad();
       const tableListContainer = await testSubjects.find('transformListTableContainer');
       const searchBarInput = await tableListContainer.findByClassName('euiFieldSearch');
       await searchBarInput.clearValueWithKeyboard();
       await searchBarInput.type(filter);
+
+      const rows = await this.parseTransformTable();
+      const filteredRows = rows.filter((row) => row.id === filter);
+      expect(filteredRows).to.have.length(
+        expectedRowCount,
+        `Filtered DFA job table should have ${expectedRowCount} row(s) for filter '${filter}' (got matching items '${filteredRows}')`
+      );
     }
 
     public async assertTransformRowFields(transformId: string, expectedRow: object) {
diff --git a/x-pack/test/ingest_manager_api_integration/apis/agent_policy/agent_policy.ts b/x-pack/test/ingest_manager_api_integration/apis/agent_policy/agent_policy.ts
index b55da0798c5f06..410b0fe0930024 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/agent_policy/agent_policy.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/agent_policy/agent_policy.ts
@@ -14,7 +14,7 @@ export default function ({ getService }: FtrProviderContext) {
   describe('ingest_manager_agent_policies', () => {
     describe('POST /api/ingest_manager/agent_policies', () => {
       it('should work with valid values', async () => {
-        const { body: apiResponse } = await supertest
+        await supertest
           .post(`/api/ingest_manager/agent_policies`)
           .set('kbn-xsrf', 'xxxx')
           .send({
@@ -22,8 +22,6 @@ export default function ({ getService }: FtrProviderContext) {
             namespace: 'default',
           })
           .expect(200);
-
-        expect(apiResponse.success).to.be(true);
       });
 
       it('should return a 400 with an empty namespace', async () => {
@@ -61,7 +59,7 @@ export default function ({ getService }: FtrProviderContext) {
 
       it('should work with valid values', async () => {
         const {
-          body: { success, item },
+          body: { item },
         } = await supertest
           .post(`/api/ingest_manager/agent_policies/${TEST_POLICY_ID}/copy`)
           .set('kbn-xsrf', 'xxxx')
@@ -73,7 +71,6 @@ export default function ({ getService }: FtrProviderContext) {
         // eslint-disable-next-line @typescript-eslint/naming-convention
         const { id, updated_at, ...newPolicy } = item;
 
-        expect(success).to.be(true);
         expect(newPolicy).to.eql({
           name: 'Copied policy',
           description: 'Test',
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/acks.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/acks.ts
index c9fa80c88762bf..1613ca9d11ee66 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/acks.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/acks.ts
@@ -90,7 +90,6 @@ export default function (providerContext: FtrProviderContext) {
         })
         .expect(200);
       expect(apiResponse.action).to.be('acks');
-      expect(apiResponse.success).to.be(true);
       const { body: eventResponse } = await supertest
         .get(`/api/ingest_manager/fleet/agents/agent1/events`)
         .set('kbn-xsrf', 'xx')
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/actions.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/actions.ts
index 8dc4e5c232b800..2b4bb335dfc5c9 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/actions.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/actions.ts
@@ -33,7 +33,6 @@ export default function (providerContext: FtrProviderContext) {
         })
         .expect(200);
 
-      expect(apiResponse.success).to.be(true);
       expect(apiResponse.item.data).to.eql({ data: 'action_data' });
       expect(apiResponse.item.sent_at).to.be('2020-03-18T19:45:02.620Z');
     });
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/checkin.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/checkin.ts
index 79f6cfae175e19..fbfc94a0840b04 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/checkin.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/checkin.ts
@@ -102,7 +102,6 @@ export default function (providerContext: FtrProviderContext) {
         .expect(200);
 
       expect(apiResponse.action).to.be('checkin');
-      expect(apiResponse.success).to.be(true);
     });
   });
 }
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/complete_flow.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/complete_flow.ts
index 2d14a7a10e6685..1d5b682d71c7ab 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/complete_flow.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/complete_flow.ts
@@ -62,7 +62,6 @@ export default function (providerContext: FtrProviderContext) {
           },
         })
         .expect(200);
-      expect(enrollmentResponse.success).to.eql(true);
 
       const agentAccessAPIKey = enrollmentResponse.item.access_api_key;
 
@@ -76,14 +75,13 @@ export default function (providerContext: FtrProviderContext) {
         })
         .expect(200);
 
-      expect(checkinApiResponse.success).to.eql(true);
       expect(checkinApiResponse.actions).length(1);
       expect(checkinApiResponse.actions[0].type).be('CONFIG_CHANGE');
       const policyChangeAction = checkinApiResponse.actions[0];
       const defaultOutputApiKey = policyChangeAction.data.config.outputs.default.api_key;
 
       // Ack actions
-      const { body: ackApiResponse } = await supertestWithoutAuth
+      await supertestWithoutAuth
         .post(`/api/ingest_manager/fleet/agents/${enrollmentResponse.item.id}/acks`)
         .set('Authorization', `ApiKey ${agentAccessAPIKey}`)
         .set('kbn-xsrf', 'xx')
@@ -102,7 +100,6 @@ export default function (providerContext: FtrProviderContext) {
           ],
         })
         .expect(200);
-      expect(ackApiResponse.success).to.eql(true);
 
       // Second agent checkin
       const { body: secondCheckinApiResponse } = await supertestWithoutAuth
@@ -113,7 +110,6 @@ export default function (providerContext: FtrProviderContext) {
           events: [],
         })
         .expect(200);
-      expect(secondCheckinApiResponse.success).to.eql(true);
       expect(secondCheckinApiResponse.actions).length(0);
 
       // Get agent
@@ -121,18 +117,16 @@ export default function (providerContext: FtrProviderContext) {
         .get(`/api/ingest_manager/fleet/agents/${enrollmentResponse.item.id}`)
         .expect(200);
 
-      expect(getAgentApiResponse.success).to.eql(true);
       expect(getAgentApiResponse.item.packages).to.contain(
         'system',
         "Agent should run the 'system' package"
       );
 
       // Unenroll agent
-      const { body: unenrollResponse } = await supertest
+      await supertest
         .post(`/api/ingest_manager/fleet/agents/${enrollmentResponse.item.id}/unenroll`)
         .set('kbn-xsrf', 'xx')
         .expect(200);
-      expect(unenrollResponse.success).to.eql(true);
 
       //  Checkin after unenrollment
       const { body: checkinAfterUnenrollResponse } = await supertestWithoutAuth
@@ -144,13 +138,12 @@ export default function (providerContext: FtrProviderContext) {
         })
         .expect(200);
 
-      expect(checkinAfterUnenrollResponse.success).to.eql(true);
       expect(checkinAfterUnenrollResponse.actions).length(1);
       expect(checkinAfterUnenrollResponse.actions[0].type).be('UNENROLL');
       const unenrollAction = checkinAfterUnenrollResponse.actions[0];
 
       //  ack unenroll actions
-      const { body: ackUnenrollApiResponse } = await supertestWithoutAuth
+      await supertestWithoutAuth
         .post(`/api/ingest_manager/fleet/agents/${enrollmentResponse.item.id}/acks`)
         .set('Authorization', `ApiKey ${agentAccessAPIKey}`)
         .set('kbn-xsrf', 'xx')
@@ -168,7 +161,6 @@ export default function (providerContext: FtrProviderContext) {
           ],
         })
         .expect(200);
-      expect(ackUnenrollApiResponse.success).to.eql(true);
 
       // Checkin after unenrollment acknowledged
       await supertestWithoutAuth
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/delete.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/delete.ts
index dc05b7a4dd792e..65fbdabe8bd790 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/delete.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/delete.ts
@@ -68,7 +68,6 @@ export default function ({ getService }: FtrProviderContext) {
         .expect(404);
 
       expect(apiResponse).not.to.eql({
-        success: true,
         action: 'deleted',
       });
     });
@@ -88,7 +87,6 @@ export default function ({ getService }: FtrProviderContext) {
         .set('kbn-xsrf', 'xx')
         .expect(200);
       expect(apiResponse).to.eql({
-        success: true,
         action: 'deleted',
       });
     });
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/enroll.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/enroll.ts
index ce356dbd081c88..eef0d3beb69d07 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/enroll.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/enroll.ts
@@ -115,7 +115,7 @@ export default function (providerContext: FtrProviderContext) {
           },
         })
         .expect(400);
-      expect(apiResponse.message).to.match(/Agent version is not compatible with kibana/);
+      expect(apiResponse.message).to.match(/is not compatible/);
     });
 
     it('should allow to enroll an agent with a valid enrollment token', async () => {
@@ -136,7 +136,6 @@ export default function (providerContext: FtrProviderContext) {
           },
         })
         .expect(200);
-      expect(apiResponse.success).to.eql(true);
       expect(apiResponse.item).to.have.keys('id', 'active', 'access_api_key', 'type', 'policy_id');
     });
 
@@ -158,7 +157,7 @@ export default function (providerContext: FtrProviderContext) {
           },
         })
         .expect(200);
-      expect(apiResponse.success).to.eql(true);
+
       const { body: privileges } = await getEsClientForAPIKey(
         providerContext,
         apiResponse.item.access_api_key
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/list.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/list.ts
index 23563c6f43bbec..1ee00ed7201692 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/list.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/list.ts
@@ -78,8 +78,7 @@ export default function ({ getService }: FtrProviderContext) {
         .auth(users.fleet_admin.username, users.fleet_admin.password)
         .expect(200);
 
-      expect(apiResponse).to.have.keys('success', 'page', 'total', 'list');
-      expect(apiResponse.success).to.eql(true);
+      expect(apiResponse).to.have.keys('page', 'total', 'list');
       expect(apiResponse.total).to.eql(4);
     });
     it('should return the list of agents when requesting as a user with fleet read permissions', async () => {
@@ -87,8 +86,7 @@ export default function ({ getService }: FtrProviderContext) {
         .get(`/api/ingest_manager/fleet/agents`)
         .auth(users.fleet_user.username, users.fleet_user.password)
         .expect(200);
-      expect(apiResponse).to.have.keys('success', 'page', 'total', 'list');
-      expect(apiResponse.success).to.eql(true);
+      expect(apiResponse).to.have.keys('page', 'total', 'list');
       expect(apiResponse.total).to.eql(4);
     });
     it('should not return the list of agents when requesting as a user without fleet permissions', async () => {
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/unenroll.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/unenroll.ts
index d1ff8731183ba4..d24e438fa13eab 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/unenroll.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/unenroll.ts
@@ -65,20 +65,17 @@ export default function (providerContext: FtrProviderContext) {
     });
 
     it('allow to unenroll using a list of ids', async () => {
-      const { body } = await supertest
+      await supertest
         .post(`/api/ingest_manager/fleet/agents/agent1/unenroll`)
         .set('kbn-xsrf', 'xxx')
         .send({
           force: true,
         })
         .expect(200);
-
-      expect(body).to.have.keys('success');
-      expect(body.success).to.be(true);
     });
 
     it('should invalidate related API keys', async () => {
-      const { body } = await supertest
+      await supertest
         .post(`/api/ingest_manager/fleet/agents/agent1/unenroll`)
         .set('kbn-xsrf', 'xxx')
         .send({
@@ -86,9 +83,6 @@ export default function (providerContext: FtrProviderContext) {
         })
         .expect(200);
 
-      expect(body).to.have.keys('success');
-      expect(body.success).to.be(true);
-
       const {
         body: { api_keys: accessAPIKeys },
       } = await esClient.security.getApiKey({ id: accessAPIKeyId });
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/enrollment_api_keys/crud.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/enrollment_api_keys/crud.ts
index 275462072919bb..6c5d552a51eb9c 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/enrollment_api_keys/crud.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/enrollment_api_keys/crud.ts
@@ -67,13 +67,11 @@ export default function (providerContext: FtrProviderContext) {
       });
 
       it('should invalide an existing api keys', async () => {
-        const { body: apiResponse } = await supertest
+        await supertest
           .delete(`/api/ingest_manager/fleet/enrollment-api-keys/${keyId}`)
           .set('kbn-xsrf', 'xxx')
           .expect(200);
 
-        expect(apiResponse.success).to.eql(true);
-
         const {
           body: { api_keys: apiKeys },
         } = await es.security.getApiKey({ id: esApiKeyId });
@@ -113,7 +111,6 @@ export default function (providerContext: FtrProviderContext) {
           })
           .expect(200);
 
-        expect(apiResponse.success).to.eql(true);
         expect(apiResponse.item).to.have.keys('id', 'api_key', 'api_key_id', 'name', 'policy_id');
       });
 
@@ -125,7 +122,7 @@ export default function (providerContext: FtrProviderContext) {
             policy_id: 'policy1',
           })
           .expect(200);
-        expect(apiResponse.success).to.eql(true);
+
         const { body: privileges } = await getEsClientForAPIKey(
           providerContext,
           apiResponse.item.api_key
diff --git a/x-pack/test/ingest_manager_api_integration/apis/index.js b/x-pack/test/ingest_manager_api_integration/apis/index.js
index fac8a26fd6aec4..7c1ebef337baa2 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/index.js
+++ b/x-pack/test/ingest_manager_api_integration/apis/index.js
@@ -22,5 +22,8 @@ export default function ({ loadTestFile }) {
 
     // Agent policies
     loadTestFile(require.resolve('./agent_policy/index'));
+
+    // Settings
+    loadTestFile(require.resolve('./settings/index'));
   });
 }
diff --git a/x-pack/test/ingest_manager_api_integration/apis/package_policy/create.ts b/x-pack/test/ingest_manager_api_integration/apis/package_policy/create.ts
index c88f03de59615b..113fbeca494d8f 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/package_policy/create.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/package_policy/create.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
 import { warnAndSkipTest } from '../../helpers';
 
@@ -34,7 +33,7 @@ export default function ({ getService }: FtrProviderContext) {
 
     it('should work with valid values', async function () {
       if (server.enabled) {
-        const { body: apiResponse } = await supertest
+        await supertest
           .post(`/api/ingest_manager/package_policies`)
           .set('kbn-xsrf', 'xxxx')
           .send({
@@ -52,8 +51,6 @@ export default function ({ getService }: FtrProviderContext) {
             },
           })
           .expect(200);
-
-        expect(apiResponse.success).to.be(true);
       } else {
         warnAndSkipTest(this, log);
       }
diff --git a/x-pack/test/ingest_manager_api_integration/apis/package_policy/get.ts b/x-pack/test/ingest_manager_api_integration/apis/package_policy/get.ts
index 756eaa8ea49bab..53a400d2fd9ebf 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/package_policy/get.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/package_policy/get.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
 import { skipIfNoDockerRegistry } from '../../helpers';
 
@@ -75,11 +74,7 @@ export default function (providerContext: FtrProviderContext) {
     });
 
     it('should succeed with a valid id', async function () {
-      const { body: apiResponse } = await supertest
-        .get(`/api/ingest_manager/package_policies/${packagePolicyId}`)
-        .expect(200);
-
-      expect(apiResponse.success).to.be(true);
+      await supertest.get(`/api/ingest_manager/package_policies/${packagePolicyId}`).expect(200);
     });
 
     it('should return a 404 with an invalid id', async function () {
diff --git a/x-pack/test/ingest_manager_api_integration/apis/package_policy/update.ts b/x-pack/test/ingest_manager_api_integration/apis/package_policy/update.ts
index e74d88f3538e4a..3c4cb93ee3ff3d 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/package_policy/update.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/package_policy/update.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
 import { skipIfNoDockerRegistry } from '../../helpers';
 
@@ -77,7 +76,7 @@ export default function (providerContext: FtrProviderContext) {
     });
 
     it('should work with valid values', async function () {
-      const { body: apiResponse } = await supertest
+      await supertest
         .put(`/api/ingest_manager/package_policies/${packagePolicyId}`)
         .set('kbn-xsrf', 'xxxx')
         .send({
@@ -95,8 +94,6 @@ export default function (providerContext: FtrProviderContext) {
           },
         })
         .expect(200);
-
-      expect(apiResponse.success).to.be(true);
     });
 
     it('should return a 500 if there is another package policy with the same name', async function () {
diff --git a/x-pack/test/ingest_manager_api_integration/apis/settings/index.js b/x-pack/test/ingest_manager_api_integration/apis/settings/index.js
new file mode 100644
index 00000000000000..99346fcabeff4f
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/apis/settings/index.js
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export default function loadTests({ loadTestFile }) {
+  describe('Settings Endpoints', () => {
+    loadTestFile(require.resolve('./update'));
+  });
+}
diff --git a/x-pack/test/ingest_manager_api_integration/apis/settings/update.ts b/x-pack/test/ingest_manager_api_integration/apis/settings/update.ts
new file mode 100644
index 00000000000000..86292b535db2d4
--- /dev/null
+++ b/x-pack/test/ingest_manager_api_integration/apis/settings/update.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
+import { skipIfNoDockerRegistry } from '../../helpers';
+
+export default function (providerContext: FtrProviderContext) {
+  const { getService } = providerContext;
+  const supertest = getService('supertest');
+  const kibanaServer = getService('kibanaServer');
+
+  describe('Settings - update', async function () {
+    skipIfNoDockerRegistry(providerContext);
+
+    it("should bump all agent policy's revision", async function () {
+      const { body: testPolicy1PostRes } = await supertest
+        .post(`/api/ingest_manager/agent_policies`)
+        .set('kbn-xsrf', 'xxxx')
+        .send({
+          name: 'test',
+          description: '',
+          namespace: 'default',
+        });
+      const { body: testPolicy2PostRes } = await supertest
+        .post(`/api/ingest_manager/agent_policies`)
+        .set('kbn-xsrf', 'xxxx')
+        .send({
+          name: 'test2',
+          description: '',
+          namespace: 'default',
+        });
+      await supertest
+        .put(`/api/ingest_manager/settings`)
+        .set('kbn-xsrf', 'xxxx')
+        .send({ kibana_urls: ['http://localhost:1232/abc', 'http://localhost:1232/abc'] });
+
+      const getTestPolicy1Res = await kibanaServer.savedObjects.get({
+        type: 'ingest-agent-policies',
+        id: testPolicy1PostRes.item.id,
+      });
+      const getTestPolicy2Res = await kibanaServer.savedObjects.get({
+        type: 'ingest-agent-policies',
+        id: testPolicy2PostRes.item.id,
+      });
+      expect(getTestPolicy1Res.attributes.revision).equal(2);
+      expect(getTestPolicy2Res.attributes.revision).equal(2);
+    });
+  });
+}
diff --git a/x-pack/test/licensing_plugin/config.legacy.ts b/x-pack/test/licensing_plugin/config.legacy.ts
deleted file mode 100644
index 14eadc3194f9e3..00000000000000
--- a/x-pack/test/licensing_plugin/config.legacy.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
-
-export default async function ({ readConfigFile }: FtrConfigProviderContext) {
-  const commonConfig = await readConfigFile(require.resolve('./config'));
-
-  return {
-    ...commonConfig.getAll(),
-    testFiles: [require.resolve('./legacy')],
-  };
-}
diff --git a/x-pack/test/licensing_plugin/legacy/index.ts b/x-pack/test/licensing_plugin/legacy/index.ts
deleted file mode 100644
index 6274bd39690420..00000000000000
--- a/x-pack/test/licensing_plugin/legacy/index.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { FtrProviderContext } from '../services';
-
-// eslint-disable-next-line import/no-default-export
-export default function ({ loadTestFile }: FtrProviderContext) {
-  describe('Legacy licensing plugin', function () {
-    this.tags('ciGroup2');
-    // MUST BE LAST! CHANGES LICENSE TYPE!
-    loadTestFile(require.resolve('./updates'));
-  });
-}
diff --git a/x-pack/test/licensing_plugin/legacy/updates.ts b/x-pack/test/licensing_plugin/legacy/updates.ts
deleted file mode 100644
index 1de8659672d2f5..00000000000000
--- a/x-pack/test/licensing_plugin/legacy/updates.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import expect from '@kbn/expect';
-import { FtrProviderContext } from '../services';
-import { createScenario } from '../scenario';
-import '../../../../test/plugin_functional/plugins/core_provider_plugin/types';
-
-// eslint-disable-next-line import/no-default-export
-export default function (ftrContext: FtrProviderContext) {
-  const { getService } = ftrContext;
-  const supertest = getService('supertest');
-  const testSubjects = getService('testSubjects');
-
-  const scenario = createScenario(ftrContext);
-
-  describe('changes in license types', () => {
-    after(async () => {
-      await scenario.teardown();
-    });
-
-    it('provides changes in license types', async () => {
-      await scenario.setup();
-      await scenario.waitForPluginToDetectLicenseUpdate();
-
-      const {
-        body: legacyInitialLicense,
-        header: legacyInitialLicenseHeaders,
-      } = await supertest.get('/api/xpack/v1/info').expect(200);
-
-      expect(legacyInitialLicense.license?.type).to.be('basic');
-      expect(legacyInitialLicenseHeaders['kbn-xpack-sig']).to.be.a('string');
-
-      await scenario.startTrial();
-      await scenario.waitForPluginToDetectLicenseUpdate();
-
-      const { body: legacyTrialLicense, header: legacyTrialLicenseHeaders } = await supertest
-        .get('/api/xpack/v1/info')
-        .expect(200);
-
-      expect(legacyTrialLicense.license?.type).to.be('trial');
-      expect(legacyTrialLicenseHeaders['kbn-xpack-sig']).to.not.be(
-        legacyInitialLicenseHeaders['kbn-xpack-sig']
-      );
-
-      await scenario.startBasic();
-      await scenario.waitForPluginToDetectLicenseUpdate();
-
-      const { body: legacyBasicLicense } = await supertest.get('/api/xpack/v1/info').expect(200);
-      expect(legacyBasicLicense.license?.type).to.be('basic');
-
-      // banner shown only when license expired not just deleted
-      await testSubjects.missingOrFail('licenseExpiredBanner');
-    });
-  });
-}
diff --git a/x-pack/test/plugin_functional/plugins/resolver_test/public/applications/resolver_test/index.tsx b/x-pack/test/plugin_functional/plugins/resolver_test/public/applications/resolver_test/index.tsx
index 4afd71fd67a69c..f3d1eb60bf1c0d 100644
--- a/x-pack/test/plugin_functional/plugins/resolver_test/public/applications/resolver_test/index.tsx
+++ b/x-pack/test/plugin_functional/plugins/resolver_test/public/applications/resolver_test/index.tsx
@@ -82,6 +82,7 @@ const AppRoot = React.memo(
                 <ResolverWithoutProviders
                   databaseDocumentID=""
                   resolverComponentInstanceID="test"
+                  indices={[]}
                 />
               </Wrapper>
             </Provider>
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security.config.ts b/x-pack/test/reporting_api_integration/reporting_and_security.config.ts
index dc5aaba69604f5..ee165bf45fc7ed 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security.config.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security.config.ts
@@ -44,7 +44,6 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
         `--xpack.reporting.csv.maxSizeBytes=2850`,
         `--xpack.reporting.queue.pollInterval=3000`,
         `--xpack.security.session.idleTimeout=3600000`,
-        `--xpack.spaces.enabled=false`,
         `--xpack.reporting.capture.networkPolicy.rules=${JSON.stringify(testPolicyRules)}`,
       ],
     },
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/index.ts b/x-pack/test/reporting_api_integration/reporting_and_security/index.ts
index 18ef28150c42d7..8bf4d2448498c5 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/index.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/index.ts
@@ -12,7 +12,8 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     this.tags('ciGroup2');
     loadTestFile(require.resolve('./csv_job_params'));
     loadTestFile(require.resolve('./csv_saved_search'));
-    loadTestFile(require.resolve('./usage'));
     loadTestFile(require.resolve('./network_policy'));
+    loadTestFile(require.resolve('./spaces'));
+    loadTestFile(require.resolve('./usage'));
   });
 }
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/network_policy.ts b/x-pack/test/reporting_api_integration/reporting_and_security/network_policy.ts
index 9f9800cafb99a9..8692f79d5aea9b 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/network_policy.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/network_policy.ts
@@ -20,7 +20,7 @@ export default function ({ getService }: FtrProviderContext) {
    * The Reporting API Functional Test config implements a network policy that
    * is designed to disallow the following Canvas worksheet
    */
-  describe('reporting network policy', () => {
+  describe('Network Policy', () => {
     before(async () => {
       await esArchiver.load(archive); // includes a canvas worksheet with an offending image URL
     });
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/spaces.ts b/x-pack/test/reporting_api_integration/reporting_and_security/spaces.ts
new file mode 100644
index 00000000000000..6a68bd530cf63b
--- /dev/null
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/spaces.ts
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import * as Rx from 'rxjs';
+import { filter, first, map, switchMap, tap, timeout } from 'rxjs/operators';
+import { FtrProviderContext } from '../ftr_provider_context';
+
+// eslint-disable-next-line import/no-default-export
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const reportingAPI = getService('reportingAPI');
+  const supertest = getService('supertest');
+  const log = getService('log');
+
+  const getCompleted$ = (downloadPath: string) => {
+    return Rx.interval(2000).pipe(
+      tap(() => log.debug(`checking report status at ${downloadPath}...`)),
+      switchMap(() => supertest.get(downloadPath)),
+      filter(({ status: statusCode }) => statusCode === 200),
+      map((response) => response.text),
+      first(),
+      timeout(15000)
+    );
+  };
+
+  // FLAKY: https://github.com/elastic/kibana/issues/76551
+  describe.skip('Exports from Non-default Space', () => {
+    before(async () => {
+      await esArchiver.load('reporting/ecommerce');
+      await esArchiver.load('reporting/ecommerce_kibana_spaces'); // dashboard in non default space
+    });
+
+    after(async () => {
+      await esArchiver.unload('reporting/ecommerce');
+      await esArchiver.unload('reporting/ecommerce_kibana_spaces');
+    });
+
+    afterEach(async () => {
+      await reportingAPI.deleteAllReports();
+    });
+
+    it('should complete a job of CSV saved search export in non-default space', async () => {
+      const downloadPath = await reportingAPI.postJob(
+        `/s/non_default_space/api/reporting/generate/csv?jobParams=%28browserTimezone%3AUTC%2CconflictedTypesFields%3A%21%28%29%2Cfields%3A%21%28order_date%2Ccategory%2Ccustomer_first_name%2Ccustomer_full_name%2Ctotal_quantity%2Ctotal_unique_products%2Ctaxless_total_price%2Ctaxful_total_price%2Ccurrency%29%2CindexPatternId%3A%27067dec90-e7ee-11ea-a730-d58e9ea7581b%27%2CmetaFields%3A%21%28_source%2C_id%2C_type%2C_index%2C_score%29%2CobjectType%3Asearch%2CsearchRequest%3A%28body%3A%28_source%3A%28includes%3A%21%28order_date%2Ccategory%2Ccustomer_first_name%2Ccustomer_full_name%2Ctotal_quantity%2Ctotal_unique_products%2Ctaxless_total_price%2Ctaxful_total_price%2Ccurrency%29%29%2Cdocvalue_fields%3A%21%28%28field%3Aorder_date%2Cformat%3Adate_time%29%29%2Cquery%3A%28bool%3A%28filter%3A%21%28%28match_all%3A%28%29%29%2C%28range%3A%28order_date%3A%28format%3Astrict_date_optional_time%2Cgte%3A%272019-06-11T08%3A24%3A16.425Z%27%2Clte%3A%272019-07-13T09%3A31%3A07.520Z%27%29%29%29%29%2Cmust%3A%21%28%29%2Cmust_not%3A%21%28%29%2Cshould%3A%21%28%29%29%29%2Cscript_fields%3A%28%29%2Csort%3A%21%28%28order_date%3A%28order%3Adesc%2Cunmapped_type%3Aboolean%29%29%29%2Cstored_fields%3A%21%28order_date%2Ccategory%2Ccustomer_first_name%2Ccustomer_full_name%2Ctotal_quantity%2Ctotal_unique_products%2Ctaxless_total_price%2Ctaxful_total_price%2Ccurrency%29%2Cversion%3A%21t%29%2Cindex%3A%27ecommerce%2A%27%29%2Ctitle%3A%27Ecom%20Search%27%29`
+      );
+
+      // Retry the download URL until a "completed" response status is returned
+      const completed$ = getCompleted$(downloadPath);
+      const reportCompleted = await completed$.toPromise();
+      expect(reportCompleted).to.match(/^"order_date",/);
+    });
+
+    it('should complete a job of PNG export of a dashboard in non-default space', async () => {
+      const downloadPath = await reportingAPI.postJob(
+        `/s/non_default_space/api/reporting/generate/png?jobParams=%28browserTimezone%3AUTC%2Clayout%3A%28dimensions%3A%28height%3A512%2Cwidth%3A2402%29%2Cid%3Apng%29%2CobjectType%3Adashboard%2CrelativeUrl%3A%27%2Fs%2Fnon_default_space%2Fapp%2Fdashboards%23%2Fview%2F3c9ee360-e7ee-11ea-a730-d58e9ea7581b%3F_g%3D%28filters%3A%21%21%28%29%2CrefreshInterval%3A%28pause%3A%21%21t%2Cvalue%3A0%29%2Ctime%3A%28from%3A%21%272019-06-10T03%3A17%3A28.800Z%21%27%2Cto%3A%21%272019-07-14T19%3A25%3A06.385Z%21%27%29%29%26_a%3D%28description%3A%21%27%21%27%2Cfilters%3A%21%21%28%29%2CfullScreenMode%3A%21%21f%2Coptions%3A%28hidePanelTitles%3A%21%21f%2CuseMargins%3A%21%21t%29%2Cquery%3A%28language%3Akuery%2Cquery%3A%21%27%21%27%29%2CtimeRestore%3A%21%21t%2Ctitle%3A%21%27Ecom%2520Dashboard%2520Non%2520Default%2520Space%21%27%2CviewMode%3Aview%29%27%2Ctitle%3A%27Ecom%20Dashboard%20Non%20Default%20Space%27%29`
+      );
+
+      const completed$: Rx.Observable<string> = getCompleted$(downloadPath);
+      const reportCompleted = await completed$.toPromise();
+      expect(reportCompleted).to.not.be(null);
+    });
+
+    it('should complete a job of PDF export of a dashboard in non-default space', async () => {
+      const downloadPath = await reportingAPI.postJob(
+        `/s/non_default_space/api/reporting/generate/printablePdf?jobParams=%28browserTimezone%3AUTC%2Clayout%3A%28dimensions%3A%28height%3A512%2Cwidth%3A2402%29%2Cid%3Apreserve_layout%29%2CobjectType%3Adashboard%2CrelativeUrls%3A%21%28%27%2Fs%2Fnon_default_space%2Fapp%2Fdashboards%23%2Fview%2F3c9ee360-e7ee-11ea-a730-d58e9ea7581b%3F_g%3D%28filters%3A%21%21%28%29%2CrefreshInterval%3A%28pause%3A%21%21t%2Cvalue%3A0%29%2Ctime%3A%28from%3A%21%272019-06-10T03%3A17%3A28.800Z%21%27%2Cto%3A%21%272019-07-14T19%3A25%3A06.385Z%21%27%29%29%26_a%3D%28description%3A%21%27%21%27%2Cfilters%3A%21%21%28%29%2CfullScreenMode%3A%21%21f%2Coptions%3A%28hidePanelTitles%3A%21%21f%2CuseMargins%3A%21%21t%29%2Cquery%3A%28language%3Akuery%2Cquery%3A%21%27%21%27%29%2CtimeRestore%3A%21%21t%2Ctitle%3A%21%27Ecom%2520Dashboard%2520Non%2520Default%2520Space%21%27%2CviewMode%3Aview%29%27%29%2Ctitle%3A%27Ecom%20Dashboard%20Non%20Default%20Space%27%29`
+      );
+
+      const completed$ = getCompleted$(downloadPath);
+      const reportCompleted = await completed$.toPromise();
+      expect(reportCompleted).to.not.be(null);
+    });
+  });
+}
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/usage.ts b/x-pack/test/reporting_api_integration/reporting_and_security/usage.ts
index 24e68b3917d6cd..49db8696c11349 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/usage.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/usage.ts
@@ -21,7 +21,8 @@ export default function ({ getService }: FtrProviderContext) {
   const reportingAPI = getService('reportingAPI');
   const usageAPI = getService('usageAPI');
 
-  describe('reporting usage', () => {
+  // FAILING: https://github.com/elastic/kibana/issues/76581
+  describe.skip('Usage', () => {
     before(async () => {
       await esArchiver.load(OSS_KIBANA_ARCHIVE_PATH);
       await esArchiver.load(OSS_DATA_ARCHIVE_PATH);
diff --git a/x-pack/test/security_solution_cypress/cli_config.ts b/x-pack/test/security_solution_cypress/cli_config.ts
new file mode 100644
index 00000000000000..f80066c53c95de
--- /dev/null
+++ b/x-pack/test/security_solution_cypress/cli_config.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
+
+import { SecuritySolutionCypressCliTestRunner } from './runner';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const securitySolutionCypressConfig = await readConfigFile(require.resolve('./config.ts'));
+  return {
+    ...securitySolutionCypressConfig.getAll(),
+
+    testRunner: SecuritySolutionCypressCliTestRunner,
+  };
+}
diff --git a/x-pack/test/security_solution_cypress/config.ts b/x-pack/test/security_solution_cypress/config.ts
index 83290a60a17a66..3a524467f7451a 100644
--- a/x-pack/test/security_solution_cypress/config.ts
+++ b/x-pack/test/security_solution_cypress/config.ts
@@ -10,8 +10,6 @@ import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
 
 import { CA_CERT_PATH } from '@kbn/dev-utils';
 
-import { SiemCypressTestRunner } from './runner';
-
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
   const kibanaCommonTestsConfig = await readConfigFile(
     require.resolve('../../../test/common/config.js')
@@ -23,8 +21,6 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
   return {
     ...kibanaCommonTestsConfig.getAll(),
 
-    testRunner: SiemCypressTestRunner,
-
     esArchiver: {
       directory: resolve(__dirname, 'es_archives'),
     },
diff --git a/x-pack/test/security_solution_cypress/runner.ts b/x-pack/test/security_solution_cypress/runner.ts
index 11c960389e25fd..ccdc2fa4424ac6 100644
--- a/x-pack/test/security_solution_cypress/runner.ts
+++ b/x-pack/test/security_solution_cypress/runner.ts
@@ -11,7 +11,7 @@ import { withProcRunner } from '@kbn/dev-utils';
 
 import { FtrProviderContext } from './ftr_provider_context';
 
-export async function SiemCypressTestRunner({ getService }: FtrProviderContext) {
+export async function SecuritySolutionCypressCliTestRunner({ getService }: FtrProviderContext) {
   const log = getService('log');
   const config = getService('config');
   const esArchiver = getService('esArchiver');
@@ -37,3 +37,30 @@ export async function SiemCypressTestRunner({ getService }: FtrProviderContext)
     });
   });
 }
+
+export async function SecuritySolutionCypressVisualTestRunner({ getService }: FtrProviderContext) {
+  const log = getService('log');
+  const config = getService('config');
+  const esArchiver = getService('esArchiver');
+
+  await esArchiver.load('empty_kibana');
+  await esArchiver.load('auditbeat');
+
+  await withProcRunner(log, async (procs) => {
+    await procs.run('cypress', {
+      cmd: 'yarn',
+      args: ['cypress:open'],
+      cwd: resolve(__dirname, '../../plugins/security_solution'),
+      env: {
+        FORCE_COLOR: '1',
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        CYPRESS_baseUrl: Url.format(config.get('servers.kibana')),
+        CYPRESS_ELASTICSEARCH_URL: Url.format(config.get('servers.elasticsearch')),
+        CYPRESS_ELASTICSEARCH_USERNAME: config.get('servers.elasticsearch.username'),
+        CYPRESS_ELASTICSEARCH_PASSWORD: config.get('servers.elasticsearch.password'),
+        ...process.env,
+      },
+      wait: true,
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_cypress/visual_config.ts b/x-pack/test/security_solution_cypress/visual_config.ts
new file mode 100644
index 00000000000000..a278e9d0a34438
--- /dev/null
+++ b/x-pack/test/security_solution_cypress/visual_config.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
+
+import { SecuritySolutionCypressVisualTestRunner } from './runner';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const securitySolutionCypressConfig = await readConfigFile(require.resolve('./config.ts'));
+  return {
+    ...securitySolutionCypressConfig.getAll(),
+
+    testRunner: SecuritySolutionCypressVisualTestRunner,
+  };
+}
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
index 3e04a507d3810f..325283f5e3440f 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
@@ -5,6 +5,7 @@
  */
 
 import expect from '@kbn/expect';
+import Url from 'url';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { PolicyTestResourceInfo } from '../../services/endpoint_policy';
 
@@ -18,6 +19,15 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   ]);
   const testSubjects = getService('testSubjects');
   const policyTestResources = getService('policyTestResources');
+  const config = getService('config');
+  const kbnTestServer = config.get('servers.kibana');
+  const { protocol, hostname, port } = kbnTestServer;
+
+  const kibanaUrl = Url.format({
+    protocol,
+    hostname,
+    port,
+  });
 
   describe('When on the Endpoint Policy Details Page', function () {
     this.tags(['ciGroup7']);
@@ -108,6 +118,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
           inputs: [
             {
               id: policyInfo.packagePolicy.id,
+              revision: 2,
               data_stream: { namespace: 'default' },
               name: 'Protect East Coast',
               meta: {
@@ -142,6 +153,42 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
                     relative_url:
                       '/api/endpoint/artifacts/download/endpoint-exceptionlist-windows-v1/d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
                   },
+                  'endpoint-trustlist-linux-v1': {
+                    compression_algorithm: 'zlib',
+                    decoded_sha256:
+                      'd801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+                    decoded_size: 14,
+                    encoded_sha256:
+                      'f8e6afa1d5662f5b37f83337af774b5785b5b7f1daee08b7b00c2d6813874cda',
+                    encoded_size: 22,
+                    encryption_algorithm: 'none',
+                    relative_url:
+                      '/api/endpoint/artifacts/download/endpoint-trustlist-linux-v1/d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+                  },
+                  'endpoint-trustlist-macos-v1': {
+                    compression_algorithm: 'zlib',
+                    decoded_sha256:
+                      'd801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+                    decoded_size: 14,
+                    encoded_sha256:
+                      'f8e6afa1d5662f5b37f83337af774b5785b5b7f1daee08b7b00c2d6813874cda',
+                    encoded_size: 22,
+                    encryption_algorithm: 'none',
+                    relative_url:
+                      '/api/endpoint/artifacts/download/endpoint-trustlist-macos-v1/d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+                  },
+                  'endpoint-trustlist-windows-v1': {
+                    compression_algorithm: 'zlib',
+                    decoded_sha256:
+                      'd801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+                    decoded_size: 14,
+                    encoded_sha256:
+                      'f8e6afa1d5662f5b37f83337af774b5785b5b7f1daee08b7b00c2d6813874cda',
+                    encoded_size: 22,
+                    encryption_algorithm: 'none',
+                    relative_url:
+                      '/api/endpoint/artifacts/download/endpoint-trustlist-windows-v1/d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+                  },
                 },
                 // The manifest version could have changed when the Policy was updated because the
                 // policy details page ensures that a save action applies the udpated policy on top
@@ -186,6 +233,11 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
               type: 'elasticsearch',
             },
           },
+          fleet: {
+            kibana: {
+              hosts: [kibanaUrl],
+            },
+          },
           revision: 3,
           agent: {
             monitoring: {
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/artifacts/index.ts b/x-pack/test/security_solution_endpoint_api_int/apis/artifacts/index.ts
index d5106f55499241..17a4182fe9371d 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/artifacts/index.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/artifacts/index.ts
@@ -54,7 +54,6 @@ export default function (providerContext: FtrProviderContext) {
           },
         })
         .expect(200);
-      expect(enrollmentResponse.success).to.eql(true);
 
       agentAccessAPIKey = enrollmentResponse.item.access_api_key;
     });
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/entity.ts b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/entity.ts
new file mode 100644
index 00000000000000..7fbba4e04798d4
--- /dev/null
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/entity.ts
@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from '@kbn/expect';
+import { eventsIndexPattern } from '../../../../plugins/security_solution/common/endpoint/constants';
+import { ResolverEntityIndex } from '../../../../plugins/security_solution/common/endpoint/types';
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
+
+  describe('Resolver tests for the entity route', () => {
+    before(async () => {
+      await esArchiver.load('endpoint/resolver/signals');
+    });
+
+    after(async () => {
+      await esArchiver.unload('endpoint/resolver/signals');
+    });
+
+    it('returns an event even if it does not have a mapping for entity_id', async () => {
+      // this id is from the es archive
+      const _id = 'fa7eb1546f44fd47d8868be8d74e0082e19f22df493c67a7725457978eb648ab';
+      const { body }: { body: ResolverEntityIndex } = await supertest.get(
+        `/api/endpoint/resolver/entity?_id=${_id}&indices=${eventsIndexPattern}&indices=.siem-signals-default`
+      );
+      expect(body).eql([
+        {
+          // this value is from the es archive
+          entity_id:
+            'MTIwNWY1NWQtODRkYS00MzkxLWIyNWQtYTNkNGJmNDBmY2E1LTc1NTItMTMyNDM1NDY1MTQuNjI0MjgxMDA=',
+        },
+      ]);
+    });
+
+    it('does not return an event when it does not have the entity_id field in the document', async () => {
+      // this id is from the es archive
+      const _id = 'no-entity-id-field';
+      const { body }: { body: ResolverEntityIndex } = await supertest.get(
+        `/api/endpoint/resolver/entity?_id=${_id}&indices=${eventsIndexPattern}&indices=.siem-signals-default`
+      );
+      expect(body).to.be.empty();
+    });
+
+    it('does not return an event when it does not have the process field in the document', async () => {
+      // this id is from the es archive
+      const _id = 'no-process-field';
+      const { body }: { body: ResolverEntityIndex } = await supertest.get(
+        `/api/endpoint/resolver/entity?_id=${_id}&indices=${eventsIndexPattern}&indices=.siem-signals-default`
+      );
+      expect(body).to.be.empty();
+    });
+  });
+}
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/index.ts b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/index.ts
index fc603af3619a4d..ecfc1ef5bb7f53 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/index.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/index.ts
@@ -10,6 +10,7 @@ export default function (providerContext: FtrProviderContext) {
 
   describe('Resolver tests', () => {
     loadTestFile(require.resolve('./entity_id'));
+    loadTestFile(require.resolve('./entity'));
     loadTestFile(require.resolve('./children'));
     loadTestFile(require.resolve('./tree'));
     loadTestFile(require.resolve('./alerts'));
diff --git a/x-pack/test/tsconfig.json b/x-pack/test/tsconfig.json
index df1d7e789507b3..d0e2ea952e1089 100644
--- a/x-pack/test/tsconfig.json
+++ b/x-pack/test/tsconfig.json
@@ -1,6 +1,7 @@
 {
-  "extends": "../tsconfig.json",
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
+    "tsBuildInfoFile": "../../build/tsbuildinfo/x-pack/test",
     "types": [
       "mocha",
       "node",
diff --git a/x-pack/test/ui_capabilities/common/services/ui_capabilities.ts b/x-pack/test/ui_capabilities/common/services/ui_capabilities.ts
index 7f831973aea5c1..e567828598b317 100644
--- a/x-pack/test/ui_capabilities/common/services/ui_capabilities.ts
+++ b/x-pack/test/ui_capabilities/common/services/ui_capabilities.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import axios, { AxiosInstance } from 'axios';
-import { UICapabilities } from 'ui/capabilities';
+import type { Capabilities as UICapabilities } from 'src/core/types';
 import { format as formatUrl } from 'url';
 import util from 'util';
 import { ToolingLog } from '@kbn/dev-utils';
diff --git a/x-pack/test_utils/jest/config.js b/x-pack/test_utils/jest/config.js
index 7bb073023b7f8b..c94fe02d2f4bdb 100644
--- a/x-pack/test_utils/jest/config.js
+++ b/x-pack/test_utils/jest/config.js
@@ -17,7 +17,6 @@ export default {
   ],
   collectCoverageFrom: ['legacy/plugins/**/*.js', 'legacy/common/**/*.js', 'legacy/server/**/*.js'],
   moduleNameMapper: {
-    '^ui/(.*)': '<rootDir>**/public/$1',
     '\\.(jpg|jpeg|png|gif|eot|otf|webp|svg|ttf|woff|woff2|mp4|webm|wav|mp3|m4a|aac|oga)$':
       '<rootDir>/src/dev/jest/mocks/file_mock.js',
     '\\.(css|less|scss)$': '<rootDir>/../src/dev/jest/mocks/style_mock.js',
diff --git a/x-pack/tsconfig.json b/x-pack/tsconfig.json
index e978702a356342..b5080f83f2edad 100644
--- a/x-pack/tsconfig.json
+++ b/x-pack/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../tsconfig.json",
+  "extends": "../tsconfig.base.json",
   "include": [
     "mocks.ts",
     "typings/**/*",
@@ -14,17 +14,13 @@
     "test/**/*",
     "plugins/security_solution/cypress/**/*",
     "plugins/apm/e2e/cypress/**/*",
-    "plugins/apm/scripts/**/*",
-    "**/typespec_tests.ts"
+    "plugins/apm/scripts/**/*"
   ],
   "compilerOptions": {
     "outDir": ".",
     "paths": {
       "kibana/public": ["src/core/public"],
       "kibana/server": ["src/core/server"],
-      "ui/*": [
-        "src/legacy/ui/public/*"
-      ],
       "plugins/xpack_main/*": [
         "x-pack/legacy/plugins/xpack_main/public/*"
       ],
@@ -37,12 +33,7 @@
       "plugins/*": ["src/legacy/core_plugins/*/public/"],
       "fixtures/*": ["src/fixtures/*"],
     },
-    "types": [
-      "node",
-      "jest",
-      "flot",
-      "jest-styled-components",
-      "@testing-library/jest-dom"
-    ]
+    // overhead is too significant
+    "incremental": false,
   }
 }
diff --git a/yarn.lock b/yarn.lock
index 0d8ae918f27dc0..95066c9fa8cdae 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1055,7 +1055,7 @@
     exec-sh "^0.3.2"
     minimist "^1.2.0"
 
-"@cypress/listr-verbose-renderer@0.4.1":
+"@cypress/listr-verbose-renderer@^0.4.1":
   version "0.4.1"
   resolved "https://registry.yarnpkg.com/@cypress/listr-verbose-renderer/-/listr-verbose-renderer-0.4.1.tgz#a77492f4b11dcc7c446a34b3e28721afd33c642a"
   integrity sha1-p3SS9LEdzHxEajSz4ochr9M8ZCo=
@@ -1065,7 +1065,7 @@
     date-fns "^1.27.2"
     figures "^1.7.0"
 
-"@cypress/request@2.88.5":
+"@cypress/request@^2.88.5":
   version "2.88.5"
   resolved "https://registry.yarnpkg.com/@cypress/request/-/request-2.88.5.tgz#8d7ecd17b53a849cfd5ab06d5abe7d84976375d7"
   integrity sha512-TzEC1XMi1hJkywWpRfD2clreTa/Z+lOrXDCxxBTBPEcY5azdPi56A6Xw+O4tWJnaJH3iIE7G5aDXZC6JgRZLcA==
@@ -1103,7 +1103,7 @@
     "@babel/preset-env" "^7.0.0"
     babel-loader "^8.0.2"
 
-"@cypress/xvfb@1.2.4":
+"@cypress/xvfb@^1.2.4":
   version "1.2.4"
   resolved "https://registry.yarnpkg.com/@cypress/xvfb/-/xvfb-1.2.4.tgz#2daf42e8275b39f4aa53c14214e557bd14e7748a"
   integrity sha512-skbBzPggOVYCbnGgV+0dmBdW/s77ZkAOXIC1knS8NagwDjBrNC1LuXtQJeiN6l+m7lzmHtaoUw/ctJKdqkG57Q==
@@ -1144,10 +1144,10 @@
   dependencies:
     "@elastic/apm-rum-core" "^5.6.0"
 
-"@elastic/charts@19.8.1":
-  version "19.8.1"
-  resolved "https://registry.yarnpkg.com/@elastic/charts/-/charts-19.8.1.tgz#27653823911c26e4703c73588367473215beaf0f"
-  integrity sha512-vONCrcZ8bZ+C16+bKLoLyNrMC/b2UvYNoPbYcnB5XYAg5a68finvXEcWD6Y+qa7GLaO2CMe5J9eSjLWXHHDmLg==
+"@elastic/charts@21.0.1":
+  version "21.0.1"
+  resolved "https://registry.yarnpkg.com/@elastic/charts/-/charts-21.0.1.tgz#1e8be5303d0c7d53d7ccfcfa121ef68164ae200f"
+  integrity sha512-KMJE2JNwoy021Rvhgu1wiga0FVCa0u4NlFVUSR+h+G010KLarc+c9yUKBTG8v/nZ6ijBtuOLCjjU9OCWXYfxvA==
   dependencies:
     "@popperjs/core" "^2.4.0"
     chroma-js "^2.1.0"
@@ -1229,10 +1229,10 @@
     tabbable "^1.1.0"
     uuid "^3.1.0"
 
-"@elastic/eui@27.4.1":
-  version "27.4.1"
-  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-27.4.1.tgz#9803f6f6c6997c769720381f521e5319ef07a599"
-  integrity sha512-eGztErFlvkwI4BFxDs6tFBGFiN15NQdJdRHvSi5caOQFGabuR8XCRNUWcNFHlwKVJaDaGsJRuwbbSLh9XdWubQ==
+"@elastic/eui@28.2.0":
+  version "28.2.0"
+  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-28.2.0.tgz#0c89c7adc27d4ac918191af8237a2634a26d0637"
+  integrity sha512-ovVkwbwcJLs87ycaof5pyTGjpuPH2sN38k2e+c3IiZjoeGAqWZJouptQguoKYglCyayxoBUV3TAE82m+qyxCnA==
   dependencies:
     "@types/chroma-js" "^2.0.0"
     "@types/lodash" "^4.14.116"
@@ -1241,6 +1241,7 @@
     "@types/react-input-autosize" "^2.0.2"
     "@types/react-virtualized-auto-sizer" "^1.0.0"
     "@types/react-window" "^1.8.1"
+    "@types/vfile-message" "^2.0.0"
     chroma-js "^2.0.4"
     classnames "^2.2.5"
     highlight.js "^9.12.0"
@@ -1251,15 +1252,25 @@
     prop-types "^15.6.0"
     react-ace "^7.0.5"
     react-beautiful-dnd "^13.0.0"
-    react-focus-on "^3.4.1"
+    react-dropzone "^10.2.1"
+    react-focus-on "^3.5.0"
     react-input-autosize "^2.2.2"
     react-is "~16.3.0"
     react-virtualized-auto-sizer "^1.0.2"
     react-window "^1.8.5"
+    rehype-raw "^4.0.1"
+    rehype-react "^6.0.0"
+    rehype-stringify "^6.0.1"
+    remark-emoji "^2.1.0"
+    remark-highlight.js "^5.2.0"
+    remark-parse "^7.0.2"
+    remark-rehype "^7.0.0"
     resize-observer-polyfill "^1.5.0"
     tabbable "^3.0.0"
     text-diff "^1.0.1"
+    unified "^8.4.2"
     uuid "^3.1.0"
+    vfile "^4.1.1"
 
 "@elastic/filesaver@1.1.2":
   version "1.1.2"
@@ -2182,6 +2193,13 @@
     vfile "^4.0.0"
     vfile-reporter "^5.1.1"
 
+"@mapbox/hast-util-table-cell-style@^0.1.3":
+  version "0.1.3"
+  resolved "https://registry.yarnpkg.com/@mapbox/hast-util-table-cell-style/-/hast-util-table-cell-style-0.1.3.tgz#5b7166ae01297d72216932b245e4b2f0b642dca6"
+  integrity sha512-QsEsh5YaDvHoMQ2YHdvZy2iDnU3GgKVBTcHf6cILyoWDZtPSdlG444pL/ioPYO/GpXSfODBb9sefEetfC4v9oA==
+  dependencies:
+    unist-util-visit "^1.3.0"
+
 "@mapbox/jsonlint-lines-primitives@^2.0.2":
   version "2.0.2"
   resolved "https://registry.yarnpkg.com/@mapbox/jsonlint-lines-primitives/-/jsonlint-lines-primitives-2.0.2.tgz#ce56e539f83552b58d10d672ea4d6fc9adc7b234"
@@ -4149,6 +4167,13 @@
   dependencies:
     "@types/node" "*"
 
+"@types/mdast@^3.0.0":
+  version "3.0.3"
+  resolved "https://registry.yarnpkg.com/@types/mdast/-/mdast-3.0.3.tgz#2d7d671b1cd1ea3deb306ea75036c2a0407d2deb"
+  integrity sha512-SXPBMnFVQg1s00dlMCc/jCdvPqdE4mXaMMCeRlxLDmTAEoegHT53xKtkDnzDTOcmMHUfcjyf36/YYZ6SxRdnsw==
+  dependencies:
+    "@types/unist" "*"
+
 "@types/memoize-one@^4.1.0":
   version "4.1.1"
   resolved "https://registry.yarnpkg.com/@types/memoize-one/-/memoize-one-4.1.1.tgz#41dd138a4335b5041f7d8fc038f9d593d88b3369"
@@ -4243,10 +4268,10 @@
   dependencies:
     "@types/node" "*"
 
-"@types/node-forge@^0.9.0":
-  version "0.9.0"
-  resolved "https://registry.yarnpkg.com/@types/node-forge/-/node-forge-0.9.0.tgz#e9f678ec09283f9f35cb8de6c01f86be9278ac08"
-  integrity sha512-J00+BIHJOfagO1Qs67Jp5CZO3VkFxY8YKMt44oBhXr+3ZYNnl8wv/vtcJyPjuH0QZ+q7+5nnc6o/YH91ZJy2pQ==
+"@types/node-forge@^0.9.5":
+  version "0.9.5"
+  resolved "https://registry.yarnpkg.com/@types/node-forge/-/node-forge-0.9.5.tgz#648231d79da197216290429020698d4e767365a0"
+  integrity sha512-rrN3xfA/oZIzwOnO3d2wRQz7UdeVkmMMPjWUCfpPTPuKFVb3D6G10LuiVHYYmvrivBBLMx4m0P/FICoDbNZUMA==
   dependencies:
     "@types/node" "*"
 
@@ -4638,12 +4663,12 @@
   resolved "https://registry.yarnpkg.com/@types/sinon/-/sinon-7.0.13.tgz#ca039c23a9e27ebea53e0901ef928ea2a1a6d313"
   integrity sha512-d7c/C/+H/knZ3L8/cxhicHUiTDxdgap0b/aNJfsmLwFu/iOP17mdgbQsbHA3SJmrzsjD0l3UEE5SN4xxuz5ung==
 
-"@types/sinonjs__fake-timers@6.0.1":
+"@types/sinonjs__fake-timers@^6.0.1":
   version "6.0.1"
   resolved "https://registry.yarnpkg.com/@types/sinonjs__fake-timers/-/sinonjs__fake-timers-6.0.1.tgz#681df970358c82836b42f989188d133e218c458e"
   integrity sha512-yYezQwGWty8ziyYLdZjwxyMb0CZR49h8JALHGrxjQHWlqGgc8kLdHEgWrgL0uZ29DMvEVBDnHU2Wg36zKSIUtA==
 
-"@types/sizzle@*", "@types/sizzle@2.3.2":
+"@types/sizzle@*", "@types/sizzle@^2.3.2":
   version "2.3.2"
   resolved "https://registry.yarnpkg.com/@types/sizzle/-/sizzle-2.3.2.tgz#a811b8c18e2babab7d542b3365887ae2e4d9de47"
   integrity sha512-7EJYyKTL7tFR8+gDbB6Wwz/arpGa0Mywk1TJbNzKzHtzbwVmY4HR9WqS5VV7dsBUKQmPNr192jHr/VpBluj/hg==
@@ -4831,7 +4856,7 @@
   dependencies:
     "@types/undertaker-registry" "*"
 
-"@types/unist@*", "@types/unist@^2.0.0", "@types/unist@^2.0.2":
+"@types/unist@*", "@types/unist@^2.0.0", "@types/unist@^2.0.2", "@types/unist@^2.0.3":
   version "2.0.3"
   resolved "https://registry.yarnpkg.com/@types/unist/-/unist-2.0.3.tgz#9c088679876f374eb5983f150d4787aa6fb32d7e"
   integrity sha512-FvUupuM3rlRsRtCN+fDudtmytGO6iHJuuRKS1Ss0pG5z8oX0diNEw94UEL7hgDbpN94rgaK5R7sWm6RrSkZuAQ==
@@ -4863,6 +4888,13 @@
     "@types/node" "*"
     "@types/unist" "*"
 
+"@types/vfile-message@^2.0.0":
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/@types/vfile-message/-/vfile-message-2.0.0.tgz#690e46af0fdfc1f9faae00cd049cc888957927d5"
+  integrity sha512-GpTIuDpb9u4zIO165fUy9+fXcULdD8HFRNli04GehoMVbeNq7D6OBnqSmg3lxZnC+UvgUhEWKxdKiwYUkGltIw==
+  dependencies:
+    vfile-message "*"
+
 "@types/vfile@^3.0.0":
   version "3.0.2"
   resolved "https://registry.yarnpkg.com/@types/vfile/-/vfile-3.0.2.tgz#19c18cd232df11ce6fa6ad80259bc86c366b09b9"
@@ -5558,7 +5590,7 @@ ajv@^4.7.0:
     co "^4.6.0"
     json-stable-stringify "^1.0.1"
 
-ajv@^6.1.0, ajv@^6.10.0, ajv@^6.10.2, ajv@^6.12.2, ajv@^6.5.5, ajv@^6.9.1:
+ajv@^6.1.0, ajv@^6.10.0, ajv@^6.10.2, ajv@^6.12.2, ajv@^6.12.4, ajv@^6.5.5, ajv@^6.9.1:
   version "6.12.4"
   resolved "https://registry.yarnpkg.com/ajv/-/ajv-6.12.4.tgz#0614facc4522127fa713445c6bfd3ebd376e2234"
   integrity sha512-eienB2c9qVQs2KWexhkrdMLVDoIQCz5KSeLxwg9Lzk4DOfBtIK9PQwwufcsn1jjGuf9WZmqPMbGxOzfcuphJCQ==
@@ -6096,7 +6128,7 @@ aproba@^1.0.3, aproba@^1.1.1:
   resolved "https://registry.yarnpkg.com/aproba/-/aproba-1.2.0.tgz#6802e6264efd18c790a1b0d517f0f2627bf2c94a"
   integrity sha512-Y9J6ZjXtoYh8RnXVCMOU/ttDmk1aBjunq9vO0ta5x85WDQiQfUF9sIPBITdbiiIVcBo03Hi3jMxigBtsddlXRw==
 
-arch@2.1.2:
+arch@^2.1.2:
   version "2.1.2"
   resolved "https://registry.yarnpkg.com/arch/-/arch-2.1.2.tgz#0c52bbe7344bb4fa260c443d2cbad9c00ff2f0bf"
   integrity sha512-NTBIIbAfkJeIletyABbVtdPgeKfDafR+1mZV/AyyfC1UkVkp9iUjV+wwmqtUgphHYajbI86jejBJp5e+jkGTiQ==
@@ -6558,6 +6590,11 @@ asynckit@^0.4.0:
   resolved "https://registry.yarnpkg.com/asynckit/-/asynckit-0.4.0.tgz#c79ed97f7f34cb8f2ba1bc9790bcc366474b4b79"
   integrity sha1-x57Zf380y48robyXkLzDZkdLS3k=
 
+at-least-node@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/at-least-node/-/at-least-node-1.0.0.tgz#602cd4b46e844ad4effc92a8011a3c46e0238dc2"
+  integrity sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==
+
 atob-lite@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/atob-lite/-/atob-lite-2.0.0.tgz#0fef5ad46f1bd7a8502c65727f0367d5ee43d696"
@@ -6575,6 +6612,11 @@ attr-accept@^1.1.3:
   dependencies:
     core-js "^2.5.0"
 
+attr-accept@^2.0.0:
+  version "2.2.1"
+  resolved "https://registry.yarnpkg.com/attr-accept/-/attr-accept-2.2.1.tgz#89b48de019ed4342f1865626b4389c666b3ed231"
+  integrity sha512-GpefLMsbH5ojNgfTW+OBin2xKzuHfyeNA+qCktzZojBhbA/lPZdCFMWdwk5ajb989Ok7ZT+EADqvW3TAFNMjhA==
+
 autobind-decorator@^1.3.4:
   version "1.4.3"
   resolved "https://registry.yarnpkg.com/autobind-decorator/-/autobind-decorator-1.4.3.tgz#4c96ffa77b10622ede24f110f5dbbf56691417d1"
@@ -7350,6 +7392,11 @@ bl@^4.0.1:
     inherits "^2.0.4"
     readable-stream "^3.4.0"
 
+blob-util@2.0.2:
+  version "2.0.2"
+  resolved "https://registry.yarnpkg.com/blob-util/-/blob-util-2.0.2.tgz#3b4e3c281111bb7f11128518006cdc60b403a1eb"
+  integrity sha512-T7JQa+zsXXEa6/8ZhHcQEW1UFfVM49Ts65uBkFL6fz2QmrElqmbajIDJvuA0tEhRe5eIjpV9ZF+0RfZR9voJFQ==
+
 block-stream@*:
   version "0.0.9"
   resolved "https://registry.yarnpkg.com/block-stream/-/block-stream-0.0.9.tgz#13ebfe778a03205cfe03751481ebb4b3300c126a"
@@ -7372,7 +7419,7 @@ bluebird@3.5.5, bluebird@^3.5.0, bluebird@^3.5.1, bluebird@^3.5.5:
   resolved "https://registry.yarnpkg.com/bluebird/-/bluebird-3.5.5.tgz#a8d0afd73251effbbd5fe384a77d73003c17a71f"
   integrity sha512-5am6HnnfN+urzt4yfg7IgTbotDjIT/u8AJpEt0sIU9FtXfVeezXAPKswrG+xKUCOYAINpSdgZVDU6QFh+cuH3w==
 
-bluebird@3.7.2:
+bluebird@3.7.2, bluebird@^3.7.2:
   version "3.7.2"
   resolved "https://registry.yarnpkg.com/bluebird/-/bluebird-3.7.2.tgz#9f229c15be272454ffa973ace0dbee79a1b0c36f"
   integrity sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==
@@ -7754,15 +7801,7 @@ buffer@^4.3.0:
     ieee754 "^1.1.4"
     isarray "^1.0.0"
 
-buffer@^5.1.0, buffer@^5.2.0:
-  version "5.2.1"
-  resolved "https://registry.yarnpkg.com/buffer/-/buffer-5.2.1.tgz#dd57fa0f109ac59c602479044dca7b8b3d0b71d6"
-  integrity sha512-c+Ko0loDaFfuPWiL02ls9Xd3GO3cPVmUobQ6t3rXNUk304u6hGq+8N/kFi+QEIKhzK3uwolVhLzszmfLmMLnqg==
-  dependencies:
-    base64-js "^1.0.2"
-    ieee754 "^1.1.4"
-
-buffer@^5.5.0:
+buffer@^5.1.0, buffer@^5.2.0, buffer@^5.5.0:
   version "5.6.0"
   resolved "https://registry.yarnpkg.com/buffer/-/buffer-5.6.0.tgz#a31749dc7d81d84db08abf937b6b8c4033f62786"
   integrity sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==
@@ -7925,7 +7964,7 @@ cacheable-request@^7.0.1:
     normalize-url "^4.1.0"
     responselike "^2.0.0"
 
-cachedir@2.3.0:
+cachedir@^2.3.0:
   version "2.3.0"
   resolved "https://registry.yarnpkg.com/cachedir/-/cachedir-2.3.0.tgz#0c75892a052198f0b21c7c1804d8331edfcae0e8"
   integrity sha512-A+Fezp4zxnit6FanDmv9EqXNAi3vt9DWp51/71UEhXukb7QUuvtv9344h91dyAxuTLoSYJFU299qzR3tzwPAhw==
@@ -8138,10 +8177,10 @@ catbox@10.x.x:
     hoek "5.x.x"
     joi "13.x.x"
 
-ccount@^1.0.3:
-  version "1.0.3"
-  resolved "https://registry.yarnpkg.com/ccount/-/ccount-1.0.3.tgz#f1cec43f332e2ea5a569fd46f9f5bde4e6102aff"
-  integrity sha512-Jt9tIBkRc9POUof7QA/VwWd+58fKkEEfI+/t1/eOlxKM7ZhrczNzMFefge7Ai+39y1pR/pP6cI19guHy3FSLmw==
+ccount@^1.0.0, ccount@^1.0.3:
+  version "1.0.5"
+  resolved "https://registry.yarnpkg.com/ccount/-/ccount-1.0.5.tgz#ac82a944905a65ce204eb03023157edf29425c17"
+  integrity sha512-MOli1W+nfbPLlKEhInaxhRdp7KVLFxLN5ykwzHgLsLI3H3gs5jjFAK4Eoj3OzzcxCtumDaI8onoVDeQyWaNTkw==
 
 center-align@^0.1.1:
   version "0.1.3"
@@ -8268,6 +8307,11 @@ change-emitter@^0.1.2:
   resolved "https://registry.yarnpkg.com/change-emitter/-/change-emitter-0.1.6.tgz#e8b2fe3d7f1ab7d69a32199aff91ea6931409515"
   integrity sha1-6LL+PX8at9aaMhma/5HqaTFAlRU=
 
+character-entities-html4@^1.0.0:
+  version "1.1.4"
+  resolved "https://registry.yarnpkg.com/character-entities-html4/-/character-entities-html4-1.1.4.tgz#0e64b0a3753ddbf1fdc044c5fd01d0199a02e125"
+  integrity sha512-HRcDxZuZqMx3/a+qrzxdBKBPUpxWEq9xw2OPZ3a/174ihfrQKVsFhqtthBInFy1zZ9GgZyFXOatNujm8M+El3g==
+
 character-entities-legacy@^1.0.0:
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/character-entities-legacy/-/character-entities-legacy-1.1.1.tgz#f40779df1a101872bb510a3d295e1fccf147202f"
@@ -8303,7 +8347,7 @@ check-disk-space@^2.1.0:
   resolved "https://registry.yarnpkg.com/check-disk-space/-/check-disk-space-2.1.0.tgz#2e77fe62f30d9676dc37a524ea2008f40c780295"
   integrity sha512-f0nx9oJF/AVF8nhSYlF1EBvMNnO+CXyLwKhPvN1943iOMI9TWhQigLZm80jAf0wzQhwKkzA8XXjyvuVUeGGcVQ==
 
-check-more-types@2.24.0:
+check-more-types@^2.24.0:
   version "2.24.0"
   resolved "https://registry.yarnpkg.com/check-more-types/-/check-more-types-2.24.0.tgz#1420ffb10fd444dcfc79b43891bbfffd32a84600"
   integrity sha1-FCD/sQ/URNz8ebQ4kbv//TKoRgA=
@@ -8609,6 +8653,16 @@ cli-table3@0.5.1:
   optionalDependencies:
     colors "^1.1.2"
 
+cli-table3@~0.6.0:
+  version "0.6.0"
+  resolved "https://registry.yarnpkg.com/cli-table3/-/cli-table3-0.6.0.tgz#b7b1bc65ca8e7b5cef9124e13dc2b21e2ce4faee"
+  integrity sha512-gnB85c3MGC7Nm9I/FkiasNBOKjOiO1RNuXXarQms37q4QMpWdlbBgD/VnOStA2faG1dpXMv31RFApjX1/QdgWQ==
+  dependencies:
+    object-assign "^4.1.0"
+    string-width "^4.2.0"
+  optionalDependencies:
+    colors "^1.1.2"
+
 cli-table@^0.3.1:
   version "0.3.1"
   resolved "https://registry.yarnpkg.com/cli-table/-/cli-table-0.3.1.tgz#f53b05266a8b1a0b934b3d0821e6e2dc5914ae23"
@@ -8826,6 +8880,11 @@ coffeescript@~1.10.0:
   resolved "https://registry.yarnpkg.com/coffeescript/-/coffeescript-1.10.0.tgz#e7aa8301917ef621b35d8a39f348dcdd1db7e33e"
   integrity sha1-56qDAZF+9iGzXYo580jc3R234z4=
 
+collapse-white-space@^1.0.0:
+  version "1.0.6"
+  resolved "https://registry.yarnpkg.com/collapse-white-space/-/collapse-white-space-1.0.6.tgz#e63629c0016665792060dbbeb79c42239d2c5287"
+  integrity sha512-jEovNnrhMuqyCcjfEJA56v0Xq8SkIoPKDyaHahwo3POf4qcSXqMYuwNcOTzp74vTsR9Tn08z4MxWqAhcekogkQ==
+
 collapse-white-space@^1.0.2:
   version "1.0.3"
   resolved "https://registry.yarnpkg.com/collapse-white-space/-/collapse-white-space-1.0.3.tgz#4b906f670e5a963a87b76b0e1689643341b6023c"
@@ -8983,7 +9042,12 @@ comma-separated-tokens@^1.0.0:
   dependencies:
     trim "0.0.1"
 
-commander@2, commander@2.19.0, commander@^2.11.0, commander@^2.12.2:
+comma-separated-tokens@^1.0.1:
+  version "1.0.8"
+  resolved "https://registry.yarnpkg.com/comma-separated-tokens/-/comma-separated-tokens-1.0.8.tgz#632b80b6117867a158f1080ad498b2fbe7e3f5ea"
+  integrity sha512-GHuDRO12Sypu2cV70d1dkA2EUmXHgntrzbpvOB+Qy+49ypNfGgFQIC2fhhXbnyrJRynDCAARsT7Ou0M6hirpfw==
+
+commander@2, commander@2.19.0, commander@^2.11.0:
   version "2.19.0"
   resolved "https://registry.yarnpkg.com/commander/-/commander-2.19.0.tgz#f6198aa84e5b83c46054b94ddedbfed5ee9ff12a"
   integrity sha512-6tvAOO+D6OENvRAh524Dh9jcfKTYDQAqvqezbCW82xj5X0pSrcpxtvRKHLG0yBY6SD7PSDrJaj+0AiOcKVd1Xg==
@@ -8998,11 +9062,6 @@ commander@3.0.2:
   resolved "https://registry.yarnpkg.com/commander/-/commander-3.0.2.tgz#6837c3fb677ad9933d1cfba42dd14d5117d6b39e"
   integrity sha512-Gar0ASD4BDyKC4hl4DwHqDrmvjoxWKZigVnAbn5H1owvm4CxCPdb0HQDehwNYMJpla5+M2tPmPARzhtYuwpHow==
 
-commander@4.1.1, commander@^4.0.1:
-  version "4.1.1"
-  resolved "https://registry.yarnpkg.com/commander/-/commander-4.1.1.tgz#9fd602bd936294e9e9ef46a3f4d6964044b18068"
-  integrity sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==
-
 commander@^2.13.0, commander@^2.15.1, commander@^2.16.0, commander@^2.19.0:
   version "2.20.0"
   resolved "https://registry.yarnpkg.com/commander/-/commander-2.20.0.tgz#d58bb2b5c1ee8f87b0d340027e9e94e222c5a422"
@@ -9023,12 +9082,17 @@ commander@^3.0.0:
   resolved "https://registry.yarnpkg.com/commander/-/commander-3.0.0.tgz#0641ea00838c7a964627f04cddc336a2deddd60a"
   integrity sha512-pl3QrGOBa9RZaslQiqnnKX2J068wcQw7j9AIaBQ9/JEp5RY6je4jKTImg0Bd+rpoONSe7GUFSgkxLeo17m3Pow==
 
+commander@^4.0.1, commander@^4.1.1:
+  version "4.1.1"
+  resolved "https://registry.yarnpkg.com/commander/-/commander-4.1.1.tgz#9fd602bd936294e9e9ef46a3f4d6964044b18068"
+  integrity sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==
+
 commander@^5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/commander/-/commander-5.0.0.tgz#dbf1909b49e5044f8fdaf0adc809f0c0722bdfd0"
   integrity sha512-JrDGPAKjMGSP1G0DUoaceEJ3DZgAfr/q6X7FVk4+U5KxUSKviYGM2k6zWkfyyBHy5rAtzgYJFa1ro2O9PtoxwQ==
 
-common-tags@1.8.0:
+common-tags@1.8.0, common-tags@^1.8.0:
   version "1.8.0"
   resolved "https://registry.yarnpkg.com/common-tags/-/common-tags-1.8.0.tgz#8e3153e542d4a39e9b10554434afaaf98956a937"
   integrity sha512-6P6g0uetGpW/sdyUy/iQQCbFF0kWVMSIVSyYz7Zgjcgh8mgw8PQzDNZeyZ5DQ2gM7LBoZPHmnjz8rUthkBG5tw==
@@ -9902,48 +9966,56 @@ cypress-multi-reporters@^1.2.3:
     debug "^4.1.1"
     lodash "^4.17.11"
 
-cypress@4.11.0:
-  version "4.11.0"
-  resolved "https://registry.yarnpkg.com/cypress/-/cypress-4.11.0.tgz#054b0b85fd3aea793f186249ee1216126d5f0a7e"
-  integrity sha512-6Yd598+KPATM+dU1Ig0g2hbA+R/o1MAKt0xIejw4nZBVLSplCouBzqeKve6XsxGU6n4HMSt/+QYsWfFcoQeSEw==
-  dependencies:
-    "@cypress/listr-verbose-renderer" "0.4.1"
-    "@cypress/request" "2.88.5"
-    "@cypress/xvfb" "1.2.4"
-    "@types/sinonjs__fake-timers" "6.0.1"
-    "@types/sizzle" "2.3.2"
-    arch "2.1.2"
-    bluebird "3.7.2"
-    cachedir "2.3.0"
-    chalk "2.4.2"
-    check-more-types "2.24.0"
-    cli-table3 "0.5.1"
-    commander "4.1.1"
-    common-tags "1.8.0"
-    debug "4.1.1"
-    eventemitter2 "6.4.2"
-    execa "1.0.0"
-    executable "4.1.1"
-    extract-zip "1.7.0"
-    fs-extra "8.1.0"
-    getos "3.2.1"
-    is-ci "2.0.0"
-    is-installed-globally "0.3.2"
-    lazy-ass "1.6.0"
-    listr "0.14.3"
-    lodash "4.17.19"
-    log-symbols "3.0.0"
-    minimist "1.2.5"
-    moment "2.26.0"
-    ospath "1.2.2"
-    pretty-bytes "5.3.0"
-    ramda "0.26.1"
-    request-progress "3.0.0"
-    supports-color "7.1.0"
-    tmp "0.1.0"
-    untildify "4.0.0"
-    url "0.11.0"
-    yauzl "2.10.0"
+cypress@5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/cypress/-/cypress-5.0.0.tgz#6957e299b790af8b1cd7bea68261b8935646f72e"
+  integrity sha512-jhPd0PMO1dPSBNpx6pHVLkmnnaTfMy3wCoacHAKJ9LJG06y16zqUNSFri64N4BjuGe8y6mNMt8TdgKnmy9muCg==
+  dependencies:
+    "@cypress/listr-verbose-renderer" "^0.4.1"
+    "@cypress/request" "^2.88.5"
+    "@cypress/xvfb" "^1.2.4"
+    "@types/sinonjs__fake-timers" "^6.0.1"
+    "@types/sizzle" "^2.3.2"
+    arch "^2.1.2"
+    blob-util "2.0.2"
+    bluebird "^3.7.2"
+    cachedir "^2.3.0"
+    chalk "^4.1.0"
+    check-more-types "^2.24.0"
+    cli-table3 "~0.6.0"
+    commander "^4.1.1"
+    common-tags "^1.8.0"
+    debug "^4.1.1"
+    eventemitter2 "^6.4.2"
+    execa "^4.0.2"
+    executable "^4.1.1"
+    extract-zip "^1.7.0"
+    fs-extra "^9.0.1"
+    getos "^3.2.1"
+    is-ci "^2.0.0"
+    is-installed-globally "^0.3.2"
+    lazy-ass "^1.6.0"
+    listr "^0.14.3"
+    lodash "^4.17.19"
+    log-symbols "^4.0.0"
+    minimist "^1.2.5"
+    moment "^2.27.0"
+    ospath "^1.2.2"
+    pretty-bytes "^5.3.0"
+    ramda "~0.26.1"
+    request-progress "^3.0.0"
+    supports-color "^7.1.0"
+    tmp "~0.2.1"
+    untildify "^4.0.0"
+    url "^0.11.0"
+    yauzl "^2.10.0"
+
+cytoscape-dagre@^2.2.2:
+  version "2.2.2"
+  resolved "https://registry.yarnpkg.com/cytoscape-dagre/-/cytoscape-dagre-2.2.2.tgz#5f32a85c0ba835f167efee531df9e89ac58ff411"
+  integrity sha512-zsg36qNwua/L2stJSWkcbSDcvW3E6VZf6KRe6aLnQJxuXuz89tMqI5EVYVKEcNBgzTEzFMFv0PE3T0nD4m6VDw==
+  dependencies:
+    dagre "^0.8.2"
 
 cytoscape@^3.10.0:
   version "3.10.0"
@@ -10157,6 +10229,14 @@ d@1:
   dependencies:
     es5-ext "^0.10.9"
 
+dagre@^0.8.2:
+  version "0.8.5"
+  resolved "https://registry.yarnpkg.com/dagre/-/dagre-0.8.5.tgz#ba30b0055dac12b6c1fcc247817442777d06afee"
+  integrity sha512-/aTqmnRta7x7MCCpExk7HQL2O4owCT2h8NT//9I1OQ9vt29Pa0BzSAkR5lwFUcQ7491yVi/3CXU9jQ5o0Mn2Sw==
+  dependencies:
+    graphlib "^2.1.8"
+    lodash "^4.17.15"
+
 damerau-levenshtein@^1.0.4:
   version "1.0.4"
   resolved "https://registry.yarnpkg.com/damerau-levenshtein/-/damerau-levenshtein-1.0.4.tgz#03191c432cb6eea168bb77f3a55ffdccb8978514"
@@ -10251,7 +10331,7 @@ debug@3.2.6, debug@3.X, debug@^3.0.0, debug@^3.1.0, debug@^3.1.1, debug@^3.2.5,
   dependencies:
     ms "^2.1.1"
 
-debug@4, debug@4.1.1, debug@^4.0.0, debug@^4.0.1, debug@^4.1.0, debug@^4.1.1:
+debug@4, debug@^4.0.0, debug@^4.0.1, debug@^4.1.0, debug@^4.1.1:
   version "4.1.1"
   resolved "https://registry.yarnpkg.com/debug/-/debug-4.1.1.tgz#3b72260255109c6b589cee050f1d516139664791"
   integrity sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==
@@ -10606,6 +10686,13 @@ destroy@~1.0.4:
   resolved "https://registry.yarnpkg.com/destroy/-/destroy-1.0.4.tgz#978857442c44749e4206613e37946205826abd80"
   integrity sha1-l4hXRCxEdJ5CBmE+N5RiBYJqvYA=
 
+detab@^2.0.0:
+  version "2.0.3"
+  resolved "https://registry.yarnpkg.com/detab/-/detab-2.0.3.tgz#33e5dd74d230501bd69985a0d2b9a3382699a130"
+  integrity sha512-Up8P0clUVwq0FnFjDclzZsy9PadzRn5FFxrr47tQQvMHqyiFYVbpH8oXDzWtF0Q7pYy3l+RPmtBl+BsFF6wH0A==
+  dependencies:
+    repeat-string "^1.5.4"
+
 detect-conflict@^1.0.0:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/detect-conflict/-/detect-conflict-1.0.1.tgz#088657a66a961c05019db7c4230883b1c6b4176e"
@@ -11218,11 +11305,6 @@ elastic-apm-node@^3.7.0:
     traceparent "^1.0.0"
     unicode-byte-truncate "^1.0.0"
 
-elasticsearch-browser@^16.7.0:
-  version "16.7.0"
-  resolved "https://registry.yarnpkg.com/elasticsearch-browser/-/elasticsearch-browser-16.7.0.tgz#1f32a402cd36a9bb14a9ea6cb70f8e126d4cb9b1"
-  integrity sha512-UES2Fbnzy4Ivq4QvES4sfk/a5UytJczeJdfxRWa4kuHEllKOffKQLTxJ8Ti86OREpACQxppqvYgzctJuEiIr7Q==
-
 elasticsearch@^16.4.0:
   version "16.5.0"
   resolved "https://registry.yarnpkg.com/elasticsearch/-/elasticsearch-16.5.0.tgz#619a48040be25d345fdddf09fa6042a88c3974d6"
@@ -11303,6 +11385,11 @@ emojis-list@^3.0.0:
   resolved "https://registry.yarnpkg.com/emojis-list/-/emojis-list-3.0.0.tgz#5570662046ad29e2e916e71aae260abdff4f6a78"
   integrity sha512-/kyM18EfinwXZbno9FyUGeFh87KC8HRQBQGildHZbEuRyWFOmv1U10o9BBp8XVZDVNNuQKyIGIu5ZYAAXJ0V2Q==
 
+emoticon@^3.2.0:
+  version "3.2.0"
+  resolved "https://registry.yarnpkg.com/emoticon/-/emoticon-3.2.0.tgz#c008ca7d7620fac742fe1bf4af8ff8fed154ae7f"
+  integrity sha512-SNujglcLTTg+lDAcApPNgEdudaqQFiAbJCqzjNxJkvN9vAwCGi0uu8IUVvx+f16h+V44KCY6Y2yboroc9pilHg==
+
 emotion-theming@^10.0.19:
   version "10.0.27"
   resolved "https://registry.yarnpkg.com/emotion-theming/-/emotion-theming-10.0.27.tgz#1887baaec15199862c89b1b984b79806f2b9ab10"
@@ -11336,14 +11423,7 @@ encoding@^0.1.11:
   dependencies:
     iconv-lite "~0.4.13"
 
-end-of-stream@^1.0.0, end-of-stream@^1.1.0:
-  version "1.4.1"
-  resolved "https://registry.yarnpkg.com/end-of-stream/-/end-of-stream-1.4.1.tgz#ed29634d19baba463b6ce6b80a37213eab71ec43"
-  integrity sha512-1MkrZNvWTKCaigbn+W15elq2BB/L22nqrSY5DKlo3X6+vclJm8Bb5djXJBmEX6fS3+zCh/F4VBK5Z2KxJt4s2Q==
-  dependencies:
-    once "^1.4.0"
-
-end-of-stream@^1.4.1, end-of-stream@^1.4.4:
+end-of-stream@^1.0.0, end-of-stream@^1.1.0, end-of-stream@^1.4.1, end-of-stream@^1.4.4:
   version "1.4.4"
   resolved "https://registry.yarnpkg.com/end-of-stream/-/end-of-stream-1.4.4.tgz#5ae64a5f45057baf3626ec14da0ca5e4b2431eb0"
   integrity sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==
@@ -12205,10 +12285,10 @@ event-target-shim@^5.0.0:
   resolved "https://registry.yarnpkg.com/event-target-shim/-/event-target-shim-5.0.1.tgz#5d4d3ebdf9583d63a5333ce2deb7480ab2b05789"
   integrity sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==
 
-eventemitter2@6.4.2:
-  version "6.4.2"
-  resolved "https://registry.yarnpkg.com/eventemitter2/-/eventemitter2-6.4.2.tgz#f31f8b99d45245f0edbc5b00797830ff3b388970"
-  integrity sha512-r/Pwupa5RIzxIHbEKCkNXqpEQIIT4uQDxmP4G/Lug/NokVUWj0joz/WzWl3OxRpC5kDrH/WdiUJoR+IrwvXJEw==
+eventemitter2@^6.4.2:
+  version "6.4.3"
+  resolved "https://registry.yarnpkg.com/eventemitter2/-/eventemitter2-6.4.3.tgz#35c563619b13f3681e7eb05cbdaf50f56ba58820"
+  integrity sha512-t0A2msp6BzOf+QAcI6z9XMktLj52OjGQg+8SJH6v5+3uxNpWYRR3wQmfA+6xtMU9kOC59qk9licus5dYcrYkMQ==
 
 eventemitter2@~0.4.13:
   version "0.4.14"
@@ -12255,19 +12335,6 @@ exec-sh@^0.3.2:
   resolved "https://registry.yarnpkg.com/exec-sh/-/exec-sh-0.3.2.tgz#6738de2eb7c8e671d0366aea0b0db8c6f7d7391b"
   integrity sha512-9sLAvzhI5nc8TpuQUh4ahMdCrWT00wPWz7j47/emR5+2qEfoZP5zzUXvx+vdx+H6ohhnsYC31iX04QLYJK8zTg==
 
-execa@1.0.0, execa@^1.0.0:
-  version "1.0.0"
-  resolved "https://registry.yarnpkg.com/execa/-/execa-1.0.0.tgz#c6236a5bb4df6d6f15e88e7f017798216749ddd8"
-  integrity sha512-adbxcyWV46qiHyvSp50TKt05tB4tK3HcmF7/nxfAdhnox83seTDbwnaqKO4sXRy7roHAIFqJP/Rw/AuEbX61LA==
-  dependencies:
-    cross-spawn "^6.0.0"
-    get-stream "^4.0.0"
-    is-stream "^1.1.0"
-    npm-run-path "^2.0.0"
-    p-finally "^1.0.0"
-    signal-exit "^3.0.0"
-    strip-eof "^1.0.0"
-
 execa@^0.1.1:
   version "0.1.1"
   resolved "https://registry.yarnpkg.com/execa/-/execa-0.1.1.tgz#b09c2a9309bc0ef0501479472db3180f8d4c3edd"
@@ -12328,6 +12395,19 @@ execa@^0.7.0:
     signal-exit "^3.0.0"
     strip-eof "^1.0.0"
 
+execa@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/execa/-/execa-1.0.0.tgz#c6236a5bb4df6d6f15e88e7f017798216749ddd8"
+  integrity sha512-adbxcyWV46qiHyvSp50TKt05tB4tK3HcmF7/nxfAdhnox83seTDbwnaqKO4sXRy7roHAIFqJP/Rw/AuEbX61LA==
+  dependencies:
+    cross-spawn "^6.0.0"
+    get-stream "^4.0.0"
+    is-stream "^1.1.0"
+    npm-run-path "^2.0.0"
+    p-finally "^1.0.0"
+    signal-exit "^3.0.0"
+    strip-eof "^1.0.0"
+
 execa@^3.2.0:
   version "3.4.0"
   resolved "https://registry.yarnpkg.com/execa/-/execa-3.4.0.tgz#c08ed4550ef65d858fac269ffc8572446f37eb89"
@@ -12366,7 +12446,7 @@ execall@^1.0.0:
   dependencies:
     clone-regexp "^1.0.0"
 
-executable@4.1.1:
+executable@^4.1.1:
   version "4.1.1"
   resolved "https://registry.yarnpkg.com/executable/-/executable-4.1.1.tgz#41532bff361d3e57af4d763b70582db18f5d133c"
   integrity sha512-8iA79xD3uAch729dUG8xaaBBFGaEa0wdD2VkYLFHwlqosEj/jT66AzcreRDSgV7ehnNLBW2WR5jIXwGKjVdTLg==
@@ -12609,18 +12689,7 @@ extract-zip@1.7.0, extract-zip@^1.6.6, extract-zip@^1.7.0:
     mkdirp "^0.5.4"
     yauzl "^2.10.0"
 
-extract-zip@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/extract-zip/-/extract-zip-2.0.0.tgz#f53b71d44f4ff5a4527a2259ade000fb8b303492"
-  integrity sha512-i42GQ498yibjdvIhivUsRslx608whtGoFIhF26Z7O4MYncBxp8CwalOs1lnHy21A9sIohWO2+uiE4SRtC9JXDg==
-  dependencies:
-    debug "^4.1.1"
-    get-stream "^5.1.0"
-    yauzl "^2.10.0"
-  optionalDependencies:
-    "@types/yauzl" "^2.9.1"
-
-extract-zip@^2.0.1:
+extract-zip@^2.0.0, extract-zip@^2.0.1:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/extract-zip/-/extract-zip-2.0.1.tgz#663dca56fe46df890d5f131ef4a06d22bb8ba13a"
   integrity sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==
@@ -12743,7 +12812,7 @@ fastq@^1.6.0:
   dependencies:
     reusify "^1.0.0"
 
-fault@^1.0.2:
+fault@^1.0.0, fault@^1.0.2:
   version "1.0.4"
   resolved "https://registry.yarnpkg.com/fault/-/fault-1.0.4.tgz#eafcfc0a6d214fc94601e170df29954a4f842f13"
   integrity sha512-CJ0HCB5tL5fYTEA7ToAq5+kTwd++Borf1/bifxd9iT70QcXr4MRrO3Llf8Ifs70q+SJcGHFtnIE/Nw6giCtECA==
@@ -12872,6 +12941,13 @@ file-saver@^1.3.8:
   resolved "https://registry.yarnpkg.com/file-saver/-/file-saver-1.3.8.tgz#e68a30c7cb044e2fb362b428469feb291c2e09d8"
   integrity sha512-spKHSBQIxxS81N/O21WmuXA2F6wppUCsutpzenOeZzOCCJ5gEfcbqJP983IrpLXzYmXnMUa6J03SubcNPdKrlg==
 
+file-selector@^0.1.12:
+  version "0.1.12"
+  resolved "https://registry.yarnpkg.com/file-selector/-/file-selector-0.1.12.tgz#fe726547be219a787a9dcc640575a04a032b1fd0"
+  integrity sha512-Kx7RTzxyQipHuiqyZGf+Nz4vY9R1XGxuQl/hLoJwq+J4avk/9wxxgZyHKtbyIPJmbD4A66DWGYfyykWNpcYutQ==
+  dependencies:
+    tslib "^1.9.0"
+
 file-sync-cmp@^0.1.0:
   version "0.1.1"
   resolved "https://registry.yarnpkg.com/file-sync-cmp/-/file-sync-cmp-0.1.1.tgz#a5e7a8ffbfa493b43b923bbd4ca89a53b63b612b"
@@ -13408,15 +13484,6 @@ fs-constants@^1.0.0:
   resolved "https://registry.yarnpkg.com/fs-constants/-/fs-constants-1.0.0.tgz#6be0de9be998ce16af8afc24497b9ee9b7ccd9ad"
   integrity sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==
 
-fs-extra@8.1.0, fs-extra@^8.0.1, fs-extra@^8.1.0:
-  version "8.1.0"
-  resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-8.1.0.tgz#49d43c45a88cd9677668cb7be1b46efdb8d2e1c0"
-  integrity sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==
-  dependencies:
-    graceful-fs "^4.2.0"
-    jsonfile "^4.0.0"
-    universalify "^0.1.0"
-
 fs-extra@^0.30.0:
   version "0.30.0"
   resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-0.30.0.tgz#f233ffcc08d4da7d432daa449776989db1df93f0"
@@ -13446,6 +13513,25 @@ fs-extra@^7.0.0, fs-extra@^7.0.1, fs-extra@~7.0.1:
     jsonfile "^4.0.0"
     universalify "^0.1.0"
 
+fs-extra@^8.0.1, fs-extra@^8.1.0:
+  version "8.1.0"
+  resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-8.1.0.tgz#49d43c45a88cd9677668cb7be1b46efdb8d2e1c0"
+  integrity sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==
+  dependencies:
+    graceful-fs "^4.2.0"
+    jsonfile "^4.0.0"
+    universalify "^0.1.0"
+
+fs-extra@^9.0.1:
+  version "9.0.1"
+  resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-9.0.1.tgz#910da0062437ba4c39fedd863f1675ccfefcb9fc"
+  integrity sha512-h2iAoN838FqAFJY2/qVpzFXy+EBxfVE220PalAqQLDVsFOHLJrZvut5puAbCdNv6WJk+B8ihI+k0c7JK5erwqQ==
+  dependencies:
+    at-least-node "^1.0.0"
+    graceful-fs "^4.2.0"
+    jsonfile "^6.0.1"
+    universalify "^1.0.0"
+
 fs-minipass@^1.2.5:
   version "1.2.5"
   resolved "https://registry.yarnpkg.com/fs-minipass/-/fs-minipass-1.2.5.tgz#06c277218454ec288df77ada54a03b8702aacb9d"
@@ -13730,7 +13816,7 @@ getopts@^2.2.5:
   resolved "https://registry.yarnpkg.com/getopts/-/getopts-2.2.5.tgz#67a0fe471cacb9c687d817cab6450b96dde8313b"
   integrity sha512-9jb7AW5p3in+IiJWhQiZmmwkpLaR/ccTWdWQCtZM66HJcHHLegowh4q4tSD7gouUyeNvFWRavfK9GXosQHDpFA==
 
-getos@3.2.1, getos@^3.1.0:
+getos@^3.1.0, getos@^3.2.1:
   version "3.2.1"
   resolved "https://registry.yarnpkg.com/getos/-/getos-3.2.1.tgz#0134d1f4e00eb46144c5a9c0ac4dc087cbb27dc5"
   integrity sha512-U56CfOK17OKgTVqozZjUKNdkfEv6jk5WISBJ8SHoagjE6L69zOwl3Z+O8myjY9MEW3i2HPWQBt/LTbCgcC973Q==
@@ -14314,6 +14400,13 @@ graceful-fs@~1.1:
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-1.1.14.tgz#07078db5f6377f6321fceaaedf497de124dc9465"
   integrity sha1-BweNtfY3f2Mh/Oqu30l94STclGU=
 
+graphlib@^2.1.8:
+  version "2.1.8"
+  resolved "https://registry.yarnpkg.com/graphlib/-/graphlib-2.1.8.tgz#5761d414737870084c92ec7b5dbcb0592c9d35da"
+  integrity sha512-jcLLfkpoVGmH7/InMC/1hIvOPSUh38oJtGhvrOFGzioE1DZ+0YW16RgmOJhHiuWTvGiJQ9Z1Ik43JvkRPRvE+A==
+  dependencies:
+    lodash "^4.17.15"
+
 graphql-anywhere@^4.1.0-alpha.0:
   version "4.1.16"
   resolved "https://registry.yarnpkg.com/graphql-anywhere/-/graphql-anywhere-4.1.16.tgz#82bb59643e30183cfb7b485ed4262a7b39d8a6c1"
@@ -15004,6 +15097,31 @@ hasha@^5.0.0:
     is-stream "^2.0.0"
     type-fest "^0.8.0"
 
+hast-to-hyperscript@^7.0.0:
+  version "7.0.4"
+  resolved "https://registry.yarnpkg.com/hast-to-hyperscript/-/hast-to-hyperscript-7.0.4.tgz#7c4c037d9a8ea19b0a3fdb676a26448ad922353d"
+  integrity sha512-vmwriQ2H0RPS9ho4Kkbf3n3lY436QKLq6VaGA1pzBh36hBi3tm1DO9bR+kaJIbpT10UqaANDkMjxvjVfr+cnOA==
+  dependencies:
+    comma-separated-tokens "^1.0.0"
+    property-information "^5.3.0"
+    space-separated-tokens "^1.0.0"
+    style-to-object "^0.2.1"
+    unist-util-is "^3.0.0"
+    web-namespaces "^1.1.2"
+
+hast-to-hyperscript@^9.0.0:
+  version "9.0.0"
+  resolved "https://registry.yarnpkg.com/hast-to-hyperscript/-/hast-to-hyperscript-9.0.0.tgz#768fb557765fe28749169c885056417342d71e83"
+  integrity sha512-NJvMYU3GlMLs7hN3CRbsNlMzusVNkYBogVWDGybsuuVQ336gFLiD+q9qtFZT2meSHzln3pNISZWTASWothMSMg==
+  dependencies:
+    "@types/unist" "^2.0.3"
+    comma-separated-tokens "^1.0.0"
+    property-information "^5.3.0"
+    space-separated-tokens "^1.0.0"
+    style-to-object "^0.3.0"
+    unist-util-is "^4.0.0"
+    web-namespaces "^1.0.0"
+
 hast-util-from-parse5@^5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/hast-util-from-parse5/-/hast-util-from-parse5-5.0.0.tgz#a505a05766e0f96e389bfb0b1dd809eeefcef47b"
@@ -15015,11 +15133,62 @@ hast-util-from-parse5@^5.0.0:
     web-namespaces "^1.1.2"
     xtend "^4.0.1"
 
+hast-util-is-element@^1.0.0:
+  version "1.0.4"
+  resolved "https://registry.yarnpkg.com/hast-util-is-element/-/hast-util-is-element-1.0.4.tgz#059090a05cc02e275df1ad02caf8cb422fcd2e02"
+  integrity sha512-NFR6ljJRvDcyPP5SbV7MyPBgF47X3BsskLnmw1U34yL+X6YC0MoBx9EyMg8Jtx4FzGH95jw8+c1VPLHaRA0wDQ==
+
 hast-util-parse-selector@^2.2.0:
   version "2.2.1"
   resolved "https://registry.yarnpkg.com/hast-util-parse-selector/-/hast-util-parse-selector-2.2.1.tgz#4ddbae1ae12c124e3eb91b581d2556441766f0ab"
   integrity sha512-Xyh0v+nHmQvrOqop2Jqd8gOdyQtE8sIP9IQf7mlVDqp924W4w/8Liuguk2L2qei9hARnQSG2m+wAOCxM7npJVw==
 
+hast-util-raw@^5.0.0:
+  version "5.0.2"
+  resolved "https://registry.yarnpkg.com/hast-util-raw/-/hast-util-raw-5.0.2.tgz#62288f311ec2f35e066a30d5e0277f963ad43a67"
+  integrity sha512-3ReYQcIHmzSgMq8UrDZHFL0oGlbuVGdLKs8s/Fe8BfHFAyZDrdv1fy/AGn+Fim8ZuvAHcJ61NQhVMtyfHviT/g==
+  dependencies:
+    hast-util-from-parse5 "^5.0.0"
+    hast-util-to-parse5 "^5.0.0"
+    html-void-elements "^1.0.0"
+    parse5 "^5.0.0"
+    unist-util-position "^3.0.0"
+    web-namespaces "^1.0.0"
+    xtend "^4.0.0"
+    zwitch "^1.0.0"
+
+hast-util-to-html@^6.0.0:
+  version "6.1.0"
+  resolved "https://registry.yarnpkg.com/hast-util-to-html/-/hast-util-to-html-6.1.0.tgz#86bcd19c3bd46af456984f8f34db16298c2b10b0"
+  integrity sha512-IlC+LG2HGv0Y8js3wqdhg9O2sO4iVpRDbHOPwXd7qgeagpGsnY49i8yyazwqS35RA35WCzrBQE/n0M6GG/ewxA==
+  dependencies:
+    ccount "^1.0.0"
+    comma-separated-tokens "^1.0.1"
+    hast-util-is-element "^1.0.0"
+    hast-util-whitespace "^1.0.0"
+    html-void-elements "^1.0.0"
+    property-information "^5.2.0"
+    space-separated-tokens "^1.0.0"
+    stringify-entities "^2.0.0"
+    unist-util-is "^3.0.0"
+    xtend "^4.0.1"
+
+hast-util-to-parse5@^5.0.0:
+  version "5.1.2"
+  resolved "https://registry.yarnpkg.com/hast-util-to-parse5/-/hast-util-to-parse5-5.1.2.tgz#09d27bee9ba9348ea05a6cfcc44e02f9083969b6"
+  integrity sha512-ZgYLJu9lYknMfsBY0rBV4TJn2xiwF1fXFFjbP6EE7S0s5mS8LIKBVWzhA1MeIs1SWW6GnnE4In6c3kPb+CWhog==
+  dependencies:
+    hast-to-hyperscript "^7.0.0"
+    property-information "^5.0.0"
+    web-namespaces "^1.0.0"
+    xtend "^4.0.0"
+    zwitch "^1.0.0"
+
+hast-util-whitespace@^1.0.0:
+  version "1.0.4"
+  resolved "https://registry.yarnpkg.com/hast-util-whitespace/-/hast-util-whitespace-1.0.4.tgz#e4fe77c4a9ae1cb2e6c25e02df0043d0164f6e41"
+  integrity sha512-I5GTdSfhYfAPNztx2xJRQpG8cuDSNt599/7YUn7Gx/WxNMsG+a835k97TDkFgk123cwjfwINaZknkKkphx/f2A==
+
 hastscript@^5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/hastscript/-/hastscript-5.0.0.tgz#fee10382c1bc4ba3f1be311521d368c047d2c43a"
@@ -15072,6 +15241,11 @@ highlight.js@^9.12.0, highlight.js@~9.12.0:
   resolved "https://registry.yarnpkg.com/highlight.js/-/highlight.js-9.12.0.tgz#e6d9dbe57cbefe60751f02af336195870c90c01e"
   integrity sha1-5tnb5Xy+/mB1HwKvM2GVhwyQwB4=
 
+highlight.js@~10.1.0:
+  version "10.1.2"
+  resolved "https://registry.yarnpkg.com/highlight.js/-/highlight.js-10.1.2.tgz#c20db951ba1c22c055010648dfffd7b2a968e00c"
+  integrity sha512-Q39v/Mn5mfBlMff9r+zzA+gWxRsCRKwEMvYTiisLr/XUiFI/4puWt0Ojdko3R3JCNWGdOWaA5g/Yxqa23kC5AA==
+
 highlight.js@~9.13.0:
   version "9.13.1"
   resolved "https://registry.yarnpkg.com/highlight.js/-/highlight.js-9.13.1.tgz#054586d53a6863311168488a0f58d6c505ce641e"
@@ -15221,6 +15395,11 @@ html-to-react@^1.3.4:
     lodash.camelcase "^4.3.0"
     ramda "^0.26"
 
+html-void-elements@^1.0.0:
+  version "1.0.5"
+  resolved "https://registry.yarnpkg.com/html-void-elements/-/html-void-elements-1.0.5.tgz#ce9159494e86d95e45795b166c2021c2cfca4483"
+  integrity sha512-uE/TxKuyNIcx44cIWnjr/rfIATDH7ZaOMmstu0CwhFG1Dunhlp4OC6/NMbhiwoq5BpW0ubi303qnEk/PZj614w==
+
 html-webpack-plugin@^4.0.0-beta.2:
   version "4.0.0-beta.5"
   resolved "https://registry.yarnpkg.com/html-webpack-plugin/-/html-webpack-plugin-4.0.0-beta.5.tgz#2c53083c1151bfec20479b1f8aaf0039e77b5513"
@@ -15740,6 +15919,11 @@ ini@^1.2.0, ini@^1.3.4, ini@^1.3.5, ini@~1.3.0:
   resolved "https://registry.yarnpkg.com/ini/-/ini-1.3.5.tgz#eee25f56db1c9ec6085e0c22778083f596abf927"
   integrity sha512-RZY5huIKCMRWDUqZlEi72f/lmXKMvuszcMBduliQ3nnWbx9X/ZBQO7DijMEYS9EhHBb2qacRUMtC7svLwe0lcw==
 
+inline-style-parser@0.1.1:
+  version "0.1.1"
+  resolved "https://registry.yarnpkg.com/inline-style-parser/-/inline-style-parser-0.1.1.tgz#ec8a3b429274e9c0a1f1c4ffa9453a7fef72cea1"
+  integrity sha512-7NXolsK4CAS5+xvdj5OMMbI962hU/wvwoxk+LWR9Ek9bVtyuuYScDN6eS0rUm6TxApFpw7CX1o4uJzcd4AyD3Q==
+
 inline-style-prefixer@^4.0.0:
   version "4.0.2"
   resolved "https://registry.yarnpkg.com/inline-style-prefixer/-/inline-style-prefixer-4.0.2.tgz#d390957d26f281255fe101da863158ac6eb60911"
@@ -16147,13 +16331,6 @@ is-callable@^1.2.0:
   resolved "https://registry.yarnpkg.com/is-callable/-/is-callable-1.2.0.tgz#83336560b54a38e35e3a2df7afd0454d691468bb"
   integrity sha512-pyVD9AaGLxtg6srb2Ng6ynWJqkHU9bEM087AKck0w8QwDarTfNcpIYoU8x8Hv2Icm8u6kFJM18Dag8lyqGkviw==
 
-is-ci@2.0.0, is-ci@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/is-ci/-/is-ci-2.0.0.tgz#6bc6334181810e04b5c22b3d589fdca55026404c"
-  integrity sha512-YfJT7rkpQB0updsdHLGWrvhBJfcfzNNawYDNIyQXJz0IViGf75O8EBPKSdvw2rF+LGCsX4FZ8tcr3b19LcZq4w==
-  dependencies:
-    ci-info "^2.0.0"
-
 is-ci@^1.0.10:
   version "1.1.0"
   resolved "https://registry.yarnpkg.com/is-ci/-/is-ci-1.1.0.tgz#247e4162e7860cebbdaf30b774d6b0ac7dcfe7a5"
@@ -16161,6 +16338,13 @@ is-ci@^1.0.10:
   dependencies:
     ci-info "^1.0.0"
 
+is-ci@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/is-ci/-/is-ci-2.0.0.tgz#6bc6334181810e04b5c22b3d589fdca55026404c"
+  integrity sha512-YfJT7rkpQB0updsdHLGWrvhBJfcfzNNawYDNIyQXJz0IViGf75O8EBPKSdvw2rF+LGCsX4FZ8tcr3b19LcZq4w==
+  dependencies:
+    ci-info "^2.0.0"
+
 is-data-descriptor@^0.1.4:
   version "0.1.4"
   resolved "https://registry.yarnpkg.com/is-data-descriptor/-/is-data-descriptor-0.1.4.tgz#0b5ee648388e2c860282e793f1856fec3f301b56"
@@ -16190,6 +16374,11 @@ is-decimal@^1.0.0:
   resolved "https://registry.yarnpkg.com/is-decimal/-/is-decimal-1.0.1.tgz#f5fb6a94996ad9e8e3761fbfbd091f1fca8c4e82"
   integrity sha1-9ftqlJlq2ejjdh+/vQkfH8qMToI=
 
+is-decimal@^1.0.2:
+  version "1.0.4"
+  resolved "https://registry.yarnpkg.com/is-decimal/-/is-decimal-1.0.4.tgz#65a3a5958a1c5b63a706e1b333d7cd9f630d3fa5"
+  integrity sha512-RGdriMmQQvZ2aqaQq3awNA6dCGtKpiDFcOzrTWrDAT2MiWrKQVPmxLGHl7Y2nNu6led0kEyoX0enY0qXYsv9zw==
+
 is-descriptor@^0.1.0:
   version "0.1.6"
   resolved "https://registry.yarnpkg.com/is-descriptor/-/is-descriptor-0.1.6.tgz#366d8240dde487ca51823b1ab9f07a10a78251ca"
@@ -16322,14 +16511,6 @@ is-hexadecimal@^1.0.0:
   resolved "https://registry.yarnpkg.com/is-hexadecimal/-/is-hexadecimal-1.0.1.tgz#6e084bbc92061fbb0971ec58b6ce6d404e24da69"
   integrity sha1-bghLvJIGH7sJcexYts5tQE4k2mk=
 
-is-installed-globally@0.3.2, is-installed-globally@^0.3.1:
-  version "0.3.2"
-  resolved "https://registry.yarnpkg.com/is-installed-globally/-/is-installed-globally-0.3.2.tgz#fd3efa79ee670d1187233182d5b0a1dd00313141"
-  integrity sha512-wZ8x1js7Ia0kecP/CHM/3ABkAmujX7WPvQk6uu3Fly/Mk44pySulQpnHG46OMjHGXApINnV4QhY3SWnECO2z5g==
-  dependencies:
-    global-dirs "^2.0.1"
-    is-path-inside "^3.0.1"
-
 is-installed-globally@^0.1.0:
   version "0.1.0"
   resolved "https://registry.yarnpkg.com/is-installed-globally/-/is-installed-globally-0.1.0.tgz#0dfd98f5a9111716dd535dda6492f67bf3d25a80"
@@ -16338,6 +16519,14 @@ is-installed-globally@^0.1.0:
     global-dirs "^0.1.0"
     is-path-inside "^1.0.0"
 
+is-installed-globally@^0.3.1, is-installed-globally@^0.3.2:
+  version "0.3.2"
+  resolved "https://registry.yarnpkg.com/is-installed-globally/-/is-installed-globally-0.3.2.tgz#fd3efa79ee670d1187233182d5b0a1dd00313141"
+  integrity sha512-wZ8x1js7Ia0kecP/CHM/3ABkAmujX7WPvQk6uu3Fly/Mk44pySulQpnHG46OMjHGXApINnV4QhY3SWnECO2z5g==
+  dependencies:
+    global-dirs "^2.0.1"
+    is-path-inside "^3.0.1"
+
 is-integer@^1.0.6:
   version "1.0.7"
   resolved "https://registry.yarnpkg.com/is-integer/-/is-integer-1.0.7.tgz#6bde81aacddf78b659b6629d629cadc51a886d5c"
@@ -16517,6 +16706,11 @@ is-plain-obj@^1.0.0, is-plain-obj@^1.1.0:
   resolved "https://registry.yarnpkg.com/is-plain-obj/-/is-plain-obj-1.1.0.tgz#71a50c8429dfca773c92a390a4a03b39fcd51d3e"
   integrity sha1-caUMhCnfync8kqOQpKA7OfzVHT4=
 
+is-plain-obj@^2.0.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/is-plain-obj/-/is-plain-obj-2.1.0.tgz#45e42e37fccf1f40da8e5f76ee21515840c09287"
+  integrity sha512-YWnfyRwxL/+SsrWYfOpUtz5b3YD+nyfkHvjbcanzk8zgyO4ASD67uVMRt8k5bM4lLMDnXfriRhOpemw+NfT1eA==
+
 is-plain-object@2.0.4, is-plain-object@^2.0.1, is-plain-object@^2.0.3, is-plain-object@^2.0.4:
   version "2.0.4"
   resolved "https://registry.yarnpkg.com/is-plain-object/-/is-plain-object-2.0.4.tgz#2c163b3fafb1b606d9d17928f05c2a1c38e07677"
@@ -17840,6 +18034,15 @@ jsonfile@^4.0.0:
   optionalDependencies:
     graceful-fs "^4.1.6"
 
+jsonfile@^6.0.1:
+  version "6.0.1"
+  resolved "https://registry.yarnpkg.com/jsonfile/-/jsonfile-6.0.1.tgz#98966cba214378c8c84b82e085907b40bf614179"
+  integrity sha512-jR2b5v7d2vIOust+w3wtFKZIfpC2pnRmFAhAC/BuweZFQR8qZzxH1OyrQ10HmdVYiXWkYUqPVsz91cG7EL2FBg==
+  dependencies:
+    universalify "^1.0.0"
+  optionalDependencies:
+    graceful-fs "^4.1.6"
+
 jsonify@~0.0.0:
   version "0.0.0"
   resolved "https://registry.yarnpkg.com/jsonify/-/jsonify-0.0.0.tgz#2c74b6ee41d93ca51b7b5aaee8f503631d252a73"
@@ -18141,7 +18344,7 @@ latest-version@^5.0.0:
   dependencies:
     package-json "^6.3.0"
 
-lazy-ass@1.6.0:
+lazy-ass@^1.6.0:
   version "1.6.0"
   resolved "https://registry.yarnpkg.com/lazy-ass/-/lazy-ass-1.6.0.tgz#7999655e8646c17f089fdd187d150d3324d54513"
   integrity sha1-eZllXoZGwX8In90YfRUNMyTVRRM=
@@ -18374,7 +18577,7 @@ listr-verbose-renderer@^0.5.0:
     date-fns "^1.27.2"
     figures "^2.0.0"
 
-listr@0.14.3:
+listr@0.14.3, listr@^0.14.3:
   version "0.14.3"
   resolved "https://registry.yarnpkg.com/listr/-/listr-0.14.3.tgz#2fea909604e434be464c50bddba0d496928fa586"
   integrity sha512-RmAl7su35BFd/xoMamRjpIE4j3v+L28o8CT5YhAXQJm1fD+1l9ngXY8JAQRJ+tFK2i5njvi0iRUKV09vPwA0iA==
@@ -18803,6 +19006,11 @@ lodash.throttle@^4.1.1:
   resolved "https://registry.yarnpkg.com/lodash.throttle/-/lodash.throttle-4.1.1.tgz#c23e91b710242ac70c37f1e1cda9274cc39bf2f4"
   integrity sha1-wj6RtxAkKscMN/HhzaknTMOb8vQ=
 
+lodash.toarray@^4.4.0:
+  version "4.4.0"
+  resolved "https://registry.yarnpkg.com/lodash.toarray/-/lodash.toarray-4.4.0.tgz#24c4bfcd6b2fba38bfd0594db1179d8e9b656561"
+  integrity sha1-JMS/zWsvuji/0FlNsRedjptlZWE=
+
 lodash.unescape@4.0.1:
   version "4.0.1"
   resolved "https://registry.yarnpkg.com/lodash.unescape/-/lodash.unescape-4.0.1.tgz#bf2249886ce514cda112fae9218cdc065211fc9c"
@@ -18818,7 +19026,7 @@ lodash.uniq@^4.5.0:
   resolved "https://registry.yarnpkg.com/lodash.uniq/-/lodash.uniq-4.5.0.tgz#d0225373aeb652adc1bc82e4945339a842754773"
   integrity sha1-0CJTc662Uq3BvILklFM5qEJ1R3M=
 
-lodash@4.17.11, lodash@4.17.15, lodash@4.17.19, lodash@>4.17.4, lodash@^4, lodash@^4.0.0, lodash@^4.0.1, lodash@^4.10.0, lodash@^4.11.1, lodash@^4.15.0, lodash@^4.17.10, lodash@^4.17.11, lodash@^4.17.12, lodash@^4.17.13, lodash@^4.17.14, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.2, lodash@^4.17.20, lodash@^4.17.4, lodash@^4.2.0, lodash@^4.2.1, lodash@^4.3.0, lodash@~4.17.10, lodash@~4.17.15, lodash@~4.17.5:
+lodash@4.17.11, lodash@4.17.15, lodash@>4.17.4, lodash@^4, lodash@^4.0.0, lodash@^4.0.1, lodash@^4.10.0, lodash@^4.11.1, lodash@^4.15.0, lodash@^4.17.10, lodash@^4.17.11, lodash@^4.17.12, lodash@^4.17.13, lodash@^4.17.14, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.2, lodash@^4.17.20, lodash@^4.17.4, lodash@^4.2.0, lodash@^4.2.1, lodash@^4.3.0, lodash@~4.17.10, lodash@~4.17.15, lodash@~4.17.5:
   version "4.17.20"
   resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.20.tgz#b44a9b6297bcb698f1c51a3545a2b3b368d59c52"
   integrity sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA==
@@ -18992,6 +19200,14 @@ lowercase-keys@^2.0.0:
   resolved "https://registry.yarnpkg.com/lowercase-keys/-/lowercase-keys-2.0.0.tgz#2603e78b7b4b0006cbca2fbcc8a3202558ac9479"
   integrity sha512-tqNXrS78oMOE73NMxK4EMLQsQowWf8jKooH9g7xPavRT706R6bkQJ6DY2Te7QukaZsulxa30wQ7bk0pm4XiHmA==
 
+lowlight@^1.2.0:
+  version "1.14.0"
+  resolved "https://registry.yarnpkg.com/lowlight/-/lowlight-1.14.0.tgz#83ebc143fec0f9e6c0d3deffe01be129ce56b108"
+  integrity sha512-N2E7zTM7r1CwbzwspPxJvmjAbxljCPThTFawEX2Z7+P3NGrrvY54u8kyU16IY4qWfoVIxY8SYCS8jTkuG7TqYA==
+  dependencies:
+    fault "^1.0.0"
+    highlight.js "~10.1.0"
+
 lowlight@~1.11.0:
   version "1.11.0"
   resolved "https://registry.yarnpkg.com/lowlight/-/lowlight-1.11.0.tgz#1304d83005126d4e8b1dc0f07981e9b689ec2efc"
@@ -19280,6 +19496,30 @@ mdast-add-list-metadata@1.0.1:
   dependencies:
     unist-util-visit-parents "1.1.2"
 
+mdast-util-definitions@^3.0.0:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/mdast-util-definitions/-/mdast-util-definitions-3.0.1.tgz#06af6c49865fc63d6d7d30125569e2f7ae3d0a86"
+  integrity sha512-BAv2iUm/e6IK/b2/t+Fx69EL/AGcq/IG2S+HxHjDJGfLJtd6i9SZUS76aC9cig+IEucsqxKTR0ot3m933R3iuA==
+  dependencies:
+    unist-util-visit "^2.0.0"
+
+mdast-util-to-hast@^9.1.0:
+  version "9.1.0"
+  resolved "https://registry.yarnpkg.com/mdast-util-to-hast/-/mdast-util-to-hast-9.1.0.tgz#6ef121dd3cd3b006bf8650b1b9454da0faf79ffe"
+  integrity sha512-Akl2Vi9y9cSdr19/Dfu58PVwifPXuFt1IrHe7l+Crme1KvgUT+5z+cHLVcQVGCiNTZZcdqjnuv9vPkGsqWytWA==
+  dependencies:
+    "@types/mdast" "^3.0.0"
+    "@types/unist" "^2.0.3"
+    collapse-white-space "^1.0.0"
+    detab "^2.0.0"
+    mdast-util-definitions "^3.0.0"
+    mdurl "^1.0.0"
+    trim-lines "^1.0.0"
+    unist-builder "^2.0.0"
+    unist-util-generated "^1.0.0"
+    unist-util-position "^3.0.0"
+    unist-util-visit "^2.0.0"
+
 mdn-data@2.0.4:
   version "2.0.4"
   resolved "https://registry.yarnpkg.com/mdn-data/-/mdn-data-2.0.4.tgz#699b3c38ac6f1d728091a64650b65d388502fd5b"
@@ -19290,7 +19530,7 @@ mdn-data@2.0.6:
   resolved "https://registry.yarnpkg.com/mdn-data/-/mdn-data-2.0.6.tgz#852dc60fcaa5daa2e8cf6c9189c440ed3e042978"
   integrity sha512-rQvjv71olwNHgiTbfPZFkJtjNMciWgswYeciZhtvWLO8bmX3TnhyA62I6sTWOyZssWHJJjY6/KiWwqQsWWsqOA==
 
-mdurl@^1.0.1:
+mdurl@^1.0.0, mdurl@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/mdurl/-/mdurl-1.0.1.tgz#fe85b2ec75a59037f2adfec100fd6c601761152e"
   integrity sha1-/oWy7HWlkDfyrf7BAP1sYBdhFS4=
@@ -19717,7 +19957,7 @@ minimist@1.2.0:
   resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.0.tgz#a35008b20f41383eec1fb914f4cd5df79a264284"
   integrity sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=
 
-minimist@1.2.5, minimist@^1.1.0, minimist@^1.1.1, minimist@^1.1.3, minimist@^1.2.0, minimist@^1.2.5, minimist@~1.2.0:
+minimist@^1.1.0, minimist@^1.1.1, minimist@^1.1.3, minimist@^1.2.0, minimist@^1.2.5, minimist@~1.2.0:
   version "1.2.5"
   resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.5.tgz#67d66014b66a6a8aaa0c083c5fd58df4e4e97602"
   integrity sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==
@@ -19984,16 +20224,16 @@ moment-timezone@^0.5.27:
   dependencies:
     moment ">= 2.9.0"
 
-moment@2.26.0:
-  version "2.26.0"
-  resolved "https://registry.yarnpkg.com/moment/-/moment-2.26.0.tgz#5e1f82c6bafca6e83e808b30c8705eed0dcbd39a"
-  integrity sha512-oIixUO+OamkUkwjhAVE18rAMfRJNsNe/Stid/gwHSOfHrOtw9EhAY2AHvdKZ/k/MggcYELFCJz/Sn2pL8b8JMw==
-
 "moment@>= 2.9.0", moment@>=1.6.0, moment@>=2.14.0, moment@^2.10.6, moment@^2.24.0:
   version "2.24.0"
   resolved "https://registry.yarnpkg.com/moment/-/moment-2.24.0.tgz#0d055d53f5052aa653c9f6eb68bb5d12bf5c2b5b"
   integrity sha512-bV7f+6l2QigeBBZSM/6yTNq4P2fNpSWj/0e7jQcy87A8e7o2nAfP/34/2ky5Vw4B9S446EtIhodAzkFCcR4dQg==
 
+moment@^2.27.0:
+  version "2.27.0"
+  resolved "https://registry.yarnpkg.com/moment/-/moment-2.27.0.tgz#8bff4e3e26a236220dfe3e36de756b6ebaa0105d"
+  integrity sha512-al0MUK7cpIcglMv3YF13qSgdAIqxHTO7brRtaz3DlSULbqfazqkc5kEjNrLDOM7fsjshoFIihnU8snrP7zUvhQ==
+
 monaco-editor@~0.17.0:
   version "0.17.1"
   resolved "https://registry.yarnpkg.com/monaco-editor/-/monaco-editor-0.17.1.tgz#8fbe96ca54bfa75262706e044f8f780e904aa45c"
@@ -20348,6 +20588,13 @@ node-dir@^0.1.10:
   dependencies:
     minimatch "^3.0.2"
 
+node-emoji@^1.10.0:
+  version "1.10.0"
+  resolved "https://registry.yarnpkg.com/node-emoji/-/node-emoji-1.10.0.tgz#8886abd25d9c7bb61802a658523d1f8d2a89b2da"
+  integrity sha512-Yt3384If5H6BYGVHiHwTL+99OzJKHhgp82S8/dktEK73T26BazdgZ4JZh92xSVtGNJvz9UbXdNAc5hcrXV42vw==
+  dependencies:
+    lodash.toarray "^4.4.0"
+
 node-environment-flags@1.0.6:
   version "1.0.6"
   resolved "https://registry.yarnpkg.com/node-environment-flags/-/node-environment-flags-1.0.6.tgz#a30ac13621f6f7d674260a54dede048c3982c088"
@@ -20384,15 +20631,10 @@ node-forge@0.9.0:
   resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-0.9.0.tgz#d624050edbb44874adca12bb9a52ec63cb782579"
   integrity sha512-7ASaDa3pD+lJ3WvXFsxekJQelBKRpne+GOVbLbtHYdd7pFspyeuJHnWfLplGf3SwKGbfs/aYl5V/JCIaHVUKKQ==
 
-node-forge@^0.7.6:
-  version "0.7.6"
-  resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-0.7.6.tgz#fdf3b418aee1f94f0ef642cd63486c77ca9724ac"
-  integrity sha512-sol30LUpz1jQFBjOKwbjxijiE3b6pjd74YwfD0fJOKPjF+fONKb2Yg8rYgS6+bK6VDl+/wfr4IYpC7jDzLUIfw==
-
-node-forge@^0.9.1:
-  version "0.9.1"
-  resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-0.9.1.tgz#775368e6846558ab6676858a4d8c6e8d16c677b5"
-  integrity sha512-G6RlQt5Sb4GMBzXvhfkeFmbqR6MzhtnT7VTHuLadjkii3rdYHNdw0m8zA4BTxVIh68FicCQ2NSUANpsqkr9jvQ==
+node-forge@^0.10.0, node-forge@^0.7.6:
+  version "0.10.0"
+  resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-0.10.0.tgz#32dea2afb3e9926f02ee5ce8794902691a676bf3"
+  integrity sha512-PPmu8eEeG9saEUvI97fm4OYxXVB6bFvyNTyiUOBichBpFG8A1Ljw3bY62+5oOjDEMHRnd0Y7HQ+x7uzxOzC6JA==
 
 node-gyp@^3.8.0:
   version "3.8.0"
@@ -21379,7 +21621,7 @@ osenv@0, osenv@^0.1.0, osenv@^0.1.4:
     os-homedir "^1.0.0"
     os-tmpdir "^1.0.0"
 
-ospath@1.2.2:
+ospath@^1.2.2:
   version "1.2.2"
   resolved "https://registry.yarnpkg.com/ospath/-/ospath-1.2.2.tgz#1276639774a3f8ef2572f7fe4280e0ea4550c07b"
   integrity sha1-EnZjl3Sj+O8lcvf+QoDg6kVQwHs=
@@ -22438,16 +22680,16 @@ prettier@^2.1.1:
   resolved "https://registry.yarnpkg.com/prettier/-/prettier-2.1.1.tgz#d9485dd5e499daa6cb547023b87a6cf51bee37d6"
   integrity sha512-9bY+5ZWCfqj3ghYBLxApy2zf6m+NJo5GzmLTpr9FsApsfjriNnS2dahWReHMi7qNPhhHl9SYHJs2cHZLgexNIw==
 
-pretty-bytes@5.3.0:
-  version "5.3.0"
-  resolved "https://registry.yarnpkg.com/pretty-bytes/-/pretty-bytes-5.3.0.tgz#f2849e27db79fb4d6cfe24764fc4134f165989f2"
-  integrity sha512-hjGrh+P926p4R4WbaB6OckyRtO0F0/lQBiT+0gnxjV+5kjPBrfVBFCsCLbMqVQeydvIoouYTCmmEURiH3R1Bdg==
-
 pretty-bytes@^4.0.2:
   version "4.0.2"
   resolved "https://registry.yarnpkg.com/pretty-bytes/-/pretty-bytes-4.0.2.tgz#b2bf82e7350d65c6c33aa95aaa5a4f6327f61cd9"
   integrity sha1-sr+C5zUNZcbDOqlaqlpPYyf2HNk=
 
+pretty-bytes@^5.3.0:
+  version "5.3.0"
+  resolved "https://registry.yarnpkg.com/pretty-bytes/-/pretty-bytes-5.3.0.tgz#f2849e27db79fb4d6cfe24764fc4134f165989f2"
+  integrity sha512-hjGrh+P926p4R4WbaB6OckyRtO0F0/lQBiT+0gnxjV+5kjPBrfVBFCsCLbMqVQeydvIoouYTCmmEURiH3R1Bdg==
+
 pretty-error@^2.1.1:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/pretty-error/-/pretty-error-2.1.1.tgz#5f4f87c8f91e5ae3f3ba87ab4cf5e03b1a17f1a3"
@@ -22647,6 +22889,13 @@ property-information@^5.0.0, property-information@^5.0.1:
   dependencies:
     xtend "^4.0.1"
 
+property-information@^5.2.0, property-information@^5.3.0:
+  version "5.5.0"
+  resolved "https://registry.yarnpkg.com/property-information/-/property-information-5.5.0.tgz#4dc075d493061a82e2b7d096f406e076ed859943"
+  integrity sha512-RgEbCx2HLa1chNgvChcx+rrCWD0ctBmGSE0M7lVm1yyv4UbvbrWoXp/BkVLZefzjrRBGW8/Js6uh/BnlHXFyjA==
+  dependencies:
+    xtend "^4.0.0"
+
 proto-list@~1.2.1:
   version "1.2.4"
   resolved "https://registry.yarnpkg.com/proto-list/-/proto-list-1.2.4.tgz#212d5bfe1318306a420f6402b8e26ff39647a849"
@@ -22933,16 +23182,16 @@ railroad-diagrams@^1.0.0:
   resolved "https://registry.yarnpkg.com/railroad-diagrams/-/railroad-diagrams-1.0.0.tgz#eb7e6267548ddedfb899c1b90e57374559cddb7e"
   integrity sha1-635iZ1SN3t+4mcG5Dlc3RVnN234=
 
-ramda@0.26.1, ramda@^0.26, ramda@^0.26.1:
-  version "0.26.1"
-  resolved "https://registry.yarnpkg.com/ramda/-/ramda-0.26.1.tgz#8d41351eb8111c55353617fc3bbffad8e4d35d06"
-  integrity sha512-hLWjpy7EnsDBb0p+Z3B7rPi3GDeRG5ZtiI33kJhTt+ORCd38AbAIjB/9zRIUoeTbE/AVX5ZkU7m6bznsvrf8eQ==
-
 ramda@^0.21.0:
   version "0.21.0"
   resolved "https://registry.yarnpkg.com/ramda/-/ramda-0.21.0.tgz#a001abedb3ff61077d4ff1d577d44de77e8d0a35"
   integrity sha1-oAGr7bP/YQd9T/HVd9RN536NCjU=
 
+ramda@^0.26, ramda@^0.26.1, ramda@~0.26.1:
+  version "0.26.1"
+  resolved "https://registry.yarnpkg.com/ramda/-/ramda-0.26.1.tgz#8d41351eb8111c55353617fc3bbffad8e4d35d06"
+  integrity sha512-hLWjpy7EnsDBb0p+Z3B7rPi3GDeRG5ZtiI33kJhTt+ORCd38AbAIjB/9zRIUoeTbE/AVX5ZkU7m6bznsvrf8eQ==
+
 randexp@0.4.6:
   version "0.4.6"
   resolved "https://registry.yarnpkg.com/randexp/-/randexp-0.4.6.tgz#e986ad5e5e31dae13ddd6f7b3019aa7c87f60ca3"
@@ -23276,6 +23525,15 @@ react-draggable@^4.0.3:
     classnames "^2.2.5"
     prop-types "^15.6.0"
 
+react-dropzone@^10.2.1:
+  version "10.2.2"
+  resolved "https://registry.yarnpkg.com/react-dropzone/-/react-dropzone-10.2.2.tgz#67b4db7459589a42c3b891a82eaf9ade7650b815"
+  integrity sha512-U5EKckXVt6IrEyhMMsgmHQiWTGLudhajPPG77KFSvgsMqNEHSyGpqWvOMc5+DhEah/vH4E1n+J5weBNLd5VtyA==
+  dependencies:
+    attr-accept "^2.0.0"
+    file-selector "^0.1.12"
+    prop-types "^15.7.2"
+
 react-dropzone@^4.2.9:
   version "4.3.0"
   resolved "https://registry.yarnpkg.com/react-dropzone/-/react-dropzone-4.3.0.tgz#facdd7db16509772633c9f5200621ac01aa6706f"
@@ -23314,14 +23572,14 @@ react-focus-lock@^2.1.0, react-focus-lock@^2.3.1:
     use-callback-ref "^1.2.1"
     use-sidecar "^1.0.1"
 
-react-focus-on@^3.4.1:
-  version "3.4.1"
-  resolved "https://registry.yarnpkg.com/react-focus-on/-/react-focus-on-3.4.1.tgz#e184f3c44185e341598c5d9d44b2987ad459b240"
-  integrity sha512-KGRIl0iAu+1k1dcX7eQCXF5ZR/nl+XyXN5Ukw/OY80vLaK2b6vDzNqnX0HdYbY5xSUhIRUvMWEzSsdEyPjvk/Q==
+react-focus-on@^3.5.0:
+  version "3.5.0"
+  resolved "https://registry.yarnpkg.com/react-focus-on/-/react-focus-on-3.5.0.tgz#3cdebbefee26a083976e1700ba75f7377040f7f1"
+  integrity sha512-RqGAHOxhRAaMSVHIN5IpY7YL6AJkD/DMa/+iPDV7aB6XWRQfg3v2q35egIZgMWP2xhXaRVai3B80dpVWyj4Rcw==
   dependencies:
     aria-hidden "^1.1.1"
     react-focus-lock "^2.3.1"
-    react-remove-scroll "^2.3.0"
+    react-remove-scroll "^2.4.0"
     react-style-singleton "^2.1.0"
     use-callback-ref "^1.2.3"
     use-sidecar "^1.0.1"
@@ -23534,10 +23792,10 @@ react-remove-scroll-bar@^2.1.0:
     react-style-singleton "^2.1.0"
     tslib "^1.0.0"
 
-react-remove-scroll@^2.3.0:
-  version "2.3.0"
-  resolved "https://registry.yarnpkg.com/react-remove-scroll/-/react-remove-scroll-2.3.0.tgz#3af06fe2f7130500704b676cdef94452c08fe593"
-  integrity sha512-UqVimLeAe+5EHXKfsca081hAkzg3WuDmoT9cayjBegd6UZVhlTEchleNp9J4TMGkb/ftLve7ARB5Wph+HJ7A5g==
+react-remove-scroll@^2.4.0:
+  version "2.4.0"
+  resolved "https://registry.yarnpkg.com/react-remove-scroll/-/react-remove-scroll-2.4.0.tgz#190c16eb508c5927595935499e8f5dd9ab0e75cf"
+  integrity sha512-BZIO3GaEs0Or1OhA5C//n1ibUP1HdjJmqUVUsOCMxwoIpaCocbB9TFKwHOkBa/nyYy3slirqXeiPYGwdSDiseA==
   dependencies:
     react-remove-scroll-bar "^2.1.0"
     react-style-singleton "^2.1.0"
@@ -23966,7 +24224,7 @@ read-pkg@^5.2.0:
     parse-json "^5.0.0"
     type-fest "^0.6.0"
 
-"readable-stream@1 || 2", readable-stream@^2.3.7, readable-stream@~2.3.3:
+"readable-stream@1 || 2", readable-stream@^2.0.0, readable-stream@^2.0.1, readable-stream@^2.0.2, readable-stream@^2.0.4, readable-stream@^2.0.5, readable-stream@^2.0.6, readable-stream@^2.1.5, readable-stream@^2.2.2, readable-stream@^2.3.3, readable-stream@^2.3.5, readable-stream@^2.3.6, readable-stream@^2.3.7, readable-stream@~2.3.3, readable-stream@~2.3.6:
   version "2.3.7"
   resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.3.7.tgz#1eca1cf711aef814c04f62252a36a62f6cb23b57"
   integrity sha512-Ebho8K4jIbHAxnuxi7o42OrZgF/ZTNcsZj6nRKyUmkhLFq8CHItp/fy6hQZuZmP/n3yZ9VBUbp4zz/mX8hmYPw==
@@ -23989,29 +24247,7 @@ readable-stream@1.0, "readable-stream@>=1.0.33-1 <1.1.0-0":
     isarray "0.0.1"
     string_decoder "~0.10.x"
 
-"readable-stream@2 || 3", readable-stream@^3.0.6, readable-stream@^3.1.1, readable-stream@^3.4.0:
-  version "3.4.0"
-  resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-3.4.0.tgz#a51c26754658e0a3c21dbf59163bd45ba6f447fc"
-  integrity sha512-jItXPLmrSR8jmTRmRWJXCnGJsfy85mB3Wd/uINMXA65yrnFo0cPClFIUWzo2najVNSl+mx7/4W8ttlLWJe99pQ==
-  dependencies:
-    inherits "^2.0.3"
-    string_decoder "^1.1.1"
-    util-deprecate "^1.0.1"
-
-readable-stream@^2.0.0, readable-stream@^2.0.1, readable-stream@^2.0.2, readable-stream@^2.0.4, readable-stream@^2.0.5, readable-stream@^2.0.6, readable-stream@^2.1.5, readable-stream@^2.2.2, readable-stream@^2.3.3, readable-stream@^2.3.5, readable-stream@^2.3.6, readable-stream@~2.3.6:
-  version "2.3.6"
-  resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.3.6.tgz#b11c27d88b8ff1fbe070643cf94b0c79ae1b0aaf"
-  integrity sha512-tQtKA9WIAhBF3+VLAseyMqZeBjW0AHJoxOtYqSUZNJxauErmLbVm2FW1y+J/YA9dUrAC39ITejlZWhVIwawkKw==
-  dependencies:
-    core-util-is "~1.0.0"
-    inherits "~2.0.3"
-    isarray "~1.0.0"
-    process-nextick-args "~2.0.0"
-    safe-buffer "~5.1.1"
-    string_decoder "~1.1.1"
-    util-deprecate "~1.0.1"
-
-readable-stream@^3.0.2:
+"readable-stream@2 || 3", readable-stream@^3.0.2, readable-stream@^3.0.6, readable-stream@^3.1.1, readable-stream@^3.4.0:
   version "3.6.0"
   resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-3.6.0.tgz#337bbda3adc0706bd3e024426a286d4b4b2c9198"
   integrity sha512-BViHy7LKeTz4oNnkcLJ+lVSL6vpiFeX6/d3oSH8zCW7UxP2onchk+vTGB143xuFjHS3deTgkKoXXymXqymiIdA==
@@ -24471,6 +24707,29 @@ rehype-parse@^6.0.0:
     parse5 "^5.0.0"
     xtend "^4.0.1"
 
+rehype-raw@^4.0.1:
+  version "4.0.2"
+  resolved "https://registry.yarnpkg.com/rehype-raw/-/rehype-raw-4.0.2.tgz#5d3191689df96c8c651ce5f51a6c668d2c07b9c8"
+  integrity sha512-xQt94oXfDaO7sK9mJBtsZXkjW/jm6kArCoYN+HqKZ51O19AFHlp3Xa5UfZZ2tJkbpAZzKtgVUYvnconk9IsFuA==
+  dependencies:
+    hast-util-raw "^5.0.0"
+
+rehype-react@^6.0.0:
+  version "6.1.0"
+  resolved "https://registry.yarnpkg.com/rehype-react/-/rehype-react-6.1.0.tgz#95f8c936eea2159f92adfbf58e5e90be86a97cbf"
+  integrity sha512-hQ4DSGOJKA1a87Ei4fJtSHzopbfgoHkwjWMCFpLrcVR5+AIyCOtHy4oQcpGF11kTZOU6oKmJ9UKzO/JpI/XZWA==
+  dependencies:
+    "@mapbox/hast-util-table-cell-style" "^0.1.3"
+    hast-to-hyperscript "^9.0.0"
+
+rehype-stringify@^6.0.1:
+  version "6.0.1"
+  resolved "https://registry.yarnpkg.com/rehype-stringify/-/rehype-stringify-6.0.1.tgz#b6aa9f84d5276c5d247c62fc1ea15983a35a4575"
+  integrity sha512-JfEPRDD4DiG7jet4md7sY07v6ACeb2x+9HWQtRPm2iA6/ic31hCv1SNBUtpolJASxQ/D8gicXiviW4TJKEMPKQ==
+  dependencies:
+    hast-util-to-html "^6.0.0"
+    xtend "^4.0.0"
+
 relateurl@0.2.x:
   version "0.2.7"
   resolved "https://registry.yarnpkg.com/relateurl/-/relateurl-0.2.7.tgz#54dbf377e51440aca90a4cd274600d3ff2d888a9"
@@ -24495,6 +24754,23 @@ release-zalgo@^1.0.0:
   dependencies:
     es6-error "^4.0.1"
 
+remark-emoji@^2.1.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/remark-emoji/-/remark-emoji-2.1.0.tgz#69165d1181b98a54ad5d9ef811003d53d7ebc7db"
+  integrity sha512-lDddGsxXURV01WS9WAiS9rO/cedO1pvr9tahtLhr6qCGFhHG4yZSJW3Ha4Nw9Uk1hLNmUBtPC0+m45Ms+xEitg==
+  dependencies:
+    emoticon "^3.2.0"
+    node-emoji "^1.10.0"
+    unist-util-visit "^2.0.2"
+
+remark-highlight.js@^5.2.0:
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/remark-highlight.js/-/remark-highlight.js-5.2.0.tgz#6d8d22085e0c76573744b7e3706fc232269f5b02"
+  integrity sha512-5tCr1CfdXDYzR8HCAnohlr1rK8DjUTFxEZdr+QEul5o13+EOEt5RrO8U6Znf8Faj5rVLcMJtxLPq6hHrZFo33A==
+  dependencies:
+    lowlight "^1.2.0"
+    unist-util-visit "^1.0.0"
+
 remark-parse@^5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/remark-parse/-/remark-parse-5.0.0.tgz#4c077f9e499044d1d5c13f80d7a98cf7b9285d95"
@@ -24516,6 +24792,34 @@ remark-parse@^5.0.0:
     vfile-location "^2.0.0"
     xtend "^4.0.1"
 
+remark-parse@^7.0.2:
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/remark-parse/-/remark-parse-7.0.2.tgz#41e7170d9c1d96c3d32cf1109600a9ed50dba7cf"
+  integrity sha512-9+my0lQS80IQkYXsMA8Sg6m9QfXYJBnXjWYN5U+kFc5/n69t+XZVXU/ZBYr3cYH8FheEGf1v87rkFDhJ8bVgMA==
+  dependencies:
+    collapse-white-space "^1.0.2"
+    is-alphabetical "^1.0.0"
+    is-decimal "^1.0.0"
+    is-whitespace-character "^1.0.0"
+    is-word-character "^1.0.0"
+    markdown-escapes "^1.0.0"
+    parse-entities "^1.1.0"
+    repeat-string "^1.5.4"
+    state-toggle "^1.0.0"
+    trim "0.0.1"
+    trim-trailing-lines "^1.0.0"
+    unherit "^1.0.4"
+    unist-util-remove-position "^1.0.0"
+    vfile-location "^2.0.0"
+    xtend "^4.0.1"
+
+remark-rehype@^7.0.0:
+  version "7.0.0"
+  resolved "https://registry.yarnpkg.com/remark-rehype/-/remark-rehype-7.0.0.tgz#8e106e49806c69b2e9523b76d24965119e2da67b"
+  integrity sha512-uqQ/VbaTdxyu/da6npHAso6hA00cMqhA3a59RziQdOLN2KEIkPykAVy52IcmZEVTuauXO0VtpxkyCey4phtHzQ==
+  dependencies:
+    mdast-util-to-hast "^9.1.0"
+
 remedial@^1.0.7:
   version "1.0.8"
   resolved "https://registry.yarnpkg.com/remedial/-/remedial-1.0.8.tgz#a5e4fd52a0e4956adbaf62da63a5a46a78c578a0"
@@ -24602,7 +24906,7 @@ replace-homedir@^1.0.0:
     is-absolute "^1.0.0"
     remove-trailing-separator "^1.1.0"
 
-request-progress@3.0.0:
+request-progress@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/request-progress/-/request-progress-3.0.0.tgz#4ca754081c7fec63f505e4faa825aa06cd669dbe"
   integrity sha1-TKdUCBx/7GP1BeT6qCWqBs1mnb4=
@@ -26631,6 +26935,17 @@ string_decoder@~1.1.1:
   dependencies:
     safe-buffer "~5.1.0"
 
+stringify-entities@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/stringify-entities/-/stringify-entities-2.0.0.tgz#fa7ca6614b355fb6c28448140a20c4ede7462827"
+  integrity sha512-fqqhZzXyAM6pGD9lky/GOPq6V4X0SeTAFBl0iXb/BzOegl40gpf/bV3QQP7zULNYvjr6+Dx8SCaDULjVoOru0A==
+  dependencies:
+    character-entities-html4 "^1.0.0"
+    character-entities-legacy "^1.0.0"
+    is-alphanumerical "^1.0.0"
+    is-decimal "^1.0.2"
+    is-hexadecimal "^1.0.0"
+
 stringify-object@3.2.2:
   version "3.2.2"
   resolved "https://registry.yarnpkg.com/stringify-object/-/stringify-object-3.2.2.tgz#9853052e5a88fb605a44cd27445aa257ad7ffbcd"
@@ -26800,6 +27115,20 @@ style-loader@^1.1.3:
     loader-utils "^1.2.3"
     schema-utils "^2.6.4"
 
+style-to-object@^0.2.1:
+  version "0.2.3"
+  resolved "https://registry.yarnpkg.com/style-to-object/-/style-to-object-0.2.3.tgz#afcf42bc03846b1e311880c55632a26ad2780bcb"
+  integrity sha512-1d/k4EY2N7jVLOqf2j04dTc37TPOv/hHxZmvpg8Pdh8UYydxeu/C1W1U4vD8alzf5V2Gt7rLsmkr4dxAlDm9ng==
+  dependencies:
+    inline-style-parser "0.1.1"
+
+style-to-object@^0.3.0:
+  version "0.3.0"
+  resolved "https://registry.yarnpkg.com/style-to-object/-/style-to-object-0.3.0.tgz#b1b790d205991cc783801967214979ee19a76e46"
+  integrity sha512-CzFnRRXhzWIdItT3OmF8SQfWyahHhjq3HwcMNCNLn+N7klOOqPjMeG/4JSu77D7ypZdGvSzvkrbyeTMizz2VrA==
+  dependencies:
+    inline-style-parser "0.1.1"
+
 styled-components@^5.1.0:
   version "5.1.0"
   resolved "https://registry.yarnpkg.com/styled-components/-/styled-components-5.1.0.tgz#2e3985b54f461027e1c91af3229e1c2530872a4e"
@@ -26907,13 +27236,6 @@ supports-color@6.1.0, supports-color@^6.1.0:
   dependencies:
     has-flag "^3.0.0"
 
-supports-color@7.1.0, supports-color@^7.1.0:
-  version "7.1.0"
-  resolved "https://registry.yarnpkg.com/supports-color/-/supports-color-7.1.0.tgz#68e32591df73e25ad1c4b49108a2ec507962bfd1"
-  integrity sha512-oRSIpR8pxT1Wr2FquTNnGet79b3BWljqOuoW/h4oBhxJ/HUbX5nX6JSruTkvXDCFMwDPvsaTTbvMLKZWSy0R5g==
-  dependencies:
-    has-flag "^4.0.0"
-
 supports-color@^0.2.0:
   version "0.2.0"
   resolved "https://registry.yarnpkg.com/supports-color/-/supports-color-0.2.0.tgz#d92de2694eb3f67323973d7ae3d8b55b4c22190a"
@@ -26952,6 +27274,13 @@ supports-color@^7.0.0:
   dependencies:
     has-flag "^4.0.0"
 
+supports-color@^7.1.0:
+  version "7.1.0"
+  resolved "https://registry.yarnpkg.com/supports-color/-/supports-color-7.1.0.tgz#68e32591df73e25ad1c4b49108a2ec507962bfd1"
+  integrity sha512-oRSIpR8pxT1Wr2FquTNnGet79b3BWljqOuoW/h4oBhxJ/HUbX5nX6JSruTkvXDCFMwDPvsaTTbvMLKZWSy0R5g==
+  dependencies:
+    has-flag "^4.0.0"
+
 supports-hyperlinks@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/supports-hyperlinks/-/supports-hyperlinks-1.0.1.tgz#71daedf36cc1060ac5100c351bb3da48c29c0ef7"
@@ -27595,6 +27924,13 @@ tmp@^0.0.33:
   dependencies:
     os-tmpdir "~1.0.2"
 
+tmp@~0.2.1:
+  version "0.2.1"
+  resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.1.tgz#8457fc3037dcf4719c251367a1af6500ee1ccf14"
+  integrity sha512-76SUhtfqR2Ijn+xllcI5P1oyannHNHByD80W1q447gU3mp9G9PSpGdWmjUOHRDPiHYacIk66W7ubDTuPF3BEtQ==
+  dependencies:
+    rimraf "^3.0.0"
+
 tmpl@1.0.x:
   version "1.0.4"
   resolved "https://registry.yarnpkg.com/tmpl/-/tmpl-1.0.4.tgz#23640dd7b42d00433911140820e5cf440e521dd1"
@@ -27804,6 +28140,11 @@ treeify@^1.0.1, treeify@^1.1.0:
   resolved "https://registry.yarnpkg.com/treeify/-/treeify-1.1.0.tgz#4e31c6a463accd0943879f30667c4fdaff411bb8"
   integrity sha512-1m4RA7xVAJrSGrrXGs0L3YTwyvBs2S8PbRHaLZAkFw7JR8oIFwYtysxlBZhYIa7xSyiYJKZ3iGrrk55cGA3i9A==
 
+trim-lines@^1.0.0:
+  version "1.1.3"
+  resolved "https://registry.yarnpkg.com/trim-lines/-/trim-lines-1.1.3.tgz#839514be82428fd9e7ec89e35081afe8f6f93115"
+  integrity sha512-E0ZosSWYK2mkSu+KEtQ9/KqarVjA9HztOSX+9FDdNacRAq29RRV6ZQNgob3iuW8Htar9vAfEa6yyt5qBAHZDBA==
+
 trim-newlines@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/trim-newlines/-/trim-newlines-1.0.0.tgz#5887966bb582a4503a41eb524f7d35011815a613"
@@ -28104,13 +28445,6 @@ typescript@4.0.2, typescript@^3.0.1, typescript@^3.0.3, typescript@^3.2.2, types
   resolved "https://registry.yarnpkg.com/typescript/-/typescript-4.0.2.tgz#7ea7c88777c723c681e33bf7988be5d008d05ac2"
   integrity sha512-e4ERvRV2wb+rRZ/IQeb3jm2VxBsirQLpQhdxplZ2MEzGvDkkMmPglecnNDfSUBivMjP93vRbngYYDQqQ/78bcQ==
 
-typings-tester@^0.3.2:
-  version "0.3.2"
-  resolved "https://registry.yarnpkg.com/typings-tester/-/typings-tester-0.3.2.tgz#04cc499d15ab1d8b2d14dd48415a13d01333bc5b"
-  integrity sha512-HjGoAM2UoGhmSKKy23TYEKkxlphdJFdix5VvqWFLzH1BJVnnwG38tpC6SXPgqhfFGfHY77RlN1K8ts0dbWBQ7A==
-  dependencies:
-    commander "^2.12.2"
-
 ua-parser-js@^0.7.18:
   version "0.7.21"
   resolved "https://registry.yarnpkg.com/ua-parser-js/-/ua-parser-js-0.7.21.tgz#853cf9ce93f642f67174273cc34565ae6f308777"
@@ -28319,6 +28653,17 @@ unified@^7.1.0:
     vfile "^3.0.0"
     x-is-string "^0.1.0"
 
+unified@^8.4.2:
+  version "8.4.2"
+  resolved "https://registry.yarnpkg.com/unified/-/unified-8.4.2.tgz#13ad58b4a437faa2751a4a4c6a16f680c500fff1"
+  integrity sha512-JCrmN13jI4+h9UAyKEoGcDZV+i1E7BLFuG7OsaDvTXI5P0qhHX+vZO/kOhz9jn8HGENDKbwSeB0nVOg4gVStGA==
+  dependencies:
+    bail "^1.0.0"
+    extend "^3.0.0"
+    is-plain-obj "^2.0.0"
+    trough "^1.0.0"
+    vfile "^4.0.0"
+
 union-value@^1.0.0:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/union-value/-/union-value-1.0.1.tgz#0b6fe7b835aecda61c6ea4d4f02c14221e109847"
@@ -28370,11 +28715,36 @@ unique-string@^2.0.0:
   dependencies:
     crypto-random-string "^2.0.0"
 
+unist-builder@^2.0.0:
+  version "2.0.3"
+  resolved "https://registry.yarnpkg.com/unist-builder/-/unist-builder-2.0.3.tgz#77648711b5d86af0942f334397a33c5e91516436"
+  integrity sha512-f98yt5pnlMWlzP539tPc4grGMsFaQQlP/vM396b00jngsiINumNmsY8rkXjfoi1c6QaM8nQ3vaGDuoKWbe/1Uw==
+
+unist-util-generated@^1.0.0:
+  version "1.1.5"
+  resolved "https://registry.yarnpkg.com/unist-util-generated/-/unist-util-generated-1.1.5.tgz#1e903e68467931ebfaea386dae9ea253628acd42"
+  integrity sha512-1TC+NxQa4N9pNdayCYA1EGUOCAO0Le3fVp7Jzns6lnua/mYgwHo0tz5WUAfrdpNch1RZLHc61VZ1SDgrtNXLSw==
+
 unist-util-is@^2.1.1:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/unist-util-is/-/unist-util-is-2.1.1.tgz#0c312629e3f960c66e931e812d3d80e77010947b"
   integrity sha1-DDEmKeP5YMZukx6BLT2A53AQlHs=
 
+unist-util-is@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/unist-util-is/-/unist-util-is-3.0.0.tgz#d9e84381c2468e82629e4a5be9d7d05a2dd324cd"
+  integrity sha512-sVZZX3+kspVNmLWBPAB6r+7D9ZgAFPNWm66f7YNb420RlQSbn+n8rG8dGZSkrER7ZIXGQYNm5pqC3v3HopH24A==
+
+unist-util-is@^4.0.0:
+  version "4.0.2"
+  resolved "https://registry.yarnpkg.com/unist-util-is/-/unist-util-is-4.0.2.tgz#c7d1341188aa9ce5b3cff538958de9895f14a5de"
+  integrity sha512-Ofx8uf6haexJwI1gxWMGg6I/dLnF2yE+KibhD3/diOqY2TinLcqHXCV6OI5gFVn3xQqDH+u0M625pfKwIwgBKQ==
+
+unist-util-position@^3.0.0:
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/unist-util-position/-/unist-util-position-3.1.0.tgz#1c42ee6301f8d52f47d14f62bbdb796571fa2d47"
+  integrity sha512-w+PkwCbYSFw8vpgWD0v7zRCl1FpY3fjDSQ3/N/wNd9Ffa4gPi8+4keqt99N3XW6F99t/mUzp2xAhNmfKWp95QA==
+
 unist-util-remove-position@^1.0.0:
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/unist-util-remove-position/-/unist-util-remove-position-1.1.1.tgz#5a85c1555fc1ba0c101b86707d15e50fa4c871bb"
@@ -28399,6 +28769,28 @@ unist-util-visit-parents@1.1.2:
   resolved "https://registry.yarnpkg.com/unist-util-visit-parents/-/unist-util-visit-parents-1.1.2.tgz#f6e3afee8bdbf961c0e6f028ea3c0480028c3d06"
   integrity sha512-yvo+MMLjEwdc3RhhPYSximset7rwjMrdt9E41Smmvg25UQIenzrN83cRnF1JMzoMi9zZOQeYXHSDf7p+IQkW3Q==
 
+unist-util-visit-parents@^2.0.0:
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/unist-util-visit-parents/-/unist-util-visit-parents-2.1.2.tgz#25e43e55312166f3348cae6743588781d112c1e9"
+  integrity sha512-DyN5vD4NE3aSeB+PXYNKxzGsfocxp6asDc2XXE3b0ekO2BaRUpBicbbUygfSvYfUz1IkmjFR1YF7dPklraMZ2g==
+  dependencies:
+    unist-util-is "^3.0.0"
+
+unist-util-visit-parents@^3.0.0:
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/unist-util-visit-parents/-/unist-util-visit-parents-3.1.0.tgz#4dd262fb9dcfe44f297d53e882fc6ff3421173d5"
+  integrity sha512-0g4wbluTF93npyPrp/ymd3tCDTMnP0yo2akFD2FIBAYXq/Sga3lwaU1D8OYKbtpioaI6CkDcQ6fsMnmtzt7htw==
+  dependencies:
+    "@types/unist" "^2.0.0"
+    unist-util-is "^4.0.0"
+
+unist-util-visit@^1.0.0:
+  version "1.4.1"
+  resolved "https://registry.yarnpkg.com/unist-util-visit/-/unist-util-visit-1.4.1.tgz#4724aaa8486e6ee6e26d7ff3c8685960d560b1e3"
+  integrity sha512-AvGNk7Bb//EmJZyhtRUnNMEpId/AZ5Ph/KUpTI09WHQuDZHKovQ1oEv3mfmKpWKtoMzyMC4GLBm1Zy5k12fjIw==
+  dependencies:
+    unist-util-visit-parents "^2.0.0"
+
 unist-util-visit@^1.1.0, unist-util-visit@^1.3.0:
   version "1.3.0"
   resolved "https://registry.yarnpkg.com/unist-util-visit/-/unist-util-visit-1.3.0.tgz#41ca7c82981fd1ce6c762aac397fc24e35711444"
@@ -28406,6 +28798,15 @@ unist-util-visit@^1.1.0, unist-util-visit@^1.3.0:
   dependencies:
     unist-util-is "^2.1.1"
 
+unist-util-visit@^2.0.0, unist-util-visit@^2.0.2:
+  version "2.0.3"
+  resolved "https://registry.yarnpkg.com/unist-util-visit/-/unist-util-visit-2.0.3.tgz#c3703893146df47203bb8a9795af47d7b971208c"
+  integrity sha512-iJ4/RczbJMkD0712mGktuGpm/U4By4FfDonL7N/9tATGIF4imikjOuagyMY53tnZq3NP6BcmlrHhEKAfGWjh7Q==
+  dependencies:
+    "@types/unist" "^2.0.0"
+    unist-util-is "^4.0.0"
+    unist-util-visit-parents "^3.0.0"
+
 universal-user-agent@^2.0.0, universal-user-agent@^2.0.1:
   version "2.0.3"
   resolved "https://registry.yarnpkg.com/universal-user-agent/-/universal-user-agent-2.0.3.tgz#9f6f09f9cc33de867bb720d84c08069b14937c6c"
@@ -28418,6 +28819,11 @@ universalify@^0.1.0:
   resolved "https://registry.yarnpkg.com/universalify/-/universalify-0.1.2.tgz#b646f69be3942dabcecc9d6639c80dc105efaa66"
   integrity sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==
 
+universalify@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/universalify/-/universalify-1.0.0.tgz#b61a1da173e8435b2fe3c67d29b9adf8594bd16d"
+  integrity sha512-rb6X1W158d7pRQBg5gkR8uPaSfiids68LTJQYOtEUhoJUWBdaQHsuT/EUduxXYxcrt4r5PJ4fuHW1MHT6p0qug==
+
 unlazy-loader@^0.1.3:
   version "0.1.3"
   resolved "https://registry.yarnpkg.com/unlazy-loader/-/unlazy-loader-0.1.3.tgz#2efdf05c489da311055586bf3cfca0c541dd8fa5"
@@ -28458,11 +28864,6 @@ unstated@^2.1.1:
   dependencies:
     create-react-context "^0.1.5"
 
-untildify@4.0.0:
-  version "4.0.0"
-  resolved "https://registry.yarnpkg.com/untildify/-/untildify-4.0.0.tgz#2bc947b953652487e4600949fb091e3ae8cd919b"
-  integrity sha512-KK8xQ1mkzZeg9inewmFVDNkg3l5LUhoq9kN6iWYB/CC9YMG8HA+c1Q8HwDe6dEX7kErrEVNVBO3fWsVq5iDgtw==
-
 untildify@^2.0.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/untildify/-/untildify-2.1.0.tgz#17eb2807987f76952e9c0485fc311d06a826a2e0"
@@ -28475,6 +28876,11 @@ untildify@^3.0.3:
   resolved "https://registry.yarnpkg.com/untildify/-/untildify-3.0.3.tgz#1e7b42b140bcfd922b22e70ca1265bfe3634c7c9"
   integrity sha512-iSk/J8efr8uPT/Z4eSUywnqyrQU7DSdMfdqK4iWEaUVVmcP5JcnpRqmVMwcwcnmI1ATFNgC5V90u09tBynNFKA==
 
+untildify@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/untildify/-/untildify-4.0.0.tgz#2bc947b953652487e4600949fb091e3ae8cd919b"
+  integrity sha512-KK8xQ1mkzZeg9inewmFVDNkg3l5LUhoq9kN6iWYB/CC9YMG8HA+c1Q8HwDe6dEX7kErrEVNVBO3fWsVq5iDgtw==
+
 unzip-response@^1.0.0:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/unzip-response/-/unzip-response-1.0.2.tgz#b984f0877fc0a89c2c773cc1ef7b5b232b5b06fe"
@@ -28622,7 +29028,7 @@ url-to-options@^1.0.1:
   resolved "https://registry.yarnpkg.com/url-to-options/-/url-to-options-1.0.1.tgz#1505a03a289a48cbd7a434efbaeec5055f5633a9"
   integrity sha1-FQWgOiiaSMvXpDTvuu7FBV9WM6k=
 
-url@0.11.0, url@^0.11.0:
+url@^0.11.0:
   version "0.11.0"
   resolved "https://registry.yarnpkg.com/url/-/url-0.11.0.tgz#3838e97cfc60521eb73c525a8e55bfdd9e2e28f1"
   integrity sha1-ODjpfPxgUh63PFJajlW/3Z4uKPE=
@@ -29179,6 +29585,14 @@ vfile-location@^2.0.0:
   resolved "https://registry.yarnpkg.com/vfile-location/-/vfile-location-2.0.2.tgz#d3675c59c877498e492b4756ff65e4af1a752255"
   integrity sha1-02dcWch3SY5JK0dW/2Xkrxp1IlU=
 
+vfile-message@*:
+  version "2.0.4"
+  resolved "https://registry.yarnpkg.com/vfile-message/-/vfile-message-2.0.4.tgz#5b43b88171d409eae58477d13f23dd41d52c371a"
+  integrity sha512-DjssxRGkMvifUOJre00juHoP9DPWuzjxKuMDrhNbk2TdaYYBNMStsNhEOt3idrtI12VQYM/1+iM0KOzXi4pxwQ==
+  dependencies:
+    "@types/unist" "^2.0.0"
+    unist-util-stringify-position "^2.0.0"
+
 vfile-message@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/vfile-message/-/vfile-message-1.0.0.tgz#a6adb0474ea400fa25d929f1d673abea6a17e359"
@@ -29247,6 +29661,17 @@ vfile@^4.0.0:
     unist-util-stringify-position "^2.0.0"
     vfile-message "^2.0.0"
 
+vfile@^4.1.1:
+  version "4.2.0"
+  resolved "https://registry.yarnpkg.com/vfile/-/vfile-4.2.0.tgz#26c78ac92eb70816b01d4565e003b7e65a2a0e01"
+  integrity sha512-a/alcwCvtuc8OX92rqqo7PflxiCgXRFjdyoGVuYV+qbgCb0GgZJRvIgCD4+U/Kl1yhaRsaTwksF88xbPyGsgpw==
+  dependencies:
+    "@types/unist" "^2.0.0"
+    is-buffer "^2.0.0"
+    replace-ext "1.0.0"
+    unist-util-stringify-position "^2.0.0"
+    vfile-message "^2.0.0"
+
 vinyl-file@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/vinyl-file/-/vinyl-file-2.0.0.tgz#a7ebf5ffbefda1b7d18d140fcb07b223efb6751a"
@@ -29492,6 +29917,11 @@ wcwidth@^1.0.1:
   dependencies:
     defaults "^1.0.3"
 
+web-namespaces@^1.0.0:
+  version "1.1.4"
+  resolved "https://registry.yarnpkg.com/web-namespaces/-/web-namespaces-1.1.4.tgz#bc98a3de60dadd7faefc403d1076d529f5e030ec"
+  integrity sha512-wYxSGajtmoP4WxfejAPIr4l0fVh+jeMXZb08wNc0tMg6xsfZXj3cECqIK0G7ZAqUq0PP8WlMDtaOGVBTAWztNw==
+
 web-namespaces@^1.1.2:
   version "1.1.2"
   resolved "https://registry.yarnpkg.com/web-namespaces/-/web-namespaces-1.1.2.tgz#c8dc267ab639505276bae19e129dbd6ae72b22b4"
@@ -30666,3 +31096,8 @@ zlib@^1.0.5:
   version "1.0.5"
   resolved "https://registry.yarnpkg.com/zlib/-/zlib-1.0.5.tgz#6e7c972fc371c645a6afb03ab14769def114fcc0"
   integrity sha1-bnyXL8NxxkWmr7A6sUdp3vEU/MA=
+
+zwitch@^1.0.0:
+  version "1.0.5"
+  resolved "https://registry.yarnpkg.com/zwitch/-/zwitch-1.0.5.tgz#d11d7381ffed16b742f6af7b3f223d5cd9fe9920"
+  integrity sha512-V50KMwwzqJV0NpZIZFwfOD5/lyny3WlSzRiXgA0G7VUnRlqttta1L6UQIHzd6EuBY/cHGfwTIck7w1yH6Q5zUw==